Command Reference for AlliedWare Plus™ Version 5.4.9-0.x

Allied Telesis AT-IE210L-10GP-60 User Manual

Displayed below is the user manual for AT-IE210L-10GP-60 by Allied Telesis which is a product in the Network Switches category. This manual has pages.

Related Manuals

Allied Telesis AT-CV5001AC-60 Manual

Allied Telesis AT-CVMNT12 Manual

Allied Telesis AT-STACKXG-00 Manual

Allied Telesis AT-SBX31GS24 Manual

Allied Telesis AT-2911SX/LC-901 Manual

Allied Telesis MC102XLPCI Manual

Allied Telesis AT-9000/28SP-E-50 Manual

Allied Telesis 2716POE/FXSC Manual

C613-50292-01 Rev A

IE210L Series

INDUSTRIAL-LITE ETHERNET LAYER 2 SWITCHES

Command Reference for

AlliedWare Plus™ Version 5.4.9-0.x

IE210L-10GP

IE210L-18GP

Acknowledgments

This product includes software developed by the University of California, Berkeley and its contributors.

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. For information about this see

www.openssl.org/

This product includes software licensed under v2 and v3 of the GNU General Public License, available from: www.gnu.org/licenses/

gpl2.html and www.gnu.org/licenses/gpl.html respectively.

Source code for all GPL licensed software in this product can be obtained from the Allied Telesis GPL Code Download Center at:

www.alliedtelesis.com/support/

Allied Telesis is committed to meeting the requirements of the open source licenses including the GNU General Public License (GPL) and

will make all required source code available.

If you would like a copy of the GPL source code contained in Allied Telesis products, please send us a request by registered mail including

a check for US$15 to cover production and shipping costs and a CD with the GPL code will be mailed to you.

GPL Code Request

Allied Telesis Labs (Ltd)

PO Box 8011

Christchurch

New Zealand

Allied Telesis, AlliedWare Plus, Allied Telesis Management Framework, EPSRing, SwitchBlade, VCStack, and VCStack Plus are trademarks or

registered trademarks in the United States and elsewhere of Allied Telesis, Inc.

Microsoft and Internet Explorer are registered trademarks of Microsoft Corporation. All other product names, company names, logos or

other designations mentioned herein may be trademarks or registered trademarks of their respective owners.

 2019 Allied Telesis, Inc.

Allied Telesis, Inc. reserves the right to make changes in specifications and other information contained in this document without prior

written notice. The information provided herein is subject to change without notice. In no event shall Allied Telesis, Inc. be liable for any

incidental, special, indirect, or consequential damages whatsoever, including but not limited to lost profits, arising out of or related to this

manual or the information contained herein, even if Allied Telesis, Inc. has been advised of, known, or should have known, the possibility

of such damages.

C613-50292-01 Rev A Command Reference for IE210L Series 3

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Contents

PART 1: Setup and Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . .72

Chapter 1: CLI Navigation Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73

configure terminal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74

disable (Privileged Exec mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75

do . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .76

enable (Privileged Exec mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77

end . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79

exit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80

help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .81

logout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82

show history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83

Chapter 2: File and Configuration Management Commands . . . . . . . . . . . . . . . 84

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .84

autoboot enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87

boot config-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .88

boot config-file backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90

boot system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91

boot system backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93

cd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .94

copy (filename) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95

copy current-software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .97

copy debug . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .98

copy running-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99

copy startup-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

copy zmodem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

create autoboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

delete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

delete debug . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

dir . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

edit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

edit (filename) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

C613-50292-01 Rev A Command Reference for IE210L Series 4

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

erase factory-default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

erase startup-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

ip tftp source-interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

ipv6 tftp source-interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

mkdir . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

move . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

move debug . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

pwd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

rmdir . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

show autoboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

show boot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

show file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

show file systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

show running-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

show running-config interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

show startup-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

show version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

unmount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

write file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

write memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

write terminal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

Chapter 3: User Access Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

aaa authentication enable default local . . . . . . . . . . . . . . . . . . . . . . . 137

aaa local authentication attempts lockout-time . . . . . . . . . . . . . . . . . . 138

aaa local authentication attempts max-fail . . . . . . . . . . . . . . . . . . . . . 139

aaa login fail-delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

clear aaa local user lockout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

clear line console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

clear line vty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

enable password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

enable secret . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

exec-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

flowcontrol hardware (asyn/console) . . . . . . . . . . . . . . . . . . . . . . . . 152

length (asyn) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

privilege level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

security-password history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

security-password forced-change . . . . . . . . . . . . . . . . . . . . . . . . . . 159

security-password lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

security-password min-lifetime-enforce . . . . . . . . . . . . . . . . . . . . . . 161

security-password minimum-categories . . . . . . . . . . . . . . . . . . . . . . 162

security-password minimum-length . . . . . . . . . . . . . . . . . . . . . . . . . 163

security-password reject-expired-pwd . . . . . . . . . . . . . . . . . . . . . . . 164

security-password warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

service advanced-vty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

service password-encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

service telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

service terminal-length (deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

show aaa local user locked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

show privilege . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

show security-password configuration . . . . . . . . . . . . . . . . . . . . . . . 172

C613-50292-01 Rev A Command Reference for IE210L Series 5

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show security-password user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

show telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

show users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

telnet server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

terminal length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

terminal resize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

username . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

Chapter 4: Feature Licensing Commands . . . . . . . . . . . . . . . . . . . . . . . . . . 182

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

license . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

show license . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

show license brief . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Chapter 5: Subscription Licensing Commands . . . . . . . . . . . . . . . . . . . . . . . 189

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

license update (filename) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

license update online . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

show license external . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

Chapter 6: GUI Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

atmf topology-gui enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

gui-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

http port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

http secure-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

log event-host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

service http . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

show http . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

Chapter 7: System Configuration and Monitoring Commands . . . . . . . . . . . . 201

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

banner exec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

banner login (system) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

banner motd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

clock set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

clock summer-time date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

clock summer-time recurring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

clock timezone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

ecofriendly led . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

findme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

findme trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

hostname . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

no debug all . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

reload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

show clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

show cpu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

show cpu history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

show debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

show ecofriendly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

C613-50292-01 Rev A Command Reference for IE210L Series 6

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show interface memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

show memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236

show memory allocations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

show memory history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

show memory pools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

show memory shared . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

show process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

show reboot history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

show router-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

show system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

show system environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

show system interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

show system mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

show system serialnumber . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

show tech-support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252

speed (asyn) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

system territory (deprecated) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

terminal monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

undebug all . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

Chapter 8: Pluggables and Cabling Commands . . . . . . . . . . . . . . . . . . . . . . 259

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

clear fiber-monitoring interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260

clear test cable-diagnostics tdr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

debug fiber-monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

fiber-monitoring action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264

fiber-monitoring baseline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266

fiber-monitoring enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

fiber-monitoring interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

fiber-monitoring sensitivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

show system fiber-monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272

show system pluggable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

show system pluggable detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

show system pluggable diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . 280

show test cable-diagnostics tdr . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282

test cable-diagnostics tdr interface . . . . . . . . . . . . . . . . . . . . . . . . . . 283

Chapter 9: Connectivity Fault Management Commands . . . . . . . . . . . . . . . . 284

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284

cc interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286

cc multicast . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

cc unicast . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

clear (MEP Attribute) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

clear ethernet cfm errorlog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291

clear mep counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

ethernet cfm domain-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

ethernet cfm mep . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296

mep (FNG attributes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298

mep active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300

mep ccm-ltm-priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302

mep crosscheck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

service ma-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

C613-50292-01 Rev A Command Reference for IE210L Series 7

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show ethernet cfm details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

show ethernet cfm domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314

show ethernet cfm errorlog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

show ethernet cfm maintenance-points local mep . . . . . . . . . . . . . . . . 319

show ethernet cfm maintenance-points remote mep . . . . . . . . . . . . . . 325

show ethernet cfm service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328

show mep-alarm status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

Chapter 10: Logging Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332

clear exception log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

clear log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

clear log buffered . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336

clear log external . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337

clear log permanent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338

copy buffered-log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339

copy permanent-log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340

default log buffered . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341

default log console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

default log email . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343

default log external . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344

default log host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345

default log monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346

default log permanent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347

log buffered . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348

log buffered (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349

log buffered exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352

log buffered size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

log console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356

log console (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357

log console exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360

log email . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363

log email (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364

log email exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367

log email time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370

log external . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372

log external (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374

log external exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377

log external rotate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380

log external size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382

log facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383

log host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385

log host (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387

log host exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390

log host source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393

log host startup-delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394

log host time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396

log monitor (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398

log monitor exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401

log permanent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404

log permanent (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405

log permanent exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408

log permanent size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411

C613-50292-01 Rev A Command Reference for IE210L Series 8

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

log-rate-limit nsm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412

log trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413

show counter log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414

show exception log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415

show log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416

show log config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418

show log external . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420

show log permanent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421

show running-config log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422

unmount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423

Chapter 11: Scripting Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 424

activate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425

echo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426

wait . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427

Chapter 12: Interface Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428

description (interface) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429

interface (to configure) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430

mru . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432

mtu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433

service statistics interfaces counter . . . . . . . . . . . . . . . . . . . . . . . . . . 434

show interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435

show interface brief . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438

show interface memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439

show interface status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441

shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 443

Chapter 13: Port Mirroring and Remote Mirroring Commands . . . . . . . . . . . . . 444

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444

mirror interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445

remote-mirror interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447

show mirror . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449

show mirror interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450

show remote-mirror . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451

switchport remote-mirror-egress . . . . . . . . . . . . . . . . . . . . . . . . . . . 453

vlan mode remote-mirror-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . 454

Chapter 14: Alarm Monitoring Commands . . . . . . . . . . . . . . . . . . . . . . . . . . 456

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456

alarm facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457

debug alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460

show alarm settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461

show debugging alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462

show facility-alarm status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463

PART 2: Interfaces and Layer 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 464

Chapter 15: Switching Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465

C613-50292-01 Rev A Command Reference for IE210L Series 9

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 465

backpressure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467

clear loop-protection counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469

clear mac address-table dynamic . . . . . . . . . . . . . . . . . . . . . . . . . . . 470

clear mac address-table static . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472

clear port counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473

clear port-security intrusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474

debug loopprot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477

debug platform packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478

duplex . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480

flowcontrol (switch port) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481

linkflap action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483

loop-protection loop-detect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484

loop-protection action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485

loop-protection action-delay-time . . . . . . . . . . . . . . . . . . . . . . . . . . 486

loop-protection timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487

mac address-table acquire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488

mac address-table ageing-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489

mac address-table logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490

mac address-table static . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491

mac address-table thrash-limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492

platform hwfilter-size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493

platform l3-vlan-hashing-algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 494

platform load-balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495

platform mac-vlan-hashing-algorithm . . . . . . . . . . . . . . . . . . . . . . . . 496

platform multicast-ratelimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497

platform stop-unreg-mc-flooding . . . . . . . . . . . . . . . . . . . . . . . . . . 498

platform vlan-stacking-tpid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500

polarity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501

show debugging loopprot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502

show debugging platform packet . . . . . . . . . . . . . . . . . . . . . . . . . . 503

show flowcontrol interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504

show interface err-disabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505

show interface switchport . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506

show loop-protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507

show mac address-table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509

show mac address-table thrash-limit . . . . . . . . . . . . . . . . . . . . . . . . 511

show platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 512

show platform classifier statistics utilization brief . . . . . . . . . . . . . . . . . 515

show platform port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 518

show port-security interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 520

show port-security intrusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521

show storm-control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522

speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523

storm-control level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525

switchport port-security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526

switchport port-security aging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527

switchport port-security maximum . . . . . . . . . . . . . . . . . . . . . . . . . 528

switchport port-security violation . . . . . . . . . . . . . . . . . . . . . . . . . . 529

thrash-limiting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530

undebug loopprot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532

undebug platform packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533

C613-50292-01 Rev A Command Reference for IE210L Series 10

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Chapter 16: VLAN Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 534

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 534

debug private-vlan ufo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536

port-vlan-forwarding-priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537

private-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540

private-vlan association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542

platform vlan-stacking-tpid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543

private-vlan ufo trap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 544

show debugging private-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545

show port-vlan-forwarding-priority . . . . . . . . . . . . . . . . . . . . . . . . . 546

show vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547

show vlan access-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 548

show vlan filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549

show vlan private-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550

show vlan private-vlan ufo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551

switchport access vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552

switchport mode access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553

switchport mode private-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554

switchport mode private-vlan trunk promiscuous . . . . . . . . . . . . . . . . 555

switchport mode private-vlan trunk secondary . . . . . . . . . . . . . . . . . . 557

switchport mode private-vlan ufo . . . . . . . . . . . . . . . . . . . . . . . . . . 559

switchport mode trunk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561

switchport private-vlan host-association . . . . . . . . . . . . . . . . . . . . . . 562

switchport private-vlan mapping . . . . . . . . . . . . . . . . . . . . . . . . . . . 563

switchport trunk allowed vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564

switchport trunk native vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567

switchport vlan-stacking (double tagging) . . . . . . . . . . . . . . . . . . . . . 568

switchport voice dscp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 569

switchport voice vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 570

switchport voice vlan priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 572

vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573

vlan access-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 574

vlan database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575

vlan filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 576

Chapter 17: Spanning Tree Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 577

clear spanning-tree statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579

clear spanning-tree detected protocols (RSTP and MSTP) . . . . . . . . . . . 580

debug mstp (RSTP and STP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581

instance priority (MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585

instance vlan (MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587

region (MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 589

revision (MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590

show debugging mstp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591

show spanning-tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592

show spanning-tree brief . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 595

show spanning-tree mst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596

show spanning-tree mst config . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597

show spanning-tree mst detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598

show spanning-tree mst detail interface . . . . . . . . . . . . . . . . . . . . . . 600

show spanning-tree mst instance . . . . . . . . . . . . . . . . . . . . . . . . . . . 602

C613-50292-01 Rev A Command Reference for IE210L Series 11

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show spanning-tree mst instance interface . . . . . . . . . . . . . . . . . . . . 603

show spanning-tree mst interface . . . . . . . . . . . . . . . . . . . . . . . . . . 604

show spanning-tree statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605

show spanning-tree statistics instance . . . . . . . . . . . . . . . . . . . . . . . 607

show spanning-tree statistics instance interface . . . . . . . . . . . . . . . . . 608

show spanning-tree statistics interface . . . . . . . . . . . . . . . . . . . . . . . 610

show spanning-tree vlan range-index . . . . . . . . . . . . . . . . . . . . . . . . 612

spanning-tree autoedge (RSTP and MSTP) . . . . . . . . . . . . . . . . . . . . . 613

spanning-tree bpdu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 614

spanning-tree cisco-interoperability (MSTP) . . . . . . . . . . . . . . . . . . . . 616

spanning-tree edgeport (RSTP and MSTP) . . . . . . . . . . . . . . . . . . . . . 617

spanning-tree enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618

spanning-tree errdisable-timeout enable . . . . . . . . . . . . . . . . . . . . . . 620

spanning-tree errdisable-timeout interval . . . . . . . . . . . . . . . . . . . . . 621

spanning-tree force-version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 622

spanning-tree forward-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623

spanning-tree guard root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624

spanning-tree hello-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625

spanning-tree link-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626

spanning-tree max-age . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627

spanning-tree max-hops (MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . 628

spanning-tree mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629

spanning-tree mst configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . 630

spanning-tree mst instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 631

spanning-tree mst instance path-cost . . . . . . . . . . . . . . . . . . . . . . . . 632

spanning-tree mst instance priority . . . . . . . . . . . . . . . . . . . . . . . . . 634

spanning-tree mst instance restricted-role . . . . . . . . . . . . . . . . . . . . . 635

spanning-tree mst instance restricted-tcn . . . . . . . . . . . . . . . . . . . . . 637

spanning-tree path-cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 638

spanning-tree portfast (STP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639

spanning-tree portfast bpdu-filter . . . . . . . . . . . . . . . . . . . . . . . . . . 641

spanning-tree portfast bpdu-guard . . . . . . . . . . . . . . . . . . . . . . . . . 643

spanning-tree priority (bridge priority) . . . . . . . . . . . . . . . . . . . . . . . 645

spanning-tree priority (port priority) . . . . . . . . . . . . . . . . . . . . . . . . . 646

spanning-tree restricted-role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647

spanning-tree restricted-tcn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 648

spanning-tree transmit-holdcount . . . . . . . . . . . . . . . . . . . . . . . . . . 649

undebug mstp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650

Chapter 18: Unidirectional Link Detection (UDLD) Commands . . . . . . . . . . . . . 651

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651

debug udld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652

show debugging udld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653

show udld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 654

show udld neighbors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655

show udld port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656

udld aggressive-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657

udld enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658

udld port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659

udld port aggressive-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660

udld port disable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661

udld reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662

udld time disable-period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 663

C613-50292-01 Rev A Command Reference for IE210L Series 12

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

udld time message-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 664

undebug udld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665

Chapter 19: Link Aggregation Commands . . . . . . . . . . . . . . . . . . . . . . . . . . 666

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 666

channel-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668

clear lacp counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670

debug lacp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671

lacp global-passive-mode enable . . . . . . . . . . . . . . . . . . . . . . . . . . . 672

lacp port-priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673

lacp system-priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674

lacp timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675

platform load-balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677

show debugging lacp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678

show diagnostic channel-group . . . . . . . . . . . . . . . . . . . . . . . . . . . 679

show etherchannel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 681

show etherchannel detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 682

show etherchannel summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683

show lacp sys-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 684

show lacp-counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685

show port etherchannel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686

show static-channel-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687

static-channel-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688

undebug lacp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690

Chapter 20: Power over Ethernet Commands . . . . . . . . . . . . . . . . . . . . . . . . 691

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 691

clear power-inline counters interface . . . . . . . . . . . . . . . . . . . . . . . . 693

debug power-inline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694

power-inline allow-legacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 696

power-inline description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 697

power-inline enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 698

power-inline max . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 699

power-inline priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701

power-inline usage-threshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703

service power-inline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704

show debugging power-inline . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705

show power-inline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 706

show power-inline counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709

show power-inline interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711

show power-inline interface detail . . . . . . . . . . . . . . . . . . . . . . . . . . 714

Chapter 21: GVRP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717

clear gvrp statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 718

debug gvrp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 719

gvrp (interface) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 721

gvrp dynamic-vlan-creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 722

gvrp enable (global) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723

gvrp registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724

gvrp timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725

show debugging gvrp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726

C613-50292-01 Rev A Command Reference for IE210L Series 13

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show gvrp configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 727

show gvrp machine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 728

show gvrp statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 729

show gvrp timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 730

PART 3: Layer 3 Switching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 731

Chapter 22: IP Addressing and Protocol Commands . . . . . . . . . . . . . . . . . . . . 732

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 732

arp-aging-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734

arp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 735

arp log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 736

arp opportunistic-nd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739

arp-reply-bc-dmac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740

clear arp-cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 741

debug ip packet interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 742

ip address (IP Addressing and Protocol) . . . . . . . . . . . . . . . . . . . . . . . 744

ip gratuitous-arp-link . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 746

ip redirects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748

ip tcp synack-retries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 749

ip unreachables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 750

ping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 752

show arp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 753

show debugging ip packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 754

show ip flooding-nexthops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756

show ip interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757

show ip sockets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 758

show ip traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761

tcpdump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763

traceroute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764

undebug ip packet interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 765

Chapter 23: Domain Name Service (DNS) Commands . . . . . . . . . . . . . . . . . . . 766

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 766

ip domain-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767

ip domain-lookup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 768

ip domain-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769

ip name-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 770

ip name-server preferred-order . . . . . . . . . . . . . . . . . . . . . . . . . . . . 772

show hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773

show ip domain-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 774

show ip domain-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775

show ip name-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776

Chapter 24: IPv6 Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 777

clear ipv6 neighbors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 779

ipv6 address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780

ipv6 address autoconfig . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 782

ipv6 address suffix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784

ipv6 enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 785

ipv6 eui64-linklocal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787

C613-50292-01 Rev A Command Reference for IE210L Series 14

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ipv6 forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788

ipv6 multicast forward-slow-path-packet . . . . . . . . . . . . . . . . . . . . . . 789

ipv6 nd accept-ra-pinfo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 790

ipv6 nd current-hoplimit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 791

ipv6 nd managed-config-flag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792

ipv6 nd minimum-ra-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 793

ipv6 nd other-config-flag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794

ipv6 nd prefix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795

ipv6 nd ra-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 797

ipv6 nd ra-lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 798

ipv6 nd raguard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 799

ipv6 nd reachable-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 801

ipv6 nd retransmission-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 802

ipv6 nd suppress-ra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803

ipv6 neighbor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804

ipv6 opportunistic-nd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 805

ipv6 unreachables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 806

optimistic-nd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 807

ping ipv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 808

show ipv6 forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810

show ipv6 interface brief . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811

show ipv6 neighbors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812

show ipv6 route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813

show ipv6 route summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815

traceroute ipv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816

Chapter 25: Routing Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 817

ip route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818

ipv6 route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820

maximum-paths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 821

show ip route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 822

show ip route database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 824

show ip route summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 825

show ipv6 route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826

show ipv6 route summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828

PART 4: Multicast Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829

Chapter 26: IGMP and IGMP Snooping Commands . . . . . . . . . . . . . . . . . . . . . 830

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 830

clear ip igmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 832

clear ip igmp group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 833

clear ip igmp interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 834

debug igmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 835

ip igmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836

ip igmp access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837

ip igmp flood specific-query . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 838

ip igmp immediate-leave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 839

ip igmp last-member-query-count . . . . . . . . . . . . . . . . . . . . . . . . . . 840

ip igmp last-member-query-interval . . . . . . . . . . . . . . . . . . . . . . . . . 841

ip igmp limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 842

C613-50292-01 Rev A Command Reference for IE210L Series 15

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ip igmp maximum-groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 843

ip igmp querier-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 845

ip igmp query-holdtime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 846

ip igmp query-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 848

ip igmp query-max-response-time . . . . . . . . . . . . . . . . . . . . . . . . . . 850

ip igmp ra-option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852

ip igmp robustness-variable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 853

ip igmp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 854

ip igmp snooping fast-leave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 855

ip igmp snooping mrouter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 856

ip igmp snooping querier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 857

ip igmp snooping report-suppression . . . . . . . . . . . . . . . . . . . . . . . . 858

ip igmp snooping routermode . . . . . . . . . . . . . . . . . . . . . . . . . . . . 859

ip igmp snooping source-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . 861

ip igmp snooping tcn query solicit . . . . . . . . . . . . . . . . . . . . . . . . . . 862

ip igmp source-address-check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 864

ip igmp static-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 865

ip igmp startup-query-count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 867

ip igmp startup-query-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . 868

ip igmp trusted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 869

ip igmp version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 870

show debugging igmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 871

show ip igmp groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 872

show ip igmp interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 874

show ip igmp snooping mrouter . . . . . . . . . . . . . . . . . . . . . . . . . . . 876

show ip igmp snooping routermode . . . . . . . . . . . . . . . . . . . . . . . . . 877

show ip igmp snooping source-timeout . . . . . . . . . . . . . . . . . . . . . . 878

show ip igmp snooping statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . 879

undebug igmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 881

Chapter 27: MLD Snooping Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . 882

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 882

clear ipv6 mld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 883

clear ipv6 mld group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 884

clear ipv6 mld interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885

debug mld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886

ipv6 mld immediate-leave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 887

ipv6 mld limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888

ipv6 mld snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890

ipv6 mld snooping fast-leave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 892

ipv6 mld snooping mrouter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893

ipv6 mld snooping querier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 895

ipv6 mld snooping report-suppression . . . . . . . . . . . . . . . . . . . . . . . 896

ipv6 mld static-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 898

show debugging mld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 900

show ipv6 mld groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901

show ipv6 mld interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 902

show ipv6 mld snooping mrouter . . . . . . . . . . . . . . . . . . . . . . . . . . 903

show ipv6 mld snooping statistics . . . . . . . . . . . . . . . . . . . . . . . . . . 904

PART 5: Access and Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 905

C613-50292-01 Rev A Command Reference for IE210L Series 16

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Chapter 28: IPv4 Hardware Access Control List (ACL) Commands . . . . . . . . . . . 906

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 906

access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 909

access-list (numbered hardware ACL for ICMP) . . . . . . . . . . . . . . . . . . 911

access-list (numbered hardware ACL for IP packets) . . . . . . . . . . . . . . . 915

access-list (numbered hardware ACL for IP protocols) . . . . . . . . . . . . . . 918

access-list (numbered hardware ACL for MAC addresses) . . . . . . . . . . . 923

access-list (numbered hardware ACL for TCP or UDP) . . . . . . . . . . . . . . 926

access-list hardware (named hardware ACL) . . . . . . . . . . . . . . . . . . . . 930

(named hardware ACL entry for ICMP) . . . . . . . . . . . . . . . . . . . . . . . . 932

(named hardware ACL entry for IP packets) . . . . . . . . . . . . . . . . . . . . 936

(named hardware ACL entry for IP protocols) . . . . . . . . . . . . . . . . . . . 940

(named hardware ACL entry for MAC addresses) . . . . . . . . . . . . . . . . . 945

(named hardware ACL entry for TCP or UDP) . . . . . . . . . . . . . . . . . . . 948

commit (IPv4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 952

show access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953

show access-list (IPv4 Hardware ACLs) . . . . . . . . . . . . . . . . . . . . . . . 954

show interface access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 956

Chapter 29: IPv4 Software Access Control List (ACL) Commands . . . . . . . . . . . . 957

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 957

access-list extended (named) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 959

access-list (extended numbered) . . . . . . . . . . . . . . . . . . . . . . . . . . . 967

(access-list extended ICMP filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . 970

(access-list extended IP filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 972

(access-list extended IP protocol filter) . . . . . . . . . . . . . . . . . . . . . . . 975

(access-list extended TCP UDP filter) . . . . . . . . . . . . . . . . . . . . . . . . . 979

access-list standard (named) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 981

access-list (standard numbered) . . . . . . . . . . . . . . . . . . . . . . . . . . . 983

(access-list standard named filter) . . . . . . . . . . . . . . . . . . . . . . . . . . 985

(access-list standard numbered filter) . . . . . . . . . . . . . . . . . . . . . . . . 987

maximum-access-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 989

show access-list (IPv4 Software ACLs) . . . . . . . . . . . . . . . . . . . . . . . . 990

show ip access-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 992

vty access-class (numbered) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993

Chapter 30: IPv6 Hardware Access Control List (ACL) Commands . . . . . . . . . . . 994

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 994

commit (IPv6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 996

ipv6 access-list (named IPv6 hardware ACL) . . . . . . . . . . . . . . . . . . . . 997

(named IPv6 hardware ACL: ICMP entry) . . . . . . . . . . . . . . . . . . . . . . 999

(named IPv6 hardware ACL: IPv6 packet entry) . . . . . . . . . . . . . . . . . 1003

(named IPv6 hardware ACL: IP protocol entry) . . . . . . . . . . . . . . . . . 1006

(named IPv6 hardware ACL: TCP or UDP entry) . . . . . . . . . . . . . . . . . 1011

ipv6 traffic-filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1015

show ipv6 access-list (IPv6 Hardware ACLs) . . . . . . . . . . . . . . . . . . . 1016

Chapter 31: IPv6 Software Access Control List (ACL) Commands . . . . . . . . . . . 1017

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1017

ipv6 access-list standard (named) . . . . . . . . . . . . . . . . . . . . . . . . . . 1019

(ipv6 access-list standard filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1021

show ipv6 access-list (IPv6 Software ACLs) . . . . . . . . . . . . . . . . . . . . 1023

C613-50292-01 Rev A Command Reference for IE210L Series 17

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

vty ipv6 access-class (named) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1024

Chapter 32: QoS Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1025

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1025

class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027

class-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1028

clear mls qos interface policer-counters . . . . . . . . . . . . . . . . . . . . . . 1029

default-action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1030

description (QoS policy-map) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1031

egress-rate-limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1032

match access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1033

match cos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1035

match dscp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1036

match eth-format protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1037

match inner-cos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1040

match inner-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1041

match ip-precedence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1042

match mac-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1043

match tcp-flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1044

match vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1045

mls qos cos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1046

mls qos enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1047

mls qos map cos-queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1048

mls qos map premark-dscp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1049

no police . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1051

police single-rate action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1052

police twin-rate action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1054

policy-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1056

priority-queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1057

remark-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1058

remark new-cos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1060

service-policy input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1062

show class-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1063

show mls qos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1064

show mls qos interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1065

show mls qos interface policer-counters . . . . . . . . . . . . . . . . . . . . . 1068

show mls qos interface queue-counters . . . . . . . . . . . . . . . . . . . . . 1069

show mls qos interface storm-status . . . . . . . . . . . . . . . . . . . . . . . . 1070

show mls qos maps cos-queue . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071

show mls qos maps premark-dscp . . . . . . . . . . . . . . . . . . . . . . . . . 1072

show platform classifier statistics utilization brief . . . . . . . . . . . . . . . . 1073

show policy-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1076

storm-action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077

storm-downtime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1078

storm-protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079

storm-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1080

storm-window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1081

trust dscp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1082

wrr-queue disable queues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1083

wrr-queue egress-rate-limit queues . . . . . . . . . . . . . . . . . . . . . . . . 1084

wrr-queue weight queues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1085

C613-50292-01 Rev A Command Reference for IE210L Series 18

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Chapter 33: 802.1X Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1086

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1086

dot1x accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1088

dot1x authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1089

debug dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1090

dot1x control-direction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1091

dot1x eap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1093

dot1x eapol-version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1094

dot1x initialize interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1096

dot1x initialize supplicant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1097

dot1x keytransmit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1098

dot1x max-auth-fail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099

dot1x max-reauth-req . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1101

dot1x port-control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1103

dot1x timeout tx-period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1105

show debugging dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1107

show dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1108

show dot1x diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1111

show dot1x interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1113

show dot1x sessionstatistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118

show dot1x statistics interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119

show dot1x supplicant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120

show dot1x supplicant interface . . . . . . . . . . . . . . . . . . . . . . . . . . 1122

undebug dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125

Chapter 34: Authentication Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 1126

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1126

auth auth-fail vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129

auth critical . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1131

auth dhcp-framed-ip-lease . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1132

auth dynamic-vlan-creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1134

auth guest-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1137

auth guest-vlan forward . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1139

auth host-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141

auth log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1143

auth max-supplicant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145

auth multi-vlan-session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147

auth profile (Global Configuration) . . . . . . . . . . . . . . . . . . . . . . . . . 1148

auth profile (Interface Configuration) . . . . . . . . . . . . . . . . . . . . . . . 1149

auth reauthentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1150

auth roaming disconnected . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1151

auth roaming enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1153

auth supplicant-ip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1155

auth supplicant-mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1157

auth timeout connect-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . 1160

auth timeout quiet-period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1162

auth timeout reauth-period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1163

auth timeout server-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1165

auth timeout supp-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1167

auth two-step enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1169

auth-mac accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1172

auth-mac authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1173

C613-50292-01 Rev A Command Reference for IE210L Series 19

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

auth-mac enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1174

auth-mac method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1176

auth-mac password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1178

auth-mac reauth-relearning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1179

auth-mac static . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1181

auth-mac username . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1182

auth-web accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1183

auth-web authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1184

auth-web enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1185

auth-web forward . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1187

auth-web max-auth-fail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1190

auth-web method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1192

auth-web-server blocking-mode . . . . . . . . . . . . . . . . . . . . . . . . . . 1193

auth-web-server dhcp ipaddress . . . . . . . . . . . . . . . . . . . . . . . . . . 1194

auth-web-server dhcp lease . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1195

auth-web-server dhcp-wpad-option . . . . . . . . . . . . . . . . . . . . . . . . 1196

auth-web-server host-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1197

auth-web-server intercept-port . . . . . . . . . . . . . . . . . . . . . . . . . . . 1198

auth-web-server ipaddress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1199

auth-web-server page language . . . . . . . . . . . . . . . . . . . . . . . . . . 1200

auth-web-server login-url . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1201

auth-web-server page logo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1202

auth-web-server page sub-title . . . . . . . . . . . . . . . . . . . . . . . . . . . 1203

auth-web-server page success-message . . . . . . . . . . . . . . . . . . . . . 1204

auth-web-server page title . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1205

auth-web-server page welcome-message . . . . . . . . . . . . . . . . . . . . 1206

auth-web-server ping-poll enable . . . . . . . . . . . . . . . . . . . . . . . . . 1207

auth-web-server ping-poll failcount . . . . . . . . . . . . . . . . . . . . . . . . 1208

auth-web-server ping-poll interval . . . . . . . . . . . . . . . . . . . . . . . . . 1209

auth-web-server ping-poll reauth-timer-refresh . . . . . . . . . . . . . . . . 1210

auth-web-server ping-poll timeout . . . . . . . . . . . . . . . . . . . . . . . . . 1211

auth-web-server port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1212

auth-web-server redirect-delay-time . . . . . . . . . . . . . . . . . . . . . . . 1213

auth-web-server redirect-url . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1214

auth-web-server session-keep . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1215

auth-web-server ssl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1216

auth-web-server ssl intercept-port . . . . . . . . . . . . . . . . . . . . . . . . . 1217

copy proxy-autoconfig-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1218

copy web-auth-https-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1219

description (Authentication Profile) . . . . . . . . . . . . . . . . . . . . . . . . 1220

erase proxy-autoconfig-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1221

erase web-auth-https-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1222

platform l3-vlan-hashing-algorithm . . . . . . . . . . . . . . . . . . . . . . . . 1223

platform mac-vlan-hashing-algorithm . . . . . . . . . . . . . . . . . . . . . . . 1224

show auth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1225

show auth diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1227

show auth interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1229

show auth sessionstatistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1232

show auth statistics interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1233

show auth supplicant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1234

show auth supplicant interface . . . . . . . . . . . . . . . . . . . . . . . . . . . 1237

show auth two-step supplicant brief . . . . . . . . . . . . . . . . . . . . . . . . 1238

show auth-web-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1239

C613-50292-01 Rev A Command Reference for IE210L Series 20

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show auth-web-server page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1240

show proxy-autoconfig-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1241

Chapter 35: AAA Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1242

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1242

aaa accounting auth-mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1244

aaa accounting auth-web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1246

aaa accounting commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1248

aaa accounting dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1250

aaa accounting login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252

aaa accounting update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1255

aaa authentication auth-mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257

aaa authentication auth-web . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259

aaa authentication dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1261

aaa authentication enable default group tacacs+ . . . . . . . . . . . . . . . 1263

aaa authentication enable default local . . . . . . . . . . . . . . . . . . . . . . 1265

aaa authentication login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1266

aaa authorization commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1268

aaa authorization config-commands . . . . . . . . . . . . . . . . . . . . . . . . 1270

aaa group server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1271

aaa local authentication attempts lockout-time . . . . . . . . . . . . . . . . . 1273

aaa local authentication attempts max-fail . . . . . . . . . . . . . . . . . . . . 1274

aaa login fail-delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1275

accounting login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1276

authorization commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1277

clear aaa local user lockout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1279

debug aaa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1280

proxy-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1282

radius-secure-proxy aaa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1283

server (radsecproxy-aaa) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1284

server mutual-authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1286

server name-check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1287

server trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1288

show aaa local user locked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1290

show aaa server group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1291

show debugging aaa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1292

show radius server group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1293

undebug aaa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1295

Chapter 36: RADIUS Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1296

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1296

auth radius send nas-identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . 1297

auth radius send service-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1298

deadtime (RADIUS server group) . . . . . . . . . . . . . . . . . . . . . . . . . . 1299

debug radius . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1300

ip radius source-interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1301

radius-server deadtime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1302

radius-server host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1303

radius-server key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1306

radius-server retransmit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1307

radius-server timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1309

C613-50292-01 Rev A Command Reference for IE210L Series 21

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

server (server group) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1311

show debugging radius . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1313

show radius . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1314

show radius statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1317

undebug radius . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1318

Chapter 37: Local RADIUS Server Commands . . . . . . . . . . . . . . . . . . . . . . . 1319

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1319

attribute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1321

authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1324

client (radsecproxy-srv) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1325

client mutual-authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1327

client name-check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1328

client trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1329

clear radius local-server statistics . . . . . . . . . . . . . . . . . . . . . . . . . . 1330

copy fdb-radius-users (to file) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1331

copy local-radius-user-db (from file) . . . . . . . . . . . . . . . . . . . . . . . . 1333

copy local-radius-user-db (to file) . . . . . . . . . . . . . . . . . . . . . . . . . . 1334

crypto pki enroll local (deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1335

crypto pki enroll local local-radius-all-users (deleted) . . . . . . . . . . . . . 1336

crypto pki enroll local user (deleted) . . . . . . . . . . . . . . . . . . . . . . . . 1337

crypto pki export local pem (deleted) . . . . . . . . . . . . . . . . . . . . . . . 1338

crypto pki export local pkcs12 (deleted) . . . . . . . . . . . . . . . . . . . . . 1339

crypto pki trustpoint local (deleted) . . . . . . . . . . . . . . . . . . . . . . . . 1340

debug crypto pki (deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1341

domain-style . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1342

egress-vlan-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1343

egress-vlan-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1345

group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1347

nas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1348

radius-secure-proxy local-server . . . . . . . . . . . . . . . . . . . . . . . . . . 1349

radius-server local . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1350

server auth-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1351

server enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1352

show radius local-server group . . . . . . . . . . . . . . . . . . . . . . . . . . . 1353

show radius local-server nas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1354

show radius local-server statistics . . . . . . . . . . . . . . . . . . . . . . . . . . 1355

show radius local-server user . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1356

user (RADIUS server) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1358

vlan (RADIUS server) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1360

Chapter 38: Public Key Infrastructure Commands . . . . . . . . . . . . . . . . . . . . 1361

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1361

crypto key generate rsa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1362

crypto key zeroize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1363

crypto pki authenticate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1364

crypto pki enroll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1365

crypto pki enroll user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1366

crypto pki export pem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1368

crypto pki export pkcs12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1369

crypto pki import pem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1371

crypto pki import pkcs12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1373

C613-50292-01 Rev A Command Reference for IE210L Series 22

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

crypto pki trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1374

enrollment (trustpoint configuration mode) . . . . . . . . . . . . . . . . . . . 1375

fingerprint (trustpoint configuration mode) . . . . . . . . . . . . . . . . . . . 1376

no crypto pki certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1378

rsakeypair (trustpoint configuration mode) . . . . . . . . . . . . . . . . . . . 1379

show crypto key mypubkey rsa . . . . . . . . . . . . . . . . . . . . . . . . . . . 1380

show crypto pki certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1381

show crypto pki enrollment user . . . . . . . . . . . . . . . . . . . . . . . . . . 1383

show crypto pki trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1384

subject-name (trustpoint configuration) . . . . . . . . . . . . . . . . . . . . . 1385

Chapter 39: TACACS+ Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1387

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1387

authorization commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1388

aaa authorization commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1390

aaa authorization config-commands . . . . . . . . . . . . . . . . . . . . . . . . 1392

ip tacacs source-interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1393

show tacacs+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1394

tacacs-server host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1396

tacacs-server key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1398

tacacs-server timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1399

Chapter 40: DHCP Snooping Commands . . . . . . . . . . . . . . . . . . . . . . . . . . 1400

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1400

arp security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1402

arp security violation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1403

clear arp security statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1405

clear ip dhcp snooping binding . . . . . . . . . . . . . . . . . . . . . . . . . . . 1406

clear ip dhcp snooping statistics . . . . . . . . . . . . . . . . . . . . . . . . . . 1407

debug arp security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1408

debug ip dhcp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1409

ip dhcp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1410

ip dhcp snooping agent-option . . . . . . . . . . . . . . . . . . . . . . . . . . . 1411

ip dhcp snooping agent-option allow-untrusted . . . . . . . . . . . . . . . . 1412

ip dhcp snooping agent-option circuit-id vlantriplet . . . . . . . . . . . . . 1413

ip dhcp snooping agent-option remote-id . . . . . . . . . . . . . . . . . . . . 1414

ip dhcp snooping binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1415

ip dhcp snooping database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1416

ip dhcp snooping delete-by-client . . . . . . . . . . . . . . . . . . . . . . . . . 1417

ip dhcp snooping delete-by-linkdown . . . . . . . . . . . . . . . . . . . . . . 1418

ip dhcp snooping max-bindings . . . . . . . . . . . . . . . . . . . . . . . . . . 1419

ip dhcp snooping trust . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1420

ip dhcp snooping verify mac-address . . . . . . . . . . . . . . . . . . . . . . . 1421

ip dhcp snooping violation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1422

ip source binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1423

service dhcp-snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1425

show arp security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1427

show arp security interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1428

show arp security statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1430

show debugging arp security . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1432

show debugging ip dhcp snooping . . . . . . . . . . . . . . . . . . . . . . . . 1433

show ip dhcp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1434

C613-50292-01 Rev A Command Reference for IE210L Series 23

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show ip dhcp snooping acl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1435

show ip dhcp snooping agent-option . . . . . . . . . . . . . . . . . . . . . . . 1438

show ip dhcp snooping binding . . . . . . . . . . . . . . . . . . . . . . . . . . 1440

show ip dhcp snooping interface . . . . . . . . . . . . . . . . . . . . . . . . . . 1442

show ip dhcp snooping statistics . . . . . . . . . . . . . . . . . . . . . . . . . . 1444

show ip source binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1447

Chapter 41: OpenFlow Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1448

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1448

openflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1449

openflow controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1450

openflow datapath-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1452

openflow failmode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1453

openflow failmode standalone . . . . . . . . . . . . . . . . . . . . . . . . . . . 1455

openflow inactivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1456

openflow native vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1457

openflow ssl peer certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1458

openflow ssl trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1459

openflow version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1460

show openflow config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1461

show openflow coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1463

show openflow flows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1465

show openflow rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1468

show openflow ssl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1470

show openflow status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1471

PART 6: Network Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1474

Chapter 42: Ethernet Protection Switched Ring (EPSRing™) Commands . . . . . . 1475

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1475

debug epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1477

epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1478

epsr configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1479

epsr datavlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1480

epsr enhancedrecovery enable . . . . . . . . . . . . . . . . . . . . . . . . . . . 1481

epsr mode master controlvlan primary port . . . . . . . . . . . . . . . . . . . 1482

epsr mode transit controlvlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1483

epsr priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1484

epsr state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1485

epsr topology-change . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1486

epsr trap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1487

show debugging epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1488

show epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1489

show epsr common segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1493

show epsr config-check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1494

show epsr <epsr-instance> . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1495

show epsr <epsr-instance> counters . . . . . . . . . . . . . . . . . . . . . . . 1496

show epsr counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1497

show epsr summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1498

undebug epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1499

Chapter 43: G.8032 Ethernet Ring Protection Switching Commands . . . . . . . . 1500

C613-50292-01 Rev A Command Reference for IE210L Series 24

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1500

cfm-sf-notify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1502

clear g8032 erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1504

clear g8032 erp-instance statistics . . . . . . . . . . . . . . . . . . . . . . . . . 1506

data-traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1507

debug g8032 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1509

enable (G.8032) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1510

epsr topology-change . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1511

erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1512

g8032 erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1513

g8032 forced-switch erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . 1515

g8032 manual-switch erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . 1517

g8032 physical-ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1518

g8032 profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1520

level (G.8032) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1521

physical-ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1522

profile name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1523

raps-channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1524

rpl role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1525

show debugging g8032 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1527

show g8032 erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1528

show g8032 erp-instance statistics . . . . . . . . . . . . . . . . . . . . . . . . . 1533

show g8032 physical-ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1535

show g8032 profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1537

sub-ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1539

timer (G.8032) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1540

topology-change . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1542

trap (G.8032) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1544

undebug g8032 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1545

Chapter 44: RRP Snooping Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . 1546

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1546

ip rrp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1547

show ip rrp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1548

PART 7: Network Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1549

Chapter 45: Allied Telesis Management Framework™ (AMF) Commands . . . . . . 1550

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1550

application-proxy whitelist enable . . . . . . . . . . . . . . . . . . . . . . . . . 1555

application-proxy whitelist server . . . . . . . . . . . . . . . . . . . . . . . . . 1556

area-link . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1558

atmf area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1560

atmf area password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1562

atmf authorize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1564

atmf authorize provision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1566

atmf backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1568

atmf backup area-masters delete . . . . . . . . . . . . . . . . . . . . . . . . . . 1569

atmf backup area-masters enable . . . . . . . . . . . . . . . . . . . . . . . . . 1570

atmf backup area-masters now . . . . . . . . . . . . . . . . . . . . . . . . . . . 1571

atmf backup area-masters synchronize . . . . . . . . . . . . . . . . . . . . . . 1572

atmf backup bandwidth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1573

C613-50292-01 Rev A Command Reference for IE210L Series 25

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

atmf backup delete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1574

atmf backup enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1575

atmf backup guests delete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1576

atmf backup guests enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1577

atmf backup guests now . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1578

atmf backup guests synchronize . . . . . . . . . . . . . . . . . . . . . . . . . . 1579

atmf backup now . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1580

atmf backup redundancy enable . . . . . . . . . . . . . . . . . . . . . . . . . . 1582

atmf backup server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1583

atmf backup stop . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1585

atmf backup synchronize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1586

atmf cleanup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1587

atmf container . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1588

atmf container login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1589

atmf controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1590

atmf distribute firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1591

atmf domain vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1593

atmf enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1596

atmf group (membership) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1597

atmf guest-class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1599

atmf log-verbose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1601

atmf management subnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1602

atmf management vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1605

atmf master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1607

atmf mtu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1608

atmf network-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1609

atmf provision (interface) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1610

atmf provision node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1611

atmf reboot-rolling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1613

atmf recover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1617

atmf recover guest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1619

atmf recover led-off . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1620

atmf recovery-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1621

atmf remote-login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1623

atmf restricted-login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1625

atmf secure-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1627

atmf secure-mode certificate expire . . . . . . . . . . . . . . . . . . . . . . . . 1629

atmf secure-mode certificate expiry . . . . . . . . . . . . . . . . . . . . . . . . 1630

atmf secure-mode certificate renew . . . . . . . . . . . . . . . . . . . . . . . . 1631

atmf secure-mode enable-all . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1632

atmf select-area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1634

atmf topology-gui enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1635

atmf trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1636

atmf virtual-crosslink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1638

atmf virtual-link . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1640

atmf virtual-link protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1643

atmf working-set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1645

bridge-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1647

clear atmf links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1648

clear atmf links virtual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1649

clear atmf links statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1650

clear atmf recovery-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1651

clear atmf secure-mode certificates . . . . . . . . . . . . . . . . . . . . . . . . 1652

C613-50292-01 Rev A Command Reference for IE210L Series 26

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

clear atmf secure-mode statistics . . . . . . . . . . . . . . . . . . . . . . . . . . 1653

clone (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1654

configure boot config (amf provisioning) . . . . . . . . . . . . . . . . . . . . . 1656

configure boot system (amf provisioning) . . . . . . . . . . . . . . . . . . . . 1658

create (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1660

debug atmf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1662

debug atmf packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1664

delete (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1667

discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1669

description (amf container) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1671

erase factory-default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1672

http-enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1673

identity (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1675

license-cert (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1677

locate (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1679

log event-host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1680

modeltype . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1681

show application-proxy whitelist interface . . . . . . . . . . . . . . . . . . . . 1682

show application-proxy whitelist server . . . . . . . . . . . . . . . . . . . . . . 1684

show application-proxy whitelist supplicant . . . . . . . . . . . . . . . . . . . 1685

show atmf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1687

show atmf area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1691

show atmf area guests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1694

show atmf area guests-detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1696

show atmf area nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1698

show atmf area nodes-detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1700

show atmf area summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1702

show atmf authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1703

show atmf backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1706

show atmf backup area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1710

show atmf backup guest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1712

show atmf container . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1714

show atmf detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1717

show atmf group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1719

show atmf group members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1721

show atmf guests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1723

show atmf guests detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1725

show atmf links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1728

show atmf links detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1730

show atmf links guest . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1739

show atmf links guest detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1741

show atmf links statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1745

show atmf nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1748

show atmf provision nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1750

show atmf recovery-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1752

show atmf secure-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1753

show atmf secure-mode audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1755

show atmf secure-mode audit link . . . . . . . . . . . . . . . . . . . . . . . . . 1756

show atmf secure-mode certificates . . . . . . . . . . . . . . . . . . . . . . . . 1757

show atmf secure-mode sa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1760

show atmf secure-mode statistics . . . . . . . . . . . . . . . . . . . . . . . . . 1763

show atmf tech . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1765

show atmf virtual-links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1768

C613-50292-01 Rev A Command Reference for IE210L Series 27

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show atmf working-set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1770

show debugging atmf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1771

show debugging atmf packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1772

show running-config atmf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1773

state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1774

switchport atmf-agentlink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1776

switchport atmf-arealink remote-area . . . . . . . . . . . . . . . . . . . . . . . 1777

switchport atmf-crosslink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1779

switchport atmf-guestlink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1781

switchport atmf-link . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1783

type atmf node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1784

undebug atmf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1787

username . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1788

Chapter 46: Dynamic Host Configuration Protocol (DHCP) Commands . . . . . . . 1790

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1790

bootfile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1792

clear ip dhcp binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1793

default-router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1794

dns-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1795

domain-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1796

host (DHCP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1797

ip address dhcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1798

ip dhcp bootp ignore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1800

ip dhcp leasequery enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1801

ip dhcp option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1802

ip dhcp pool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1804

ip dhcp-client default-route distance . . . . . . . . . . . . . . . . . . . . . . . 1805

ip dhcp-client request vendor-identifying-specific . . . . . . . . . . . . . . . 1807

ip dhcp-client vendor-identifying-class . . . . . . . . . . . . . . . . . . . . . . 1808

lease . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1809

network (DHCP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1811

next-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1812

option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1813

probe enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1815

probe packets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1816

probe timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1817

probe type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1818

range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1819

route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1820

service dhcp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1821

short-lease-threshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1822

show counter dhcp-client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1824

show counter dhcp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1825

show dhcp lease . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1826

show ip dhcp binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1827

show ip dhcp pool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1828

show ip dhcp server statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1833

show ip dhcp server summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1835

subnet-mask . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1836

Chapter 47: DHCP for IPv6 (DHCPv6) Commands . . . . . . . . . . . . . . . . . . . . . 1837

C613-50292-01 Rev A Command Reference for IE210L Series 28

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1837

clear counter ipv6 dhcp-client . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1838

clear ipv6 dhcp client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1839

ipv6 address dhcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1840

show counter ipv6 dhcp-client . . . . . . . . . . . . . . . . . . . . . . . . . . . 1841

show ipv6 dhcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1843

show ipv6 dhcp interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1844

Chapter 48: NTP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1845

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1845

ntp access-group (deprecated) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1847

ntp authenticate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1848

ntp authentication-key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1849

ntp broadcastdelay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1850

ntp discard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1851

ntp master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1852

ntp peer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1853

ntp rate-limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1855

ntp restrict . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1856

ntp server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1858

ntp source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1860

ntp trusted-key (deprecated) . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1862

show counter ntp (deprecated) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1863

show ntp associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1864

show ntp counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1866

show ntp counters associations . . . . . . . . . . . . . . . . . . . . . . . . . . . 1867

show ntp status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1868

Chapter 49: Precision Time Protocol (PTP) and Transparent Clock Commands . . 1869

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1869

clock-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1870

ptp-clk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1871

ptp global . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1873

show ptp data transparent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1874

show ptp port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1875

Chapter 50: SNMP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1876

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1876

alias (interface) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1878

debug snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1879

show counter snmp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1880

show debugging snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1884

show running-config snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1885

show snmp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1886

show snmp-server community . . . . . . . . . . . . . . . . . . . . . . . . . . . 1887

show snmp-server group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1888

show snmp-server user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1889

show snmp-server view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1890

snmp trap link-status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1891

snmp trap link-status suppress . . . . . . . . . . . . . . . . . . . . . . . . . . . 1892

snmp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1894

snmp-server community . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1896

C613-50292-01 Rev A Command Reference for IE210L Series 29

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

snmp-server contact . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1897

snmp-server enable trap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1898

snmp-server engineID local . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1901

snmp-server engineID local reset . . . . . . . . . . . . . . . . . . . . . . . . . . 1903

snmp-server group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1904

snmp-server host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1906

snmp-server legacy-ifadminstatus . . . . . . . . . . . . . . . . . . . . . . . . . 1908

snmp-server location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1909

snmp-server source-interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1910

snmp-server startup-trap-delay . . . . . . . . . . . . . . . . . . . . . . . . . . . 1911

snmp-server user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1912

snmp-server view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1915

undebug snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1916

Chapter 51: LLDP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1917

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1917

clear lldp statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1919

clear lldp table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1920

debug lldp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1921

lldp faststart-count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1923

lldp holdtime-multiplier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1924

lldp management-address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1925

lldp med-notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1926

lldp med-tlv-select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1927

lldp non-strict-med-tlv-order-check . . . . . . . . . . . . . . . . . . . . . . . . 1930

lldp notification-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1931

lldp notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1932

lldp port-number-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1933

lldp reinit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1934

lldp run . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1935

lldp timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1936

lldp tlv-select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1937

lldp transmit receive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1939

lldp tx-delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1940

location civic-location configuration . . . . . . . . . . . . . . . . . . . . . . . . 1941

location civic-location identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . 1945

location civic-location-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1946

location coord-location configuration . . . . . . . . . . . . . . . . . . . . . . . 1947

location coord-location identifier . . . . . . . . . . . . . . . . . . . . . . . . . . 1949

location coord-location-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1950

location elin-location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1952

location elin-location-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1953

show debugging lldp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1954

show lldp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1956

show lldp interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1958

show lldp local-info . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1960

show lldp neighbors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1965

show lldp neighbors detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1967

show lldp statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1971

show lldp statistics interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1973

show location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1975

C613-50292-01 Rev A Command Reference for IE210L Series 30

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Chapter 52: Mail (SMTP) Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1977

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1977

debug mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1978

delete mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1979

mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1980

mail from . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1982

mail smtpserver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1983

mail smtpserver authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . 1984

mail smtpserver port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1986

show counter mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1988

show mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1989

undebug mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1990

Chapter 53: RMON Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1991

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1991

rmon alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1992

rmon collection history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1994

rmon collection stats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1995

rmon event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1996

show rmon alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1997

show rmon event . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1998

show rmon history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2000

show rmon statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2002

Chapter 54: Secure Shell (SSH) Commands . . . . . . . . . . . . . . . . . . . . . . . . . 2004

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2004

banner login (SSH) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2006

clear ssh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2007

crypto key destroy hostkey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2008

crypto key destroy userkey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2009

crypto key generate hostkey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2010

crypto key generate userkey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2012

crypto key pubkey-chain knownhosts . . . . . . . . . . . . . . . . . . . . . . . 2013

crypto key pubkey-chain userkey . . . . . . . . . . . . . . . . . . . . . . . . . . 2015

debug ssh client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2017

debug ssh server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2018

service ssh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2019

show banner login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2021

show crypto key hostkey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2022

show crypto key pubkey-chain knownhosts . . . . . . . . . . . . . . . . . . . 2024

show crypto key pubkey-chain userkey . . . . . . . . . . . . . . . . . . . . . . 2025

show crypto key userkey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2026

show running-config ssh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2027

show ssh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2029

show ssh client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2031

show ssh server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2032

show ssh server allow-users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2034

show ssh server deny-users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2035

ssh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2036

ssh client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2038

ssh server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2040

ssh server allow-users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2042

C613-50292-01 Rev A Command Reference for IE210L Series 31

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ssh server authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2044

ssh server deny-users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2046

ssh server max-auth-tries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2048

ssh server resolve-host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2049

ssh server scp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2050

ssh server sftp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2051

undebug ssh client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2052

undebug ssh server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2053

Chapter 55: Trigger Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2054

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2054

active (trigger) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2056

day . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2057

debug trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2059

description (trigger) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2060

repeat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2061

script . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2062

show debugging trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2064

show running-config trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2065

show trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2066

test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2071

time (trigger) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2072

trap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2074

trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2075

trigger activate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2076

type atmf node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2077

type card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2080

type cpu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2081

type interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2082

type linkmon-probe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2083

type log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2085

type memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2086

type periodic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2087

type ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2088

type reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2089

type time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2090

undebug trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2091

Chapter 56: Ping-Polling Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2092

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2092

active (ping-polling) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2094

clear ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2095

critical-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2096

debug ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2097

description (ping-polling) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2098

fail-count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2099

ip (ping-polling) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2100

length (ping-poll data) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2101

normal-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2102

ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2103

sample-size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2104

show counter ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2106

C613-50292-01 Rev A Command Reference for IE210L Series 32

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2108

source-ip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2112

timeout (ping polling) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2114

up-count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2115

undebug ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2116

Chapter 57: sFlow Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2117

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2117

debug sflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2118

debug sflow agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2119

sflow agent (address) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2120

sflow collector (address) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2122

sflow collector max-datagram-size . . . . . . . . . . . . . . . . . . . . . . . . . 2124

sflow enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2125

sflow max-header-size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2126

sflow polling-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2128

sflow sampling-rate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2129

show debugging sflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2130

show running-config sflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2132

show sflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2133

show sflow interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2135

undebug sflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2136

C613-50292-01 Rev A Command Reference for IE210L Series 33

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

List of Commands

(access-list extended ICMP filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .970

(access-list extended IP filter). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .972

(access-list extended IP protocol filter). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .975

(access-list extended TCP UDP filter). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .979

(access-list standard named filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .985

(access-list standard numbered filter). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .987

(ipv6 access-list standard filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1021

(named hardware ACL entry for ICMP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .932

(named hardware ACL entry for IP packets) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .936

(named hardware ACL entry for IP protocols) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .940

(named hardware ACL entry for MAC addresses) . . . . . . . . . . . . . . . . . . . . . . . . . .945

(named hardware ACL entry for TCP or UDP). . . . . . . . . . . . . . . . . . . . . . . . . . . . . .948

(named IPv6 hardware ACL: ICMP entry) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .999

(named IPv6 hardware ACL: IP protocol entry) . . . . . . . . . . . . . . . . . . . . . . . . . . 1006

(named IPv6 hardware ACL: IPv6 packet entry). . . . . . . . . . . . . . . . . . . . . . . . . . 1003

(named IPv6 hardware ACL: TCP or UDP entry). . . . . . . . . . . . . . . . . . . . . . . . . . 1011

aaa accounting auth-mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1244

aaa accounting auth-web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1246

aaa accounting commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1248

aaa accounting dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1250

aaa accounting login. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1252

aaa accounting update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1255

aaa authentication auth-mac. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1257

aaa authentication auth-web. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1259

aaa authentication dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1261

C613-50292-01 Rev A Command Reference for IE210L Series 34

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

aaa authentication enable default group tacacs+ . . . . . . . . . . . . . . . . . . . . . . . .1263

aaa authentication enable default local. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1265

aaa authentication enable default local. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

aaa authentication login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1266

aaa authorization commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1268

aaa authorization commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1390

aaa authorization config-commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1270

aaa authorization config-commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1392

aaa group server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1271

aaa local authentication attempts lockout-time. . . . . . . . . . . . . . . . . . . . . . . . . .1273

aaa local authentication attempts lockout-time. . . . . . . . . . . . . . . . . . . . . . . . . . . 138

aaa local authentication attempts max-fail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1274

aaa local authentication attempts max-fail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139

aaa login fail-delay. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1275

aaa login fail-delay. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 909

access-list (extended numbered) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 967

access-list (numbered hardware ACL for ICMP) . . . . . . . . . . . . . . . . . . . . . . . . . . . 911

access-list (numbered hardware ACL for IP packets). . . . . . . . . . . . . . . . . . . . . . . 915

access-list (numbered hardware ACL for IP protocols). . . . . . . . . . . . . . . . . . . . . 918

access-list (numbered hardware ACL for MAC addresses) . . . . . . . . . . . . . . . . . 923

access-list (numbered hardware ACL for TCP or UDP) . . . . . . . . . . . . . . . . . . . . . 926

access-list (standard numbered). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 983

access-list extended (named) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 959

access-list hardware (named hardware ACL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 930

access-list standard (named) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 981

accounting login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1276

activate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425

active (ping-polling) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2094

active (trigger). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2056

alarm facility. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457

alias (interface) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1878

application-proxy whitelist enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1555

application-proxy whitelist server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1556

area-link. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1558

C613-50292-01 Rev A Command Reference for IE210L Series 35

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

arp log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 736

arp opportunistic-nd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 739

arp security violation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1403

arp security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1402

arp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 735

arp-aging-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734

arp-reply-bc-dmac. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740

atmf area password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1562

atmf area. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1560

atmf authorize provision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1566

atmf authorize. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1564

atmf backup area-masters delete. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1569

atmf backup area-masters enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1570

atmf backup area-masters now. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1571

atmf backup area-masters synchronize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1572

atmf backup bandwidth . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1573

atmf backup delete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1574

atmf backup enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1575

atmf backup guests delete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1576

atmf backup guests enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1577

atmf backup guests now. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1578

atmf backup guests synchronize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1579

atmf backup now. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1580

atmf backup redundancy enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1582

atmf backup server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1583

atmf backup stop. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1585

atmf backup synchronize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1586

atmf backup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1568

atmf cleanup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1587

atmf container login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1589

atmf container. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1588

atmf controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1590

atmf distribute firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1591

atmf domain vlan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1593

atmf enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1596

C613-50292-01 Rev A Command Reference for IE210L Series 36

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

atmf group (membership) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1597

atmf guest-class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1599

atmf log-verbose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1601

atmf management subnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1602

atmf management vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1605

atmf master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1607

atmf mtu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1608

atmf network-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1609

atmf provision (interface) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1610

atmf provision node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1611

atmf reboot-rolling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1613

atmf recover guest. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1619

atmf recover led-off. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1620

atmf recover. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1617

atmf recovery-server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1621

atmf remote-login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1623

atmf restricted-login. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1625

atmf secure-mode certificate expire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1629

atmf secure-mode certificate expiry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1630

atmf secure-mode certificate renew . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1631

atmf secure-mode enable-all. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1632

atmf secure-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1627

atmf select-area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1634

atmf topology-gui enable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1635

atmf topology-gui enable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194

atmf trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1636

atmf virtual-crosslink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1638

atmf virtual-link protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1643

atmf virtual-link . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1640

atmf working-set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1645

attribute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1321

auth auth-fail vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1129

auth critical. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1131

auth dhcp-framed-ip-lease. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1132

auth dynamic-vlan-creation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1134

C613-50292-01 Rev A Command Reference for IE210L Series 37

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

auth guest-vlan forward . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1139

auth guest-vlan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1137

auth host-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1141

auth log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1143

auth max-supplicant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1145

auth multi-vlan-session . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1147

auth profile (Global Configuration) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1148

auth profile (Interface Configuration). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1149

auth radius send nas-identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1297

auth radius send service-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1298

auth reauthentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1150

auth roaming disconnected. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1151

auth roaming enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1153

auth supplicant-ip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1155

auth supplicant-mac. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1157

auth timeout connect-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1160

auth timeout quiet-period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1162

auth timeout reauth-period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1163

auth timeout server-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1165

auth timeout supp-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1167

auth two-step enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1169

authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1324

auth-mac accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1172

auth-mac authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1173

auth-mac enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1174

auth-mac method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1176

auth-mac password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1178

auth-mac reauth-relearning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1179

auth-mac static . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1181

auth-mac username . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1182

authorization commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1277

authorization commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1388

auth-web accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1183

auth-web authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1184

auth-web enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1185

C613-50292-01 Rev A Command Reference for IE210L Series 38

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

auth-web forward . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1187

auth-web max-auth-fail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1190

auth-web method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1192

auth-web-server blocking-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1193

auth-web-server dhcp ipaddress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1194

auth-web-server dhcp lease. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1195

auth-web-server dhcp-wpad-option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1196

auth-web-server host-name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1197

auth-web-server intercept-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1198

auth-web-server ipaddress. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1199

auth-web-server login-url . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1201

auth-web-server page language . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1200

auth-web-server page logo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1202

auth-web-server page sub-title. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1203

auth-web-server page success-message. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1204

auth-web-server page title . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1205

auth-web-server page welcome-message . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1206

auth-web-server ping-poll enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1207

auth-web-server ping-poll failcount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1208

auth-web-server ping-poll interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1209

auth-web-server ping-poll reauth-timer-refresh . . . . . . . . . . . . . . . . . . . . . . . . .1210

auth-web-server ping-poll timeout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1211

auth-web-server port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1212

auth-web-server redirect-delay-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1213

auth-web-server redirect-url . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1214

auth-web-server session-keep . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1215

auth-web-server ssl intercept-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1217

auth-web-server ssl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1216

autoboot enable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

backpressure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467

banner exec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203

banner login (SSH). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2006

banner login (system). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

banner motd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207

boot config-file backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

C613-50292-01 Rev A Command Reference for IE210L Series 39

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

boot config-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

boot system backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

boot system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

bootfile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1792

bridge-group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1647

cc interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286

cc multicast . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288

cc unicast . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289

cd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

cfm-sf-notify. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1502

channel-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 668

class. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1027

class-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1028

clear (MEP Attribute). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290

clear aaa local user lockout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1279

clear aaa local user lockout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

clear arp security statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1405

clear arp-cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 741

clear atmf links statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1650

clear atmf links virtual . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1649

clear atmf links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1648

clear atmf recovery-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1651

clear atmf secure-mode certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1652

clear atmf secure-mode statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1653

clear counter ipv6 dhcp-client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1838

clear ethernet cfm errorlog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291

clear exception log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334

clear fiber-monitoring interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260

clear g8032 erp-instance statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1506

clear g8032 erp-instance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1504

clear gvrp statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 718

clear ip dhcp binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1793

clear ip dhcp snooping binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1406

clear ip dhcp snooping statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1407

clear ip igmp group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 833

C613-50292-01 Rev A Command Reference for IE210L Series 40

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

clear ip igmp interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 834

clear ip igmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 832

clear ipv6 dhcp client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1839

clear ipv6 mld group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 884

clear ipv6 mld interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885

clear ipv6 mld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 883

clear ipv6 neighbors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 779

clear lacp counters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 670

clear line console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

clear line vty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

clear lldp statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1919

clear lldp table. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1920

clear log buffered. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336

clear log external . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337

clear log permanent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 338

clear log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

clear loop-protection counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 469

clear mac address-table dynamic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470

clear mac address-table static . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472

clear mep counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

clear mls qos interface policer-counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1029

clear ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2095

clear port counter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473

clear port-security intrusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474

clear power-inline counters interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 693

clear radius local-server statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1330

clear spanning-tree detected protocols (RSTP and MSTP) . . . . . . . . . . . . . . . . . 580

clear spanning-tree statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 579

clear ssh. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2007

clear test cable-diagnostics tdr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

client (radsecproxy-srv) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1325

client mutual-authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1327

client name-check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1328

client trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1329

clock set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

C613-50292-01 Rev A Command Reference for IE210L Series 41

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

clock summer-time date . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210

clock summer-time recurring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212

clock timezone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

clock-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1870

clone (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1654

commit (IPv4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 952

commit (IPv6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 996

configure boot config (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1656

configure boot system (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1658

configure terminal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

copy (filename) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

copy buffered-log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339

copy current-software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

copy debug . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

copy fdb-radius-users (to file) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1331

copy local-radius-user-db (from file). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1333

copy local-radius-user-db (to file) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1334

copy permanent-log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340

copy proxy-autoconfig-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1218

copy running-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

copy startup-config. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

copy web-auth-https-file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1219

copy zmodem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

create (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1660

create autoboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

critical-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2096

crypto key destroy hostkey. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2008

crypto key destroy userkey. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2009

crypto key generate hostkey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2010

crypto key generate rsa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1362

crypto key generate userkey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2012

crypto key pubkey-chain knownhosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2013

crypto key pubkey-chain userkey. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2015

crypto key zeroize . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1363

crypto pki authenticate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1364

C613-50292-01 Rev A Command Reference for IE210L Series 42

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

crypto pki enroll local (deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1335

crypto pki enroll local local-radius-all-users (deleted) . . . . . . . . . . . . . . . . . . . .1336

crypto pki enroll local user (deleted). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1337

crypto pki enroll user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1366

crypto pki enroll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1365

crypto pki export local pem (deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1338

crypto pki export local pkcs12 (deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1339

crypto pki export pem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1368

crypto pki export pkcs12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1369

crypto pki import pem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1371

crypto pki import pkcs12. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1373

crypto pki trustpoint local (deleted) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1340

crypto pki trustpoint. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1374

data-traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1507

day. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2057

deadtime (RADIUS server group) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1299

debug aaa. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1280

debug alarm. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460

debug arp security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1408

debug atmf packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1664

debug atmf. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1662

debug crypto pki (deleted). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1341

debug dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1090

debug epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1477

debug fiber-monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262

debug g8032 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1509

debug gvrp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 719

debug igmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 835

debug ip dhcp snooping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1409

debug ip packet interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 742

debug lacp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671

debug lldp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1921

debug loopprot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477

debug mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1978

debug mld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886

C613-50292-01 Rev A Command Reference for IE210L Series 43

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

debug mstp (RSTP and STP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581

debug ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2097

debug platform packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478

debug power-inline. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 694

debug private-vlan ufo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536

debug radius . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1300

debug sflow agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2119

debug sflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2118

debug snmp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1879

debug ssh client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2017

debug ssh server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2018

debug trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2059

debug udld. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652

default log buffered . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 341

default log console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342

default log email . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343

default log external . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344

default log host. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345

default log monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346

default log permanent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347

default-action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1030

default-router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1794

delete (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1667

delete debug . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

delete mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1979

delete . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

description (amf container) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1671

description (Authentication Profile) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1220

description (interface) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429

description (ping-polling). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2098

description (QoS policy-map) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1031

description (trigger) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2060

dir. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

disable (Privileged Exec mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

discovery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1669

C613-50292-01 Rev A Command Reference for IE210L Series 44

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

dns-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1795

do. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

domain-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1796

domain-style . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1342

dot1x accounting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1088

dot1x authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1089

dot1x control-direction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1091

dot1x eap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1093

dot1x eapol-version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1094

dot1x initialize interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1096

dot1x initialize supplicant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1097

dot1x keytransmit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1098

dot1x max-auth-fail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1099

dot1x max-reauth-req . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1101

dot1x port-control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1103

dot1x timeout tx-period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1105

duplex . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480

echo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426

ecofriendly led . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215

edit (filename). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

edit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

egress-rate-limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1032

egress-vlan-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1343

egress-vlan-name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1345

enable (G.8032). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1510

enable (Privileged Exec mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

enable password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144

enable secret . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147

end . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

enrollment (trustpoint configuration mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1375

epsr configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1479

epsr datavlan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1480

epsr enhancedrecovery enable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1481

epsr mode master controlvlan primary port . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1482

epsr mode transit controlvlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1483

C613-50292-01 Rev A Command Reference for IE210L Series 45

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

epsr priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1484

epsr state. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1485

epsr topology-change . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1486

epsr topology-change . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1511

epsr trap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1487

epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1478

erase factory-default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

erase factory-default. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1672

erase proxy-autoconfig-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1221

erase startup-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

erase web-auth-https-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1222

erp-instance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1512

ethernet cfm domain-name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

ethernet cfm mep . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 296

exec-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

exit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

fail-count. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2099

fiber-monitoring action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264

fiber-monitoring baseline. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266

fiber-monitoring enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

fiber-monitoring interval. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

fiber-monitoring sensitivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270

findme trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218

findme . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

fingerprint (trustpoint configuration mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1376

flowcontrol (switch port). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481

flowcontrol hardware (asyn/console). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152

g8032 erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1513

g8032 forced-switch erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1515

g8032 manual-switch erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1517

g8032 physical-ring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1518

g8032 profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1520

group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1347

gui-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195

gvrp (interface) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 721

C613-50292-01 Rev A Command Reference for IE210L Series 46

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

gvrp dynamic-vlan-creation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 722

gvrp enable (global) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723

gvrp registration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724

gvrp timer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 725

help. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

host (DHCP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1797

hostname . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

http port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196

http secure-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

http-enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1673

identity (amf provisioning). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1675

instance priority (MSTP). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 585

instance vlan (MSTP). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587

interface (to configure) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 430

ip (ping-polling) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2100

ip address (IP Addressing and Protocol) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 744

ip address dhcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1798

ip dhcp bootp ignore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1800

ip dhcp leasequery enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1801

ip dhcp option. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1802

ip dhcp pool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1804

ip dhcp snooping agent-option allow-untrusted. . . . . . . . . . . . . . . . . . . . . . . . .1412

ip dhcp snooping agent-option circuit-id vlantriplet . . . . . . . . . . . . . . . . . . . . .1413

ip dhcp snooping agent-option remote-id. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1414

ip dhcp snooping agent-option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1411

ip dhcp snooping binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1415

ip dhcp snooping database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1416

ip dhcp snooping delete-by-client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1417

ip dhcp snooping delete-by-linkdown. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1418

ip dhcp snooping max-bindings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1419

ip dhcp snooping trust. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1420

ip dhcp snooping verify mac-address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1421

ip dhcp snooping violation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1422

ip dhcp snooping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1410

ip dhcp-client default-route distance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1805

C613-50292-01 Rev A Command Reference for IE210L Series 47

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ip dhcp-client request vendor-identifying-specific . . . . . . . . . . . . . . . . . . . . . . .1807

ip dhcp-client vendor-identifying-class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1808

ip domain-list. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767

ip domain-lookup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 768

ip domain-name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769

ip gratuitous-arp-link . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 746

ip igmp access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837

ip igmp flood specific-query . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 838

ip igmp immediate-leave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 839

ip igmp last-member-query-count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 840

ip igmp last-member-query-interval. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 841

ip igmp limit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 842

ip igmp maximum-groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 843

ip igmp querier-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 845

ip igmp query-holdtime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 846

ip igmp query-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 848

ip igmp query-max-response-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 850

ip igmp ra-option. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852

ip igmp robustness-variable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 853

ip igmp snooping fast-leave. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 855

ip igmp snooping mrouter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 856

ip igmp snooping querier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 857

ip igmp snooping report-suppression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 858

ip igmp snooping routermode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 859

ip igmp snooping source-timeout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 861

ip igmp snooping tcn query solicit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 862

ip igmp snooping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 854

ip igmp source-address-check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 864

ip igmp startup-query-count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 867

ip igmp startup-query-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .868

ip igmp static-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 865

ip igmp trusted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 869

ip igmp version. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 870

ip igmp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836

ip name-server preferred-order . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 772

C613-50292-01 Rev A Command Reference for IE210L Series 48

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ip name-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 770

ip radius source-interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1301

ip redirects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 748

ip route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818

ip rrp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1547

ip source binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1423

ip tacacs source-interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1393

ip tcp synack-retries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 749

ip tftp source-interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

ip unreachables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 750

ipv6 access-list (named IPv6 hardware ACL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 997

ipv6 access-list standard (named) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1019

ipv6 address autoconfig . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 782

ipv6 address dhcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1840

ipv6 address suffix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784

ipv6 address. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780

ipv6 enable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 785

ipv6 eui64-linklocal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787

ipv6 forwarding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788

ipv6 mld immediate-leave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 887

ipv6 mld limit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 888

ipv6 mld snooping fast-leave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 892

ipv6 mld snooping mrouter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 893

ipv6 mld snooping querier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 895

ipv6 mld snooping report-suppression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 896

ipv6 mld snooping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890

ipv6 mld static-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 898

ipv6 multicast forward-slow-path-packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 789

ipv6 nd accept-ra-pinfo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 790

ipv6 nd current-hoplimit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 791

ipv6 nd managed-config-flag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792

ipv6 nd minimum-ra-interval. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 793

ipv6 nd other-config-flag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794

ipv6 nd prefix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795

ipv6 nd raguard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 799

C613-50292-01 Rev A Command Reference for IE210L Series 49

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ipv6 nd ra-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 797

ipv6 nd ra-lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 798

ipv6 nd reachable-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 801

ipv6 nd retransmission-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 802

ipv6 nd suppress-ra. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803

ipv6 neighbor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804

ipv6 opportunistic-nd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 805

ipv6 route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 820

ipv6 tftp source-interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

ipv6 traffic-filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1015

ipv6 unreachables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 806

lacp global-passive-mode enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 672

lacp port-priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 673

lacp system-priority. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674

lacp timeout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675

lease . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1809

length (asyn) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

length (ping-poll data). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2101

level (G.8032). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1521

license update (filename) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

license update online . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191

license . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183

license-cert (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1677

line. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

linkflap action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483

lldp faststart-count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1923

lldp holdtime-multiplier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1924

lldp management-address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1925

lldp med-notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1926

lldp med-tlv-select. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1927

lldp non-strict-med-tlv-order-check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1930

lldp notification-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1931

lldp notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1932

lldp port-number-type. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1933

lldp reinit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1934

C613-50292-01 Rev A Command Reference for IE210L Series 50

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

lldp run . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1935

lldp timer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1936

lldp tlv-select . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1937

lldp transmit receive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1939

lldp tx-delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1940

locate (amf provisioning) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1679

location civic-location configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1941

location civic-location identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1945

location civic-location-id. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1946

location coord-location configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1947

location coord-location identifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1949

location coord-location-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1950

location elin-location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1952

location elin-location-id. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1953

log buffered (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349

log buffered exclude. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352

log buffered size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

log buffered . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348

log console (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357

log console exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360

log console. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356

log email (filter). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364

log email exclude. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367

log email time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370

log email . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363

log event-host. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1680

log event-host. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198

log external (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374

log external exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377

log external rotate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380

log external size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382

log external . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372

log facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383

log host (filter). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387

log host exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390

C613-50292-01 Rev A Command Reference for IE210L Series 51

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

log host source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393

log host startup-delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394

log host time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396

log host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385

log monitor (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 398

log monitor exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 401

log permanent (filter) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405

log permanent exclude . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408

log permanent size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411

log permanent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404

log trustpoint. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413

login authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1281

logout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

log-rate-limit nsm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 412

loop-protection action. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485

loop-protection action-delay-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486

loop-protection loop-detect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 484

loop-protection timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487

mac address-table acquire . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488

mac address-table ageing-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489

mac address-table logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 490

mac address-table static . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491

mac address-table thrash-limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492

mail from. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1982

mail smtpserver authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1984

mail smtpserver port. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1986

mail smtpserver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1983

mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1980

match access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1033

match cos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1035

match dscp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1036

match eth-format protocol. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1037

match inner-cos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1040

match inner-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1041

match ip-precedence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1042

C613-50292-01 Rev A Command Reference for IE210L Series 52

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

match mac-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1043

match tcp-flags. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1044

match vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1045

maximum-access-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 989

maximum-paths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 821

mep (FNG attributes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298

mep active . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300

mep ccm-ltm-priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302

mep crosscheck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 304

mirror interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445

mkdir . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

mls qos cos. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1046

mls qos enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1047

mls qos map cos-queue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1048

mls qos map premark-dscp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1049

modeltype . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1681

move debug. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

move. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

mru . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432

mtu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433

nas. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1348

network (DHCP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1811

next-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1812

no crypto pki certificate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1378

no debug all. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221

no police . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1051

normal-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2102

ntp access-group (deprecated). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1847

ntp authenticate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1848

ntp authentication-key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1849

ntp broadcastdelay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1850

ntp discard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1851

ntp master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1852

ntp peer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1853

ntp rate-limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1855

C613-50292-01 Rev A Command Reference for IE210L Series 53

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ntp restrict . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1856

ntp server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1858

ntp source. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1860

ntp trusted-key (deprecated). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1862

openflow controller. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1450

openflow datapath-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1452

openflow failmode standalone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1455

openflow failmode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1453

openflow inactivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1456

openflow native vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1457

openflow ssl peer certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1458

openflow ssl trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1459

openflow version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1460

openflow. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1449

optimistic-nd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 807

option. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1813

physical-ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1522

ping ipv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 808

ping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 752

ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2103

platform hwfilter-size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493

platform l3-vlan-hashing-algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1223

platform l3-vlan-hashing-algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494

platform load-balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495

platform load-balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677

platform mac-vlan-hashing-algorithm. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1224

platform mac-vlan-hashing-algorithm. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496

platform multicast-ratelimit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 497

platform stop-unreg-mc-flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498

platform vlan-stacking-tpid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 500

platform vlan-stacking-tpid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543

polarity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501

police single-rate action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1052

police twin-rate action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1054

policy-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1056

C613-50292-01 Rev A Command Reference for IE210L Series 54

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

port-vlan-forwarding-priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537

power-inline allow-legacy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 696

power-inline description. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 697

power-inline enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 698

power-inline max. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 699

power-inline priority. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701

power-inline usage-threshold. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703

priority-queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1057

private-vlan association. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 542

private-vlan ufo trap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 544

private-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540

privilege level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

probe enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1815

probe packets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1816

probe timeout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1817

probe type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1818

profile name. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1523

proxy-port. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1282

ptp global . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1873

ptp-clk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1871

pwd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

radius-secure-proxy aaa. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1283

radius-secure-proxy local-server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1349

radius-server deadtime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1302

radius-server host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1303

radius-server key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1306

radius-server local . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1350

radius-server retransmit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1307

radius-server timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1309

range . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1819

raps-channel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1524

reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

region (MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 589

reload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

remark new-cos . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1060

C613-50292-01 Rev A Command Reference for IE210L Series 55

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

remark-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1058

remote-mirror interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447

repeat. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2061

revision (MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 590

rmdir. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

rmon alarm. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1992

rmon collection history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1994

rmon collection stats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1995

rmon event. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1996

route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1820

rpl role . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1525

rsakeypair (trustpoint configuration mode) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1379

sample-size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2104

script. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2062

security-password forced-change . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

security-password history. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

security-password lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

security-password minimum-categories. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

security-password minimum-length. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163

security-password min-lifetime-enforce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161

security-password reject-expired-pwd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164

security-password warning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

server (radsecproxy-aaa) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1284

server (server group). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1311

server auth-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1351

server enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1352

server mutual-authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1286

server name-check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1287

server trustpoint. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1288

service advanced-vty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

service dhcp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1821

service dhcp-snooping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1425

service http. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199

service ma-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306

service password-encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

C613-50292-01 Rev A Command Reference for IE210L Series 56

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

service power-inline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704

service ssh. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2019

service statistics interfaces counter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434

service telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168

service terminal-length (deleted). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

service-policy input. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1062

sflow agent (address) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2120

sflow collector (address) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2122

sflow collector max-datagram-size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2124

sflow enable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2125

sflow max-header-size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2126

sflow polling-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2128

sflow sampling-rate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2129

short-lease-threshold . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1822

show aaa local user locked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1290

show aaa local user locked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170

show aaa server group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1291

show access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953

show access-list (IPv4 Hardware ACLs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 954

show access-list (IPv4 Software ACLs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 990

show alarm settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461

show application-proxy whitelist interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1682

show application-proxy whitelist server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1684

show application-proxy whitelist supplicant . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1685

show arp security interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1428

show arp security statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1430

show arp security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1427

show arp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 753

show atmf area guests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1694

show atmf area guests-detail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1696

show atmf area nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1698

show atmf area nodes-detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1700

show atmf area summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1702

show atmf area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1691

show atmf authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1703

C613-50292-01 Rev A Command Reference for IE210L Series 57

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show atmf backup area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1710

show atmf backup guest. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1712

show atmf backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1706

show atmf container. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1714

show atmf detail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1717

show atmf group members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1721

show atmf group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1719

show atmf guests detail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1725

show atmf guests. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1723

show atmf links detail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1730

show atmf links guest detail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1741

show atmf links guest. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1739

show atmf links statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1745

show atmf links. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1728

show atmf nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1748

show atmf provision nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1750

show atmf recovery-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1752

show atmf secure-mode audit link . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1756

show atmf secure-mode audit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1755

show atmf secure-mode certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1757

show atmf secure-mode sa. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1760

show atmf secure-mode statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1763

show atmf secure-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1753

show atmf tech . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1765

show atmf virtual-links. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1768

show atmf working-set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1770

show atmf. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1687

show auth diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1227

show auth interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1229

show auth sessionstatistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1232

show auth statistics interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1233

show auth supplicant interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1237

show auth supplicant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1234

show auth two-step supplicant brief . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1238

show auth. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1225

C613-50292-01 Rev A Command Reference for IE210L Series 58

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show auth-web-server page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1240

show auth-web-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1239

show autoboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

show banner login. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2021

show boot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

show class-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1063

show clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

show counter dhcp-client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1824

show counter dhcp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1825

show counter ipv6 dhcp-client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1841

show counter log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414

show counter mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1988

show counter ntp (deprecated) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1863

show counter ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2106

show counter snmp-server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1880

show cpu history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

show cpu. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

show crypto key hostkey. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2022

show crypto key mypubkey rsa. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1380

show crypto key pubkey-chain knownhosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2024

show crypto key pubkey-chain userkey. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2025

show crypto key userkey . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2026

show crypto pki certificates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1381

show crypto pki enrollment user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1383

show crypto pki trustpoint . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1384

show debugging aaa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1292

show debugging alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462

show debugging arp security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1432

show debugging atmf packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1772

show debugging atmf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1771

show debugging dot1x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1107

show debugging epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1488

show debugging g8032. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1527

show debugging gvrp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 726

show debugging igmp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 871

C613-50292-01 Rev A Command Reference for IE210L Series 59

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show debugging ip dhcp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1433

show debugging ip packet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 754

show debugging lacp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 678

show debugging lldp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1954

show debugging loopprot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502

show debugging mld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 900

show debugging mstp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 591

show debugging platform packet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503

show debugging power-inline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705

show debugging private-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545

show debugging radius. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1313

show debugging sflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2130

show debugging snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1884

show debugging trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2064

show debugging udld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653

show debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232

show dhcp lease. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1826

show diagnostic channel-group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679

show dot1x diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1111

show dot1x interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1113

show dot1x sessionstatistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1118

show dot1x statistics interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1119

show dot1x supplicant interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1122

show dot1x supplicant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1120

show dot1x. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1108

show ecofriendly . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

show epsr <epsr-instance> counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1496

show epsr <epsr-instance> . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1495

show epsr common segments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1493

show epsr config-check. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1494

show epsr counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1497

show epsr summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1498

show epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1489

show etherchannel detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 682

show etherchannel summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683

C613-50292-01 Rev A Command Reference for IE210L Series 60

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show etherchannel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 681

show ethernet cfm details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309

show ethernet cfm domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314

show ethernet cfm errorlog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317

show ethernet cfm maintenance-points local mep. . . . . . . . . . . . . . . . . . . . . . . . 319

show ethernet cfm maintenance-points remote mep . . . . . . . . . . . . . . . . . . . . . 325

show ethernet cfm service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328

show exception log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 415

show facility-alarm status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 463

show file systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122

show file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

show flowcontrol interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504

show g8032 erp-instance statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1533

show g8032 erp-instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1528

show g8032 physical-ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1535

show g8032 profile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1537

show gvrp configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 727

show gvrp machine. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 728

show gvrp statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .729

show gvrp timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 730

show history. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

show hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773

show http . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

show interface access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 956

show interface brief. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 438

show interface err-disabled . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505

show interface memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234

show interface memory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 439

show interface status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441

show interface switchport . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506

show interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435

show ip access-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 992

show ip dhcp binding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1827

show ip dhcp pool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1828

show ip dhcp server statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1833

C613-50292-01 Rev A Command Reference for IE210L Series 61

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show ip dhcp server summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1835

show ip dhcp snooping acl. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1435

show ip dhcp snooping agent-option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1438

show ip dhcp snooping binding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1440

show ip dhcp snooping interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1442

show ip dhcp snooping statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1444

show ip dhcp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1434

show ip domain-list. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 774

show ip domain-name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775

show ip flooding-nexthops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756

show ip igmp groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 872

show ip igmp interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 874

show ip igmp snooping mrouter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876

show ip igmp snooping routermode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 877

show ip igmp snooping source-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 878

show ip igmp snooping statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 879

show ip interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757

show ip name-server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776

show ip route database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 824

show ip route summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 825

show ip route. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 822

show ip rrp snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1548

show ip sockets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 758

show ip source binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1447

show ip traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761

show ipv6 access-list (IPv6 Hardware ACLs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1016

show ipv6 access-list (IPv6 Software ACLs). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1023

show ipv6 dhcp interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1844

show ipv6 dhcp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1843

show ipv6 forwarding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 810

show ipv6 interface brief. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811

show ipv6 mld groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901

show ipv6 mld interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 902

show ipv6 mld snooping mrouter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 903

show ipv6 mld snooping statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 904

C613-50292-01 Rev A Command Reference for IE210L Series 62

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show ipv6 neighbors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812

show ipv6 route summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 815

show ipv6 route summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828

show ipv6 route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 813

show ipv6 route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826

show lacp sys-id . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 684

show lacp-counter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 685

show license brief . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

show license external . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192

show license. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185

show lldp interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1958

show lldp local-info. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1960

show lldp neighbors detail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1967

show lldp neighbors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1965

show lldp statistics interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1973

show lldp statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1971

show lldp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1956

show location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1975

show log config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418

show log external. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 420

show log permanent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421

show log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416

show loop-protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 507

show mac address-table thrash-limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511

show mac address-table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509

show mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1989

show memory allocations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238

show memory history. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

show memory pools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

show memory shared. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

show memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236

show mep-alarm status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331

show mirror interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450

show mirror . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449

show mls qos interface policer-counters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1068

C613-50292-01 Rev A Command Reference for IE210L Series 63

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show mls qos interface queue-counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1069

show mls qos interface storm-status. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1070

show mls qos interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1065

show mls qos maps cos-queue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1071

show mls qos maps premark-dscp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1072

show mls qos. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1064

show ntp associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1864

show ntp counters associations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1867

show ntp counters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1866

show ntp status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1868

show openflow config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1461

show openflow coverage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1463

show openflow flows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1465

show openflow rules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1468

show openflow ssl . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1470

show openflow status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1471

show ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2108

show platform classifier statistics utilization brief . . . . . . . . . . . . . . . . . . . . . . . .1073

show platform classifier statistics utilization brief . . . . . . . . . . . . . . . . . . . . . . . . . 515

show platform port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 518

show platform. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 512

show policy-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1076

show port etherchannel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686

show port-security interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 520

show port-security intrusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521

show port-vlan-forwarding-priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 546

show power-inline counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709

show power-inline interface detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 714

show power-inline interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711

show power-inline. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 706

show privilege. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

show process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243

show proxy-autoconfig-file . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1241

show ptp data transparent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1874

show ptp port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1875

C613-50292-01 Rev A Command Reference for IE210L Series 64

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show radius local-server group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1353

show radius local-server nas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1354

show radius local-server statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1355

show radius local-server user. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1356

show radius server group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1293

show radius statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1317

show radius . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1314

show reboot history . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245

show remote-mirror . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451

show rmon alarm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1997

show rmon event. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1998

show rmon history. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2000

show rmon statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2002

show router-id. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246

show running-config atmf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1773

show running-config interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

show running-config log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 422

show running-config sflow. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2132

show running-config snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1885

show running-config ssh. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2027

show running-config trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2065

show running-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124

show security-password configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172

show security-password user. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

show sflow interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2135

show sflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2133

show snmp-server community . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1887

show snmp-server group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1888

show snmp-server user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1889

show snmp-server view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1890

show snmp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1886

show spanning-tree brief . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 595

show spanning-tree mst config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597

show spanning-tree mst detail interface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600

show spanning-tree mst detail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598

C613-50292-01 Rev A Command Reference for IE210L Series 65

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show spanning-tree mst instance interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603

show spanning-tree mst instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602

show spanning-tree mst interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604

show spanning-tree mst . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596

show spanning-tree statistics instance interface . . . . . . . . . . . . . . . . . . . . . . . . . . 608

show spanning-tree statistics instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607

show spanning-tree statistics interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610

show spanning-tree statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605

show spanning-tree vlan range-index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612

show spanning-tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592

show ssh client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2031

show ssh server allow-users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2034

show ssh server deny-users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2035

show ssh server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2032

show ssh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2029

show startup-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

show static-channel-group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687

show storm-control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522

show system environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

show system fiber-monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272

show system interrupts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249

show system mac. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250

show system pluggable detail. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277

show system pluggable diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

show system pluggable. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

show system serialnumber. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

show system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247

show tacacs+. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1394

show tech-support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252

show telnet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

show test cable-diagnostics tdr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282

show trigger. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2066

show udld neighbors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 655

show udld port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656

show udld. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 654

C613-50292-01 Rev A Command Reference for IE210L Series 66

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

show users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

show version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

show vlan access-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 548

show vlan filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 549

show vlan private-vlan ufo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551

show vlan private-vlan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550

show vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547

shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 443

snmp trap link-status suppress . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1892

snmp trap link-status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1891

snmp-server community . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1896

snmp-server contact. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1897

snmp-server enable trap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1898

snmp-server engineID local reset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1903

snmp-server engineID local . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1901

snmp-server group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1904

snmp-server host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1906

snmp-server legacy-ifadminstatus. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1908

snmp-server location . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1909

snmp-server source-interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1910

snmp-server startup-trap-delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1911

snmp-server user . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1912

snmp-server view. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1915

snmp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1894

source-ip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2112

spanning-tree autoedge (RSTP and MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 613

spanning-tree bpdu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 614

spanning-tree cisco-interoperability (MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 616

spanning-tree edgeport (RSTP and MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617

spanning-tree enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618

spanning-tree errdisable-timeout enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 620

spanning-tree errdisable-timeout interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621

spanning-tree force-version. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 622

spanning-tree forward-time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623

spanning-tree guard root . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624

C613-50292-01 Rev A Command Reference for IE210L Series 67

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

spanning-tree hello-time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625

spanning-tree link-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626

spanning-tree max-age . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627

spanning-tree max-hops (MSTP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 628

spanning-tree mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629

spanning-tree mst configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630

spanning-tree mst instance path-cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632

spanning-tree mst instance priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 634

spanning-tree mst instance restricted-role. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635

spanning-tree mst instance restricted-tcn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 637

spanning-tree mst instance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 631

spanning-tree path-cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 638

spanning-tree portfast (STP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639

spanning-tree portfast bpdu-filter. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641

spanning-tree portfast bpdu-guard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 643

spanning-tree priority (bridge priority) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645

spanning-tree priority (port priority). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 646

spanning-tree restricted-role. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647

spanning-tree restricted-tcn . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 648

spanning-tree transmit-holdcount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 649

speed (asyn). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254

speed . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 523

ssh client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2038

ssh server allow-users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2042

ssh server authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2044

ssh server deny-users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2046

ssh server max-auth-tries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2048

ssh server resolve-host. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2049

ssh server scp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2050

ssh server sftp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2051

ssh server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2040

ssh . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2036

state . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1774

static-channel-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688

storm-action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1077

C613-50292-01 Rev A Command Reference for IE210L Series 68

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

storm-control level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 525

storm-downtime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1078

storm-protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1079

storm-rate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1080

storm-window. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1081

subject-name (trustpoint configuration). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1385

subnet-mask . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1836

sub-ring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1539

switchport access vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552

switchport atmf-agentlink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1776

switchport atmf-arealink remote-area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1777

switchport atmf-crosslink . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1779

switchport atmf-guestlink. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1781

switchport atmf-link . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1783

switchport mode access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553

switchport mode private-vlan trunk promiscuous. . . . . . . . . . . . . . . . . . . . . . . . . 555

switchport mode private-vlan trunk secondary . . . . . . . . . . . . . . . . . . . . . . . . . . . 557

switchport mode private-vlan ufo . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559

switchport mode private-vlan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554

switchport mode trunk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 561

switchport port-security aging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 527

switchport port-security maximum. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528

switchport port-security violation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529

switchport port-security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526

switchport private-vlan host-association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 562

switchport private-vlan mapping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563

switchport remote-mirror-egress. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453

switchport trunk allowed vlan. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564

switchport trunk native vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567

switchport vlan-stacking (double tagging). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 568

switchport voice dscp. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 569

switchport voice vlan priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 572

switchport voice vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 570

system territory (deprecated) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256

tacacs-server host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1396

C613-50292-01 Rev A Command Reference for IE210L Series 69

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

tacacs-server key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1398

tacacs-server timeout. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1399

tcpdump . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 763

telnet server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176

terminal length . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178

terminal monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

terminal resize. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179

test cable-diagnostics tdr interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283

test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2071

thrash-limiting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530

time (trigger) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2072

timeout (ping polling) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2114

timer (G.8032) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1540

topology-change . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1542

traceroute ipv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 816

traceroute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 764

trap (G.8032) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1544

trap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2074

trigger activate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2076

trigger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2075

trust dscp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1082

type atmf node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1784

type atmf node . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2077

type card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2080

type cpu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2081

type interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2082

type linkmon-probe . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2083

type log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2085

type memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2086

type periodic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2087

type ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2088

type reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2089

type time. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2090

udld aggressive-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 657

C613-50292-01 Rev A Command Reference for IE210L Series 70

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

udld enable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658

udld port aggressive-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 660

udld port disable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661

udld port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659

udld reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662

udld time disable-period. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 663

udld time message-interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 664

undebug aaa . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1295

undebug all . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 258

undebug atmf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1787

undebug dot1x. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1125

undebug epsr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1499

undebug g8032 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1545

undebug igmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 881

undebug ip packet interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 765

undebug lacp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 690

undebug loopprot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532

undebug mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1990

undebug mstp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650

undebug ping-poll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2116

undebug platform packet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533

undebug radius . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1318

undebug sflow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2136

undebug snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1916

undebug ssh client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2052

undebug ssh server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2053

undebug trigger. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2091

undebug udld . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665

unmount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

unmount . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423

up-count . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2115

user (RADIUS server) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1358

username . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1788

username . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180

vlan (RADIUS server) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1360

C613-50292-01 Rev A Command Reference for IE210L Series 71

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

vlan access-map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 574

vlan database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 575

vlan filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 576

vlan mode remote-mirror-vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 454

vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 573

vty access-class (numbered) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993

vty ipv6 access-class (named) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1024

wait . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427

write file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132

write memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

write terminal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

wrr-queue disable queues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1083

wrr-queue egress-rate-limit queues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1084

wrr-queue weight queues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1085

C613-50292-01 Rev A Command Reference for IE210L Series 72

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Part 1: Setup and Troubleshooting

C613-50292-01 Rev A Command Reference for IE210L Series 73

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI Navigation

Commands

Introduction

Overview This chapter provides an alphabetical reference for the commands used to

navigate between different modes. This chapter also provides a reference for the

help and show commands used to help navigate within the CLI.

Command List •“configure terminal” on page 74

•“disable (Privileged Exec mode)” on page 75

•“do” on page 76

•“enable (Privileged Exec mode)” on page 77

•“end” on page 79

•“exit” on page 80

•“help” on page 81

•“logout” on page 82

•“show history” on page 83

C613-50292-01 Rev A Command Reference for IE210L Series 74

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

CONFIGURE TERMINAL

configure terminal

Overview This command enters the Global Configuration command mode.

Syntax configure terminal

Mode Privileged Exec

Example To enter the Global Configuration command mode (note the change in the

command prompt), enter the command:

awplus# configure terminal

awplus(config)#

C613-50292-01 Rev A Command Reference for IE210L Series 75

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

DISABLE (PRIVILEGED EXEC MODE)

disable (Privileged Exec mode)

Overview This command exits the Privileged Exec mode, returning the prompt to the User

Exec mode. To end a session, use the exit command.

Syntax disable

Mode Privileged Exec

Example To exit the Privileged Exec mode, enter the command:

awplus# disable

awplus>

Commands

enable (Privileged Exec mode)

end

exit

C613-50292-01 Rev A Command Reference for IE210L Series 76

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

Overview This command lets you to run User Exec and Privileged Exec mode commands

when you are in any configuration mode.

Syntax do <command>

Mode Any configuration mode

Example awplus# configure terminal

awplus(config)# do ping 192.0.2.23

Parameter Description

<command>Specify the command and its parameters.

C613-50292-01 Rev A Command Reference for IE210L Series 77

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

ENABLE (PRIVILEGED EXEC MODE)

enable (Privileged Exec mode)

Overview This command enters the Privileged Exec mode and optionally changes the

privilege level for a session. If a privilege level is not specified then the maximum

privilege level (15) is applied to the session. If the optional privilege level is omitted

then only users with the maximum privilege level can access Privileged Exec mode

without providing the password as specified by the enable password or enable

secret commands. If no password is specified then only users with the maximum

privilege level set with the username command can assess Privileged Exec mode.

Syntax enable [<privilege-level>]

Mode User Exec

Usage Many commands are available from the Privileged Exec mode that configure

operating parameters for the device, so you should apply password protection to

the Privileged Exec mode to prevent unauthorized use. Passwords can be

encrypted but then cannot be recovered. Note that non-encrypted passwords are

shown in plain text in configurations.

The username command sets the privilege level for the user. After login, users are

given access to privilege level 1. Users access higher privilege levels with the

enable (Privileged Exec mode) command. If the privilege level specified is higher

than the users configured privilege level specified by the username command,

then the user is prompted for the password for that level.

Note that a separate password can be configured for each privilege level using the

enable password and the enable secret commands from the Global Configuration

mode. The service password-encryption command encrypts passwords

configured by the enable password and the enable secret commands, so

passwords are not shown in plain text in configurations.

Example The following example shows the use of the enable command to enter the

Privileged Exec mode (note the change in the command prompt).

awplus> enable

awplus#

The following example shows the enable command enabling access the

Privileged Exec mode for users with a privilege level of 7 or greater. Users with a

privilege level of 7 or greater do not need to enter a password to access Privileged

Exec mode. Users with a privilege level 6 or less need to enter a password to access

Parameter Description

<privilege

- level>Specify the privilege level for a CLI session in the range <1-15>, where

15 is the maximum privilege level, 7 is the intermediate privilege level

and 1 is the minimum privilege level. The privilege level for a user must

match or exceed the privilege level set for the CLI session for the user

to access Privileged Exec mode. Privilege level for a user is configured

by username.

C613-50292-01 Rev A Command Reference for IE210L Series 78

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

ENABLE (PRIVILEGED EXEC MODE)

Privilege Exec mode. Use the enable password command or the enable secret

commands to set the password to enable access to Privileged Exec mode.

awplus> enable 7

awplus#

Commands

disable (Privileged Exec mode)

enable password

enable secret

exit

service password-encryption

username

C613-50292-01 Rev A Command Reference for IE210L Series 79

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

END

end

Overview This command returns the prompt to the Privileged Exec command mode from

any other advanced command mode.

Syntax end

Mode All advanced command modes, including Global Configuration and Interface

Configuration modes.

Example The following example shows the use of the end command to return to the

Privileged Exec mode directly from Interface mode.

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# end

awplus#

Commands

disable (Privileged Exec mode)

enable (Privileged Exec mode)

exit

C613-50292-01 Rev A Command Reference for IE210L Series 80

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

EXIT

exit

Overview This command exits the current mode, and returns the prompt to the mode at the

previous level. When used in User Exec mode, the exit command terminates the

session.

Syntax exit

Mode All command modes, including Global Configuration and Interface Configuration

modes.

Example The following example shows the use of the exit command to exit Interface mode,

and return to Configure mode.

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# exit

awplus(config)#

Commands

disable (Privileged Exec mode)

enable (Privileged Exec mode)

end

C613-50292-01 Rev A Command Reference for IE210L Series 81

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

HELP

help

Overview This command displays a description of the AlliedWare Plus™ OS help system.

Syntax help

Mode All command modes

Example To display a description on how to use the system help, use the command:

awplus# help

Output Figure 1-1: Example output from the help command

When you need help at the command line, press '?'.



If nothing matches, the help list will be empty. Delete 

characters until entering a '?' shows the available options.



Enter '?' after a complete parameter to show remaining valid 

command parameters (e.g. 'show ?').



Enter '?' after part of a parameter to show parameters that 

complete the typed letters (e.g. 'show ip?').

C613-50292-01 Rev A Command Reference for IE210L Series 82

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

LOGOUT

logout

Overview This command exits the User Exec or Privileged Exec modes and ends the session.

Syntax logout

Mode User Exec and Privileged Exec

Example To exit the User Exec mode, use the command:

awplus# logout

C613-50292-01 Rev A Command Reference for IE210L Series 83

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CLI NAVIGATION COMMANDS

SHOW HISTORY

show history

Overview This command lists the commands entered in the current session. The history

buffer is cleared automatically upon reboot.

The output lists all command line entries, including commands that returned an

error.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show history

Mode User Exec and Privileged Exec

Example To display the commands entered during the current session, use the command:

awplus# show history

Output Figure 1-2: Example output from the show history command

1 en

2 show ru

3 conf t

4 route-map er deny 3

5 exit

6 ex

7 di

C613-50292-01 Rev A Command Reference for IE210L Series 84

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

File and

Configuration

Management

Commands

Introduction

Overview This chapter provides an alphabetical reference of AlliedWare Plus™ OS file and

configuration management commands.

Filename Syntax

and Keyword

Usage

Many of the commands in this chapter use the placeholder “filename” to represent

the name and location of the file that you want to act on. The following table

explains the syntax of the filename for each different type of file location.

When you copy a

file... Use this syntax: Example:

Copying in local

Flash memory flash:[/][<directory>/]<filename>To specify a file in the configs directory

in Flash:

flash:configs/example.cfg

Copying to or from

an SD (or SDHC)

card

card:[/][<directory>/]<filename>To specify a file in the top-level

directory of the SD card:

card:example.cfg

Copying with

HTTP http://[[<username>:<password>]@]

{<hostname>|<host-ip>}[/<filepath

>]/<filename>

To specify a file in the configs directory

on the server:

http://www.company.com/configs/exa

mple.cfg

Copying with TFTP tftp://[[<location>]/<directory>]

/<filename>To specify a file in the top-level

directory of the server:

tftp://172.1.1.1/example.cfg

Copying with SCP scp://<username>@<location>[/<dir

ectory>][/<filename>] To specify a file in the configs directory

on the server, logging on as user “bob”:

e.g.

scp://bob@10.10.0.12/configs/example

.cfg

Copying with SFTP sftp://[[<location>]/<directory>]

/<filename>To specify a file in the top-level

directory of the server:

sftp://10.0.0.5/example.cfg

C613-50292-01 Rev A Command Reference for IE210L Series 85

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

Valid characters The filename and path can include characters from up to four categories. The

categories are:

1) uppercase letters: A to Z

2) lowercase letters: a to z

3) digits: 0 to 9

4) special symbols: most printable ASCII characters not included in the previous

three categories, including the following characters:

•-

•/

•.

•_

•@

•"

•'

•*

•:

•~

•?

Do not use spaces, parentheses or the + symbol within filenames. Use hyphens or

underscores instead.

Syntax for

directory listings

A leading slash (/) indicates the root of the current filesystem location.

In commands where you need to specify the local filesystem’s Flash base directory,

you may use flash or flash: or flash:/. For example, these commands are all the

same:

•dir flash

•dir flash:

•dir flash:/

Similarly, you can specify the SD (or SDHC) card base directory with card or card:

or card:/

You cannot name a directory or subdirectory flash, nvs, usb, card, tftp, scp, sftp

or http. These keywords are reserved for tab completion when using various file

commands.

Command List •“autoboot enable” on page 87

•“boot config-file” on page 88

•“boot config-file backup” on page 90

•“boot system” on page 91

C613-50292-01 Rev A Command Reference for IE210L Series 86

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

•“boot system backup” on page 93

•“cd” on page 94

•“copy (filename)” on page 95

•“copy current-software” on page 97

•“copy debug” on page 98

•“copy running-config” on page 99

•“copy startup-config” on page 100

•“copy zmodem” on page 101

•“create autoboot” on page 102

•“delete” on page 103

•“delete debug” on page 104

•“dir” on page 105

•“edit” on page 107

•“edit (filename)” on page 108

•“erase factory-default” on page 109

•“erase startup-config” on page 110

•“ip tftp source-interface” on page 111

•“ipv6 tftp source-interface” on page 112

•“mkdir” on page 113

•“move” on page 114

•“move debug” on page 115

•“pwd” on page 116

•“rmdir” on page 117

•“show autoboot” on page 118

•“show boot” on page 119

•“show file” on page 121

•“show file systems” on page 122

•“show running-config” on page 124

•“show running-config interface” on page 127

•“show startup-config” on page 129

•“show version” on page 130

•“unmount” on page 131

•“write file” on page 132

•“write memory” on page 133

•“write terminal” on page 134

C613-50292-01 Rev A Command Reference for IE210L Series 87

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

AUTOBOOT ENABLE

autoboot enable

Overview This command enables the device to restore a release file and/or a configuration

file from an SD card.

When the Autoboot feature is enabled, the device looks for a special file called

autoboot.txt on the external media. If this file exists, the device will check the key

and values in the file and recover the device with a new release file and/or

configuration file from the external media. An example of a valid autoboot.txt file

is shown in the following figure.

Figure 2-1: Example autoboot.txt file

Use the no variant of this command to disable the Autoboot feature.

Syntax autoboot enable

no autoboot enable

Default The Autoboot feature operates the first time the device is powered up in the field,

after which the feature is disabled by default.

Mode Global Configuration

Example To enable the Autoboot feature, use the command:

awplus# configure terminal

awplus(config)# autoboot enable

Commands

create autoboot

show autoboot

show boot

[AlliedWare Plus]

Copy_from_external_media_enabled=yes

Boot_Release=IE210-5.4.9-0.1.rel

Boot_Config=network1.cfg

C613-50292-01 Rev A Command Reference for IE210L Series 88

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

BOOT CONFIG-FILE

boot config-file

Overview Use this command to set the configuration file to use during the next boot cycle.

Use the no variant of this command to remove the configuration file.

Syntax boot config-file <filepath-filename>

no boot config-file

Mode Global Configuration

Usage You can only specify that the configuration file is on an SD card if there is a backup

configuration file already specified in Flash. If you attempt to set the configuration

file on an SD card and a backup configuration file is not specified in Flash, the

following error message is displayed:

In addition, you can only specify that the configuration file is on an SD card if the

card is writable.

For an explanation of the configuration fallback order, see the File Management

Feature Overview and Configuration Guide.

Examples To run the configuration file “branch.cfg” the next time the device boots up, when

“branch.cfg” is stored on the device’s Flash filesystem, use the commands:

awplus# configure terminal

awplus(config)# boot config-file flash:/branch.cfg

To stop running the configuration file “branch.cfg” when the device boots up,

when “branch.cfg” is stored on the device’s Flash filesystem, use the commands:

awplus# configure terminal

awplus(config)# no boot config-file flash:/branch.cfg

To run the configuration file “branch.cfg” the next time the device boots up, when

“branch.cfg” is stored on an SD card, use the commands:

awplus# configure terminal

awplus(config)# boot config-file card:/branch.cfg

Parameter Description

<filepath-filename> Filepath and name of a configuration file.

The specified configuration file must exist in the

specified filesystem.

Valid configuration files must have a . cfg extension.

% Backup configuration files must be stored in the flash

filesystem

C613-50292-01 Rev A Command Reference for IE210L Series 89

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

BOOT CONFIG-FILE

To stop running the configuration file “branch.cfg” when the device boots up,

when “branch.cfg” is stored on an SD card, use the commands:

awplus# configure terminal

awplus(config)# no boot config-file card:/branch.cfg

Commands

boot config-file backup

boot system

boot system backup

show boot

C613-50292-01 Rev A Command Reference for IE210L Series 90

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

BOOT CONFIG-FILE BACKUP

boot config-file backup

Overview Use this command to set a backup configuration file to use if the main

configuration file cannot be accessed.

Use the no variant of this command to remove the backup configuration file.

Syntax boot config-file backup <filepath-filename>

no boot config-file backup

Mode Global Configuration

Usage For an explanation of the configuration fallback order, see the File Management

Feature Overview and Configuration Guide.

Examples To set the configuration file backup.cfg as the backup to the main

configuration file, use the commands:

awplus# configure terminal

awplus(config)# boot config-file backup flash:/backup.cfg

To remove the configuration file backup.cfg as the backup to the main

configuration file, use the commands:

awplus# configure terminal

awplus(config)# no boot config-file backup flash:/backup.cfg

Commands

boot config-file

boot system

boot system backup

show boot

Parameter Description

<filepath-filename> Filepath and name of a backup configuration file.

Backup configuration files must be in the Flash filesystem.

Valid backup configuration files must have a . cfg

extension.

backup The specified file is a backup configuration file.

C613-50292-01 Rev A Command Reference for IE210L Series 91

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

BOOT SYSTEM

boot system

Overview Use this command to set the release file to load during the next boot cycle.

Use the no variant of this command to stop specifying a primary release file to boot

from. If the device boots up with no release file set, it will use autoboot or the

backup release file if either of those are configured, or you can use the boot menu

to select a release file source. To access the boot menu, type Ctrl-B at bootup.

Syntax boot system <filepath-filename>

no boot system

Mode Global Configuration

Usage You can only specify that the release file is on an SD card if there is a backup release

file already specified in Flash. If you attempt to set the release file on an SD card and

a backup release file is not specified in Flash, the following error message is

displayed:

In addition, you can only specify that the configuration file is on an SD card if the

card is writable.

Examples To boot up with the release IE210-5.4.9-0.1.rel file the next time the device boots

up, when the release file is stored on the device’s Flash filesystem, use the

commands:

awplus# configure terminal

awplus(config)# boot system flash:/IE210-5.4.9-0.1.rel

To run the release file IE210-5.4.9-0.1.rel the next time the device boots up, when

the release file is stored on an SD card, use the commands:

awplus# configure terminal

awplus(config)# boot system card:/IE210-5.4.9-0.1.rel

Parameter Description

<filepath-filename> Filepath and name of a release file.

The specified release file must exist and must be stored

in the root directory of the specified filesystem.

Valid release files must have a . rel extension.

A backup boot image must be set before setting a current boot 

image on card

C613-50292-01 Rev A Command Reference for IE210L Series 92

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

BOOT SYSTEM

Commands

boot config-file

boot config-file backup

boot system backup

show boot

C613-50292-01 Rev A Command Reference for IE210L Series 93

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

BOOT SYSTEM BACKUP

boot system backup

Overview Use this command to set a backup release file to load if the main release file cannot

be loaded.

Use the no variant of this command to stop specifying a backup release file.

Syntax boot system backup <filepath-filename>

no boot system backup

Mode Global Configuration

Examples To specify the file IE210-5.4.8-2.1.rel as the backup to the main release file, use the

commands:

awplus# configure terminal

awplus(config)# boot system backup flash:/IE210-5.4.8-2.1.rel

To stop specifying a backup to the main release file, use the commands:

awplus# configure terminal

awplus(config)# no boot system backup

Commands

boot config-file

boot config-file backup

boot system

show boot

Parameter Description

<filepath-filename> Filepath and name of a backup release file.

Backup release files must be in the Flash filesystem.

Valid release files must have a . rel extension.

backup The specified file is a backup release file.

C613-50292-01 Rev A Command Reference for IE210L Series 94

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

Overview This command changes the current working directory.

Syntax cd <directory-name>

Mode Privileged Exec

Example To change to the directory called images, use the command:

awplus# cd images

Commands

dir

pwd

show file systems

Parameter Description

<directory-name> Name and path of the directory.

C613-50292-01 Rev A Command Reference for IE210L Series 95

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

COPY (FILENAME)

copy (filename)

Overview This command copies a file. This allows you to:

• copy files from your device to a remote device

• copy files from a remote device to your device

• copy files stored on Flash memory to or from a different memory type, such

as an SD card

• create two copies of the same file on your device

Syntax copy [force] <source-name> <destination-name>

Mode Privileged Exec

Examples To use TFTP to copy the file “bob.key” into the current directory from the remote

server at 10.0.0.1, use the command:

awplus# copy tftp://10.0.0.1/bob.key bob.key

To use SFTP to copy the file “new.cfg” into the current directory from a remote

server at 10.0.1.2, use the command:

awplus# copy sftp://10.0.1.2/new.cfg bob.key

To use SCP with the username “beth” to copy the file old.cfg into the directory

config_files on a remote server that is listening on TCP port 2000, use the

command:

awplus# copy scp://beth@serv:2000/config_files/old.cfg old.cfg

To copy the file “newconfig.cfg” onto your device’s Flash from an SD (or SDHC)

Card, use the command:

awplus# copy card:/newconfig.cfg flash:/newconfig.cfg

To copy the file “newconfig.cfg” to an SD (or SDHC) Card from your device’s Flash,

use the command:

awplus# copy flash:/newconfig.cfg card:/newconfig.cfg

Parameter Description

force This parameter forces the copy command to overwrite the

destination file, if it already exists, without prompting the

user for confirmation.

<source-name> The filename and path of the source file. See Introduction

on page 84 for valid syntax.

<destination-name> The filename and path for the destination file. See

Introduction on page 84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 96

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

COPY (FILENAME)

To copy the file “config.cfg” into the current directory from an SD (or SDHC) Card,

and rename it to “configtest.cfg”, use the command:

awplus# copy card:/config.cfg configtest.cfg

To copy the file “config.cfg” into the current directory from a remote file server, and

rename it to “configtest.cfg”, use the command:

awplus# copy fserver:/config.cfg configtest.cfg

On an AMF network, to copy the file “file.txt” from the node named master to the

Flash memory of the local node, use the commands:

awplus# atmf working-set group all

network-name[80]# copy master.atmf/flash:/file.txt flash:

Commands

copy zmodem

copy buffered-log

copy permanent-log

edit (filename)

show file systems

C613-50292-01 Rev A Command Reference for IE210L Series 97

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

COPY CURRENT-SOFTWARE

copy current-software

Overview This command copies the AlliedWare Plus™ OS software that the device has

booted from, to a destination file. Specify whether the destination is Flash or card

when saving the software to the local filesystem.

Syntax copy current-software <destination-name>

Mode Privileged Exec

Example To copy the current software as installed in the working directory with the file

name my-release.rel, use the command:

awplus# copy current-software my-release.rel

Commands

boot system backup

show boot

Parameter Description

<destination-name> The filename and path where you would like the current

running-release saved. This command creates a file if no file

exists with the specified filename. If a file already exists,

then the CLI prompts you before overwriting the file. See

Introduction on page 84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 98

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

COPY DEBUG

copy debug

Overview This command copies a specified debug file to a destination file.

Syntax copy debug {<destination-name>|card|debug|flash|scp|tftp}

{<source-name>|card|debug|flash|scp|tftp}

Mode Privileged Exec

Example To copy debug output to a file on flash called “my-debug”, use the following

command:

awplus# copy debug flash:my-debug

To copy debug output to an SD (or SDHC) card with a filename “my-debug”, use

the following command:

awplus# copy debug card:my-debug

Output Figure 2-2: CLI prompt after entering the copy debug command

Commands

delete debug

move debug

Parameter Description

<destination-name> The filename and path where you would like the debug

output saved. See Introduction on page 84 for valid syntax.

<source-name> The filename and path where the debug output originates.

See the Introduction to this chapter for valid syntax.

Enter source file name []:

C613-50292-01 Rev A Command Reference for IE210L Series 99

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

COPY RUNNING-CONFIG

copy running-config

Overview This command copies the running-config to a destination file, or copies a source

file into the running-config. Commands entered in the running-config do not

survive a device reboot unless they are saved in a configuration file.

Syntax copy <source-name> running-config

copy running-config [<destination-name>]

copy running-config startup-config

Mode Privileged Exec

Examples To copy the running-config into the startup-config, use the command:

awplus# copy running-config startup-config

To copy the file layer3.cfg into the running-config, use the command:

awplus# copy layer3.cfg running-config

To use SCP to copy the running-config as current.cfg to the remote server

listening on TCP port 2000, use the command:

awplus# copy running-config

scp://user@server:2000/config_files/current.cfg

Commands

copy startup-config

write file

write memory

Parameter Description

<source-name>The filename and path of a configuration file. This must be

a valid configuration file with a . cfg filename extension.

Specify this when you want the script in the file to become

the new running-config. See Introduction on page 84 for

valid syntax.

<destination-name>The filename and path where you would like the current

running-config saved. This command creates a file if no file

exists with the specified filename. If a file already exists,

then the CLI prompts you before overwriting the file. See

Introduction on page 84 for valid syntax. If you do not

specify a file name, the device saves the running-config to

a file called default.cfg.

startup-config Copies the running-config into the file set as the current

startup-config file.

C613-50292-01 Rev A Command Reference for IE210L Series 100

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

COPY STARTUP-CONFIG

copy startup-config

Overview This command copies the startup-config script into a destination file, or

alternatively copies a configuration script from a source file into the startup-config

file. Specify whether the destination is Flash or card when loading from the local

filesystem.

Syntax copy <source-name> startup-config

copy startup-config <destination-name>

Mode Privileged Exec

Examples To copy the file Layer3.cfg to the startup-config, use the command:

awplus# copy Layer3.cfg startup-config

To copy the startup-config as the file oldconfig.cfg in the current

directory, use the command:

awplus# copy startup-config oldconfig.cfg

Commands

copy running-config

Parameter Description

<source-name> The filename and path of a configuration file. This must be

a valid configuration file with a . cfg filename extension.

Specify this to copy the script in the file into the startup-

config file. Note that this does not make the copied file the

new startup file, so any further changes made in the

configuration file are not added to the startup-config file

unless you reuse this command. See Introduction on page

84 for valid syntax.

<destination-name> The destination and filename that you are saving the

startup- config as. This command creates a file if no file

exists with the specified filename. If a file already exists,

then the CLI prompts you before overwriting the file. See

Introduction on page 84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 101

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

COPY ZMODEM

copy zmodem

Overview This command allows you to copy files using ZMODEM using Minicom. ZMODEM

works over a serial connection and does not need any interfaces configured to do

a file transfer.

Syntax copy <source-name> zmodem

copy zmodem

Mode Privileged Exec

Example To copy the local file asuka.key using ZMODEM, use the command:

awplus# copy asuka.key zmodem

Commands

copy (filename)

show file systems

Parameter Description

<source-name> The filename and path of the source file. See Introduction on

page 84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 102

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

CREATE AUTOBOOT

create autoboot

Overview Use this command to create an autoboot.txt file on an external storage device. This

command will automatically ensure that the keys and values that are expected in

this file are correct. After the file is created the create autoboot command will

copy the current release and configuration files across to the external storage

device. The external storage device is then available to restore a release file and/or

a configuration file to the device.

Syntax create autoboot card

Mode Privileged Exec

Example To create an autoboot.txt file on an SD card, use the command:

awplus# create autoboot card

Commands

autoboot enable

show autoboot

show boot

C613-50292-01 Rev A Command Reference for IE210L Series 103

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

DELETE

delete

Overview This command deletes files or directories.

Syntax delete [force] [recursive] <filename>

Mode Privileged Exec

Examples To delete the file temp.cfg from the current directory, use the command:

awplus# delete temp.cfg

To delete the read-only file one.cfg from the current directory, use the

command:

awplus# delete force one.cfg

To delete the directory old_configs, which is not empty, use the command:

awplus# delete recursive old_configs

To delete the directory new_configs, which is not empty, without prompting if

any read-only files are being deleted, use the command:

awplus# delete force recursive new_configs

Commands

erase startup-config

rmdir

Parameter Description

force Ignore nonexistent filenames and never prompt before deletion.

recursive Remove the contents of directories recursively.

<filename>The filename and path of the file to delete. See Introduction on page

84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 104

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

DELETE DEBUG

delete debug

Overview Use this command to delete a specified debug output file.

Syntax delete debug <source-name>

Mode Privileged Exec

Example To delete debug output, use the following command:

awplus# delete debug

Output Figure 2-3: CLI prompt after entering the delete debug command

Commands

copy debug

move debug

Parameter Description

<source-name> The filename and path where the debug output originates.

See Introduction on page 84 for valid URL syntax.

Enter source file name []:

C613-50292-01 Rev A Command Reference for IE210L Series 105

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

DIR

dir

Overview This command lists the files on a filesystem. If you don’t specify a directory or file,

then this command lists the files in the current directory.

Syntax dir [all] [recursive] [sort [reverse] [name|size|time]]

[<filename>|card|debug|flash|nvs]

Mode Privileged Exec

Examples To list the files in the current working directory, use the command:

awplus# dir

To list the non-hidden files in the root of the Flash filesystem, use the command:

awplus# dir flash

To list all the files in the root of the Flash filesystem, use the command:

awplus# dir all flash:

To list recursively the files in the Flash filesystem, use the command:

awplus# dir recursive flash:

To list the files in alphabetical order, use the command:

awplus# dir sort name

Parameter Description

all List all files.

recursive List the contents of directories recursively.

sort Sort directory listing.

reverse Sort using reverse order.

name Sort by name.

size Sort by size.

time Sort by modification time (default).

<filename>The name of the directory or file. If you don’t specify a

directory or file, then this command lists the files in the

current directory.

card SD (or SDHC) card root directory

debug Debug root directory

flash Flash memory root directory

nvs NVS memory root directory

C613-50292-01 Rev A Command Reference for IE210L Series 106

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

DIR

To list the files by size, smallest to largest, use the command:

awplus# dir sort reverse size

To sort the files by modification time, oldest to newest, use the command:

awplus# dir sort reverse time

Output Figure 2-4: Example output from the dir command

Commands

pwd

awplus#dir

630 -rw- May 19 2016 23:36:31 example.cfg

23652123 -rw- May 17 2016 03:41:18 

149 -rw- Feb 9 2016 00:40:35 exception.log

C613-50292-01 Rev A Command Reference for IE210L Series 107

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

EDIT

edit

Overview This command opens a text file in the AlliedWare Plus™ text editor. Once opened

you can use the editor to alter to the file.

If a filename is specified and it already exists, then the editor opens it in the text

editor.

If no filename is specified, the editor prompts you for one when you exit it.

Before starting the editor make sure your terminal, terminal emulation program, or

Telnet client is 100% compatible with a VT100 terminal. The editor uses VT100

control sequences to display text on the terminal.

For more information about using the editor, including control sequences, see the

File Management Feature Overview and Configuration Guide.

Syntax edit [<filename>]

Mode Privileged Exec

Examples To create and edit a new text file, use the command:

awplus# edit

To edit the existing configuration file myconfig.cfg stored on your device’s

Flash memory, use the command:

awplus# edit myconfig.cfg

Commands

edit (filename)

show file

Parameter Description

<filename> Name of a file in the local Flash filesystem.

C613-50292-01 Rev A Command Reference for IE210L Series 108

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

EDIT (FILENAME)

edit (filename)

Overview This command opens a remote text file as read-only in the AlliedWare Plus™ text

editor.

Before starting the editor make sure your terminal, terminal emulation program, or

Telnet client is 100% compatible with a VT100 terminal. The editor uses VT100

control sequences to display text on the terminal.

Syntax edit <filename>

Mode Privileged Exec

Example To view the file bob.key stored in the security directory of a TFTP server, use the

command:

awplus# edit tftp://security/bob.key

Commands

copy (filename)

edit

show file

Parameter Description

<filename> The filename and path of the remote file. See Introduction on

page 84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 109

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

ERASE FACTORY-DEFAULT

erase factory-default

Overview This command erases all data from Flash except the following:

• the boot release file (a .rel file) and its release setting file

• all license files

• the latest GUI release file

The device is then rebooted and returned to its factory default condition. The

device can then be used for AMF automatic node recovery.

Syntax erase factory-default

Mode Privileged Exec.

Usage This command is an alias to the atmf cleanup command.

Example To erase data, use the command:

Node_1# erase factory-default

This command will erase all NVS, all flash contents except for

the boot release, a GUI resource file, and any license files,

and then reboot the switch. Continue? (y/n):y

Commands

atmf cleanup

C613-50292-01 Rev A Command Reference for IE210L Series 110

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

ERASE STARTUP-CONFIG

erase startup-config

Overview This command deletes the file that is set as the startup-config file, which is the

configuration file that the system runs when it boots up.

At the next restart, the device loads the default configuration file, default.cfg. If

default.cfg no longer exists, then the device loads with the factory default

configuration. This provides a mechanism for you to return the device to the

factory default settings.

Syntax erase startup-config

Mode Privileged Exec

Example To delete the file currently set as the startup-config, use the command:

awplus# erase startup-config

Commands

boot config-file backup

copy running-config

copy startup-config

show boot

C613-50292-01 Rev A Command Reference for IE210L Series 111

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

IP TFTP SOURCE-INTERFACE

ip tftp source-interface

Overview Use this command to manually specify the IP address that all TFTP requests

originate from. This is useful in network configurations where TFTP servers only

accept requests from certain devices, or where the server cannot dynamically

determine the source of the request.

Use the no variant of this command to stop specifying a source.

Syntax ip tftp source-interface [<interface>|<ip-add>]

no ip tftp source-interface

Default There is no default source specified.

Mode Global Configuration

Usage This command is helpful in network configurations where TFTP traffic needs to

traverse point-to-point links or subnets within your network, and you do not want

to propagate those point-to-point links through your routing tables.

In those circumstances, the TFTP server cannot dynamically determine the source

of the TFTP request, and therefore cannot send the requested data to the correct

device. Specifying a source interface or address enables the TFTP server to send the

data correctly.

Example To specify that TFTP requests originate from the IP address 192.0.2.1, use the

following commands:

awplus# configure terminal

awplus(config)# ip tftp source-interface 192.0.2.1

Commands

copy (filename)

Parameter Description

<interface> The VLAN that TFTP requests originate from. The device will use

the IP address of this interface as its source IP address.

<ip-add> The IP address that TFTP requests originate from, in dotted

decimal format

C613-50292-01 Rev A Command Reference for IE210L Series 112

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

IPV6 TFTP SOURCE-INTERFACE

ipv6 tftp source-interface

Overview Use this command to manually specify the IPv6 address that all TFTP requests

originate from. This is useful in network configurations where TFTP servers only

accept requests from certain devices, or where the server cannot dynamically

determine the source of the request.

Use the no variant of this command to stop specifying a source.

Syntax ipv6 tftp source-interface [<interface>|<ipv6-add>]

no ipv6 tftp source-interface

Default There is no default source specified.

Mode Global Configuration

Usage This command is helpful in network configurations where TFTP traffic needs to

traverse point-to-point links or subnets within your network, and you do not want

to propagate those point-to-point links through your routing tables.

In those circumstances, the TFTP server cannot dynamically determine the source

of the TFTP request, and therefore cannot send the requested data to the correct

device. Specifying a source interface or address enables the TFTP server to send the

data correctly.

Example To specify that TFTP requests originate from the IPv6 address 2001:db8::8a2e:7334,

use the following commands:

awplus# configure terminal

awplus(config)# ipv6 tftp source-interface 2001:db8::8a2e:7334

Commands

copy (filename)

Parameter Description

<interface> The VLAN that TFTP requests originate from. The device will use

the IPv6 address of this interface as its source IPv6 address.

<ipv6-add> The IPv6 address that TFTP requests originate from, in the format

x:x::x:x, for example, 2001:db8::8a2e:7334.

C613-50292-01 Rev A Command Reference for IE210L Series 113

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

MKDIR

mkdir

Overview This command makes a new directory.

Syntax mkdir <name>

Mode Privileged Exec

Usage You cannot name a directory or subdirectory flash, nvs, usb, card, tftp, scp, sftp

or http. These keywords are reserved for tab completion when using various file

commands.

Example To make a new directory called images in the current directory, use the

command:

awplus# mkdir images

Commands

dir

pwd

Parameter Description

<name> The name and path of the directory that you are creating.

C613-50292-01 Rev A Command Reference for IE210L Series 114

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

MOVE

move

Overview This command renames or moves a file.

Syntax move <source-name> <destination-name>

Mode Privileged Exec

Examples To rename the file temp.cfg to startup.cfg, use the command:

awplus# move temp.cfg startup.cfg

To move the file temp.cfg from the root of the Flash filesystem to the directory

myconfigs, use the command:

awplus# move temp.cfg myconfigs/temp.cfg

Commands

delete

edit

show file

show file systems

Parameter Description

<source-name> The filename and path of the source file. See Introduction

on page 84 for valid syntax.

<destination-name> The filename and path of the destination file. See

Introduction on page 84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 115

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

MOVE DEBUG

move debug

Overview This command moves a specified debug file to a destination debug file.

Syntax move debug {<destination-name>|card|debug|flash}

Mode Privileged Exec

Example To move debug output into Flash memory with a filename “my-debug”, use the

following command:

awplus# move debug flash:my-debug

To move debug output onto an SD (or SDHC) card with a filename “my-debug”, use

the following command:

awplus# move debug card:my-debug

Output Figure 2-5: CLI prompt after entering the move debug command

Commands

copy debug

delete debug

Parameter Description

<destination-name> The filename and path where you would like the debug

output moved to. See Introduction on page 84 for valid

syntax.

Enter source file name []:

C613-50292-01 Rev A Command Reference for IE210L Series 116

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

PWD

pwd

Overview This command prints the current working directory.

Syntax pwd

Mode Privileged Exec

Example To print the current working directory, use the command:

awplus# pwd

Commands

C613-50292-01 Rev A Command Reference for IE210L Series 117

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

RMDIR

rmdir

Overview This command removes a directory. This command only works on empty

directories, unless you specify the optional force keyword.

Syntax rmdir [force] <name>

Mode Privileged Exec

Examples To remove the directory “images” from the top level of the Flash filesystem, use the

command:

awplus# rmdir flash:/images

To create a directory called “level1” containing a subdirectory called “level2”, and

then force the removal of both directories, use the commands:

awplus# mkdir level1

awplus# mkdir level1/level2

awplus# rmdir force level1

Commands

dir

mkdir

pwd

Parameter Description

force Optional keyword that allows you to delete directories that

are not empty and contain files or subdirectories.

<name>The name and path of the directory.

C613-50292-01 Rev A Command Reference for IE210L Series 118

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW AUTOBOOT

show autoboot

Overview This command displays the Autoboot configuration and status.

Syntax show autoboot

Mode Privileged Exec

Example To show the Autoboot configuration and status, use the command:

awplus# show autoboot

Output Figure 2-6: Example output from the show autoboot command

Figure 2-7: Example output from the show autoboot command when an

external media source is not present

Commands

autoboot enable

create autoboot

show boot

awplus#show autoboot

Autoboot configuration

--------------------------------------------------------------------------------

Autoboot status : enabled

SD Card file autoboot.txt exists : yes



Restore information on SD card

Autoboot enable in autoboot.txt : yes

Restore release file : IE210-5.4.9-0.1.rel (file exists)

Restore configuration file : network_1.cfg (file exists)

awplus#show autoboot

Autoboot configuration

--------------------------------------------------------------------------------

Autoboot status : enabled

External media source : SD card not found.

C613-50292-01 Rev A Command Reference for IE210L Series 119

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW BOOT

show boot

Overview This command displays the current boot configuration. We recommend that the

currently running release is set as the current boot image.

Syntax show boot

Mode Privileged Exec

Example To show the current boot configuration, use the command:

awplus# show boot

Output Figure 2-8: Example output from show boot when the current boot config is

on an SD card



awplus#show boot

Boot configuration

----------------------------------------------------------------

Current software : IE210-5.4.9-0.1.rel

Current boot image : card:/IE210-5.4.9-0.1.rel

Backup boot image : flash:/IE210-5.4.8-2.1.rel

Default boot config: flash:/default.cfg

Current boot config: card:/my.cfg (file exists)

Backup boot config: flash:/backup.cfg (file not found)

Autoboot status : enabled

Table 2-1: Parameters in the output from show boot

Parameter Description

Current software The current software release that the device is using.

Current boot image The boot image currently configured for use during the

next boot cycle.

Backup boot image The boot image to use during the next boot cycle if the

device cannot load the main image.

Default boot

config The default startup configuration file. The device loads

this configuration script if no file is set as the startup-

config file.

Current boot

config The configuration file currently configured as the

startup-config file. The device loads this configuration file

during the next boot cycle if this file exists.

C613-50292-01 Rev A Command Reference for IE210L Series 120

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW BOOT

Commands

autoboot enable

boot config-file backup

boot system backup

show autoboot

Backup boot config The configuration file to use during the next boot cycle if

the main configuration file cannot be loaded.

Autoboot status The status of the Autoboot feature; either enabled or

disabled.

Table 2-1: Parameters in the output from show boot (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 121

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW FILE

show file

Overview This command displays the contents of a specified file.

Syntax show file <filename>

Mode Privileged Exec

Example To display the contents of the file oldconfig.cfg, which is in the current

directory, use the command:

awplus# show file oldconfig.cfg

Commands

edit

edit (filename)

show file systems

Parameter Description

<filename> Name of a file on the local Flash filesystem, or name and

directory path of a file.

C613-50292-01 Rev A Command Reference for IE210L Series 122

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW FILE SYSTEMS

show file systems

Overview This command lists the filesystems and their utilization information where

appropriate.

Syntax show file systems

Mode Privileged Exec

Examples To display the filesystems, use the command:

awplus# show file systems

Output Figure 2-9: Example output from the show file systems command

awplus#show file systems



Size(b) Free(b) Type Flags Prefixes S/D/V Lcl/Ntwk Avail

-------------------------------------------------------------------

125.9M 118.0M flash rw flash: static local Y

- - system rw system: virtual local -

10.0M 9.9M debug rw debug: static local Y

- - sdcard rw card: dynamic local N

- - fserver rw fserver: dynamic network N

- - tftp rw tftp: - network -

- - scp rw scp: - network -

- - sftp ro sftp: - network -

- - http ro http: - network -

- - rsync rw rsync: - network -

Table 3: Parameters in the output of the show file systems command

Parameter Description

Size (B)

Available The total memory available to this filesystem. The units are given

after the value and are M for Megabytes or k for kilobytes.

Free (B) The total memory free within this filesystem. The units are given

after the value and are M for Megabytes or k for kilobytes.

Type The memory type used for this filesystem, such as:

flash

system

sdcard

tftp

scp

sftp

http.

Flags The file setting options: rw (read write), ro (read only).

C613-50292-01 Rev A Command Reference for IE210L Series 123

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW FILE SYSTEMS

Commands

edit

edit (filename)

show file

Prefixes The prefixes used when entering commands to access the

filesystems, such as:

flash

system

card

tftp

scp

sftp

http.

S/V/D The memory type: static, virtual, dynamic.

Lcl / Ntwk Whether the memory is located locally or via a network

connection.

Avail Whether the memory is accessible: Y (yes), N (no), - (not applicable)

Table 3: Parameters in the output of the show file systems command (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 124

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW RUNNING-CONFIG

show running-config

Overview This command displays the current configuration of your device. Its output

includes all non-default configuration. The default settings are not displayed.

NOTE: You can control the output by entering | or > at the end of the command:

• To display only lines that contain a particular word, enter:

| include <word>

• To start the display at the first line that contains a particular word, enter:

| begin <word>

• To save the output to a file, enter:

> <filename>

Syntax show running-config [full|<feature>]

Parameter Description

full Display the running-config for all features. This is the default setting, so

it is the same as entering show running-config.

<feature>Display only the configuration for a single feature. The features

available depend on your device and will be some of the following list:

access-list ACL configuration

antivirus Antivirus configuration

application Application configuration

as-path Autonomous system path filter

configuration

as-path access-list Configuration of ACLs for AS path filtering

atmf Allied Telesis Management Framework

configuration

bgp Border Gateway Protocol (BGP)

configuration

community-list Community-list configuration

crypto Security-specific configuration

dhcp DHCP configuration

dpi Deep Packet Inspection configuration

entity Entity configuration

firewall Firewall configuration

interface Interface configuration. See show

running-config interface for further

options.

C613-50292-01 Rev A Command Reference for IE210L Series 125

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW RUNNING-CONFIG

ip Internet Protocol (IP) configuration

ip pim dense-mode PIM-DM configuration

ip pim sparse-mode PIM-SM configuration

ip route IP static route configuration

ip-reputation IP Reputation configuration

ips IPS configuration

ipsec Internet Protocol Security (IPsec)

configuration

ipv6 Internet Protocol version 6 (IPv6)

configuration

ipv6 access-list IPv6 ACL configuration

ipv6 mroute IPv6 multicast route configuration

ipv6 prefix-list IPv6 prefix list configuration

ipv6 route IPv6 static route configuration

isakmp Internet Security Association Key

Management Protocol (ISAKMP)

configuration

key chain Authentication key management

configuration

l2tp-profile L2TP tunnel profile configuration

lldp LLDP configuration

log Logging utility configuration

malware-protection Malware protection configuration

nat Network Address Translation configuration

power-inline Power over Ethernet (PoE) configuration

policy-based-routing Policy-based routing (PBR) configuration

pppoe-ac PPPoE access concentrator configuration

prefix-list Prefix-list configuration

route-map Route-map configuration

router Router configuration

router-id Configuration of the router identifier for

this system

security-password Strong password security configuration

snmp SNMP configuration

ssh Secure Shell configuration

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 126

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW RUNNING-CONFIG

Mode Privileged Exec and Global Configuration

Example To display the current configuration of your device, use the command:

awplus# show running-config

Output Figure 2-10: Example output from show running-config

Commands

copy running-config

show running-config interface

switch Switch configuration

web-control Web Control configuration

Parameter Description

awplus#show running-config

!

service password-encryption

!

no banner motd

!

username manager privilege 15 password 8 $1$bJoVec4D$JwOJGPr7YqoExA0GVasdE0

!

no service ssh

!

service telnet

!

service http

!

no clock timezone



...



line con 0

line vty 0 4

!

end

C613-50292-01 Rev A Command Reference for IE210L Series 127

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW RUNNING-CONFIG INTERFACE

show running-config interface

Overview This command displays the current configuration of one or more interfaces on the

device.

You can optionally limit the command output to display only information for a

given protocol or feature. The features available depend on your device and will be

a subset of the features listed in the table below.

Syntax show running-config interface [<interface-list>] [dot1x|ip

igmp|ip multicast|ip pim dense-mode|ip pim sparse-mode|ipv6

rip|lacp|mstp|ospf|rip|rstp|stp]

Parameter Description

<interface-list>The interfaces or ports to display information about. An

interface-list can be:

•a VLAN (e.g. vlan2)

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

• a dynamic (LACP) channel group (e.g. po2)

• the loopback interface (lo)

• a continuous range of interfaces separated by a hyphen

(e.g. vlan10-20)

• a comma-separated list (e.g. vlan1,vlan10-20). Do not mix

interface types in a list.

The specified interfaces must exist.

dot1x Displays running configuration for 802.1X port

authentication for the specified interfaces.

lacp Displays running configuration for LACP (Link Aggregation

Control Protocol) for the specified interfaces.

ip igmp Displays running configuration for IGMP (Internet Group

Management Protocol) for the specified interfaces.

ip multicast Displays running configuration for general multicast

settings for the specified interfaces.

ip pim sparse-mode Displays running configuration for PIM-SM (Protocol

Independent Multicast - Sparse Mode) for the specified

interfaces.

ip pim dense-mode Displays running configuration for PIM-DM (Protocol

Independent Multicasting - Dense Mode) for the specified

interfaces.

mstp Displays running configuration for MSTP (Multiple

Spanning Tree Protocol) for the specified interfaces.

ospf Displays running configuration for OSPF (Open Shortest

Path First) for the specified interfaces.

C613-50292-01 Rev A Command Reference for IE210L Series 128

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW RUNNING-CONFIG INTERFACE

Mode Privileged Exec and Global Configuration

Default Displays information for all protocols on all interfaces

Examples To display the current running configuration of your device for ports 1 to 4, use the

command:

awplus# show running-config interface port1.0.1-port1.0.4

To display the current running configuration of a device for vlan2, use the

command:

awplus# show running-config interface vlan2

Output Figure 2-11: Example output from show running-config interface for a

switchport

Commands

copy running-config

show running-config

rip Displays running configuration for RIP (Routing Information

Protocol) for the specified interfaces.

ipv6 rip Displays running configuration for RIPng (RIP for IPv6) for

the specified interfaces.

rstp Displays running configuration for RSTP (Rapid Spanning

Tree Protocol) for the specified interfaces.

stp Displays running configuration for STP (Spanning Tree

Protocol) for the specified interfaces.

Parameter Description

awplus#show running-config interface port1.0.2

!

interface port1.0.2

switchport

switchport mode access

C613-50292-01 Rev A Command Reference for IE210L Series 129

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW STARTUP-CONFIG

show startup-config

Overview This command displays the contents of the start-up configuration file, which is the

file that the device runs on start-up.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show startup-config

Mode Privileged Exec

Example To display the contents of the current start-up configuration file, use the

command:

awplus# show startup-config

Output Figure 2-12: Example output from the show startup-config command

Commands

boot config-file backup

copy running-config

copy startup-config

erase startup-config

show boot

awplus#show startup-config

!

service password-encryption

!

no banner motd

!

username manager privilege 15 password 8 $1$bJoVec4D$JwOJGPr7YqoExA0GVasdE0

!

no service ssh

!

service telnet

!

service http

!

no clock timezone



...



line con 0

line vty 0 4

!

end

C613-50292-01 Rev A Command Reference for IE210L Series 130

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

SHOW VERSION

show version

Overview This command displays the version number and copyright details of the current

AlliedWare Plus™ OS your device is running.

Syntax show version

Mode User Exec and Privileged Exec

Example To display the version details of your currently installed software, use the

command:

awplus# show version

Commands

boot system backup

show boot

C613-50292-01 Rev A Command Reference for IE210L Series 131

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

UNMOUNT

unmount

Overview Use this command to unmount an external storage device. We recommend you

unmount storage devices before removing them, to avoid file corruption. This is

especially important if files may be automatically written to the storage device,

such as external log files or AMF backup files.

Syntax unmount card

Mode Privileged Exec

Example To unmount an SD card and safely remove it from the device, use the command:

awplus# unmount card

Commands

clear log external

log external

show file systems

show log config

show log external

Command

changes

Version 5.4.7-1.1: command added

Parameter Description

card Unmount the SD card.

C613-50292-01 Rev A Command Reference for IE210L Series 132

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

WRITE FILE

write file

Overview This command copies the running-config into the file that is set as the current

startup-config file. This command is a synonym of the write memory and copy

running-config startup-config commands.

Syntax write [file]

Mode Privileged Exec

Example To write configuration data to the start-up configuration file, use the command:

awplus# write file

Commands

copy running-config

write memory

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 133

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

WRITE MEMORY

write memory

Overview This command copies the running-config into the file that is set as the current

startup-config file. This command is a synonym of the write file and copy

running-config startup-config commands.

Syntax write [memory]

Mode Privileged Exec

Example To write configuration data to the start-up configuration file, use the command:

awplus# write memory

Commands

copy running-config

write file

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 134

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FILE AND CONFIGURATION MANAGEMENT COMMANDS

WRITE TERMINAL

write terminal

Overview This command displays the current configuration of the device. This command is a

synonym of the show running-config command.

Syntax write terminal

Mode Privileged Exec

Example To display the current configuration of your device, use the command:

awplus# write terminal

Commands

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 135

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

User Access

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

user access.

Command List •“aaa authentication enable default local” on page 137

•“aaa local authentication attempts lockout-time” on page 138

•“aaa local authentication attempts max-fail” on page 139

•“aaa login fail-delay” on page 140

•“clear aaa local user lockout” on page 141

•“clear line console” on page 142

•“clear line vty” on page 143

•“enable password” on page 144

•“enable secret” on page 147

•“exec-timeout” on page 150

•“flowcontrol hardware (asyn/console)” on page 152

•“length (asyn)” on page 154

•“line” on page 155

•“privilege level” on page 157

•“security-password history” on page 158

•“security-password forced-change” on page 159

•“security-password lifetime” on page 160

•“security-password min-lifetime-enforce” on page 161

•“security-password minimum-categories” on page 162

•“security-password minimum-length” on page 163

C613-50292-01 Rev A Command Reference for IE210L Series 136

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

•“security-password reject-expired-pwd” on page 164

•“security-password warning” on page 165

•“service advanced-vty” on page 166

•“service password-encryption” on page 167

•“service telnet” on page 168

•“service terminal-length (deleted)” on page 169

•“show aaa local user locked” on page 170

•“show privilege” on page 171

•“show security-password configuration” on page 172

•“show security-password user” on page 173

•“show telnet” on page 174

•“show users” on page 175

•“telnet” on page 176

•“telnet server” on page 177

•“terminal length” on page 178

•“terminal resize” on page 179

•“username” on page 180

C613-50292-01 Rev A Command Reference for IE210L Series 137

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

AAA AUTHENTICATION ENABLE DEFAULT LOCAL

aaa authentication enable default local

Overview This command enables local privilege level authentication.

Use the no variant of this command to disable local privilege level authentication.

Syntax aaa authentication enable default local

no aaa authentication enable default

Default Local privilege level authentication is enabled by default.

Mode Global Configuration

Usage The privilege level configured for a particular user in the local user database is the

privilege threshold above which the user is prompted for an enable (Privileged

Exec mode) command.

Examples To enable local privilege level authentication, use the following commands:

awplus# configure terminal

awplus(config)# aaa authentication enable default local

To disable local privilege level authentication, use the following commands:

awplus# configure terminal

awplus(config)# no aaa authentication enable default

Commands

aaa authentication login

enable (Privileged Exec mode)

enable password

enable secret

C613-50292-01 Rev A Command Reference for IE210L Series 138

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

AAA LOCAL AUTHENTICATION ATTEMPTS LOCKOUT-TIME

aaa local authentication attempts

lockout-time

Overview This command configures the duration of the user lockout period.

Use the no variant of this command to restore the duration of the user lockout

period to its default of 300 seconds (5 minutes).

Syntax aaa local authentication attempts lockout-time <lockout-tiime>

no aaa local authentication attempts lockout-time

Mode Global Configuration

Default The default for the lockout-time is 300 seconds (5 minutes).

Usage While locked out all attempts to login with the locked account will fail. The lockout

can be manually cleared by another privileged account using the clear aaa local

user lockout command.

Examples To configure the lockout period to 10 minutes (600 seconds), use the commands:

awplus# configure terminal

awplus(config)# aaa local authentication attempts lockout-time

600

To restore the default lockout period of 5 minutes (300 seconds), use the

commands:

awplus# configure terminal

awplus(config)# no aaa local authentication attempts

lockout-time

Commands

aaa local authentication attempts max-fail

Parameter Description

<lockout-time><0-10000>. Time in seconds to lockout the user.

C613-50292-01 Rev A Command Reference for IE210L Series 139

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

AAA LOCAL AUTHENTICATION ATTEMPTS MAX-FAIL

aaa local authentication attempts max-fail

Overview This command configures the maximum number of failed login attempts before a

user account is locked out. Every time a login attempt fails the failed login counter

is incremented.

Use the no variant of this command to restore the maximum number of failed

Syntax aaa local authentication attempts max-fail <failed-logins>

no aaa local authentication attempts max-fail

Mode Global Configuration

Default The default for the maximum number of failed login attempts is five failed login

attempts.

Usage When the failed login counter reaches the limit configured by this command that

user account is locked out for a specified duration configured by the aaa local

authentication attempts lockout-time command.

When a successful login occurs the failed login counter is reset to 0. When a user

account is locked out all attempts to login using that user account will fail.

Examples To configure the number of login failures that will lock out a user account to two

awplus# configure terminal

awplus(config)# aaa local authentication attempts max-fail 2

To restore the number of login failures that will lock out a user account to the

default number of login attempts (five login attempts), use the commands:

awplus# configure terminal

awplus(config)# no aaa local authentication attempts max-fail

Commands

aaa local authentication attempts lockout-time

clear aaa local user lockout

Parameter Description

<failed-logins><1-32>. Number of login failures allowed before locking out a

user.

C613-50292-01 Rev A Command Reference for IE210L Series 140

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

AAA LOGIN FAIL-DELAY

aaa login fail-delay

Overview Use this command to configure the minimum time period between failed login

attempts. This setting applies to login attempts via the console, SSH and Telnet.

Use the no variant of this command to reset the minimum time period to its default

value.

Syntax aaa login fail-delay <1-10>

no aaa login fail-delay

Default 1 second

Mode Global configuration

Example To apply a delay of at least 5 seconds between login attempts, use the following

commands:

awplus# configure terminal

awplus(config)# aaa login fail-delay 5

Commands

aaa authentication login

aaa local authentication attempts lockout-time

clear aaa local user lockout

Parameter Description

<1-10> The minimum number of seconds required between login

attempts

C613-50292-01 Rev A Command Reference for IE210L Series 141

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

CLEAR AAA LOCAL USER LOCKOUT

clear aaa local user lockout

Overview Use this command to clear the lockout on a specific user account or all user

accounts.

Syntax clear aaa local user lockout {username <username>|all}

Mode Privileged Exec

Examples To unlock the user account ‘bob’ use the following command:

awplus# clear aaa local user lockout username bob

To unlock all user accounts use the following command:

awplus# clear aaa local user lockout all

Commands

aaa local authentication attempts lockout-time

Parameter Description

username Clear lockout for the specified user.

<username> Specifies the user account.

all Clear lockout for all user accounts.

C613-50292-01 Rev A Command Reference for IE210L Series 142

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

CLEAR LINE CONSOLE

clear line console

Overview This command resets a console line. If a terminal session exists on the line then the

terminal session is terminated. If console line settings have changed then the new

settings are applied.

Syntax clear line console 0

Mode Privileged Exec

Example To reset the console line (asyn), use the command:

awplus# clear line console 0

awplus# % The new settings for console line 0 have been applied

Commands

clear line vty

flowcontrol hardware (asyn/console)

line

show users

C613-50292-01 Rev A Command Reference for IE210L Series 143

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

CLEAR LINE VTY

clear line vty

Overview This command resets a VTY line. If a session exists on the line then it is closed.

Syntax clear line vty <0-32>

Mode Privileged Exec

Example To reset the first VTY line, use the command:

awplus# clear line vty 1

Commands

privilege level

line

show telnet

show users

Parameter Description

<0-32>Line number

C613-50292-01 Rev A Command Reference for IE210L Series 144

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

ENABLE PASSWORD

enable password

Overview To set a local password to control access to various privilege levels, use the enable

password Global Configuration command. Use the enable password command to

modify or create a password to be used, and use the no enable password

command to remove the password.

Note that the enable secret command is an alias for the enable password

command, and the no enable secret command is an alias for the no enable

password command. Issuing a no enable password command removes a password

configured with the enable secret command. The enable password command is

shown in the running and startup configurations. Note that if the enable secret

command is entered then enable password is shown in the configuration.

Syntax enable password [<plain>|8 <hidden>|level <1-15> 8 <hidden>]

no enable password [level <1-15>]

Default The privilege level for enable password is level 15 by default. Previously the default

was level 1.

Mode Global Configuration

Usage This command enables the Network Administrator to set a password for entering

the Privileged Exec mode when using the enable (Privileged Exec mode)

command. There are three methods to enable a password. In the examples below,

for each method, note that the configuration is different and the configuration file

output is different, but the password string to be used to enter the Privileged Exec

mode with the enable command is the same (mypasswd).

A user can now have an intermediate CLI security level set with this command for

privilege level 7 to access all the show commands in Privileged Exec mode and all

the commands in User Exec mode, but not any configuration commands in

Privileged Exec mode.

Parameter Description

<plain>Specifies the unencrypted password.

8Specifies a hidden password will follow.

<hidden>Specifies the hidden encrypted password. Use an encrypted

password for better security where a password crosses the network

or is stored on a TFTP server.

level Privilege level <1-15>. Level for which the password applies. You can

specify up to 16 privilege levels, using numbers 1 through 15. Level 1

is normal EXEC-mode user privileges for User Exec mode. If this

argument is not specified in the command or the no variant of the

command, the privilege level defaults to 15 (enable mode privileges)

for Privileged Exec mode. A privilege level of 7 can be set for

intermediate CLI security.

C613-50292-01 Rev A Command Reference for IE210L Series 145

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

ENABLE PASSWORD

Note that the enable password command is an alias for the enable secret

command and one password per privilege level is allowed using these commands.

Do not assign one password to a privilege level with enable password and another

password to a privilege level with enable secret. Use enable password or enable

secret commands. Do not use both on the same level.

Using plain

passwords

The plain password is a clear text string that appears in the configuration file as

configured.

awplus# configure terminal

awplus(config)# enable password mypasswd

awplus(config)# end

This results in the following show output:

Using encrypted

passwords

You can configure an encrypted password using the service password-encryption

command. First, use the enable password command to specify the string that you

want to use as a password (mypasswd). Then, use the service

password-encryption command to encrypt the specified string (mypasswd). The

advantage of using an encrypted password is that the configuration file does not

show mypasswd, it will only show the encrypted string fU7zHzuutY2SA.

awplus# configure terminal

awplus(config)# enable password mypasswd

awplus(config)# service password-encryption

awplus(config)# end

This results in the following show output:

Using hidden

passwords

You can configure an encrypted password using the HIDDEN parameter (8) with

the enable password command. Use this method if you already know the

encrypted string corresponding to the plain text string that you want to use as a

password. It is not required to use the service password-encryption command for

awplus#show run

Current configuration:

hostname awplus

enable password mypasswd

!

interface lo

awplus#show run

Current configuration:

hostname awplus

enable password 8 fU7zHzuutY2SA

service password-encryption

!

interface lo

C613-50292-01 Rev A Command Reference for IE210L Series 146

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

ENABLE PASSWORD

this method. The output in the configuration file will show only the encrypted

string, and not the text string.

awplus# configure terminal

awplus(config)# enable password 8 fU7zHzuutY2SA

awplus(config)# end

This results in the following show output:

Commands

enable (Privileged Exec mode)

enable secret

service password-encryption

privilege level

show privilege

username

show running-config

awplus#show run

Current configuration:

hostname awplus

enable password 8 fU7zHzuutY2SA

!

interface lo

C613-50292-01 Rev A Command Reference for IE210L Series 147

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

ENABLE SECRET

enable secret

Overview To set a local password to control access to various privilege levels, use the enable

secret Global Configuration command. Use the enable secret command to modify

or create a password to be used, and use the no enable secret command to remove

the password.

Note that the enable secret command is an alias for the enable password

command, and the no enable secret command is an alias for the no enable

password command. Issuing a no enable password command removes a password

configured with the enable secret command. The enable password command is

shown in the running and startup configurations. Note that if the enable secret

command is entered then enable password is shown in the configuration

Syntax enable secret [<plain>|8 <hidden>|level <0-15> 8 <hidden>]

no enable secret [level <1-15>]

Default The privilege level for enable secret is level 15 by default.

Mode Global Configuration

Usage This command enables the Network Administrator to set a password for entering

the Privileged Exec mode when using the enable (Privileged Exec mode)

command. There are three methods to enable a password. In the examples below,

for each method, note that the configuration is different and the configuration file

output is different, but the password string to be used to enter the Privileged Exec

mode with the enable command is the same (mypasswd).

A user can have an intermediate CLI security level set with this command for

privilege level 7 to access all the show commands in Privileged Exec mode and all

the commands in User Exec mode, but not any configuration commands in

Privileged Exec mode.

Parameter Description

<plain>Specifies the unencrypted password.

8Specifies a hidden password will follow.

<hidden>Specifies the hidden encrypted password. Use an encrypted

password for better security where a password crosses the network

or is stored on a TFTP server.

level Privilege level <1-15>. Level for which the password applies. You can

specify up to 16 privilege levels, using numbers 1 through 15. Level 1

is normal EXEC-mode user privileges for User Exec mode. If this

argument is not specified in the command or the no variant of the

command, the privilege level defaults to 15 (enable mode privileges)

for Privileged Exec mode. A privilege level of 7 can be set for

intermediate CLI security.

C613-50292-01 Rev A Command Reference for IE210L Series 148

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

ENABLE SECRET

Note that the enable secret command is an alias for the enable password

command and one password per privilege level is allowed using these commands.

Do not assign one password to a privilege level with enable password and another

password to a privilege level with enable secret. Use enable password or enable

secret commands. Do not use both on the same level.

Using plain

passwords

The plain password is a clear text string that appears in the configuration file as

configured.

awplus# configure terminal

awplus(config)# enable secret mypasswd

awplus(config)# end

This results in the following show output:

Using encrypted

passwords

Configure an encrypted password using the service password-encryption

command. First, use the enable password command to specify the string that you

want to use as a password (mypasswd). Then, use the service

password-encryption command to encrypt the specified string (mypasswd). The

advantage of using an encrypted password is that the configuration file does not

show mypasswd, it will only show the encrypted string fU7zHzuutY2SA.

awplus# configure terminal

awplus(config)# enable secret mypasswd

awplus(config)# service password-encryption

awplus(config)# end

This results in the following show output:

Using hidden

passwords

Configure an encrypted password using the HIDDEN parameter (8) with the

enable password command. Use this method if you already know the encrypted

string corresponding to the plain text string that you want to use as a password. It

is not required to use the service password-encryption command for this method.

awplus#show run

Current configuration:

hostname awplus

enable password mypasswd

!

interface lo

awplus#show run

Current configuration:

hostname awplus

enable password 8 fU7zHzuutY2SA

service password-encryption

!

interface lo

C613-50292-01 Rev A Command Reference for IE210L Series 149

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

ENABLE SECRET

The output in the configuration file will show only the encrypted string, and not

the text string:

awplus# configure terminal

awplus(config)# enable secret 8 fU7zHzuutY2SA

awplus(config)# end

This results in the following show output:

Commands

enable (Privileged Exec mode)

enable secret

service password-encryption

privilege level

show privilege

username

show running-config

awplus#show run

Current configuration:

hostname awplus

enable password 8 fU7zHzuutY2SA

!

interface lo

C613-50292-01 Rev A Command Reference for IE210L Series 150

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

EXEC-TIMEOUT

exec-timeout

Overview This command sets the interval your device waits for user input from either a

console or VTY connection. Once the timeout interval is reached, the connection is

dropped. This command sets the time limit when the console or VTY connection

automatically logs off after no activity.

The no variant of this command removes a specified timeout and resets to the

default timeout (10 minutes).

Syntax exec-timeout {<minutes>} [<seconds>]

no exec-timeout

Default The default for the exec-timeout command is 10 minutes and 0 seconds

(exec-timeout 10 0).

Mode Line Configuration

Usage This command is used set the time the telnet session waits for an idle VTY session,

before it times out. An exec-timeout 0 0 setting will cause the telnet session to

wait indefinitely. The command exec-timeout 0 0 is useful while configuring a

device, but reduces device security.

If no input is detected during the interval then the current connection resumes. If

no connections exist then the terminal returns to an idle state and disconnects

incoming sessions.

Examples To set VTY connections to timeout after 2 minutes, 30 seconds if there is no

response from the user, use the following commands:

awplus# configure terminal

awplus(config)# line vty 0 32

awplus(config-line)# exec-timeout 2 30

To reset the console connection to the default timeout of 10 minutes 0 seconds if

there is no response from the user, use the following commands:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# no exec-timeout

Validation

Commands

show running-config

Parameter Description

<minutes> <0-35791> Required integer timeout value in minutes

<seconds> <0-2147483> Optional integer timeout value in seconds

C613-50292-01 Rev A Command Reference for IE210L Series 151

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

EXEC-TIMEOUT

Commands

line

service telnet

C613-50292-01 Rev A Command Reference for IE210L Series 152

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

FLOWCONTROL HARDWARE (ASYN/CONSOLE)

flowcontrol hardware (asyn/console)

Overview Use this command to enable RTS/CTS (Ready To Send/Clear To Send) hardware

flow control on a terminal console line (asyn port) between the DTE (Data Terminal

Equipment) and the DCE (Data Communications Equipment).

Syntax flowcontrol hardware

no flowcontrol hardware

Mode Line Configuration

Default Hardware flow control is disabled by default.

Usage Hardware flow control makes use of the RTS and CTS control signals between the

DTE and DCE where the rate of transmitted data is faster than the rate of received

data. Flow control is a technique for ensuring that a transmitting entity does not

overwhelm a receiving entity with data. When the buffers on the receiving device

are full, a message is sent to the sending device to suspend the transmission until

the data in the buffers has been processed.

Hardware flow control can be configured on terminal console lines (e.g. asyn0). For

Reverse Telnet connections, hardware flow control must be configured to match

on both the Access Server and the Remote Device. For terminal console sessions,

hardware flow control must be configured to match on both the DTE and the DCE.

Settings are saved in the running configuration. Changes are applied after reboot,

clear line console, or after closing the session.

Use show running-config and show startup-config commands to view hardware

flow control settings that take effect after reboot for a terminal console line. See

the show running-config command output:

Note that line configuration commands do not take effect immediately. Line

configuration commands take effect after one of the following commands or

events:

•issuing a clear line console command

•issuing a reboot command

• logging out of the current session

awplus#show running-config

!

line con 1

speed 9600

mode out 2001

flowcontrol hardware

C613-50292-01 Rev A Command Reference for IE210L Series 153

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

FLOWCONTROL HARDWARE (ASYN/CONSOLE)

Examples To enable hardware flow control on terminal console line asyn0, use the

commands:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# flowcontrol hardware

To disable hardware flow control on terminal console line asyn0, use the

commands:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# no flowcontrol hardware

Commands

clear line console

show running-config

speed (asyn)

C613-50292-01 Rev A Command Reference for IE210L Series 154

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

LENGTH (ASYN)

length (asyn)

Overview Use this command to specify the number of rows of output that the device will

display before pausing, for the console or VTY line that you are configuring.

The no variant of this command restores the length of a line (terminal session)

attached to a console port or to a VTY to its default length of 22 rows.

Syntax length <0-512>

no length

Mode Line Configuration

Default The length of a terminal session is 22 rows. The no length command restores the

default.

Usage If the output from a command is longer than the length of the line the output will

be paused and the ‘–More–’ prompt allows you to move to the next screen full of

data.

A length of 0 will turn off pausing and data will be displayed to the console as long

as there is data to display.

Examples To set the terminal session length on the console to 10 rows, use the command:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# length 10

To reset the terminal session length on the console to the default (22 rows), use the

command:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# no length

To display output to the console continuously, use the command:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# length 0

Commands

terminal resize

terminal length

Parameter Description

<0-512> Number of lines on screen. Specify 0 for no pausing.

C613-50292-01 Rev A Command Reference for IE210L Series 155

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

LINE

line

Overview Use this command to enter line configuration mode for the specified VTYs or the

console. The command prompt changes to show that the device is in Line

Configuration mode.

Syntax line vty <first-line> [<last-line>]

line console 0

Mode Global Configuration

Usage This command puts you into Line Configuration mode. Once in Line Configuration

mode, you can configure console and virtual terminal settings, including setting

speed (asyn), length (asyn), privilege level, and authentication (login

authentication) or accounting (accounting login) method lists.

To change the console (asyn) port speed, use this line command to enter Line

Configuration mode before using the speed (asyn)command. Set the console

speed (Baud rate) to match the transmission rate of the device connected to the

console (asyn) port on your device.

Note that line configuration commands do not take effect immediately. Line

configuration commands take effect after one of the following commands or

events:

•issuing a clear line console command

•issuing a reboot command

• logging out of the current session

Examples To enter Line Configuration mode in order to configure all VTYs, use the

commands:

awplus# configure terminal

awplus(config)# line vty 0 32

awplus(config-line)#

Parameter Description

<first-line> <0-32> Specify the first line number.

<last-line> <0-32> Specify the last line number.

console The console terminal line(s) for local access.

vty Virtual terminal for remote console access.

C613-50292-01 Rev A Command Reference for IE210L Series 156

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

LINE

To enter Line Configuration mode to configure the console (asyn 0) port terminal

line, use the commands:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)#

Commands

accounting login

clear line console

clear line vty

flowcontrol hardware (asyn/console)

length (asyn)

privilege level

speed (asyn)

C613-50292-01 Rev A Command Reference for IE210L Series 157

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

PRIVILEGE LEVEL

privilege level

Overview This command sets a privilege level for VTY or console connections. The

configured privilege level from this command overrides a specific user’s initial

privilege level at the console login.

Syntax privilege level <1-15>

Mode Line Configuration

Usage You can set an intermediate CLI security level for a console user with this command

by applying privilege level 7 to access all show commands in Privileged Exec and

all User Exec commands. However, intermediate CLI security will not show

configuration commands in Privileged Exec.

Examples To set the console connection to have the maximum privilege level, use the

following commands:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# privilege level 15

To set all VTY connections to have the minimum privilege level, use the following

commands:

awplus# configure terminal

awplus(config)# line vty 0 5

awplus(config-line)# privilege level 1

To set all VTY connections to have an intermediate CLI security level, to access all

show commands, use the following commands:

awplus# configure terminal

awplus(config)# line vty 0 5

awplus(config-line)# privilege level 7

Commands

enable password

line

show privilege

username

C613-50292-01 Rev A Command Reference for IE210L Series 158

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SECURITY-PASSWORD HISTORY

security-password history

Overview This command specifies the number of previous passwords that are unable to be

reused. A new password is invalid if it matches a password retained in the

password history.

The no variant of the command disables this feature.

Syntax security-password history <0-15>

no security-password history

Default The default history value is 0, which will disable the history functionality.

Mode Global Configuration

Examples To restrict reuse of the three most recent passwords, use the command:

awplus# configure terminal

awplus(config)# security-password history 3

To allow the reuse of recent passwords, use the command:

awplus# configure terminal

awplus(config)# no security-password history

Commands

security-password forced-change

security-password lifetime

security-password min-lifetime-enforce

security-password minimum-categories

security-password minimum-length

security-password reject-expired-pwd

security-password warning

show running-config security-password

show security-password configuration

show security-password user

Parameter Description

<0-15> The allowable range of previous passwords to match against. A

value of 0 will disable the history functionality and is equivalent to

the no security-password history command. If the history

functionality is disabled, all users’ password history is reset and all

password history is lost.

C613-50292-01 Rev A Command Reference for IE210L Series 159

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SECURITY-PASSWORD FORCED-CHANGE

security-password forced-change

Overview This command specifies whether or not a user is forced to change an expired

password at the next login. If this feature is enabled, users whose passwords have

expired are forced to change to a password that must comply with the current

password security rules at the next login.

Note that to use this command, the lifetime feature must be enabled with the

security-password lifetime command and the reject-expired-pwd feature must be

disabled with the security-password reject-expired-pwd command.

The no variant of the command disables this feature.

Syntax security-password forced-change

no security-password forced-change

Default The forced-change feature is disabled by default.

Mode Global Configuration

Example To force a user to change their expired password at the next login, use the

command:

awplus# configure terminal

awplus(config)# security-password forced-change

Commands

security-password history

security-password lifetime

security-password min-lifetime-enforce

security-password minimum-categories

security-password minimum-length

security-password reject-expired-pwd

security-password warning

show running-config security-password

show security-password configuration

show security-password user

C613-50292-01 Rev A Command Reference for IE210L Series 160

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SECURITY-PASSWORD LIFETIME

security-password lifetime

Overview This command enables password expiry by specifying a password lifetime in days.

Note that when the password lifetime feature is disabled, it also disables the

security-password forced-change command and the security-password warning

command.

The no variant of the command disables this feature.

Syntax security-password lifetime <0-1000>

no security-password lifetime

Default The default password lifetime is 0, which will disable the lifetime functionality.

Mode Global Configuration

Example To configure the password lifetime to 10 days, use the command:

awplus# configure terminal

awplus(config)# security-password lifetime 10

Commands

security-password forced-change

security-password history

security-password min-lifetime-enforce

security-password minimum-categories

security-password minimum-length

security-password reject-expired-pwd

security-password warning

show running-config security-password

show security-password configuration

show security-password user

Parameter Description

<0-1000> Password lifetime specified in days. A value of 0 will disable lifetime

functionality and the password will never expire. This is equivalent

to the no security-password lifetime command.

C613-50292-01 Rev A Command Reference for IE210L Series 161

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SECURITY-PASSWORD MIN-LIFETIME-ENFORCE

security-password min-lifetime-enforce

Overview Use this command to configure a minimum number of days before a password can

be changed by a user. With this feature enabled, once a user sets the password, the

user cannot change it again until the minimum lifetime has passed.

Use the no variant of this command to remove the minimum lifetime.

Syntax security-password min-lifetime-enforce <0-1000>

no security-password min-lifetime-enforce

Default By default, no minimum lifetime is enforced.

Mode Global Configuration

Usage The minimum lifetime is helpful in conjunction with a security policy that prevents

people from re-using old passwords. For example, if you do not allow people to

re-use any of their last 5 passwords, a person can bypass that restriction by

changing their password 5 times in quick succession and then re-setting it to their

previous password. The minimum lifetime prevents that by preventing people

from changing their password in quick succession.

Example To force users to wait at least 2 days between changing passwords, use the

command:

awplus(config)# security-password min-lifetime-enforce 2

Commands

security-password forced-change

security-password history

security-password lifetime

security-password minimum-categories

security-password minimum-length

security-password reject-expired-pwd

security-password warning

show running-config security-password

show security-password configuration

show security-password user

Command

changes

Version 5.4.7-0.2: command added

Parameter Description

<0-1000> The minimum number of days before a password can be changed

C613-50292-01 Rev A Command Reference for IE210L Series 162

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SECURITY-PASSWORD MINIMUM-CATEGORIES

security-password minimum-categories

Overview This command specifies the minimum number of categories that the password

must contain in order to be considered valid. The password categories are:

• uppercase letters: A to Z

• lowercase letters: a to z

• digits: 0 to 9

• special symbols: all printable ASCII characters not included in the previous

three categories. The question mark (?) cannot be used as it is reserved for

help functionality.

Note that to ensure password security, the minimum number of categories should

align with the lifetime selected, i.e. the fewer categories specified the shorter the

lifetime specified.

Syntax security-password minimum-categories <1-4>

Default The default number of categories that the password must satisfy is 1.

Mode Global Configuration

Example To configure the required minimum number of character categories to be 3, use

the command:

awplus# configure terminal

awplus(config)# security-password minimum-categories 3

Commands

security-password forced-change

security-password history

security-password lifetime

security-password min-lifetime-enforce

security-password minimum-length

security-password reject-expired-pwd

security-password warning

show running-config security-password

show security-password configuration

show security-password user

Parameter Description

<1-4> Number of categories the password must satisfy, in the range 1 to 4.

C613-50292-01 Rev A Command Reference for IE210L Series 163

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SECURITY-PASSWORD MINIMUM-LENGTH

security-password minimum-length

Overview This command specifies the minimum allowable password length. This value is

checked against when there is a password change or a user account is created.

Syntax security-password minimum-length <1-23>

Default The default minimum password length is 1.

Mode Global Configuration

Example To configure the required minimum password length as 8, use the command:

awplus# configure terminal

awplus(config)# security-password minimum-length 8

Commands

security-password forced-change

security-password history

security-password lifetime

security-password min-lifetime-enforce

security-password minimum-categories

security-password reject-expired-pwd

security-password warning

show running-config security-password

show security-password configuration

show security-password user

Parameter Description

<1-23> Minimum password length in the range from 1 to 23.

C613-50292-01 Rev A Command Reference for IE210L Series 164

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SECURITY-PASSWORD REJECT-EXPIRED-PWD

security-password reject-expired-pwd

Overview This command specifies whether or not a user is allowed to login with an expired

password. Users with expired passwords are rejected at login if this functionality is

enabled. Users then have to contact the Network Administrator to change their

password.

CAUTION: Once all users’ passwords are expired you are unable to login to the device

again if the security-password reject-expired-pwd command has been executed. You

will have to reboot the device with a default configuration file, or load an earlier

software version that does not have the security password feature.

We recommend you never have the command line “security-password

reject-expired-pwd” in a default config file.

Note that when the reject-expired-pwd functionality is disabled and a user logs on

with an expired password, if the forced-change feature is enabled with

security-password forced-change command, a user may have to change the

password during login depending on the password lifetime specified by the

security-password lifetime command.

The no variant of the command disables this feature.

Syntax security-password reject-expired-pwd

no security-password reject-expired-pwd

Default The reject-expired-pwd feature is disabled by default.

Mode Global Configuration

Example To configure the system to reject users with an expired password, use the

command:

awplus# configure terminal

awplus(config)# security-password reject-expired-pwd

Commands

security-password forced-change

security-password history

security-password lifetime

security-password min-lifetime-enforce

security-password minimum-categories

security-password minimum-length

security-password warning

show running-config security-password

show security-password configuration

show security-password user

C613-50292-01 Rev A Command Reference for IE210L Series 165

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SECURITY-PASSWORD WARNING

security-password warning

Overview This command specifies the number of days before the password expires that the

user will receive a warning message specifying the remaining lifetime of the

password.

Note that the warning period cannot be set unless the lifetime feature is enabled

with the security-password lifetime command.

The no variant of the command disables this feature.

Syntax security-password warning <0-1000>

no security-password warning

Default The default warning period is 0, which disables warning functionality.

Mode Global Configuration

Example To configure a warning period of three days, use the command:

awplus# configure terminal

awplus(config)# security-password warning 3

Commands

security-password forced-change

security-password history

security-password lifetime

security-password min-lifetime-enforce

security-password minimum-categories

security-password minimum-length

security-password reject-expired-pwd

show running-config security-password

show security-password configuration

show security-password user

Parameter Description

<0-1000> Warning period in the range from 0 to 1000 days. A value 0 disables

the warning functionality and no warning message is displayed for

expiring passwords. This is equivalent to the no security-password

warning command. The warning period must be less than, or equal

to, the password lifetime set with the security-password lifetime

command.

C613-50292-01 Rev A Command Reference for IE210L Series 166

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SERVICE ADVANCED-VTY

service advanced-vty

Overview This command enables the advanced-vty help feature. This allows you to use TAB

completion for commands. Where multiple options are possible, the help feature

displays the possible options.

The no service advanced-vty command disables the advanced-vty help feature.

Syntax service advanced-vty

no service advanced-vty

Default The advanced-vty help feature is enabled by default.

Mode Global Configuration

Examples To disable the advanced-vty help feature, use the command:

awplus# configure terminal

awplus(config)# no service advanced-vty

To re-enable the advanced-vty help feature after it has been disabled, use the

following commands:

awplus# configure terminal

awplus(config)# service advanced-vty

C613-50292-01 Rev A Command Reference for IE210L Series 167

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SERVICE PASSWORD-ENCRYPTION

service password-encryption

Overview Use this command to enable password encryption. This is enabled by default.

When password encryption is enabled, the device displays passwords in the

running config in encrypted form instead of in plain text.

Use the no service password-encryption command to stop the device from

displaying newly-entered passwords in encrypted form. This does not change the

display of existing passwords.

Syntax service password-encryption

no service password-encryption

Mode Global Configuration

Example awplus# configure terminal

awplus(config)# service password-encryption

Validation

Commands

show running-config

Commands

enable password

C613-50292-01 Rev A Command Reference for IE210L Series 168

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SERVICE TELNET

service telnet

Overview Use this command to enable the telnet server. The server is enabled by default.

Enabling the telnet server starts the device listening for incoming telnet sessions

on the configured port.

The server listens on port 23, unless you have changed the port by using the

privilege level command.

Use the no variant of this command to disable the telnet server. Disabling the

telnet server will stop the device listening for new incoming telnet sessions.

However, existing telnet sessions will still be active.

Syntax service telnet [ip|ipv6]

no service telnet [ip|ipv6]

Default The IPv4 and IPv6 telnet servers are enabled by default.

The configured telnet port is TCP port 23 by default.

Mode Global Configuration

Examples To enable both the IPv4 and IPv6 telnet servers, use the following commands:

awplus# configure terminal

awplus(config)# service telnet

To enable the IPv6 telnet server only, use the following commands:

awplus# configure terminal

awplus(config)# service telnet ipv6

To disable both the IPv4 and IPv6 telnet servers, use the following commands:

awplus# configure terminal

awplus(config)# no service telnet

To disable the IPv6 telnet server only, use the following commands:

awplus# configure terminal

awplus(config)# no service telnet ipv6

Commands

clear line vty

show telnet

telnet server

C613-50292-01 Rev A Command Reference for IE210L Series 169

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SERVICE TERMINAL-LENGTH (DELETED)

service terminal-length (deleted)

Overview This command has been deleted in Software Version 5.4.5-0.1 and later.

C613-50292-01 Rev A Command Reference for IE210L Series 170

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SHOW AAA LOCAL USER LOCKED

show aaa local user locked

Overview This command displays the current number of failed attempts, last failure time and

location against each user account attempting to log into the device.

Note that once the lockout count has been manually cleared by another privileged

account using the clear aaa local user lockout command or a locked account

successfully logs into the system after waiting for the lockout time, this command

will display nothing for that particular account.

Syntax show aaa local user locked

Mode User Exec and Privileged Exec

Example To display the current failed attempts for local users, use the command:

awplus# show aaa local user locked

Output Figure 3-1: Example output from the show aaa local user locked command

Commands

aaa local authentication attempts lockout-time

aaa local authentication attempts max-fail

clear aaa local user lockout

awplus# show aaa local user locked

bob 3 05/23/14 16:21:37 ttyS0

manager 5 05/23/14 16:31:44 192.168.1.200

C613-50292-01 Rev A Command Reference for IE210L Series 171

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SHOW PRIVILEGE

show privilege

Overview This command displays the current user privilege level, which can be any privilege

level in the range <1-15>. Privilege levels <1-6> allow limited user access (all User

Exec commands), privilege levels <7-14> allow restricted user access (all User Exec

commands plus Privileged Exec show commands). Privilege level 15 gives full user

access to all Privileged Exec commands.

Syntax show privilege

Mode User Exec and Privileged Exec

Usage A user can have an intermediate CLI security level set with this command for

privilege levels <7-14> to access all show commands in Privileged Exec mode and

all commands in User Exec mode, but no configuration commands in Privileged

Exec mode.

Example To show the current privilege level of the user, use the command:

awplus# show privilege

Output Figure 3-2: Example output from the show privilege command

Commands

privilege level

awplus#show privilege

Current privilege level is 15

awplus#disable

awplus>show privilege

Current privilege level is 1

C613-50292-01 Rev A Command Reference for IE210L Series 172

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SHOW SECURITY-PASSWORD CONFIGURATION

show security-password configuration

Overview This command displays the configuration settings for the various security

password rules.

Syntax show security-password configuration

Mode Privileged Exec

Example To display the current security-password rule configuration settings, use the

command:

awplus# show security-password configuration

Output Figure 3-3: Example output from the show security-password configuration

command

Commands

security-password forced-change

security-password history

security-password lifetime

security-password min-lifetime-enforce

security-password minimum-categories

security-password minimum-length

security-password reject-expired-pwd

security-password warning

show security-password user

Security Password Configuration

Minimum password length ............................ 8

Minimum password character categories to match ..... 3

Number of previously used passwords to restrict..... 4

Password lifetime .................................. 30 day(s)

Warning period before password expires ........... 3 day(s)

Reject expired password at login ................... Disabled

Force changing expired password at login ......... Enabled

C613-50292-01 Rev A Command Reference for IE210L Series 173

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SHOW SECURITY-PASSWORD USER

show security-password user

Overview This command displays user account and password information for all users.

Syntax show security-password user

Mode Privileged Exec

Example To display the system users’ remaining lifetime or last password change, use the

command:

awplus# show security-password user

Output Figure 3-4: Example output from the show security-password user command

Commands

security-password forced-change

security-password history

security-password lifetime

security-password min-lifetime-enforce

security-password minimum-categories

security-password minimum-length

security-password reject-expired-pwd

security-password warning

show security-password configuration

User account and password information



UserName Privilege Last-PWD-Change Remaining-lifetime

----------------------------------------------------------------

manager 15 4625 day(s) ago No Expiry

bob15 15 0 day(s) ago 30 days

ted7 7 0 day(s) ago No Expiry

mike1 1 0 day(s) ago No Expiry

C613-50292-01 Rev A Command Reference for IE210L Series 174

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SHOW TELNET

show telnet

Overview This command shows the Telnet server settings.

Syntax show telnet

Mode User Exec and Privileged Exec

Example To show the Telnet server settings, use the command:

awplus# show telnet

Output Figure 3-5: Example output from the show telnet command

Commands

clear line vty

service telnet

show users

telnet server

Telnet Server Configuration

------------------------------------------------------------

Telnet server : Enabled

Protocol : IPv4,IPv6

Port : 23

C613-50292-01 Rev A Command Reference for IE210L Series 175

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

SHOW USERS

show users

Overview This command shows information about the users who are currently logged into

the device.

Syntax show users

Mode User Exec and Privileged Exec

Example To show the users currently connected to the device, use the command:

awplus# show users

Output Figure 3-6: Example output from the show users command

Line User Host(s) Idle Location Priv Idletime Timeout

con 0 manager idle 00:00:00 ttyS0 15 10 N/A

vty 0 bob idle 00:00:03 172.16.11.3 1 0 5

Table 1: Parameters in the output of the show users command

Parameter Description

Line Console port user is connected to.

User Login name of user.

Host(s) Status of the host the user is connected to.

Idle How long the host has been idle.

Location URL location of user.

Priv The privilege level in the range 1 to 15, with 15 being the highest.

Idletime The time interval the device waits for user input from either a

console or VTY connection.

Timeout The time interval before a server is considered unreachable.

C613-50292-01 Rev A Command Reference for IE210L Series 176

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

TELNET

telnet

Overview Use this command to open a telnet session to a remote device.

Syntax telnet {<hostname>|[ip] <ipv4-addr>|[ipv6] <ipv6-addr>}

[<port>]

Mode User Exec and Privileged Exec

Examples To connect to TCP port 2602 on the device at 10.2.2.2, use the command:

awplus# telnet 10.2.2.2 2602

To connect to the telnet server host.example, use the command:

awplus# telnet host.example

To connect to the telnet server host.example on TCP port 100, use the

command:

awplus# telnet host.example 100

Parameter Description

<hostname>The host name of the remote system.

ip Keyword used to specify the IPv4 address or host name of a remote

system.

<ipv4-addr> An IPv4 address of the remote system.

ipv6 Keyword used to specify the IPv6 address of a remote system

<ipv6-addr> Placeholder for an IPv6 address in the format x:x::x:x, for

example, 2001:db8::8a2e:7334

<port>Specify a TCP port number (well known ports are in the range 1-

1023, registered ports are 1024-49151, and private ports are 49152-

65535).

C613-50292-01 Rev A Command Reference for IE210L Series 177

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

TELNET SERVER

telnet server

Overview This command enables the telnet server on the specified TCP port. If the server is

already enabled then it will be restarted on the new port. Changing the port

number does not affect the port used by existing sessions.

Syntax telnet server {<1-65535>|default}

Mode Global Configuration

Example To enable the telnet server on TCP port 2323, use the following commands:

awplus# configure terminal

awplus(config)# telnet server 2323

Commands

show telnet

Parameter Description

<1-65535> The TCP port to listen on.

default Use the default TCP port number 23.

C613-50292-01 Rev A Command Reference for IE210L Series 178

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

TERMINAL LENGTH

terminal length

Overview Use the terminal length command to specify the number of rows of output that

the device will display before pausing, for the currently-active terminal only.

Use the terminal no length command to remove the length specified by this

command. The default length will apply unless you have changed the length for

some or all lines by using the length (asyn) command.

Syntax terminal length <length>

terminal no length [<length>]

Mode User Exec and Privileged Exec

Examples The following example sets the number of lines to 15:

awplus# terminal length 15

The following example removes terminal length set previously:

awplus# terminal no length

Commands

terminal resize

length (asyn)

Parameter Description

<length><0-512> Number of rows that the device will display on the

currently-active terminal before pausing.

C613-50292-01 Rev A Command Reference for IE210L Series 179

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

TERMINAL RESIZE

terminal resize

Overview Use this command to automatically adjust the number of rows of output on the

console, which the device will display before pausing, to the number of rows

configured on the user’s terminal.

Syntax terminal resize

Mode User Exec and Privileged Exec

Usage When the user’s terminal size is changed, then a remote session via SSH or TELNET

adjusts the terminal size automatically. However, this cannot normally be done

automatically for a serial or console port. This command automatically adjusts the

terminal size for a serial or console port.

Examples The following example automatically adjusts the number of rows shown on the

console:

awplus# terminal resize

Commands

length (asyn)

terminal length

C613-50292-01 Rev A Command Reference for IE210L Series 180

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

USERNAME

username

Overview This command creates or modifies a user to assign a privilege level and a password.

NOTE: The default username privilege level of 1 is not shown in running-config output.

Any username privilege level that has been modified from the default is shown.

Syntax username <name> privilege <1-15> [password [8] <password>]

username <name> password [8] <password>

no username <name>

Mode Global Configuration

Default The privilege level is 1 by default. Note the default is not shown in running-config

output.

Parameter Description

<name>The login name for the user. Do not use punctuation marks such as single quotes (‘ ‘),

double quotes (“ “), or colons ( : ) with the user login name.

privilege The user’s privilege level. Use the privilege levels to set the access rights for each user.

<1-15> A privilege level: either 1-14 (limited access) or 15 (full access). A user

with privilege level 1-14 can only access higher privilege levels if an

enable password has been configured for the level the user tries to

access and the user enters that password.

A user at privilege level 1 can access the majority of show

commands. A user at privilege level 7 can access the majority of

show commands including platform show commands. Privilege

Level 15 (to access the Privileged Exec command mode) is required

to access configuration commands as well as show commands in

Privileged Exec.

password A password that the user must enter when logging in.

8Specifies that you are entering a password as a string that has

already been encrypted, instead of entering a plain-text password.

The running-config displays the new password as an encrypted

string even if password encryption is turned off.

Note that the user enters the plain-text version of the password

when logging in.

<password>The user’s password. The password can be up to 23 characters in

length and include characters from up to four categories. The

password categories are:

• uppercase letters: A to Z

• lowercase letters: a to z

• digits: 0 to 9

• special symbols: all printable ASCII characters not included in the

previous three categories. The question mark ? cannot be used as

it is reserved for help functionality.

C613-50292-01 Rev A Command Reference for IE210L Series 181

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

USER ACCESS COMMANDS

USERNAME

Usage An intermediate CLI security level (privilege level 7 to privilege level 14) allows a

CLI user access to the majority of show commands, including the platform show

commands that are available at privilege level 1 to privilege level 6. Note that some

show commands, such as show running-configuration and show

startup-configuration, are only available at privilege level 15.

Examples To create the user “bob” with a privilege level of 15, for all show commands

including show running-configuration and show startup-configuration and to

access configuration commands in Privileged Exec command mode, and the

password “bobs_secret”, use the commands:

awplus# configure terminal

awplus(config)# username bob privilege 15 password bobs_secret

To create a user “junior_admin” with a privilege level of 7, which will have

intermediate CLI security level access for most show commands, and the password

“show_only”, use the commands:

awplus# configure terminal

awplus(config)# username junior_admin privilege 7 password

show_only

Commands

enable password

security-password minimum-categories

security-password minimum-length

C613-50292-01 Rev A Command Reference for IE210L Series 182

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Feature Licensing

Commands

Introduction

Overview This chapter provides an alphabetical reference for each of the Feature Licensing

commands. Feature Licensing enables you to use advanced features such as Layer

3 routing.

To see which Feature Licenses are available for your device, see the AlliedWare Plus

Datasheet.

With Software Version 5.4.6-1.x and later, new installations of Allied Telesis

Management Framework (AMF) require a Subscription License instead of a Feature

License. For information about Subscription Licensing commands, see the

Subscription Licensing Commands chapter.

Note that AMF Feature Licenses purchased prior to 5.4.6-1.x will still operate with

5.4.6-x.x and later software versions.

For step-by-step instructions about how to license AlliedWare Plus devices, see the

Licensing Feature Overview and Configuration_Guide.

Command List •“license” on page 183

•“show license” on page 185

•“show license brief” on page 187

C613-50292-01 Rev A Command Reference for IE210L Series 183

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FEATURE LICENSING COMMANDS

LICENSE

license

Overview This command activates the licensed software feature set on a device.

Use the no variant of this command to deactivate the licensed software feature set

on a device.

For feature licenses, contact your authorized distributor or reseller. If a license key

expires or is incorrect so the license key is invalid, then some software features will

be unavailable.

NOTE: See the AlliedWare Plus™ datasheet for a list of current feature licenses available

by product. Purchase licenses from your authorized dealer or reseller.

In a live network, only install feature licenses during scheduled maintenance.

Syntax license <label> <key>

no license <label>

Mode Privileged Exec

Usage You can change the license label using this command to make it specific to you

when you initially add a license. Once a license is added, any change to the license

label first requires removal of the license before adding a license again with a new

license label.

The default feature license labels are issued along with encrypted license keys by

e-mail for you to apply using this command to activate features. You can change

default feature license labels, but they must be 15 characters or less.

For example, you may want to change the label of the premium license to

“premium-license”. You can check your new license label by using the show license

command.

If you add a feature license you will be prompted at the console that the feature

needs to restart. Restarting of individual protocols in this manner could result in

the loss of network traffic. Only install licenses in scheduled maintenance periods

for devices in a live environment.

Examples To activate the license called “Premium” that has the key

12345678ABCDE123456789ABCDE, use the command:

awplus# license Premium 12345678ABCDE123456789ABCDE

Parameter Description

<label> A name for the feature license. To determine names already in

use, use the show license command. This can be the default

name supplied for the feature, or a renamed feature name.

<key> The encrypted license key to enable a set of software features.

C613-50292-01 Rev A Command Reference for IE210L Series 184

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FEATURE LICENSING COMMANDS

LICENSE

To deactivate the license called “Premium”, use the command:

awplus# no license Premium

Commands

show license

C613-50292-01 Rev A Command Reference for IE210L Series 185

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FEATURE LICENSING COMMANDS

SHOW LICENSE

show license

Overview This command displays information about a specific software feature license, or all

enabled software feature licenses on the device.

Syntax show license [feature] [<label>|index <index-number>]

Mode User Exec and Privileged Exec

Examples To display full information about all enabled licenses, use the command:

awplus# show license

To display full information about the licenses with index number 1, use the

command:

awplus# show license index 1

Output Figure 4-1: Example output from show license

Parameter Description

feature Only display license information for any applied feature licenses.

<label>The license name to show information about. This can be used

instead of the index number to identify a specific license.

index

<index-number>The index number of the license to show information about. This

can be used instead of the license name to identify a specific

license.

awplus#show license

Board region: Global

Software Licenses

------------------------------------------------------------------------

Index : 1

License name : Base License

Customer name : Base License

Quantity of licenses : 1

Type of license : Full

License issue date : 20-Mar-2019

License expiry date : N/A

Features included : IPv6Basic, LAG-FULL, MLDSnoop, RADIUS-100, ...

Table 4-1: Parameters in the output of show license

Parameter Description

Board region Name of the region for the Base License features.

Index Index identifying entry. The index is assigned

automatically by the software. It is not configured.

C613-50292-01 Rev A Command Reference for IE210L Series 186

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FEATURE LICENSING COMMANDS

SHOW LICENSE

Commands

license

show license brief

License name Name of the license key bundle (case-sensitive).

Customer name Customer name.

Quantity of licenses Quantity of licensed installations.

Type of license Full or Trial.

License issue date Date the license was generated.

License expiry date Expiry date for trial license.

Features included List of features included in the feature license.

Table 4-1: Parameters in the output of show license (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 187

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FEATURE LICENSING COMMANDS

SHOW LICENSE BRIEF

show license brief

Overview This command displays information about a specific software feature license, or all

enabled software feature licenses on the device.

Syntax show license brief

show license [feature] [<label>|index <index-number>] brief

Mode User Exec and Privileged Exec

Examples To display a brief summary of information about all licenses, use the command:

awplus# show license brief

Output Figure 4-2: Example output from show license brief

Parameter Description

feature Only display license information for any applied feature licenses.

<label>The license name to show information about. This can be used

instead of the index number to identify a specific license.

index

<index-number>The index number of the license to show information about. This

can be used instead of the license name to identify a specific

license.

brief Displays a brief summary of license information.

awplus#show license brief

Board region: Global

Software Licenses

------------------------------------------------------------------------

Index License name Quantity Customer name

Type Version Period

------------------------------------------------------------------------

1 Base License 1 Base License

Full N/A



Current enabled features for displayed licenses:

IPv6Basic, LAG-FULL, MLDSnoop ...

Table 4-2: Parameters in the output of show license brief

Parameter Description

Board region Name of the region for the Base License features.

Index Index identifying entry. The index is assigned

automatically by the software. It is not configured.

C613-50292-01 Rev A Command Reference for IE210L Series 188

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

FEATURE LICENSING COMMANDS

SHOW LICENSE BRIEF

Commands

license

show license

License name Name of the license key bundle (case-sensitive).

Quantity Quantity of licensed installations.

Customer name Customer name.

Type Full or Trial.

Period Expiry date for trial license.

Current enabled features for

displayed licenses

List of features included in the license.

Table 4-2: Parameters in the output of show license brief (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 189

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Subscription

Licensing

Commands

Introduction

Overview This chapter provides an alphabetical reference for each of the Subscription

Licensing commands.

Subscription Licensing enables you to use OpenFlow. To see the OpenFlow

subscriptions for your device, see the AlliedWare Plus Datasheet.

For step-by-step instructions about how to license AlliedWare Plus devices, see the

Licensing Feature Overview and Configuration Guide.

Command List •“license update (filename)” on page 190

•“license update online” on page 191

•“show license external” on page 192

C613-50292-01 Rev A Command Reference for IE210L Series 190

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SUBSCRIPTION LICENSING COMMANDS

LICENSE UPDATE (FILENAME)

license update (filename)

Overview Use this command to load a license, after you have manually copied the license file

onto the device.

Only use this command if you cannot directly access the Allied Telesis Download

Center from this device. Otherwise, use the command license update online

instead.

Syntax license update <filename>

Mode Privileged Exec

Usage You can download subscription licenses from the Allied Telesis Download Center,

in order to copy them onto the device.

Examples To load a license onto a device from a file called “license_file.bin” that is stored at

the top level of Flash memory, use the following command:

awplus#license update license_file.bin

Commands

license update online

show license external

Command

changes

Version 5.4.6-2.1: usage changed by introduction of license update online

Parameter Description

<filename>Name and path of the license file on the device.

C613-50292-01 Rev A Command Reference for IE210L Series 191

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SUBSCRIPTION LICENSING COMMANDS

LICENSE UPDATE ONLINE

license update online

Overview Use this command to add or update subscription licenses from the Allied Telesis

Download Center, to subscribe to features such as OpenFlow.

When you enter this command, the device will:

1) Connect to the Download Center

2) Check if new or changed licenses are available for the device, keyed to the

device’s serial number

3) For each such license it finds, download and install the license.

Syntax license update online

Default AlliedWare Plus devices do not automatically connect to the Download Center and

check whether licenses are available. They only check when you run the license

update online command.

Mode User Exec/Privileged Exec

Usage Verifying the update

The update process normally takes approximately 5 seconds.

If the console does not respond for 10 or more seconds after typing the command,

a network, routing or firewall configuration error is probably preventing the

connection from establishing. If this happens, you can abort the command by

pressing Ctrl-C, or wait for the command to time out after 30 seconds.

If the connection to the Download Centers fails and times out, an error message

will be generated on the CLI to indicate the problem. If you abort the command,

no error message is displayed.

If the update is successful, the device will produce log messages to say which

features have had their licensing state updated (activated, deactivated, number of

items changed, or expiry date changed). If the command completes successfully

but there are no licenses available for the device, or no change in the licenses

already on the device, no log messages will be produced.

You should also use the show license external command to confirm which licenses

are active on the device after the update has been applied.

Example To add a subscription license, use the command:

awplus# license update online

Commands

show license external

Command

changes

Version 5.4.6-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 192

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SUBSCRIPTION LICENSING COMMANDS

SHOW LICENSE EXTERNAL

show license external

Overview Use this command to show information about subscription (external) licenses.

Syntax show license external

Mode Privileged Exec

Examples To show information about what subscription features the device is licensed for,

use the following command:

awplus#show license external

Output Figure 5-1: Example output from show license external

Commands

license update online

awplus#show license external 



Features with installed entitlements:



OpenFlow



Currently licensed: Yes



Start date: 19 Sep 2016 00:00

Expiry date: 19 Sep 2017 23:59

C613-50292-01 Rev A Command Reference for IE210L Series 193

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GUI Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

the GUI.

For more information, see Getting Started with the Device GUI on Switches.

Command List •“atmf topology-gui enable” on page 194

•“gui-timeout” on page 195

•“http port” on page 196

•“http secure-port” on page 197

•“log event-host” on page 198

•“service http” on page 199

•“show http” on page 200

C613-50292-01 Rev A Command Reference for IE210L Series 194

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GUI COMMANDS

ATMF TOPOLOGY-GUI ENABLE

atmf topology-gui enable

Overview Use this command to enable the operation of Vista Manager EX on the Master

device.

Vista Manager EX delivers state-of-the-art monitoring and management for your

Autonomous Management Framework™ (AMF) network, by automatically creating

a complete topology map of switches, firewalls and wireless access points (APs).

An expanded view includes third-party devices such as security cameras.

Use the no variant of this command to disable operation of Vista Manager EX.

Syntax atmf topology-gui enable

no atmf topology-gui enable

Default Disabled by default on AMF Master and member nodes. Enabled by default on

Controllers.

Mode Global Configuration mode

Usage To use Vista Manager EX, you must also enable the HTTP service on all AMF nodes,

including all AMF masters and controllers. The HTTP service is enabled by default

on AlliedWare Plus switches and disabled by default on AR-Series firewalls. To

enable it, use the commands:

Node1# configure terminal

Node1(config)# service http

On one master in each AMF area in your network, you also need to configure the

master to send event notifications to Vista Manager EX. To do this, use the

commands:

Node1# configure terminal

Node1(config)# log event-host <ip-address> atmf-topology-event

Example To enable Vista Manager EX on Node1, use the following commands:

Node1# configure terminal

Node1(config)# atmf topology-gui enable

To disable Vista Manager EX on Node1, use the following commands:

Node1# configure terminal

Node1(config)# no atmf topology-gui enable

Commands

atmf enable

gui-timeout

log event-host

service http

C613-50292-01 Rev A Command Reference for IE210L Series 195

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GUI COMMANDS

GUI-TIMEOUT

gui-timeout

Overview Use this command to configure an idle timeout period for a GUI session. The time

can be set in minutes and/or seconds.

Use the no variant of this command to disable the GUI session idle timeout.

Syntax gui-timeout <minutes> [<seconds>]

no gui-timeout

Default Disabled

Mode Global Configuration

Usage The GUI uses the configured timeout period (set in either minutes and/or seconds)

to determine when a GUI session should be closed. Once the GUI timeout has

expired, you will need to login to reactivate your session.

To enter seconds only, enter 0 for minutes, followed by a space, and then enter the

seconds.

If the GUI timeout is disabled, a GUI session will remain active until you terminate

it. No idle time will be configured.

The same timeout period will apply to all GUI sessions logged into a specific device.

Examples Use this command to configure the GUI timeout period for 3 minutes and 30

seconds for a GUI session.

awplus# gui-timeout 3 30

Use this command to configure the GUI timeout period for 0 minutes and 61

seconds for a GUI session.

awplus# gui-timeout 0 61

Use this command to disable the GUI timeout period.

awplus# no gui-timeout

Output Figure 6-1: Example output from gui-timeout

Commands

show running-config

Parameter Description

<minutes> Specifies the idle time in minutes from 0 through 35791

<seconds> Specifies the idle time in seconds from 0 through 2147483

awplus#configure terminal

awplus(config)#gui-timeout 3 30

The new gui-timeout settings [3 min 30 sec] will apply to new sessions only

C613-50292-01 Rev A Command Reference for IE210L Series 196

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GUI COMMANDS

HTTP PORT

http port

Overview Use this command to change the HTTP port used to access the web-based device

GUI, or to disable HTTP management.

Use the no variant of this command to return to using the default port, which is 80.

Syntax http port {<1-65535>|none}

no http port

Default The default port for accessing the GUI is port 80.

Mode Global Configuration

Usage Do not configure the HTTP port to be the same as the HTTPS port.

Note that the device will redirect from HTTP to HTTPS unless you have disabled

HTTPS access, which we do not recommend doing.

Example To set the port to 8080, use the commands:

awplus# configure terminal

awplus(config)# http port 8080

To return to using the default port of 80, use the commands:

awplus# configure terminal

awplus(config)# no http port

To stop users from accessing the GUI via HTTP, use the commands:

awplus# configure terminal

awplus(config)# http port none

Commands

http secure-port

service http

show http

Command

changes

Version 5.4.7-2.4: command added on AR-Series devices

Version 5.4.8-0.2: command added on AlliedWare Plus switches

Parameter Description

<1-65535> The HTTP port number

none Disable HTTP management. You may want to do this if you need

to use port 80 for a different service or you do not need to use

HTTP at all.

C613-50292-01 Rev A Command Reference for IE210L Series 197

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GUI COMMANDS

HTTP SECURE-PORT

http secure-port

Overview Use this command to change the HTTPS port used to access the web-based device

GUI, or to disable HTTPS management.

Use the no variant of this command to return to using the default port, which is

443.

Syntax http secure-port {<1-65535>|none}

no http secure-port

Default The default port for accessing the GUI is port 443.

Mode Global Configuration

Usage Do not configure the HTTPS port to be the same as the HTTP port.

Note that if you are using Vista Manager EX and need to change the HTTPS port,

you must use certificate-based authorization in Vista Manager EX. See the Vista

Manager EX Installation and User Guide for instructions.

Example To set the port to 8443, use the commands:

awplus# configure terminal

awplus(config)# http secure-port 8443

To return to using the default port of 443, use the commands:

awplus# configure terminal

awplus(config)# no http secure-port

To stop users from accessing the GUI via HTTPS, use the commands:

awplus# configure terminal

awplus(config)# http secure-port none

Commands

http port

service http

show http

Command

changes

Version 5.4.7-1.1: command added on AR-Series devices

Version 5.4.7-2.4: none parameter added

Version 5.4.8-0.2: command added on AlliedWare Plus switches

Parameter Description

<1-65535> The HTTPS port number

none Disable HTTPS management. Do not do this if you want to use

Vista Manager EX or the GUI.

C613-50292-01 Rev A Command Reference for IE210L Series 198

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GUI COMMANDS

LOG EVENT-HOST

log event-host

Overview Use this command to set up an external host to log AMF topology events through

Vista Manager. This command is run on the Master device.

Use the no variant of this command to disable log events through Vista Manager.

Syntax log event-host [<ipv4-addr>|<ipv6-addr>] atmf-topology-event

no log event-host [<ipv4-addr>|<ipv6-addr>] atmf-topology-event

Default Log events are disabled by default.

Mode Global Configuration

Usage Event hosts are set so syslog sends the messages out as they come.

Note that there is a difference between log event and log host messages:

• Log event messages are sent out as they come by syslog

• Log host messages are set to wait for a number of messages (20) to send

them out together for traffic optimization.

Example To enable Node 1 to log event messages from host IP address 192.0.2.31, use the

following commands:

Node1# configure terminal

Node1(config)# log event-host 192.0.2.31 atmf-topology-event

To disable Node 1 to log event messages from host IP address 192.0.2.31, use the

following commands:

Node1# configure terminal

Node1(config)# no log event-host 192.0.2.31 atmf-topology-event

Commands

atmf topology-gui enable

Parameter Description

<ipv4-addr> ipv4 address of the event host

<ipv6-addr> ipv6 address of the event host

C613-50292-01 Rev A Command Reference for IE210L Series 199

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GUI COMMANDS

SERVICE HTTP

service http

Overview Use this command to enable the HTTP (Hypertext Transfer Protocol) service.

This service is required to support Vista Manager EX™ and the device GUI.

Use the no variant of this command to disable the HTTP feature.

Syntax service http

no service http

Default Enabled

Mode Global Configuration

Example To enable the HTTP service, use the following commands:

awplus# configure terminal

awplus(config)# service http

To disable the HTTP service, use the following commands:

awplus# configure terminal

awplus(config)# no service http

Commands

http port

http secure-port

show http

C613-50292-01 Rev A Command Reference for IE210L Series 200

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GUI COMMANDS

SHOW HTTP

show http

Overview This command shows the HTTP server settings.

Syntax show http

Mode User Exec and Privileged Exec

Example To show the HTTP server settings, use the command:

awplus# show http

Output Figure 6-2: Example output from the show http command

Commands

clear line vty

service http

awplus#show http

HTTP Server Configuration

------------------------------------------------------------

HTTP server : Enabled

Port : 80

C613-50292-01 Rev A Command Reference for IE210L Series 201

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

System

Configuration and

Monitoring

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands for configuring and

monitoring the system.

Command List •“banner exec” on page 203

•“banner login (system)” on page 205

•“banner motd” on page 207

•“clock set” on page 209

•“clock summer-time date” on page 210

•“clock summer-time recurring” on page 212

•“clock timezone” on page 214

•“ecofriendly led” on page 215

•“findme” on page 216

•“findme trigger” on page 218

•“hostname” on page 219

•“no debug all” on page 221

•“reboot” on page 223

•“reload” on page 224

•“show clock” on page 225

•“show cpu” on page 227

•“show cpu history” on page 230

•“show debugging” on page 232

•“show ecofriendly” on page 233

•“show interface memory” on page 234

C613-50292-01 Rev A Command Reference for IE210L Series 202

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

•“show memory” on page 236

•“show memory allocations” on page 238

•“show memory history” on page 240

•“show memory pools” on page 241

•“show memory shared” on page 242

•“show process” on page 243

•“show reboot history” on page 245

•“show router-id” on page 246

•“show system” on page 247

•“show system environment” on page 248

•“show system interrupts” on page 249

•“show system mac” on page 250

•“show system serialnumber” on page 251

•“show tech-support” on page 252

•“speed (asyn)” on page 254

•“system territory (deprecated)” on page 256

•“terminal monitor” on page 257

•“undebug all” on page 258

C613-50292-01 Rev A Command Reference for IE210L Series 203

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

BANNER EXEC

banner exec

Overview This command configures the User Exec mode banner that is displayed on the

console after you login. The banner exec default command restores the User Exec

banner to the default banner. Use the no banner exec command to disable the

User Exec banner and remove the default User Exec banner.

Syntax banner exec <banner-text>

banner exec default

no banner exec

Default By default, the AlliedWare Plus™ version and build date is displayed at console

Mode Global Configuration

Examples To configure a User Exec mode banner after login (in this example, to tell people to

use the enable command to move to Privileged Exec mode), enter the following

commands:

To restore the default User Exec mode banner after login, enter the following

commands:

AlliedWare Plus (TM) 5.4.9 01/02/19 12:00:00

awplus#configure terminal

awplus(config)#banner exec Use enable to move to Priv Exec mode

awplus(config)#exit

awplus#exit



awplus login: manager

Password:



Use enable to move to Priv Exec mode



awplus>

awplus#configure terminal

awplus(config)#banner exec default

awplus(config)#exit

awplus#exit



awplus login: manager

Password:



AlliedWare Plus (TM) 5.4.9 01/02/19 12:00:00



awplus>

C613-50292-01 Rev A Command Reference for IE210L Series 204

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

BANNER EXEC

To remove the User Exec mode banner after login, enter the following commands:

Commands

banner login (system)

banner motd

awplus#configure terminal

awplus(config)#no banner exec

awplus(config)#exit

awplus#exit



awplus login: manager

Password:



awplus>

C613-50292-01 Rev A Command Reference for IE210L Series 205

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

BANNER LOGIN (SYSTEM)

banner login (system)

Overview This command configures the login banner that is displayed on the console when

you login. The login banner is displayed on all connected terminals. The login

banner is displayed after the MOTD (Message-of-the-Day) banner and before the

Use the no banner login command to disable the login banner.

Syntax banner login

no banner login

Default By default, no login banner is displayed at console login.

Mode Global Configuration

Examples To configure a login banner of “Authorised users only” to be displayed when you

To remove the login banner, enter the following commands:

awplus#configure terminal

awplus(config)#banner login

Type CNTL/D to finish.



Authorised users only



awplus(config)#exit

awplus#exit



Authorised users only



awplus login: manager

Password:



AlliedWare Plus (TM) 5.4.9 01/02/19 12:00:00



awplus>

awplus#configure terminal

awplus(config)#no banner login

awplus(config)#exit

awplus#exit



awplus login: manager

Password:



AlliedWare Plus (TM) 5.4.9 01/02/19 12:00:00



awplus>

C613-50292-01 Rev A Command Reference for IE210L Series 206

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

BANNER LOGIN (SYSTEM)

Commands

banner exec

banner motd

C613-50292-01 Rev A Command Reference for IE210L Series 207

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

BANNER MOTD

banner motd

Overview Use this command to create or edit the text MotD (Message-of-the-Day) banner

displayed before login. The MotD banner is displayed on all connected terminals.

The MotD banner is useful for sending messages that affect all network users, for

example, any imminent system shutdowns.

Use the no variant of this command to delete the MotD banner.

Syntax banner motd <motd-text>

no banner motd

Default By default, the device displays the AlliedWare Plus™ OS version and build date

when you login.

Mode Global Configuration

Examples To configure a MotD banner of “System shutdown at 6pm today” to be displayed

when you log in, enter the following commands:

To delete the login banner, enter the following commands:

Parameter Description

<motd-text> The text to appear in the Message of the Day banner.

awplus>enable

awplus#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

awplus(config)#banner motd System shutdown at 6pm today

awplus(config)#exit

awplus#exit



System shutdown at 6pm today

awplus login: manager

Password:



AlliedWare Plus (TM) 5.4.9 01/02/19 12:00:00



awplus>

C613-50292-01 Rev A Command Reference for IE210L Series 208

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

BANNER MOTD

Commands

banner exec

banner login (system)

awplus>enable

awplus#configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

awplus(config)#no banner motd

awplus(config)#exit

awplus#exit



awplus login: manager

Password:



AlliedWare Plus (TM) 5.4.9 01/02/19 12:00:00



awplus>

C613-50292-01 Rev A Command Reference for IE210L Series 209

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

CLOCK SET

clock set

Overview This command sets the time and date for the system clock.

Syntax clock set <hh:mm:ss> <day> <month> <year>

Mode Privileged Exec

Usage Configure the timezone before setting the local time. Otherwise, when you change

the timezone, the device applies the new offset to the local time.

NOTE: If Network Time Protocol (NTP) is enabled, then you cannot change the time or

date using this command. NTP maintains the clock automatically using an external

time source. If you wish to manually alter the time or date, you must first disable NTP.

Example To set the time and date on your system to 2pm on the 2nd of October 2016, use

the command:

awplus# clock set 14:00:00 2 oct 2016

Commands

clock timezone

Parameter Description

<hh:mm:ss> Local time in 24-hour format

<day> Day of the current month, from 1 to 31

<month> The first three letters of the current month

<year> Current year, from 2000 to 2035

C613-50292-01 Rev A Command Reference for IE210L Series 210

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

CLOCK SUMMER-TIME DATE

clock summer-time date

Overview This command defines the start and end of summertime for a specific year only,

and specifies summertime’s offset value to Standard Time for that year.

The no variant of this command removes the device’s summertime setting. This

clears both specific summertime dates and recurring dates (set with the clock

summer-time recurring command).

By default, the device has no summertime definitions set.

Syntax clock summer-time <timezone-name> date <start-day>

<start-month> <start-year> <start-time> <end-day> <end-month>

<end-year> <end-time> <1-180>

no clock summer-time

Mode Global Configuration

Examples To set a summertime definition for New Zealand using NZST (UTC+12:00) as the

standard time, and NZDT (UTC+13:00) as summertime, with the summertime set to

begin on the 25th of September 2016 and end on the 2nd of April 2017:

awplus(config)# clock summer-time NZDT date 25 sep 2:00 2016 2

apr 2:00 2017 60

To remove any summertime settings on the system, use the command:

awplus(config)# no clock summer-time

Parameter Description

<timezone-name> A description of the summertime zone, up to 6 characters long.

date Specifies that this is a date-based summertime setting for just

the specified year.

<start-day> Day that the summertime starts, from 1 to 31.

<start-month> First three letters of the name of the month that the

summertime starts.

<start-year> Year that summertime starts, from 2000 to 2035.

<start-time> Time of the day that summertime starts, in the 24-hour time

format HH:MM.

<end-day> Day that summertime ends, from 1 to 31.

<end-month> First three letters of the name of the month that the

summertime ends.

<end-year> Year that summertime ends, from 2000 to 2035.

<end-time> Time of the day that summertime ends, in the 24-hour time

format HH:MM.

<1-180> The offset in minutes.

C613-50292-01 Rev A Command Reference for IE210L Series 211

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

CLOCK SUMMER-TIME DATE

Commands

clock summer-time recurring

clock timezone

C613-50292-01 Rev A Command Reference for IE210L Series 212

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

CLOCK SUMMER-TIME RECURRING

clock summer-time recurring

Overview This command defines the start and end of summertime for every year, and

specifies summertime’s offset value to Standard Time.

The no variant of this command removes the device’s summertime setting. This

clears both specific summertime dates (set with the clock summer-time date

command) and recurring dates.

By default, the device has no summertime definitions set.

Syntax clock summer-time <timezone-name> recurring <start-week>

<start-day> <start-month> <start-time> <end-week> <end-day>

<end-month> <end-time> <1-180>

no clock summer-time

Parameter Description

<timezone-

name> A description of the summertime zone, up to 6 characters long.

recurring Specifies that this summertime setting applies every year from

now on.

<start-week> Week of the month when summertime starts, in the range 1-5. The

value 5 indicates the last week that has the specified day in it for

the specified month. For example, to start summertime on the last

Sunday of the month, enter 5 for <start-week> and sun for

<start-day>.

<start-day> Day of the week when summertime starts. Valid values are mon,

tue, wed, thu, fri, sat or sun.

<start-month> First three letters of the name of the month that summertime

starts.

<start-time> Time of the day that summertime starts, in the 24-hour time

format HH:MM.

<end-week> Week of the month when summertime ends, in the range 1-5. The

value 5 indicates the last week that has the specified day in it for

the specified month. For example, to end summertime on the last

Sunday of the month, enter 5 for <end-week> and sun for <end-

day>.

<end-day> Day of the week when summertime ends. Valid values are mon,

tue, wed, thu, fri, sat or sun.

<end-month> First three letters of the name of the month that summertime

ends.

<end-time> Time of the day that summertime ends, in the 24-hour time format

HH:MM.

<1-180> The offset in minutes.

C613-50292-01 Rev A Command Reference for IE210L Series 213

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

CLOCK SUMMER-TIME RECURRING

Mode Global Configuration

Examples To set a summertime definition for New Zealand using NZST (UTC+12:00) as the

standard time, and NZDT (UTC+13:00) as summertime, with summertime set to

start on the last Sunday in September, and end on the 1st Sunday in April, use the

command:

awplus(config)# clock summer-time NZDT recurring 5 sun sep 2:00

1 sun apr 2:00 60

To remove any summertime settings on the system, use the command:

awplus(config)# no clock summer-time

Commands

clock summer-time date

clock timezone

C613-50292-01 Rev A Command Reference for IE210L Series 214

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

CLOCK TIMEZONE

clock timezone

Overview This command defines the device’s clock timezone. The timezone is set as a offset

to the UTC.

The no variant of this command resets the system time to UTC.

By default, the system time is set to UTC.

Syntax clock timezone <timezone-name> {minus|plus}

[<0-13>|<0-12>:<00-59>]

no clock timezone

Mode Global Configuration

Usage Configure the timezone before setting the local time. Otherwise, when you change

the timezone, the device applies the new offset to the local time.

Examples To set the timezone to New Zealand Standard Time with an offset from UTC of +12

hours, use the command:

awplus(config)# clock timezone NZST plus 12

To set the timezone to Indian Standard Time with an offset from UTC of +5:30

hours, use the command:

awplus(config)# clock timezone IST plus 5:30

To set the timezone back to UTC with no offsets, use the command:

awplus(config)# no clock timezone

Commands

clock set

clock summer-time date

clock summer-time recurring

Parameter Description

<timezone-name> A description of the timezone, up to 6 characters long.

minusorplus The direction of offset from UTC. The minus option

indicates that the timezone is behind UTC. The plus option

indicates that the timezone is ahead of UTC.

<0-13> The offset in hours or from UTC.

<0-12>:<00-59> The offset in hours or from UTC.

C613-50292-01 Rev A Command Reference for IE210L Series 215

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

ECOFRIENDLY LED

ecofriendly led

Overview Use this command to enable the eco-friendly LED (Light Emitting Diode) feature,

which turns off power to the port LEDs.

You can also use the front-panel eco-switch button to enable or disable the

eco-friendly feature. Using this button overrides the configuration set with the

ecofriendly led command.

Use the no variant of this command to disable the eco-friendly LED feature.

Syntax ecofriendly led

no ecofriendly led

Default The eco-friendly LED feature is disabled by default.

Mode Global Configuration

Usage When the eco-friendly LED feature is enabled, a change in port status will not affect

the display of the associated LED. When the eco-friendly LED feature is disabled

and power is returned to port LEDs, the LEDs will correctly show the current state

of the ports.

For an example of how to configure a trigger to turn off power to port LEDs, see the

Triggers Feature Overview and Configuration Guide.

Examples To enable the eco-friendly LED feature which turns off power to all port LEDs, use

the following commands:

awplus# configure terminal

awplus(config)# ecofriendly led

To disable the eco-friendly LED feature, use the following command:

awplus# configure terminal

awplus(config)# no ecofriendly led

Commands

show ecofriendly

C613-50292-01 Rev A Command Reference for IE210L Series 216

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

FINDME

findme

Overview Use this command to physically locate a specific device from a group of similar

devices. Activating the command causes a selected number of port LEDs to

alternately flash green then amber (if that device has amber LEDs) at a rate of 1 Hz.

Use the no variant of this command to deactivate the Find Me feature prior to the

timeout expiring.

Syntax findme [interface <port-list>] [timeout <duration>]

no findme

Default By default all port LEDs flash for 60 seconds.

Mode Privileged Exec

Usage Running the findme command causes the device’s port LEDs to flash. An optional

timeout parameter specifies the flash behavior duration. Normal LED behavior is

restored automatically after either the default time, or a specified time has elapsed,

or a no findme command is used. You can specify which interface or interfaces are

flashed with the optional interface parameter.

Example To activate the Find Me feature for the default duration (60 seconds) on all ports,

use the following command:

awplus# findme

To activate the Find Me feature for 120 seconds on all ports, use the following

command:

awplus# findme timeout 120

To activate the Find Me feature for the default duration (60 seconds) on switch port

interfaces port1.0.2 through port1.0.4, use the following command:

awplus# findme interface port1.0.2-1.0.4

In the example above, ports 2 to 4 will flash 4 times and then all ports will flash

twice. Each alternate flash will be amber (if that device has amber LEDs). This

pattern will repeat until timeout (default or set) or no findme commands are used.

Parameter Description

interface <port-list> The ports to flash. The port list can be:

• a switch port, e.g. port1.0.4

• a continuous range of ports separated by a hyphen,

e.g. port1.0.1-1.0.4

• a comma-separated list of ports and port ranges,

e.g. port1.0.1,port1.0.5-1.0.6.

timeout <duration>How long the LEDs flash, in seconds, in the range 5 to

3600 seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 217

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

FINDME

To deactivate the Find Me feature, use the following command:

awplus# no findme

C613-50292-01 Rev A Command Reference for IE210L Series 218

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

FINDME TRIGGER

findme trigger

Overview When this command is enabled, the LED flashing functionality of the find-me

command is applied whenever any or all of the selected parameter conditions is

detected.

Use the no variant to remove the findme trigger function for the selected

parameter.

Syntax findme trigger {all|loopprot|thrash-limit|qsp}

no findme trigger {all|loopprot|thrash-limit|qsp}

Default The findme trigger function is disabled.

Mode Global config

Usage Note that findme trigger is not available if you have set the switch to take the

following actions in response to an event:

• For loop detection, the actions log-only and none

• For MAC address thrash-limiting, the actions learn-disable and none.

Example To enable action LED flashing for the loop protection function:

awplus# findme trigger loopprot

Commands

findme

loop-protection loop-detect

Parameter Description

all Enable the find-me function whenever any of the listed parameter

conditions are detected

loopprot Enable the findme function whenever a loop protection condition

is detected.

thrash-limit Enable the findme function whenever a MAC address

thrash-limiting condition is detected.

qsp Enable the findme function whenever a QoS Storm Protection

condition is detected.

C613-50292-01 Rev A Command Reference for IE210L Series 219

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

HOSTNAME

hostname

Overview This command sets the name applied to the device as shown at the prompt. The

hostname is:

• displayed in the output of the show system command

• displayed in the CLI prompt so you know which device you are configuring

• stored in the MIB object sysName

Use the no variant of this command to revert the hostname setting to its default.

For devices that are not part of an AMF network, the default is “awplus”.

Syntax hostname <hostname>

no hostname [<hostname>]

Default awplus

Mode Global Configuration

Usage Within an AMF network, any device without a user-defined hostname will

automatically be assigned a name based on its MAC address.

To efficiently manage your network using AMF, we strongly advise that you devise

a naming convention for your network devices and apply an appropriate

hostname to each device.

The name must also follow the rules for ARPANET host names. The name must start

with a letter, end with a letter or digit, and use only letters, digits, and hyphens.

Refer to RFC 1035.

Example To set the system name to HQ-Sales, use the command:

awplus# configure terminal

awplus(config)# hostname HQ-Sales

This changes the prompt to:

HQ-Sales(config)#

To revert to the default hostname awplus, use the command:

HQ-Sales(config)# no hostname

This changes the prompt to:

awplus(config)#

Parameter Description

<hostname> Specifies the name given to a specific device. This is also referred to as

the Node name in AMF output screens.

C613-50292-01 Rev A Command Reference for IE210L Series 220

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

HOSTNAME

NOTE: When AMF is configured, running the no hostname command will apply a

hostname that is based on the MAC address of the device node, for example,

node_0000_5e00_5301.

Commands

show system

C613-50292-01 Rev A Command Reference for IE210L Series 221

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

NO DEBUG ALL

no debug all

Overview This command disables the debugging facility for all features on your device. This

stops the device from generating any diagnostic debugging messages.

You can optionally disable the debugging facility for only the given protocol or

feature. The features available depend on your device and will be a subset of the

features listed in the Syntax section below.

Syntax no debug all [bgp|ipv6|dot1x|nsm|ospf|pim dense-mode|pim

sparse-mode|rip|vrrp]

Default The debugging facility is disabled by default.

Mode Global Configuration and Privileged Exec

Example To disable debugging for all features, use the command:

awplus# no debug all

To disable all 802.1X debugging, use the command:

awplus# no debug all dot1x

To disable all IPv6 debugging, use the command:

awplus# no debug all ipv6

To disable all NSM debugging, use the command:

awplus# no debug all nsm

Parameter Description

bgp Turns off all debugging for BGP (Border Gateway Protocol).

dot1x Turns off all debugging for IEEE 802.1X port-based network

access- control.

ipv6 Turns off all debugging for IPv6 (Internet Protocol version 6).

nsm Turns off all debugging for the NSM (Network Services

Module).

ospf Turns off all debugging for OSPF (Open Shortest Path First).

pim dense-mode Turns off all debugging for PIM (Protocol Independent

Multicast) Dense Mode.

pim sparse-mode Turns off all debugging for PIM (Protocol Independent

Multicast) Sparse Mode.

rip Turns off all debugging for RIP (Routing Information Protocol).

vrrp Turns off all debugging for VRRP (Virtual Router Redundancy

Protocol).

C613-50292-01 Rev A Command Reference for IE210L Series 222

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

NO DEBUG ALL

To disable all RIP debugging, use the command:

awplus# no debug all rip

Commands

undebug all

Command

changes

Version 5.4.7-1.1: RIP parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 223

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

REBOOT

reboot

Overview This command halts the device and performs a cold restart (also known as reload).

It displays a confirmation request before restarting.

Syntax reboot

reload

Mode Privileged Exec

Usage The reboot and reload commands perform the same action.

Examples To restart the device, use the command:

awplus# reboot

reboot system? (y/n): y

C613-50292-01 Rev A Command Reference for IE210L Series 224

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

RELOAD

reload

Overview This command performs the same function as the reboot command.

C613-50292-01 Rev A Command Reference for IE210L Series 225

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW CLOCK

show clock

Overview This command displays the system’s current configured local time and date. It also

displays other clock related information such as timezone and summertime

configuration.

Syntax show clock

Mode User Exec and Privileged Exec

Example To display the system’s current local time, use the command:

awplus# show clock

Output Figure 7-1: Example output from the show clock command for a device using

New Zealand time

Local Time: Mon, 17 Oct 2016 13:56:06 +1200

UTC Time: Mon, 17 Oct 2016 01:56:06 +0000

Timezone: NZST

Timezone Offset: +12:00

Summer time zone: NZDT

Summer time starts: Last Sunday in September at 02:00:00

Summer time ends: First Sunday in April at 02:00:00

Summer time offset: 60 mins

Summer time recurring: Yes

Table 1: Parameters in the output of the show clock command

Parameter Description

Local Time Current local time.

UTC Time Current UTC time.

Timezone The current configured timezone name.

Timezone Offset Number of hours offset to UTC.

Summer time zone The current configured summertime zone name.

Summer time starts Date and time set as the start of summer time.

Summer time ends Date and time set as the end of summer time.

Summer time offset Number of minutes that summer time is offset from the

system’s timezone.

Summer time

recurring Whether the device will apply the summer time settings

every year or only once.

C613-50292-01 Rev A Command Reference for IE210L Series 226

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW CLOCK

Commands

clock set

clock summer-time date

clock summer-time recurring

clock timezone

C613-50292-01 Rev A Command Reference for IE210L Series 227

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW CPU

show cpu

Overview This command displays a list of running processes with their CPU utilization.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show cpu [sort {thrds|pri|sleep|runtime}]

Mode User Exec and Privileged Exec

Examples To show the CPU utilization of current processes, sorting them by the number of

threads the processes are using, use the command:

awplus# show cpu sort thrds

Parameter Description

sort Changes the sorting order using the following fields. If you do not

specify a field, then the list is sorted by percentage CPU

utilization.

thrds Sort by the number of threads.

pri Sort by the process priority.

sleep Sort by the average time sleeping.

runtime Sort by the runtime of the process.

C613-50292-01 Rev A Command Reference for IE210L Series 228

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW CPU

Output Figure 7-2: Example output from show cpu

CPU averages:

1 second: 12%, 20 seconds: 2%, 60 seconds: 2%

System load averages:

1 minute: 0.03, 5 minutes: 0.02, 15 minutes: 0.00

Current CPU load:

userspace: 6%, kernel: 4%, interrupts: 1% iowaits: 0%



user processes

==============

pid name thrds cpu% pri state sleep% runtime

1544 hostd 1 2.8 20 run 0 120

1166 exfx 17 1.8 20 sleep 0 3846

1284 aisexec 44 0.9 -2 sleep 0 2606

1 init 1 0.0 20 sleep 0 120

9772 sh 1 0.0 20 sleep 0 0

9773 corerotate 1 0.0 20 sleep 0 0

853 syslog-ng 1 0.0 20 sleep 0 356

859 klogd 1 0.0 20 sleep 0 1

910 inetd 1 0.0 20 sleep 0 3

920 portmap 1 0.0 20 sleep 0 0

931 crond 1 0.0 20 sleep 0 1

1090 openhpid 11 0.0 20 sleep 0 233

1111 hpilogd 1 0.0 20 sleep 0 0

1240 hsl 1 0.0 20 sleep 0 79

1453 authd 1 0.0 20 sleep 0 85

...

Table 2: Parameters in the output of the show cpu command

Parameter Description

CPU averages Average CPU utilization for the periods stated.

System load

averages The average number of processes waiting for CPU time for the

periods stated.

Current CPU

load Current CPU utilization specified by load types.

pid Identifier number of the process.

name A shortened name for the process

thrds Number of threads in the process.

cpu% Percentage of CPU utilization that this process is consuming.

pri Process priority state.

state Process state; one of “run”, “sleep”, “zombie”, and “dead”.

C613-50292-01 Rev A Command Reference for IE210L Series 229

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW CPU

Commands

show memory

show memory allocations

show memory history

show memory pools

show process

sleep% Percentage of time that the process is in the sleep state.

runtime The time that the process has been running for, measured in

jiffies. A jiffy is the duration of one tick of the system timer

interrupt.

Table 2: Parameters in the output of the show cpu command (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 230

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW CPU HISTORY

show cpu history

Overview This command prints a graph showing the historical CPU utilization.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show cpu history

Mode User Exec and Privileged Exec

Usage This command’s output displays three graphs of the percentage CPU utilization:

• per second for the last minute, then

• per minute for the last hour, then

• per 30 minutes for the last 30 hours.

Examples To display a graph showing the historical CPU utilization of the device, use the

command:

awplus# show cpu history

Output Figure 7-3: Example output from the show cpu history command

Per second CPU load history



100

90

80

70

60

50

40

30

20 *

10 ******************************************* ****************

|....|....|....|....|....|....|....|....|....|....|....|....

Oldest Newest

CPU load% per second (last 60 seconds)

* = average CPU load%

C613-50292-01 Rev A Command Reference for IE210L Series 231

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW CPU HISTORY

Commands

show memory

show memory allocations

show memory pools

show process

Per minute CPU load history



100

90

80

70

60 +

50

40

30

20 ++ +++++++++ +++++++ ++++ + ++++++ ++++ +++ +++++ +++++++++

10 ************************************************************

|....|....|....|....|....|....|....|....|....|....|....|....

Oldest Newest

CPU load% per minute (last 60 minutes)

* = average CPU load%, + = maximum

Per (30) minute CPU load history



100

90

80

70 +

60

50

40

30

20

10 ***

|....|....|....|....|....|....|....|....|....|....|....|....

Oldest Newest

CPU load% per 30 minutes (last 60 values / 30 hours)

* = average, - = minimum, + = maximum

C613-50292-01 Rev A Command Reference for IE210L Series 232

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW DEBUGGING

show debugging

Overview This command displays all debugging options in alphabetical order, indicating

whether debugging is enabled or disabled for each feature.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show debugging

Mode User Exec and Privileged Exec

Example To find out what debugging is enabled, use the command:

awplus# show debugging

Output Figure 7-4: Example output from the show debugging command

awplus#show debugging

AAA debugging status:

Authentication debugging is off

Accounting debugging is off



% DHCP Snooping service is disabled



802.1X debugging status:



EPSR debugging status:

EPSR Info debugging is off

EPSR Message debugging is off

EPSR Packet debugging is off

EPSR State debugging is off



IGMP Debugging status:

IGMP Decoder debugging is off

IGMP Encoder debugging is off

...

C613-50292-01 Rev A Command Reference for IE210L Series 233

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW ECOFRIENDLY

show ecofriendly

Overview This command displays the switch’s eco-friendly configuration status. The

ecofriendly led configuration status are shown in the show ecofriendly output.

Syntax show ecofriendly

Mode Privileged Exec and Global Configuration

Example To display the switch’s eco-friendly configuration status, use the following

command:

awplus# show ecofriendly

Output Figure 7-5: Example output from the show ecofriendly command

awplus#show ecofriendly 

Front panel port LEDs normal



Energy efficient ethernet

Port Name Configured Status

port1.0.1 Port 1 off -

port1.0.2 off off

port1.0.3 off -

port1.0.4 Port 4 off -

port1.0.5 off -

...

Table 3: Parameters in the output of the show ecofriendly command

Parameter Description

normal The eco-friendly LED feature is disabled and port LEDs

show the current state of the ports. This is the default

setting.

off The eco-friendly LED feature is enabled and power to

the port LEDs is disabled.

Port Displays the port number as assigned by the switch.

Name Displays the port name if a name is configured for a

port number.

Configured Because LPI is not supported, this entry always shows

“off” or a dash (-).

Status Because LPI is not supported, this entry always shows

“off” or a dash (-).

C613-50292-01 Rev A Command Reference for IE210L Series 234

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW INTERFACE MEMORY

show interface memory

Overview This command displays the shared memory used by either all interfaces, or the

specified interface or interfaces. The output is useful for diagnostic purposes by

Allied Telesis authorized service personnel.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show interface memory

show interface <port-list> memory

Mode User Exec and Privileged Exec

Example To display the shared memory used by all interfaces, use the command:

awplus# show interface memory

To display the shared memory used by port1.0.1 and port1.0.3 to port1.0.4, use the

command:

awplus# show interface port1.0.1,port1.0.3-port1.0.4 memory

Output Figure 7-6: Example output from the show interface memory command

Parameter Description

<port-list> Display information about only the specified port or ports. The port

list can be:

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

• a dynamic (LACP) channel group (e.g. po2)

• a continuous range of ports separated by a hyphen (e.g.

port1.0.1-1.0.4)

• a comma-separated list (e.g. port1.0.1,port1.0.3-1.0.4). Do not mix

port types in the same list.

awplus#show interface memory

Vlan blocking state shared memory usage

---------------------------------------------

Interface shmid Bytes Used nattch Status

port1.0.1 491535 512 1

port1.0.2 393228 512 1

port1.0.3 557073 512 1

...

lo 425997 512 1

po1 1179684 512 1

po2 1212453 512 1

sa3 1245222 512 1

C613-50292-01 Rev A Command Reference for IE210L Series 235

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW INTERFACE MEMORY

Figure 7-7: Example output from show interface <port-list> memory for a list

of interfaces

Commands

show interface brief

show interface status

show interface switchport

awplus#show interface port1.0.1,port1.0.3-port1.0.4 memory

Vlan blocking state shared memory usage

---------------------------------------------

Interface shmid Bytes Used nattch Status

port1.0.1 589842 512 1

port1.0.3 688149 512 1

port1.0.4 327690 512 1

C613-50292-01 Rev A Command Reference for IE210L Series 236

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW MEMORY

show memory

Overview This command displays the memory used by each process that is currently running

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show memory [sort {size|peak|stk}]

Mode User Exec and Privileged Exec

Example To display the memory used by the current running processes, use the command:

awplus# show memory

Output Figure 7-8: Example output from show memory

Parameter Description

sort Changes the sorting order for the list of processes. If you do not

specify this, then the list is sorted by percentage memory

utilization.

size Sort by the amount of memory the process is

currently using.

peak Sort by the amount of memory the process is

currently using.

stk Sort by the stack size of the process.

awplus#show memory sort stk



RAM total: 124384 kB; free: 64236 kB; buffers: 15888 kB



user processes

==============

pid name mem% size(kB) peak(kB) data(kB) stk(kB) virt(kB)

490 openhpid 1.5 1988 7480 1308 528 6704

578 hsl 7.1 8940 29312 5148 312 21052

18986 imish 1.3 1660 13668 3876 172 13668

18931 imish 3.6 4548 13668 3876 172 13668

576 imi 4.6 5772 14532 4428 144 14532

572 nsm 4.9 6128 15092 4480 140 15092

574 hostd 1.6 2048 8116 1876 140 8116

586 cntrd 2.5 3168 12140 3288 140 12136

606 sflowd 2.8 3564 12336 3408 140 12336

610 authd 3.0 3808 12604 3472 140 12604

616 mstpd 3.1 3856 12652 3480 140 12652

...

C613-50292-01 Rev A Command Reference for IE210L Series 237

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW MEMORY

Commands

show memory allocations

show memory history

show memory pools

show memory shared

Table 4: Parameters in the output of the show memory command

Parameter Description

RAM total Total amount of RAM memory free.

free Available memory size.

buffers Memory allocated kernel buffers.

pid Identifier number for the process.

name Short name used to describe the process.

mem% Percentage of memory utilization the process is currently using.

size Amount of memory currently used by the process.

peak Greatest amount of memory ever used by the process.

data Amount of memory used for data.

stk The stack size.

C613-50292-01 Rev A Command Reference for IE210L Series 238

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW MEMORY ALLOCATIONS

show memory allocations

Overview This command displays the memory allocations used by processes.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show memory allocations [<process>]

Mode User Exec and Privileged Exec

Example To display the memory allocations used by all processes on your device, use the

command:

awplus# show memory allocations

Output Figure 7-9: Example output from the show memory allocations command

Parameter Description

<process> Displays the memory allocation used by the specified process.

awplus#show memory allocations

Memory allocations for imi

-----------------------------



Current 15093760 (peak 15093760)



Statically allocated memory:

- binary/exe : 1675264

- libraries : 8916992

- bss/global data : 2985984

- stack : 139264



Dynamically allocated memory (heap):

- total allocated : 1351680

- in use : 1282440

- non-mmapped : 1351680

- maximum total allocated : 1351680

- total free space : 69240

- releasable : 68968

- space in freed fastbins : 16



Context

filename:line allocated freed

+ lib.c:749 484

.

C613-50292-01 Rev A Command Reference for IE210L Series 239

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW MEMORY ALLOCATIONS

Commands

show memory

show memory history

show memory pools

show memory shared

show tech-support

C613-50292-01 Rev A Command Reference for IE210L Series 240

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW MEMORY HISTORY

show memory history

Overview This command prints a graph showing the historical memory usage.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show memory history

Mode User Exec and Privileged Exec

Usage This command’s output displays three graphs of the percentage memory

utilization:

• per second for the last minute, then

• per minute for the last hour, then

• per 30 minutes for the last 30 hours.

Examples To show a graph displaying the historical memory usage, use the command:

awplus# show memory history

Output Figure 7-10: Example output from the show memory history command

Commands

show memory allocations

show memory pools

show memory shared

show tech-support

Per minute memory utilization history



100

90

80

70

60

50

40*************************************************************

30

20

10

|....|....|....|....|....|....|....|....|....|....|....|....

Oldest Newest

Memory utilization% per minute (last 60 minutes)

* = average memory utilisation%.

...

C613-50292-01 Rev A Command Reference for IE210L Series 241

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW MEMORY POOLS

show memory pools

Overview This command shows the memory pools used by processes.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show memory pools [<process>]

Mode User Exec and Privileged Exec

Example To shows the memory pools used by processes, use the command:

awplus# show memory pools

Output Figure 7-11: Example output from the show memory pools command

Commands

show memory allocations

show memory history

show tech-support

Parameter Description

<process> Displays the memory pools used by the specified process.

awplus#show memory pools

Memory pools for imi

----------------------



Current 15290368 (peak 15290368)



Statically allocated memory:

- binary/exe : 1675264

- libraries : 8916992

- bss/global data : 2985984

- stack : 139264



Dynamically allocated memory (heap):

- total allocated : 1548288

- in use : 1479816

- non-mmapped : 1548288

- maximum total allocated : 1548288

- total free space : 68472

- releasable : 68200

- space in freed fastbins : 16

.

C613-50292-01 Rev A Command Reference for IE210L Series 242

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW MEMORY SHARED

show memory shared

Overview This command displays shared memory allocation information. The output is

useful for diagnostic purposes by Allied Telesis authorized service personnel.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show memory shared

Mode User Exec and Privileged Exec

Example To display information about the shared memory allocation used on the device,

use the command:

awplus# show memory shared

Output Figure 7-12: Example output from the show memory shared command

Commands

show memory allocations

show memory history

show memory

awplus#show memory shared

Shared Memory Status

--------------------------

Segment allocated = 39

Pages allocated = 39

Pages resident = 11



Shared Memory Limits

--------------------------

Maximum number of segments = 4096

Maximum segment size (kbytes) = 32768

Maximum total shared memory (pages) = 2097152

Minimum segment size (bytes) = 1

C613-50292-01 Rev A Command Reference for IE210L Series 243

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW PROCESS

show process

Overview This command lists a summary of the current running processes.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show process [sort {cpu|mem}]

Mode User Exec and Privileged Exec

Usage This command displays a snapshot of currently-running processes. If you want to

see CPU or memory utilization history instead, use the commands show cpu

history or show memory history.

Example To display a summary of the current running processes, use the command:

awplus# show process

Output Figure 7-13: Example output from the show process command

Parameter Description

sort Changes the sorting order for the list of processes.

cpu Sorts the list by the percentage of CPU utilization.

mem Sorts the list by the percentage of memory

utilization.

CPU averages:

1 second: 8%, 20 seconds: 5%, 60 seconds: 5%

System load averages:

1 minute: 0.04, 5 minutes: 0.08, 15 minutes: 0.12

Current CPU load:

userspace: 9%, kernel: 9%, interrupts: 0% iowaits: 0%

RAM total: 514920 kB; free: 382600 kB; buffers: 16368 kB



user processes

==============

pid name thrds cpu% mem% pri state sleep% 

962 pss 12 0 6 25 sleep 5 

1 init 1 0 0 25 sleep 0 

797 syslog-ng 1 0 0 16 sleep 88 

...

kernel threads

==============

pid name cpu% pri state sleep% 

71 aio/0 0 20 sleep 0 

3 events/0 0 10 sleep 98 

...

C613-50292-01 Rev A Command Reference for IE210L Series 244

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW PROCESS

Commands

show cpu

show cpu history

Table 5: Parameters in the output from the show process command

Parameter Description

CPU averages Average CPU utilization for the periods stated.

System load

averages The average number of processes waiting for CPU time for the

periods stated.

Current CPU

load Current CPU utilization specified by load types

RAM total Total memory size.

free Available memory.

buffers Memory allocated to kernel buffers.

pid Identifier for the process.

name Short name to describe the process.

thrds Number of threads in the process.

cpu% Percentage of CPU utilization that this process is consuming.

mem% Percentage of memory utilization that this process is consuming.

pri Process priority.

state Process state; one of “run”, “sleep”, “stop”, “zombie”, or “dead”.

sleep% Percentage of time the process is in the sleep state.

C613-50292-01 Rev A Command Reference for IE210L Series 245

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW REBOOT HISTORY

show reboot history

Overview Use this command to display the device’s reboot history.

Syntax show reboot history

Mode User Exec and Privileged Exec

Example To show the reboot history, use the command:

awplus# show reboot history

Output Figure 7-14: Example output from the show reboot history command

Commands

show tech-support

awplus#show reboot history



<date> <time> <type> <description>

-----------------------------------------------

2016-10-10 01:42:04 Expected User Request

2016-10-10 01:35:31 Expected User Request

2016-10-10 01:16:25 Unexpected Rebooting due to critical process (network/nsm) 

failure!

2016-10-10 01:11:04 Unexpected Rebooting due to critical process (network/nsm) 

failure!

2016-10-09 19:56:16 Expected User Request

2016-10-09 19:51:20 Expected User Request

Table 6: Parameters in the output from the show reboot history command

Parameter Description

Unexpected A non-intended reboot.

Expected A planned or user-triggered reboot.

User request User initiated reboot via the CLI.

C613-50292-01 Rev A Command Reference for IE210L Series 246

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW ROUTER-ID

show router-id

Overview Use this command to show the Router ID of the current system.

Syntax show router-id

Mode User Exec and Privileged Exec

Example To display the Router ID of the current system, use the command:

awplus# show router-id

Output Figure 7-15: Example output from the show router-id command

awplus>show router-id

Router ID: 10.55.0.2 (automatic)

C613-50292-01 Rev A Command Reference for IE210L Series 247

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW SYSTEM

show system

Overview This command displays general system information about the device, including

the hardware, memory usage, and software version. It also displays location and

contact details when these have been set.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show system

Mode User Exec and Privileged Exec

Example To display configuration information, use the command:

awplus# show system

Output Figure 7-16: Example output from show system

Commands

show system environment

System Status Fri May 25 13:29:10 2018



Board ID Bay Board Name Rev Serial number

--------------------------------------------------------------------------------

Base 544 Base IE210L-18GP A-0 A10099G180500022

--------------------------------------------------------------------------------

RAM: Total: 511160 kB Free: 401264 kB

Flash: 125.9MB Used: 7.9MB Available: 117.9MB

--------------------------------------------------------------------------------

Environment Status : Normal

Uptime : 0 days 03:46:46

Bootloader version : 3.2.6



Current software : IE210-5.4.8-0.2.rel

Software version : main-20180524-3

Build date : Thu May 24 06:19:19 UTC 2018



Current boot config: flash:/stk_a_1331_1001_40292.cfg (file exists)



System Name

awplus

System Contact

C613-50292-01 Rev A Command Reference for IE210L Series 248

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW SYSTEM ENVIRONMENT

show system environment

Overview This command displays the current environmental status of your device and any

attached PSU, XEM, or other expansion option. The environmental status covers

information about temperatures, fans, and voltage.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show system environment

Mode User Exec and Privileged Exec

Example To display the system’s environmental status, use the command:

awplus# show system environment

Output Figure 7-17: Example output from show system environment

Commands

show system

awplus#show system environment

Environment Monitoring Status



Overall Status: Normal



Resource ID: 1 Name: IE210L-18GP

ID Sensor (Units) Reading Low Limit High Limit Status

1 Fan: Fan 1 (Rpm) 4418 2025 - Ok

2 Fan: Fan 2 (Rpm) 4440 2025 - Ok

3 Voltage: 2.5V (Volts) 2.508 2.339 2.859 Ok

4 Voltage: 1.0V (Volts) 1.014 0.891 1.090 Ok

5 Voltage: 3.3V (Volts) 3.355 3.028 3.545 Ok

6 Voltage: 1.5V (Volts) 1.545 1.335 1.649 Ok

7 Voltage: 12.0V (Volts) 11.874 10.767 13.166 Ok

8 Temp: System (Degrees C) 37 -11 81 Ok

C613-50292-01 Rev A Command Reference for IE210L Series 249

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW SYSTEM INTERRUPTS

show system interrupts

Overview Use this command to display the number of interrupts for each IRQ (Interrupt

Request) used to interrupt input lines on a PIC (Programmable Interrupt Controller)

on your device.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show system interrupts

Mode User Exec and Privileged Exec

Example To display information about the number of interrupts for each IRQ in your device,

use the command:

awplus# show system interrupts

Output Figure 7-18: Example output from the show system interrupts command

Commands

show system environment

awplus#show system interrupts

CPU0 

27:1387835593 GIC Disabled 1 iproc_gtimer

29: 0 GIC Disabled 1 twd

62: 0 GIC Enabled 0 IDM

63: 0 GIC Enabled 0 IDM

64: 0 GIC Enabled 0 IDM

65: 0 GIC Enabled 0 IDM

66: 0 GIC Enabled 0 IDM

67: 0 GIC Enabled 0 IDM

68: 0 GIC Enabled 0 IDM

69: 0 GIC Enabled 0 IDM

70: 0 GIC Enabled 0 IDM

C613-50292-01 Rev A Command Reference for IE210L Series 250

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW SYSTEM MAC

show system mac

Overview This command displays the physical MAC address of the device.

Syntax show system mac

Mode User Exec and Privileged Exec

Example To display the physical MAC address enter the following command:

awplus# show system mac

Output Figure 7-19: Example output from the show system mac command

awplus#show system mac

eccd.6d9d.4eed (system)

C613-50292-01 Rev A Command Reference for IE210L Series 251

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW SYSTEM SERIALNUMBER

show system serialnumber

Overview This command shows the serial number information for the device.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show system serialnumber

Mode User Exec and Privileged Exec

Example To display the serial number information for the device, use the command:

awplus# show system serialnumber

Output Figure 7-20: Example output from the show system serial number command

awplus#show system serialnumber

45AX5300X

C613-50292-01 Rev A Command Reference for IE210L Series 252

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW TECH-SUPPORT

show tech-support

Overview This command generates system and debugging information for the device and

saves it to a file.

This command is useful for collecting a large amount of information so that it can

then be analyzed for troubleshooting purposes. The output of this command can

be provided to technical support staff when reporting a problem.

You can optionally limit the command output to display only information for a

given protocol or feature. The features available depend on your device and will be

a subset of the features listed in the table below.

Syntax show tech-support

{[all|atmf|auth|bgp|card|dhcpsn|epsr|firewall|igmp|ip|ipv6|mld

update]} [outfile <filename>]

Parameter Description

all Display full information

atmf Display ATMF-specific information

auth Display authentication-related information

bgp Display BGP-related information

card Display Chassis Card specific information

dhcpsn Display DHCP Snooping specific information

epsr Display EPSR specific information

firewall Display firewall specific information

igmp Display IGMP specific information

ip Display IP specific information

ipv6 Display IPv6 specific information

mld Display MLD specific information

openflow Display information related to OpenFlow

ospf Display OSPF related information

ospf6 Display OSPF6 specific information

pim Display PIM related information

rip RIP related information

ripng Display RIPNG specific information

stack Display stacking device information

stp Display STP specific information

system Display general system information

C613-50292-01 Rev A Command Reference for IE210L Series 253

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SHOW TECH-SUPPORT

Default Captures all information for the device.

By default the output is saved to the file ‘tech-support.txt.gz’ in the current

directory. If this file already exists in the current directory then a new file is

generated with the time stamp appended to the file name, for example

‘tech-support20161009.txt.gz’, so the previous file is retained.

Usage The command generates a large amount of output, which is saved to a file in

compressed format. The output file name can be specified by outfile option. If the

output file already exists, a new file name is generated with the current time stamp.

If the output filename does not end with “.gz”, then “.gz” is appended to the

filename. Since output files may be too large for Flash on the device we

recommend saving files to external memory or a TFTP server whenever possible to

avoid device lockup. This method is not likely to be appropriate when running the

working set option of AMF across a range of physically separated devices.

Mode Privileged Exec

Examples To produce the output needed by technical support staff, use the command:

awplus# show tech-support

tacacs+ Display TACACS+ information

update Display resource update specific information

|Output modifier

>Output redirection

>> Output redirection (append)

outfile Output file name

<filename>Specifies a name for the output file. If no name is specified, this file

will be saved as: tech-support.txt.gz.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 254

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SPEED (ASYN)

speed (asyn)

Overview This command changes the console speed from the device. Note that a change in

console speed is applied for subsequent console sessions. Exit the current session

to enable the console speed change using the clear line console command.

Syntax speed <console-speed-in-bps>

Default The default console speed baud rate is 9600 bps.

Mode Line Configuration

Usage This command is used to change the console (asyn) port speed. Set the console

speed to match the transmission rate of the device connected to the console (asyn)

port on your device.

Example To set the terminal console (asyn0) port speed from the device to 57600 bps, then

exit the session, use the commands:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# speed 57600

awplus(config-line)# exit

awplus(config)# exit

awplus# exit

Then log in again to enable the change:

awplus login:

Password:

awplus>

Parameter Description

<console-speed-in-bps>Console speed Baud rate in bps (bits per second).

1200 1200 Baud

2400 2400 Baud

9600 9600 Baud

19200 19200 Baud

38400 38400 Baud

57600 57600 Baud

115200 115200 Baud

C613-50292-01 Rev A Command Reference for IE210L Series 255

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SPEED (ASYN)

Commands

clear line console

line

show running-config

show startup-config

speed

C613-50292-01 Rev A Command Reference for IE210L Series 256

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

SYSTEM TERRITORY (DEPRECATED)

system territory (deprecated)

Overview This command has been deprecated in Software Version 5.4.4-0.1 and later. It now

has no effect.

It is no longer useful to specify a system territory, so there is no alternative

command.

C613-50292-01 Rev A Command Reference for IE210L Series 257

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

TERMINAL MONITOR

terminal monitor

Overview Use this command to display debugging output on a terminal.

To display the cursor after a line of debugging output, press the Enter key.

Use the command terminal no monitor or no terminal monitor to stop

displaying debugging output on the terminal. Alternatively, you can use the

timeout option to stop displaying debugging output on the terminal after a set

time.

Syntax terminal monitor [<1-60>]

terminal no monitor

no terminal monitor

Default Disabled

Mode User Exec and Privileged Exec

Examples To display debugging output on a terminal, enter the command:

awplus# terminal monitor

To display debugging on the terminal for 60 seconds, enter the command:

awplus# terminal monitor 60

To stop displaying debugging output on the terminal, use the command:

awplus# no terminal monitor

Commands

All debug commands

Command

changes

Version 5.4.8-0.2: no terminal monitor added as an alias for terminal no monitor

Parameter Description

<1-60>Set a timeout between 1 and 60 seconds for terminal output.

C613-50292-01 Rev A Command Reference for IE210L Series 258

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SYSTEM CONFIGURATION AND MONITORING COMMANDS

UNDEBUG ALL

undebug all

Overview This command applies the functionality of the no debug all command.

C613-50292-01 Rev A Command Reference for IE210L Series 259

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Pluggables and

Cabling Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

and monitor Pluggables and Cabling, including:

• Cable Fault Locator for finding faults in copper cabling

• Optical Digital Diagnostic Monitoring (DDM) to help find fiber issues when

links go down

• Active Fiber Monitoring for detecting changes in optical power received over

fiber cables.

For more information, see the Pluggables and Cabling Feature Overview and

Configuration Guide.

Command List •“clear fiber-monitoring interface” on page 260

•“clear test cable-diagnostics tdr” on page 261

•“debug fiber-monitoring” on page 262

•“fiber-monitoring action” on page 264

•“fiber-monitoring baseline” on page 266

•“fiber-monitoring enable” on page 268

•“fiber-monitoring interval” on page 269

•“fiber-monitoring sensitivity” on page 270

•“show system fiber-monitoring” on page 272

•“show system pluggable” on page 275

•“show system pluggable detail” on page 277

•“show system pluggable diagnostics” on page 280

•“show test cable-diagnostics tdr” on page 282

•“test cable-diagnostics tdr interface” on page 283

C613-50292-01 Rev A Command Reference for IE210L Series 260

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

CLEAR FIBER-MONITORING INTERFACE

clear fiber-monitoring interface

Overview Use this command to clear the Active Fiber Monitoring state of a port. It clears the

alarm, baseline and history and starts monitoring from the beginning. It does not

change the configuration.

Syntax clear fiber-monitoring interface <port>

Default n/a

Mode Privileged Exec

Usage Normally, you do not need to clear the Active Fiber Monitoring state of a port. If the

issue resolves itself and the monitored optical power returns to the baseline, the

alarm clears automatically.

However, you may need to clear the Active Fiber Monitoring state if the optical

power level reduces for a known reason, causing the port to be stuck in the alarm

state. In this situation, the alarm will not clear automatically, because Active Fiber

Monitoring does not update the baseline when the port is in the alarm state, for

security reasons.

Example To clear the Active Fiber Monitoring state for interface port1.0.17, use the

command:

awplus# clear fiber-monitoring interface port1.0.17

Commands

show system fiber-monitoring

Command

changes

Version 5.4.8-0.2: command added

Parameter Description

<port> The name of the port to reset Active Fiber Monitoring on.

C613-50292-01 Rev A Command Reference for IE210L Series 261

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

CLEAR TEST CABLE-DIAGNOSTICS TDR

clear test cable-diagnostics tdr

Overview Use this command to clear the results of the last cable test that was run.

Syntax clear test cable-diagnostics tdr

Mode Privileged Exec

Examples To clear the results of a previous cable-diagnostics test use the following

commands:

awplus# clear test cable-diagnostics tdr

Commands

show test cable-diagnostics tdr

test cable-diagnostics tdr interface

C613-50292-01 Rev A Command Reference for IE210L Series 262

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

DEBUG FIBER-MONITORING

debug fiber-monitoring

Overview Use this command to enable debugging of active fiber monitoring on the specified

ports.

Use the no variant of this command to disable debugging on all ports or the

specified ports.

Syntax debug fiber-monitoring interface <port-list>

no debug fiber-monitoring [interface <port-list>]

Default Debugging of active fiber monitoring is disabled by default.

Mode User Exec/Privileged Exec

Usage While debugging is enabled by this command for a port, all the optical power

readings for the port are sent to the console.

Example To enable debugging messages for active fiber monitoring of port1.0.17 to be sent

to the console, use the commands:

awplus# debug fiber-monitoring interface port1.0.17

awplus# terminal monitor

To disable debugging messages for active fiber monitoring on port1.0.17, use the

command:

awplus# no debug fiber-monitoring interface port1.0.17

To disable all debugging messages for active fiber monitoring, use the command:

awplus# no debug fiber-monitoring

Parameter Description

<port-list> The list of fiber ports to enable or disable debugging for, as a

single port, a comma separated list or a hyphenated range.

C613-50292-01 Rev A Command Reference for IE210L Series 263

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

DEBUG FIBER-MONITORING

Output Figure 8-1: Example output from debug fiber-monitoring

Commands

show system fiber-monitoring

awplus#debug fiber-monitoring interface port1.0.17

awplus#terminal monitor 

% Warning: Console logging enabled

awplus#01:42:50 awplus Pluggable[522]: Fiber-monitor port2.0.1: Channel:1

Reading:1748 Baseline:1708 Threshold:1356

01:42:52 awplus Pluggable[522]: Fiber-monitor port2.0.1: Channel:1 Reading:1717

Baseline:1709 Threshold:1357

01:42:54 awplus Pluggable[522]: Fiber-monitor port2.0.1: Channel:1 Reading:1780

Baseline:1709 Threshold:1357

01:42:56 awplus Pluggable[522]: Fiber-monitor port2.0.1: Channel:1 Reading:1685

Baseline:1710 Threshold:1358

01:42:58 awplus Pluggable[522]: Fiber-monitor port2.0.1: Channel:1 Reading:1701

Baseline:1710 Threshold:1358

01:43:01 awplus Pluggable[522]: Fiber-monitor port2.0.1: Channel:1 Reading:1733

Baseline:1709 Threshold:1357

C613-50292-01 Rev A Command Reference for IE210L Series 264

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

FIBER-MONITORING ACTION

fiber-monitoring action

Overview Use this command to specify an action to be taken if the optical power received on

the port changes from the baseline by the amount specified in the

fiber-monitoring sensitivity command.

Use the no variant of this command to remove the specified action or all actions

from the port.

Syntax fiber-monitoring action [trap] [shutdown] [continuous]

no fiber-monitoring action [trap|shutdown]

Default By default a log message is generated, but no additional action is performed.

Mode Interface Configuration mode for a fiber port.

Usage If fiber monitoring is enabled and this command is not used to set an action, a

change in received power on a fiber port only generates a log message.

Example To set the device to send an SNMP trap when port1.0.17 or port1.0.18 receive

reduced power and when that reduced-power alarm is cleared, use the

commands:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# fiber-monitoring action trap

To set the device to send an SNMP trap when port1.0.17 or port1.0.18 receive

reduced power, and every polling interval after that until the alarm is cleared, use

the commands:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# fiber-monitoring action trap continuous

To set the device to send an SNMP trap and to shut down the port when port1.0.17

or port1.0.18 receive reduced power, use the commands:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# fiber-monitoring action trap shutdown

Parameter Description

trap Send an SNMP notification.

shutdown Shutdown the port.

continuous Make the action or actions happen continuously (every polling

interval) while the sensor is in the alarm state. Otherwise, the

action only happens when the alarm is triggered or cleared.

C613-50292-01 Rev A Command Reference for IE210L Series 265

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

FIBER-MONITORING ACTION

To set the device to stop shutting down the port if port1.0.17 or port1.0.18 receive

reduced power, use the commands:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# no fiber-monitoring action shutdown

If the device is set to send an SNMP trap for those ports, it will continue to do so.

To set the device not to perform any action when it receives reduced power on

port1.0.17 or port1.0.18, except sending a log message, use the commands:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# no fiber-monitoring action

Commands

fiber-monitoring sensitivity

show system fiber-monitoring

Command

changes

Version 5.4.8-0.2: continuous parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 266

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

FIBER-MONITORING BASELINE

fiber-monitoring baseline

Overview Use this command to configure how the baseline value for comparison is

calculated for active fiber monitoring on the port.

Note that alarm generation will not commence until the link has been up for a full

averaging period.

Use the no variant of this command to set the fiber-monitoring baseline to its

default value.

Syntax fiber-monitoring baseline average <12-150> [interval <2-86400>]

fiber-monitoring baseline fixed <1-65535>

no fiber-monitoring baseline

Default The default is a moving average of the last 12 values, taken at the same interval as

the monitoring interval. The monitoring interval is set using the fiber-monitoring

interval command. If the monitoring interval is set to its default of 5 seconds, the

fiber-monitoring baseline default will be the average over the last minute.

Mode Interface Configuration for a fiber port

Usage There are two ways to configure the baseline. The first is to choose a number of

readings to average. This is the default and recommended method. The second is

to set a fixed value in units of x0.0001mW.

If a fixed value is required, the easiest way to choose a value is to enable fiber

monitoring on the port and use the show system fiber-monitoring command to

see what readings you can expect.

Parameter Description

average

<12-150> Set the baseline optical power received to be based on the

moving average of the specified number of most recent

(non-zero) values. Default is to use this setting and 12 values.

interval

<2-86400> Optionally, specify the optical power polling interval for

determining the baseline, in seconds. By default, the baseline

polling interval is the same as the monitoring polling interval,

which is 5 seconds by default.

If specified, this baseline interval should be larger than the

monitoring interval.

Even if you specify a baseline interval, Active Fiber Monitoring will

use the monitoring interval to calculate the initial baseline

average. This means the first x baseline readings will be taken at

the monitoring interval, where x is the number of readings

specified in the average parameter.

See Usage below for more information.

fixed

<1-65535> Set the baseline to a fixed level of received optical power in

0.0001mW. Not recommended—see Usage below.

C613-50292-01 Rev A Command Reference for IE210L Series 267

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

FIBER-MONITORING BASELINE

CAUTION: We do not recommend setting a fixed value because gradual change over

time caused by temperature fluctuations, etc. could lead to unnecessary alarms.

If you use the averaging method, you can optionally specify how often Active Fiber

Monitoring polls the cable to determine the baseline. This allows Active Fiber

Monitoring to update the baseline less often than it polls the device for

monitoring.

In order to prevent the theoretical possibility of slow clamping, you can set the

baseline interval to a large value, so that the baseline average is only updated with

the current reading (for example) once per day or once per hour.

As fiber attenuation can be affected by ambient temperature, take care if changing

the baseline interval in environments with large daily temperature fluctuations.

Example To set the baseline optical power to a moving average of the last 30 monitoring

readings on port1.0.17 and port1.0.18, use the command:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# fiber-monitoring baseline average 30

To calculate the baseline based on 12 values taken 24 hours (86400 seconds) apart,

instead of using the monitoring interval, use the command:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# fiber-monitoring baseline average 12

interval 86400

To set the baseline to its default, averaging the last 12 readings, use the command:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# no fiber-monitoring baseline

Commands

fiber-monitoring interval

fiber-monitoring sensitivity

Command

changes

Version 5.4.8-0.2: interval parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 268

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

FIBER-MONITORING ENABLE

fiber-monitoring enable

Overview Use this command to enable active fiber monitoring on a fiber port. If the port can

support fiber monitoring but does not have the correct SFP or fiber type installed,

the configuration will be saved, and monitoring will commence when a supported

SFP is inserted. Disabling and re-enabling fiber monitoring on a port resets the

baseline calculation.

Use the no variants of this command to disable active fiber monitoring on the

interface, or to remove all the configuration and state for the ports, respectively.

Syntax fiber-monitoring enable

no fiber-monitoring enable

no fiber-monitoring

Default Active fiber monitoring is disabled by default.

Mode Interface Configuration mode for a fiber port

Examples To enable active fiber monitoring on port1.0.17 and port1.0.18, use the

commands:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# fiber-monitoring enable

To disable fiber monitoring on the ports, use the commands:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# no fiber-monitoring enable

To remove all fiber-monitoring configuration and state for the ports, use the

commands:

awplus(config)# interface port1.0.17-port1.0.18

awplus(config-if)# no fiber-monitoring

Commands

fiber-monitoring action

fiber-monitoring sensitivity

show system fiber-monitoring

C613-50292-01 Rev A Command Reference for IE210L Series 269

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

FIBER-MONITORING INTERVAL

fiber-monitoring interval

Overview Use this command to configure the fiber monitoring polling interval in seconds for

the port. The optical power will be read every <interval> seconds and compared

against the calculated threshold values to see if a log message or other action is

required.

Use the no variant of this command to reset the polling interval to the default (5

seconds).

Syntax fiber-monitoring interval <2-60>

no fiber-monitoring interval

Default The interval is set to 5 seconds by default.

Mode Interface configuration mode for a fiber port.

Example To set the fiber monitoring polling interval for port1.0.17 to 30 seconds, use the

commands:

awplus(config)# interface port1.0.17

awplus(config-if)# fiber-monitoring interval 30

To reset the fiber monitoring polling interval back to the default (5s), use the

commands:

awplus(config)# interface port1.0.17

awplus(config-if)# no fiber-monitoring interval

Commands

fiber-monitoring baseline

show system fiber-monitoring

Parameter Description

<2-60> Optical power polling interval in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 270

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

FIBER-MONITORING SENSITIVITY

fiber-monitoring sensitivity

Overview Use this command to configure the sensitivity of the alarm thresholds on the port

for active fiber monitoring.

Use the no variant of this command to reset the sensitivity to the default.

Syntax fiber-monitoring sensitivity (low|medium|high|highest|fixed

<25-65535>)|relative <0.01-10.0>

no fiber-monitoring sensitivity

Default The default is medium sensitivity.

Mode User Exec/Privileged Exec

Usage A log message is generated and configured actions are taken if the received optical

power drops below the baseline value by the sensitivity configured with this

command.

The sensitivity can be configured to one of four pre-defined levels in decibels or to

a fixed absolute delta in units of 0.0001mW. The alarm thresholds can be seen in

the show system fiber-monitoring output. The maximum absolute sensitivity

configurable is 0.0025 mW. Note that 0.0025 mW equates to a reduction of

approximately 1dB at the maximum attenuation of an AT-SPLX10/1.

Example To set the fiber monitoring sensitivity for port1.0.17 to a relative sensitivity of 0.1

dB, use the commands:

awplus(config)# interface port1.0.17

awplus(config-if)# fiber-monitoring sensitivity relative 0.1

To reset the fiber monitoring sensitivity to the default (medium), use the

commands:

awplus(config)# interface port1.0.17

awplus(config-if)# no fiber-monitoring sensitivity

Commands

fiber-monitoring action

fiber-monitoring baseline

Parameter Description

low Low sensitivity (+/-2 dB)

medium Medium sensitivity (1 dB) (default)

high High sensitivity (the greater of 0.5 dB and 0.0025 mW)

highest The highest sensitivity available: 0.0025mW

fixed<25-65535>Fixed sensitivity at the specified level in 0.0001 mW.

relative <0.01-10.0>Relative sensitivity at the specified level in dB.

C613-50292-01 Rev A Command Reference for IE210L Series 271

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

FIBER-MONITORING SENSITIVITY

show system fiber-monitoring

C613-50292-01 Rev A Command Reference for IE210L Series 272

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM FIBER-MONITORING

show system fiber-monitoring

Overview Use this command to display settings and current status for Active Fiber

Monitoring.

Syntax show system fiber-monitoring

Mode User Exec and Privileged Exec

Example To display configuration and status for active fiber monitoring on ports, use the

command:

awplus# show system fiber-monitoring

Output Figure 8-2: Example output from show system fiber-monitoring

awplus#show sys fiber-monitoring 

Fiber Monitoring Status

Reading units 0.0001mW



Interface port1.0.17

Status: enabled

Supported: Supported pluggable

Debugging: disabled

Interval: 2 seconds

Sensitivity: 1.00dB

Baseline type: average of last 35 values greater than 50

Status:

Baseline value: 496

Alarm threshold: 393

Alarm: no

Last 12 Readings: 498 498 498 498 498 498 498 498 498 498 498 498 

Minimum reading: 486

Maximum reading: 498



Interface port1.0.18

Status: enabled

Supported: Supported pluggable

Debugging: disabled

Interval: 2 seconds

Sensitivity: 1.00dB

Baseline type: average of last 30 values greater than 50

Status:

Baseline value: 0

Alarm threshold: 0

Alarm: no

Last 12 Readings: 0 0 0 0 0 0 0 0 0 0 0 0 

Minimum reading: 0

Maximum reading: 0

C613-50292-01 Rev A Command Reference for IE210L Series 273

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM FIBER-MONITORING

Commands

debug fiber-monitoring

fiber-monitoring action

fiber-monitoring baseline

fiber-monitoring enable

Table 8-1: Parameters in the output from show system fiber-monitoring

Parameter Description

Reading units The units for optical power readings in the rest of the

display, e.g. 0.0001mW.

Status Whether active fiber monitoring is enabled or disabled for

this port.

Supported Whether the pluggable inserted in this port supports

active fiber monitoring.

Debugging Whether debugging of active fiber monitoring is enabled

or disabled for this port.

Interval The configured interval between readings of optical

power on this port.

Sensitivity The configured sensitivity threshold for optical power

changes on this port.

Baseline type How the baseline optical power level is calculated: either

the average of the specified number of previous readings

or a specified fixed value in 0.0001mW.

Status Current values for the following parameters.

Baseline value The baseline value, calculated according to the configured

baseline method, in 0.0001mW.

Alarm threshold The current threshold for a change in optical power,

calculated according to the configured sensitivity method,

that will result in action.

Alarm Whether the optical power at the most recent reading

fallen below the threshold.

Last 12 readings The last 12 optical power values measured, in 0.0001mW,

with oldest value first.

Minimum reading The lowest optical power reading since the fiber

pluggable was last inserted, or since active fiber

monitoring was last enabled on the port.

Maximum reading The highest optical power reading since the fiber

pluggable was last inserted, or since active fiber

monitoring was last enabled on the port.

C613-50292-01 Rev A Command Reference for IE210L Series 274

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM FIBER-MONITORING

fiber-monitoring interval

fiber-monitoring sensitivity

C613-50292-01 Rev A Command Reference for IE210L Series 275

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM PLUGGABLE

show system pluggable

Overview This command displays brief pluggable transceiver information showing the

pluggable type, the pluggable serial number, and the pluggable port on the

device. Different types of pluggable transceivers are supported in different models

of device. See your Allied Telesis dealer for more information about the models of

pluggables that your device supports.

Syntax show system pluggable [<port-list>]

Mode User Exec and Privileged Exec

Example To display brief information about all installed pluggable transceivers, use the

command:

awplus# show system pluggable

Output Figure 8-3: Example output from show system pluggable

Parameter Description

<port-list> The ports to display information about. The port list can be:

• a switch port (e.g. port1.0.17)

• a continuous range of ports separated by a hyphen (e.g.

portport1.0.17-port1.0.18)

• a comma-separated list of ports and port ranges (e.g.

port1.0.17,port1.0.18)

awplus#show system pluggable 

System Pluggable Information



Port Vendor Device Serial Number Datecode Type

--------------------------------------------------------------------------------

port1.0.17 ATI AT-SPSX A03240R151300867 15032801 1000BASE-SX

port1.0.18 ATI AT-SPSX A03240R111800076 15032801 1000BASE-SX

--------------------------------------------------------------------------------

Table 9: Parameters in the output from the show system pluggable command

Parameter Description

Port Specifies the port number for the installed pluggable

transceiver.

Vendor Specifies the vendor’s name for the installed pluggable

transceiver.

Device Specifies the device name for the installed pluggable

transceiver.

C613-50292-01 Rev A Command Reference for IE210L Series 276

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM PLUGGABLE

Commands

show system environment

show system pluggable detail

show system pluggable diagnostics

Serial Number Specifies the serial number for the installed pluggable

transceiver.

Datecode Specifies the manufacturing datecode for the installed

pluggable transceiver. Checking the manufacturing

datecode with the vendor may be useful when

determining Laser Diode aging issues. For more

information, see ”Troubleshooting Fiber and Pluggable

Issues” in the "Pluggables and Cabling" Feature Overview

and Configuration Guide.

Type Specifies the device type for the installed pluggable

transceiver.

Table 9: Parameters in the output from the show system pluggable command

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 277

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM PLUGGABLE DETAIL

show system pluggable detail

Overview This command displays detailed pluggable transceiver information showing the

pluggable type, the pluggable serial number, and the pluggable port on the

device. Different types of pluggable transceivers are supported in different models

of device. See your Allied Telesis dealer for more information about the models of

pluggables that your device supports.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show system pluggable [<port-list>] detail

Mode User Exec and Privileged Exec

Usage In addition to the information about pluggable transceivers displayed using the

show system pluggable command (port, manufacturer, serial number,

manufacturing datecode, and type information), the show system pluggable

detail command displays the following information:

•SFP Laser Wavelength: Specifies the laser wavelength of the installed

pluggable transceiver

•Single mode Fiber: Specifies the link length supported by the pluggable

transceiver using single mode fiber

•OM1 (62.5μ m) Fiber: Specifies the link length, in meters (m) or kilometers

(km) supported by the pluggable transceiver using 62.5 micron multi-mode

fiber.

•OM2 (50μ m) Fiber: Specifies the link length (in meters or kilometers)

supported by the pluggable transceiver using 50 micron multi-mode fiber.

•Diagnostic Calibration: Specifies whether the pluggable transceiver

supports DDM or DOM Internal or External Calibration.

–Internal is displayed if the pluggable transceiver supports DDM or

DOM Internal Calibration.

–External is displayed if the pluggable transceiver supports DDM or

DOM External Calibration.

– a dash (-) is displayed if neither Internal Calibration or External

Calibration is supported.

Parameter Description

<port-list> The ports to display information about. The port list can be:

• a switch port (e.g. port1.0.17)

• a continuous range of ports separated by a hyphen (e.g.

portport1.0.17-port1.0.18)

• a comma-separated list of ports and port ranges (e.g.

port1.0.17,port1.0.18)

C613-50292-01 Rev A Command Reference for IE210L Series 278

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM PLUGGABLE DETAIL

•Power Monitoring: Displays the received power measurement type, which

can be either OMA(Optical Module Amplitude) or Avg(Average Power)

measured in μW.

NOTE: For parameters that are not supported or not specified, a hyphen is displayed

instead.

Example To display detailed information about the pluggable transceivers installed in a

particular port on the device, use a command like:

awplus# show system pluggable port1.0.17 detail

To display detailed information about all the pluggable transceivers installed on

the device, use the command:

awplus# show system pluggable detail

Output Figure 8-4: Example output from show system pluggable detail for a port

awplus#show system pluggable port1.0.17 detail

System Pluggable Information Detail

port1.0.17

==========

Vendor Name: ATI

Device Name: AT-SPSX

Device Revision: A

Device Type: 1000BASE-SX

Serial Number: A02420N0607J0023

Manufacturing Datecode: 060704

SFP Laser Wavelength: 850nm

Link Length Supported

Single Mode Fiber : -

OM1 (62.5um) Fiber: 150m

OM2 (50um) Fiber : 300m

OM3 (50um) Fiber : -

Diagnostic Calibration: External

Power Monitoring: Average

Table 8-1: Parameters in the output from show system pluggable detail

Parameter Description

Port Specifies the port the pluggable transceiver is installed in.

Vendor Name Specifies the vendor’s name for the installed pluggable

transceiver.

Device Name Specifies the device name for the installed pluggable

transceiver.

Device Revision Specifies the hardware revision code for the pluggable

transceiver. This may be useful for troubleshooting because

different devices may support different pluggable

transceiver revisions.

C613-50292-01 Rev A Command Reference for IE210L Series 279

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM PLUGGABLE DETAIL

Commands

show system environment

show system pluggable

show system pluggable diagnostics

Device Type Specifies the device type for the installed pluggable

transceiver.

Serial Number Specifies the serial number for the installed pluggable

transceiver.

Manufacturing

Datecode Specifies the manufacturing datecode for the installed

pluggable transceiver. Checking the manufacturing

datecode with the vendor may be useful when

determining Laser Diode aging issues. For more

information, see “Troubleshooting Fiber and Pluggable

Issues” in the "Pluggables and Cabling" Feature Overview

and Configuration Guide.

SFP Laser

Wavelength Specifies the laser wavelength of the installed pluggable

transceiver.

Single Mode Fiber Specifies the link length supported by the pluggable

transceiver using single mode fiber.

OM1 (62.5um)

Fiber Specifies the link length (in μm - micron) supported by the

pluggable transceiver using 62.5 micron multi-mode fiber.

OM2 (50um) Fiber Specifies the link length (in μm - micron) supported by the

pluggable transceiver using 50 micron multi-mode fiber.

Diagnostic

Calibration Specifies whether the pluggable transceiver supports DDM

or DOM Internal or External Calibration:

Internal is displayed if the pluggable transceiver supports

DDM or DOM Internal Calibration.

External is displayed if the pluggable transceiver supports

DDM or DOM External Calibration.

- is displayed if neither Internal Calibration or External

Calibration is supported.

Power Monitoring Displays the received power measurement type, which can

be either OMA (Optical Module Amplitude) or Avg

(Average Power) measured in μW.

Table 8-1: Parameters in the output from show system pluggable detail (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 280

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM PLUGGABLE DIAGNOSTICS

show system pluggable diagnostics

Overview This command displays diagnostic information about pluggable transceivers that

support Digital Diagnostic Monitoring (DDM).

Different types of pluggable transceivers are supported in different models of

device. See your device’s Datasheet for more information about the models of

pluggables that your device supports.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show system pluggable [<port-list>] diagnostics

Mode User Exec and Privileged Exec

Usage Diagnostic monitoring features allow you to monitor real-time parameters of the

pluggable transceiver, such as optical output power, optical input power,

temperature, laser bias current, and transceiver supply voltage. Additionally, RX

LOS (Loss of Signal) is shown when the received optical level is below a preset

threshold. Monitor these parameters to check on the health of all transceivers,

selected transceivers or a specific transceiver installed in a device.

Examples To display detailed information about all pluggable transceivers installed on a

standalone device, use the command:

awplus# show system pluggable diagnostics

Parameter Description

<port-list> The ports to display information about. The port list can be:

• a switch port (e.g. port1.0.17)

• a continuous range of ports separated by a hyphen (e.g.

portport1.0.17-port1.0.18)

• a comma-separated list of ports and port ranges (e.g.

port1.0.17,port1.0.18)

C613-50292-01 Rev A Command Reference for IE210L Series 281

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW SYSTEM PLUGGABLE DIAGNOSTICS

Output Figure 8-5: Example output from the show system pluggable diagnostics

command on a device

Commands

show system environment

show system pluggable

show system pluggable detail

awplus#show system pluggable diagnostics



System Pluggable Information Diagnostics



port1.0.17 Status Alarms Warnings

Reading Alarm Max Min Warning Max Min 

Temp: (Degrees C) 44.871 - 100.00 -40.00 - 95.000 -30.00

Vcc: (Volts) 3.3043 - 3.4650 3.1350 - 3.4000 3.2000

Tx Bias: (mA) 3.468 - 13.264 0.000 - 10.264 0.264

Tx Power: (mW) 0.2376 - 0.7943 0.0562 - 0.6310 0.0708

Rx Power: (mW) 0.2104 - 1.0000 0.0126 - 0.7943 0.0200

Rx LOS: Rx Up



...

Table 9: Parameters in the output from the show system pluggables

diagnostics command

Parameter Description

Temp (Degrees C) Shows the temperature inside the transceiver.

Vcc (Volts) Shows voltage supplied to the transceiver.

Tx Bias (mA) Shows current to the Laser Diode in the transceiver.

Tx Power (mW) Shows the amount of light transmitted from the transceiver.

Rx Power (mW) Shows the amount of light received in the transceiver.

Rx LOS Rx Loss of Signal. This indicates whether:

• light is being received (Rx Up) and therefore the link is up,

• light is not being received (Rx Down) and therefore the

link is down

C613-50292-01 Rev A Command Reference for IE210L Series 282

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

SHOW TEST CABLE-DIAGNOSTICS TDR

show test cable-diagnostics tdr

Overview Use this command to display the results of the last cable-diagnostics test that was

run using the TDR (Time Domain Reflectometer) on a fixed copper cable port.

The displayed status of the cable can be either:

•OK

•Open

• Short (within-pair)

• Short (across-pair)

• Error

Syntax show test cable-diagnostics tdr

Mode Privileged Exec

Examples To show the results of a cable-diagnostics test use the following command:

awplus# show test cable-diagnostics tdr

Output Figure 8-6: Example output from the show test cable-diagnostics tdr

command

Commands

clear test cable-diagnostics tdr

test cable-diagnostics tdr interface

Port Pair Length Status 

------------------------------------------------- 

1.0.1 A - OK 

B - OK 

C - OK 

D - OK

C613-50292-01 Rev A Command Reference for IE210L Series 283

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PLUGGABLES AND CABLING COMMANDS

TEST CABLE-DIAGNOSTICS TDR INTERFACE

test cable-diagnostics tdr interface

Overview Use this command to apply the Cable Fault Locator’s cable-diagnostics tests to

twisted pair data cables for a selected port. The tests will detect either correct,

short circuit, or open, circuit terminations. For more information on running the

CFL, see the Pluggables and Cabling Feature Overview and Configuration Guide.

The test can take several seconds to complete. See the related show command to

display the test results.

A new test can only be started if no other test is in progress. CFL cannot run on a

port that is currently supplying power via PoE.

The displayed status of the cable can be either, OK, Short (within-pair), or Open.

The “Open” or “Short” status is accompanied with the distance from the source

port to the incorrect termination.

Syntax test cable-diagnostics tdr interface <interface>

Mode Privileged Exec

Example To run a cable test on the cable inserted into port1.0.1 use the following command:

awplus# test cable-diagnostics tdr interface port1.0.1

You will receive the following message:

Link will go down while test is in progress. Continue? (y/n): y

Select y to continue.

awplus# y

You will then receive the following message:

Test started. This will take several seconds to complete. Use

"show test cable-diagnostics tdr" to print results.

Commands

clear test cable-diagnostics tdr

show test cable-diagnostics tdr

Parameter Description

cable-diagnostics The cable diagnostic tests.

tdr Time Domain Reflectometry.

interface Selects the interface to test.

<interface> Interface number of the port to be tested, e.g. port1.0.2.

C613-50292-01 Rev A Command Reference for IE210L Series 284

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Connectivity Fault

Management

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

Connectivity Fault Management.

For more information, see the Connectivity Fault Management (CFM) Feature

Overview and Configuration Guide.

Command List •“cc interval” on page 286

•“cc multicast” on page 288

•“cc unicast” on page 289

•“clear (MEP Attribute)” on page 290

•“clear ethernet cfm errorlog” on page 291

•“clear mep counter” on page 292

•“ethernet cfm domain-name” on page 293

•“ethernet cfm mep” on page 296

•“mep (FNG attributes)” on page 298

•“mep active” on page 300

•“mep ccm-ltm-priority” on page 302

•“mep crosscheck” on page 304

•“service ma-name” on page 306

•“show ethernet cfm details” on page 309

•“show ethernet cfm domain” on page 314

•“show ethernet cfm errorlog” on page 317

•“show ethernet cfm maintenance-points local mep” on page 319

•“show ethernet cfm maintenance-points remote mep” on page 325

C613-50292-01 Rev A Command Reference for IE210L Series 285

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

•“show ethernet cfm service” on page 328

•“show mep-alarm status” on page 331

C613-50292-01 Rev A Command Reference for IE210L Series 286

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

CC INTERVAL

cc interval

Overview Use this command to set the CCM Interval.

Syntax cc ma-name <ma-name> interval <interval>

Default The default interval is 4 (1 second).

Mode Ethernet CFM Configuration

Usage Continuity Checks is another term for connectivity fault detection. This makes use

of Continuity Check Messages (CCMs) that are periodically sent by an MEP

(multicast or unicast) and received by other MEP(s). CCMs can be used to detect

connectivity faults across a link (using Link Level MEPs) or across a segment of a

VLAN using VLAN aware MEPs, both of which are used within an MD/MA. CCMs are

sent periodically at a given rate (or frame interval) that is agreed upon by all the

MEPs in the MA. The faster the rate, the more quickly faults can be detected.

If an MEP does not receive a CCM within 3.5 times the expected interval from a peer

MEP(s), that MEP declares a connectivity fault. This is known as a “defect”. Upon

detecting a defect, the detecting MEP will also set the Remote Defect Indicator

(RDI) bit for its outgoing CCM messages to its peer MEP(s) so as to notify the peer

MEPs that a defect has been detected. If the defect persists long enough (generally

2.5 seconds), then an “alarm” is declared. If an alarm is declared, then the defect has

to abate long enough (generally 10 seconds) for the alarm to clear.

Example To set the CCM interval of a Maintenance Association named “MA-INST2-1” to the

value of “4”, use the commands:

awplus(config)# ethernet cfm domain-name MD-INST2

awplus(config-ether-cfm)# cc ma-name MA-INST2-1 interval 4

Commands

ethernet cfm domain-name

Parameter Description

ma-name Specify the Maintenance Association for which the Interval is

used.

<ma-name> Specify the Maintenance Association's CLI instance name.

interval Specify the CCM Interval.

<interval> Specify the CCM Interval (CCI), using one of the following: 

1 - CCI of 3 milliseconds (currently not supported) 

2 - CCI of 10 milliseconds (currently not supported) 

3 - CCI of 100 milliseconds 

4 - CCI of 1 second 

5 - CCI of 10 seconds 

6 - CCI of 1 minute 

7 - CCI of 10 minutes.

C613-50292-01 Rev A Command Reference for IE210L Series 287

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

CC INTERVAL

service ma-name

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 288

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

CC MULTICAST

cc multicast

Overview Use this command to enable a Local MEP to send CCMs using multicast, or to

disable sending CCMs altogether.

Syntax cc multicast state {enable|disable}

Default Multicast is disabled by default.

Mode Interface Ethernet CFM MEP Configuration

Usage Continuity Checks is another term for connectivity fault detection. This makes use

of Continuity Check Messages (CCMs) that are periodically sent by an MEP

(multicast or unicast) and received by other MEP(s). CCMs can be used to detect

connectivity faults across a link (using Link Level MEPs) or across a segment of a

VLAN using VLAN aware MEPs, both of which are used within an MD/MA. CCMs are

sent using multicast or unicast (but not both).

In order to enable a Local MEP to send, the Local MEP's “active” administrative state

must be set to true, using the command mep active.

Example To configure a Local MEP to send CCMs using multicast, use the commands:

awplus(config)# interface port1.0.2

awplus(config-if)# ethernet cfm mep down mpid 12 domain-name

MD-INST2 ma-name MA-INST2-1

awplus(config-if-eth-cfm-mep)# cc multicast state enable

Commands

ethernet cfm domain-name

ethernet cfm mep

service ma-name

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

Parameter Description

state Specify to either enable or disable CFM multicast CCMs.

enable Start sending periodic multicast frames.

disable Stop sending multicast frames.

C613-50292-01 Rev A Command Reference for IE210L Series 289

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

CC UNICAST

cc unicast

Overview Use this command to enable a Local MEP to send CCMs using unicast, or to disable

sending CCMs altogether.

Syntax cc unicast rmpid <rmep-id> state {enable|disable}

Mode Interface Ethernet CFM MEP Configuration

Usage Continuity Checks is another term for connectivity fault detection. This makes use

of Continuity Check Messages (CCMs) that are periodically sent by an MEP

(multicast or unicast) and received by other MEP(s). CCMs can be used to detect

connectivity faults across a link (using Link Level MEPs) or across a segment of a

VLAN using VLAN aware MEPs, both of which are used within an MD/MA. CCMs are

sent using multicast or unicast (but not both).

In order to enable a Local MEP to send, the Local MEP's “active” administrative state

must be set to true, using the command mep active.

In order to send unicast CCMs, the Remote MEP has to be configured along with its

MAC address.

Example To configure a Local MEP to send CCMs using unicast, use the commands:

awplus(config)# interface port1.0.2

awplus(config-if)# ethernet cfm mep down mpid 12 domain-name

MD-INST2 ma-name MA-INST2-1

awplus(config-if-eth-cfm-mep)# cc unicast rmpid 21 state enable

Commands

ethernet cfm domain-name

ethernet cfm mep

mep crosscheck

service ma-name

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

Parameter Description

rmpid The remote MEP that the Local MEP is to unicast to.

<rmep-id> The remote MEP ID in the range 1-8191.

C613-50292-01 Rev A Command Reference for IE210L Series 290

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

CLEAR (MEP ATTRIBUTE)

clear (MEP Attribute)

Overview Use this command to clear a Local MEP attribute.

Syntax clear {ccm-ltm-priority|lowest-priority-defect|fng-alarm-time

|reset-fng-time|active|all}

Mode Interface Ethernet CFM MEP Configuration

Example To set the active state of the Local MEP to False, use the commands:

awplus(config)# interface port1.0.2

awplus(config-if)# ethernet cfm mep down mpid 12 domain-name

MD-INST2 ma-name MA-INST2-1

awplus(config-if-eth-cfm-mep)# clear active

Commands

ethernet cfm domain-name

ethernet cfm mep

mep (FNG attributes)

service ma-name

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

Parameter Description

ccm-ltm-priority Set the queuing and p-bit priority for CCM messages to their

default value of 7.

lowest-priority-

defect Set the Fault Notification Generation (FNG) lowest alarm

priority defect to the default value of 2.

fng-alarm-time Set the Fault Notification Generation (FNG) time for a defect to

be present before an alarm is raised to the default value of 2.5

seconds.

reset-fng-time Set the Fault Notification Generation (FNG) time for a defect to

abate before an alarm is cleared to the default value of 10

seconds.

active Set the Local MEP's Active state to the default value of False,

which sets the Local MEP's Administrative State to Down.

all Set all of the above attributes to their default values.

C613-50292-01 Rev A Command Reference for IE210L Series 291

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

CLEAR ETHERNET CFM ERRORLOG

clear ethernet cfm errorlog

Overview Use this command to clear the Event List for all Maintenance Associations (MAs)

associated with the specified Maintenance Domain (MD).

Syntax clear ethernet cfm errorlog domain <domain-name>

Mode Privileged Exec

Usage When a new error is detected for an MA that is associated with an MD, and the error

is due to an error from a received or missing CCM from a Remote MEP, an event is

logged to the CFM Errors Event List.

Example To clear the event list for all MA’s associated with an MD named “MD-INST2”, use

the command:

awplus# clear ethernet cfm errorlog domain MD-INST2

Commands

show ethernet cfm errorlog

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

Parameter Description

<domain-name> Specify the domain name

C613-50292-01 Rev A Command Reference for IE210L Series 292

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

CLEAR MEP COUNTER

clear mep counter

Overview Use this command to clear statistics counters for all Local MEPs within a given

Maintenance Association (MA) and its associated Maintenance Domain (MD), or to

optionally clear counters for one specific Local MEP.

Syntax clear mep counter domain <domain-name> service <ma-name> 

[mep <mep-id>]

Mode User Exec/Privileged Exec

Example To clear the statistic counter for an MEP with the MEP ID “12”, use the command:

awplus# clear mep counter domain MD-INST1 service MA-INST1-1 mep

Commands

show ethernet cfm maintenance-points local mep

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

Parameter Description

domain Specify the Maintenance Domain that Local MEP(s) are to have

their counters cleared for. Both domain and service must be

specified.

<domain-name> Specify the Maintenance Domain's CLI instance name.

service Specify the Maintenance Association that the Local MEP(s) are to

have their counters cleared for. Both domain and service must be

specified.

<ma-name> Specify the CLI name that identifies the service (Maintenance

Association (MA)) instance.

mep Specify one specific Local MEP.

<mep-id> Specify the Local MEP instance by MEP-id.

C613-50292-01 Rev A Command Reference for IE210L Series 293

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

ETHERNET CFM DOMAIN-NAME

ethernet cfm domain-name

Overview Use this command to create and configure a CFM Maintenance Domain, or to enter

Ethernet CFM Configuration mode for an existing Maintenance Domain instance.

Use the no variant of this command to destroy the Maintenance Domain's instance

that was previously created.

Syntax ethernet cfm domain-name <domain-name>

ethernet cfm domain-name <domain-name> md-type character-string

md-type-name <md-type-name> level <level> [mip-creation none]

ethernet cfm domain-name <domain-name> md-type dns-based

md-type-name <md-type-name> level <level> [mip-creation none]

ethernet cfm domain-name <domain-name> md-type mac md-type-name

<md-type-name> level <level> [mip-creation none]

ethernet cfm domain-name <domain-name> md-type no-name level

<level> [mip-creation none]

no ethernet cfm domain-name <domain-name>

Parameter Description

<domain-name> The name that identifies this Maintenance Domain instance. If

creating this instance, specify the remaining parameters. If

re-entering configuration mode for this instance, use this

parameter to identify this instance, and do not enter the

remaining parameters.

md-type Specify the name type. The MD name part of the MAID field

may or may not appear in the CCM message. There are

different formats and conventions for the name depending on

type.

character-string Specify the md-type as Character String-based MD name

format. The <md-type-name> is a character string of 1 to 43

characters. This character string plus the Short MA name that

is configured for an MA make up the MAID field in a CCM

message.

md-type-name The Maintenance Domain type.

<md-type-name> The value of the MD type name, which depends on the

md-type selected.

dns-based Specify the md-type as DNS-based MD name format. The

<md-type-name> is a Domain Name like string of 1 to 43

characters. This is a globally unique text string derived from a

DNS name. This DNS based string plus the Short MA name

that is configured for an MA make up the MAID field in a CCM

message.

C613-50292-01 Rev A Command Reference for IE210L Series 294

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

ETHERNET CFM DOMAIN-NAME

Mode Global Configuration

Usage A Maintenance Domain is a Connectivity Fault Management (CFM) term that

represents the administrative area of a network from which an operator can

manage VLANs that traverse their area. An MD can also be scoped to a simple

Ethernet link. To differentiate different administrative areas, an MD is made up of a

name and a level. As part of CFM, a Connectivity Check Message (CCM) is used to

detect Ethernet connectivity faults amongst nodes that participate in CFM. CCM

messages carry the MD name within the MAID field as well as carries the level of

the MD.

This command is used to configure the MD name, which can be chosen from a

variety of name format types, as well as the level.

Example To create a Maintenance Domain instance named “MD-INST2” with a character

string-based name of “MD-12L3” and a level of 3, use the command:

awplus(config)# ethernet cfm domain-name MD-INST2 md-type

character-string md-type-name MD-12L3 level 3

To enter Ethernet CFM Configuration mode for an existing MD instance named

“MD-INST2”, use the command:

awplus(config)# ethernet cfm domain-name MD-INST2

awplus(config-ether-cfm)#

To destroy a Maintenance Domain instance named “MD-INST2”, use the

command:

awplus(config)# no ethernet cfm domain-name MD-INST2

Commands

cc interval

cc multicast

cc unicast

mac Specify the md-type as MAC-based MD name format. The

<md-type-name> consists of a MAC address + 2-octet

(unsigned) integer in the form of HHHH.HHHH.HHHH:<2-octet

integer>. This MAC based string plus the Short MA name that

is configured for an MA make up the MAID field in a CCM

message.

no-name Specify the md-type whereby no MD name is to appear in the

CCM message.

level Specify the Level the Domain operates in.

<level> 0 to 7.

mip-creation Optional parameter that specifies the MIP creation permission

value.

none Specifies that no MIPs are to be created (default and only

choice).

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 295

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

ETHERNET CFM DOMAIN-NAME

cfm-sf-notify

clear (MEP Attribute)

ethernet cfm mep

mep (FNG attributes)

mep crosscheck

service ma-name

show ethernet cfm domain

show ethernet cfm errorlog

show ethernet cfm maintenance-points remote mep

show ethernet cfm service

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 296

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

ETHERNET CFM MEP

ethernet cfm mep

Overview Use this command to create a Local MEP instance, or to enter Interface Ethernet

CFM MEP Configuration mode for an existing Local MEP's instance, so you can

configure it.

Use the no variant of this command to destroy the Local MEP instance.

Syntax ethernet cfm mep down mpid <mep-id> domain-name <domain-name>

ma-name <ma-name>

no ethernet cfm mep down mpid <mep-id> domain-name <domain-name>

ma-name <ma-name>

Mode Interface Configuration

Usage Maintenance Points are entities that exist within an MD/MA and can perform the

CFM/802.1ag functions such as Continuity Checks for fault management. The main

type of MP is a Maintenance End Point (MEP). This type of maintenance point sits

at the edges of a Maintenance Domain but is a member of only one MA within the

Maintenance Domain. Thus an MEP is used at the end of a VLAN segment, or it is

used at the end of a link. MPs live on bridge ports and station ports. On a bridge

port, there are two types.

• An Up Maintenance Entity is considered an inward MP. It communicates

across the inside of the bridge to the other side, and this allows it to reach the

outside world. It lives on a bridge port for a given VLAN, but it does not use

this port to send or receive to get to the outside world. Instead, it sends and

receives through the inside of the bridge and communicates to the outside

world through the other VLAN port members. An Up MP cannot be used for

Link Level CFM.

• A Down Maintenance Entity is considered an outward MP. It sends and

receives only through its bridge port outwardly to the outside world, and

does not communicate inside the bridge. A Down MP is not subject to

blocking due to Spanning Tree Protocol (STP) or any other protocol trying to

Parameter Description

down Specify the Local MEP as a Down MEP.

mpid Specify the Local MEP ID.

<mep-id> 1-8191. This must be unique ID for all MEPs in the MA (both local

and remote).

domain-name Specify the Maintenance Domain that the Local MEP is to be

associated with.

<domain-name> Specify the Maintenance Domain's CLI instance name.

ma-name Specify the Maintenance Association that the Local MEP is to be

associated with.

<ma-name> Specify the Maintenance Association's CLI instance name.

C613-50292-01 Rev A Command Reference for IE210L Series 297

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

ETHERNET CFM MEP

prevent loops in the network. As such, it is important that Down MPs be used

in an MD/MA that is not subject to topology loops. A Down MP can be VLAN

aware or link-local.

An MEP can be either Up or Down for a given MD/MA, but within a bridge for the

same MD/MA, there can only be one Up or Down MEP (not both). An Up MEP must

be VLAN aware. A Down MEP may be VLAN aware. Otherwise, a Down MEP is

allowed to be link local (VLAN unaware), and its scope is that of the entire link.

AlliedWare Plus supports Down Maintenance Entities only.

Example To create a local MEP instance context with a domain name of “MD-INST2” and an

MA name of “MA-INST2-1”, use the commands:

awplus(config)# interface port1.0.2

awplus(config-if)# ethernet cfm mep down mpid 12 domain-name

MD-INST2 ma-name MA-INST2-1

To re-enter a local MEP instance context with the domain name “MD-INST2” and

the MA name “MA-INST2-1”, use the commands:

awplus(config-if)# ethernet cfm mep down mpid 12 domain-name

MD-INST2 ma-name MA-INST2-1

awplus(config-if-eth-cfm-mep)#

To destroy a local MEP instance context with the domain name “MD-INST2” and

the MA name “MA-INST2-1”, use the commands:

awplus(config-if)# no ethernet cfm mep down mpid 12 domain-name

MD-INST2 ma-name MA-INST2-1

Commands

cc multicast

cc unicast

cfm-sf-notify

clear (MEP Attribute)

ethernet cfm domain-name

mep (FNG attributes)

mep crosscheck

service ma-name

show ethernet cfm errorlog

show ethernet cfm maintenance-points remote mep

show ethernet cfm service

show mep-alarm status

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 298

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

MEP (FNG ATTRIBUTES)

mep (FNG attributes)

Overview Use this command to configure the Fault Notification Generation (FNG) attributes

of a Local MEP.

Syntax mep {lowest-priority-defect <defect-priority>|

fng-alarm-time <soak-time>|reset-fng-time <abate-time>}

Mode Interface Ethernet CFM MEP Configuration

Usage Maintenance Points are entities that exist within an MD/MA and can perform the

CFM/802.1ag functions such as Continuity Checks for fault management. The main

type of MP is a Maintenance End Point (MEP). This type of maintenance point sits

at the edges of a Maintenance Domain but is a member of only one MA within the

Maintenance Domain. Thus an MEP is used at the end of a VLAN segment, or it is

used at the end of a link.

A Local MEP can detect defects in connectivity of a VLAN or a local link using

Continuity Check Messages (CCM) by sending and receiving CCMs with Remote

MEP peers. Any defects detected locally can also be conveyed to Remote MEP

peers by sending a Remote Defect Indicator (RDI) to the peers within a Continuity

Check Message (CCM). If defects persist long enough, an alarm can be generated.

Use this command to configure the following attributes of a Local MEP:

• Fault Notification Generation Lowest Alarm Priority Defect — the lowest

defect priority that can cause an alarm to be raised. This configuration

parameter specifies the lowest defect that has to occur before an alarm can

be generated. Any priority less than this will not result in an alarm

notification. Note that if a local defect is detected and its priority is not high

enough to generate an alarm, then the Local MEP will not send an RDI to its

Remote MEP peers, which is used to notify the peers of a connectivity fault.

We recommend you keep the lowest alarm priority defect set to 2.

• Fault Notification Generation Alarm timers — the timers that determine

whether a defect has been present long enough to result in an alarm being

generated, or whether a defect has been abated for long enough to clear an

alarm.

Parameter Description

lowest-priority-defect

<defect-priority> The lowest level defect allowed to generate alarms.

An integer in the range 1 to 6. T he default is 2.

fng-alarm-time

<soak-time> The time that the defects must be present before an

alarm is generated. An integer in the range of 250 to

1000 in increments of 10 ms. The default is 250 (2.5

seconds).

reset-fng-time

<abate-time> The time that the defect must be absent before the

alarm is cleared. An integer in the range of 250 to

1000 in increments of 10 ms. The default is 1000 (10

seconds).

C613-50292-01 Rev A Command Reference for IE210L Series 299

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

MEP (FNG ATTRIBUTES)

Example To clear an alarm after the defect has been abated for 6 seconds, use the

commands:

awplus(config)# interface port1.0.2

awplus(config-if)# ethernet cfm mep down mpid 12 domain-name

MD-INST2 ma-name MA-INST2-1

awplus(config-if-eth-cfm-mep)# mep reset-fng-time 600

Commands

clear (MEP Attribute)

ethernet cfm domain-name

ethernet cfm mep

service ma-name

show mep-alarm status

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 300

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

MEP ACTIVE

mep active

Overview Use this command to specify the administrative state of the Local MEP.

Syntax mep active {true|false}

Default false

Mode Interface Ethernet CFM MEP Configuration

Usage Maintenance Points are entities that exist within an MD/MA and can perform the

CFM/802.1ag functions such as Continuity Checks for fault management. The main

type of MP is a Maintenance End Point (MEP). This type of maintenance point sits

at the edges of a Maintenance Domain but is a member of only one MA within the

Maintenance Domain. Thus an MEP is used at the end of a VLAN segment, or it is

used at the end of a link.

A Local MEP can detect defects in connectivity of a VLAN or a local link using

Continuity Check Messages (CCM) by sending and receiving CCMs with Remote

MEP peers. Any defects detected locally can also be conveyed to Remote MEP

peers by sending a Remote Defect Indicator (RDI) to the peers within a Continuity

Check Message (CCM). If defects persist long enough, an alarm can be generated.

Setting the Local MEP's Administrative State to true enables it to perform various

functions such as processing CCM messages. Setting the state to false deactivates

the Local MEP.

Example To set the administrative state of the local MEP to “active”, use the commands:

awplus(config)# interface port1.0.2

awplus(config-if)# ethernet cfm mep down mpid 12 domain-name

MD-INST2 ma-name MA-INST2-1

awplus(config-if-eth-cfm-mep)# mep active true

Commands

clear (MEP Attribute)

ethernet cfm domain-name

ethernet cfm mep

service ma-name

show mep-alarm status

Parameter Description

true Put the Local MEP into a state of active, which enables it to

perform various functions such as processing CCM messages.

false Specify the state of the Local MEP to cease functioning.

C613-50292-01 Rev A Command Reference for IE210L Series 301

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

MEP ACTIVE

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 302

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

MEP CCM-LTM-PRIORITY

mep ccm-ltm-priority

Overview Use this command to specify the queuing and p-bit priority for CCM messages.

Syntax mep ccm-ltm-priority <0-7>

Default 7

Mode Interface Ethernet CFM MEP Configuration

Usage Maintenance Points are entities that exist within an MD/MA and can perform the

CFM/802.1ag functions such as Continuity Checks for fault management. The main

type of MP is a Maintenance End Point (MEP). This type of maintenance point sits

at the edges of a Maintenance Domain but is a member of only one MA within the

Maintenance Domain. Thus an MEP is used at the end of a VLAN segment, or it is

used at the end of a link.

A Local MEP can detect defects in connectivity of a VLAN or a local link using

Continuity Check Messages (CCM) by sending and receiving CCMs with Remote

MEP peers. CCMs are high priority messages by default, but the priority is

configurable, although we do not recommend changing it. Any defects detected

locally can also be conveyed to Remote MEP peers by sending a Remote Defect

Indicator (RDI) to the peers within a Continuity Check Message (CCM). If defects

persist long enough, an alarm can be generated.

Example To set the queuing and p-bit priority for CCM messages to 6, use the commands:

awplus(config)# interface port1.0.2

awplus(config-if)# ethernet cfm mep down mpid 12 domain-name

MD-INST2 ma-name MA-INST2-1

awplus(config-if-eth-cfm-mep)# mep ccm-ltm-priority 6

CCMs should be the highest priority message so we recommend leaving their

priority as 7.

Commands

clear (MEP Attribute)

ethernet cfm domain-name

ethernet cfm mep

service ma-name

show mep-alarm status

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Parameter Description

<0-7> The queuing and p-bit priority for CCM messages.

C613-50292-01 Rev A Command Reference for IE210L Series 303

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

MEP CCM-LTM-PRIORITY

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 304

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

MEP CROSSCHECK

mep crosscheck

Overview Use this command within the MD instance context to create a Remote MEP

instance and configure its parameters.

Use the no variant of this command to destroy the Remote MEP instance.

Syntax mep crosscheck mpid <rmep-id> ma-name <ma-name> [mac

<HHHH.HHHH.HHHH>]

no mep crosscheck mpid <rmep-id> ma-name <ma-name>

Mode Ethernet CFM Configuration

Usage Maintenance Points are entities that exist within an MD/MA and can perform the

CFM/802.1ag functions such as Continuity Checks for fault management. The main

type of MP is a Maintenance End Point (MEP). This type of maintenance point sits

at the edges of a Maintenance Domain but is a member of only one MA within the

Maintenance Domain. Thus an MEP is used at the end of a VLAN segment, or it is

used at the end of a link. MPs live on bridge ports and station ports. On a bridge

port, there are two types.

• An Up Maintenance Entity is considered an inward MP. It communicates

across the inside of the bridge to the other side, and this allows it to reach the

outside world. It lives on a bridge port for a given VLAN, but it does not use

this port to send or receive to get to the outside world. Instead, it sends and

receives through the inside of the bridge and communicates to the outside

world through the other VLAN port members. An Up MP cannot be used for

Link Level CFM.

• A Down Maintenance Entity is considered an outward MP. It sends and

receives only through its bridge port outwardly to the outside world, and

does not communicate inside the bridge. A Down MP is not subject to

blocking due to Spanning Tree Protocol (STP) or any other protocol trying to

prevent loops in the network. As such, it is important that Down MPs be used

Parameter Description

mpid Specify the Remote MEP id.

<rmep-id> 1-8191. This must be unique ID for all MEPs in the MA (both

local and remote).

ma-name Specify the Maintenance Association that the Remote MEP is

to be associated with.

<ma-name> Specify the Maintenance Association's CLI instance name.

mac Optionally, when using unicast for communication between a

Local MEP and a Remote MEP, specify the remote MEP's MAC

address.

<HHHH.HHHH.HHHH> Specify the Remote MEP's MAC address using the

HHHH.HHHH.HHHH format where H is a hexadecimal value.

C613-50292-01 Rev A Command Reference for IE210L Series 305

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

MEP CROSSCHECK

in an MD/MA that is not subject to topology loops. A Down MP can be VLAN

aware or link-local.

An MEP can be either Up or Down for a given MD/MA, but within a bridge for the

same MD/MA, there can only be one Up or Down MEP (not both). An Up MEP must

be VLAN aware. A Down MEP may be VLAN aware. Otherwise, a Down MEP is

allowed to be link local (VLAN unaware), and its scope is that of the entire link.

Example To create a remote MEP instance named “MA-INST2-1” with an MEP ID of 21, use

the command:

awplus(config-ether-cfm)# mep crosscheck mpid 21 ma-name

MA-INST2-1

To destroy the remote MEP instance named “MA-INST2-1” with the MEP ID of 21,

use the command:

awplus(config-ether-cfm)# no mep crosscheck mpid 21 ma-name

MA-INST2-1

Commands

cc unicast

ethernet cfm domain-name

ethernet cfm mep

service ma-name

show ethernet cfm errorlog

show ethernet cfm maintenance-points remote mep

show ethernet cfm service

show mep-alarm status

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 306

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SERVICE MA-NAME

service ma-name

Overview Use this command to create a Maintenance Association instance within the MD

instance context and configure its parameters.

Use the no variant of this command to destroy the Maintenance Association

instance.

Syntax service ma-name <ma-name> ma-type

{icc|integer|primary-vid|string|vpn-id} ma-type-name

<ma-type-name> [vlan <primary-vid> [mip-creation {none}]]

no service <ma-name>

Parameter Description

<ma-name> The CLI name that identifies this Maintenance Association (MA)

instance.

ma-type Specify the MA name type. The MA name part of the MAID field

appears in the CCM message. There are different formats and

conventions for the name depending on the type.

icc Specify the ma-type as ICC based MA name format. The

<ma-type-name> is a 13 byte character string consisting of a 1 to

6 character ITU Carrier Code (ICC) plus a 1 to 6 character Unique

MEGID (UMC) code for the name. Any remaining characters are

padding out with NULLs by the system to fill out the 13 bytes.

This can only be used with Maintenance Domain whose name

md-type is set to “No name”.

integer Specify the ma-type as Integer based MA name format. The

<ma-type-name> Is a number up to 2 Bytes (0..65535).

primary-vid Specify the ma-type as Primary VLAN-id based MA name format.

The <ma-type-name> Is the VLAN id number that has been

assigned to the MA as the primary VLAN.

string Specify the ma-type as Character String based MA name format.

The <ma-type-name> is a string of 1 to 45 characters.

vpn-id Specify the ma-type as an RFC2685 VPN ID based MA name

format. The <ma-type-name> is a 7 Byte value divided into two

parts. The first part makes up the VPN's OUI which is three octets

and the remaining four octets make up the VPN Index. The

format is HHHHHH.HHHHHHHH where H is a hexadecimal digit.

ma-type-name The Maintenance Association (MA) name type.

<ma-type-name> The value of the MA type name, which depends on the ma-type

selected (icc, integer, primary-vid, string, vpn-id).

vlan An optional parameter that specifies the VLAN.

<primvary-vid> Specify the ID of the primary VLAN in the MA.

C613-50292-01 Rev A Command Reference for IE210L Series 307

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SERVICE MA-NAME

Mode Ethernet CFM Configuration

Usage A Maintenance Association is a Connectivity Fault Management (CFM) term that

represents a particular segment of a network within a Maintenance Domain. An

MA can represent a segment of a VLAN that is managed for connectivity within

that segment. As a VLAN is often the granularity that a Network Service Provider

sells to their customer, an MA is often referred to as a “Service”. An MA can also be

used to represent a link and in this case the MA is VLAN unaware.

As part of CFM, a Connectivity Check Message (CCM) is used to detect Ethernet

connectivity faults amongst nodes that participate in CFM. CCM messages carry

the MA name within the MAID field. Within an MD instance context, this command

is used to configure the MA name, which can be chosen from a variety of format

types.

Example To create a Maintenance Association instance named “MA-INST2-1” with an MA

name type of “string” and value of “MA-12V100”, use the command:

awplus(config-ether-cfm)# service ma-name MA-INST2-1 ma-type

string ma-type-name MA-12V100

To destroy a Maintenance Association instance named “MA-INST2-1”, use the

command:

awplus(config-ether-cfm)# no service MA-INST2-1

Commands

cc interval

cc multicast

cc unicast

cfm-sf-notify

clear (MEP Attribute)

ethernet cfm domain-name

ethernet cfm mep

mep (FNG attributes)

mep crosscheck

show ethernet cfm domain

show ethernet cfm errorlog

show ethernet cfm maintenance-points remote mep

show ethernet cfm service

mip-creation Optional parameter that specifies the MIP creation permission

value.

none Specifies that no MIPs are to be created (the default and only

choice).

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 308

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SERVICE MA-NAME

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 309

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM DETAILS

show ethernet cfm details

Overview Use this command to show CFM configuration, status, and statistics in detail for all

CFM entities that the system knows about.

Syntax show ethernet cfm details

Mode User Exec/Privileged Exec

Example To show CFM configuration, status, and statistics in detail for all CFM entities, use

the command:

awplus# show ethernet cfm details

The output loops through the hierarchy of MDs, then MAs within each MD, then

local MEPs within that MA, and finally remote MEPs within that MA.

Output Figure 9-1: Example output from show ethernet cfm details

awplus#show ethernet cfm details



==========================================================

Maintenance Domain

==========================================================

Maintenance Domain Name........... MD-INST1

Maintenance Domain Name Format.... character-string

Maintenance Domain Name Value..... MD-12L3

Level............................. 3

Associated CFM Services........... (VLAN 400 ): MA-INST1-1

(VLAN 300 ): MA-INST1-2

MIP Creation...................... None

Service

-------

CFM Service Name.................. MA-INST1-1

CFM Domain Name................... MD-INST1

CFM Domain Level.................. 3

Primary VLAN...................... 400

Maintenance Assoc Name Format..... string

Maintenance Assoc Name Value...... MA-12V400

CCM Transmission Interval......... 1 second

Local MEPs........................ MEP DOWN

2 (interface port1.0.3)

Configured Remote MEPs............ 102

Missing Remote MEPs............... None

Current MEP Defects............... -

MIP Creation...................... None

C613-50292-01 Rev A Command Reference for IE210L Series 310

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM DETAILS

Local Maintenance End Point

---------------------------

Domain Name....................... MD-INST1

MA Service Name................... MA-INST1-1

MA Primary VLAN................... 400

MEP ID............................ 2

Direction......................... Down

Interface......................... port1.0. 3

MEP Active State.............. True

CC State...................... Enabled

CC Type....................... Multicast

PDU VLAN Priority............. 7

MAC-address................... eccd.6dc9.bef6

Tx-RDI........................ False

Current Defects............... -

Current Highest Defect Alarm.. -

Alarm Minimum Defect.......... 2 (someMACstatusDefect)

Alarm Trip Time............... AUTO (2.5 seconds)

Alarm Reset Time.............. AUTO (10 seconds)

Configured Remote MEPs........ 102

Missing Remote MEPs........... None

Error CCM Reason.............. N/A

Last Error CCM................ N/A

Cross-connect Defect Reason... N/A

Last Cross Connect CCM........ N/A

Counters

Domain Name....................... MD-INST1

MA Service Name................... MA-INST1-1

MA Service VLAN................... 400

MEP ID............................ 2

Direction......................... DOWN

Interface......................... port1.0. 3

Tx CCM Count................... 0

Rx Out-of-Sequence CCM......... 0

Remote Maintenance End Point

----------------------------

CFM Service Name.................. MA-INST1-1

CFM Domain Name................... MD-INST1

Remote MEPID...................... 102

Receiving CCMs.................... Wait

Rx RDI............................ -

MAC Address....................... -

Port Status....................... -

Interface Status.................. -

C613-50292-01 Rev A Command Reference for IE210L Series 311

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM DETAILS

Service

-------

CFM Service Name.................. MA-INST1-2

CFM Domain Name................... MD-INST1

CFM Domain Level.................. 3

Primary VLAN...................... 300

Maintenance Assoc Name Format..... string

Maintenance Assoc Name Value...... MA-12V300

CCM Transmission Interval......... 1 second

Local MEPs........................ MEP DOWN

1 (interface port1.0.1)

MEP DOWN

200 (interface port1.0.2)

Configured Remote MEPs............ 101,1001

Missing Remote MEPs............... 101,1001

Current MEP Defects............... 3 (someRMEPCCMdefect)

MIP Creation...................... None

Local Maintenance End Point

---------------------------

Domain Name....................... MD-INST1

MA Service Name................... MA-INST1-2

MA Primary VLAN................... 300

MEP ID............................ 1

Direction......................... Down

Interface......................... port1.0. 1

MEP Active State.............. True

CC State...................... Enabled

CC Type....................... Multicast

PDU VLAN Priority............. 7

MAC-address................... eccd.6dc9.bef6

Tx-RDI........................ True

Current Defects............... 3 (someRMEPCCMdefect)

Current Highest Defect Alarm.. 4 (someRMEPCCMdefect)

Alarm Minimum Defect.......... 2 (someMACstatusDefect)

Alarm Trip Time............... AUTO (2.5 seconds)

Alarm Reset Time.............. AUTO (10 seconds)

Configured Remote MEPs........ 101,1001

Missing Remote MEPs........... 101,1001

Error CCM Reason.............. N/A

Last Error CCM................ N/A

Cross-connect Defect Reason... N/A

Last Cross Connect CCM........ N/A

Counters

Domain Name....................... MD-INST1

MA Service Name................... MA-INST1-2

MA Service VLAN................... 300

MEP ID............................ 1

Direction......................... DOWN

Interface......................... port1.0. 1

Tx CCM Count................... 121

Rx Out-of-Sequence CCM......... 0

C613-50292-01 Rev A Command Reference for IE210L Series 312

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM DETAILS

Local Maintenance End Point

---------------------------

Domain Name....................... MD-INST1

MA Service Name................... MA-INST1-2

MA Primary VLAN................... 300

MEP ID............................ 200

Direction......................... Down

Interface......................... port1.0. 2

MEP Active State.............. True

CC State...................... Enabled

CC Type....................... Multicast

PDU VLAN Priority............. 7

MAC-address................... eccd.6dc9.bef6

Tx-RDI........................ True

Current Defects............... 3 (someRMEPCCMdefect)

Current Highest Defect Alarm.. 4 (someRMEPCCMdefect)

Alarm Minimum Defect.......... 2 (someMACstatusDefect)

Alarm Trip Time............... AUTO (2.5 seconds)

Alarm Reset Time.............. AUTO (10 seconds)

Configured Remote MEPs........ 101,1001

Missing Remote MEPs........... 101,1001

Error CCM Reason.............. N/A

Last Error CCM................ N/A

Cross-connect Defect Reason... N/A

Last Cross Connect CCM........ N/A

Counters

Domain Name....................... MD-INST1

MA Service Name................... MA-INST1-2

MA Service VLAN................... 300

MEP ID............................ 200

Direction......................... DOWN

Interface......................... port1.0. 2

Tx CCM Count................... 0

Rx Out-of-Sequence CCM......... 0

Remote Maintenance End Point

----------------------------

CFM Service Name.................. MA-INST1-2

CFM Domain Name................... MD-INST1

Remote MEPID...................... 101

Receiving CCMs.................... Fail

Rx RDI............................ -

MAC Address....................... -

Port Status....................... -

Interface Status.................. -

Remote Maintenance End Point

----------------------------

CFM Service Name.................. MA-INST1-2

CFM Domain Name................... MD-INST1

Remote MEPID...................... 1001

Receiving CCMs.................... Fail

Rx RDI............................ -

MAC Address....................... -

Port Status....................... -

Interface Status.................. -

C613-50292-01 Rev A Command Reference for IE210L Series 313

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM DETAILS

Commands

show ethernet cfm domain

show ethernet cfm maintenance-points local mep

show ethernet cfm maintenance-points remote mep

show ethernet cfm service

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 314

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM DOMAIN

show ethernet cfm domain

Overview Use this command to show the Ethernet CFM Domain(s) that have been

configured in summary format. Options include the ability to show all domains

with detailed information, or to show a specified domain with detailed

information.

Syntax show ethernet cfm domain

show ethernet cfm domain details

show ethernet cfm domain <domain-name> details

Mode Privileged Exec

Example To show all domain configurations in summary format, use the command:

awplus# show ethernet cfm domain

To show all domains in detail, use the command:

awplus# show ethernet cfm domain details

To show a specific domain named “MD-INST1” in detail, use the command:

awplus# show ethernet cfm domain MD-INST1 details

Output Figure 9-2: Example output from show ethernet cfm domain

Parameter Description

<domain-name> The CLI name that identifies this Maintenance Domain instance.

details Provide detailed information in the output.

awplus#show ethernet cfm domain



CFM Domain Name Level

---------------------------------------

MD-INST1 0

MD-INST2 3

Table 9-1: Parameters in the output from show ethernet cfm domain

Parameter Description

CFM Domain Name The Maintenance Domain name for the managed object.

Level The level for the domain.

C613-50292-01 Rev A Command Reference for IE210L Series 315

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM DOMAIN

Figure 9-3: Example output from show ethernet cfm domain details

Figure 9-4: Example output from show ethernet cfm domain MD-INST1

details

Commands

ethernet cfm domain-name

awplus#show ethernet cfm domain details



Maintenance Domain Name.......... MD-INST1

Maintenance Domain Name Format... character-string

Maintenance Domain Name Value.... MD-12L0

Level............................ 0

Associated CFM Services.......... (Link Level ): MA-INST1-1

MIP Creation..................... None

------------------------------------------------------------------

Maintenance Domain Name.......... MD-INST2

Maintenance Domain Name Format... character-string

Maintenance Domain Name Value.... MD-12L3

Level............................ 3

Associated CFM Services.......... (Link Level ): MA-INST2-1

MIP Creation..................... None

------------------------------------------------------------------

awplus#show ethernet cfm domain MD-INST1 details



Maintenance Domain Name.......... MD-INST1

Maintenance Domain Name Format... character-string

Maintenance Domain Name Value.... MD-12L0

Level............................ 0

Associated CFM Services.......... (Link Level ): MA-INST1-1

MIP Creation..................... None

------------------------------------------------------------------

Table 9-2: Parameters in the output from show ethernet cfm domain details

Parameter Description

Domain Name The Maintenance Domain name for the managed object.

Domain Name Format

and Value The Maintenance Domain Name Format and Value. The

format is one of the following:

character-string

DNS

MAC

No name

Level The level for the domain.

Associated CFM

Services The Maintenance Associations (MA) instance names.

MIP Creation The MIP creation value.

C613-50292-01 Rev A Command Reference for IE210L Series 316

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM DOMAIN

service ma-name

show ethernet cfm details

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 317

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM ERRORLOG

show ethernet cfm errorlog

Overview Use this command to list the CFM Errors that are in the CFM Errors Event List,

starting from the oldest at the top to the latest at the end.

Syntax show ethernet cfm errorlog domain <domain-name>

Mode Privileged Exec

Usage When a new error is detected for a Maintenance Association (MA) that is associated

with a Maintenance Domain (MD), and such is due to an error from a received or

missing CCM from a Remote MEP, an event is logged to the CFM Errors Event List.

Example To show the list of errors for an MD named “MD-INST2”, use the command:

awplus# show ethernet cfm errorlog domain MD-INST2

Output Figure 9-5: Example output from show ethernet cfm errorlog domain

MD-INST2

Parameter Description

<domain-name> Specify the domain name value.

awplus#show ethernet cfm errorlog domain MD-INST2



CFM Service Name Level VLAN MEPID Remote MAC Error Reason

------------------------------------------------------------------

MA-INST2-1 0 0 12 0000.0000.0000 Remote MEP Down

Table 9-3: Parameters in the output from show ethernet cfm errorlog domain

MD-INST2

Parameter Description

Level The level configured for the MD.

VLAN The VLAN ID used by the MA if any, otherwise is "0".

MEPID The MEP ID of the local MEP that detected the error.

Remote MAC The source MAC address of the received CCM causing the

error if known, 0000.0000.0000 otherwise.

C613-50292-01 Rev A Command Reference for IE210L Series 318

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM ERRORLOG

Commands

clear ethernet cfm errorlog

ethernet cfm domain-name

ethernet cfm mep

mep crosscheck

service ma-name

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

Error Reason One of the following:

“Remote MEP Down” - an RMEPCCMDefect has been

declared for this remote MEP. CCMs have not been

received from this remote MEP within the CCM interval.



“MEP Configuration” - the CCM received from the remote

MEP has the same MEP ID as the local MEP that received

the CCM. For unicast remote MEPs this error can also

indicate that even though the CCM received from the

remote MEP has an MEP ID that matches a configured

remote MEP ID in the MA, the source MAC address differs

from the configured MAC address for that remote MEP.



“Forwarding Loop” - the CCM received from the remote

MEP has an MEP ID that matches a configured local MEP ID

in the MA, and also has the same source MAC address as

the local MEP's MAC address that received the CCM.



“Cross Connected” - a xconCCMdefect was detected.

CFM Service Name The name of the MA associated with the MD for this

error(s).

Table 9-3: Parameters in the output from show ethernet cfm errorlog domain

MD-INST2 (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 319

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM MAINTENANCE-POINTS LOCAL MEP

show ethernet cfm maintenance-points

local mep

Overview Use this command to show one or more Local MEPs, and their configuration and

status in summary format. Options include the ability to show Local MEP(s) for a

given interface with further option to show statistics counters. Another option is to

show Local MEPs for a given Maintenance Association (MA) and Maintenance

Domain (MD) either for statistics counters, or for one specific Local MEP with either

detailed information or statistics counters.

Syntax show ethernet cfm maintenance-points local mep interface <port>

[counters]

show ethernet cfm maintenance-points local mep domain

<domain-name> service <ma-name> [counters]

show ethernet cfm maintenance-points local mep domain

<domain-name> service <ma-name> mep <mep-id> {details|counters}

Mode User Exec/Privileged Exec

Examples To show the configuration and status of all the Local MEP(s) on an interface, use the

command:

awplus# show ethernet cfm maintenance-points local mep

interface port1.0.2

Parameter Description

interface Specify the interface for which Local MEP(s) are to be shown.

<interface-



name> Specify the interface by name.

counters Specify that counter statistics are to be shown.

domain Specify the Maintenance Domain that Local MEP(s) are to be

shown for. Both this and service must be specified.

<domain-name> Specify the Maintenance Domain's CLI instance name.

service Specify the Maintenance Association that the Local MEP(s) are to

be shown for. Both this and domain must be specified.

<ma-name> Specify CLI name that identifies the service (Maintenance

Association (MA)) instance of interest.

mep Specify one particular Local MEP of interest.

<mep-id> Specify the Local MEP instance by MEP-id.

details Specify that details are to be included in the output.

C613-50292-01 Rev A Command Reference for IE210L Series 320

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM MAINTENANCE-POINTS LOCAL MEP

To show details of a specific Local MEP on an MA and its associated MD, use the

command:

awplus# show ethernet cfm maintenance-points local mep domain

MD-INST1 service MA-INST1-1 mep 12 details

Output Figure 9-6: Example output from show ethernet cfm maintenance-points

local mep interface port1.0.2

awplus#show ethernet cfm maintenance-points local mep interface

port1.0.2



Service Name MEPID Dir Interface State Defect

------------------------------------------------------------------

MA-INST1-1 12 D port1.0.2 En ..3..

Table 9-4: Parameters in the output from show ethernet cfm

maintenance-points local mep interface <interface-name>

Parameter Description

Service Name The MA service name.

MEPID The MEP ID of the local MEP of interest within the MA.

Dir The direction of this local MEP:

D - Down MEP.

U - Up MEP.

Note: Only Down is currently supported.

Interface The interface on which the local MEP resides.

State Whether the local MEP's CCM processing is enabled “En”

or disabled “Dis”.

Defect Defect bit list <dbl> indicating which of 5 possible defects

are currently being detected with each bit showing the

detected <defect-number> or . if there is no defect.

C613-50292-01 Rev A Command Reference for IE210L Series 321

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM MAINTENANCE-POINTS LOCAL MEP

Figure 9-7: Example output from show ethernet cfm maintenance-points

local mep domain MD-INST1 service MA-INST1-1 mep 12

details

awplus#show ethernet cfm maintenance-points local mep domain

MD-INST1 service MA-INST1-1 mep 12 details



Domain Name....................... MD-INST1

MA Service Name................... MA-INST1-1

MA Primary VLAN................... 0

MEP ID............................ 12

Direction......................... Down

Interface......................... port1.0. 2

MEP Active State.............. True

CC State...................... Enabled

CC Type....................... Multicast

PDU VLAN Priority............. 7

MAC-address................... 000c.2526.95a1

Tx-RDI........................ True

Current Defects............... 3 (someRMEPCCMdefect)

Current Highest Defect Alarm.. 4 (someRMEPCCMdefect)

Alarm Minimum Defect.......... 2 (someMACstatusDefect)

Alarm Trip Time............... AUTO (2.5 seconds)

Alarm Reset Time.............. AUTO (10 seconds)

Configured Remote MEPs........ 21

Missing Remote MEPs........... 21

Error CCM Reason.............. N/A

Last Error CCM................ N/A

Cross-connect Defect Reason... N/A

Last Cross Connect CCM........ N/A

Table 9-5: Parameters in the output from show ethernet cfm

maintenance-points local mep domain <domain-name> service

<ma-name> mep <mep-id> details

Parameter Description

Domain Name and

MA Service Name Uniquely identify the MD and MA this local MEP is

associated with.

MA Primary VLAN The VLAN used by this MEP. A link-local MEP VLAN is

indicated by “-”.

MEP ID The local MEP's ID.

Direction The direction of the local MEP, either Down or Up.

Interface The Interface port or Interface lag that the local MEP is

configured against.

MEP Active State The MEP’s configured administrative state:

Up: True

Down: False.

C613-50292-01 Rev A Command Reference for IE210L Series 322

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM MAINTENANCE-POINTS LOCAL MEP

CC State The MEP's CCM configured administrative state:

Up: Enable

Down: Disable.

CC Type The configured CCM sending and receiving type, either

multicast or unicast. If not yet configured, it shows as

None.

Tx-RDI Whether this local MEP is sending RDI or not. An RDI is

sent when one or more of the following defects have been

declared by the local MEP:

someRMEPCCMdefect

someMACstatusDefect

errorCCMdefect

xconCCMdefect

Current Defects A list of defects the local MEP is currently detecting. It

shows the defect(s), as both a defect priority and name.

Current Highest

Defect Alarm The highest defect priority that has been encountered

while the local MEP has been in an alarm state.

Alarm Minimum

Defect The minimum defect the local MEP has to see before

declaring an alarm.

Alarm Trip Time The amount of time the defect has to exist before an alarm

is declared.

Configured Remote

MEP IDs A comma separated list of configured remote MEPs (by

MEP IDs) known by this local MEP. If the remote MEP also

has a configured unicast MAC address, the MEP ID will also

include -HHHH.HHHH.HHHH.

Missing Remote

MEPs The remote MEPs (by MEP ID) that have been configured

against this local MEP but have not been heard from.

Table 9-5: Parameters in the output from show ethernet cfm

maintenance-points local mep domain <domain-name> service

<ma-name> mep <mep-id> details (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 323

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM MAINTENANCE-POINTS LOCAL MEP

Commands

clear mep counter

ethernet cfm mep

show ethernet cfm details

Error CCM Reason The reason that the local MEP is detecting the

errorCCMdefect condition (if any):



Wrong MEP ID Received - CCM received with correct level

and MAID, but MEP ID has not been configured in this MA.



My MEP ID Received - CCM received with correct level and

MAID, but an MEP ID that is the same as a local MEP in this

MA.



My MEP ID Received (loop) - as above, but the CCM

received also has the same MAC address as the local MEP

in the MA.



CCM Interval Mismatch - CCM received with correct level

and MAID, but CCM interval does not match that

configured for this MA.



MAC address mismatch - for a configured unicast RMEP

(via crosscheck) the MAC address did not match the

provisioned value in the associated MA.



N/A - indicates there is no error CCM defect being

detected.

Last Error CCM If an errorCCMdefect condition is detected, portions of the

CCM that caused this condition are displayed.

Cross Connect

Defect Reason The reason that the local MEP is detecting the

xconCCMdefect condition (if any):



Wrong MAID - CCM received with correct level but

incorrect MAID (mismatch in the domain name and/or

short MA name versus configured).



Wrong Level - CCM received with a level that is lower than

the level configured for this local MEP's domain.



N/A - indicates there is no error CCM defect being

detected.

Last Cross Connect

CCM If a xconCCMdefect condition is detected, portions of the

CCM that caused this condition are displayed.

Table 9-5: Parameters in the output from show ethernet cfm

maintenance-points local mep domain <domain-name> service

<ma-name> mep <mep-id> details (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 324

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM MAINTENANCE-POINTS LOCAL MEP

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

C613-50292-01 Rev A Command Reference for IE210L Series 325

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM MAINTENANCE-POINTS REMOTE MEP

show ethernet cfm maintenance-points

remote mep

Overview Use this command to show one or more Ethernet CFM maintenance points,

namely Remote Maintenance End Points (MEPs) within a given Maintenance

Association (MA) and its associated Maintenance Domain (MD), and their

configuration and status in summary format. Options include the ability to show

an individual Remote MEP in detail.

Syntax show ethernet cfm maintenance-points remote mep domain

<domain-name> service <ma-name> [{mac <rmep-mac-address>|rmep

<mep-id>} details]

Mode User Exec/Privileged Exec

Example To show all the remote MEP(s)'s status for this MA and MD in summary form, use

the command:

awplus# show ethernet cfm maintenance-points remote mep domain

MD-INST1 service MA-INST1-1

To show a specific remote MEP by its ID in detail, use the command:

awplus# show ethernet cfm maintenance-points remote mep domain

MD-INST1 service MA-INST1-1 rmep 21 details

To show a specific remote MEP by its MAC address in detail, use the command:

awplus# show ethernet cfm maintenance-points remote mep domain

MD-INST1 service MA-INST1-1 mac 000c.2526.95bf details

Parameter Description

domain Specify the Maintenance Domain that Remote MEP(s) are to

be shown for.

<domain-name> Specify the Maintenance Domain's CLI instance name.

service Specify the Maintenance Association that the Remote

MEP(s) are to be shown for.

<ma-name> Specify the service's (Maintenance Association (MA)) CLI

instance name.

mac Specify the remote MEP of interest by its MAC address.

<rmep-mac-address> Specify the value of the remote MEP's MAC address using

the format HHHH.HHHH.HHHH where H is a hexadecimal

digit.

rmep Specify the remote MEP of interest by its ID.

<mep-id> Specify the value of the remote MEP's ID in the range 1 to

8191.

C613-50292-01 Rev A Command Reference for IE210L Series 326

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM MAINTENANCE-POINTS REMOTE MEP

Output Figure 9-8: Example output from show ethernet cfm maintenance-points

remote mep domain MD-INST1 service MA-INST1-1

Figure 9-9: Example output from show ethernet cfm maintenance-points

remote mep domain MD-INST1 service MA-INST1-1 rmep 21

details

Figure 9-10: Example output from show ethernet cfm maintenance-points

remote mep domain MD-INST1 service MA-INST1-1 mac

000c.2526.95bf details

awplus#show ethernet cfm maintenance-points remote mep domain

MD-INST1 service MA-INST1-1



CFM Domain Name: MD-INST1

CFM Service Name: MA-INST1-1

RX RX Port Intf

MEPID CCM RDI Stat Stat

----------------------------

21 Yes No Up Up

awplus#show ethernet cfm maintenance-points remote mep domain

MD-INST1 service MA-INST1-1 rmep 21 details



CFM Service Name..... MA-INST1-1

CFM Domain Name...... MD-INST1

Remote MEPID......... 21

Receiving CCMs....... Yes

Rx RDI............... No

MAC Address.......... 000c.2526.95bf

Port Status.......... Up

Interface Status..... Up

awplus#show ethernet cfm maintenance-points remote mep domain

MD-INST1 service MA-INST1-1 mac 000c.2526.95bf details



CFM Service Name..... MA-INST1-1

CFM Domain Name...... MD-INST1

Remote MEPID......... 21

Receiving CCMs....... Yes

Rx RDI............... No

MAC Address.......... 000c.2526.95bf

Port Status.......... Up

Interface Status..... Up

C613-50292-01 Rev A Command Reference for IE210L Series 327

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM MAINTENANCE-POINTS REMOTE MEP

Commands

ethernet cfm domain-name

mep crosscheck

service ma-name

show ethernet cfm details

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

Table 9-6: Parameters in the output from show ethernet cfm

maintenance-points remote mep

Parameter Description

CFM Domain Name

and CFM Service

Name

The instance identifiers that uniquely identify the MA and

MD for the remote MEP(s) of interest.

Remote MEPID The remote MEP ID that is configured for this MA.

Receiving CCMs The current state of the 802.1ag remote MEP state

machine:

Yes - RMEP_OK. CCMs are being received without any

error.

Wait - RMEP_START. Still preparing to receive remote MEP

CCMs without a timeout occurring.

Failed - RMEP_FAILED. While waiting to receive CCMs from

a remote MEP, a timeout occurred.

- - the state machine is not running.

RX RDI The current RDI being received from this remote MEP:

True - the last CCM received from the remote MEP has the

RDI set. This means the remote MEP itself is seeing one of

the following defects: someRMEPCCMDefect,

someMACstatusDefect, errorCCMdefect, xconCCMdefect.

False - the last CCM received from the remote MEP does

not have its RDI set.

MAC Address The configured or discovered MAC address of the remote

MEP.

Port Status If the CCM was received with a port status TLV, this

indicates the last value received, or "-" if none received.

Interface Status If the CCM was received with an interface status TLV, this

indicates the last value received, or "-" if none received.

C613-50292-01 Rev A Command Reference for IE210L Series 328

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM SERVICE

show ethernet cfm service

Overview Use this command to show the Ethernet CFM Services (Maintenance Associations

(MA)) configuration in summary format, or show a specified MA with detailed

information.

Syntax show ethernet cfm service [<ma-name> domain <domain-name>

details]

Mode User Exec/Privileged Exec

Example To show details for all MAs in summary form, use the command:

awplus# show ethernet cfm service

To show a specified MA in detailed form, use the command:

awplus# show ethernet cfm service MA-INST2-1 domain MD-INST2

details

Output Figure 9-11: Example output from show ethernet cfm service

Parameter Description

<ma-name> The CLI name that identifies the service (Maintenance Association

(MA)) instance of interest.

domain Specify the domain name by name.

<domain-name> The CLI name that identifies this Maintenance Domain instance.

awplus#show ethernet cfm service



CFM Domain Name CFM Service Name VLAN Defect

------------------------------------------------------------------

MD-INST1 MA-INST1-1 NONE .....

MD-INST2 MA-INST2-1 NONE ..3..

Table 9-7: Parameters in the output from show ethernet cfm service

Parameter Description

CFM Domain Name The Maintenance Domain name for the managed object.

CFM Service Name The Maintenance Associations (MA) instance name.

C613-50292-01 Rev A Command Reference for IE210L Series 329

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM SERVICE

Figure 9-12: Example output from show ethernet cfm service MA-INST2-1

domain MD-INST2 details

VLAN The Primary VLAN.

Defect A list of defects detected by the MA’s Local MEPs. The

defects shown can be:

1 - someRDIdefect is declared

2 - someMACstatusDefect is declared

3 - someRMEPCCMdefect is declared

4 - errorCCMdefect is declared

5 - xconCCMdefect is declared

awplus#show ethernet cfm service MA-INST2-1 domain MD-INST2

details



CFM Service Name................ MA-INST2-1

CFM Domain Name................. MD-INST2

CFM Domain Level................ 3

Primary VLAN.................... -



Maintenance Assoc Name Format... string

Maintenance Assoc Name Value.... MA-12V100

CCM Transmission Interval....... 1 second

Local MEPs...................... MEP DOWN 12 (interface

port1.0.2)



Configured Remote MEPs.......... 21

Missing Remote MEPs............. 21

Current MEP Defects............. 3 (someRMEPCCMdefect)

MIP Creation.................... None

Table 9-8: Parameters in the output from show ethernet cfm service

<ma-name> domain <domain-name> details

Parameter Description

CFM Service Name The Maintenance Associations (MA) instance name.

CFM Domain Name The Maintenance Domain name for the managed object.

CFM Domain Level The level of the domain.

Primary VLAN The Primary VLAN that was configured (if any).

Table 9-7: Parameters in the output from show ethernet cfm service (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 330

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW ETHERNET CFM SERVICE

Commands

ethernet cfm domain-name

ethernet cfm mep

mep crosscheck

service ma-name

show ethernet cfm details

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

Maintenance Assoc

Name Format and

Value

The name and name format of the MA. The name format is

one of the following:

ICC - ICC string based name format

Integer - Integer based name format

Primary-vid - Primary VLAN based name format

String - Character string based name format

VPN-ID - VPN-ID based name format

CCM Transmission

Interval The CCI that was configured for this MA. It can be one of

the following:

3 - CCI of 100 milliseconds

4 - CCI of 1 second (default)

5 - CCI of 10 seconds

6 - CCI of 1 minute

7 - CCI of 10 minutes

Local MEPs A list of the Local MEPs configured for this MA. For each

MEP, it displays the MEP direction Up or Down, its MEP-id,

and the interface it was configured on.

Configured Remote

MEPs A list of Remote MEPs by MEP-id.

Missing Remote

MEPs A list of the configured Remote MEPs that this MA has not

received any CCM messages from within 3.5 times the

configured CCI.

Defect A list of defects detected by the MA’s Local MEPs. The

defects shown can be:

1 - someRDIdefect is declared

2 - someMACstatusDefect is declared

3 - someRMEPCCMdefect is declared

4 - errorCCMdefect is declared

5 - xconCCMdefect is declared

Table 9-8: Parameters in the output from show ethernet cfm service

<ma-name> domain <domain-name> details (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 331

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

CONNECTIVITY FAULT MANAGEMENT COMMANDS

SHOW MEP-ALARM STATUS

show mep-alarm status

Overview Use this command to show any alarms that have been declared by Local MEPs, and

the defect(s) that caused the alarm.

Syntax show mep-alarm status

Mode User Exec/Privileged Exec

Usage A Local MEP is used to detect connectivity faults with other remote MEPs that are

in the same Maintenance Association (MA) and Maintenance Domain (MD) as the

Local MEP. A Local MEP looks first for connectivity defects, and if these defects

persist for a long enough period of time (typically 2.5 seconds), then an alarm is

declared.

Example To show the alarms on local MEPs, use the command:

awplus# show mep-alarm status

Output Figure 9-13: Example output from show mep-alarm status

Commands

ethernet cfm mep

mep (FNG attributes)

mep crosscheck

Command

changes

Version 5.4.7-1.1: command added

Version 5.4.8-0.2: added to SBx8100 series products

Version 5.4.8-1.1: added to SBx908 GEN2 series products

awplus#show mep-alarm status



CFM Domain Name CFM Service Name MEP Active Alarm

------------------------------------------------------------------

MD-INST1 MA-INST1-1 12 someRMEPCCM

Table 9-9: Parameters in the output from show mep-alarm status

Parameter Description

CFM Domain Name The domain name.

CFM Service Name The MA name.

Active Alarms The highest priority defect causing the alarm, one of the

following: someRDI, someMACstatus, someRMEPCCM,

errorCCM, or xconCCM.

MEP The local MEP's ID.

C613-50292-01 Rev A Command Reference for IE210L Series 332

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Logging Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

logging. See the Logging Feature Overview and Configuration Guide for more

information about the different types of log and how to filter log messages.

Command List •“clear exception log” on page 334

•“clear log” on page 335

•“clear log buffered” on page 336

•“clear log external” on page 337

•“clear log permanent” on page 338

•“copy buffered-log” on page 339

•“copy permanent-log” on page 340

•“default log buffered” on page 341

•“default log console” on page 342

•“default log email” on page 343

•“default log external” on page 344

•“default log host” on page 345

•“default log monitor” on page 346

•“default log permanent” on page 347

•“log buffered” on page 348

•“log buffered (filter)” on page 349

•“log buffered exclude” on page 352

•“log buffered size” on page 355

•“log console” on page 356

C613-50292-01 Rev A Command Reference for IE210L Series 333

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

•“log console (filter)” on page 357

•“log console exclude” on page 360

•“log email” on page 363

•“log email (filter)” on page 364

•“log email exclude” on page 367

•“log email time” on page 370

•“log external” on page 372

•“log external (filter)” on page 374

•“log external exclude” on page 377

•“log external rotate” on page 380

•“log external size” on page 382

•“log facility” on page 383

•“log host” on page 385

•“log host (filter)” on page 387

•“log host exclude” on page 390

•“log host source” on page 393

•“log host startup-delay” on page 394

•“log host time” on page 396

•“log monitor (filter)” on page 398

•“log monitor exclude” on page 401

•“log permanent” on page 404

•“log permanent (filter)” on page 405

•“log permanent exclude” on page 408

•“log permanent size” on page 411

•“log-rate-limit nsm” on page 412

•“log trustpoint” on page 413

•“show counter log” on page 414

•“show exception log” on page 415

•“show log” on page 416

•“show log config” on page 418

•“show log external” on page 420

•“show log permanent” on page 421

•“show running-config log” on page 422

•“unmount” on page 423

C613-50292-01 Rev A Command Reference for IE210L Series 334

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

CLEAR EXCEPTION LOG

clear exception log

Overview This command resets the contents of the exception log, but does not remove the

associated core files.

Syntax clear exception log

Mode Privileged Exec

Example awplus# clear exception log

C613-50292-01 Rev A Command Reference for IE210L Series 335

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

CLEAR LOG

clear log

Overview This command removes the contents of the buffered and permanent logs.

Syntax clear log

Mode Privileged Exec

Example To delete the contents of the buffered and permanent log use the command:

awplus# clear log

Commands

clear log buffered

clear log permanent

show log

C613-50292-01 Rev A Command Reference for IE210L Series 336

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

CLEAR LOG BUFFERED

clear log buffered

Overview This command removes the contents of the buffered log.

Syntax clear log buffered

Mode Privileged Exec

Example To delete the contents of the buffered log use the following commands:

awplus# clear log buffered

Commands

default log buffered

log buffered

log buffered (filter)

log buffered size

log buffered exclude

show log

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 337

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

CLEAR LOG EXTERNAL

clear log external

Overview Use this command to delete the external log file from the SD card it is stored on.

If the external log is rotating between multiple files, this command deletes all

those files, not just the most recent one.

Syntax clear log external

Mode Privileged Exec

Example To delete the external log file, use the command:

awplus# clear log external

Commands

default log external

log external

log external (filter)

log external exclude

log external rotate

log external size

show log config

show log external

unmount

Command

changes

Version 5.4.7-1.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 338

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

CLEAR LOG PERMANENT

clear log permanent

Overview This command removes the contents of the permanent log.

Syntax clear log permanent

Mode Privileged Exec

Example To delete the contents of the permanent log use the following commands:

awplus# clear log permanent

Commands

default log permanent

log permanent

log permanent (filter)

log permanent exclude

log permanent size

show log config

show log permanent

C613-50292-01 Rev A Command Reference for IE210L Series 339

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

COPY BUFFERED-LOG

copy buffered-log

Overview Use this command to copy the buffered log to an internal or external destination.

Syntax copy buffered-log <destination-name>

Mode Privileged Exec

Example To copy the buffered log file into a folder in Flash named “buffered-log” and name

the file “buffered-log.log”, use the command:

awplus# copy buffered-log flash:/buffered-log/buffered-log.log

To copy the buffered log file onto an SD card and name the file “buffered-log.log”,

use the command:

awplus# copy buffered-log card:/buffered-log.log

Commands

log buffered

show file systems

show log

Command

changes

Version 5.4.7-1.1: command added

Parameter Description

<destination-name> The filename and path for the destination file. See

Introduction on page 84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 340

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

COPY PERMANENT-LOG

copy permanent-log

Overview Use this command to copy the permanent log to an internal or external

destination.

Syntax copy permanent-log <destination-name>

Mode Privileged Exec

Example To copy the permanent log file into a folder in Flash named “perm-log” and name

the file “permanent-log.log”, use the command:

awplus# copy permanent-log flash:/perm-log/permanent-log.log

To copy the permanent log file onto an SD card and name the file

“permanent-log.log”, use the command:

awplus# copy permanent-log card:/permanent-log.log

Commands

log permanent

show file systems

show log permanent

Command

changes

Version 5.4.7-1.1: command added

Parameter Description

<destination-name> The filename and path for the destination file. See

Introduction on page 84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 341

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

DEFAULT LOG BUFFERED

default log buffered

Overview This command restores the default settings for the buffered log stored in RAM. By

default the size of the buffered log is 50 kB and it accepts messages with the

severity level of “warnings” and above.

Syntax default log buffered

Default The buffered log is enabled by default.

Mode Global Configuration

Example To restore the buffered log to its default settings use the following commands:

awplus# configure terminal

awplus(config)# default log buffered

Commands

clear log buffered

log buffered

log buffered (filter)

log buffered size

log buffered exclude

show log

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 342

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

DEFAULT LOG CONSOLE

default log console

Overview This command restores the default settings for log messages sent to the terminal

when a log console command is issued. By default all messages are sent to the

console when a log console command is issued.

Syntax default log console

Mode Global Configuration

Example To restore the log console to its default settings use the following commands:

awplus# configure terminal

awplus(config)# default log console

Commands

log console

log console (filter)

log console exclude

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 343

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

DEFAULT LOG EMAIL

default log email

Overview This command restores the default settings for log messages sent to an email

address. By default no filters are defined for email addresses. Filters must be

defined before messages will be sent. This command also restores the remote

syslog server time offset value to local (no offset).

Syntax default log email <email-address>

Mode Global Configuration

Example To restore the default settings for log messages sent to the email address

admin@alliedtelesis.com use the following commands:

awplus# configure terminal

awplus(config)# default log email admin@alliedtelesis.com

Commands

log email

log email (filter)

log email exclude

log email time

show log config

Parameter Description

<email-address> The email address to send log messages to

C613-50292-01 Rev A Command Reference for IE210L Series 344

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

DEFAULT LOG EXTERNAL

default log external

Overview Use this command to restore the default settings for the external log. By default,

the size of the external log is 50 kB, it rotates through 1 additional file, and it

accepts messages with a severity level of notices and above.

Note that this command does not clear the configured filename for the external

log.

Syntax default log external

Mode Global Configuration

Example To restore the default settings for the external log, use the commands:

awplus# configure terminal

awplus(config)# default log external

Commands

clear log external

log external

log external (filter)

log external exclude

log external rotate

log external size

show log config

show log external

unmount

Command

changes

Version 5.4.7-1.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 345

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

DEFAULT LOG HOST

default log host

Overview This command restores the default settings for log sent to a remote syslog server.

By default no filters are defined for remote syslog servers. Filters must be defined

before messages will be sent. This command also restores the remote syslog server

time offset value to local (no offset).

Syntax default log host <ip-addr>

Mode Global Configuration

Example To restore the default settings for messages sent to the remote syslog server with

IP address 10.32.16.21 use the following commands:

awplus# configure terminal

awplus(config)# default log host 10.32.16.21

Commands

log host

log host (filter)

log host exclude

log host source

log host time

show log config

Parameter Description

<ip-addr>The IP address of a remote syslog server

C613-50292-01 Rev A Command Reference for IE210L Series 346

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

DEFAULT LOG MONITOR

default log monitor

Overview This command restores the default settings for log messages sent to the terminal

when a terminal monitor command is used.

Syntax default log monitor

Default All messages are sent to the terminal when a terminal monitor command is used.

Mode Global Configuration

Example To restore the log monitor to its default settings use the following commands:

awplus# configure terminal

awplus(config)# default log monitor

Commands

log monitor (filter)

log monitor exclude

show log config

terminal monitor

C613-50292-01 Rev A Command Reference for IE210L Series 347

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

DEFAULT LOG PERMANENT

default log permanent

Overview This command restores the default settings for the permanent log stored in Flash.

By default, the size of the permanent log is 50 kB and it accepts messages with the

severity level of warnings and above.

Syntax default log permanent

Default The permanent log is enabled by default.

Mode Global Configuration

Example To restore the permanent log to its default settings use the following commands:

awplus# configure terminal

awplus(config)# default log permanent

Commands

clear log permanent

log permanent

log permanent (filter)

log permanent exclude

log permanent size

show log config

show log permanent

C613-50292-01 Rev A Command Reference for IE210L Series 348

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG BUFFERED

log buffered

Overview This command configures the device to store log messages in RAM. Messages

stored in RAM are not retained on the device over a restart. Once the buffered log

reaches its configured maximum allowable size old messages will be deleted to

make way for new ones.

Syntax log buffered

no log buffered

Default The buffered log is configured by default.

Mode Global Configuration

Examples To configured the device to store log messages in RAM use the following

commands:

awplus# configure terminal

awplus(config)# log buffered

To configure the device to not store log messages in a RAM buffer use the

following commands:

awplus# configure terminal

awplus(config)# no log buffered

Commands

clear log buffered

copy buffered-log

default log buffered

log buffered (filter)

log buffered size

log buffered exclude

show log

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 349

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG BUFFERED (FILTER)

log buffered (filter)

Overview Use this command to create a filter to select messages to be sent to the buffered

log. Selection can be based on the priority/ severity of the message, the program

that generated the message, the logging facility used, a sub-string within the

message or a combination of some or all of these.

The no variant of this command removes the corresponding filter, so that the

specified messages are no longer sent to the buffered log.

Syntax log buffered [level <level>] [program <program-name>] [facility

<facility>] [msgtext <text-string>]

no log buffered [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

level Filter messages to the buffered log by severity level.

<level>The minimum severity of message to send to the buffered log. The level can be specified as

one of the following numbers or level names, where 0 is the highest severity and 7 is the

lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Filter messages to the buffered log by program. Include messages from a specified program in

the buffered log.

<program-

name>The name of a program to log messages from. You can enter either one of the following

predefined program names (depending on your device model), or another program name

that you find in the log output. The pre-defined names are not case sensitive but other

program names from the log output are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

C613-50292-01 Rev A Command Reference for IE210L Series 350

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG BUFFERED (FILTER)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Filter messages to the buffered log by syslog facility.

<facility>Specify one of the following syslog facilities to include messages from in the buffered log:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

msgtext Select messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 351

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG BUFFERED (FILTER)

Default By default the buffered log has a filter to select messages whose severity level is

“notices (5)” or higher. This filter may be removed using the no variant of this

command.

Mode Global Configuration

Examples To add a filter to send all messages generated by EPSR that have a severity of

notices or higher to the buffered log, use the following commands:

awplus# configure terminal

awplus(config)# log buffered level notices program epsr

To add a filter to send all messages containing the text “Bridging initialization” to

the buffered log, use the following commands:

awplus# configure terminal

awplus(config)# log buffered msgtext Bridging initialization

To remove a filter that sends all messages generated by EPSR that have a severity

of notices or higher to the buffered log, use the following commands:

awplus# configure terminal

awplus(config)# no log buffered level notices program epsr

To remove a filter that sends all messages containing the text “Bridging

initialization” to the buffered log, use the following commands:

awplus# configure terminal

awplus(config)# no log buffered msgtext Bridging initialization

Commands

clear log buffered

default log buffered

log buffered

log buffered size

log buffered exclude

show log

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 352

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG BUFFERED EXCLUDE

log buffered exclude

Overview Use this command to exclude specified log messages from the buffered log. You

can exclude messages on the basis of:

• the priority/severity of the message

• the program that generated the message

• the logging facility used

• a sub-string within the message, or

• a combination of some or all of these.

Use the no variant of this command to stop excluding the specified messages.

Syntax log buffered exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

no log buffered exclude [level <level>] [program

<program-name>] [facility <facility>] [msgtext <text-string>]

Parameter Description

level Exclude messages of the specified severity level.

<level>The severity level to exclude. The level can be specified as one of the following numbers or

level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Exclude messages from a specified program.

<program-

name>The name of a program. You can enter either one of the following predefined program names

(depending on your device model), or another program name that you find in the log output.

The pre-defined names are not case sensitive but other program names from the log output

are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

C613-50292-01 Rev A Command Reference for IE210L Series 353

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG BUFFERED EXCLUDE

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Exclude messages from a syslog facility.

<facility>Specify one of the following syslog facilities to exclude messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

msgtext Exclude messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 354

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG BUFFERED EXCLUDE

Default No log messages are excluded

Mode Global configuration

Example To remove messages that contain the string “example of irrelevant message”, use

the following commands:

awplus# configure terminal

awplus(config)# log buffered exclude msgtext example of

irrelevant message

Commands

clear log buffered

default log buffered

log buffered

log buffered (filter)

log buffered size

show log

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 355

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG BUFFERED SIZE

log buffered size

Overview This command configures the amount of memory that the buffered log is

permitted to use. Once this memory allocation has been filled old messages will be

deleted to make room for new messages.

Syntax log buffered size <50-250>

Mode Global Configuration

Example To allow the buffered log to use up to 100 kB of RAM use the following commands:

awplus# configure terminal

awplus(config)# log buffered size 100

Commands

clear log buffered

copy buffered-log

default log buffered

log buffered

log buffered (filter)

log buffered exclude

show log

show log config

Parameter Description

<50-250>Size of the RAM log in kilobytes

C613-50292-01 Rev A Command Reference for IE210L Series 356

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG CONSOLE

log console

Overview This command configures the device to send log messages to consoles. The

console log is configured by default to send messages to the device’s main console

port.

Use the no variant of this command to configure the device not to send log

messages to consoles.

Syntax log console

no log console

Mode Global Configuration

Examples To configure the device to send log messages use the following commands:

awplus# configure terminal

awplus(config)# log console

To configure the device not to send log messages in all consoles use the following

commands:

awplus# configure terminal

awplus(config)# no log console

Commands

default log console

log console (filter)

log console exclude

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 357

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG CONSOLE (FILTER)

log console (filter)

Overview This command creates a filter to select messages to be sent to all consoles when

the log console command is given. Selection can be based on the priority/severity

of the message, the program that generated the message, the logging facility

used, a sub-string within the message or a combination of some or all of these.

Syntax log console [level <level>] [program <program-name>] [facility

<facility>] [msgtext <text-string>]

no log console [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

level Filter messages by severity level.

<level>The minimum severity of message to send. The level can be specified as one of the following

numbers or level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Filter messages by program. Include messages from a specified program.

<program-

name>The name of a program to log messages from. You can enter either one of the following

predefined program names (depending on your device model), or another program name

that you find in the log output. The pre-defined names are not case sensitive but other

program names from the log output are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

C613-50292-01 Rev A Command Reference for IE210L Series 358

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG CONSOLE (FILTER)

Default By default the console log has a filter to select messages whose severity level is

critical or higher. This filter may be removed using the no variant of this

command. This filter may be removed and replaced by filters that are more

selective.

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Filter messages by syslog facility.

<facility>Specify one of the following syslog facilities to include messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

msgtext Select messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 359

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG CONSOLE (FILTER)

Mode Global Configuration

Examples To create a filter to send all messages containing the text “Bridging initialization”

to console instances where the log console command has been entered, use the

following commands:

awplus# configure terminal

awplus(config)# log console msgtext "Bridging initialization"

To remove a filter that sends all messages generated by EPSR that have a severity

of notices or higher to consoles, use the following commands:

awplus# configure terminal

awplus(config)# no log console level notices program epsr

To remove a default filter that includes sending critical, alert and emergency

level messages to the console, use the following commands:

awplus# configure terminal

awplus(config)# no log console level critical

Commands

default log console

log console

log console exclude

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 360

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG CONSOLE EXCLUDE

log console exclude

Overview Use this command to prevent specified log messages from being sent to the

console, when console logging is turned on. You can exclude messages on the

basis of:

• the priority/severity of the message

• the program that generated the message

• the logging facility used

• a sub-string within the message, or

• a combination of some or all of these.

Use the no variant of this command to stop excluding the specified messages.

Syntax log console exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

no log console exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

level Exclude messages of the specified severity level.

<level>The severity level to exclude. The level can be specified as one of the following numbers or

level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Exclude messages from a specified program.

<program-

name>The name of a program. You can enter either one of the following predefined program names

(depending on your device model), or another program name that you find in the log output.

The pre-defined names are not case sensitive but other program names from the log output

are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

C613-50292-01 Rev A Command Reference for IE210L Series 361

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG CONSOLE EXCLUDE

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Exclude messages from a syslog facility.

<facility>Specify one of the following syslog facilities to exclude messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 362

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG CONSOLE EXCLUDE

Default No log messages are excluded

Mode Global configuration

Example To remove messages that contain the string “example of irrelevant message”, use

the following commands:

awplus# configure terminal

awplus(config)# log console exclude msgtext example of

irrelevant message

Commands

default log console

log console

log console (filter)

show log config

msgtext Exclude messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 363

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EMAIL

log email

Overview This command configures the device to send log messages to an email address.

The email address is specified in this command.

Syntax log email <email-address>

Default By default no filters are defined for email log targets. Filters must be defined before

messages will be sent.

Mode Global Configuration

Example To have log messages emailed to the email address

admin@alliedtelesis.com use the following commands:

awplus# configure terminal

awplus(config)# log email admin@alliedtelesis.com

Commands

default log email

log email (filter)

log email exclude

log email time

show log config

Parameter Description

<email-address> The email address to send log messages to

C613-50292-01 Rev A Command Reference for IE210L Series 364

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EMAIL (FILTER)

log email (filter)

Overview This command creates a filter to select messages to be sent to an email address.

Selection can be based on the priority/ severity of the message, the program that

generated the message, the logging facility used, a sub-string within the message

or a combination of some or all of these.

The no variant of this command configures the device to no longer send log

messages to a specified email address. All configuration relating to this log target

will be removed.

Syntax log email <email-address> [level <level>] [program

<program-name>] [facility <facility>] [msgtext <text-string>]

no log email <email-address> [level <level>] [program

<program-name>] [facility <facility>] [msgtext <text-string>]

Parameter Description

<email-

address> The email address to send logging messages to

level Filter messages by severity level.

<level>The minimum severity of message to send. The level can be specified as one of the following

numbers or level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Filter messages by program. Include messages from a specified program.

<program-

name>The name of a program to log messages from. You can enter either one of the following

predefined program names (depending on your device model), or another program name

that you find in the log output. The pre-defined names are not case sensitive but other

program names from the log output are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

C613-50292-01 Rev A Command Reference for IE210L Series 365

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EMAIL (FILTER)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Filter messages by syslog facility.

<facility>Specify one of the following syslog facilities to include messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

msgtext Select messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 366

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EMAIL (FILTER)

Mode Global Configuration

Examples To create a filter to send all messages generated by EPSR that have a severity of

notices or higher to the email address admin@homebase.com, use the following

commands:

awplus# configure terminal

awplus(config)# log email admin@homebase.com level notices

program epsr

To create a filter to send all messages containing the text “Bridging initialization”,

to the email address admin@homebase.com, use the following commands:

awplus# configure terminal

awplus(config)# log email admin@homebase.com msgtext "Bridging

initialization"

To create a filter to send messages with a severity level of informational and

above to the email address admin@alliedtelesis.com, use the following

commands:

awplus# configure terminal

awplus(config)# log email admin@alliedtelesis.com level

informational

To stop the device emailing log messages emailed to the email address

admin@alliedtelesis.com, use the following commands:

awplus# configure terminal

awplus(config)# no log email admin@homebase.com

To remove a filter that sends all messages generated by EPSR that have a severity

of notices or higher to the email address admin@homebase.com, use the

following commands:

awplus# configure terminal

awplus(config)# no log email admin@homebase.com level notices

program epsr

To remove a filter that sends messages with a severity level of informational and

above to the email address admin@alliedtelesis.com, use the following

commands:

awplus# configure terminal

awplus(config)# no log email admin@alliedtelesis.com level

informational

Commands

default log email

log email

log email exclude

log email time

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 367

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EMAIL EXCLUDE

log email exclude

Overview Use this command to prevent specified log messages from being emailed, when

the device is configured to send log messages to an email address. You can

exclude messages on the basis of:

• the priority/severity of the message

• the program that generated the message

• the logging facility used

• a sub-string within the message, or

• a combination of some or all of these.

Use the no variant of this command to stop excluding the specified messages.

Syntax log email exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

no log email exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

level Exclude messages of the specified severity level.

<level>The severity level to exclude. The level can be specified as one of the following numbers or

level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Exclude messages from a specified program.

<program-

name>The name of a program. You can enter either one of the following predefined program names

(depending on your device model), or another program name that you find in the log output.

The pre-defined names are not case sensitive but other program names from the log output

are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

C613-50292-01 Rev A Command Reference for IE210L Series 368

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EMAIL EXCLUDE

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Exclude messages from a syslog facility.

<facility>Specify one of the following syslog facilities to exclude messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 369

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EMAIL EXCLUDE

Default No log messages are excluded

Mode Global configuration

Example To remove messages that contain the string “example of irrelevant message”, use

the following commands:

awplus# configure terminal

awplus(config)# log email exclude msgtext example of irrelevant

message

Commands

default log email

log email

log email (filter)

log email time

show log config

msgtext Exclude messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 370

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EMAIL TIME

log email time

Overview This command configures the time used in messages sent to an email address. If

the syslog server is in a different time zone to your device then the time offset can

be configured using either the utc-offset parameter option keyword or the

local-offset parameter option keyword, where utc-offset is the time difference

from UTC (Universal Time, Coordinated) and local-offset is the difference from

local time.

Syntax log email <email-address> time {local|local-offset|utc-offset

{plus|minus}<0-24>}

Default The default is local time.

Mode Global Configuration

Usage Use the local option if the email recipient is in the same time zone as this device.

Messages will display the time as on the local device when the message was

generated.

Use the offset option if the email recipient is in a different time zone to this device.

Specify the time offset of the email recipient in hours. Messages will display the

time they were generated on this device but converted to the time zone of the

email recipient.

Parameter Description

<email-address> The email address to send log messages to

time Specify the time difference between the email recipient and the

device you are configuring.

local The device is in the same time zone as the email recipient

local-offset The device is in a different time zone to the email recipient. Use

the plus or minus keywords and specify the difference (offset)

from local time of the device to the email recipient in hours.

utc-offset The device is in a different time zone to the email recipient. Use

the plus or minus keywords and specify the difference (offset)

from UTC time of the device to the email recipient in hours.

plus Negative offset (difference) from the device to the email

recipient.

minus Positive offset (difference) from the device to the email

recipient.

<0-24> World Time zone offset in hours

C613-50292-01 Rev A Command Reference for IE210L Series 371

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EMAIL TIME

Examples To send messages to the email address test@home.com in the same time zone

as the device’s local time zone, use the following commands:

awplus# configure terminal

awplus(config)# log email admin@base.com time local 0

To send messages to the email address admin@base.com with the time

information converted to the time zone of the email recipient, which is 3 hours

ahead of the device’s local time zone, use the following commands:

awplus# configure terminal

awplus(config)# log email admin@base.com time local-offset plus

To send messages to the email address user@remote.com with the time

information converted to the time zone of the email recipient, which is 3 hours

behind the device’s UTC time zone, use the following commands:

awplus# configure terminal

awplus(config)# log email user@remote.com time utc-offset minus

Commands

default log email

log email

log email (filter)

log email exclude

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 372

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL

log external

Overview Use this command to enable external logging. External logging sends syslog

messages to a file on an SD card.

If the file does not already exist on the storage device, it (and any specified

subdirectory) will be automatically created. If the file already exists, messages are

appended to it.

Use the no variant of this command to disable external logging.

Syntax log external <filename>

no log external

Default External logging is disabled by default.

Mode Global Configuration

Usage We strongly recommend using ext3 or ext4 as the file system on the external

storage device. These file systems have a lower risk of file corruption occurring if

the switch or firewall loses power.

You should also unmount the storage device before removing it from the switch

or firewall, to avoid corrupting the log file. To unmount the device, use the

unmount command.

Example To save messages to a file called “messages.log” in a directory called “log” on an SD

card, use the command:

awplus# configure terminal

awplus(config)# log external card:/log/messages.log

Commands

clear log external

default log external

log external (filter)

log external exclude

log external rotate

log external size

show log config

show log external

unmount

Parameter Description

<filename> The file and optionally directory path to store the log messages in.

See Introduction on page 84 for valid syntax.

C613-50292-01 Rev A Command Reference for IE210L Series 373

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL

Command

changes

Version 5.4.7-1.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 374

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL (FILTER)

log external (filter)

Overview Use this command to create a filter to select messages to be sent to the external

log. You can include messages based on:

• the priority/severity of the message

• the program that generated the message

• the logging facility used

• a sub-string within the message, or

• a combination of some or all of these.

The no variant of this command removes the corresponding filter, so that the

specified messages are no longer sent to the external log.

Syntax log external [level <level>] [program <program-name>] [facility

<facility>] [msgtext <text-string>]

no log external [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

level Filter messages to the external log by severity level.

<level>The minimum severity of message to send to the external log. The level can be specified as

one of the following numbers or level names, where 0 is the highest severity and 7 is the

lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Filter messages to the external log by program. Include messages from a specified program in

the external log.

<program-

name>The name of a program to log messages from. You can enter either one of the following

predefined program names (depending on your device model), or another program name

that you find in the log output. The pre-defined names are not case sensitive but other

program names from the log output are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

C613-50292-01 Rev A Command Reference for IE210L Series 375

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL (FILTER)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Filter messages to the external log by syslog facility.

<facility>Specify one of the following syslog facilities to include messages from in the log:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 376

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL (FILTER)

Default By default the external log has a filter to select messages whose severity level is

“notices (5)” or higher. This filter may be removed using the no variant of this

command.

Mode Global Configuration

Examples To add a filter to send all messages generated by EPSR that have a severity of

notices or higher to the external log, use the following commands:

awplus# configure terminal

awplus(config)# log external level notices program epsr

To add a filter to send all messages containing the text “Bridging initialization” to

the external log, use the following commands:

awplus# configure terminal

awplus(config)# log external msgtext Bridging initialization

To remove a filter that sends all messages generated by EPSR that have a severity

of notices or higher to the external log, use the following commands:

awplus# configure terminal

awplus(config)# no log external level notices program epsr

To remove a filter that sends all messages containing the text “Bridging

initialization” to the external log, use the following commands:

awplus# configure terminal

awplus(config)# no log external msgtext Bridging initialization

Commands

clear log external

default log external

log external

log external exclude

log external rotate

log external size

show log config

show log external

unmount

Command

changes

Version 5.4.7-1.1: command added

msgtext Select messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 377

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL EXCLUDE

log external exclude

Overview Use this command to exclude specified log messages from the external log. You

can exclude messages on the basis of:

• the priority/severity of the message

• the program that generated the message

• the logging facility used

• a sub-string within the message, or

• a combination of some or all of these.

Use the no variant of this command to stop excluding the specified messages.

Syntax log external exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

no log external exclude [level <level>] [program

<program-name>] [facility <facility>] [msgtext <text-string>]

Parameter Description

level Exclude messages of the specified severity level.

<level>The severity level to exclude. The level can be specified as one of the following numbers or

level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Exclude messages from a specified program.

<program-

name>The name of a program. You can enter either one of the following predefined program names

(depending on your device model), or another program name that you find in the log output.

The pre-defined names are not case sensitive but other program names from the log output

are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

C613-50292-01 Rev A Command Reference for IE210L Series 378

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL EXCLUDE

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Exclude messages from a syslog facility.

<facility>Specify one of the following syslog facilities to exclude messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

msgtext Exclude messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 379

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL EXCLUDE

Default No log messages are excluded

Mode Global Configuration

Example To remove messages that contain the string “example of irrelevant message”, use

the following commands:

awplus# configure terminal

awplus(config)# log external exclude msgtext example of

irrelevant message

Commands

clear log external

default log external

log external

log external (filter)

log external rotate

log external size

show log config

show log external

unmount

Command

changes

Version 5.4.7-1.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 380

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL ROTATE

log external rotate

Overview Use this command to configure the number of files that the external log can rotate

through.

Use the no variant of this command to return to the default.

Syntax log external rotate <0-255>

no log external rotate

Default The default is 1, which rotates between the initial file and 1 additional file (for

example, rotates between messages.log and messages.log.1)

Mode Global Configuration

Usage The device rotates between the initial file and the number of additional files

specified by this command. For example, the diagram below shows how setting

rotate to 2 makes the device rotate through 3 files.

Note that if you set rotate to 0, and the external log file becomes full, then the

device deletes the full log file and creates a new (empty) file of the same name to

save messages into. For this reason, we recommend setting rotate to at least 1.

Example To set the rotation value to 2, and therefore rotate between 3 files, use the

commands:

awplus# configure terminal

awplus(config)# log external rotate 2

Parameter Description

<0-255> The number of additional files to rotate through. Note that the

device rotates between the initial file and the number of

additional files specified by this value - see the Usage section

below.

3UBSEQUENTROTATION3ECONDROTATION&IRSTROTATION3TARTOFLOGGING

MESSAGESLOG MESSAGESLOG MESSAGESLOGMESSAGESLOG

MESSAGESLOG MESSAGESLOG MESSAGESLOG

MESSAGESLOG MESSAGESLOG

LOG

EXTERNAL

SIZE

RENAMEDTO

DELETED

RENAMEDTO

C613-50292-01 Rev A Command Reference for IE210L Series 381

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL ROTATE

Commands

clear log external

default log external

log external

log external (filter)

log external exclude

log external size

show log config

show log external

unmount

Command

changes

Version 5.4.7-1.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 382

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG EXTERNAL SIZE

log external size

Overview Use this command to configure the total amount of size that the external log is

permitted to use, in kilobytes. The maximum possible depends on the storage

device’s file system.

Note that if you are rotating between multiple files, this is the maximum size of all

files, not of each individual file. For example, if you are rotating between 2 files (log

external rotate 1), each file will have a maximum size of 25 kBytes by default.

Use the no variant of this command to return to the default size.

Syntax log external size [<50-4194304>]

no log external size

Default 50 kBytes

Mode Global Configuration

Example To configure a total log size of 100 kBytes, use the commands:

awplus# configure terminal

awplus(config)# log external size 100

Commands

clear log external

default log external

log external

log external (filter)

log external exclude

log external rotate

log external size

show log config

show log external

unmount

Command

changes

Version 5.4.7-1.1: command added

Parameter Description

<50-4194304> The total amount of size that the external log is permitted to use,

in kilobytes.

C613-50292-01 Rev A Command Reference for IE210L Series 383

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG FACILITY

log facility

Overview Use this command to assign a facility to all log messages generated on this device.

This facility overrides any facility that is automatically generated as part of the log

message.

Use the no variant of this command to remove the configured facility.

Syntax log facility {kern|user|mail|daemon|auth|syslog|lpr|news|uucp|

local6|local7}

no log facility

Default None. The outgoing syslog facility depends on the log message.

Mode Global Configuration

Usage Specifying different facilities for log messages generated on different devices can

allow messages from multiple devices sent to a common server to be

distinguished from each other.

Ordinarily, the facility values generated in log messages have meanings as shown

in the following table. Using this command will override these meanings, and the

new meanings will depend on the use you put them to.

Table 10-1: Ordinary meanings of the facility parameter in log messages

Facility Description

kern Kernel messages

user User-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by the syslog daemon

lpr Line printer subsystem

news Network news subsystem

uucp UNIX-to-UNIX Copy Program subsystem

cron Clock daemon

authpriv Security/authorization (private) messages

C613-50292-01 Rev A Command Reference for IE210L Series 384

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG FACILITY

Example To specify a facility of local6, use the following commands:

awplus# configure terminal

awplus(config)# log facility local6

Commands

show log config

ftp FTP daemon

local<0..7>The facility labels above have specific meanings, while the

local facility labels are intended to be put to local use. In

AlliedWare Plus, some of these local facility labels are used

in log messages. In particular, local5 is assigned to log

messages generated by UTM Firewall security features.

Table 10-1: Ordinary meanings of the facility parameter in log messages (cont.)

Facility Description

C613-50292-01 Rev A Command Reference for IE210L Series 385

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST

log host

Overview This command configures the device to send log messages to a remote syslog

server via UDP port 514. The IP address of the remote server must be specified. By

default no filters are defined for remote syslog servers. Filters must be defined

before messages will be sent.

Use the no variant of this command to stop sending log messages to the remote

syslog server.

Syntax log host <ipv4-addr> [secure]

log host <ipv6-addr>

no log host <ipv4-addr>|<ipv6-addr>

Mode Global Configuration

Usage Use the optional secure parameter to configure a secure IPv4 syslog host. For

secure hosts, syslog over TLS is used to encrypt the logs. The certificate received

from the remote log server must have an issuer chain that terminates with the root

CA certificate for any of the trustpoints that are associated with the application.

The remote server may also request that a certificate is transmitted from the local

device. In this situation the first trustpoint added to the syslog application will be

transmitted to the remote server.

For detailed information about securing syslog, see the PKI Feature Overview_and

Configuration_Guide.

Examples To configure the device to send log messages to a remote secure syslog server with

IP address 10.32.16.99, use the following commands:

awplus# configure terminal

awplus(config)# log host 10.32.16.99 secure

To stop the device from sending log messages to the remote syslog server with IP

address 10.32.16.99, use the following commands:

awplus# configure terminal

awplus(config)# no log host 10.32.16.99

Commands

default log host

log host (filter)

Parameter Description

<ipv4-addr>Specify the source IPv4 address, in dotted decimal notation (A.B.C.D).

<ipv6-addr> Specify the source IPv6 address, in X:X::X:X notation.

secure Optional value to create a secure log destination. This option is only

valid for IPv4 hosts.

C613-50292-01 Rev A Command Reference for IE210L Series 386

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST

log host exclude

log host source

log host startup-delay

log host time

log trustpoint

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 387

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST (FILTER)

log host (filter)

Overview This command creates a filter to select messages to be sent to a remote syslog

server. Selection can be based on the priority/severity of the message, the program

that generated the message, the logging facility used, a substring within the

message or a combination of some or all of these.

The no variant of this command configures the device to no longer send log

messages to a remote syslog server. The IP address of the syslog server must be

specified. All configuration relating to this log target will be removed.

Syntax log host <ip-addr> [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

no log host <ip-addr> [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

<ip-addr> The IP address of a remote syslog server.

level Filter messages by severity level.

<level>The minimum severity of message to send. The level can be specified as one of the following

numbers or level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Filter messages by program. Include messages from a specified program.

<program-

name>The name of a program to log messages from. You can enter either one of the following

predefined program names (depending on your device model), or another program name

that you find in the log output. The pre-defined names are not case sensitive but other

program names from the log output are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

C613-50292-01 Rev A Command Reference for IE210L Series 388

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST (FILTER)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Filter messages by syslog facility.

<facility>Specify one of the following syslog facilities to include messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

msgtext Select messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 389

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST (FILTER)

Mode Global Configuration

Examples To create a filter to send all messages generated by EPSR that have a severity of

notices or higher to a remote syslog server with IP address 10.32.16.21, use the

following commands:

awplus# configure terminal

awplus(config)# log host 10.32.16.21 level notices program epsr

To create a filter to send all messages containing the text “Bridging initialization”,

to a remote syslog server with IP address 10.32.16.21, use the following

commands:

awplus# configure terminal

awplus(config)# log host 10.32.16.21 msgtext "Bridging

initialization"

To create a filter to send messages with a severity level of informational and

above to the syslog server with IP address 10.32.16.21, use the following

commands:

awplus# configure terminal

awplus(config)# log host 10.32.16.21 level informational

To remove a filter that sends all messages generated by EPSR that have a severity

of notices or higher to a remote syslog server with IP address 10.32.16.21, use the

following commands:

awplus# configure terminal

awplus(config)# no log host 10.32.16.21 level notices program

epsr

To remove a filter that sends all messages containing the text “Bridging

initialization”, to a remote syslog server with IP address 10.32.16.21, use the

following commands:

awplus# configure terminal

awplus(config)# no log host 10.32.16.21 msgtext "Bridging

initialization"

To remove a filter that sends messages with a severity level of informational and

above to the syslog server with IP address 10.32.16.21, use the following

commands:

awplusawpluls# configure terminal

awplus(config)# no log host 10.32.16.21 level informational

Commands

default log host

log host

log host exclude

log host source

log host time

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 390

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST EXCLUDE

log host exclude

Overview Use this command to prevent specified log messages from being sent to the

remote syslog server, when log host is enabled. You can exclude messages on the

basis of:

• the priority/severity of the message

• the program that generated the message

• the logging facility used

• a sub-string within the message, or

• a combination of some or all of these.

Use the no variant of this command to stop excluding the specified messages.

Syntax log host exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

no log host exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

level Exclude messages of the specified severity level.

<level>The severity level to exclude. The level can be specified as one of the following numbers or

level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Exclude messages from a specified program.

<program-

name>The name of a program. You can enter either one of the following predefined program names

(depending on your device model), or another program name that you find in the log output.

The pre-defined names are not case sensitive but other program names from the log output

are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

C613-50292-01 Rev A Command Reference for IE210L Series 391

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST EXCLUDE

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Exclude messages from a syslog facility.

<facility>Specify one of the following syslog facilities to exclude messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 392

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST EXCLUDE

Default No log messages are excluded

Mode Global configuration

Example To remove messages that contain the string “example of irrelevant message”, use

the following commands:

awplus# configure terminal

awplus(config)# log host exclude msgtext example of irrelevant

message

Commands

default log host

log host

log host (filter)

log host source

log host time

show log config

msgtext Exclude messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 393

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST SOURCE

log host source

Overview Use this command to specify a source interface or IP address for the device to send

syslog messages from. You can specify any one of an interface name, an IPv4

address or an IPv6 address.

This is useful if the device can reach the syslog server via multiple interfaces or

addresses and you want to control which interface/address the device uses.

Note that AlliedWare Plus does not support source interface settings on secure log

hosts (which are hosts configured using “log host <ip-address> secure”).

Use the no variant of this command to stop specifying a source interface or

address.

Syntax log host source {<interface-name>|<ipv4-addr>|<ipv6-addr>}

no log host source

Default None (no source is configured)

Mode Global Configuration

Example To send syslog messages from 192.168.1.1, use the commands:

awplus# configure terminal

awplus(config)# log host source 192.168.1.1

Commands

default log host

log host

log host (filter)

log host exclude

log host time

show log config

Parameter Description

<interface-name> Specify the source interface name. You can enter a VLAN, eth

interface or loopback interface.

<ipv4-addr> Specify the source IPv4 address, in dotted decimal notation

(A.B.C.D).

<ipv6-addr> Specify the source IPv6 address, in X:X::X:X notation.

C613-50292-01 Rev A Command Reference for IE210L Series 394

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST STARTUP-DELAY

log host startup-delay

Overview Use this command to set the delay between the device booting up and it

attempting to connect to remote log hosts. This is to allow time for network

connectivity to the remote host to be established. During this period, the device

buffers log messages and sends them once it has connected to the remote host.

The startup delay begins when the message "syslog-ng starting up" appears in the

log.

If the default startup delay is not long enough for the boot and configuration

process to complete and the links to come up, you may see logging failure

messages on startup. In these cases, you can use the command to increase the

startup delay.

Use the no variant of this command to return to the default delay values.

Syntax log host startup-delay [delay <1-600>] [messages <1-5000>]

no log host startup-delay

Default By default the system will buffer up to 2000 messages and wait 120 seconds from

when syslog starts before attempting to filter and transmit the buffered messages

to remote hosts.

Mode Global Configuration

Example To increase the delay to 180 seconds, use the commands:

awplus# configure terminal

awplus(config)# log host startup-delay delay 180

Commands

default log host

log host (filter)

log host exclude

log host source

log host time

log trustpoint

show log config

Parameter Description

delay <1-600> The time, in seconds, from when syslog starts before the

device attempts to filter and transmit the buffered

messages to remote hosts.

messages <1-5000>The maximum number of messages that the device will

buffer during the delay period.

C613-50292-01 Rev A Command Reference for IE210L Series 395

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST STARTUP-DELAY

Command

changes

Version 5.4.8-0.2: defaults changed

C613-50292-01 Rev A Command Reference for IE210L Series 396

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST TIME

log host time

Overview This command configures the time used in messages sent to a remote syslog

server. If the syslog server is in a different time zone to your device then the time

offset can be configured using either the utc-offset parameter option keyword or

the local-offset parameter option keyword, where utc-offset is the time

difference from UTC (Universal Time, Coordinated) and local-offset is the

difference from local time.

Syntax log host <email-address> time {local|local-offset|utc-offset

{plus|minus} <0-24>}

Default The default is local time.

Mode Global Configuration

Usage Use the local option if the remote syslog server is in the same time zone as the

device. Messages will display the time as on the local device when the message

was generated.

Use the offset option if the email recipient is in a different time zone to this device.

Specify the time offset of the remote syslog server in hours. Messages will display

the time they were generated on this device but converted to the time zone of the

remote syslog server.

Examples To send messages to the remote syslog server with the IP address 10.32.16.21

in the same time zone as the device’s local time zone, use the following

commands:

awplus# configure terminal

awplus(config)# log host 10.32.16.21 time local 0

Parameter Description

<email-address> The email address to send log messages to

time Specify the time difference between the email recipient and the

device you are configuring.

local The device is in the same time zone as the email recipient

local-offset The device is in a different time zone to the email recipient. Use

the plus or minus keywords and specify the difference (offset)

from local time of the device to the email recipient in hours.

utc-offset The device is in a different time zone to the email recipient. Use

the plus or minus keywords and specify the difference (offset)

from UTC time of the device to the email recipient in hours.

plus Negative offset (difference) from the device to the syslog server.

minus Positive offset (difference) from the device to the syslog server.

<0-24> World Time zone offset in hours

C613-50292-01 Rev A Command Reference for IE210L Series 397

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG HOST TIME

To send messages to the remote syslog server with the IP address 10.32.16.12

with the time information converted to the time zone of the remote syslog server,

which is 3 hours ahead of the device’s local time zone, use the following

commands:

awplus# configure terminal

awplus(config)# log host 10.32.16.12 time local-offset plus 3

To send messages to the remote syslog server with the IP address 10.32.16.02

with the time information converted to the time zone of the email recipient, which

is 3 hours behind the device’s UTC time zone, use the following commands:

awplus# configure terminal

awplus(config)# log host 10.32.16.02 time utc-offset minus 3

Commands

default log host

log host

log host (filter)

log host exclude

log host source

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 398

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG MONITOR (FILTER)

log monitor (filter)

Overview This command creates a filter to select messages to be sent to the terminal when

the terminal monitor command is given. Selection can be based on the

priority/severity of the message, the program that generated the message, the

logging facility used, a sub-string within the message or a combination of some or

all of these.

Syntax log monitor [level <level>] [program <program-name>] [facility

<facility>] [msgtext <text-string>]

no log monitor [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

level Filter messages by severity level.

<level>The minimum severity of message to send. The level can be specified as one of the following

numbers or level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Filter messages by program. Include messages from a specified program.

<program-

name>The name of a program to log messages from. You can enter either one of the following

predefined program names (depending on your device model), or another program name

that you find in the log output. The pre-defined names are not case sensitive but other

program names from the log output are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

C613-50292-01 Rev A Command Reference for IE210L Series 399

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG MONITOR (FILTER)

Default By default there is a filter to select all messages. This filter may be removed and

replaced by filters that are more selective.

Mode Global Configuration

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Filter messages by syslog facility.

<facility>Specify one of the following syslog facilities to include messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

msgtext Select messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 400

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG MONITOR (FILTER)

Examples To create a filter to send all messages that are generated by authentication and

have a severity of info or higher to terminal instances where the terminal monitor

command has been given, use the following commands:

awplus# configure terminal

awplus(config)# log monitor level info program auth

To remove a filter that sends all messages generated by EPSR that have a severity

of notices or higher to the terminal, use the following commands:

awplus# configure terminal

awplus(config)# no log monitor level notices program epsr

To remove a default filter that includes sending everything to the terminal, use the

following commands:

awplus# configure terminal

awplus(config)# no log monitor level debugging

Commands

default log monitor

log monitor exclude

show log config

terminal monitor

C613-50292-01 Rev A Command Reference for IE210L Series 401

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG MONITOR EXCLUDE

log monitor exclude

Overview Use this command to prevent specified log messages from being displayed on a

terminal, when terminal monitor is enabled. You can exclude messages on the

basis of:

• the priority/severity of the message

• the program that generated the message

• the logging facility used

• a sub-string within the message, or

• a combination of some or all of these.

Use the no variant of this command to stop excluding the specified messages.

Syntax log console exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

no log console exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

level Exclude messages of the specified severity level.

<level>The severity level to exclude. The level can be specified as one of the following numbers or

level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Exclude messages from a specified program.

<program-

name>The name of a program. You can enter either one of the following predefined program names

(depending on your device model), or another program name that you find in the log output.

The pre-defined names are not case sensitive but other program names from the log output

are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

C613-50292-01 Rev A Command Reference for IE210L Series 402

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG MONITOR EXCLUDE

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Exclude messages from a syslog facility.

<facility>Specify one of the following syslog facilities to exclude messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 403

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG MONITOR EXCLUDE

Default No log messages are excluded

Mode Global configuration

Example To remove messages that contain the string “example of irrelevant message”, use

the following commands:

awplus# configure terminal

awplus(config)# log monitor exclude msgtext example of

irrelevant message

Commands

default log monitor

log monitor (filter)

show log config

terminal monitor

msgtext Exclude messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 404

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG PERMANENT

log permanent

Overview This command configures the device to send permanent log messages to Flash

memory on the device. The content of the permanent log is retained over a reboot.

Once the permanent log reaches its configured maximum allowable size old

messages will be deleted to make way for new messages.

The no variant of this command configures the device not to send any messages

to the permanent log. Log messages will not be retained over a restart.

Syntax log permanent

no log permanent

Mode Global Configuration

Examples To enable permanent logging use the following commands:

awplus# configure terminal

awplus(config)# log permanent

To disable permanent logging use the following commands:

awplus# configure terminal

awplus(config)# no log permanent

Commands

clear log permanent

copy permanent-log

default log permanent

log permanent (filter)

log permanent exclude

log permanent size

show log config

show log permanent

C613-50292-01 Rev A Command Reference for IE210L Series 405

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG PERMANENT (FILTER)

log permanent (filter)

Overview This command creates a filter to select messages to be sent to the permanent log.

Selection can be based on the priority/ severity of the message, the program that

generated the message, the logging facility used, a sub-string within the message

or a combination of some or all of these.

The no variant of this command removes the corresponding filter, so that the

specified messages are no longer sent to the permanent log.

Syntax log permanent [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

no log permanent [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

Parameter Description

level Filter messages sent to the permanent log by severity level.

<level>The minimum severity of message to send. The level can be specified as one of the following

numbers or level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Filter messages by program. Include messages from a specified program.

<program-

name>The name of a program to log messages from. You can enter either one of the following

predefined program names (depending on your device model), or another program name

that you find in the log output. The pre-defined names are not case sensitive but other

program names from the log output are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

C613-50292-01 Rev A Command Reference for IE210L Series 406

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG PERMANENT (FILTER)

Default By default the buffered log has a filter to select messages whose severity level is

notices (5) or higher. This filter may be removed using the no variant of this

command.

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Filter messages by syslog facility.

<facility>Specify one of the following syslog facilities to include messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

msgtext Select messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 407

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG PERMANENT (FILTER)

Mode Global Configuration

Examples To create a filter to send all messages generated by EPSR that have a severity of

notices or higher to the permanent log use the following commands:

awplus# configure terminal

awplus(config)# log permanent level notices program epsr

To create a filter to send all messages containing the text “Bridging

initialization”, to the permanent log use the following commands:

awplus# configure terminal

awplus(config)# log permanent msgtext Bridging initialization

Commands

clear log permanent

default log permanent

log permanent

log permanent exclude

log permanent size

show log config

show log permanent

C613-50292-01 Rev A Command Reference for IE210L Series 408

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG PERMANENT EXCLUDE

log permanent exclude

Overview Use this command to prevent specified log messages from being sent to the

permanent log. You can exclude messages on the basis of:

• the priority/severity of the message

• the program that generated the message

• the logging facility used

• a sub-string within the message, or

• a combination of some or all of these.

Use the no variant of this command to stop excluding the specified messages.

Syntax log permanent exclude [level <level>] [program <program-name>]

[facility <facility>] [msgtext <text-string>]

no log permanent exclude [level <level>] [program

<program-name>] [facility <facility>] [msgtext <text-string>]

Parameter Description

level Exclude messages of the specified severity level.

<level>The severity level to exclude. The level can be specified as one of the following numbers or

level names, where 0 is the highest severity and 7 is the lowest severity:

0|emergencies System is unusable

1|alerts Action must be taken immediately

2|critical Critical conditions

3|errors Error conditions

4|warnings Warning conditions

5|notices Normal, but significant, conditions

6|informational Informational messages

7|debugging Debug-level messages

program Exclude messages from a specified program.

<program-

name>The name of a program. You can enter either one of the following predefined program names

(depending on your device model), or another program name that you find in the log output.

The pre-defined names are not case sensitive but other program names from the log output

are.

rip Routing Information Protocol (RIP)

ripng Routing Information Protocol - next generation (RIPng)

ospf Open Shortest Path First (OSPF)

ospfv3 Open Shortest Path First (OSPF) version 3 (OSPFv3)

bgp Border Gateway Protocol (BGP)

C613-50292-01 Rev A Command Reference for IE210L Series 409

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG PERMANENT EXCLUDE

rsvp Resource Reservation Protocol (RSVP)

pim-dm Protocol Independent Multicast - Dense Mode (PIM-DM)

pim-sm Protocol Independent Multicast - Sparse Mode (PIM-SM)

pim-smv6 PIM-SM version 6 (PIM-SMv6)

dot1x IEEE 802.1X Port-Based Access Control

lacp Link Aggregation Control Protocol (LACP)

stp Spanning Tree Protocol (STP)

rstp Rapid Spanning Tree Protocol (RSTP)

mstp Multiple Spanning Tree Protocol (MSTP)

imi Integrated Management Interface (IMI)

imish Integrated Management Interface Shell (IMISH)

epsr Ethernet Protection Switched Rings (EPSR)

irdp ICMP Router Discovery Protocol (IRDP)

rmon Remote Monitoring

loopprot Loop Protection

poe Power-inline (Power over Ethernet)

dhcpsn DHCP snooping (DHCPSN)

facility Exclude messages from a syslog facility.

<facility>Specify one of the following syslog facilities to exclude messages from:

kern Kernel messages

user Random user-level messages

mail Mail system

daemon System daemons

auth Security/authorization messages

syslog Messages generated internally by syslogd

lpr Line printer subsystem

news Network news subsystem

uucp UUCP subsystem

cron Clock daemon

authpriv Security/authorization messages (private)

ftp FTP daemon

msgtext Exclude messages containing a certain text string.

<text-

string>A text string to match (maximum 128 characters). This is case sensitive, and must be the last

text on the command line.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 410

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG PERMANENT EXCLUDE

Default No log messages are excluded

Mode Global configuration

Example To remove messages that contain the string “example of irrelevant message”, use

the following commands:

awplus# configure terminal

awplus(config)# log permanent exclude msgtext example of

irrelevant message

Commands

clear log permanent

default log permanent

log permanent

log permanent (filter)

log permanent size

show log config

show log permanent

C613-50292-01 Rev A Command Reference for IE210L Series 411

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG PERMANENT SIZE

log permanent size

Overview This command configures the amount of memory that the permanent log is

permitted to use. Once this memory allocation has been filled old messages will be

deleted to make room for new messages.

Syntax log permanent size <50-250>

Mode Global Configuration

Example To allow the permanent log to use up to 100 kB of Flash use the following

commands:

awplus# configure terminal

awplus(config)# log permanent size 100

Commands

clear log permanent

copy permanent-log

default log permanent

log permanent

log permanent (filter)

log permanent exclude

show log config

show log permanent

Parameter Description

<50-250>Size of the permanent log in kilobytes

C613-50292-01 Rev A Command Reference for IE210L Series 412

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG-RATE-LIMIT NSM

log-rate-limit nsm

Overview This command limits the number of log messages generated by the device for a

given interval.

Use the no variant of this command to revert to the default number of log

messages generated by the device of up to 200 log messages per second.

Syntax log-rate-limit nsm messages <message-limit> interval

<time-interval>

no log-rate-limit nsm

Default By default, the device will allow 200 log messages to be generated per second.

Mode Global Configuration

Usage This log rate limiting feature constrains the rate that log messages are generated

by the device. This makes sure that the device does not run out of memory from

generating a lot of log messages in extreme circumstances, such as if a packet

storm occurs.

Note that if within the given time interval, the number of log messages exceeds the

limit, then any excess log messages are discarded. At the end of the time interval,

a single log message is generated indicating that log messages were discarded

due to the log rate limit being exceeded.

If you expect that there will be a lot of discarded log messages due to log rate

limiting, then we recommend setting the time interval to no less than 100, which

means that there would only be one log message, indicating excessive log

messages have been discarded.

Examples To limit the device to generate up to 300 log messages per second, use the

following commands:

awplus# configure terminal

awplus(config)# log-rate-limit nsm messages 300 interval 100

To return the device the default setting, to generate up to 200 log messages per

second, use the following commands:

awplus# configure terminal

awplus(config)# no log-rate-limit nsm

Parameter Description

<message-limit><1-65535>

The number of log messages generated by the device.

<time-interval><0-65535>

The time period for log message generation in 1/100 seconds.

If an interval of 0 is specified then no log message rate limiting

is applied.

C613-50292-01 Rev A Command Reference for IE210L Series 413

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

LOG TRUSTPOINT

log trustpoint

Overview This command adds one or more trustpoints to be used with the syslog

application. Multiple trustpoints may be specified, or the command may be

executed multiple times, to add multiple trustpoints to the application.

The no version of this command removes one or more trustpoints from the list of

trustpoints associated with the application.

Syntax log trustpoint [<trustpoint-list>]

no log trustpoint [<trustpoint-list>]

Default No trustpoints are created by default.

Mode Global Configuration

Usage The device certificate associated with first trustpoint added to the application will

be transmitted to remote servers. The certificate received from the remote server

must have an issuer chain that terminates with the root CA certificate for any of the

trustpoints that are associated with the application.

If no trustpoints are specified in the command, the trustpoint list will be

unchanged.

If no log trustpoint is issued without specifying any trustpoints, then all

trustpoints will be disassociated from the application.

Example You can add multiple trustpoints by executing the command multiple times:

awplus# configure terminal

awplus(config)# log trustpoint trustpoint_1

awplus(config)# log trustpoint trustpoint_2

Alternatively, add multiple trustpoints with a single command:

awplus(config)# log trustpoint trustpoint_2 trustpoint_3

Disassociate all trustpoints from the syslog application using the command:

awplus(config)# log trustpoint trustpoint_2 trustpoint_3

Commands

log host

show log config

Parameter Description

<trustpoint-list> Specify one or more trustpoints to be added or deleted.

C613-50292-01 Rev A Command Reference for IE210L Series 414

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

SHOW COUNTER LOG

show counter log

Overview This command displays log counter information.

Syntax show counter log

Mode User Exec and Privileged Exec

Example To display the log counter information, use the command:

awplus# show counter log

Output Figure 10-1: Example output from the show counter log command

Commands

show log config

Log counters

Total Received ......... 2328

Total Received P0 ......... 0

Total Received P1 ......... 0

Total Received P2 ......... 1

Total Received P3 ......... 9

Total Received P4 ......... 32

Total Received P5 ......... 312

Total Received P6 ......... 1602

Total Received P7 ......... 372

Table 11: Parameters in output of the show counter log command

Parameter Description

Total Received Total number of messages received by the log

Total Received P0 Total number of Priority 0 (Emergency) messages

received

Total Received P1 Total number of Priority 1 (Alert) messages received

Total Received P2 Total number of Priority 2 (Critical) messages received

Total Received P3 Total number of Priority 3 (Error) messages received

Total Received P4 Total number of Priority 4 (Warning) messages received

Total Received P5 Total number of Priority 5 (Notice) messages received

Total Received P6 Total number of Priority 6 (Info) messages received

Total Received P7 Total number of Priority 7 (Debug) messages received

C613-50292-01 Rev A Command Reference for IE210L Series 415

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

SHOW EXCEPTION LOG

show exception log

Overview This command displays the contents of the exception log.

Syntax show exception log

Mode User Exec and Privileged Exec

Example To display the exception log, use the command:

awplus# show exception log

Output Figure 10-2: Example output from the show exception log command on a

device

Output Figure 10-3: Example output from the show exception log command on a

device that has never had an exception occur

awplus#show exception log



Stack member 1:



<date> <time> <facility>.<severity> <program[<pid>]>: <message>

-------------------------------------------------------------------------

2019 Apr 08 07:56:19 local7.debug awplus c orehandler : Proce ss imi (PID:1041) s ignal

11, core dumped to /flash/imi-test-1-1554663379-1041.tgz

-------------------------------------------------------------------------

awplus#show exception log

<date> <time> <facility>.<severity> <program[<pid>]>: <message>

-------------------------------------------------------------------------

None

-------------------------------------------------------------------------

awplus#

C613-50292-01 Rev A Command Reference for IE210L Series 416

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

SHOW LOG

show log

Overview This command displays the contents of the buffered log.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare_Plus” Feature Overview and Configuration Guide.

Syntax show log [tail [<10-250>]]

Default By default the entire contents of the buffered log is displayed.

Mode User Exec, Privileged Exec and Global Configuration

Usage If the optional tail parameter is specified, only the latest 10 messages in the

buffered log are displayed. A numerical value can be specified after the tail

parameter to select how many of the latest messages should be displayed.

The show log command is only available to users at privilege level 7 and above. To

set a user’s privilege level, use the command:

awplus(config)# username <name> privilege <1-15>

Examples To display the contents of the buffered log use the command:

awplus# show log

To display the 10 latest entries in the buffered log use the command:

awplus# show log tail 10

Parameter Description

tail Display only the latest log entries.

<10-250>Specify the number of log entries to display.

C613-50292-01 Rev A Command Reference for IE210L Series 417

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

SHOW LOG

Output Figure 10-4: Example output from show log

Commands

clear log buffered

copy buffered-log

default log buffered

log buffered

log buffered (filter)

log buffered size

log buffered exclude

show log config

awplus#show log



<date> <time> <facility>.<severity> <program[<pid>]>: <message>

-------------------------------------------------------------------------

2019 May 25 09:42:51 kern.notice awplus kernel: Linux version 4.4.6-at1

(maker@maker03-build) (gcc version 4.9.3 (crosstool-NG crossto ol-ng-1.22.0) ) #1 SMP

Thu May 24 06:19:06 UTC 2018

2019 May 25 09:42:51 syslog.notice awplus syslog-ng[274]: syslog-ng starting up;

version='3.10.1'

2019 May 25 09:42:51 kern.notice awplus kernel: Kernel command line:

console=ttyS0,115200 root=/dev/ram0 releasefile=IE210-tb200.rel bootversion=3.2.6

loglevel=1 extraflash=04000000 mtdoops.mtdd

ev=errlog securitylevel=1 ramdisk=19064 relhdr=1644167168,1647057220

2019 May 25 09:42:51 kern.notice awplus kernel: Virtual kernel memory layout:

2019 May 25 09:42:51 kern.notice awplus kernel: vector : 0xffff0000 - 0xffff1000

( 4 kB)

2019 May 25 09:42:51 kern.notice awplus kernel: fixmap : 0xffc00000 - 0xfff00000

(3072 kB)

2019 May 25 09:42:51 kern.notice awplus kernel: vmalloc : 0xe0800000 - 0xff800000

( 496 MB)

2019 May 25 09:42:51 kern.notice awplus kernel: lowmem : 0xc0000000 - 0xe0000000

( 512 MB)

...

C613-50292-01 Rev A Command Reference for IE210L Series 418

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

SHOW LOG CONFIG

show log config

Overview This command displays information about the logging system. This includes the

configuration of the various log destinations, such as buffered, permanent, syslog

servers (hosts) and email addresses. This also displays the latest status information

for each log destination.

Syntax show log config

Mode User Exec, Privileged Exec and Global Configuration

Example To display the logging configuration use the command:

awplus# show log config

Output Figure 10-5: Example output from show log config

Facility: default



PKI trustpoints: example_trustpoint



Buffered log:

Status ......... enabled

Maximum size ... 100kb

Filters:

*1 Level ........ notices

Program ...... any

Facility ..... any

Message text . any

2 Level ........ informational

Program ...... auth

Facility ..... daemon

Message text . any

Statistics ..... 1327 messages received, 821 accepted by filter (2016 Oct 11 

10:36:16)

Permanent log:

Status ......... enabled

Maximum size ... 60kb

Filters:

1 Level ........ error

Program ...... any

Facility ..... any

Message text . any

*2 Level ........ warnings

Program ...... dhcp

Facility ..... any

Message text . "pool exhausted"

Statistics ..... 1327 messages received, 12 accepted by filter (2016 Oct 11 

10:36:16)

C613-50292-01 Rev A Command Reference for IE210L Series 419

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

SHOW LOG CONFIG

In the above example the ’*’ next to filter 1 in the buffered log configuration

indicates that this is the default filter. The permanent log has had its default filter

removed, so none of the filters are marked with ‘*’.

NOTE: Terminal log and console log cannot be set at the same time. If console logging

is enabled then the terminal logging is turned off.

Commands

show counter log

show log

show log permanent

Host 10.32.16.21:

Time offset .... +2:00

Offset type .... UTC

Source ......... -

Secured ........ enabled

Filters:

1 Level ........ critical

Program ...... any

Facility ..... any

Message text . any

Statistics ..... 1327 messages received, 1 accepted by filter (2016 Oct 11 

10:36:16)

Email admin@alliedtelesis.com:

Time offset .... +0:00

Offset type .... Local

Filters:

1 Level ........ emergencies

Program ...... any

Facility ..... any

Message text . any

Statistics ..... 1327 messages received, 0 accepted by filter (2016 Oct 11 

10:36:16)

...

C613-50292-01 Rev A Command Reference for IE210L Series 420

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

SHOW LOG EXTERNAL

show log external

Overview Use this command to display the contents of the external log, which is stored on

an SD card.

Syntax show log external [tail [<10-250>]]

Mode Global Configuration

Privileged Exec

User Exec

Usage If the optional tail parameter is specified, only the latest 10 messages in the

permanent log are displayed. A numerical value can be specified after the tail

parameter to change how many of the latest messages should be displayed.

Example To display the last 5 entries in the external log, use the command:

awplus# show log external tail 5

Commands

clear log external

default log external

log external

log external (filter)

log external exclude

log external rotate

log external size

show log config

unmount

Command

changes

Version 5.4.7-1.1: command added

Parameter Description

tail Display only the latest log entries.

<10-250>Specify the number of log entries to display.

C613-50292-01 Rev A Command Reference for IE210L Series 421

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

SHOW LOG PERMANENT

show log permanent

Overview This command displays the contents of the permanent log.

Syntax show log permanent [tail [<10-250>]]

Usage If the optional tail parameter is specified only, the latest 10 messages in the

permanent log are displayed. A numerical value can be specified after the tail

parameter to change how many of the latest messages should be displayed.

Mode User Exec, Privileged Exec and Global Configuration

Example To display the permanent log, use the command:

awplus# show log permanent

Output Figure 10-6: Example output from show log permanent

Commands

clear log permanent

copy permanent-log

default log permanent

log permanent

log permanent (filter)

log permanent exclude

log permanent size

show log config

Parameter Description

tail Display only the latest log entries.

<10-250>Specify the number of log entries to display.

awplus#show log permanent



<date> <time> <facility>.<severity> <program[<pid>]>: <message>

------------------------------------------------------------------------

2014 Jun 10 09:30:09 syslog.notice syslog-ng[67]: syslog-ng starting up; 

version=\’2.0rc3\’

2014 Jun 10 09:30:09 auth.warning portmap[106]: user rpc not found, reverting to 

user bin

2014 Jun 10 09:30:09 cron.notice crond[116]: crond 2.3.2 dillon, started, log 

level 8

2014 Jun 10 09:30:14 daemon.err snmpd[181]: /flash/.configs/snmpd.conf: line 20: 

Error: bad SUBTREE object 

2014 Jun 10 09:30:14 user.info HSL[192]: HSL: INFO: Registering port port1.0.1

C613-50292-01 Rev A Command Reference for IE210L Series 422

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

SHOW RUNNING-CONFIG LOG

show running-config log

Overview This command displays the current running configuration of the Log utility.

Syntax show running-config log

Mode Privileged Exec and Global Configuration

Example To display the current configuration of the log utility, use the command:

awplus# show running-config log

Commands

show log

show log config

C613-50292-01 Rev A Command Reference for IE210L Series 423

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOGGING COMMANDS

UNMOUNT

unmount

Overview Use this command to unmount an external storage device. We recommend you

unmount storage devices before removing them, to avoid file corruption. This is

especially important if files may be automatically written to the storage device,

such as external log files or AMF backup files.

Syntax unmount card

Mode Privileged Exec

Example To unmount an SD card and safely remove it from the device, use the command:

awplus# unmount card

Commands

clear log external

log external

show file systems

show log config

show log external

Command

changes

Version 5.4.7-1.1: command added

Parameter Description

card Unmount the SD card.

C613-50292-01 Rev A Command Reference for IE210L Series 424

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Scripting

Commands

Introduction

Overview This chapter provides commands used for command scripts.

Command List •“activate” on page 425

•“echo” on page 426

•“wait” on page 427

C613-50292-01 Rev A Command Reference for IE210L Series 425

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SCRIPTING COMMANDS

ACTIVATE

activate

Overview This command activates a script file.

Syntax activate [background] <script>

Mode Privileged Exec

Usage When a script is activated, the privilege level is set to 1 enabling User Exec

commands to run in the script. If you need to run Privileged Exec commands in

your script you need to add an enable (Privileged Exec mode) command to the

start of your script. If you need to run Global Configuration commands in your

script you need to add a configure terminal command after the enable command

at the start of your script.

The activate command executes the script in a new shell. A terminal length shell

command, such as terminal length 0 may also be required to disable a delay that

would pause the display.

A script must be a text file with a filename extension of either . sh or . scp only for

the AlliedWare Plus™ CLI to activate the script file. The . sh filename extension

indicates the file is an ASH script, and the . scp filename extension indicates the file

is an AlliedWare Plus™ script.

Examples To activate a command script to run as a background process, use the command:

awplus# activate background test.scp

Commands

configure terminal

echo

enable (Privileged Exec mode)

wait

Parameter Description

background Activate a script to run in the background. A process that is running in

the background will operate as a separate task, and will not interrupt

foreground processing. Generally, we recommend running short,

interactive scripts in the foreground and longer scripts in the

background. The default is to run the script in the foreground.

consisting of commands documented in this software reference.

Note that you must use either a . scp or a . sh filename extension for a

valid script text file, as described below in the usage section for this

command.

C613-50292-01 Rev A Command Reference for IE210L Series 426

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SCRIPTING COMMANDS

ECHO

echo

Overview This command echoes a string to the terminal, followed by a blank line.

Syntax echo <line>

Mode User Exec and Privileged Exec

Usage This command may be useful in CLI scripts, to make the script print user-visible

comments.

Example To echo the string Hello World to the console, use the command:

awplus# echo Hello World

Output

Commands

activate

wait

Parameter Description

<line>The string to echo

Hello World

C613-50292-01 Rev A Command Reference for IE210L Series 427

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SCRIPTING COMMANDS

WAIT

wait

Overview This command pauses execution of the active script for the specified period of

time.

Syntax wait <delay>

Default No wait delay is specified by default.

Mode Privileged Exec (when executed from a script not directly from the command line)

Usage Use this command to pause script execution in an .scp (AlliedWare Plus™ script) or

an .sh (ASH script) file executed by the activate command. The script must contain

an enable command, because the wait command is only executed in the

Privileged Exec mode.

Example See an .scp script file extract below that will show port counters for interface

port1.0.2 over a 10 second interval:

Commands

activate

echo

enable (Privileged Exec mode)

Parameter Description

<delay><1-65335> Specify the time delay in seconds

enable



show interface port1.0.2



wait 10



show interface port1.0.2

C613-50292-01 Rev A Command Reference for IE210L Series 428

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Interface

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

and display interfaces.

Command List •“description (interface)” on page 429

•“interface (to configure)” on page 430

•“mru” on page 432

•“mtu” on page 433

•“service statistics interfaces counter” on page 434

•“show interface” on page 435

•“show interface brief” on page 438

•“show interface memory” on page 439

•“show interface status” on page 441

•“shutdown” on page 443

C613-50292-01 Rev A Command Reference for IE210L Series 429

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

DESCRIPTION (INTERFACE)

description (interface)

Overview Use this command to add a description to a specific port or interface.

Syntax description <description>

Mode Interface Configuration

Example The following example uses this command to describe the device that a switch

port is connected to.

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# description Boardroom PC

Command

changes

Version 5.4.7-1.1: valid character set changed to printable ASCII characters

Parameter Description

<description>Text describing the specific interface. Descriptions can contain any

printable ASCII characters (ASCII 32-126).

C613-50292-01 Rev A Command Reference for IE210L Series 430

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

INTERFACE (TO CONFIGURE)

interface (to configure)

Overview Use this command to select one or more interfaces to configure.

Syntax interface <interface-list>

Usage A local loopback interface is one that is always available for higher layer protocols

to use and advertise to the network. Although a local loopback interface is

assigned an IP address, it does not have the usual requirement of connecting to a

lower layer physical entity. This lack of physical attachment creates the perception

of a local loopback interface always being accessible via the network.

Local loopback interfaces can be utilized by a number of protocols for various

purposes. They can be used to improve access to the device and also increase its

reliability, security, scalability and protection. In addition, local loopback interfaces

can add flexibility and simplify management, information gathering and filtering.

Mode Global Configuration

Example The following example shows how to enter Interface mode to configure vlan1.

Note how the prompt changes.

awplus# configure terminal

awplus(config)# interface vlan1

awplus(config-if)#

The following example shows how to enter Interface mode to configure the local

loopback interface.

awplus# configure terminal

awplus(config)# interface lo

awplus(config-if)#

Parameter Description

<interface-list>The interfaces to configure. An interface-list can be:

•a VLAN (e.g. vlan2)

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

• a dynamic (LACP) channel group (e.g. po2)

• the loopback interface (lo)

• a continuous range of interfaces separated by a hyphen

(e.g. vlan10-20)

• a comma-separated list (e.g. vlan1,vlan10-20). Do not mix

interface types in a list.

The specified interfaces must exist.

C613-50292-01 Rev A Command Reference for IE210L Series 431

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

INTERFACE (TO CONFIGURE)

Commands

ip address (IP Addressing and Protocol)

show interface

show interface brief

C613-50292-01 Rev A Command Reference for IE210L Series 432

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

MRU

mru

Overview Use this command to set the Maximum Receive Unit (MRU) size for switch ports,

where MRU is the maximum frame size (excluding headers) that switch ports can

receive. For more information, see the Switching Feature Overview and

Configuration Guide.

Use the no variant of this command to remove a previously specified Maximum

Receive Unit (MRU) size for switch ports, and restore the default MRU size (1500

bytes) for switch ports.

NOTE: The MRU sizes specify the payload only. For an IEEE 802.1q frame, provision is

made (internally) for the following additional components:

• Source and Destination addresses

• EtherType field

• Priority and VLAN tag fields

•FCS

These additional components increase the frame size internally by 22 bytes. For

example, the default frame size is 1522 bytes, including headers.

Syntax mru <mru-size>

no mru

Default The default MRU size is 1500 bytes for switch ports.

Mode Interface Configuration for switch ports.

Examples To configure an MRU of 9194 bytes on port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# mru 9194

To restore the MRU default size of 1500 bytes on port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no mru

Commands

show interface

Parameter Description

<mru-size>68-9194. This value specifies the Maximum Receive Unit (MRU) size in

bytes, where 1500 bytes is the default Ethernet MRU size for an

interface.

C613-50292-01 Rev A Command Reference for IE210L Series 433

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

MTU

mtu

Overview Use this command to set the Maximum Transmission Unit (MTU) size for interfaces,

where MTU is the maximum packet size that interfaces can transmit. The MTU size

setting is applied to both IPv4 and IPv6 packet transmission.

Use the no variant of this command to remove a previously specified Maximum

Transmission Unit (MTU) size, and restore the default MTU size. For example the

VLAN interface default is 1500 bytes.

Syntax mtu <68-1582>

no mtu

Default The default MTU size, for example 1500 bytes for VLAN interfaces.

Mode Interface Configuration

Usage If a device receives an IPv4 packet for Layer 3 switching to another interface with

an MTU size smaller than the packet size, and if the packet has the ‘don’t

fragment’ bit set, then the device will send an ICMP ‘destination unreachable’ (3)

packet type and a ‘fragmentation needed and DF set’ (4) code back to the source.

For IPv6 packets bigger than the MTU size of the transmitting interface, an ICMP

‘packet too big’ (ICMP type 2 code 0) message is sent to the source.

Note that show interface output will only show MTU size for VLAN interfaces.

Examples To configure an MTU size of 1500 bytes on vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# mtu 1500

To restore the MTU size to the default MTU size of 1500 bytes on vlan2, use the

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no mtu

Commands

show interface

C613-50292-01 Rev A Command Reference for IE210L Series 434

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SERVICE STATISTICS INTERFACES COUNTER

service statistics interfaces counter

Overview Use this command to enable the interface statistics counter.

Use the no variant of this command to disable the interface statistics counter.

Syntax service statistics interfaces counter

no service statistics interfaces counter

Default The interface statistics counter is enabled by default.

Mode Global Configuration

Example To enable the interface statistics counter, use the following commands:

awplus# configure terminal

awplus(config)# service statistics interfaces counter

To disable the interface statistics counter, use the following commands:

awplus# configure terminal

awplus(config)# no service statistics interfaces counter

Command

changes

Version 5.4.7-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 435

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SHOW INTERFACE

show interface

Overview Use this command to display interface configuration and status.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show interface [<interface-list>]

Mode User Exec and Privileged Exec

Usage Note that the output displayed with this command will show MTU (Maximum

Transmission Unit) size for VLAN interfaces, and MRU (Maximum Received Unit)

size for switch ports.

Example To display configuration and status information for all interfaces, use the

command:

awplus# show interface

Parameter Description

<interface-list>The interfaces or ports to display. An interface-list can be:

•a VLAN (e.g. vlan2)

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

•a dynamic (LACP) channel group (e.g. po2)

• the loopback interface (lo)

• a continuous range of interfaces separated by a hyphen

(e.g. vlan10-20)

• a comma-separated list (e.g. vlan1,vlan10-20). Do not mix

interface types in a list.

The specified interfaces must exist.

C613-50292-01 Rev A Command Reference for IE210L Series 436

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SHOW INTERFACE

Figure 12-1: Example output from the show interface command

To display configuration and status information for the loopback interface lo, use

the command:

awplus# show interface lo

Figure 12-2: Example output from the show interface lo command

To display configuration and status information for interface vlan1, use the

command:

awplus# show interface vlan1

awplus#show interface

Interface port1.0.1

Scope: both

Link is UP, administrative state is UP

Thrash-limiting

Status Not Detected, Action learn-disable, Timeout 1(s)

Hardware is Ethernet, address is 00c0.ffee.0401

index 5001 metric 1 mru 1500

current duplex full, current speed 1000, current polarity mdix

configured duplex auto, configured speed auto, configured polarity auto

<UP,BROADCAST,RUNNING,MULTICAST>

SNMP link-status traps: Disabled

input packets 2901115, bytes 212107158, dropped 0, multicast packets 1250912

output packets 317532, bytes 29171173, multicast packets 3, broadcast packets 3

input average rate : 30 seconds 5.09 Kbps, 5 minutes 3.72 Kbps

output average rate: 30 seconds 1.36 Kbps, 5 minutes 477 bps

input peak rate 152.06 Kbps at 2018/04/10 15:56:53

output peak rate 6.78 Mbps at 2018/04/10 15:56:53

Time since last state change: 7 days 03:06:10

...

awplus#show interface lo

Interface lo

Scope: both

Link is UP, administrative state is UP

Hardware is Loopback

index 1 metric 1

<UP,LOOPBACK,RUNNING>

SNMP link-status traps: Disabled

Router Advertisement is disabled

Router Advertisement default routes are accepted

Router Advertisement prefix info is accepted

Time since last state change: 8 days 00:01:09

C613-50292-01 Rev A Command Reference for IE210L Series 437

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SHOW INTERFACE

Figure 12-3: Example output from the show interface vlan1 command

Commands

mru

mtu

show interface brief

Command

changes

Version 5.4.7-2.1: average rate and peak rate added to output

awplus#show interface vlan1

Interface vlan1

Link is UP, administrative state is UP

Hardware is VLAN, address is 0000.cd38.026c

IPv4 address 192.168.1.1/24 broadcast 192.168.1.255

index 301 metric 1 mtu 1500

arp ageing timeout 300

<UP,BROADCAST,RUNNING,MULTICAST>

VRF Binding: Not bound

SNMP link-status traps: Disabled

Router Advertisement is disabled

Router Advertisement default routes are accepted

Router Advertisement prefix info is accepted

input packets 0, bytes 0, dropped 0, multicast packets 0

output packets 9, bytes 612, multicast packets 0, broadcast packets 0

input average rate : 30 seconds 0 bps, 5 minutes 0 bps

output average rate: 30 seconds 0 bps, 5 minutes 0 bps

output peak rate 140 bps at 2018/04/10 16:40:56

Time since last state change: 8 days 19:09:19

C613-50292-01 Rev A Command Reference for IE210L Series 438

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SHOW INTERFACE BRIEF

show interface brief

Overview Use this command to display brief interface, configuration, and status information,

including provisioning information.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show interface brief

Mode User Exec and Privileged Exec

Output Figure 12-4: Example output from show interface brief

Commands

show interface

show interface memory

awplus#show int brief

Interface Status Protocol

port1.0.1 admin up down

port1.0.2 admin up down

port1.0.3 admin up down

port1.0.4 admin up down

port1.0.5 admin up down

port1.0.6 admin up running

lo admin up running

vlan1 admin up down

vlan2 admin up down

Table 12-1: Parameters in the output of show interface brief

Parameter Description

Interface The name or type of interface.

Status The administrative state. This can be either admin up or admin

down.

Protocol The link state. This can be either down, running, or provisioned.

C613-50292-01 Rev A Command Reference for IE210L Series 439

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SHOW INTERFACE MEMORY

show interface memory

Overview This command displays the shared memory used by either all interfaces, or the

specified interface or interfaces. The output is useful for diagnostic purposes by

Allied Telesis authorized service personnel.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show interface memory

show interface <port-list> memory

Mode User Exec and Privileged Exec

Example To display the shared memory used by all interfaces, use the command:

awplus# show interface memory

To display the shared memory used by port1.0.1 and port1.0.3 to port1.0.4, use the

command:

awplus# show interface port1.0.1,port1.0.3-port1.0.4 memory

Output Figure 12-5: Example output from the show interface memory command

Parameter Description

<port-list> Display information about only the specified port or ports. The port

list can be:

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

• a dynamic (LACP) channel group (e.g. po2)

• a continuous range of ports separated by a hyphen (e.g.

port1.0.1-1.0.4)

• a comma-separated list (e.g. port1.0.1,port1.0.3-1.0.4). Do not mix

port types in the same list.

awplus#show interface memory

Vlan blocking state shared memory usage

---------------------------------------------

Interface shmid Bytes Used nattch Status

port1.0.1 491535 512 1

port1.0.2 393228 512 1

port1.0.3 557073 512 1

...

lo 425997 512 1

po1 1179684 512 1

po2 1212453 512 1

sa3 1245222 512 1

C613-50292-01 Rev A Command Reference for IE210L Series 440

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SHOW INTERFACE MEMORY

Figure 12-6: Example output from show interface <port-list> memory for a list

of interfaces

Commands

show interface brief

show interface status

show interface switchport

awplus#show interface port1.0.1,port1.0.3-port1.0.4 memory

Vlan blocking state shared memory usage

---------------------------------------------

Interface shmid Bytes Used nattch Status

port1.0.1 589842 512 1

port1.0.3 688149 512 1

port1.0.4 327690 512 1

C613-50292-01 Rev A Command Reference for IE210L Series 441

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SHOW INTERFACE STATUS

show interface status

Overview Use this command to display the status of the specified interface or interfaces.

Note that when no interface or interfaces are specified then the status of all

interfaces on the device are shown.

Syntax show interface [<port-list>] status

Examples To display the status of port1.0.1 to port1.0.3, use the commands:

awplus# show interface port1.0.1-port1.0.3 status

To display the status of all ports, use the commands:

awplus# show interface status

Parameter Description

<port-list> The ports to display information about. The port list can be:

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

• a dynamic (LACP) channel group (e.g. po2)

• a continuous range of ports separated by a hyphen (e.g.

port1.0.1-1.0.4)

• a comma-separated list (e.g. port1.0.1,port1.0.3-1.0.4). Do not mix

port types in the same list.

Table 13: Example output from the show interface <port-list> status command

awplus#show interface port1.0.1-port1.0.3 status

Port Name Status Vlan Duplex Speed Type

port1.0.1 notconnect 1 auto auto 1000BASE-T

port1.0.2 notconnect 1 auto auto 1000BASE-T

port1.0.3 notconnect 1 auto auto 1000BASE-T

Table 14: Example output from the show interface status command

awplus#show interface status

Port Name Status Vlan Duplex Speed Type

port1.0.1 Trunk_Net connected trunk a-full a-1000 1000BaseTX

port1.0.2 Access_Net1 connected 1 full 1000 1000BaseTX

port1.0.3 Access_Net1 disabled 1 auto auto 1000BaseTX

...

C613-50292-01 Rev A Command Reference for IE210L Series 442

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SHOW INTERFACE STATUS

Commands

show interface

show interface memory

Table 15: Parameters in the output from the show interface status command

Parameter Description

Port Name/Type of the interface.

Name Description of the interface.

Status The administrative and operational status of the interface; one of:

• disabled: the interface is administratively down.

• connect: the interface is operationally up.

• notconnect: the interface is operationally down.

Vlan VLAN type or VLAN IDs associated with the port:

• When the VLAN mode is trunk, it displays trunk (it does not

display the VLAN IDs).

• When the VLAN mode is access, it displays the VLAN ID.

• When the VLAN mode is private promiscuous, it displays the

primary VLAN ID if it has one, and promiscuous if it does not

have a VLAN ID.

• When the VLAN mode is private host, it displays the primary

and secondary VLAN IDs.

• When the port is an Eth port, it displays none: there is no VLAN

associated with it.

• When the VLAN is dynamically assigned, it displays the current

dynamically assigned VLAN ID (not the access VLAN ID), or

dynamic if it has multiple VLANs dynamically assigned.

Duplex The actual duplex mode of the interface, preceded by a- if it has

autonegotiated this duplex mode. If the port is disabled or not

connected, it displays the configured duplex setting.

Speed The actual link speed of the interface, preceded by a- if it has

autonegotiated this speed. If the port is disabled or not

connected, it displays the configured speed setting.

Type The type of interface, e.g. 1000BaseTX. For SFP bays, it displays

Unknown if it does not recognize the type of SFP installed, or Not

present if an SFP is not installed or is faulty.

C613-50292-01 Rev A Command Reference for IE210L Series 443

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

INTERFACE COMMANDS

SHUTDOWN

shutdown

Overview This command shuts down the selected interface. This administratively disables

the link and takes the link down at the physical (electrical) layer.

Use the no variant of this command to disable this function and therefore to bring

the link back up again.

Syntax shutdown

no shutdown

Mode Interface Configuration

Usage If you shutdown an aggregator, the device shows the admin status of the

aggregator and its component ports as “admin down”. While the aggregator is

down, the device accepts shutdown and no shutdown commands on

component ports, but these have no effect on port status. Ports will not come up

again while the aggregator is down.

Example To shut down port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# shutdown

To bring up port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no shutdown

To shut down vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# shutdown

To bring up vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no shutdown

C613-50292-01 Rev A Command Reference for IE210L Series 444

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Port Mirroring and

Remote Mirroring

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

Port Mirroring and Remote Mirroring (also known as RSPAN).

For more information, see the Mirroring Feature Overview and Configuration

Guide.

Command List •“mirror interface” on page 445

•“remote-mirror interface” on page 447

•“show mirror” on page 449

•“show mirror interface” on page 450

•“show remote-mirror” on page 451

•“switchport remote-mirror-egress” on page 453

•“vlan mode remote-mirror-vlan” on page 454

C613-50292-01 Rev A Command Reference for IE210L Series 445

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

MIRROR INTERFACE

mirror interface

Overview Use this command to define a mirror port and mirrored (monitored) ports and

direction of traffic to be mirrored. The port for which you enter interface mode will

be the mirror port.

The destination port is removed from all VLANs, and no longer participates in other

switching.

Use the no variant of this command to disable port mirroring by the destination

port on the specified source port.

Use the none variant of this command when using copy-to-mirror ACL and QoS

commands.

Syntax mirror interface <source-port-list> direction

{both|receive|transmit}

mirror interface none

no mirror interface <source-port-list>

no mirror interface none

Mode Interface Configuration

Parameter Description

<source-port-list> The source switch ports to mirror. A port-list can be:

• a port (e.g. port1.0.2)

• a continuous range of ports separated by a hyphen, e.g.

port1.0.1-port1.0.3

• a comma-separated list of ports and port ranges, e.g.

port1.0.1,port1.0.2-port1.0.4

The source port list cannot include dynamic or static

channel groups (link aggregators).

direction Specifies whether to mirror traffic that the source port

receives, transmits, or both.

both Mirroring traffic both received and transmitted by the

source port.

receive Mirroring traffic received by the source port.

transmit Mirroring traffic transmitted by the source port.

none Specify this parameter for use with the copy-to-mirror

parameter of:

- the ACL (Access Control List) access-list and ipv6

access-list commands or

- the QoS (Quality of Service) default action command.

The none parameter lets you specify the destination port

(the analyzer port) for the traffic without specifying a

source mirror port.

C613-50292-01 Rev A Command Reference for IE210L Series 446

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

MIRROR INTERFACE

Usage Use this command to send traffic to another device connected to the mirror port

for monitoring.

For more information, see the Mirroring Feature Overview and Configuration

Guide.

A mirror port cannot be associated with a VLAN. If a switch port is configured to be

a mirror port, it is automatically removed from any VLAN it was associated with.

This command can only be applied to a single mirror (destination) port, not to a

range of ports, nor to a static or dynamic channel group. Do not apply multiple

interfaces with an interface command before issuing the mirror interface

command. One interface may have multiple mirror interfaces.

Access control lists can be used to mirror a subset of traffic from the mirrored port

by using the copy-to-mirror parameter in hardware ACL commands.

Example To mirror traffic received and transmitted on port1.0.1 to destination port1.0.2, use

the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# mirror interface port1.0.1 direction both

To enable use with the access-list (numbered hardware ACL for IP packets) ACL and

default-action QoS commands to destination port1.0.1 without specifying a source

port, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# mirror interface none

To mirror all received or transmitted TCP traffic to analyzer port1.0.1, use the

sample configuration snippet below:

Commands

access-list (numbered hardware ACL for IP packets)

access-list (numbered hardware ACL for MAC addresses)

default-action

ipv6 access-list (named IPv6 hardware ACL)

awplus#show running-config



mls qos enable

access-list 3000 copy-to-mirror tcp any any

access-group 3000

!

interface port1.0.1

mirror interface none

C613-50292-01 Rev A Command Reference for IE210L Series 447

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

REMOTE-MIRROR INTERFACE

remote-mirror interface

Overview Use this command on the source device to specify the source port whose traffic is

to be remote-mirrored (monitored), and the remote mirroring VLAN ID these

mirrored frames will be tagged with when they egress from the source device. The

port for which Interface Configuration mode is entered is the port via which the

mirrored traffic egresses the source device towards the remote destination device.

Use the no variant of this command to disable remote mirroring of the specified

mirrored port by the egress (destination) port on the source device.

Syntax remote-mirror interface <port-list> direction

{both|receive|transmit} vlan <2-4090> [priority <0-7>]

remote-mirror interface none vlan <2-4090> [priority <0-7>]

no remote-mirror interface <port-list> [direction

{receive|transmit}]

no remote-mirror interface none

Default No ports are set to be remote mirrored by default.

Mode Interface Configuration

Usage To prevent unwanted processing of mirrored traffic, we recommend configuring

remote monitoring on the receiving device before configuring it on the source

device.

Parameter Description

<port-list> The ports from which to mirror traffic. A port-list can be:

• a port (e.g. port1.0.1)

• a continuous range of ports separated by a hyphen, e.g.

port1.0.1-port1.0.4

• a comma-separated list of ports and port ranges, e.g.

port1.0.1,port1.0.3-port1.0.4

direction Specifies whether to mirror traffic that the source port

receives, transmits, or both.

both Mirroring traffic both received and transmitted by the source

port.

receive Mirroring traffic received by the source port.

transmit Mirroring traffic transmitted by the source port.

2-4090 The VLAN ID of the remote mirroring VLAN that this mirrored

traffic is to be tagged with at the egress port on the source

device.

priority The 802.1p priority tag to apply to mirrored packets.

C613-50292-01 Rev A Command Reference for IE210L Series 448

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

REMOTE-MIRROR INTERFACE

This command can only be used to configure a single egress port on the source

device, not a range of egress ports. Do not use the interface command with

multiple interfaces before using this remote-mirror interface command. One

egress (destination) port on the source device can transmit mirrored frames from

up to four remote mirrored (source) ports.

The egress port on the source device can be associated with other VLANs in

addition to the remote mirror VLAN, so it can function as an uplink for traffic from

multiple VLANs. This command does not change the VLAN associations of the

mirrored ports.

Only one port on the device can be configured as either a mirror port for port

mirroring (mirror interface command) or as an egress port on the source device

for remote mirroring (remote-mirror interface command).

All mirrored ports on a single device must use the same remote mirror VLAN and

priority.

Access control lists can be used to mirror a subset of traffic from the mirrored port

by using the copy-to-mirror parameter in hardware ACL commands.

Example To configure the source device to send all the traffic that it receives on

remote-mirrored port port1.0.2 out egress port port1.0.1 tagged with remote

mirroring VLAN ID 2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# remote-mirror interface port1.0.2 direction

receive vlan 2

To stop port1.0.1 remote-mirroring traffic received on mirrored port port1.0.2, use

the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no remote-mirror interface port1.0.2

direction receive

Commands

access-list (numbered hardware ACL for IP packets)

access-list (numbered hardware ACL for MAC addresses)

default-action

mirror interface

remote-mirror interface

show remote-mirror

switchport remote-mirror-egress

vlan mode remote-mirror-vlan

C613-50292-01 Rev A Command Reference for IE210L Series 449

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

SHOW MIRROR

show mirror

Overview Use this command to display the status of all mirrored ports.

Syntax show mirror

Mode User Exec and Privileged Exec

Example To display the status of all mirrored ports, use the following command:

awplus# show mirror

Output Figure 13-1: Example output from the show mirror command

Mirror Test Port Name: port1.0.1

Mirror option: Enabled

Mirror direction: both

Monitored Port Name: port1.0.2

C613-50292-01 Rev A Command Reference for IE210L Series 450

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

SHOW MIRROR INTERFACE

show mirror interface

Overview Use this command to display port mirroring configuration for a mirrored

(monitored) switch port.

Syntax show mirror interface <port>

Mode User Exec, Privileged Exec and Interface Configuration

Example To display port mirroring configuration for port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# show mirror interface port1.0.2

Output Figure 13-2: Example output from the show mirror interface command

Parameter Description

<port>The monitored switch port to display information about.

Mirror Test Port Name: port1.0.1

Mirror option: Enabled

Mirror direction: both

Monitored Port Name: port1.0.2

C613-50292-01 Rev A Command Reference for IE210L Series 451

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

SHOW REMOTE-MIRROR

show remote-mirror

Overview Use this command to display information for remote-mirroring.

Syntax show remote-mirror

Mode User Exec

Example To display information about remote mirroring, use the command:

awplus# show remote-mirror

Output Figure 13-3: Example output from show remote-mirror

awplus#show remote-mirror

Remote mirror information: 

Remote mirror destination:

Port: port1.0.3

VLAN: 259

User priority: 0



Monitored ports:

port1.0.1

direction: both



Remote mirror egress ports:



Remote mirror VLANs:

VLAN 259

Table 13-1: Parameters in the output from show remote-mirror

Parameter Description

Remote mirror

destination On the source device, this displays information about:

• the egress port for the mirrored traffic on the source

device

• the remote mirroring VLAN ID this traffic is tagged with

on egress

• the user priority this traffic is tagged with on egress

Monitored ports On the source device, this displays:

• the ports being mirrored (monitored)

• the direction—whether both received traffic,

transmitted traffic or both are mirrored

• ‘none (via ACL)’ if it is configured with the command

remote-mirror interface none to allow ACLs to select

the traffic to be mirrored

C613-50292-01 Rev A Command Reference for IE210L Series 452

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

SHOW REMOTE-MIRROR

Commands

remote-mirror interface

switchport remote-mirror-egress

vlan mode remote-mirror-vlan

Remote mirror

egress ports On the destination device, this displays :

• the remote mirror egress ports

• the remote mirror VLANs they are associated with

Remote mirror

VLANs On source, destination and intermediate devices, this

displays a list of any VLANs configured in remote mirror

VLAN mode. To see a list of the ports associated with these

VLANs, use the command show vlan brief.

Table 13-1: Parameters in the output from show remote-mirror (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 453

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

SWITCHPORT REMOTE-MIRROR-EGRESS

switchport remote-mirror-egress

Overview Use this command on the device receiving remote mirrored traffic to set the

remote mirroring egress port for the specified remote mirroring VLAN. This port

removes the remote mirror VLAN tagging before transmitting the mirrored traffic.

Ingress traffic on this port is disabled.

Use the no variant of this command to reset the port to no longer function as a

remote mirror egress port.

Syntax switchport remote-mirror-egress vlan <vlan-id>

no switchport remote-mirror-egress

Default There is no remote mirror egress port by default.

Mode Interface Configuration for a switch port

Usage To prevent unwanted processing of mirrored traffic, we recommend configuring

remote monitoring on the receiving device before configuring it on the source

device.

This command would typically be used for the port that transmits the

remote-mirrored traffic to a device that will analyze it. The port effectively

functions as an access port in the remote mirror VLAN, with the added feature of

not allowing ingress traffic on the port.

Example To set port1.0.2 on the destination device as the remote mirror egress port for

mirrored traffic that is tagged with VLAN ID 2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport remote-mirror-egress vlan 2

To unset port1.0.2 as a remote mirror egress port, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport remote-mirror-egress

Commands

remote-mirror interface

show remote-mirror

vlan mode remote-mirror-vlan

Parameter Description

<vlan-id> The port will transmit the mirrored traffic it receives from this

remote mirror VLAN.

C613-50292-01 Rev A Command Reference for IE210L Series 454

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

VLAN MODE REMOTE-MIRROR-VLAN

vlan mode remote-mirror-vlan

Overview Use this command to create a single VLAN or a range of VLANs in remote mirror

mode to be used for remote mirroring.

Use the no variant of this command to remove the remote mirror VLAN from the

VLAN database and its configurations.

Syntax vlan [<vid>|<vid-range>] mode remote-mirror-vlan

no vlan [<vid>|<vid-range>]

Default There is no remote mirror VLAN by default.

Mode VLAN Configuration

Usage This remote mirror VLAN needs to be configured on the remote mirroring source

device, the destination (receiving) device, and any devices in between that are to

forward the mirrored traffic. We recommend configuring this on the receiving

device and intermediate devices before configuring the source device.

The remote mirror VLAN operates in a special mode— all traffic on the remote

mirror VLAN is flooded, and no learning or CPU processing is done for packets in

the VLAN. BPDU packets (link-local packets used to control features like spanning

tree or AMF) are dropped on remote mirror VLANs.

Disabling the remote-mirroring VLAN on the source switch does not prevent the

mirrored packets from being sent with the remote-mirror VLAN tag. To stop the

mirroring, the command no remote-mirror interface must be used.

Example To create a VLAN with VLAN ID 3 in remote mirror VLAN mode, use the commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# vlan 3 mode remote-mirror-vlan

To remove the remote mirror VLAN with ID 3, use the commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# no vlan 3

Commands

remote-mirror interface

show remote-mirror

Parameter Description

<vid> The VLAN ID of the remote mirroring VLAN to be created.

<vid-range> The range of VLAN IDs for the remote mirroring VLANs to be

created.

C613-50292-01 Rev A Command Reference for IE210L Series 455

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PORT MIRRORING AND REMOTE MIRRORING COMMANDS

VLAN MODE REMOTE-MIRROR-VLAN

switchport remote-mirror-egress

C613-50292-01 Rev A Command Reference for IE210L Series 456

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Alarm Monitoring

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

alarm monitoring. For more information, see the Alarm Monitoring Feature

Overview and Configuration Guide.

Command List •“alarm facility” on page 457

•“debug alarm” on page 460

•“show alarm settings” on page 461

•“show debugging alarm” on page 462

•“show facility-alarm status” on page 463

C613-50292-01 Rev A Command Reference for IE210L Series 457

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ALARM MONITORING COMMANDS

ALARM FACILITY

alarm facility

Overview Use this command to enable alarm monitoring. Enabling alarms allows you to

monitor the switch environment and respond to problems as they occur.

Alarm monitoring is user-configured, including which alarms are enabled, and the

LED and relay settings for each alarm.

Use the no variant of this command to disable the alarm facility for a particular

alarm.

The command syntax varies depending on the type of alarm you are configuring.

The section below includes the syntax for each alarm type.

Syntax alarm facility epsr

alarm facility input-alarm <input-alarm-number>

alarm facility link-down <port-list>

alarm facility loopprot

alarm facility main-pse

alarm facility power-supply <power-supply-number>

alarm facility pse-port <port-list>

alarm facility temperature

no alarm facility {epsr|input-alarm <number>|link-aggregation

{partial-failure|total-failure}|link-down

<port-list>|loopprot|main-pse|power-supply <id>|pse-port

<port-list>|temperature}

alarm facility ufo

Parameter Description

epsr EPSR alarm

input-alarm External contact input alarm.

<input-alarm-number> The external contact input number. The current

models have only a single pair of input contacts, so

this number must be 1.

link-down Link failure alarm. This triggers if a link goes down on

a particular switch port or ports.

Note that you must also enable link-status traps on

the monitored ports. To do this, use the command

snmp trap link-status.

Note that if a port is part of a link aggregation group,

you cannot configure a link-down alarm on that port.

For example, if port 1.0.1 is in a link aggregation

group, you cannot enter commands like alarm

facility link-down port1.0.1 led.

C613-50292-01 Rev A Command Reference for IE210L Series 458

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ALARM MONITORING COMMANDS

ALARM FACILITY

Default All alarms are disabled by default.

Mode Global Configuration

Example To turn on the LED in case a loop occurs, use the command:

awplus# configure terminal

awplus(config)# alarm facility loopprot led

<port-list> The switch ports on which the alarm will be activated

or disabled. The port list can be any of the following:

•An individual port. Example: 1.0.3

• A continuous range of ports. Example: 1.0.1-1.0.3

• A combination of individual ports and port ranges,

separated by commas. Example: 1.0.1, 1.0.3-1.0.4

loopprot Loop protection alarm.

main-pse Main power source equipment failure alarm. This

triggers if the sum of the power consumed by all of

the PoE devices plugged into the switch exceeds the

maximum permitted.

Note: This alarm pertains to PoE models only.

power-supply Power supply failure alarm. This triggers if the

designated power supply is down.

<power-supply-number> The power supply unit number. The switch has two

power supplies, so the number must be 1 or 2.

pse-port PoE failure on a switch port alarm. This triggers if a PoE

device plugged into a port is consuming more than

the maximum power output for the port.

Note that if a port is part of a link aggregation group,

you cannot configure a pse-port alarm on that port.

For example, if port 1.0.1 is in a link aggregation

group, you cannot enter commands like alarm

facility pse-port port1.0.1 led.

temperature High temperature alarm. This triggers if the

temperature of the device exceeds 95 degrees Celsius.

led Enable or disable the LED for the alarm.

relay Enable or disable the relay output for the alarm.

alarm-position The position (open or closed) of the input contact

corresponding to the alarm that has occurred.

open The electrical circuit for the contact input is open.

close The electrical circuit for the contact input is closed.

ufo One or more UFO VLANs are isolated and can not

forward traffic.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 459

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ALARM MONITORING COMMANDS

ALARM FACILITY

To have an alarm when the contact input is open, use the command:

awplus# configure terminal

awplus(config)# alarm facility input-alarm 1 alarm-position

open

To turn off the LED from flashing when the device temperature is too high, use the

command:

awplus# configure terminal

awplus(config)# no alarm facility temperature led

Commands

show alarm settings

show facility-alarm status

Command

changes

Version 5.4.7-2.1: ufo parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 460

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ALARM MONITORING COMMANDS

DEBUG ALARM

debug alarm

Overview Use this command to enable debugging of the Alarm Monitoring feature. When

debugging is enabled, the switch displays debugging messages on the terminal

monitor and in the log.

Use the no variant of this command to disable debugging of the Alarm Monitoring

feature.

Syntax debug alarm

no debug alarm

Default Disabled

Mode Global Configuration

Example To turn on Alarm debugging, use the commands:

awplus# configure terminal

awplus(config)# debug alarm

Commands

show debugging alarm

C613-50292-01 Rev A Command Reference for IE210L Series 461

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ALARM MONITORING COMMANDS

SHOW ALARM SETTINGS

show alarm settings

Overview Use this command to view all alarms configured on the switch. The output also

includes the alarm position for each contact input.

Syntax show alarm settings

Mode User Exec and Privileged Exec

Example To display all of the alarm settings enabled on the switch, use the command:

awplus# show alarm settings

Output Figure 14-1: Example output from the show alarm settings command

Commands

alarm facility

show facility-alarm status

Alarm ID LED Relay

---------------------- --------- -------- --------

External PSU 1 Enabled Disabled

External PSU 2 Enabled Disabled



EPSR - Disabled Disabled



External contact input 1 Disabled Disabled



Link down port1.0.1 Disabled Disabled

Link down port1.0.2 Disabled Disabled

Link down port1.0.3 Disabled Disabled

Link down port1.0.4 Disabled Disabled

Link down port1.0.5 Disabled Disabled

Link down port1.0.6 Disabled Disabled



Loop detect - Disabled Enabled



Main PSE failure - Disabled Disabled



PoE failure port1.0.1 Disabled Disabled

PoE failure port1.0.2 Disabled Disabled

PoE failure port1.0.3 Disabled Disabled

PoE failure port1.0.4 Disabled Disabled



Temperature - Enabled Enabled



Alarm ID Alarm position

---------------------- --------- --------------

External contact input 1 Open

C613-50292-01 Rev A Command Reference for IE210L Series 462

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ALARM MONITORING COMMANDS

SHOW DEBUGGING ALARM

show debugging alarm

Overview Use this command to show whether Alarm Monitoring debugging is enabled or

disabled.

Syntax show debugging alarm

Mode User Exec/Privileged Exec

Example To show the status of Alarm Monitoring debugging, use the command:

awplus# show debugging alarm

Output Figure 14-2: Example output from show debugging alarm

Commands

debug alarm

awplus#show debugging alarm



% Alarm debugging is disabled

C613-50292-01 Rev A Command Reference for IE210L Series 463

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ALARM MONITORING COMMANDS

SHOW FACILITY-ALARM STATUS

show facility-alarm status

Overview Use this command to view all of the alarms that are currently active on the switch.

Syntax show facility-alarm status

Mode User Exec and Privileged Exec

Example To display all of the currently active alarms on the switch, use the command:

awplus# show facility-alarm status

Output Figure 14-3: Example output from the show facility-alarm status command

Commands

alarm facility

show alarm settings

Active alarms ID 

---------------------- ---------

External PSU 2 

EPSR - 

G8032 - 

UFO - 

Link down port1.0.1

PoE failure port1.0.1

C613-50292-01 Rev A Command Reference for IE210L Series 464

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Part 2: Interfaces and Layer 2

C613-50292-01 Rev A Command Reference for IE210L Series 465

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Switching

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

switching.

For more information, see the Switching Feature Overview and Configuration

Guide.

Command List •“backpressure” on page 467

•“clear loop-protection counters” on page 469

•“clear mac address-table dynamic” on page 470

•“clear mac address-table static” on page 472

•“clear port counter” on page 473

•“clear port-security intrusion” on page 474

•“debug loopprot” on page 477

•“debug platform packet” on page 478

•“duplex” on page 480

•“flowcontrol (switch port)” on page 481

•“linkflap action” on page 483

•“loop-protection loop-detect” on page 484

•“loop-protection action” on page 485

•“loop-protection action-delay-time” on page 486

•“loop-protection timeout” on page 487

•“mac address-table acquire” on page 488

•“mac address-table ageing-time” on page 489

•“mac address-table logging” on page 490

C613-50292-01 Rev A Command Reference for IE210L Series 466

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

•“mac address-table static” on page 491

•“mac address-table thrash-limit” on page 492

•“platform hwfilter-size” on page 493

•“platform l3-vlan-hashing-algorithm” on page 494

•“platform load-balancing” on page 495

•“platform mac-vlan-hashing-algorithm” on page 496

•“platform multicast-ratelimit” on page 497

•“platform stop-unreg-mc-flooding” on page 498

•“platform vlan-stacking-tpid” on page 500

•“polarity” on page 501

•“show debugging loopprot” on page 502

•“show debugging platform packet” on page 503

•“show flowcontrol interface” on page 504

•“show interface err-disabled” on page 505

•“show interface switchport” on page 506

•“show loop-protection” on page 507

•“show mac address-table” on page 509

•“show mac address-table thrash-limit” on page 511

•“show platform” on page 512

•“show platform classifier statistics utilization brief” on page 515

•“show platform port” on page 518

•“show port-security interface” on page 520

•“show port-security intrusion” on page 521

•“show storm-control” on page 522

•“speed” on page 523

•“storm-control level” on page 525

•“switchport port-security” on page 526

•“switchport port-security aging” on page 527

•“switchport port-security maximum” on page 528

•“switchport port-security violation” on page 529

•“thrash-limiting” on page 530

•“undebug loopprot” on page 532

•“undebug platform packet” on page 533

C613-50292-01 Rev A Command Reference for IE210L Series 467

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

BACKPRESSURE

backpressure

Overview This command provides a method of applying flow control to ports running in half

duplex mode. The setting will only apply when the link is in the half-duplex state.

You can disable backpressure on an interface using the off parameter or the no

variant of this command.

Syntax backpressure {on|off}

no backpressure

Default Backpressure is turned off by default. You can determine whether an interface has

backpressure enabled by viewing the running-config output; backpressure on is

shown for interfaces if this feature is enabled.

Mode Interface Configuration

Usage The backpressure feature enables half duplex Ethernet ports to control traffic flow

during congestion by preventing further packets arriving. Back pressure utilizes a

pre-802.3x mechanism in order to apply Ethernet flow control to switch ports that

are configured in the half duplex mode.

The flow control applied by the flowcontrol (switch port) command operates only

on full-duplex links, whereas back pressure operates only on half-duplex links.

If a port has insufficient capacity to receive further frames, the device will simulate

a collision by transmitting a CSMACD jamming signal from this port until the buffer

empties. The jamming signal causes the sending device to stop transmitting and

wait a random period of time, before retransmitting its data, thus providing time

for the buffer to clear. Although this command is only valid for switch ports

operating in half-duplex mode the remote device (the one sending the data) can

be operating in the full duplex mode.

To see the currently-negotiated duplex mode for ports whose links are up, use the

command show interface. To see the configured duplex mode (when different

from the default), use the command show running-config.

Examples To enable back pressure flow control on interfaces port1.0.1-port1.0.2

enter the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1-port1.0.2

awplus(config-if)# backpressure on

Parameters Description

on Enables half-duplex flow control.

off Disables half-duplex flow control.

C613-50292-01 Rev A Command Reference for IE210L Series 468

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

BACKPRESSURE

To disable back pressure flow control on interface port1.0.2 enter the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# backpressure off

Validation

Commands

show running-config

show interface

Commands

duplex

C613-50292-01 Rev A Command Reference for IE210L Series 469

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

CLEAR LOOP-PROTECTION COUNTERS

clear loop-protection counters

Overview Use this command to clear the counters for the Loop Protection counters.

Syntax clear loop-protection [interface <port-list>] counters

Mode Privileged Exec

Examples To clear the counter information for all interfaces:

awplus# clear loop-protection counters

To clear the counter information for a single port:

awplus# clear loop-protection interface port1.0.1 counters

Parameters Description

interface The interface whose counters are to be cleared.

<port-list>A port, a port range, or an aggregated link.

C613-50292-01 Rev A Command Reference for IE210L Series 470

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

CLEAR MAC ADDRESS-TABLE DYNAMIC

clear mac address-table dynamic

Overview Use this command to clear the filtering database of all entries learned for a selected

MAC address, an MSTP instance, a switch port interface or a VLAN interface.

Syntax clear mac address-table dynamic 

[address <mac-address>|interface <port> [instance <inst>]|

vlan <vid>]

Mode Privileged Exec

Usage Use this command with options to clear the filtering database of all entries learned

for a given MAC address, interface or VLAN. Use this command without options to

clear any learned entries.

Use the optional instance parameter to clear the filtering database entries

associated with a specified MSTP instance Note that you must first specify a switch

port interface before you can specify an MSTP instance.

Compare this usage and operation with the clear mac address-table static

command. Note that an MSTP instance cannot be specified with the command

clear mac address-table static.

Examples This example shows how to clear all dynamically learned filtering database entries.

awplus# clear mac address-table dynamic

This example shows how to clear all dynamically learned filtering database entries

when learned through device operation for the MAC address 0000.5E00.5302.

awplus# clear mac address-table dynamic address 0000.5E00.5302

Parameter Description

address

<mac-address> Specify a MAC (Media Access Control) address to be cleared

from the filtering database, in the format

HHHH.HHHH.HHHH.

interface <port> Specify a switch port to be cleared from the filtering

database. The port can be:

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

• a dynamic (LACP) channel group (e.g. po2)

instance <inst> Specify an MSTP (Multiple Spanning Tree) instance in the

range 1 to 63 to be cleared from the filtering database.

vlan <vid> Specify a VID (VLAN ID) in the range 1 to 4094 to be cleared

from the filtering database.

C613-50292-01 Rev A Command Reference for IE210L Series 471

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

CLEAR MAC ADDRESS-TABLE DYNAMIC

This example shows how to clear all dynamically learned filtering database entries

when learned through device operation for a given MSTP instance 1 on switch port

interface port1.0.3.

awplus# clear mac address-table dynamic interface port1.0.3

instance 1

Commands

clear mac address-table static

show mac address-table

C613-50292-01 Rev A Command Reference for IE210L Series 472

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

CLEAR MAC ADDRESS-TABLE STATIC

clear mac address-table static

Overview Use this command to clear the filtering database of all statically configured entries

for a selected MAC address, interface, or VLAN.

Syntax clear mac address-table static [address <mac-address>|interface

<port>|vlan <vid>]

Mode Privileged Exec

Usage Use this command with options to clear the filtering database of all entries made

from the CLI for a given MAC address, interface or VLAN. Use this command

without options to clear any entries made from the CLI.

Compare this usage with clear mac address-table dynamic command.

Examples This example shows how to clear all filtering database entries configured through

the CLI.

awplus# clear mac address-table static

This example shows how to clear all filtering database entries for a specific

interface configured through the CLI.

awplus# clear mac address-table static interface port1.0.3

This example shows how to clear filtering database entries configured through the

CLI for the MAC address 0000.5E00.5302.

awplus# clear mac address-table static address 0000.5E00.5302

Commands

clear mac address-table dynamic

mac address-table static

show mac address-table

Parameter Description

address

<mac-address> Specify a MAC (Media Access Control) address to be cleared

from the filtering database, in the format

HHHH.HHHH.HHHH.

interface <port> Specify the port from which statically configured entries are

to be cleared. The port can be

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

• a dynamic (LACP) channel group (e.g. po2)

vlan <vid> Specify a VID (VLAN ID) in the range 1 to 4094 to be cleared

from the filtering database.

C613-50292-01 Rev A Command Reference for IE210L Series 473

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

CLEAR PORT COUNTER

clear port counter

Overview Use this command to clear the packet counters of the port.

Syntax clear port counter [<port>]

Mode Privileged Exec

Example To clear the packet counter for port1.0.1, use the command:

awplus# clear port counter port1.0.1

Commands

show platform port

Parameter Description

<port> The port number or range

C613-50292-01 Rev A Command Reference for IE210L Series 474

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

CLEAR PORT-SECURITY INTRUSION

clear port-security intrusion

Overview Use this command to clear the history of the port-security intrusion list on all ports,

or an individual port. If a port is not specified, the intrusion lists of all ports are

cleared. This command does not clear any MAC addresses the device has already

learned on the ports. If you want to clear MAC addresses on a switch port from the

filtering database, you can use the clear mac address-table dynamic command or

the clear mac address-table static command.

Syntax clear port-security intrusion [interface <port>]

Mode Privileged Exec

Examples To see the port-security status on port1.0.2, use the following command:

awplus# show port-security interface port1.0.2

To see the intrusion list on port1.0.2, use the following command:

awplus# show port-security intrusion interface port1.0.2

Parameter Description

<port> Specify the switch port from which the history of violated address

entries will be cleared. The port can be a single switch port, (e.g.

port1.0.4), a static channel group (e.g. sa2), or a dynamic (LACP)

channel group (e.g. po2).

Table 15-1: Example output from show port-security interface



awplus#show port-security interface port1.0.2

Port Security configuration

------------------------------------------------------------

Security Enabled : YES

Port Status : ENABLED

Violation Mode : TRAP

Aging : OFF

Maximum MAC Addresses : 1

Total MAC Addresses : 1

Lock Status : LOCKED

Security Violation Count : 1

Last Violation Source Address : 801f.0200.19da

C613-50292-01 Rev A Command Reference for IE210L Series 475

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

CLEAR PORT-SECURITY INTRUSION

To clear the history of port-security intrusion list on port1.0.2, use the following

command:

awplus# clear port-security intrusion interface port1.0.2

To see the port-security status on port1.0.2, use the following command:

awplus# show port-security interface port1.0.2

NOTE: Note that the port status is still locked while the history of port violation is

cleared from the database.

To see the intrusion list on port1.0.2, use the following command:

awplus# show port-security intrusion interface port1.0.2

Table 15-2: Example output from show port-security intrusion



awplus#show port-security intrusion interface port1.0.2

Port Security Intrusion List

------------------------------------------------------------

Interface: port1.0.2 - 1 intrusion(s) detected

801f.0200.19da

Table 15-3: Example output from show port-security interface



awplus#show port-security interface port1.0.2

Port Security configuration

------------------------------------------------------------

Security Enabled : YES

Port Status : ENABLED

Violation Mode : TRAP

Aging : OFF

Maximum MAC Addresses : 1

Total MAC Addresses : 1

Lock Status : LOCKED

Security Violation Count : 0

Last Violation Source Address : None

Table 15-4: Example output from show port-security intrusion



awplus#show port-security intrusion interface port1.0.2

Port Security Intrusion List

------------------------------------------------------------

Interface: port1.0.2 - no intrusions detected

C613-50292-01 Rev A Command Reference for IE210L Series 476

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

CLEAR PORT-SECURITY INTRUSION

Commands

show port-security interface

show port-security intrusion

switchport port-security

switchport port-security aging

switchport port-security maximum

switchport port-security violation

C613-50292-01 Rev A Command Reference for IE210L Series 477

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

DEBUG LOOPPROT

debug loopprot

Overview This command enables Loop Protection debugging.

The no variant of this command disables Loop Protection debugging.

Syntax debug loopprot {info|msg|pkt|state|nsm|all}

no debug loopprot {info|msg|pkt|state|nsm|all}

Mode Privileged Exec and Global Configuration

Example To enable debug for all state transitions, use the command:

awplus# debug loopprot state

Commands

show debugging loopprot

undebug loopprot

Parameter Description

info General Loop Protection information.

msg Received and transmitted Loop Detection Frames (LDFs).

pkt Echo raw ASCII display of received and transmitted LDF packets to

the console.

state Loop Protection states transitions.

nsm Network Service Module information.

all All debugging information.

C613-50292-01 Rev A Command Reference for IE210L Series 478

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

DEBUG PLATFORM PACKET

debug platform packet

Overview This command enables platform to CPU level packet debug functionality on the

device.

Use the no variant of this command to disable platform to CPU level packet debug.

If the result means both send and receive packet debug are disabled, then any

active timeout will be canceled.

Syntax debug platform packet [recv] [send] [sflow] [timeout <timeout>]

[vlan <vid>|all]

no debug platform packet [recv] [send]

Default A 5 minute timeout is configured by default if no other timeout duration is

specified.

Mode Privileged Exec and Global Configuration

Usage This command can be used to trace packets sent and received by the CPU. If a

timeout is not specified, then a default 5 minute timeout will be applied.

If a timeout of 0 is specified, packet debug will be generated until the no variant of

this command is used or another timeout value is specified. The timeout value

applies to both send and receive debug and is updated whenever the debug

platform packet command is used.

Examples To enable both receive and send packet debug for the default timeout of 5

minutes, enter:

awplus# debug platform packet

To enable receive packet debug for 10 seconds, enter:

awplus# debug platform packet recv timeout 10

To enable packet debug for sFlow packets only for the default timeout of 5

minutes, enter:

awplus# debug platform packet sflow

Parameter Description

recv Debug packets received.

send Debug packets sent.

sflow Debug sFlow packets.

timeout <timeout>Stop debug after a specified time. Specify the time in

seconds.

vlan <vid> Specify a VID (VLAN ID) in the range 1 to 4094 to limit

debug to that VLAN.

all Debug all VLANs (default setting).

C613-50292-01 Rev A Command Reference for IE210L Series 479

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

DEBUG PLATFORM PACKET

To enable send packet debug with no timeout, enter:

awplus# debug platform packet send timeout 0

To enable VLAN packet debug for VLAN 1 with a timeout duration of 3 minutes,

enter:

awplus# debug platform packet vlan 1 timeout 150

To disable receive packet debug, enter:

awplus# no debug platform packet recv

Commands

show debugging platform packet

undebug platform packet

C613-50292-01 Rev A Command Reference for IE210L Series 480

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

DUPLEX

duplex

Overview This command changes the duplex mode for the specified port.

To see the currently-negotiated duplex mode for ports whose links are up, use the

command show interface. To see the configured duplex mode (when different

from the default), use the command show running-config.

Syntax duplex {auto|full|half}

Default By default, ports auto-negotiate duplex mode (except for 100Base-FX ports which

do not support auto-negotiation, so default to full duplex mode).

Mode Interface Configuration

Usage Switch ports in a static or dynamic (LACP) channel group must have the same port

speed and be in full duplex mode. Once switch ports have been aggregated into a

channel group, you can set the duplex mode of all the switch ports in the channel

group by applying this command to the channel group.

Examples To specify full duplex for port1.0.4, enter the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.4

awplus(config-if)# duplex full

To specify half duplex for port1.0.4, enter the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.4

awplus(config-if)# duplex half

To auto-negotiate duplex mode for port1.0.4, enter the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.4

awplus(config-if)# duplex auto

Commands

polarity

speed

show interface

Parameter Description

auto Auto-negotiate duplex mode.

full Operate in full duplex mode only.

half Operate in half duplex mode only.

C613-50292-01 Rev A Command Reference for IE210L Series 481

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

FLOWCONTROL (SWITCH PORT)

flowcontrol (switch port)

Overview Use this command to enable flow control, and configure the flow control mode for

the switch port.

Use the no variant of this command to disable flow control for the specified switch

port.

Syntax flowcontrol {send|receive} {off|on}

no flowcontrol

Default By default, flow control is disabled.

Mode Interface Configuration

Usage The flow control mechanism specified by 802.3x is only for full duplex links. It

operates by sending PAUSE frames to the link partner to temporarily suspend

transmission on the link.

Flow control enables connected Ethernet ports to control traffic rates during

congestion by allowing congested nodes to pause link operation at the other end.

If one port experiences congestion, and cannot receive any more traffic, it notifies

the other port to stop sending until the condition clears. When the local device

detects congestion at its end, it notifies the remote device by sending a pause

frame. On receiving a pause frame, the remote device stops sending data packets,

which prevents loss of data packets during the congestion period.

Flow control is not recommended when running QoS or ACLs, because the

complex queuing, scheduling, and filtering configured by QoS or ACLs may be

slowed by applying flow control.

For half-duplex links, an older form of flow control known as backpressure is

supported. See the related backpressure command.

For flow control on async serial (console) ports, see the flowcontrol hardware

(asyn/console) command.

Parameter Description

receive When the port receives pause frames, it temporarily stops (pauses)

sending traffic.

on Enable the specified flow control.

off Disable the specified flow control.

send When the port is congested (receiving too much traffic), it sends

pause frames to request the other end to temporarily stop (pause)

sending traffic.

C613-50292-01 Rev A Command Reference for IE210L Series 482

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

FLOWCONTROL (SWITCH PORT)

Examples To enable flow control on port1.0.2 (receive only), use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# flowcontrol receive on

To enable flow control on port1.0.2 (send only), use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# flowcontrol send on

To disable flow control on port1.0.2 (receive only), use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# flowcontrol receive off

To disable flow control on port1.0.2 (send only), use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# flowcontrol send off

Commands

backpressure

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 483

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

LINKFLAP ACTION

linkflap action

Overview Use this command to detect flapping on all ports. If more than 15 flaps occur in less

than 15 seconds the flapping port will shut down.

Use the no variant of this command to disable flapping detection at this rate.

Syntax linkflap action [shutdown]

no linkflap action

Default Linkflap action is disabled by default.

Mode Global Configuration

Example To enable the linkflap action command on the device, use the following

commands:

awplus# configure terminal

awplus(config)# linkflap action shutdown

Parameter Description

linkflap Global setting for link flapping.

action Specify the action for port.

shutdown Shutdown the port.

C613-50292-01 Rev A Command Reference for IE210L Series 484

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

LOOP-PROTECTION LOOP-DETECT

loop-protection loop-detect

Overview Use this command to enable the loop-protection loop-detect feature and

configure its parameters.

Use the no variant of this command to disable the loop-protection loop-detect

feature.

Syntax loop-protection loop-detect [ldf-interval <period>]

[ldf-rx-window <frames>] [fast-block]

no loop-protection loop-detect

Default The loop-protection loop-detect feature is disabled by default. The default interval

is 10 seconds, and the default window size is 3 frames.

Mode Global Configuration

Usage See the “Loop Protection” section in the Switching Feature Overview and

Configuration Guide for relevant conceptual, configuration, and overview

information prior to applying this command.

Example To enable the loop-detect mechanism on the switch, and generate loop-detect

frames once every 5 seconds, use the following commands:

awplus# configure terminal

awplus(config)# loop-protection loop-detect ldf-interval 5

Commands

loop-protection action

loop-protection timeout

show loop-protection

Parameter Description

ldf-interval The time (in seconds) between successive loop-detect frames

being sent.

<period> Specify a period between 1 and 600 seconds. The default is 10

seconds.

ldf-rx-window The number of transmitted loop detect frames whose details

are held for comparing with frames arriving at the same port.

<frames> Specify a value for the window size between 1 and 5 frames.

The default is 3 frames.

[fast-block] The fast-block blocks transmitting port to keep partial

connectivity.

C613-50292-01 Rev A Command Reference for IE210L Series 485

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

LOOP-PROTECTION ACTION

loop-protection action

Overview Use this command to specify the protective action to apply when a network loop

is detected on an interface.

Use the no variant of this command to reset the loop protection actions to the

default action, vlan-disable, on an interface.

Syntax loop-protection action

{link-down|log-only|port-disable|vlan-disable|none}

no loop-protection action

Default loop-protection action vlan-disable

Mode Interface Configuration

Usage See the “Loop Protection” section in the Switching Feature Overview and

Configuration Guide for relevant conceptual, configuration, and overview

information prior to applying this command.

Example To disable the interface port1.0.2 and bring the link down when a network

loop is detected, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# loop-protection action link-down

Commands

loop-protection loop-detect

loop-protection timeout

show loop-protection

Parameter Description

link-down Block all traffic on a port (or aggregated link) that detected the

loop, and take down the link.

log-only Details of loop conditions are logged. No action is applied to the

port (or aggregated link).

port-disable Block all traffic on interface for which the loop occurred, but keep

the link in the up state.

vlan-disable Block all traffic for the VLAN on which the loop traffic was

detected. Note that setting this parameter will also enable ingress

filtering. This is the default action.

none Applies no protective action.

C613-50292-01 Rev A Command Reference for IE210L Series 486

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

LOOP-PROTECTION ACTION-DELAY-TIME

loop-protection action-delay-time

Overview Use this command to sets the loop protection action delay time for an interface to

specified values in seconds. The action delay time specifies the waiting period for

the action.

Use the no variant of this command to reset the loop protection action delay time

for an interface to default.

Syntax loop-protection action-delay-time <0-86400>

no loop-protection action

Default Action delay timer is disabled by default.

Mode Interface Configuration

Example To configure a loop protection action delay time of 10 seconds on port1.0.4, use

the commands:

awplus# configure terminal

awplus(config)# interface port1.0.4

awplus(config-if)# loop-protection action-delay-time 10

Commands

loop-protection loop-detect

loop-protection timeout

show loop-protection

Parameter Description

<0-86400> Time in seconds; 0 means action delay timer is disabled.

C613-50292-01 Rev A Command Reference for IE210L Series 487

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

LOOP-PROTECTION TIMEOUT

loop-protection timeout

Overview Use this command to specify the Loop Protection recovery action duration on an

interface.

Use the no variant of this command to set the loop protection timeout to the

default.

Syntax loop-protection timeout <duration>

no loop-protection timeout

Default The default is 7 seconds.

Mode Interface Configuration

Usage See the “Loop Protection” section in the Switching_Feature Overview_and

Configuration_Guide for relevant conceptual, configuration, and overview

information prior to applying this command.

Example To configure a loop protection action timeout of 10 seconds for port1.0.4, use the

command:

awplus# configure terminal

awplus(config)# interface port1.0.4

awplus(config-if)# loop-protection timeout 10

Commands

loop-protection loop-detect

loop-protection action

show loop-protection

Parameter Description

<duration> The time (in seconds) for which the configured action will apply

before being disabled. This duration can be set between 0 and 86400

seconds (24 hours). The set of 0 means infinity so timeout does not

expire.

C613-50292-01 Rev A Command Reference for IE210L Series 488

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

MAC ADDRESS-TABLE ACQUIRE

mac address-table acquire

Overview Use this command to enable MAC address learning on the device.

Use the no variant of this command to disable learning.

Syntax mac address-table acquire

no mac address-table acquire

Default Learning is enabled by default for all instances.

Mode Global Configuration

Example awplus# configure terminal

awplus(config)# mac address-table acquire

C613-50292-01 Rev A Command Reference for IE210L Series 489

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

MAC ADDRESS-TABLE AGEING-TIME

mac address-table ageing-time

Overview Use this command to specify an ageing-out time for a learned MAC address. The

learned MAC address will persist for at least the specified time.

The no variant of this command will reset the ageing-out time back to the default

of 300 seconds (5 minutes).

Syntax mac address-table ageing-time <ageing-timer> none

no mac address-table ageing-time

Default The default ageing time is 300 seconds.

Mode Global Configuration

Examples The following commands specify various ageing timeouts on the device:

awplus# configure terminal

awplus(config)# mac address-table ageing-time 1000

awplus# configure terminal

awplus(config)# mac address-table ageing-time none

awplus# configure terminal

awplus(config)# no mac address-table ageing-time

Parameter Description

<ageing-timer> <10-1000000> The number of seconds of persistence.

none Disable learned MAC address timeout.

C613-50292-01 Rev A Command Reference for IE210L Series 490

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

MAC ADDRESS-TABLE LOGGING

mac address-table logging

Overview Use this command to create log entries when the content of the FDB (forwarding

database) changes. Log messages are produced when a MAC address is added to

or removed from the FDB.

CAUTION: MAC address table logging may impact the performance of the switch. Only

enable it when necessary as a debug tool.

Use the no variant of this command to stop creating log entries when the content

of the FDB changes.

Syntax mac address-table logging

no mac address-table logging

Default MAC address table logging is disabled by default.

Mode User Exec/Privileged Exec

Usage When MAC address table logging is enabled, the switch produces the following

messages:

Note that rapid changes may not be logged. For example, if an entry is added and

then removed within a few seconds, those actions may not be logged.

To see whether MAC address table logging is enabled, use the command show

running-config.

Example To create log messages when the content of the FDB changes, use the command:

awplus# mac address-table logging

Commands

show running-config

Change Message format Example

MAC added MAC add <mac> <port> <vlan>MAC add eccd.6db5.68a7 port1.0.1 vlan2

MAC removed MAC remove <mac> <port> <vlan>MAC remove eccd.6db5.68a7 port1.0.1 vlan2

C613-50292-01 Rev A Command Reference for IE210L Series 491

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

MAC ADDRESS-TABLE STATIC

mac address-table static

Overview Use this command to statically configure the MAC address-table to forward or

discard frames with a matching destination MAC address.

Syntax mac address-table static <mac-addr> {forward|discard} interface

<port> [vlan <vid>]

no mac address-table static <mac-addr> {forward|discard}

interface <port> [vlan <vid>]

Mode Global Configuration

Usage The mac address-table static command is only applicable to Layer 2 switched

traffic within a single VLAN. Do not apply the mac address-table static command

to Layer 3 switched traffic passing from one VLAN to another VLAN. Frames will not

be discarded across VLANs because packets are routed across VLANs. This

command only works on Layer 2 traffic.

Example awplus# configure terminal

awplus(config)# mac address-table static 2222.2222.2222 forward

interface port1.0.4 vlan 3

Commands

clear mac address-table static

show mac address-table

Parameter Description

<mac-addr> The destination MAC address in HHHH.HHHH.HHHH format.

interface

<port> Specify a switch port to be cleared from the filtering database. The

port can be:

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

• a dynamic (LACP) channel group (e.g. po2)

vlan <vid> The ID of a VLAN to apply the command to, in the range 1 to 4094. If

you do not specify a VLAN, the command applies to VLAN1.

C613-50292-01 Rev A Command Reference for IE210L Series 492

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

MAC ADDRESS-TABLE THRASH-LIMIT

mac address-table thrash-limit

Overview Use this command to set the thrash limit on the device.

Thrashing occurs when a MAC address table rapidly “flips” its mapping of a single

MAC address between two switchports on the same VLAN. This is usually because

of a network loop.

Use the no variant of this command to return the thrash limit to its default setting.

Syntax mac address-table thrash-limit <rate>

no mac address-table thrash-limit

Default 10 MAC thrashing flips per second

Mode Global Configuration

Usage Use this command to limit thrashing on the selected port range.

Example To apply a thrash limit of 20 MAC address flips per second:

awplus# configure terminal

awplus(config)# mac address-table thrash-limit 20

Commands

show interface

show mac address-table thrash-limit

thrash-limiting

Parameter Description

<rate> The maximum thrash rate at which limiting is applied. This rate can be set

to between 5 and 255 MAC thrashing flips per second. Once the thrash

limit rate is reached, the port is considered to be thrashing.

C613-50292-01 Rev A Command Reference for IE210L Series 493

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

PLATFORM HWFILTER-SIZE

platform hwfilter-size

Overview You can use this command to control the configuration of hardware Access

Control Lists (ACLs), which determines the total available number and

functionality of hardware ACLs.

For this command to take effect, you need to reboot the affected service.

You cannot attach an IPv6 ACL to a port if the ACL contains a specified source or

destination IPv6 address or both and the hw-filter size setting is

ipv4-limited-ipv6. If you do so, a diagnostic message will be generated.

Syntax platform hwfilter-size {ipv4-limited-ipv6|ipv4-full-ipv6}

Default The default mode is ipv4-limited-ipv6.

Mode Global Configuration

Example To configure hardware ACLs to filter IPv4 and IPv6 traffic, use the following

commands:

awplus# configure terminal

awplus(config)# platform hwfilter-size ipv4-full-ipv6

Commands

show platform

ipv6 access-list (named IPv6 hardware ACL)

Parameter Description

hwfilter-size Configure hardware ACLs command.

ipv4-full-ipv6 Configure hardware ACLs to filter IPv4 traffic, MAC

addresses and IPv6 traffic, including filtering on source or

destination IPv6 addresses, or both; however, this will

reduce the total number of filters available in the hardware

table.

ipv4-limited-ipv6 Configure hardware ACLs to filter IPv4 traffic, MAC

addresses and IPv6 traffic. Source or destination IPv6

addresses or both are not filtered.

C613-50292-01 Rev A Command Reference for IE210L Series 494

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

PLATFORM L3-VLAN-HASHING-ALGORITHM

platform l3-vlan-hashing-algorithm

Overview This command enables you to change the L3 VLAN hash-key-generating

algorithm.

The no variant of this command returns the hash-key algorithm to the default of

crc32l.

Syntax platform l3-vlan-hashing-algorithm

{crc16l|crc16u|crc32l|crc32u}

no platform l3-vlan-hashing-algorithm

Default The hash-key algorithm is crc32l by default.

Mode Global configuration

Usage Occasionally, when using the Multiple Dynamic VLAN feature, a supplicant cannot

be authenticated because a collision occurs within the VLAN L3 table. This can

happen when more than four different IP addresses produce the same hash-key.

When this situation occurs, collisions can sometimes be avoided by changing the

hashing algorithm from its default of crc32l. Several different algorithms may need

to be tried to rectify the problem.

You must restart the switch for this command to take effect.

Note that this command is intended for technical support staff, or advanced end

users.

Example To change the hash-key generating algorithm applying to the lower bits of CRC-16,

use the command:

awplus# configure terminal

awplus(config)# platform l3-vlan-hashing-algorithm crc16l

Commands

platform mac-vlan-hashing-algorithm

show platform

Parameter Description

crc16l The algorithm that will apply to the lower bits of CRC-16

crc16u The algorithm that will apply to the upper bits of CRC-16

crc32l The algorithm that will apply to the lower bits of CRC-32

crc32u The algorithm that will apply to the upper bits of CRC-32

C613-50292-01 Rev A Command Reference for IE210L Series 495

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

PLATFORM LOAD-BALANCING

platform load-balancing

Overview This command selects which address fields are used as inputs into the load

balancing algorithm for aggregated links. The output from this algorithm is used

to select which individual path a given packet will traverse within an aggregated

link.

The no variant of this command applies its default setting.

Syntax platform load-balancing {src-dst-mac|src-dst-ip}

no platform load-balancing

Default The default is src-dst-ip.

Mode Global configuration

Examples To set the load balancing algorithm to include only Layer 2 MAC addresses, use the

commands:

awplus# configure terminal

awplus(config)# platform load-balancing src-dst-mac

To set the load balancing algorithm to include only Layer 3 IP addresses and Layer

4 ports, use the commands:

awplus# configure terminal

awplus(config)# platform load-balancing src-dst-ip

Commands

show platform

Parameter Description

src-dst-mac Include the source and destination MAC addresses (Layer 2)

src-dst-ip Include the source and destination IP addresses (Layer 3) and

UDP/TCP source and destination ports.

If you choose this option, the algorithm will use MAC addresses

to calculate load balancing for Layer 2 and non-IP packets.

C613-50292-01 Rev A Command Reference for IE210L Series 496

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

PLATFORM MAC-VLAN-HASHING-ALGORITHM

platform mac-vlan-hashing-algorithm

Overview This command enables you to change the MAC VLAN hash-key-generating

algorithm.

The no variant of this command returns the hash-key algorithm to the default of

crc32l

Syntax platform mac-vlan-hashing-algorithm

{crc16l|crc16u|crc32l|crc32u}

no platform mac-vlan-hashing-algorithm

Default The hash-key algorithm is crc32l by default.

Mode Global configuration

Usage Occasionally, when using the Multiple Dynamic VLAN feature, a supplicant cannot

be authenticated because a collision occurs within the VLAN MAC table. This can

happen when more than four different MAC addresses produce the same

hash-key.

When this situation occurs, collisions can sometimes be avoided by changing the

hashing algorithm from its default of crc32l. Several different algorithms may need

to be tried to rectify the problem.

You must restart the switch for this command to take effect.

Note that this command is intended for technical support staff, or advanced end

users.

Example To change the hash-key generating algorithm applying to the lower bits of CRC-16,

use the command:

awplus# configure terminal

awplus(config)# platform mac-vlan-hashing-algorithm crc16l

Commands

platform l3-vlan-hashing-algorithm

show platform

Parameter Description

crc16l The algorithm that will apply to the lower bits of CRC-16

crc16u The algorithm that will apply to the upper bits of CRC-16

crc32l The algorithm that will apply to the lower bits of CRC-32

crc32u The algorithm that will apply to the upper bits of CRC-32

C613-50292-01 Rev A Command Reference for IE210L Series 497

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

PLATFORM MULTICAST-RATELIMIT

platform multicast-ratelimit

Overview Use this command to set the maximum number of multicast packets to be

forwarded to the CPU (in packets per second). Setting the value to zero disables

rate limiting.

This command should be used with care. Increasing or removing the limit could

make the device less responsive under heavy multicast load.

Use the no variant of this command to return the limit to its default.

Syntax platform multicast-ratelimit <0-100>

no platform multicast-ratelimit

Default 10 packets per second (pps)

Mode Global Configuration

Usage If you find that the CPU load on your device from multicast traffic is higher than

desired, reducing this rate may reduce the CPU load.

If you need the device to process a large amount of multicast traffic, increasing this

rate may improve performance.

Example To set the rate to 30pps, use the commands:

awplus# configure terminal

awplus(config)# platform multicast-ratelimit 30

Command

changes

Version 5.4.8-1.1: default changed to 100pps on SBx908 GEN2, SBx8100, and x930

Series switches.

C613-50292-01 Rev A Command Reference for IE210L Series 498

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

PLATFORM STOP-UNREG-MC-FLOODING

platform stop-unreg-mc-flooding

Overview If a multicast stream is arriving at a network device, and that network device has

received no IGMP reports that request the receipt of the stream, then that stream

is referred to as "unregistered". IGMP snooping actively prevents the flooding of

unregistered streams to all ports in the VLAN on which the stream is received.

However, there are brief moments at which this prevention is not in operation, and

an unregistered stream may be briefly flooded. This command stops this flooding

during even those brief periods when IGMP snooping is not explicitly preventing

the flooding.

Use the no variant of this command to revert to default behavior and disable this

feature.

NOTE: This command should not be used within any IPv6 networks. IPv6 neighbor

discovery operation is inhibited by this feature.

This command does not affect the flooding of Local Network Control Block IPv4

multicast packets in the address range 224.0.0.1 to 224.0.0.255 (224.0.0/24). Such

packets will continue to be uninterruptedly flooded, as they need to be.

Syntax platform stop-unreg-mc-flooding

no platform stop-unreg-mc-flooding

Default This feature is disabled by default.

Mode Global Configuration

Usage This command stops the periodic flooding of unknown or unregistered multicast

packets when the Group Membership interval timer expires and there are no

subscribers to a multicast group. If there is multicast traffic in a VLAN without

subscribers, multicast traffic temporarily floods out of the VLAN when the Group

Membership interval timer expires, which happens when the switch does not get

replies from Group Membership queries.

This command also stops the initial flood of multicast packets that happens when

a new multicast source starts to send traffic. This flooding lasts until snooping

realises that this the multicast group is arriving at the switch, and puts an entry into

hardware to prevent it from being flooded.

This command is useful in networks where low-performance devices are attached.

The operation of such devices can be impaired by them receiving unnecessary

streams of traffic. For example, in sites where IP cameras are in use, the flooding of

video streams to a whole VLAN can send enough traffic to the cameras to cause

interruption of their video streaming.

Output Do not use this command in IPv6 networks. The following console message is

displayed after entering this command to warn you of this:

% WARNING: IPv6 will not work with this setting enabled

% Please consult the documentation for more information

C613-50292-01 Rev A Command Reference for IE210L Series 499

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

PLATFORM STOP-UNREG-MC-FLOODING

Examples To enable this feature and stop multicast packet flooding, use the following

commands:

awplus# configure terminal

awplus(config)# platform stop-unreg-mc-flooding

To disable this feature and allow multicast packet flooding, use the following

commands:

awplus# configure terminal

awplus(config)# no platform stop-unreg-mc-flooding

Commands

show platform

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 500

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

PLATFORM VLAN-STACKING-TPID

platform vlan-stacking-tpid

Overview This command specifies the Tag Protocol Identifier (TPID) value that applies to all

frames that are carrying double tagged VLANs. All nested VLANs must use the

same TPID value. (This feature is sometimes referred to as VLAN stacking or VLAN

double-tagging.)

Use the no variant of this command to revert to the default TPID value (0x8100).

NOTE: Because the additional tag increases the frame size beyond 1522 bytes, you

must increase the MRU size to activate VLAN-stacking. Go into interface mode for the

appropriate ports and use the mru command.

Syntax platform vlan-stacking-tpid <tpid>

no platform vlan-stacking-tpid

Default The default TPID value is 0x8100.

Mode Global Configuration

Examples To set the VLAN stacking TPID value to 0x9100, use the following commands:

awplus# configure terminal

awplus(config)# platform vlan-stacking-tpid 9100

To reset the VLAN stacking TPID value to the default (0x8100), use the following

commands:

awplus# configure terminal

awplus(config)# no platform vlan-stacking-tpid

Commands

switchport vlan-stacking (double tagging)

show platform

show running-config

Parameter Description

<tpid> The Ethernet type of the tagged packet, as a two byte hexadecimal

number.

C613-50292-01 Rev A Command Reference for IE210L Series 501

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

POLARITY

polarity

Overview This command sets the MDI/MDIX polarity on a copper-based switch port.

Syntax polarity {auto|mdi|mdix}

Default By default, switch ports set the polarity automatically (auto).

Mode Interface Configuration

Usage We recommend the default auto setting for MDI/MDIX polarity. Polarity applies to

copper 10BASE-T, 100BASE-T, and 1000BASE-T switch ports; it does not apply to

fiber ports. See the “MDI/MDIX Connection Modes” section in the Switching

Feature Overview and Configuration Guide for more information.

Example To set the polarity for port1.0.4 to fixed MDI mode, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.4

awplus(config-if)# polarity mdi

Parameter Description

mdi Sets the polarity to MDI (medium dependent interface).

mdix Sets the polarity to MDI-X (medium dependent interface crossover).

auto The switch port sets the polarity automatically. This is the default option.

C613-50292-01 Rev A Command Reference for IE210L Series 502

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW DEBUGGING LOOPPROT

show debugging loopprot

Overview This command shows Loop Protection debugging information.

Syntax show debugging loopprot

Mode User Exec and Privileged Exec

Example To display the enabled Loop Protection debugging modes, use the command:

awplus# show debugging loopprot

Commands

debug loopprot

C613-50292-01 Rev A Command Reference for IE210L Series 503

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW DEBUGGING PLATFORM PACKET

show debugging platform packet

Overview This command shows platform to CPU level packet debugging information.

Syntax show debugging platform packet

Mode User Exec and Privileged Exec

Example To display the platform packet debugging information, use the command:

awplus# show debugging platform packet

Commands

debug platform packet

undebug platform packet

C613-50292-01 Rev A Command Reference for IE210L Series 504

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW FLOWCONTROL INTERFACE

show flowcontrol interface

Overview Use this command to display flow control information.

Syntax show flowcontrol interface <port>

Mode User Exec and Privileged Exec

Example To display the flow control for port1.0.3, use the command:

awplus# show flowcontrol interface port1.0.3

Output Figure 15-1: Example output from the show flowcontrol interface command

for a specific interface

Parameter Description

<port> Specifies the name of the port to be displayed.

Port Send FlowControl Receive FlowControl RxPause TxPause

admin oper admin oper

----- ------- -------- ------- -------- ------- -------

port1.0.3 on on on on 0 0

C613-50292-01 Rev A Command Reference for IE210L Series 505

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW INTERFACE ERR-DISABLED

show interface err-disabled

Overview Use this command to show the ports which have been dynamically shut down by

protocols running on the device and the protocols responsible for the shutdown.

Syntax show interface [<interface-range> err-disabled]

Mode User Exec and Privileged Exec

Example To show which protocols have shut down ports, use the commands:

awplus# show interface err-disabled

Output Figure 15-2: Example output from show interface err-disabled

Parameter Description

<interface-range> Interface range

err-disabled Brief summary of interfaces shut down by protocols

awplus#show interface err-disabled

Interface Reason

port1.0.1 loop protection

port1.0.2 loop protection

C613-50292-01 Rev A Command Reference for IE210L Series 506

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW INTERFACE SWITCHPORT

show interface switchport

Overview Use this command to show VLAN information about each switch port.

Syntax show interface switchport

Mode User Exec and Privileged Exec

Example To display VLAN information about each switch port, enter the command:

awplus# show interface switchport

Output Figure 15-3: Example output from the show interface switchport command

Commands

show interface memory

Interface name : port1.0.1

Switchport mode : access

Ingress filter : enable

Acceptable frame types : all

Default Vlan : 1

Configured Vlans : 2

Dynamic Vlans :



Interface name : port1.0.2

Switchport mode : trunk

Ingress filter : enable

Acceptable frame types : all

Default Vlan : 1

Configured Vlans : 1 4 5 6 7 8

Dynamic Vlans :

...

C613-50292-01 Rev A Command Reference for IE210L Series 507

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW LOOP-PROTECTION

show loop-protection

Overview Use this command to display the current loop protection setup for the device.

Syntax show loop-protection [interface <port-list>] [counters]

Mode User Exec and Privileged Exec

Usage This command is used to display the current configuration and operation of the

Loop Protection feature

Examples To display the current configuration status, use the command:

awplus# show loop-protection

Figure 15-4: Example output from the show loop-protection command

To display the counter information, use the command:

awplus# show loop-protection counters

Figure 15-5: Example output from the show loop-protection counters

command

Parameter Description

interface The interface selected for display.

<port-list>A port, a port range, or an aggregated link.

counters Displays counter information for loop protection.

awplus#show loop-protection



LDF Interval: 10

LDF Rx Window: 3

Fast Block: Disabled

Timeout

Int Enabled Action Status Timeout Remain Rx port

--------------------------------------------------------------------------

port1.0.1 Yes vlan-dis Normal 7 - -

port1.0.2 Yes vlan-dis Normal 7 - -

port1.0.3 Yes vlan-dis Normal 7 - -

...

C613-50292-01 Rev A Command Reference for IE210L Series 508

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW LOOP-PROTECTION

awplus#show loop-protection counters



Switch Loop Detection Counter



Interface Tx Rx Rx Invalid Last LDF Rx

-------------------------------------------------------------------------

port1.0.1

vlan1 60 0 0 -

port1.0.2

vlan1 0 0 0 -

port1.0.3

vlan1 0 0 0 -

...

C613-50292-01 Rev A Command Reference for IE210L Series 509

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW MAC ADDRESS-TABLE

show mac address-table

Overview Use this command to display the MAC address-table for all

configured VLANs.

Syntax show mac address-table

Mode User Exec and Privileged Exec

Usage The show mac address-table command is only applicable to view a MAC

address-table for Layer 2 switched traffic within VLANs.

Example To display the mac address-table, use the following command:

awplus# show mac address-table

Output See the following sample output captured when there was no traffic being

switched:

See the sample output captured when packets were switched and MAC addresses

were learned:

Note the new MAC addresses learned for port1.0.2 and port1.0.3 added as dynamic

entries.

Note the first column of the output below shows VLAN IDs if multiple VLANs are

configured:

awplus#show mac address-table



VLAN port mac type

1 unknown 0000.cd28.0752 forward static

ARP - 0000.cd00.0000 forward static

awplus#show mac address-table



VLAN port mac type

1 unknown 0000.cd28.0752 forward static

1 port1.0.2 0030.846e.9bf4 forward dynamic

1 port1.0.3 0030.846e.bac7 forward dynamic 

ARP - 0000.cd00.0000 forward static

awplus#show mac address-table



VLAN port mac type

1 unknown 0000.cd28.0752 forward static

1 port1.0.2 0030.846e.bac7 forward dynamic

2 unknown 0000.cd28.0752 forward static

2 port1.0.3 0030.846e.9bf4 forward dynamic 

ARP - 0000.cd00.0000 forward static

C613-50292-01 Rev A Command Reference for IE210L Series 510

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW MAC ADDRESS-TABLE

Also note if manually configured static MAC addresses exist, this is shown to the

right of the type column:

Commands

clear mac address-table dynamic

clear mac address-table static

mac address-table static

awplus(config)#mac address-table static 0000.1111.2222 for int 

port1.0.3 vlan 1

awplus(config)#end

awplus#

awplus#show mac address-table



VLAN port mac type

1 unknown 0000.cd28.0752 forward static

1 port1.0.2 0030.846e.bac7 forward dynamic

1 port1.0.3 0000.1111.2222 forward static

...

C613-50292-01 Rev A Command Reference for IE210L Series 511

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW MAC ADDRESS-TABLE THRASH-LIMIT

show mac address-table thrash-limit

Overview Use this command to display the current thrash limit set for all interfaces on the

device.

Syntax show mac address-table thrash-limit

Mode User Exec and Privileged Exec

Example To display the current, use the following command:

awplus# show mac address-table thrash-limit

Output Figure 15-6: Example output from the show mac address-table thrash-limit

command

Commands

mac address-table thrash-limit

% Thrash-limit 7 movements per second

C613-50292-01 Rev A Command Reference for IE210L Series 512

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PLATFORM

show platform

Overview This command displays the settings configured by using the platform commands.

Syntax show platform

Mode Privileged Exec

Usage This command displays the settings in the running config. For changes in some of

these settings to take effect, the device must be rebooted with the new settings in

the startup config.

Example To check the settings configured with platform commands on the device, use the

following command:

awplus# show platform

Output Figure 15-7: Example output from the show platform command

awplus# show platform



MAC vlan hashing algorithm crc32l

L3 hashing algorithm crc32l

Load Balancing src-dst-ip

stop-unreg-mc-flooding off

Vlan-stacking TPID 0x8100

Hardware Filter Size ipv4-limited-ipv6

Table 16: Parameters in the output of the show platform command. Note that the parameters

displayed depend on your device, and that not all displayed parameters can be modified on

all devices.

Parameter Description

Routing Ratio Whether all memory is allocated to IPv4 address table entries only, or whether it is

allocated evenly to both IPv4 and IPv6 addresses (set with the platform

routingratio command).

Route Weighting The split between multicast and unicast route entries (set with the platform

routingratio command).

MAC vlan hashing

algorithm

The MAC VLAN hash-key-generating algorithm (set with the platform

mac-vlan-hashing-algorithm command). The default algorithm is crc32l. The

algorithm may need to be changed in rare circumstances in which hash collisions

occur.

L3 hashing algorithm The L3 VLAN hash-key-generating algorithm (set with the platform

l3-vlan-hashing-algorithm command). The default algorithm is crc32l. The

algorithm may need to be changed in rare circumstances in which hash collisions

occur.

C613-50292-01 Rev A Command Reference for IE210L Series 513

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PLATFORM

Load Balancing Which packet fields are used in the channel load balancing algorithm (set with the

platform load-balancing command).

Control-plane-

prioritization

Maximum traffic rate on the CPU port (set with the platform

control-plane-prioritization rate command).

Fdb-chain-length The length of the FDB hash chain (set with the platform fdb-chain-length

command). FDB entries are hashed and indexed using a hash. In rare

circumstances it may be useful to reduce the chain length.

L2MC overlapped group

check

Whether Layer 2 multicast entries are checked before deletion (set with the

platform l2mc-overlap command).

silicon-profile The silicon profile setting (set with the platform silicon-profile command) for the

switch hardware; one of:

•profile 1

•profile 2

•profile 3

• None (default)

fdb-l3-hosts mode Whether Host Mode is turned on or not. Host Mode increases the number of host

entries and is available for systems containing SBx81CFC960 controller cards and

SBx81XLEM line cards. See platform silicon-profile and platform fdb-l3-hosts

for details.

Jumboframe support Whether the jumbo frames setting is enabled or disabled (set with the platform

jumboframe command).

Traffic Manager A test setting that is disabled by default.

stop-unreg-mc-flooding Whether the stop-unreg-mc-flooding feature is on or off (set with the platform

stop-unreg-mc-flooding command). This feature prevents flooding of

unregistered multicast packets in the occasional situations in which IGMP

snooping does not prevent it.

Port Mode Whether each port on the AT-StackQS is configured as one 40Gbps port or four

10Gbps ports, if they are operating as network ports (set with the platform

portmode interface command).

Vlan-stacking TPID The value of the TPID set in the Ethernet type field when a frame has a double

VLAN tag (set with the platform vlan-stacking-tpid command).

PBR enabled Whether policy-based routing is globally enabled or not (set with the platform

pbr-enable command).

Table 16: Parameters in the output of the show platform command. Note that the parameters

displayed depend on your device, and that not all displayed parameters can be modified on

all devices. (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 514

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PLATFORM

Hardware Filter Size Whether hardware ACLs can filter on IPv6 addresses (ipv4-full-ipv6) or not

(ipv4-limited-ipv6). This is set with the platform hwfilter-size command.

Vlan Ingress Filter Hard

Drop

The Bridge Vlan Ingress Filtering drops traffic if the VID assigned to the packet

does not match with the port’s VLAN membership.

There are two ways the traffic is dropped by the Ingress Filtering mechanism:

• HARD DROP - Traffic is dropped by the Bridge Engine and not forwarded or

trapped.

• SOFT DROP - Traffic may be mirrored or trapped by the Bridge Engine.

Table 16: Parameters in the output of the show platform command. Note that the parameters

displayed depend on your device, and that not all displayed parameters can be modified on

all devices. (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 515

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PLATFORM CLASSIFIER STATISTICS UTILIZATION BRIEF

show platform classifier statistics utilization

brief

Overview This command displays the number of used entries available for various platform

functions, and the percentage that number of entries represents of the total

available.

Syntax show platform classifier statistics utilization brief

Mode Privileged Exec

Example To display the platform classifier utilization statistics, use the following command:

awplus# show platform classifier statistics utilization brief

Output Figure 15-8: Output from show platform classifier statistics utilization brief

Output Figure 15-9: Output from show platform classifier statistics utilization brief

In this example, there is one UFO VLAN and one upstream port consuming 3 FP

entries.

#show platform classifier statistics utilization brief

[Instance 0]

Capacity: 503

Number of Entries:

Policy Type Group ID Used / Allocated

----------------------------------------------

ACL 1476395010 0 / 119 ( 0%)

Interface 0

VACL 0

Flooding Nexthop Inactive 0 / 0 ( 0%)

Remote-Mirror Inactive 0 / 0 ( 0%)

UFO Inactive 0 / 0 ( 0%)

QoS Inactive 0 / 0 ( 0%)



Rule Limit Reached (clear on read): 0

Total Rule Limit Reached from startup: 0



Space will be allocated to QOS as required.

C613-50292-01 Rev A Command Reference for IE210L Series 516

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PLATFORM CLASSIFIER STATISTICS UTILIZATION BRIEF

Output

parameters

Depending on your switch, you will see some of the following parameters in the

output from show platform classifier statistics utilization brief

#show platform classifier statistics utilization brief



[Instance 4]

Number of Entries:

Policy Type Group ID Used / Total

---------------------------------------------- 

ACL 1476395010 0 / 117 ( 0%)

Interface 0

VACL 0

DoS Inactive 0 / 0 ( 0%

VLAN Counter

Group-Octet Inactive 0 / 0 ( 0%)

Group-Packet Inactive 0 / 0 ( 0%)

Floding Nexthop Inactive 0 / 0 ( 0%)

Remote-Mirror Inactive 0 / 0 ( 0%)

UFO 1476395012 3 / 128 ( 2%)

QoS 0 / 256 ( 0%)

[Instance 5]

Number of Entries:

Policy Type Group ID Used / Total

----------------------------------------------

ACL 1476395010 0 / 117 ( 0%)

Interface 0

VACL 0

DoS Inactive 0 / 0 ( 0%)

VLAN Counter

Group-Octet Inactive 0 / 0 ( 0%)

Group-Packet Inactive 0 / 0 ( 0%)

Floding Nexthop Inactive 0 / 0 ( 0%)

Remote-Mirror Inactive 0 / 0 ( 0%)

UFO 1476395012 3 / 128 ( 2%)

QoS 0 / 256 ( 0%)

Parameter Description

IPv6 Multicast Reserved hardware space for use by IPv6 multicast.

System Fixed system entries. For example, resiliency links make use of system ACLs.

MLD Snooping Entries to send various packets that MLD Snooping is interested in to the CPU.

DHCP Snooping Entries used to send DHCP and ARP packets to the CPU. User-added DHCP

Snooping filters under ACLs are counted under the ACL or QoS categories.

Loop Detection Entries uses to send the special loop detection frame to the CPU.

EPSR Entries used to send EPSR control traffic to the CPU.

CFM Entries used by Connectivity Fault Management.

C613-50292-01 Rev A Command Reference for IE210L Series 517

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PLATFORM CLASSIFIER STATISTICS UTILIZATION BRIEF

Commands

show platform

ipv6 access-list (named IPv6 hardware ACL)

G8032 Entries used to send G.8032 control traffic to the CPU.

Global ACLs Entries for ACLs appear here if the ACLs are applied globally instead of per

switchport.

ACL Entries for ACL filters that have been applied directly to ports using the

access-group command.

VACL Entries for VLAN-based ACLs (ACLs that are applied to VLANs instead of ports).

DOS Entries used for Denial of Service protection.

UFO Entries used by Upward Forwarding Only (UFO).

QoS Entries for ACL filters and other class-map configurations, such as policers, applied

through policy maps using the service input command.

RA Guard Entries used to block IPv6 router advertisements, configured with the ipv6 nd

raguard command.

AMFAPPS Entries used by AMF Application Proxy. These entries enable the SES Controller to

block infected ports.

Pre-Ingress Entries used for VLAN ID Translation (and also for subnet-based and MAC-based

VLAN entries on SBx81XLEM cards).

Egress Entries used for VLAN ID Translation.

UDB User Defined Bytes (UDB), which are a limited resource of bytes that can be used to

implement additional arbitrary matching on packet bytes on some switches. The

software manages the use and allocation of these bytes automatically. The output

of this table is intended for use by Allied Telesis Customer Support only.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 518

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PLATFORM PORT

show platform port

Overview This command displays the various port registers or platform counters for

specified switchports.

Syntax show platform port [<port-list>] [counters]

Mode Privileged Exec

Examples To display port registers for port1.0.1 to port1.0.4 use the following command:

awplus# show platform port port1.0.1-port1.0.4

To display platform counters for port1.0.1 to port1.0.4 use the following command:

awplus# show platform port port1.0.1-port1.0.4 counters

Output Figure 15-10: Example output from the show platform port command

Parameter Description

<port-list> The ports to display information about. A port-list can be:

• a switchport (e.g. port1.0.4)

• a continuous range of ports separated by a hyphen (e.g.

port1.0.1-1.0.4)

• a comma-separated list (e.g. port1.0.1,port1.0.3-1.0.4). Do not mix

port types in the same list.

counters Show the platform counters.

C613-50292-01 Rev A Command Reference for IE210L Series 519

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PLATFORM PORT

awplus#show platform port port1.0.1

Phy register value for port1.0.1 (ifindex: 5001)



00:1140 01:79ed 02:600d 03:85b0 04:01e1 05:cde1 06:006d 07:2001

08:4006 09:0600 0a:7800 0b:0000 0c:0000 0d:4007 0e:0000 0f:3000

10:0021 11:2f00 12:0000 13:0000 14:0000 15:0236 16:0000 17:0000

18:4c00 19:871c 1a:0000 1b:ffff 1c:0000 1d:0405 1e:0000 1f:0000



Port configuration for lport 0x08002002:

Phy Driver: 542XX Gigabit PHY Driver

enabled: 1

loopback: 0

link: 1

speed: 1000 max speed: 1000

duplex: 1

linkscan: 2

autonegotiate: 1

master: 2

tx pause: 0 rx pause: 0

untagged vlan: 1

vlan filter: 3

stp state: 4

learn: 5

discard: 0

jam: 0

max frame size: 1482

MC Disable SA: no

MC Disable TTL: no

MC egress untag: 0

MC egress vid: 1

MC TTL threshold: -1

C613-50292-01 Rev A Command Reference for IE210L Series 520

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PORT-SECURITY INTERFACE

show port-security interface

Overview Use this command to show the current port-security configuration and the switch

port status.

Syntax show port-security interface <port>

Mode Privileged Exec

Example To see the port-security status on port1.0.2, use the following command:

awplus# show port-security interface port1.0.2

Output Figure 15-11: Example output from the show port-security interface command

Commands

clear port-security intrusion

show port-security intrusion

switchport port-security

switchport port-security aging

switchport port-security maximum

switchport port-security violation

Parameter Description

<port> The port to display information about. The port may be a switch

port (e.g. port1.0.2), a static channel group (e.g. sa3), or a

dynamic (LACP) channel group (e.g. po4).

Port Security configuration

Security Enabled : YES

Port Status : ENABLED

Violation Mode : TRAP

Aging : OFF

Maximum MAC Addresses : 3

Total MAC ddresses : 1

Lock Status : UNLOCKED

Security Violation Count : 0

Last Violation Source Address : None

C613-50292-01 Rev A Command Reference for IE210L Series 521

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW PORT-SECURITY INTRUSION

show port-security intrusion

Overview Use this command to show the intrusion list. If the port is not specified, the entire

intrusion table is shown.

Syntax show port-security intrusion [interface <port>]

Mode Privileged Exec

Example To see the intrusion list on port1.0.2, use the following command:

awplus# show port-security intrusion interface port1.0.2

Output Figure 15-12: Example output from the show port-security intrusion command

for port1.0.2

Commands

clear port-security intrusion

show port-security interface

switchport port-security

switchport port-security aging

switchport port-security maximum

switchport port-security violation

Parameter Description

interface Specify a port

<port>The port to display information about. The port may be a switch

port (e.g. port1.0.2), a static channel group (e.g. sa3), or a

dynamic (LACP) channel group (e.g. po4).

Port Security Intrusion List 

Interface: port1.0.2 -3 intrusion(s) detected 

11-22-33-44-55-04 11-22-33-44-55-06 11-22-33-44-55- 08

C613-50292-01 Rev A Command Reference for IE210L Series 522

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SHOW STORM-CONTROL

show storm-control

Overview Use this command to display storm-control information for all interfaces or a

particular interface.

Syntax show storm-control [<port>]

Mode User Exec and Privileged Exec

Example To display storm-control information for port1.0.2, use the following command:

awplus# show storm-control port1.0.2

Output Figure 15-13: Example output from the show storm-control command for

port1.0.2

Commands

storm-control level

Parameter Description

<port>The port to display information about. The port may be:

• a switchport (e.g. port1.0.4)

• a static channel group (e.g. sa2)

• a dynamic (LACP) channel group (e.g. po2)

Port BcastLevel McastLevel DlfLevel

port1.0.2 40. 0% 100. 0% 100. 0%

C613-50292-01 Rev A Command Reference for IE210L Series 523

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SPEED

speed

Overview This command changes the speed of the specified port. You can optionally specify

the speed or speeds that get autonegotiated, so autonegotiation is only

attempted at the specified speeds.

To see the currently-negotiated speed for ports whose links are up, use the show

interface command. To see the configured speed (when different from the

default), use the show running-config command.

Syntax speed {10|100|1000}

speed auto [10] [100] [1000]

The following table shows the speed options for each type of port.

Mode Interface Configuration

Default By default, ports autonegotiate speed (except for 100Base-FX ports which do not

support auto-negotiation, so default to 100 Mbps).

Usage We recommend having autonegotiation enabled for link speeds of 1000 Mbps and

above. For example, to apply a fixed speed of 1000 Mbps use the command speed

auto 1000.

If multiple speeds are specified after the auto option to autonegotiate speeds, then

the device only attempts autonegotiation at those specified speeds.

Switch ports in a static or dynamic (LACP) channel group must have the same port

speed and be in full duplex mode. Once switch ports have been aggregated into a

channel group, you can set the speed of all the switch ports in the channel group

by applying this command to the channel group.

Port type Speed Options (units are Mbps)

RJ-45 copper ports auto (default)

100

1000

tri-speed copper SFPs auto (default)

100

1000

100 Mbps fiber SFPs 100

1000 Mbps fiber SFPs auto (default)

1000

1000 Mbps copper SFPs auto (default)

1000

C613-50292-01 Rev A Command Reference for IE210L Series 524

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SPEED

Examples To set the speed of a tri-speed port to 100 Mbps, enter the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# speed 100

To return the port to auto-negotiating its speed, enter the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# speed auto

To set the port to auto-negotiate its speed at 100 Mbps and 1000 Mbps, enter the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# speed auto 100 1000

To set the port to auto-negotiate its speed at 1000 Mbps only, which will fix this

port speed to 1000 Mbps, enter the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# speed auto 1000

Commands

duplex

polarity

show interface

speed (asyn)

C613-50292-01 Rev A Command Reference for IE210L Series 525

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

STORM-CONTROL LEVEL

storm-control level

Overview Use this command to specify the speed limiting level for broadcasting, multicast,

or destination lookup failure (DLF) traffic for the port. Storm-control limits the

selected traffic type to the specified percentage of the maximum port speed.

Use the no variant of this command to disable storm-control for broadcast,

multicast or DLF traffic.

Syntax storm-control {broadcast|multicast|dlf} level <level>

no storm-control {broadcast|multicast|dlf} level

Default By default, storm-control is disabled.

Mode Interface Configuration

Usage Flooding techniques are used to block the forwarding of unnecessary flooded

traffic. A packet storm occurs when a large number of broadcast packets are

received on a port. Forwarding these packets can cause the network to slow down

or time out.

Example To limit broadcast traffic on port1.0.2 to 30% of the maximum port speed, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# storm-control broadcast level 30

Commands

show storm-control

Parameter Description

<level> <0-100> Specifies the percentage of the maximum port speed

allowed for broadcast, multicast or destination lookup failure traffic.

broadcast Applies the storm-control to broadcast frames.

multicast Applies the storm-control to multicast frames.

dlf Applies the storm-control to destination lookup failure traffic.

C613-50292-01 Rev A Command Reference for IE210L Series 526

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SWITCHPORT PORT-SECURITY

switchport port-security

Overview Use this command to enable the port-security feature. This feature is also known

as the port-based learn limit. It allows the user to set the maximum number of MAC

addresses that each port can learn.

Use the no variant of this command to disable the port-security feature.

Syntax switchport port-security

no switchport port-security

Mode Interface Configuration

Examples To enable the port-security feature on port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport port-security

To disable the port-security feature on port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport port-security

Commands

clear port-security intrusion

show port-security interface

show port-security intrusion

switchport port-security aging

switchport port-security maximum

switchport port-security violation

C613-50292-01 Rev A Command Reference for IE210L Series 527

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SWITCHPORT PORT-SECURITY AGING

switchport port-security aging

Overview Use this command to set MAC addresses that have been learned by port security

to age out.

Use the no variant of this command to set the MAC addresses to not age out.

Syntax switchport port-security aging

no switchport port-security aging

Mode Interface Configuration

Examples To set port1.0.2 so that the MAC addresses that have been learned by port security

age out, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport port-security aging

To stop the MAC addresses that have been learned by port security from aging out

on port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport port-security aging

Commands

clear port-security intrusion

show port-security interface

show port-security intrusion

switchport port-security

switchport port-security maximum

switchport port-security violation

C613-50292-01 Rev A Command Reference for IE210L Series 528

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SWITCHPORT PORT-SECURITY MAXIMUM

switchport port-security maximum

Overview Use this command to set the maximum number of MAC addresses that each port

can learn.

Use the no variant of this command to unset the maximum number of MAC

addresses that each port can learn. This is same as setting the maximum number

to 0. This command also resets the intrusion list table.

If a new MAC is seen on a port with port security enabled and the MAC is statically

configured for another port, a violation is triggered. The maximum learn limit will

be ignored and the specified intrusion action for the port will be carried out.

Syntax switchport port-security maximum <0-256>

no switchport port-security maximum

Mode Interface Configuration

Examples To learn 3 MAC addresses on port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport port-security maximum 3

To remove the MAC learning limit on port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport port-security maximum

Commands

clear port-security intrusion

show port-security interface

show port-security intrusion

switchport port-security

switchport port-security aging

switchport port-security violation

Parameter Description

maximum <0-256> Specify the maximum number of addresses to learn.

C613-50292-01 Rev A Command Reference for IE210L Series 529

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

SWITCHPORT PORT-SECURITY VIOLATION

switchport port-security violation

Overview Use this command to set the action taken on a switch port when the port exceeds

the learning limits. The port action can be either shutdown, restrict or protect. If

shutdown is set, the physical link will be disabled and “shutdown” will be shown

in the config. If restrict is set, the packet from the un-authorized MAC will be

discarded and SNMP TRAP will be generated to alert management. If protect is set,

the packet will simply be discarded by the packet processor silently.

Use the no variant of this command to set the violation action to default. The

default violation action is protect.

Syntax switchport port-security violation {shutdown|restrict|protect}

no switchport port-security violation

Mode Interface Configuration

Examples To set the action to be shutdown on port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport port-security violation shutdown

To set the port-security action to the default (protect) on port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport port-security violation

Commands

clear port-security intrusion

show port-security interface

show port-security intrusion

switchport port-security

switchport port-security aging

switchport port-security maximum

Parameter Description

shutdown Disable the port.

restrict Alert the network administrator.

protect Discard the packet.

C613-50292-01 Rev A Command Reference for IE210L Series 530

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

THRASH-LIMITING

thrash-limiting

Overview Use this command to configure the thrash limit action that will be applied to a port

on the device when a thrashing condition is detected. The thrash-limiting timeout

specifies the time, in seconds, for which the action is employed.

Use the no variant of this command to return the action or timeout to its default

setting.

Syntax thrash-limiting {[action

{learn-disable|link-down|port-disable|vlan-disable|none}]

[timeout <0-86400>]}

no thrash-limiting {action|timeout}

Default The default action is learn-disable and the default timeout is 1 second.

Mode Interface Configuration

Usage Thrash-limiting actions are initiated when MAC addresses are added and removed

from a port’s MAC table faster than a given rate. The rate is 10 MAC address

changes per second by default. You can change it with the mac address-table

thrash-limit command.

See the “Thrash Limiting” section in the Switching Feature Overview and

Configuration Guide for more information.

Examples To set the action to learn disable for port1.0.1, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# thrash-limiting action learn-disable

Parameter Description

action The action taken when MAC thrashing is detected.

learn-disable Disable MAC address learning

link-down Block all traffic on an interface - link down

port-disable Block all traffic on an interface - link remains up

vlan-disable Block all traffic on a VLAN if the switch detects thrashing for

that VLAN on the selected port. Note that setting this

parameter will also enable ingress filtering.

none No thrash action

timeout Set the duration for the thrash action

<0-86400> The duration of the applied thrash action in seconds. The

default is 1 seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 531

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

THRASH-LIMITING

To block all traffic on a VLAN on port1.0.1 if the switch detects thrashing for that

VLAN on that port, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# thrash-limiting action vlan-disable

To set the thrash limiting action to its default on port1.0.1, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no thrash-limiting action

To set the thrash limiting timeout to 5 seconds on port1.0.1, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# thrash-limiting timeout 5

To set the thrash limiting timeout value to its default on port1.0.1, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no thrash-limiting timeout

Commands

mac address-table thrash-limit

show interface

C613-50292-01 Rev A Command Reference for IE210L Series 532

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

UNDEBUG LOOPPROT

undebug loopprot

Overview This command applies the functionality of the no debug loopprot command.

C613-50292-01 Rev A Command Reference for IE210L Series 533

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SWITCHING COMMANDS

UNDEBUG PLATFORM PACKET

undebug platform packet

Overview This command applies the functionality of the no debug platform packet

command.

C613-50292-01 Rev A Command Reference for IE210L Series 534

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

VLANs. For more information see the VLAN Feature Overview and Configuration

Guide.

Command List •“debug private-vlan ufo” on page 536

•“port-vlan-forwarding-priority” on page 537

•“private-vlan” on page 540

•“private-vlan association” on page 542

•“platform vlan-stacking-tpid” on page 543

•“private-vlan ufo trap” on page 544

•“show debugging private-vlan” on page 545

•“show port-vlan-forwarding-priority” on page 546

•“show vlan” on page 547

•“show vlan access-map” on page 548

•“show vlan filter” on page 549

•“show vlan private-vlan” on page 550

•“show vlan private-vlan ufo” on page 551

•“switchport access vlan” on page 552

•“switchport mode access” on page 553

•“switchport mode private-vlan” on page 554

•“switchport mode private-vlan trunk promiscuous” on page 555

•“switchport mode private-vlan trunk secondary” on page 557

•“switchport mode private-vlan ufo” on page 559

C613-50292-01 Rev A Command Reference for IE210L Series 535

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

•“switchport mode trunk” on page 561

•“switchport private-vlan host-association” on page 562

•“switchport private-vlan mapping” on page 563

•“switchport trunk allowed vlan” on page 564

•“switchport trunk native vlan” on page 567

•“switchport vlan-stacking (double tagging)” on page 568

•“switchport voice dscp” on page 569

•“switchport voice vlan” on page 570

•“switchport voice vlan priority” on page 572

•“vlan” on page 573

•“vlan access-map” on page 574

•“vlan database” on page 575

•“vlan filter” on page 576

C613-50292-01 Rev A Command Reference for IE210L Series 536

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

DEBUG PRIVATE-VLAN UFO

debug private-vlan ufo

Overview Use this command to enable private-vlan Upward Forwarding Only (UFO)

debugging.

Use the no variant of this command to disable private-vlan UFO debugging.

Syntax debug private-vlan ufo

no debug private-vlan ufo

Mode Privileged Exec

Usage Use this command to enable or disable private-vlan ufo debugging.

Example To enable private-vlan UFO debugging, use the commands:

awplus# configure terminal

awplus(config)# debug private-vlan ufo

Commands

show debugging private-vlan

private-vlan ufo trap

switchport mode private-vlan ufo

Command

changes

Version 5.4.7-2.1: command added

Version 5.4.8-2.1: added to SBx8100 Series products

Version 5.4.9-0.1: added to x530 Series products

C613-50292-01 Rev A Command Reference for IE210L Series 537

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

PORT-VLAN-FORWARDING-PRIORITY

port-vlan-forwarding-priority

Overview Use this command to specify which protocol has the highest priority for controlling

transitions from blocking to forwarding traffic, when more than one of EPSR, Loop

Protection, and MAC thrashing protection are used on the switch.

These protocols use the same mechanism to block or forward traffic. This

command specifies either EPSR or Loop Protection as the highest priority protocol.

Setting the priority stops contention between protocols.

For more information, see the Usage section below.

CAUTION: The loop-protection and none parameter options must not be set on an

EPSR master node. Use the epsr parameter option on an EPSR master node instead.

Setting this command incorrectly on an EPSR master node could cause unexpected

broadcast storms.

Use the no variant of this command to restore the default highest priority protocol

back to the default of EPSR.

For more information about EPSR, see the EPSR Feature Overview and

Configuration_Guide.

Syntax port-vlan-forwarding-priority {epsr|loop-protection|none}

no port-vlan-forwarding-priority

Default By default, the highest priority protocol is EPSR

Mode Global Configuration

Usage Usually, you only need to configure one of EPSR, Loop Protection and MAC

Thrashing protection on a switch, because they perform similar functions—each

prevents network loops by blocking a selected port for each (loop-containing)

VLAN.

However, if more than one of these three features is configured on a switch, you

can use this command to prioritize either EPSR or Loop Protection when their

Parameter Description

epsr Sets EPSR as the highest priority protocol. Use this parameter on

an EPSR master node to avoid unexpected broadcast storms.

loop-protection Sets Loop Protection as the highest priority protocol.

Note that this option must not be set on an EPSR master node.

Use the epsr parameter option on an EPSR master node to avoid

unexpected broadcast storms.

none Sets the protocols to have equal priority. This allows protocols to

override each other to set a port to forwarding for a VLAN.

Note that this option must not be set on a EPSR master node.

Use the epsr parameter option on an EPSR master node to avoid

unexpected broadcast storms.

C613-50292-01 Rev A Command Reference for IE210L Series 538

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

PORT-VLAN-FORWARDING-PRIORITY

effects on a port would conflict and override each other. Without this command,

each protocol could set a port to forwarding for a VLAN, sometimes overriding the

previous setting by another protocol to block the port. This could sometimes lead

to unexpected broadcast storms.

This command means that, when a protocol is set to have the highest priority over

a data VLAN on a port, it will not allow other protocols to put that port-vlan into a

forwarding state if the highest priority protocol blocked it.

The priority mechanism is only used for blocking-to-forwarding transitions;

protocols remain independent on the forwarding-to-blocking transitions.

For example, consider an EPSR master node in a two-node ESPR ring with the

following settings:

• The EPSR master node primary port is configured to switchport interface

port1.0.1

• The EPSR master node secondary port is configured to switchport interface

port1.0.2

• The EPSR master node control VLAN is configured to VLAN interface vlan10

• The EPSR master node has a first data VLAN configured to VLAN interface

vlan20

• The EPSR master node has a second data VLAN configured to VLAN interface

vlan30.

Initially, the EPSR ring is complete, with port1.0.2 blocking data VLANs vlan20 and

vlan30 and some broadcast traffic flowing through. If the user removes vlan30

from EPSR, a storm is created on vlan30. MAC thrashing protection detects it and

blocks vlan30.

Then after the storm has stopped, MAC thrashing protection sets it to forwarding

again and it keeps oscillating between forwarding and blocking. In the meantime,

the user adds back vlan30 to EPSR as a data VLAN and EPSR blocks it on port1.0.2.

If the priority is set to none (port-vlan-forwarding-priority none), MAC thrashing

protection notices that the storm has stopped again and decides to put vlan30 on

port1.0.2 into forwarding state. This overrides what EPSR requires for this

port-VLAN and creates a storm.

If the priority is set to EPSR or default (port-vlan-forwarding-priority epsr), MAC

thrashing protection notices that the storm has stopped again and attempts to put

vlan30 on port1.0.2 into forwarding state. The higher priority protocol (EPSR) is

blocking the VLAN on this port, so it stays blocking and no storm occurs.

Example To prioritize EPSR over Loop Protection or MAC Thrashing protection settings, so

that Loop Protection or MAC Thrashing protection cannot set a port to the

forwarding state for a VLAN if EPSR has set it to the blocking state, use the

commands:

awplus# configure terminal

awplus(config)# port-vlan-forwarding-priority epsr

C613-50292-01 Rev A Command Reference for IE210L Series 539

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

PORT-VLAN-FORWARDING-PRIORITY

To prioritize Loop Protection over EPSR or MAC Thrashing protection settings, so

that EPSR or MAC Thrashing protection cannot set a port to the forwarding state

for a VLAN if Loop Protection has set it to the blocking state, use the commands:

awplus# configure terminal

awplus(config)# port-vlan-forwarding-priority loop-protection

To set EPSR, Loop Protection, and MAC Thrashing protection protocols to have

equal priority for port forwarding and blocking, which allows the protocols to

override each other to set a port to the forwarding or blocking states, use the

commands:

awplus# configure terminal

awplus(config)# port-vlan-forwarding-priority none

To restore the default highest priority protocol back to the default of EPSR, use the

commands:

awplus# configure terminal

awplus(config)# no port-vlan-forwarding-priority

Commands

show port-vlan-forwarding-priority

C613-50292-01 Rev A Command Reference for IE210L Series 540

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

PRIVATE-VLAN

private-vlan

Overview Use this command to a create a private VLAN. Private VLANs can be either primary

or secondary. Secondary VLANs can be either community or isolated.

Alternatively, private VLANs can be UFO (Upstream Forwarding Only). Private

VLAN port members are either ‘downstream’ or ‘upstream’. Once a private VLAN is

configured as UFO, its port members by default are downstream.

Use the no variant of this command to remove the specified private VLAN.

For more information, see the VLAN Feature Overview and Configuration Guide.

Syntax private-vlan <vlan-id> {community|isolated|primary|ufo}

no private-vlan <vlan-id> {community|isolated|primary|ufo}

Mode VLAN Configuration

Examples To configure a set of private VLANs, use the following commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# vlan 2 name vlan2 state enable

awplus(config-vlan)# vlan 3 name vlan3 state enable

awplus(config-vlan)# vlan 4 name vlan4 state enable

awplus(config-vlan)# private-vlan 2 primary

awplus(config-vlan)# private-vlan 3 isolated

awplus(config-vlan)# private-vlan 4 community

To remove a set of private VLANs, use the following commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# no private-vlan 2 primary

awplus(config-vlan)# no private-vlan 3 isolated

awplus(config-vlan)# no private-vlan 4 community

Parameter Description

<vlan-id> VLAN ID in the range <2-4094> for the VLAN which is to be made a

private VLAN.

community Community VLAN.

isolated Isolated VLAN.

primary Primary VLAN.

ufo Upstream Forwarding Only (UFO) VLAN.

C613-50292-01 Rev A Command Reference for IE210L Series 541

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

PRIVATE-VLAN

To configure a private VLAN for Upward Forwarding Only (UFO), use the following

commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# vlan 512 name vlan512 state enable

awplus(config-vlan)# private-vlan 512 ufo

Commands

show vlan private-vlan

Command

changes

Version 5.4.7-2.1: ufo parameter added

Version 5.4.8-2.1: ufo parameter added to SBx8100 Series products

Version 5.4.9-0.1: ufo parameter added to x530 Series products

C613-50292-01 Rev A Command Reference for IE210L Series 542

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

PRIVATE-VLAN ASSOCIATION

private-vlan association

Overview Use this command to associate a secondary VLAN to a primary VLAN. Only one

isolated VLAN can be associated to a primary VLAN. Multiple community VLANs

can be associated to a primary VLAN.

Use the no variant of this command to remove association of all the secondary

VLANs to a primary VLAN.

For more information, see the VLAN_Feature Overview and Configuration Guide.

Syntax private-vlan <primary-vlan-id> association {add

<secondary-vlan-id>|remove <secondary-vlan-id>}

no private-vlan <primary-vlan-id> association

Mode VLAN Configuration

Examples The following commands associate primary VLAN 2 with secondary VLAN 3:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# private-vlan 2 association add 3

The following commands remove the association of primary VLAN 2 with

secondary VLAN 3:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# private-vlan 2 association remove 3

The following commands remove all secondary VLAN associations of primary

VLAN 2:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# no private-vlan 2 association

Parameter Description

<primary-vlan-id>VLAN ID of the primary VLAN.

<secondary-vlan-id>VLAN ID of the secondary VLAN

(either isolated or community).

C613-50292-01 Rev A Command Reference for IE210L Series 543

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

PLATFORM VLAN-STACKING-TPID

platform vlan-stacking-tpid

Overview This command specifies the Tag Protocol Identifier (TPID) value that applies to all

frames that are carrying double tagged VLANs. All nested VLANs must use the

same TPID value. (This feature is sometimes referred to as VLAN stacking or VLAN

double-tagging.)

Use the no variant of this command to revert to the default TPID value (0x8100).

NOTE: Because the additional tag increases the frame size beyond 1522 bytes, you

must increase the MRU size to activate VLAN-stacking. Go into interface mode for the

appropriate ports and use the mru command.

Syntax platform vlan-stacking-tpid <tpid>

no platform vlan-stacking-tpid

Default The default TPID value is 0x8100.

Mode Global Configuration

Examples To set the VLAN stacking TPID value to 0x9100, use the following commands:

awplus# configure terminal

awplus(config)# platform vlan-stacking-tpid 9100

To reset the VLAN stacking TPID value to the default (0x8100), use the following

commands:

awplus# configure terminal

awplus(config)# no platform vlan-stacking-tpid

Commands

switchport vlan-stacking (double tagging)

show platform

show running-config

Parameter Description

<tpid> The Ethernet type of the tagged packet, as a two byte hexadecimal

number.

C613-50292-01 Rev A Command Reference for IE210L Series 544

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

PRIVATE-VLAN UFO TRAP

private-vlan ufo trap

Overview Use this command to enable the sending of SNMP traps for private VLAN UFO.

Use the no variant of this command to disable the sending of SNMP traps for

private VLAN UFO.

Syntax private-vlan ufo trap

no private-vlan ufo trap

Default Enabled.

Mode Global Configuration

Usage This command enables SNMP traps for private-vlan UFO. If enabled, traps will be

sent when any UFO VLAN becomes "isolated", which occurs when traffic can not be

forwarded at Layer 2 because there is no upstream port for the UFO VLAN, and

Layer3 forwarding has not been configured for the VLAN.

Example To configure a private-vlan UFO trap use the commands:

awplus# configure terminal

awplus(config)# private-vlan ufo trap

Commands

private-vlan

snmp-server enable trap

Command

changes

Version 5.4.7-2.1: command added

Version 5.4.8-2.1: added to SBx8100 Series products

Version 5.4.9-0.1: added to x530 Series products

Parameter Description

ufo Specifies private-vlan for those VLANs in UFO mode.

trap Enables or disables SNMP trap sending for private-vlan UFO.

C613-50292-01 Rev A Command Reference for IE210L Series 545

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SHOW DEBUGGING PRIVATE-VLAN

show debugging private-vlan

Overview Use this command to show whether debugging for a private-vlan, namely UFO, is

enabled.

Syntax show debugging private-vlan

Mode Privileged Exec

Example To show if debugging is enabled for private-vlan UFO, use the command:

awplus# show debugging private-vlan

Output Figure 16-1: Example output from show debugging private-vlan

Commands

debug private-vlan ufo

Command

changes

Version 5.4.7-2.1: command added.

Version 5.4.8-2.1: added to SBx8100 Series products

Version 5.4.9-0.1: added to x530 Series products

awplus#show debugging private-vlan



Private-VLAN debugging status:

UFO debugging is off

C613-50292-01 Rev A Command Reference for IE210L Series 546

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SHOW PORT-VLAN-FORWARDING-PRIORITY

show port-vlan-forwarding-priority

Overview Use this command to display the highest priority protocol that controls port-vlan

forwarding or blocking traffic. This command displays whether EPSR or Loop

Protection is set as the highest priority for determining whether a port forwards a

VLAN, as set by the port-vlan-forwarding-priority command.

For more information about EPSR, see the EPSR Feature Overview and

Configuration_Guide.

Syntax show port-vlan-forwarding-priority

Mode Privileged Exec

Example To display the highest priority protocol, use the command:

awplus# show port-vlan-forwarding-priority

Output Figure 16-2: Example output from the show port-vlan-forwarding-priority

command

Commands

port-vlan-forwarding-priority

Port-vlan Forwarding Priority: EPSR

C613-50292-01 Rev A Command Reference for IE210L Series 547

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SHOW VLAN

show vlan

Overview Use this command to display information about a particular VLAN by specifying its

VLAN ID. Selecting all will display information for all the VLANs configured.

Syntax show vlan

{all|brief|dynamic|static|auto|static-ports|<1-4094>}

Mode User Exec and Privileged Exec

Example To display information about VLAN 2, use the command:

awplus# show vlan 2

Output Figure 16-3: Example output from the show vlan command

Commands

vlan

Parameter Description

<1-4094> Display information about the VLAN specified by the VLAN ID.

all Display information about all VLANs on the device.

brief Display information about all VLANs on the device.

dynamic Display information about all VLANs learned dynamically.

static Display information about all statically configured VLANs.

auto Display information about all auto-configured VLANs.

static-ports Display static egress/forbidden ports.

VLAN ID Name Type State Member ports

(u)-Untagged, (t)-Tagged

======= ================ ======= ======= ====================================

2 VLAN0002 STATIC ACTIVE port1.0.3(u) port1.0.4(u) port1.0.5(u)

port1.0.6(u)

...

C613-50292-01 Rev A Command Reference for IE210L Series 548

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SHOW VLAN ACCESS-MAP

show vlan access-map

Overview Use this command to display information about the configured VLAN

access-maps. VLAN access-maps contain a series of ACLs and enable you to filter

traffic ingressing specified VLANs.

Syntax show vlan access-map [<name>]

Mode User Exec/Privileged Exec

Example To display the ACLs in all access-maps, use the command:

awplus# show vlan access-map

Output Figure 16-4: Example output from show vlan access-map

Commands

vlan access-map

Command

changes

Version 5.4.6-2.1: command added

Parameter Description

<name> The name of the access-map to display.

awplus#show vlan access-map 



Vlan access map : deny_all 

Hardware MAC access list 4000

10 deny any any 



Vlan access map : ip_range 

Hardware IP access list 3000

10 deny ip 192.168.1.1/24 any

C613-50292-01 Rev A Command Reference for IE210L Series 549

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SHOW VLAN FILTER

show vlan filter

Overview Use this command to display information about the configured VLAN filters. VLAN

filters apply access-maps (and therefore ACLs) to VLANs. This enables you to filter

traffic ingressing specified VLANs.

Syntax show vlan filter [<access-map-name>]

Mode User Exec/Privileged Exec

Example To display information about the filter that uses the access-map named “deny_all”,

use the command:

awplus# show vlan filter deny_all

Output Figure 16-5: Example output from show vlan filter

Commands

vlan access-map

vlan filter

Command

changes

Version 5.4.6-2.1: command added

Parameter Description

<access-map-name> The name of an access-map. The command output displays

only the filters that use that access-map.

awplus#show vlan filter deny_all 

Vlan filter : deny_all

direction : ingress 

vlan list : 48-49

access map : deny_all

Hardware MAC access list 4000 

10 deny any any

C613-50292-01 Rev A Command Reference for IE210L Series 550

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SHOW VLAN PRIVATE-VLAN

show vlan private-vlan

Overview Use this command to display the private VLAN configuration and associations.

Syntax show vlan private-vlan

Mode User Exec and Privileged Exec

Example To display the private VLAN configuration and associations, enter the command:

awplus# show vlan private-vlan

Output Figure 16-6: Example output from the show vlan private-vlan command

Commands

private-vlan

private-vlan association

awplus#show vlan private-vlan

PRIMARY SECONDARY TYPE INTERFACES

------- --------- ---------- ----------

2 3 isolated

2 4 community

8 isolated

C613-50292-01 Rev A Command Reference for IE210L Series 551

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SHOW VLAN PRIVATE-VLAN UFO

show vlan private-vlan ufo

Overview Use this command to show the configuration status of a private VLAN UFO-based

VLAN(s) and member interfaces.

Syntax show vlan private-vlan ufo {all|<vlan-id>}

Mode User Exec/Privileged Exec.

Usage Private VLANs can be UFO (Upstream Forwarding Only). Private VLAN port

members are either "downstream" or "upstream" which are controlled by a

protocol or by static configuration.

Example To show all the private-vlan UFO interfaces, use the command:

awplus# show vlan private-vlan ufo all

Output Figure 16-7: Example output from show vlan private-vlan ufo all

Command

changes

Version 5.4.7-2.1: command added

Version 5.4.8-2.1: added to SBx8100 Series products

Version 5.4.9-0.1: added to x530 Series products

Parameter Description

<vlan-id> A specific VLAN. This must have been configured previously as a

private-vlan UFO.

all All VLANs that have been configured previously as private-vlan

UFO.

awplus#show vlan private-vlan ufo all

VLAN INTERFACES CONFIGURED TYPE PROTOCOL MISC

-----------------------------------------------------------------------------

100 port1.0.1 primary-upstream upstream UFO -

100 port1.0.2 secondary-upstream downstream UFO -

100 port1.0.3 - downstream Static -

200 port1.0.4 epsr downstream EPSR -

200 sa1 epsr upstream EPSR 0030.846e.bac7

200 port1.0.5 - downstream Static -

300 port1.0.6 - downstream-fault Static -

300 port1.0.7 - downstream-fault Static -

300 port1.0.8 - downstream-fault Static -

400 Port1.0.9 stp upstream STP 0030.846e.9bf4 

400 Port1.0.10 stp downstream STP -

400 Port1.0.11 downstream Static -

C613-50292-01 Rev A Command Reference for IE210L Series 552

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT ACCESS VLAN

switchport access vlan

Overview Use this command to change the port-based VLAN of the current port.

Use the no variant of this command to change the port-based VLAN of this port to

the default VLAN, vlan1.

Syntax switchport access vlan <vlan-id>

no switchport access vlan

Default Reset the default VLAN 1 to specified switchports using the negated form of this

command.

Mode Interface Configuration

Usage Any untagged frame received on this port will be associated with the specified

VLAN.

Examples To change the port-based VLAN to VLAN 3 for port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport access vlan 3

To reset the port-based VLAN to the default VLAN 1 for port1.0.2, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport access vlan

Commands

show interface switchport

show vlan

Parameter Description

<vlan-id><1-4094> The port-based VLAN ID for the port.

C613-50292-01 Rev A Command Reference for IE210L Series 553

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT MODE ACCESS

switchport mode access

Overview Use this command to set the switching characteristics of the port to access mode.

Received frames are classified based on the VLAN characteristics, then accepted or

discarded based on the specified filtering criteria.

Syntax switchport mode access [ingress-filter {enable|disable}]

Default By default, ports are in access mode with ingress filtering on.

Usage Use access mode to send untagged frames only.

Mode Interface Configuration

Example awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport mode access ingress-filter enable

Validation

Command

show interface switchport

Parameter Description

ingress-filter Set the ingress filtering for the received frames.

enable Turn on ingress filtering for received frames. This is the default.

disable Turn off ingress filtering to accept frames that do not meet the

classification criteria.

C613-50292-01 Rev A Command Reference for IE210L Series 554

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT MODE PRIVATE-VLAN

switchport mode private-vlan

Overview Use this command to make a Layer 2 port a private VLAN host port or a

promiscuous port.

Use the no variant of this command to remove the configuration.

Syntax switchport mode private-vlan {host|promiscuous}

no switchport mode private-vlan {host|promiscuous}

Mode Interface Configuration

Examples To configure host mode, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport mode private-vlan host

To configure promiscuous mode, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.3

awplus(config-if)# switchport mode private-vlan promiscuous

To remove promiscuous mode, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.3

awplus(config-if)# no switchport mode private-vlan promiscuous

Commands

switchport private-vlan mapping

Parameter Description

host This port type can communicate with all other host ports assigned to

the same community VLAN, but it cannot communicate with the

ports in the same isolated VLAN. All communications outside of this

VLAN must pass through a promiscuous port in the associated

primary VLAN.

promiscuous A promiscuous port can communicate with all interfaces, including

the community and isolated ports within a private VLAN.

C613-50292-01 Rev A Command Reference for IE210L Series 555

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT MODE PRIVATE-VLAN TRUNK PROMISCUOUS

switchport mode private-vlan trunk

promiscuous

Overview Use this command to enable a port in trunk mode to be promiscuous port for

isolated VLANs.

Use the no variant of this command to remove a port in trunk mode as a

promiscuous port for isolated VLANs. You must first remove the secondary port, or

ports, in trunk mode associated with the promiscuous port with the no switchport

mode private-vlan trunk secondary command.

Syntax switchport mode private-vlan trunk promiscuous group <group-id>

no switchport mode private-vlan trunk promiscuous

Default By default, a port in trunk mode is disabled as a promiscuous port.

Mode Interface Configuration

Usage A port must be put in trunk mode with switchport mode trunk command before it

can be enabled as a promiscuous port.

To add VLANs to be trunked over the promiscuous port, use the switchport trunk

allowed vlan command. These VLANs can be isolated VLANs, or non-private VLANs.

To configure the native VLAN for the promiscuous port, use the switchport trunk

native vlan command. The native VLAN can be an isolated VLAN, or a non-private

VLAN.

When you enable a promiscuous port, all of the secondary port VLANs associated

with the promiscuous port via the group ID number must be added to the

promiscuous port. In other words, the set of VLANs on the promiscuous port must

be a superset of all the VLANs on the secondary ports within the group.

Parameter Description

<group-id>The group ID is a numeric value in the range 1 to 32 that is

used to associate the promiscuous port with secondary ports.

C613-50292-01 Rev A Command Reference for IE210L Series 556

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT MODE PRIVATE-VLAN TRUNK PROMISCUOUS

Examples To create the isolated VLANs 2, 3 and 4 and then enable port1.0.2 in trunk mode as

a promiscuous port for these VLANs with the group ID of 3, use the following

commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# vlan 2-4

awplus(config-vlan)# private-vlan 2 isolated

awplus(config-vlan)# private-vlan 3 isolated

awplus(config-vlan)# private-vlan 4 isolated

awplus(config-vlan)# exit

awplus(config)# interface port1.0.2

awplus(config-if)# switchport mode trunk

awplus(config-if)# switchport trunk allowed vlan add 2-4

awplus(config-if)# switchport mode private-vlan trunk

promiscuous group 3

To remove port1.0.2 in trunk mode as a promiscuous port for a private VLAN, use

the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport mode private-vlan trunk

promiscuous

Note that you must remove the secondary port or ports enabled as trunk ports that

are associated with the promiscuous port before removing the promiscuous port.

Commands

switchport mode private-vlan trunk secondary

switchport mode trunk

switchport trunk allowed vlan

switchport trunk native vlan

show vlan private-vlan

C613-50292-01 Rev A Command Reference for IE210L Series 557

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT MODE PRIVATE-VLAN TRUNK SECONDARY

switchport mode private-vlan trunk

secondary

Overview Use this command to enable a port in trunk mode to be a secondary port for

isolated VLANs.

Use the no variant of this command to remove a port in trunk mode as a secondary

port for isolated VLANs.

Syntax switchport mode private-vlan trunk secondary group <group-id>

no switchport mode private-vlan trunk secondary

Default By default, a port in trunk mode is disabled as a secondary port.

When a port in trunk mode is enabled to be a secondary port for isolated VLANs,

by default it will have a native VLAN of none (no native VLAN specified).

Mode Interface Configuration

Usage A port must be put in trunk mode with switchport mode trunk command before

the port is enabled as a secondary port in trunk mode.

To add VLANs to be trunked over the secondary port use the switchport trunk

allowed vlan command. These must be isolated VLANs and must exist on the

associated promiscuous port.

To configure the native VLAN for the secondary port, use the switchport trunk

native vlan command. The native VLAN must be an isolated VLAN and must exist

on the associated promiscuous port.

Parameter Description

<group-id>The group ID is a numeric value in the range 1 to 32 that is

used to associate a secondary port with its promiscuous port.

C613-50292-01 Rev A Command Reference for IE210L Series 558

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT MODE PRIVATE-VLAN TRUNK SECONDARY

Examples To create isolated private VLAN 2 and then enable port1.0.3 in trunk mode as a

secondary port for the this VLAN with the group ID of 3, use the following

commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# vlan 2

awplus(config-vlan)# private-vlan 2 isolated

awplus(config-vlan)# exit

awplus(config)# interface port1.0.3

awplus(config-if)# switchport mode trunk

awplus(config-if)# switchport trunk allowed vlan add 2

awplus(config-if)# switchport mode private-vlan trunk secondary

group 3

To remove port1.0.3 in trunk mode as a secondary port, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.3

awplus(config-if)# no switchport mode private-vlan trunk

secondary

Commands

switchport mode private-vlan trunk promiscuous

switchport mode trunk

switchport trunk allowed vlan

switchport trunk native vlan

show vlan private-vlan

C613-50292-01 Rev A Command Reference for IE210L Series 559

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT MODE PRIVATE-VLAN UFO

switchport mode private-vlan ufo

Overview Use this command to allow private VLAN UFO 802.1q member ports to be

configured as upstream or downstream.

Use the no variant of this command to change the role of the private VLAN UFO

802.1q member port to downstream.

Syntax switchport mode private-vlan ufo <vid-list>

{primary-upstream|secondary-upstream|stp|epsr}

no switchport mode private-vlan ufo <vid-list>

Default Downstream.

Note: The default setting for a private VLAN UFO member interface is downstream,

but it is not explicitly configured. Use the no variant of this command to make the

member interface downstream.

Mode Interface Configuration

Parameter Description

<vid-list> A hyphen-separated range or a comma-separated list of

VLAN IDs, all of which must have previously been configured

with the private-vlan setting of "ufo".

primary-upstream The primary interface port/LAG that this UFO VLAN will

attempt to use as the Upstream interface. More than one

primary-upstream interface can be configured.

secondary-upstream The interface that this UFO VLAN will revert to use as the

Upstream port if all the primary-upstream ports are

unavailable due to being either operationally down (i.e. Link

Down) or blocked from forwarding (e.g. STP). More than one

secondary-upstream interface can be configured.

stp Let STP determine whether this interface is upstream or

downstream. STP will determine if this interface plays the

role of an STP Root Port for the CIST, or for the MSTI that this

UFO VLAN belongs to. If it is, then UFO will designate this

interface as an Upstream interface member for this UFO

VLAN. Otherwise it is Downstream.

epsr Let EPSR determine whether this interface is upstream or

downstream. If this UFO VLAN is a protected data VLAN in an

EPSR instance, and this interface is one of the transit node's

interfaces, then this interface will determine if an EPSR

Master is reachable from this interface. If it is, then UFO will

designate this interface as an Upstream interface member

for this UFO VLAN. Otherwise it is Downstream.

C613-50292-01 Rev A Command Reference for IE210L Series 560

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT MODE PRIVATE-VLAN UFO

Example To configure a private VLAN UFO trunk port as primary-upstream, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport mode trunk

awplus(config-if)# switchport trunk allowed vlan add 100

awplus(config-if)# switchport mode private-vlan ufo 100

primary-upstream

To change the role of the private VLAN UFO 802.1q member port back to the

default of downstream, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport mode private-vlan ufo 100

Commands

private-vlan

show vlan private-vlan ufo

Command

changes

Version 5.4.7-2.1: command added

Version 5.4.8-2.1: added to SBx8100 Series products

Version 5.4.9-0.1: added to x530 Series products

C613-50292-01 Rev A Command Reference for IE210L Series 561

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT MODE TRUNK

switchport mode trunk

Overview Use this command to set the switching characteristics of the port to trunk.

Received frames are classified based on the VLAN characteristics, then accepted or

discarded based on the specified filtering criteria.

Syntax switchport mode trunk [ingress-filter {enable|disable}]

Default By default, ports are in access mode, are untagged members of the default VLAN

(vlan1), and have ingress filtering on.

Mode Interface Configuration

Usage A port in trunk mode can be a tagged member of multiple VLANs, and an untagged

member of one native VLAN.

To configure which VLANs this port will trunk for, use the switchport trunk allowed

vlan command.

Example awplus# configure terminal

awplus(config)# interface port1.0.3

awplus(config-if)# switchport mode trunk ingress-filter enable

Validation

Command

show interface switchport

Parameter Description

ingress-filter Set the ingress filtering for the frames received.

enable Turn on ingress filtering for received frames. This is the default.

disable Turn off ingress filtering to accept frames that do not meet the

classification criteria.

C613-50292-01 Rev A Command Reference for IE210L Series 562

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT PRIVATE-VLAN HOST-ASSOCIATION

switchport private-vlan host-association

Overview Use this command to associate a primary VLAN and a secondary VLAN to a host

port. Only one primary and secondary VLAN can be associated to a host port.

Use the no variant of this command to remove the association.

Syntax switchport private-vlan host-association <primary-vlan-id> add

<secondary-vlan-id>

no switchport private-vlan host-association

Mode Interface Configuration

Examples awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport private-vlan host-association 2

add 3

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport private-vlan host-association

Parameter Description

<primary-vlan-id>VLAN ID of the primary VLAN.

<secondary-vlan-id>VLAN ID of the secondary VLAN (either isolated or com

munity).

C613-50292-01 Rev A Command Reference for IE210L Series 563

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT PRIVATE-VLAN MAPPING

switchport private-vlan mapping

Overview Use this command to associate a primary VLAN and a set of secondary VLANs to a

promiscuous port.

Use the no variant of this to remove all the association of secondary VLANs to

primary VLANs for a promiscuous port.

Syntax switchport private-vlan mapping <primary-vlan-id> add

<secondary-vid-list>

switchport private-vlan mapping <primary-vlan-id> remove

<secondary-vid-list>

no switchport private-vlan mapping

Mode Interface Configuration

Usage This command can be applied to a switch port or a static channel group, but not a

dynamic (LACP) channel group. LACP channel groups (dynamic/LACP

aggregators) cannot be promiscuous ports in private VLANs.

Examples awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport private-vlan mapping 2 add 3-4

awplus(config-if)# switchport private-vlan mapping 2 remove 3-4

awplus(config-if)# no switchport private-vlan mapping

Commands

switchport mode private-vlan

Parameter Description

<primary-vlan-id>VLAN ID of the primary VLAN.

<secondary-vid-list>VLAN ID of the secondary VLAN (either isolated or

community), or a range of VLANs, or a comma-separated

list of VLANs and ranges.

C613-50292-01 Rev A Command Reference for IE210L Series 564

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT TRUNK ALLOWED VLAN

switchport trunk allowed vlan

Overview Use this command to add VLANs to be trunked over this switch port. Traffic for

these VLANs can be sent and received on the port.

Use the no variant of this command to reset switching characteristics of a specified

interface to negate a trunked configuration specified with switchport trunk

allowed vlan command.

Syntax switchport trunk allowed vlan all

switchport trunk allowed vlan none

switchport trunk allowed vlan add <vid-list>

switchport trunk allowed vlan remove <vid-list>

switchport trunk allowed vlan except <vid-list>

no switchport trunk

Default By default, ports are untagged members of the default VLAN (vlan1).

Mode Interface Configuration

Parameter Description

all Allow all VLANs to transmit and receive through the port.

none Allow no VLANs to transmit and receive through the port.

add Add a VLAN to the list of VLANs that are allowed to transmit and

receive through the port. Only use this parameter if a list of VLANs is

already configured on a port.

remove Remove a VLAN from the list of VLANs that are allowed to transmit

and receive through the port. Only use this parameter if a list of

VLANs is already configured on a port.

If you are removing VLAN port membership for a large number of

switchports and VLANs, note that this command may take a number

of minutes to run.

except All VLANs, except the VLAN for which the VID is specified, are part of

its port member set. Only use this parameter to remove VLANs after

either this parameter or the all parameter have added VLANs to a

port.

<vid-list><2-4094> The ID of the VLAN or VLANs that will be added to, or

removed from, the port. A single VLAN, VLAN range, or comma-

separated VLAN list can be set.

For a VLAN range, specify two VLAN numbers: lowest, then highest

number in the range, separated by a hyphen.

For a VLAN list, specify the VLAN numbers separated by commas.

Do not enter spaces between hyphens or commas when setting

parameters for VLAN ranges or lists.

C613-50292-01 Rev A Command Reference for IE210L Series 565

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT TRUNK ALLOWED VLAN

Usage The all parameter sets the port to be a tagged member of all the VLANs configured

on the device. The none parameter removes all VLANs from the port’s tagged

member set. The add and remove parameters will add and remove VLANs to and

from the port’s member set. The except parameter creates an exception to the list.

If you use the all parameter, and then you want to remove VLANs from the port’s

member list, you must use the except parameter to remove the unwanted VLANs.

Similarly, if you use the except parameter to remove a list of VLANs, and you want

to change that list, you must use the except parameter to make that change (not

the add and remove parameters).

For example, if you want to remove VLAN3-5 from a port and the port’s

configuration is currently switchport trunk allowed vlan all, then you should

remove VLAN3-5 by entering the except parameter, instead of using the remove

parameter. This means using the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.6

awplus(config-if)# switchport trunk allowed vlan except 3-5

If you do this, then the configuration changes to:

For example, if you want to add VLAN4 back in again, and the port configuration is

currently switchport trunk allowed vlan except 3-5, then you should add VLAN4

by re-entering the except parameter with the list of VLANs to remove, instead of

using the add parameter. This means using the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.5

awplus(config-if)# switchport trunk allowed vlan except 3,5

If you do this, then the configuration changes to:

awplus#show running-config



interface port1.0.6

switchport

switchport mode trunk

switchport trunk allowed vlan except 3-5

awplus#show running-config



interface port1.0.5

switchport

switchport mode trunk

switchport trunk allowed vlan except 3,5

C613-50292-01 Rev A Command Reference for IE210L Series 566

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT TRUNK ALLOWED VLAN

Examples The following shows adding a single VLAN to the port’s member set.

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport trunk allowed vlan add 2

The following shows adding a range of VLANs to the port’s member set.

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport trunk allowed vlan add 2-4

The following shows adding a list of VLANs to the port’s member set.

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport trunk allowed vlan add 2,3,4

C613-50292-01 Rev A Command Reference for IE210L Series 567

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT TRUNK NATIVE VLAN

switchport trunk native vlan

Overview Use this command to configure the native VLAN for this port. The native VLAN is

used for classifying the incoming untagged packets. Use the none parameter with

this command to remove the native VLAN from the port and set the acceptable

frame types to vlan-tagged only.

Use the no variant of this command to revert the native VLAN to the default VLAN

ID 1. Command negation removes tagged VLANs, and sets the native VLAN to the

default VLAN.

Syntax switchport trunk native vlan {<vid>|none}

no switchport trunk native vlan

Default VLAN 1 (the default VLAN), which is reverted to using the no form of this

command.

Mode Interface Configuration

Examples The following commands show configuration of VLAN 2 as the native VLAN for

port1.0.2:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport trunk native vlan 2

The following commands show the removal of the native VLAN for interface

port1.0.2:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport trunk native vlan none

The following commands revert the native VLAN to the default VLAN 1 for interface

port1.0.2:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no switchport trunk native vlan

Parameter Description

<vid>The ID of the VLAN that will be used to classify the incoming

untagged packets, in the range 2-2094. The VLAN ID must be a part of

the VLAN member set of the port.

none No native VLAN specified. This option removes the native VLAN from

the port and sets the acceptable frame types to vlan-tagged only.

Note: Use the no variant of this command to revert to the default

VLAN 1 as the native VLAN for the specified interface switchport - not

none.

C613-50292-01 Rev A Command Reference for IE210L Series 568

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT VLAN-STACKING (DOUBLE TAGGING)

switchport vlan-stacking (double tagging)

Overview Use this command to enable VLAN stacking on a port and set it to be a

customer-edge-port or provider-port. This is sometimes referred to as VLAN

double-tagging, nested VLANs, or Q in Q.

Use no parameter with this command to disable VLAN stacking on an interface.

Syntax switchport vlan-stacking {customer-edge-port|provider-port}

no switchport vlan-stacking

Default By default, ports are not VLAN stacking ports.

Mode Interface Configuration

Usage Use VLAN stacking to separate traffic from different customers to that they can be

managed over a provider network.

Note that you must also set an MRU of 1504 or higher on the customer edge port,

using the mru command.

Traffic with an extra VLAN header added by VLAN stacking cannot be routed.

Example To apply vlan-stacking to the selected port, configure it to be a customer edge

port, and increase the MRU, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport vlan-stacking customer-edge-port

awplus(config-if)# mru 10240

Parameter Description

customer-edge-port Set the port to be a customer edge port. This port must

already be in access mode.

provider-port Set the port to be a provider port. This port must already

be in trunk mode.

C613-50292-01 Rev A Command Reference for IE210L Series 569

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT VOICE DSCP

switchport voice dscp

Overview Use this command for a specific port to configure the Layer 3 DSCP value

advertised when the transmission of LLDP-MED Network Policy TLVs for voice

devices is enabled. When LLDP-MED capable IP phones receive this network policy

information, they transmit voice data with the specified DSCP value.

Use the no variant of this command to reset the DSCP value to the default, 0.

Syntax switchport voice dscp <0-63>

no switchport voice dscp

Default A DSCP value of 0 will be advertised.

Mode Interface Configuration

Usage LLDP-MED advertisements including Network Policy TLVs are transmitted via a

port if:

•LLDP is enabled (lldp run command)

• Voice VLAN is configured for the port (switchport voice vlan command)

• The port is configured to transmit LLDP advertisements—enabled by default

(lldp transmit receive command)

• The port is configured to transmit Network Policy TLVs—enabled by default

(lldp med-tlv-select command)

• There is an LLDP-MED device connected to the port

Example To tell IP phones connected to port1.0.2 to send voice data with DSCP value 27, use

the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport voice dscp 27

Commands

lldp med-tlv-select

show lldp

switchport voice vlan

Parameter Description

dscp Specify a DSCP value for voice data.

<0-63>DSCP value.

C613-50292-01 Rev A Command Reference for IE210L Series 570

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT VOICE VLAN

switchport voice vlan

Overview Use this command to configure the Voice VLAN tagging advertised when the

transmission of LLDP-MED Network Policy TLVs for voice endpoint devices is

enabled. When LLDP-MED capable IP phones receive this network policy

information, they transmit voice data with the specified tagging. This command

also sets the ports to be spanning tree edge ports, that is, it enables spanning tree

portfast on the ports.

Use the no variant of this command to remove LLDP-MED network policy

configuration for voice devices connected to these ports. This does not change the

spanning tree edge port status.

Syntax switchport voice vlan [<vid>|dot1p|dynamic|untagged]

no switchport voice vlan

Default By default, no Voice VLAN is configured, and therefore no network policy is

advertised for voice devices.

Mode Interface Configuration

Usage LLDP-MED advertisements including Network Policy TLVs are transmitted via a

port if:

•LLDP is enabled (lldp run command)

• Voice VLAN is configured for the port using this command (switchport voice

vlan)

• The port is configured to transmit LLDP advertisements—enabled by default

(lldp transmit receive command)

• The port is configured to transmit Network Policy TLVs—enabled by default

(lldp med-tlv-select command)

• There is an LLDP-MED device connected to the port.

To set the priority value to be advertised for tagged frames, use the switchport

voice vlan priority command.

If the Voice VLAN details are to be assigned by RADIUS, then the RADIUS server

must be configured to send the attribute “Egress-VLANID (56)” or

Parameter Description

dot1p The IP phone should send User Priority tagged packets, that is, packets in

which the tag contains a User Priority value, and a VID of 0. (The User

Priority tag is also known as the 802.1p priority tag, or the Class of Service

(CoS) tag.)

dynamic The VLAN ID with which the IP phone should send tagged packets will be

assigned by RADIUS authentication.

untagged The IP phone should send untagged packets.

C613-50292-01 Rev A Command Reference for IE210L Series 571

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT VOICE VLAN

“Egress-VLAN-Name (58)” in the RADIUS Accept message when authenticating a

phone attached to this port.

To set these attributes on the local RADIUS server, use the egress-vlan-id command

or the egress-vlan-name command.

Examples To tell IP phones connected to port1.0.5 to send voice data tagged for VLAN 10, use

the commands:

awplus# configure terminal

awplus(config)# interface port1.0.5

awplus(config-if)# switchport voice vlan 10

To tell IP phones connected to ports 1.0.2-1.0.6 to send priority tagged packets

(802.1p priority tagged with VID 0, so that they will be assigned to the port VLAN)

use the following commands. The priority value is 5 by default, but can be

configured with the switchport voice vlan priority command.

awplus# configure terminal

awplus(config)# interface port1.0.2-port1.0.6

awplus(config-if)# switchport voice vlan dot1p

To dynamically configure the VLAN ID advertised to IP phones connected to

port1.0.1 based on the VLAN assigned by RADIUS authentication (with RADIUS

attribute “Egress- VLANID” or “Egress-VLAN-Name” in the RADIUS accept packet),

use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# switchport voice vlan dynamic

To remove the Voice VLAN, and therefore disable the transmission of LLDP-MED

network policy information for voice devices on port1.0.6, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.6

awplus(config-if)# no switchport voice vlan

C613-50292-01 Rev A Command Reference for IE210L Series 572

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

SWITCHPORT VOICE VLAN PRIORITY

switchport voice vlan priority

Overview Use this command to configure the Layer 2 user priority advertised when the

transmission of LLDP-MED Network Policy TLVs for voice devices is enabled. This is

the priority in the User Priority field of the IEEE 802.1Q VLAN tag, also known as the

Class of Service (CoS), or 802.1p priority. When LLDP-MED capable IP phones

receive this network policy information, they transmit voice data with the specified

priority.

Syntax switchport voice vlan priority <0-7>

no switchport voice vlan priority

To remove the Voice VLAN, and therefore disable the transmission of LLDP-MED

network policy information for voice devices on port1.0.6, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.6

awplus(config-if)# no switchport voice vlan

Parameter Description

priority Specify a user priority value for voice data.

<0-7>Priority value.

C613-50292-01 Rev A Command Reference for IE210L Series 573

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

VLAN

vlan

Overview This command creates VLANs, assigns names to them, and enables or disables

them. Disabling the VLAN causes all forwarding over the specified VLAN ID to

cease. Enabling the VLAN allows forwarding of frames on the specified VLAN.

The no variant of this command destroys the specified VLANs or returns their MTU

to the default.

Syntax vlan <vid> [name <vlan-name>] [state {enable|disable}]

vlan <vid-range> [state {enable|disable}]

vlan {<vid>|<vlan-name>} [mtu <mtu-value>]

no vlan {<vid>|<vid-range>} [mtu]

Default By default, VLANs are enabled when they are created.

Mode VLAN Configuration

Examples To enable vlan 45, use the commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# vlan 45 name accounts state enable

To destroy vlan 45, use the commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# no vlan 45

Commands

mtu

vlan database

show vlan

Parameter Description

<vid>The VID of the VLAN to enable or disable, in the range 1-4094.

<vlan-name>The ASCII name of the VLAN. Maximum length: 32 characters.

<vid-range>Specifies a range of VLAN identifiers.

<mtu-value>Specifies the Maximum Transmission Unit (MTU) size in bytes, in the

range 68 to 1500 bytes, for the VLAN.

enable Puts the VLAN into an enabled state.

disable Puts the VLAN into a disabled state.

C613-50292-01 Rev A Command Reference for IE210L Series 574

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

VLAN ACCESS-MAP

vlan access-map

Overview Use this command to create a VLAN access-map and enter into VLAN access-map

mode, so you can add ACLs to the map. You can use any IPv4 or IPv6 hardware

ACLs. VLAN access-maps are used to attach ACLs to VLANs, and therefore to filter

traffic as it ingresses VLANs.

See the ACL Feature Overview and Configuration Guide for more information,

including information about the number of rules consumed by per-VLAN ACLs,

and ACL processing order.

Use the no variant of this command to delete a VLAN access-map.

Syntax vlan access-map <name>

no vlan access-map <name>

Default By default, no VLAN access-maps exist.

Mode Global Configuration

Example To apply ACL 3001 to VLAN 48, where the ACL drops IP traffic from any source to

any destination, use the commands:

awplus# configure terminal

awplus(config)# access-list 3001 deny ip any any

awplus(config)# vlan access-map deny_all

awplus(config-vlan-access-map)# match access-group 3001

awplus(config-vlan-access-map)# exit

awplus(config)# vlan filter deny_all vlan-list 48 input

Commands

match access-group

show vlan access-map

vlan filter

Command

changes

Version 5.4.6-2.1: command added

Parameter Description

<name> A name for the access-map.

C613-50292-01 Rev A Command Reference for IE210L Series 575

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

VLAN DATABASE

vlan database

Overview Use this command to enter the VLAN Configuration mode.

Syntax vlan database

Mode Global Configuration

Usage Use this command to enter the VLAN configuration mode. You can then add or

delete a VLAN, or modify its values.

Example In the following example, note the change to VLAN configuration mode from

Configure mode:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)#

Commands

vlan

C613-50292-01 Rev A Command Reference for IE210L Series 576

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

VLAN COMMANDS

VLAN FILTER

vlan filter

Overview Use this command to apply a VLAN access-map to a list of VLANs. The switch uses

the ACLs in the access-map to filter traffic ingressing those VLANs.

See the ACL Feature Overview and Configuration Guide for more information,

including information about the number of rules consumed by per-VLAN ACLs,

and ACL processing order.

Use the no variant of this command to to remove the access-map filter from the

listed VLANs.

Syntax vlan filter <access-map-name> vlan-list <vid> input

no vlan filter <access-map-name> vlan-list <vid> input

Default By default, no VLAN filters exist.

Mode Global Configuration

Example To apply ACL 3001 to VLAN 48, where the ACL drops IP traffic from any source to

any destination, use the commands:

awplus# configure terminal

awplus(config)# access-list 3001 deny ip any any

awplus(config)# vlan access-map deny_all

awplus(config-vlan-access-map)# match access-group 3001

awplus(config-vlan-access-map)# exit

awplus(config)# vlan filter deny_all vlan-list 48 input

Commands

match access-group

show vlan filter

vlan access-map

Command

changes

Version 5.4.6-2.1: command added

Parameter Description

<access-map-name> The name of the VLAN access-map to apply to the

specified list of VLANs

vlan-list <vid>The list of VLANs to filter. You can specify a single VLAN

(e.g. 49), a comma-separated list of VLANs (e.g. 49, 51), a

hyphenated range of VLANs (e.g. 49-51), or a combination

(e.g. 49,51-53)

input Apply the filter to ingress traffic

C613-50292-01 Rev A Command Reference for IE210L Series 577

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Spanning Tree

Commands

Introduction

Overview This chapter provides an alphabetical reference for commands used to configure

RSTP, STP or MSTP. For information about spanning trees, including configuration

procedures, see the STP Feature Overview and Configuration Guide.

Command List •“clear spanning-tree statistics” on page 579

•“clear spanning-tree detected protocols (RSTP and MSTP)” on page 580

•“debug mstp (RSTP and STP)” on page 581

•“instance priority (MSTP)” on page 585

•“instance vlan (MSTP)” on page 587

•“region (MSTP)” on page 589

•“revision (MSTP)” on page 590

•“show debugging mstp” on page 591

•“show spanning-tree” on page 592

•“show spanning-tree brief” on page 595

•“show spanning-tree mst” on page 596

•“show spanning-tree mst config” on page 597

•“show spanning-tree mst detail” on page 598

•“show spanning-tree mst detail interface” on page 600

•“show spanning-tree mst instance” on page 602

•“show spanning-tree mst instance interface” on page 603

•“show spanning-tree mst interface” on page 604

•“show spanning-tree statistics” on page 605

•“show spanning-tree statistics instance” on page 607

C613-50292-01 Rev A Command Reference for IE210L Series 578

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

•“show spanning-tree statistics instance interface” on page 608

•“show spanning-tree statistics interface” on page 610

•“show spanning-tree vlan range-index” on page 612

•“spanning-tree autoedge (RSTP and MSTP)” on page 613

•“spanning-tree bpdu” on page 614

•“spanning-tree cisco-interoperability (MSTP)” on page 616

•“spanning-tree edgeport (RSTP and MSTP)” on page 617

•“spanning-tree enable” on page 618

•“spanning-tree errdisable-timeout enable” on page 620

•“spanning-tree errdisable-timeout interval” on page 621

•“spanning-tree force-version” on page 622

•“spanning-tree forward-time” on page 623

•“spanning-tree guard root” on page 624

•“spanning-tree hello-time” on page 625

•“spanning-tree link-type” on page 626

•“spanning-tree max-age” on page 627

•“spanning-tree max-hops (MSTP)” on page 628

•“spanning-tree mode” on page 629

•“spanning-tree mst configuration” on page 630

•“spanning-tree mst instance” on page 631

•“spanning-tree mst instance path-cost” on page 632

•“spanning-tree mst instance priority” on page 634

•“spanning-tree mst instance restricted-role” on page 635

•“spanning-tree mst instance restricted-tcn” on page 637

•“spanning-tree path-cost” on page 638

•“spanning-tree portfast (STP)” on page 639

•“spanning-tree portfast bpdu-filter” on page 641

•“spanning-tree portfast bpdu-guard” on page 643

•“spanning-tree priority (bridge priority)” on page 645

•“spanning-tree priority (port priority)” on page 646

•“spanning-tree restricted-role” on page 647

•“spanning-tree restricted-tcn” on page 648

•“spanning-tree transmit-holdcount” on page 649

•“

undebug mstp” on page 650

C613-50292-01 Rev A Command Reference for IE210L Series 579

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

CLEAR SPANNING-TREE STATISTICS

clear spanning-tree statistics

Overview Use this command to clear all the STP BPDU (Bridge Protocol Data Unit) statistics.

Syntax clear spanning-tree statistics

clear spanning-tree statistics [instance <mstp-instance>]

clear spanning-tree statistics [interface <port> [instance

<mstp-instance>]]

Mode User Exec and Privileged Exec

Usage Use this command with the instance parameter in MSTP mode. Specifying this

command with the interface parameter only not the instance parameter will work

in STP and RSTP mode.

Examples awplus# clear spanning-tree statistics

awplus# clear spanning-tree statistics instance 1

awplus# clear spanning-tree statistics interface port1.0.2

instance 1

Parameter Description

<port>The port to clear STP BPDU statistics for. The port may be a switch

port (e.g. port1.0.4), a static channel group (e.g. sa2), or a

dynamic (LACP) channel group (e.g. po2).

<mstp-

instance>The MSTP instance (MSTI - Multiple Spanning Tree Instance) to clear

MSTP BPDU statistics.

C613-50292-01 Rev A Command Reference for IE210L Series 580

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

CLEAR SPANNING-TREE DETECTED PROTOCOLS (RSTP AND MSTP)

clear spanning-tree detected protocols

(RSTP and MSTP)

Overview Use this command to clear the detected protocols for a specific port, or all ports.

Use this command in RSTP or MSTP mode only.

Syntax clear spanning-tree detected protocols [interface <port>]

Mode Privileged Exec

Example awplus# clear spanning-tree detected protocols

Parameter Description

<port>The port to clear detected protocols for. The port may be a switch

port (e.g. port1.0.4), a static channel group (e.g. sa2), or a

dynamic (LACP) channel group (e.g. po2).

C613-50292-01 Rev A Command Reference for IE210L Series 581

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

DEBUG MSTP (RSTP AND STP)

debug mstp (RSTP and STP)

Overview Use this command to enable debugging for the configured spanning tree mode,

and echo data to the console, at various levels. Note that although this command

uses the keyword mstp it displays debugging output for RSTP and STP protocols

as well the MSTP protocol.

Use the no variant of this command to disable spanning tree debugging.

Syntax debug mstp {all|cli|protocol [detail]|timer [detail]}

debug mstp {packet {rx|tx} [decode] [interface <interface>]}

debug mstp {topology-change [interface <interface>]}

no debug mstp {all|cli|protocol [detail]|timer [detail]}

no debug mstp {packet {rx|tx} [decode] [interface <interface>]}

no debug mstp {topology-change [interface <interface>]}

Mode Privileged Exec and Global Configuration mode

Usage 1 Use the debug mstp topology-change interface command to generate

debugging messages when the device receives an indication of a topology change

in a BPDU from another device. The debugging can be activated on a per-port

basis. Although this command uses the keyword mstp, it displays debugging

output for RSTP and STP protocols as well as the MSTP protocol.

Due to the likely volume of output, these debug messages are best viewed using

the terminal monitor command before issuing the relevant debug mstp

Parameter Description

all Echoes all spanning tree debugging levels to the console.

cli Echoes spanning tree commands to the console.

packet Echoes spanning tree packets to the console.

rx Received packets.

tx Transmitted packets.

protocol Echoes protocol changes to the console.

timer Echoes timer information to the console.

detail Detailed output.

decode Interprets packet contents

topology-change Interprets topology change messages

interface Keyword before <interface> placeholder to specify an

interface to debug

<interface>Placeholder used to specify the name of the interface to

debug.

C613-50292-01 Rev A Command Reference for IE210L Series 582

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

DEBUG MSTP (RSTP AND STP)

command. The default terminal monitor filter will select and display these

messages. Alternatively, the messages can be directed to any of the other log

outputs by adding a filter for the MSTP application using log buffered (filter)

command:

awplus# configure terminal

awplus(config)# log buffered program mstp

Output 1

Usage 2 Use the debug mstp packet rx|tx decode interface command to generate

debugging messages containing the entire contents of a BPDU displayed in

readable text for transmitted and received xSTP BPDUs. The debugging can be

activated on a per-port basis and transmit and receive debugging is controlled

independently. Although this command uses the keyword mstp, it displays

debugging output for RSTP and STP protocols as well as the MSTP protocol.

Due to the likely volume of output, these debug messages are best viewed using

the terminal monitor command before issuing the relevant debug mstp

command. The default terminal monitor filter will select and display these

messages. Alternatively, the messages can be directed to any of the other log

outputs by adding a filter for the MSTP application using the log buffered (filter)

command:

awplus(config)# log buffered program mstp

Output 2 In MSTP mode - an MSTP BPDU with 1 MSTI:

awplus#terminal monitor

awplus#debug mstp topology-change interface port1.0.4

10:09:09 awplus MSTP[1409]: Topology change rcvd on port1.0.4 (internal)

10:09:09 awplus MSTP[1409]: Topology change rcvd on MSTI 1 port1.0.4

awplus#debug mstp topology-change interface port1.0.6

10:09:29 awplus MSTP[1409]: Topology change rcvd on port1.0.6 (external)

10:09:29 awplus MSTP[1409]: Topology change rcvd on MSTI 1 port1.0.6

C613-50292-01 Rev A Command Reference for IE210L Series 583

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

DEBUG MSTP (RSTP AND STP)

In STP mode transmitting a TCN BPDU:

In STP mode receiving an STP BPDU:

In RSTP mode receiving an RSTP BPDU:

awplus#terminal monitor

awplus#debug mstp packet rx decode interface port1.0.4

17:23:42 awplus MSTP[1417]: port1.0.4 xSTP BPDU rx - start

17:23:42 awplus MSTP[1417]: Protocol version: MSTP, BPDU type: RST

17:23:42 awplus MSTP[1417]: CIST Flags: Agree Forward Learn role=Desig

17:23:42 awplus MSTP[1417]: CIST root id : 0000:0000cd1000fe

17:23:42 awplus MSTP[1417]: CIST ext pathcost : 0

17:23:42 awplus MSTP[1417]: CIST reg root id : 0000:0000cd1000fe

17:23:42 awplus MSTP[1417]: CIST port id : 8001 (128:1)

17:23:42 awplus MSTP[1417]: msg age: 0 max age: 20 hellotime: 2 fwd delay: 15

17:23:42 awplus MSTP[1417]: Version 3 length : 80

17:23:42 awplus MSTP[1417]: Format id : 0

17:23:42 awplus MSTP[1417]: Config name : test

17:23:42 awplus MSTP[1417]: Revision level : 0

17:23:42 awplus MSTP[1417]: Config digest : 3ab68794d602fdf43b21c0b37ac3bca8

17:23:42 awplus MSTP[1417]: CIST int pathcost : 0

17:23:42 awplus MSTP[1417]: CIST bridge id : 0000:0000cd1000fe

17:23:42 awplus MSTP[1417]: CIST hops remaining : 20

17:23:42 awplus MSTP[1417]: MSTI flags : Agree Forward Learn role=Desig

17:23:42 awplus MSTP[1417]: MSTI reg root id : 8001:0000cd1000fe

17:23:42 awplus MSTP[1417]: MSTI pathcost : 0

17:23:42 awplus MSTP[1417]: MSTI bridge priority : 32768 port priority : 128

17:23:42 awplus MSTP[1417]: MSTI hops remaining : 20

17:23:42 awplus MSTP[1417]: port1.0.4 xSTP BPDU rx - finish

awplus#terminal monitor

awplus#debug mstp packet tx decode interface port1.0.4

17:28:09 awplus MSTP[1417]: port1.0.4 xSTP BPDU tx - start

17:28:09 awplus MSTP[1417]: Protocol version: STP, BPDU type: TCN

17:28:09 awplus MSTP[1417]: port1.0.4 xSTP BPDU tx - finish

awplus#terminal monitor

awplus#debug mstp packet rx decode interface port1.0.4

17:31:36 awplus MSTP[1417]: port1.0.4 xSTP BPDU rx - start

17:31:36 awplus MSTP[1417]: Protocol version: STP, BPDU type: Config

17:31:36 awplus MSTP[1417]: Flags: role=none

17:31:36 awplus MSTP[1417]: Root id : 8000:0000cd1000fe

17:31:36 awplus MSTP[1417]: Root pathcost : 0

17:31:36 awplus MSTP[1417]: Bridge id : 8000:0000cd1000fe

17:31:36 awplus MSTP[1417]: Port id : 8001 (128:1)

17:31:36 awplus MSTP[1417]: msg age: 0 max age: 20 hellotime: 2 fwd delay: 15

17:31:36 awplus MSTP[1417]: port1.0.4 xSTP BPDU rx - finish



C613-50292-01 Rev A Command Reference for IE210L Series 584

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

DEBUG MSTP (RSTP AND STP)

Examples awplus# debug mstp all

awplus# debug mstp cli

awplus# debug mstp packet rx

awplus# debug mstp protocol detail

awplus# debug mstp timer

awplus# debug mstp packet rx decode interface port1.0.2

awplus# debug mstp packet tx decode interface port1.0.6

Commands

log buffered (filter)

show debugging mstp

terminal monitor

undebug mstp

awplus#terminal monitor

awplus#debug mstp packet rx decode interface port1.0.4

awplus#17:30:17 awplus MSTP[1417]: port1.0.4 xSTP BPDU rx - start

17:30:17 awplus MSTP[1417]: Protocol version: RSTP, BPDU type: RST

17:30:17 awplus MSTP[1417]: CIST Flags: Forward Learn role=Desig

17:30:17 awplus MSTP[1417]: CIST root id : 8000:0000cd1000fe

17:30:17 awplus MSTP[1417]: CIST ext pathcost : 0

17:30:17 awplus MSTP[1417]: CIST reg root id : 8000:0000cd1000fe

17:30:17 awplus MSTP[1417]: CIST port id : 8001 (128:1)

17:30:17 awplus MSTP[1417]: msg age: 0 max age: 20 hellotime: 2 fwd delay: 15

17:30:17 awplus MSTP[1417]: port1.0.4 xSTP BPDU rx - finish

C613-50292-01 Rev A Command Reference for IE210L Series 585

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

INSTANCE PRIORITY (MSTP)

instance priority (MSTP)

Overview Use this command to set the priority for this device to become the root bridge for

the specified MSTI (Multiple Spanning Tree Instance).

Use this command for MSTP only.

Use the no variant of this command to restore the root bridge priority of the device

for the instance to the default.

Syntax instance <instance-id> priority <priority>

no instance <instance-id> priority

Default The default priority value for all instances is 32768.

Mode MST Configuration

Usage MSTP lets you distribute traffic more efficiently across a network by blocking

different links for different VLANs. You do this by making different devices into the

root bridge for each MSTP instance, so that each instance blocks a different link.

If all devices have the same root bridge priority for the instance, MSTP selects the

device with the lowest MAC address to be the root bridge. Give the device a higher

priority for becoming the root bridge for a particular instance by assigning it a

lower priority number, or vice versa.

Examples To set the root bridge priority for MSTP instance 2 to be the highest (0), so that it

will be the root bridge for this instance when available, use the commands:

awplus# configure terminal

awplus(config)# spanning-tree mst configuration

awplus(config-mst)# instance 2 priority 0

To reset the root bridge priority for instance 2 to the default (32768), use the

commands:

awplus# configure terminal

awplus(config)# spanning-tree mst configuration

awplus(config-mst)# no instance 2 priority

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15.

<priority> Specify the root bridge priority for the device for the MSTI in the

range <0-61440>. Note that a lower priority number indicates a

greater likelihood of the device becoming the root bridge. The

priority values can be set only in increments of 4096. If you

specify a number that is not a multiple of 4096, it will be rounded

down. The default priority is 32768.

C613-50292-01 Rev A Command Reference for IE210L Series 586

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

INSTANCE PRIORITY (MSTP)

Commands

region (MSTP)

revision (MSTP)

show spanning-tree mst config

spanning-tree mst instance

spanning-tree mst instance priority

C613-50292-01 Rev A Command Reference for IE210L Series 587

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

INSTANCE VLAN (MSTP)

instance vlan (MSTP)

Overview Use this command to create an MST Instance (MSTI), and associate the specified

VLANs with it. An MSTI is a spanning tree instance that exists within an MST region

(MSTR).

When a VLAN is associated with an MSTI the member ports of the VLAN are

automatically configured to send and receive spanning-tree information for the

associated MSTI. You can disable this automatic configuration of member ports of

the VLAN to the associated MSTI by using a no spanning-tree mst instance

command to remove the member port from the MSTI.

Use the instance vlan command for MSTP only.

Use the no variant of this command to remove the specified VLANs from the MSTI.

Syntax instance <instance-id> vlan <vid-list>

no instance <instance-id> vlan <vid-list>

Mode MST Configuration

Usage The VLANs must be created before being associated with an MST instance (MSTI).

If the VLAN range is not specified, the MSTI will not be created.

This command removes the specified VLANs from the CIST and adds them to the

specified MSTI. If you use the no variant of this command to remove the VLAN from

the MSTI, it returns it to the CIST. To move a VLAN from one MSTI to another, you

must first use the no variant of this command to return it to the CIST.

Ports in these VLANs will remain in the control of the CIST until you associate the

ports with the MSTI using the spanning-tree mst instance command.

Example To associate VLAN 30 with MSTI 2, use the commands:

awplus# configure terminal

awplus(config)# spanning-tree mode mstp

awplus(config)# spanning-tree mst configuration

awplus(config-mst)# instance 2 vlan 30

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15.

<vid-list> Specify one or more VLAN identifiers (VID) to be associated with

the MSTI specified. This can be a single VID in the range 1-4094,

or a hyphen-separated range or a comma-separated list of VLAN

IDs.

C613-50292-01 Rev A Command Reference for IE210L Series 588

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

INSTANCE VLAN (MSTP)

Commands

region (MSTP)

revision (MSTP)

show spanning-tree mst config

spanning-tree mst instance

vlan

C613-50292-01 Rev A Command Reference for IE210L Series 589

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

REGION (MSTP)

region (MSTP)

Overview Use this command to assign a name to the device’s MST Region. MST Instances

(MSTI) of a region form different spanning trees for different VLANs.

Use this command for MSTP only.

Use the no variant of this command to remove this region name and reset it to the

default.

Syntax region <region-name>

no region

Default By default, the region name is My Name.

Mode MST Configuration

Usage The region name, the revision number, and the digest of the VLAN to MSTI

configuration table must be the same on all devices that are intended to be in the

same MST region.

Example awplus# configure terminal

awplus(config)# spanning-tree mst configuration

awplus(config-mst)# region ATL

Commands

revision (MSTP)

show spanning-tree mst config

Parameter Description

<region-name>Specify the name of the region, up to 32 characters. Valid

characters are upper-case, lower-case, digits, underscore.

C613-50292-01 Rev A Command Reference for IE210L Series 590

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

REVISION (MSTP)

revision (MSTP)

Overview Use this command to specify the MST revision number to be used in the

configuration identifier.

Use this command for MSTP only.

Syntax revision <revision-number>

Default The default of revision number is 0.

Mode MST Configuration

Usage The region name, the revision number, and the digest of the VLAN to MSTI

configuration table must be the same on all devices that are intended to be in the

same MST region.

Example awplus# configure terminal

awplus(config)# spanning-tree mst configuration

awplus(config-mst)# revision 25

Commands

region (MSTP)

show spanning-tree mst config

instance vlan (MSTP)

Parameter Description

<revision-number><0-65535> Revision number.

C613-50292-01 Rev A Command Reference for IE210L Series 591

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW DEBUGGING MSTP

show debugging mstp

Overview Use this command to show the MSTP debugging options set.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show debugging mstp

Mode User Exec and Privileged Exec mode

Example To display the MSTP debugging options set, enter the command:

awplus# show debugging mstp

Output Figure 17-1: Example output from show debugging mstp

Commands

debug mstp (RSTP and STP)

MSTP debugging status:

MSTP receiving packet debugging is on

C613-50292-01 Rev A Command Reference for IE210L Series 592

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE

show spanning-tree

Overview Use this command to display detailed spanning tree information on the specified

port or on all ports. Use this command for RSTP, MSTP or STP.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree [interface <port-list>]

Mode User Exec and Privileged Exec

Usage Note that any list of interfaces specified must not span any interfaces that are not

installed.

A topology change counter has been included for RSTP and MSTP. You can see the

topology change counter for RSTP by using the show spanning-tree command.

You can see the topology change counter for MSTP by using the show

spanning-tree mst instance command.

Example To display spanning tree information about port1.0.3, use the command:

awplus# show spanning-tree interface port1.0.3

Parameter Description

interface Display information about the following port only.

<port-list>The ports to display information about. A port-list can be:

• a switch port (e.g. port1.0.6) a static channel group (e.g. sa2) or a

dynamic (LACP) channel group (e.g. po2)

• a continuous range of ports separated by a hyphen, e.g.

port1.0.1-1.0.4, or sa1-2, or po1-2

• a comma-separated list of ports and port ranges, e.g.

port1.0.1,port1.0.4-1.0.6. Do not mix switch ports, static channel

groups, and dynamic (LACP) channel groups in the same list

C613-50292-01 Rev A Command Reference for IE210L Series 593

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE

Output Figure 17-2: Example output from show spanning-tree in RSTP mode

Output Figure 17-3: Example output from show spanning-tree

awplus#show spanning-tree

% 1: Bridge up - Spanning Tree Enabled

% 1: Root Path Cost 0 - Root Port 0 - Bridge Priority 32768

% 1: Forward Delay 15 - Hello Time 2 - Max Age 20

% 1: Root Id 80000000cd24ff2d

% 1: Bridge Id 80000000cd24ff2d

% 1: last topology change Mon Oct 3 02:06:26 2016

% 1: portfast bpdu-filter disabled

% 1: portfast bpdu-guard disabled

% 1: portfast errdisable timeout disabled

% 1: portfast errdisable timeout interval 300 sec

% port1.0.1: Port 5001 - Id 8389 - Role Disabled - State Discarding

% port1.0.1: Designated Path Cost 0

% port1.0.1: Configured Path Cost 20000000 - Add type Explicit ref count 1

% port1.0.1: Designated Port Id 8389 - Priority 128 -

% port1.0.1: Root 80000000cd24ff2d

% port1.0.1: Designated Bridge 80000000cd24ff2d

% port1.0.1: Message Age 0 - Max Age 20

% port1.0.1: Hello Time 2 - Forward Delay 15

% port1.0.1: Forward Timer 0 - Msg Age Timer 0 - Hello Timer 0 - topo change 

timer 0

% port1.0.1: forward-transitions 0

% port1.0.1: Version Rapid Spanning Tree Protocol - Received None - Send STP

% port1.0.1: No portfast configured - Current portfast off

% port1.0.1: portfast bpdu-guard default - Current portfast bpdu-guard off

% port1.0.1: portfast bpdu-filter default - Current portfast bpdu-filter off

% port1.0.1: no root guard configured - Current root guard off

% port1.0.1: Configured Link Type point-to-point - Current shared

%

% port1.0.2: Port 5002 - Id 838a - Role Disabled - State Discarding

% port1.0.2: Designated Path Cost 0

% port1.0.2: Configured Path Cost 20000000 - Add type Explicit ref count 1

% port1.0.2: Designated Port Id 838a - Priority 128 -

% port1.0.2: Root 80000000cd24ff2d

% port1.0.2: Designated Bridge 80000000cd24ff2d

% port1.0.2: Message Age 0 - Max Age 20

% port1.0.2: Hello Time 2 - Forward Delay 15

% port1.0.2: Forward Timer 0 - Msg Age Timer 0 - Hello Timer 0 - topo change 

timer 0

% port1.0.2: forward-transitions 0

% port1.0.2: Version Rapid Spanning Tree Protocol - Received None - Send STP

% port1.0.2: No portfast configured - Current portfast off

% port1.0.2: portfast bpdu-guard default - Current portfast bpdu-guard off

% port1.0.2: portfast bpdu-filter default - Current portfast bpdu-filter off

% port1.0.2: no root guard configured - Current root guard off

% port1.0.2: Configured Link Type point-to-point - Current shared

C613-50292-01 Rev A Command Reference for IE210L Series 594

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE

% 1: Bridge up - Spanning Tree Enabled

% 1: Root Path Cost 0 - Root Port 0 - Bridge Priority 32768

% 1: Forward Delay 15 - Hello Time 2 - Max Age 20

% 1: Root Id 80000000cd20f093

% 1: Bridge Id 80000000cd20f093

% 1: last topology change Mon Oct 3 02:06:26 2016

% 1: portfast bpdu-filter disabled

% 1: portfast bpdu-guard disabled

% 1: portfast errdisable timeout disabled

% 1: portfast errdisable timeout interval 300 sec

% port1.0.3: Port 5023 - Id 839f - Role Designated - State Forwarding

% port1.0.3: Designated Path Cost 0

% port1.0.3: Configured Path Cost 200000 - Add type Explicit ref count 1

% port1.0.3: Designated Port Id 839f - Priority 128 -

% port1.0.3: Root 80000000cd20f093

% port1.0.3: Designated Bridge 80000000cd20f093

% port1.0.3: Message Age 0 - Max Age 20

% port1.0.3: Hello Time 2 - Forward Delay 15

% port1.0.3: Forward Timer 0 - Msg Age Timer 0 - Hello Timer 1 - topo change 

timer 0

% port1.0.3: forward-transitions 32

% port1.0.3: Version Rapid Spanning Tree Protocol - Received None - Send RSTP

% port1.0.3: No portfast configured - Current portfast off

% port1.0.3: portfast bpdu-guard default - Current portfast bpdu-guard off

% port1.0.3: portfast bpdu-filter default - Current portfast bpdu-filter off

% port1.0.3: no root guard configured - Current root guard off

% port1.0.3: Configured Link Type point-to-point - Current point-to-point

...

C613-50292-01 Rev A Command Reference for IE210L Series 595

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE BRIEF

show spanning-tree brief

Overview Use this command to display a summary of spanning tree status information on all

ports. Use this command for RSTP, MSTP or STP.

Syntax show spanning-tree brief

Mode User Exec and Privileged Exec

Usage Note that any list of interfaces specified must not span any interfaces that are not

installed.

A topology change counter has been included for RSTP and MSTP. You can see the

topology change counter for RSTP by using the show spanning-tree command.

You can see the topology change counter for MSTP by using the show

spanning-tree mst instance command.

Example To display a summary of spanning tree status information, use the command:

awplus# show spanning-tree brief

Output Figure 17-4: Example output from show spanning-tree brief

Commands

show spanning-tree

Parameter Description

brief A brief summary of spanning tree information.

Default: Bridge up - Spanning Tree Enabled

Default: Root Path Cost 40000 - Root Port 4501 - Bridge Priority 32768

Default: Root Id 8000:0000cd250001

Default: Bridge Id 8000:0000cd296eb1



Port Designated Bridge Port Id Role State

sa1 8000:001577c9744b 8195 Rootport Forwarding

po1 8000:0000cd296eb1 81f9 Designated Forwarding

port1.0.1 8000:0000cd296eb1 8389 Disabled Discarding

port1.0.2 8000:0000cd296eb1 838a Disabled Discarding

port1.0.3 8000:0000cd296eb1 838b Disabled Discarding

...

C613-50292-01 Rev A Command Reference for IE210L Series 596

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE MST

show spanning-tree mst

Overview This command displays bridge-level information about the CIST and VLAN to MSTI

mappings.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree mst

Mode User Exec, Privileged Exec and Interface Configuration

Example To display bridge-level information about the CIST and VLAN to MSTI mappings,

enter the command:

awplus# show spanning-tree mst

Output Figure 17-5: Example output from show spanning-tree mst

Commands

show spanning-tree mst interface

% 1: Bridge up - Spanning Tree Enabled

% 1: CIST Root Path Cost 0 - CIST Root Port 0 - CIST Bridge 

Priority 32768

% 1: Forward Delay 15 - Hello Time 2 - Max Age 20 - Max-hops 20

% 1: CIST Root Id 8000000475e93ffe

% 1: CIST Reg Root Id 8000000475e93ffe

% 1: CST Bridge Id 8000000475e93ffe

% 1: portfast bpdu-filter disabled

% 1: portfast bpdu-guard disabled

% 1: portfast errdisable timeout disabled

% 1: portfast errdisable timeout interval 300 sec

%

% Instance VLAN

% 0: 1

% 2: 4

C613-50292-01 Rev A Command Reference for IE210L Series 597

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE MST CONFIG

show spanning-tree mst config

Overview Use this command to display MSTP configuration identifier for the device.

Syntax show spanning-tree mst config

Mode User Exec, Privileged Exec and Interface Configuration

Usage The region name, the revision number, and the digest of the VLAN to MSTI

configuration table must be the same on all devices that are intended to be in the

same MST region.

Example To display MSTP configuration identifier information, enter the command:

awplus# show spanning-tree mst config

Output Figure 17-6: Example output from show spanning-tree mst config

Commands

instance vlan (MSTP)

region (MSTP)

revision (MSTP)

awplus#show spanning-tree mst config

%

% MSTP Configuration Information:

%------------------------------------------------------

% Format Id : 0

% Name : My Name

% Revision Level : 0

% Digest : 0x80DEE46DA92A98CF21C603291B22880A

%------------------------------------------------------

C613-50292-01 Rev A Command Reference for IE210L Series 598

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE MST DETAIL

show spanning-tree mst detail

Overview This command displays detailed information about each instance, and all

interfaces associated with that particular instance.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree mst detail

Mode User Exec, Privileged Exec and Interface Configuration

Example To display detailed information about each instance, and all interfaces associated

with them, enter the command:

awplus# show spanning-tree mst detail

Output Figure 17-7: Example output from show spanning-tree mst detail

% 1: Bridge up - Spanning Tree Enabled

% 1: CIST Root Path Cost 0 - CIST Root Port 0 - CIST Bridge Priority 32768

% 1: Forward Delay 15 - Hello Time 2 - Max Age 20 - Max-hops 20

% 1: CIST Root Id 80000000cd24ff2d

% 1: CIST Reg Root Id 80000000cd24ff2d

% 1: CIST Bridge Id 80000000cd24ff2d

% 1: portfast bpdu-filter disabled

% 1: portfast bpdu-guard disabled

% 1: portfast errdisable timeout disabled

% 1: portfast errdisable timeout interval 300 sec

% port1.0.1: Port 5001 - Id 8389 - Role Disabled - State Discarding

% port1.0.1: Designated External Path Cost 0 -Internal Path Cost 0

% port1.0.1: Configured Path Cost 20000000 - Add type Explicit ref count 1

% port1.0.1: Designated Port Id 8389 - CIST Priority 128 -

% port1.0.1: CIST Root 80000000cd24ff2d

% port1.0.1: Regional Root 80000000cd24ff2d

% port1.0.1: Designated Bridge 80000000cd24ff2d

% port1.0.1: Message Age 0 - Max Age 20

% port1.0.1: CIST Hello Time 2 - Forward Delay 15

% port1.0.1: CIST Forward Timer 0 - Msg Age Timer 0 - Hello Timer 0 - topo 

change timer 0

...

% port1.0.2: forward-transitions 0

% port1.0.2: Version Multiple Spanning Tree Protocol - Received None - Send STP

% port1.0.2: No portfast configured - Current portfast off

% port1.0.2: portfast bpdu-guard default - Current portfast bpdu-guard off

% port1.0.2: portfast bpdu-filter default - Current portfast bpdu-filter off

% port1.0.2: no root guard configured - Current root guard off

% port1.0.2: Configured Link Type point-to-point - Current shared

C613-50292-01 Rev A Command Reference for IE210L Series 599

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE MST DETAIL

% port1.0.3: Port 5003 - Id 838b - Role Disabled - State Discarding

% port1.0.3: Designated External Path Cost 0 -Internal Path Cost 0

% port1.0.3: Configured Path Cost 20000000 - Add type Explicit ref count 1

% port1.0.3: Designated Port Id 838b - CIST Priority 128 -

% port1.0.3: CIST Root 80000000cd24ff2d

% port1.0.3: Regional Root 80000000cd24ff2d

% port1.0.3: Designated Bridge 80000000cd24ff2d

% port1.0.3: Message Age 0 - Max Age 20

% port1.0.3: CIST Hello Time 2 - Forward Delay 15

% port1.0.3: CIST Forward Timer 0 - Msg Age Timer 0 - Hello Timer 0 - topo 

change timer 0

% port1.0.3: forward-transitions 0

% port1.0.3: Version Multiple Spanning Tree Protocol - Received None - Send STP

% port1.0.3: No portfast configured - Current portfast off

% port1.0.3: portfast bpdu-guard default - Current portfast bpdu-guard off

% port1.0.3: portfast bpdu-filter default - Current portfast bpdu-filter off

% port1.0.3: no root guard configured - Current root guard off

% port1.0.3: Configured Link Type point-to-point - Current shared

C613-50292-01 Rev A Command Reference for IE210L Series 600

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE MST DETAIL INTERFACE

show spanning-tree mst detail interface

Overview This command displays detailed information about the specified switch port, and

the MST instances associated with it.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree mst detail interface <port>

Mode User Exec, Privileged Exec and Interface Configuration

Example To display detailed information about port1.0.3 and the instances associated with

it, enter the command:

awplus# show spanning-tree mst detail interface port1.0.3

Output Figure 17-8: Example output from show spanning-tree mst detail interface

Parameter Description

<port>The port to display information about. The port may be a switch port

(e.g. port1.0.4), a static channel group (e.g. sa2), or a dynamic

(LACP) channel group (e.g. po2).

% 1: Bridge up - Spanning Tree Enabled

% 1: CIST Root Path Cost 0 - CIST Root Port 0 - CIST Bridge Priority 32768

% 1: Forward Delay 15 - Hello Time 2 - Max Age 20 - Max-hops 20

% 1: CIST Root Id 80000000cd24ff2d

% 1: CIST Reg Root Id 80000000cd24ff2d

% 1: CIST Bridge Id 80000000cd24ff2d

% 1: portfast bpdu-filter disabled

% 1: portfast bpdu-guard disabled

% 1: portfast errdisable timeout disabled

% 1: portfast errdisable timeout interval 300 sec

% port1.0.2: Port 5002 - Id 838a - Role Disabled - State Discarding

% port1.0.2: Designated External Path Cost 0 -Internal Path Cost 0

% port1.0.2: Configured Path Cost 20000000 - Add type Explicit ref count 2

% port1.0.2: Designated Port Id 838a - CIST Priority 128 -

% port1.0.2: CIST Root 80000000cd24ff2d

% port1.0.2: Regional Root 80000000cd24ff2d

% port1.0.2: Designated Bridge 80000000cd24ff2d

% port1.0.2: Message Age 0 - Max Age 20

% port1.0.2: CIST Hello Time 2 - Forward Delay 15

% port1.0.2: CIST Forward Timer 0 - Msg Age Timer 0 - Hello Timer 0 - topo 

change timer 0

% port1.0.2: forward-transitions 0

% port1.0.2: Version Multiple Spanning Tree Protocol - Received None - Send STP

C613-50292-01 Rev A Command Reference for IE210L Series 601

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE MST DETAIL INTERFACE

% port1.0.2: No portfast configured - Current portfast off

% port1.0.2: portfast bpdu-guard default - Current portfast bpdu-guard off

% port1.0.2: portfast bpdu-filter default - Current portfast bpdu-filter off

% port1.0.2: no root guard configured - Current root guard off

% port1.0.2: Configured Link Type point-to-point - Current shared

%

% Instance 2: Vlans: 2

% 1: MSTI Root Path Cost 0 -MSTI Root Port 0 - MSTI Bridge Priority 32768

% 1: MSTI Root Id 80020000cd24ff2d

% 1: MSTI Bridge Id 80020000cd24ff2d

% port1.0.2: Port 5002 - Id 838a - Role Disabled - State Discarding

% port1.0.2: Designated Internal Path Cost 0 - Designated Port Id 838a

% port1.0.2: Configured Internal Path Cost 20000000

% port1.0.2: Configured CST External Path cost 20000000

% port1.0.2: CST Priority 128 - MSTI Priority 128

% port1.0.2: Designated Root 80020000cd24ff2d

% port1.0.2: Designated Bridge 80020000cd24ff2d

% port1.0.2: Message Age 0 - Max Age 0

% port1.0.2: Hello Time 2 - Forward Delay 15

% port1.0.2: Forward Timer 0 - Msg Age Timer 0 - Hello Timer 0

C613-50292-01 Rev A Command Reference for IE210L Series 602

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE MST INSTANCE

show spanning-tree mst instance

Overview This command displays detailed information for the specified instance, and all

switch ports associated with that instance.

A topology change counter has been included for RSTP and MSTP. You can see the

topology change counter for RSTP by using the show spanning-tree command.

You can see the topology change counter for MSTP by using the show

spanning-tree mst instance command.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree mst instance <instance-id>

Mode User Exec, Privileged Exec, and Interface Configuration

Example To display detailed information for instance 2, and all switch ports associated with

that instance, use the command:

awplus# show spanning-tree mst instance 2

Output Figure 17-9: Example output from show spanning-tree mst instance

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15.

% 1: MSTI Root Path Cost 0 - MSTI Root Port 0 - MSTI Bridge Priority 32768

% 1: MSTI Root Id 80020000cd24ff2d

% 1: MSTI Bridge Id 80020000cd24ff2d

% port1.0.2: Port 5002 - Id 838a - Role Disabled - State Discarding

% port1.0.2: Designated Internal Path Cost 0 - Designated Port Id 838a

% port1.0.2: Configured Internal Path Cost 20000000

% port1.0.2: Configured CST External Path cost 20000000

% port1.0.2: CST Priority 128 - MSTI Priority 128

% port1.0.2: Designated Root 80020000cd24ff2d

% port1.0.2: Designated Bridge 80020000cd24ff2d

% port1.0.2: Message Age 0 - Max Age 0

% port1.0.2: Hello Time 2 - Forward Delay 15

% port1.0.2: Forward Timer 0 - Msg Age Timer 0 - Hello Timer 0

C613-50292-01 Rev A Command Reference for IE210L Series 603

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE MST INSTANCE INTERFACE

show spanning-tree mst instance interface

Overview This command displays detailed information for the specified MST (Multiple

Spanning Tree) instance, and the specified switch port associated with that MST

instance.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree mst instance <instance-id> interface <port>

Mode User Exec, Privileged Exec, and Interface Configuration

Example To display detailed information for instance 2, interface port1.0.2, use the

command:

awplus# show spanning-tree mst instance 2 interface port1.0.2

Output Figure 17-10: Example output from show spanning-tree mst instance

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15.

<port>The port to display information about. The port may be a switch

port (e.g. port1.0.4), a static channel group (e.g. sa2), or a dynamic

(LACP) channel group (e.g. po2).

% 1: MSTI Root Path Cost 0 - MSTI Root Port 0 - MSTI Bridge Priority 32768

% 1: MSTI Root Id 80020000cd24ff2d

% 1: MSTI Bridge Id 80020000cd24ff2d

% port1.0.2: Port 5002 - Id 838a - Role Disabled - State Discarding

% port1.0.2: Designated Internal Path Cost 0 - Designated Port Id 838a

% port1.0.2: Configured Internal Path Cost 20000000

% port1.0.2: Configured CST External Path cost 20000000

% port1.0.2: CST Priority 128 - MSTI Priority 128

% port1.0.2: Designated Root 80020000cd24ff2d

% port1.0.2: Designated Bridge 80020000cd24ff2d

% port1.0.2: Message Age 0 - Max Age 0

% port1.0.2: Hello Time 2 - Forward Delay 15

% port1.0.2: Forward Timer 0 - Msg Age Timer 0 - Hello Timer 0

C613-50292-01 Rev A Command Reference for IE210L Series 604

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE MST INTERFACE

show spanning-tree mst interface

Overview This command displays the number of instances created, and VLANs associated

with it for the specified switch port.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree mst interface <port>

Mode User Exec, Privileged Exec, and Interface Configuration

Example To display detailed information about each instance, and all interfaces associated

with them, for port1.0.4, use the command:

awplus# show spanning-tree mst interface port1.0.4

Output Figure 17-11: Example output from show spanning-tree mst interface

Parameter Description

<port>The port to display information about. The port may be a switch port

(e.g. port1.0.4), a static channel group (e.g. sa2), or a dynamic

(LACP) channel group (e.g. po2).

% 1: Bridge up - Spanning Tree Enabled

% 1: CIST Root Path Cost 0 - CIST Root Port 0 - CIST Bridge Priority 32768

% 1: Forward Delay 15 - Hello Time 2 - Max Age 20 - Max-hops 20

% 1: CIST Root Id 80000008c73a2b22

% 1: CIST Reg Root Id 80000008c73a2b22

% 1: CST Bridge Id 80000008c73a2b22

% 1: portfast bpdu-filter disabled

% 1: portfast bpdu-guard disabled

% 1: portfast errdisable timeout disabled

% 1: portfast errdisable timeout interval 1 sec

%

% Instance VLAN

% 0: 1

% 1: 2-3

% 2: 4-5

C613-50292-01 Rev A Command Reference for IE210L Series 605

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE STATISTICS

show spanning-tree statistics

Overview This command displays BPDU (Bridge Protocol Data Unit) statistics for all

spanning-tree instances, and all switch ports associated with all spanning-tree

instances.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree statistics

Mode Privileged Exec

Usage To display BPDU statistics for all spanning-tree instances, and all switch ports

associated with all spanning-tree instances, use the command:

awplus# show spanning-tree statistics

Output Figure 17-12: Example output from show spanning-tree statistics

Port number = 915 Interface = port1.0.6

================================

% BPDU Related Parameters

% -----------------------

% Port Spanning Tree : Disable

% Spanning Tree Type : Rapid Spanning Tree Protocol

% Current Port State : Discarding

% Port ID : 8393

% Port Number : 393

% Path Cost : 20000000

% Message Age : 0

% Designated Root : ec:cd:6d:20:c0:ed

% Designated Cost : 0

% Designated Bridge : ec:cd:6d:20:c0:ed

% Designated Port Id : 8393

% Top Change Ack : FALSE

% Config Pending : FALSE

% PORT Based Information & Statistics

% -----------------------------------

% Config Bpdu's xmitted : 0

% Config Bpdu's received : 0

% TCN Bpdu's xmitted : 0

% TCN Bpdu's received : 0

% Forward Trans Count : 0

C613-50292-01 Rev A Command Reference for IE210L Series 606

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE STATISTICS

% STATUS of Port Timers

% ---------------------

% Hello Time Configured : 2

% Hello timer : INACTIVE

% Hello Time Value : 0

% Forward Delay Timer : INACTIVE

% Forward Delay Timer Value : 0

% Message Age Timer : INACTIVE

% Message Age Timer Value : 0

% Topology Change Timer : INACTIVE

% Topology Change Timer Value : 0

% Hold Timer : INACTIVE

% Hold Timer Value : 0

% Other Port-Specific Info

------------------------

% Max Age Transitions : 1

% Msg Age Expiry : 0

% Similar BPDUS Rcvd : 0

% Src Mac Count : 0

% Total Src Mac Rcvd : 0

% Next State : Learning

% Topology Change Time : 0

C613-50292-01 Rev A Command Reference for IE210L Series 607

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE STATISTICS INSTANCE

show spanning-tree statistics instance

Overview This command displays BPDU (Bridge Protocol Data Unit) statistics for the specified

MST (Multiple Spanning Tree) instance, and all switch ports associated with that

MST instance.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree statistics instance <instance-id>

Mode Privileged Exec

Example To display BPDU statistics information for MST instance 2, and all switch ports

associated with that MST instance, use the command:

awplus# show spanning-tree statistics instance 2

Output Figure 17-13: Example output from show spanning-tree statistics instance

Commands

show spanning-tree statistics

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15.

% % INST_PORT port1.0.3 Information & Statistics

% ----------------------------------------

% Config Bpdu's xmitted (port/inst) : (0/0)

% Config Bpdu's received (port/inst) : (0/0)

% TCN Bpdu's xmitted (port/inst) : (0/0)

% TCN Bpdu's received (port/inst) : (0/0)

% Message Age(port/Inst) : (0/0)

% port1.0.3: Forward Transitions : 0

% Next State : Learning

% Topology Change Time : 0

...

C613-50292-01 Rev A Command Reference for IE210L Series 608

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE STATISTICS INSTANCE INTERFACE

show spanning-tree statistics instance

interface

Overview This command displays BPDU (Bridge Protocol Data Unit) statistics for the specified

MST (Multiple Spanning Tree) instance and the specified switch port associated

with that MST instance.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree statistics instance <instance-id> interface

<port>

Mode Privileged Exec

Example To display BPDU statistics for MST instance 2, interface port1.0.2, use the

command:

awplus# show spanning-tree statistics instance 2 interface

port1.0.2

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15.

<port>The port to display information about. The port may be a switch

port (e.g. port1.0.4), a static channel group (e.g. sa2), or a

dynamic (LACP) channel group (e.g. po2).

C613-50292-01 Rev A Command Reference for IE210L Series 609

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE STATISTICS INSTANCE INTERFACE

Output Figure 17-14: Example output from show spanning-tree statistics instance

interface

Commands

show spanning-tree statistics

awplus#sh spanning-tree statistics interface port1.0.2 instance 1

Spanning Tree Enabled for Instance : 1

==================================

% INST_PORT port1.0.2 Information & Statistics

% ----------------------------------------

% Config Bpdu's xmitted (port/inst) : (0/0)

% Config Bpdu's received (port/inst) : (0/0)

% TCN Bpdu's xmitted (port/inst) : (0/0)

% TCN Bpdu's received (port/inst) : (0/0)

% Message Age(port/Inst) : (0/0)

% port1.0.2: Forward Transitions : 0

% Next State : Learning

% Topology Change Time : 0



% Other Inst/Vlan Information & Statistics

% ----------------------------------------

% Bridge Priority : 0

% Bridge Mac Address : ec:cd:6d:20:c0:ed

% Topology Change Initiator : 5023

% Last Topology Change Occured : Mon Oct 3 05:42:06 2016

% Topology Change : FALSE

% Topology Change Detected : FALSE

% Topology Change Count : 1

% Topology Change Last Recvd from : 00:00:00:00:00:00

C613-50292-01 Rev A Command Reference for IE210L Series 610

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE STATISTICS INTERFACE

show spanning-tree statistics interface

Overview This command displays BPDU (Bridge Protocol Data Unit) statistics for the specified

switch port, and all MST instances associated with that switch port.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show spanning-tree statistics interface <port>

Mode Privileged Exec

Example To display BPDU statistics about each MST instance for port1.0.2, use the

command:

awplus# show spanning-tree statistics interface port1.0.2

Output Figure 17-15: Example output from show spanning-tree statistics interface

Parameter Description

<port>The port to display information about. The port may be a switch port

(e.g. port1.0.2), a static channel group (e.g. sa2), or a dynamic (LACP)

channel group (e.g. po2).

awplus#show spanning-tree statistics interface port1.0.2



Port number = 906 Interface = port1.0.2

================================

% BPDU Related Parameters

% -----------------------

% Port Spanning Tree : Disable

% Spanning Tree Type : Multiple Spanning Tree Protocol

% Current Port State : Discarding

% Port ID : 838a

% Port Number : 38a

% Path Cost : 20000000

% Message Age : 0

% Designated Root : ec:cd:6d:20:c0:ed

% Designated Cost : 0

% Designated Bridge : ec:cd:6d:20:c0:ed

% Designated Port Id : 838a

% Top Change Ack : FALSE

% Config Pending : FALSE

C613-50292-01 Rev A Command Reference for IE210L Series 611

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE STATISTICS INTERFACE

Commands

show spanning-tree statistics

% PORT Based Information & Statistics

% -----------------------------------

% Config Bpdu's xmitted : 0

% Config Bpdu's received : 0

% TCN Bpdu's xmitted : 0

% TCN Bpdu's received : 0

% Forward Trans Count : 0

% STATUS of Port Timers

% ---------------------

% Hello Time Configured : 2

% Hello timer : INACTIVE

% Hello Time Value : 0

% Forward Delay Timer : INACTIVE

% Forward Delay Timer Value : 0

% Message Age Timer : INACTIVE

% Message Age Timer Value : 0

% Topology Change Timer : INACTIVE

% Topology Change Timer Value : 0

% Hold Timer : INACTIVE

% Hold Timer Value : 0

% Other Port-Specific Info

------------------------

% Max Age Transitions : 1

% Msg Age Expiry : 0

% Similar BPDUS Rcvd : 0

% Src Mac Count : 0

% Total Src Mac Rcvd : 0

% Next State : Learning

% Topology Change Time : 0

% Other Bridge information & Statistics

--------------------------------------

% STP Multicast Address : 01:80:c2:00:00:00

% Bridge Priority : 32768

% Bridge Mac Address : ec:cd:6d:20:c0:ed

% Bridge Hello Time : 2

% Bridge Forward Delay : 15

% Topology Change Initiator : 5023

% Last Topology Change Occured : Mon Oct 3 05:41:20 2016

% Topology Change : FALSE

% Topology Change Detected : TRUE

% Topology Change Count : 1

% Topology Change Last Recvd from : 00:00:00:00:00:00

C613-50292-01 Rev A Command Reference for IE210L Series 612

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SHOW SPANNING-TREE VLAN RANGE-INDEX

show spanning-tree vlan range-index

Overview Use this command to display information about MST (Multiple Spanning Tree)

instances and the VLANs associated with them including the VLAN range-index

value for the device.

Syntax show spanning-tree vlan range-index

Mode Privileged Exec

Example To display information about MST instances and the VLANs associated with them

for the device, including the VLAN range-index value, use the following command:

awplus# show spanning-tree vlan range-index

Output Figure 17-16: Example output from show spanning-tree vlan range-index

Commands

show spanning-tree statistics

awplus#show spanning-tree vlan range-index

% MST Instance VLAN RangeIdx

% 1 1 1%

C613-50292-01 Rev A Command Reference for IE210L Series 613

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE AUTOEDGE (RSTP AND MSTP)

spanning-tree autoedge (RSTP and MSTP)

Overview Use this command to enable the autoedge feature on the port.

The autoedge feature allows the port to automatically detect that it is an edge

port. If it does not receive any BPDUs in the first three seconds after linkup,

enabling, or entering RSTP or MSTP mode, it sets itself to be an edgeport and

enters the forwarding state.

Use this command for RSTP or MSTP.

Use the no variant of this command to disable this feature.

Syntax spanning-tree autoedge

no spanning-tree autoedge

Default Disabled

Mode Interface Configuration

Example awplus# configure terminal

awplus(config)# interface port1.0.3

awplus(config-if)# spanning-tree autoedge

Commands

spanning-tree edgeport (RSTP and MSTP)

C613-50292-01 Rev A Command Reference for IE210L Series 614

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE BPDU

spanning-tree bpdu

Overview Use this command to configure BPDU (Bridge Protocol Data Unit) discarding or

forwarding, when STP is disabled on the switch. This may be needed for correct STP

operation in complex networks.

There is no no variant for this command. Instead, apply the discard parameter to

reset it back to the default then re-enable STP with the command spanning-tree

enable.

Syntax spanning-tree bpdu

{discard|forward|forward-untagged-vlan|forward-vlan}

Default The discard parameter is enabled by default.

Mode Global Configuration

Usage This command enables the switch to forward unsupported BPDUs with an

unsupported Spanning Tree Protocol, such as proprietary STP protocols with

unsupported BPDUs, by forwarding BDPU (Bridge Protocol Data Unit) frames

unchanged through the switch.

You must disable RSTP with the no spanning-tree rstp enable command before

you can use this command.

When you want to revert to default behavior on the switch, issue a spanning-tree

bdpu discard command and re-enable Spanning Tree with a spanning-tree rstp

enable command.

Parameter Description

bpdu A port that has BPDU filtering enabled will not transmit any BPDUs

and will ignore any BPDUs received. This port type has one of the

following parameters (in Global Configuration mode):

discard Discards all ingress STP BPDU frames.

forward Forwards any ingress STP BPDU packets to all ports,

regardless of any VLAN membership.

forward-

untagged-

vlan

Forwards any ingress STP BPDU frames to all ports

that are untagged members of the ingress port’s

native VLAN.

forward-

vlan Forwards any ingress STP BPDU frames to all ports

that are tagged members of the ingress port’s native

VLAN.

C613-50292-01 Rev A Command Reference for IE210L Series 615

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE BPDU

Examples To enable STP BPDU discard in Global Configuration mode with STP disabled,

which discards all ingress STP BPDU frames, enter the commands:

awplus# configure terminal

awplus(config)# no spanning-tree rstp enable

awplus(config)# spanning-tree bpdu discard

To enable STP BPDU forward in Global Configuration mode with STP disabled,

which forwards any ingress STP BPDU frames to all ports regardless of any VLAN

membership, enter the commands:

awplus# configure terminal

awplus(config)# no spanning-tree rstp enable

awplus(config)# spanning-tree bpdu forward

To enable STP BPDU forwarding for untagged frames in Global Configuration

mode with STP disabled, which forwards any ingress STP BPDU frames to all ports

that are untagged members of the ingress port’s native VLAN, enter the

commands:

awplus# configure terminal

awplus(config)# no spanning-tree rstp enable

awplus(config)# spanning-tree bpdu forward-untagged-vlan

To enable STP BPDU forwarding for tagged frames in Global Configuration mode

with STP disabled, which forwards any ingress STP BPDU frames to all ports that are

tagged members of the ingress port’s native VLAN, enter the commands:

awplus# configure terminal

awplus(config)# no spanning-tree rstp enable

awplus(config)# spanning-tree bpdu forward-vlan

To reset STP BPDU back to the default discard parameter and re-enable RSTP on

the switch, enter the commands:

awplus# configure terminal

awplus(config)# spanning-tree bpdu discard

awplus(config)# spanning-tree rstp enable

Commands

show spanning-tree

spanning-tree enable

C613-50292-01 Rev A Command Reference for IE210L Series 616

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE CISCO-INTEROPERABILITY (MSTP)

spanning-tree cisco-interoperability (MSTP)

Overview Use this command to enable/disable Cisco-interoperability for MSTP.

Use this command for MSTP only.

Syntax spanning-tree cisco-interoperability {enable|disable}

Default If this command is not used, Cisco interoperability is disabled.

Mode Global Configuration

Usage For compatibility with certain Cisco devices, all devices in the switched LAN

running the AlliedWare Plus™ Operating System must have Cisco-interoperability

enabled. When the AlliedWare Plus Operating System is interoperating with Cisco,

the only criteria used to classify a region are the region name and revision level.

VLAN to instance mapping is not used to classify regions when interoperating with

Cisco.

Examples To enable Cisco interoperability on a Layer 2 device:

awplus# configure terminal

awplus(config)# spanning-tree cisco-interoperability enable

To disable Cisco interoperability on a Layer 2 device:

awplus# configure terminal

awplus(config)# spanning-tree cisco-interoperability disable

Parameter Description

enable Enable Cisco interoperability for MSTP.

disable Disable Cisco interoperability for MSTP.

C613-50292-01 Rev A Command Reference for IE210L Series 617

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE EDGEPORT (RSTP AND MSTP)

spanning-tree edgeport (RSTP and MSTP)

Overview Use this command to set a port as an edge-port.

Use this command for RSTP or MSTP.

This command has the same effect as the spanning-tree portfast (STP) command,

but the configuration displays differently in the output of some show commands.

Use the no variant of this command to set a port to its default state (not an

edge-port).

Syntax spanning-tree edgeport

no spanning-tree edgeport

Default Not an edge port.

Mode Interface Configuration

Usage Use this command on a switch port connected to a LAN that has no other bridges

attached. If a BPDU is received on the port that indicates that another bridge is

connected to the LAN, then the port is no longer treated as an edge port.

Example awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree edgeport

Commands

spanning-tree autoedge (RSTP and MSTP)

C613-50292-01 Rev A Command Reference for IE210L Series 618

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE ENABLE

spanning-tree enable

Overview Use this command in Global Configuration mode to enable the specified spanning

tree protocol for all switch ports. Note that this must be the spanning tree protocol

that is configured on the device by the spanning-tree mode command.

Use the no variant of this command to disable the configured spanning tree

protocol. This places all switch ports in the forwarding state.

Syntax spanning-tree {mstp|rstp|stp} enable

no spanning-tree {mstp|rstp|stp} enable

Default RSTP is enabled by default for all switch ports.

Mode Global Configuration

Usage With no configuration, spanning tree is enabled, and the spanning tree mode is set

to RSTP. To change the mode, see spanning-tree mode command.

Examples To enable STP in Global Configuration mode, enter the below commands:

awplus# configure terminal

awplus(config)# spanning-tree stp enable

To disable STP in Global Configuration mode, enter the below commands:

awplus# configure terminal

awplus(config)# no spanning-tree stp enable

To enable MSTP in Global Configuration mode, enter the below commands:

awplus# configure terminal

awplus(config)# spanning-tree mstp enable

To disable MSTP in Global Configuration mode, enter the below commands:

awplus# configure terminal

awplus(config)# no spanning-tree mstp enable

To enable RSTP in Global Configuration mode, enter the below commands:

awplus# configure terminal

awplus(config)# spanning-tree rstp enable

Parameter Description

mstp Enables or disables MSTP (Multiple Spanning Tree Protocol).

rstp Enables or disables RSTP (Rapid Spanning Tree Protocol).

stp Enables or disables STP (Spanning Tree Protocol).

C613-50292-01 Rev A Command Reference for IE210L Series 619

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE ENABLE

To disable RSTP in Global Configuration mode, enter the below commands:

awplus# configure terminal

awplus(config)# no spanning-tree rstp enable

Commands

spanning-tree bpdu

spanning-tree mode

C613-50292-01 Rev A Command Reference for IE210L Series 620

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE ERRDISABLE-TIMEOUT ENABLE

spanning-tree errdisable-timeout enable

Overview Use this command to enable the errdisable-timeout facility, which sets a timeout

for ports that are disabled due to the BPDU guard feature.

Use this command for RSTP or MSTP.

Use the no variant of this command to disable the errdisable-timeout facility.

Syntax spanning-tree errdisable-timeout enable

no spanning-tree errdisable-timeout enable

Default By default, the errdisable-timeout is disabled.

Mode Global Configuration

Usage The BPDU guard feature shuts down the port on receiving a BPDU on a

BPDU-guard enabled port. This command associates a timer with the feature such

that the port is re- enabled without manual intervention after a set interval. This

interval can be configured by the user using the spanning-tree errdisable-timeout

interval command.

Example awplus# configure terminal

awplus(config)# spanning-tree errdisable-timeout enable

Commands

show spanning-tree

spanning-tree errdisable-timeout interval

spanning-tree portfast bpdu-guard

C613-50292-01 Rev A Command Reference for IE210L Series 621

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE ERRDISABLE-TIMEOUT INTERVAL

spanning-tree errdisable-timeout interval

Overview Use this command to specify the time interval after which a port is brought back

up when it has been disabled by the BPDU guard feature.

Use this command for RSTP or MSTP.

Syntax spanning-tree errdisable-timeout interval <10-1000000>

no spanning-tree errdisable-timeout interval

Default By default, the port is re-enabled after 300 seconds.

Mode Global Configuration

Example awplus# configure terminal

awplus(config)# spanning-tree errdisable-timeout interval 34

Commands

show spanning-tree

spanning-tree errdisable-timeout enable

spanning-tree portfast bpdu-guard

Parameter Description

<10-1000000> Specify the errdisable-timeout interval in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 622

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE FORCE-VERSION

spanning-tree force-version

Overview Use this command in Interface Configuration mode for a switch port interface only

to force the protocol version for the switch port. Use this command for RSTP or

MSTP only.

Syntax spanning-tree force-version <version>

no spanning-tree force-version

Default By default, no version is forced for the port. The port is in the spanning tree mode

configured for the device, or a lower version if it automatically detects one.

Mode Interface Configuration mode for a switch port interface only.

Examples Set the value to enforce the spanning tree protocol (STP):

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree force-version 0

Set the default protocol version:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no spanning-tree force-version

Commands

show spanning-tree

Parameter Description

<version> <0-3> Version identifier.

0Forces the port to operate in STP mode.

1Not supported.

2Forces the port to operate in RSTP mode. If it receives STP

BPDUs, it can automatically revert to STP mode.

3Forces the port to operate in MSTP mode (this option is only

available if MSTP mode is configured). If it receives RSTP or

STP BPDUs, it can automatically revert to RSTP or STP mode.

C613-50292-01 Rev A Command Reference for IE210L Series 623

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE FORWARD-TIME

spanning-tree forward-time

Overview Use this command to set the forward delay value. Use the no variant of this

command to reset the forward delay value to the default setting of 15 seconds.

The forward delay sets the time (in seconds) to control how fast a port changes its

spanning tree state when moving towards the forwarding state. If the mode is set

to STP, the value determines how long the port stays in each of the listening and

learning states which precede the forwarding state. If the mode is set to RSTP or

MSTP, this value determines the maximum time taken to transition from

discarding to learning and from learning to forwarding.

This value is used only when the device is acting as the root bridge. Devices not

acting as the Root Bridge use a dynamic value for the forward delay set by the root

bridge. The forward delay, max-age, and hello time parameters are interrelated.

Syntax spanning-tree forward-time <forward-delay>

no spanning-tree forward-time

Default The default is 15 seconds.

Mode Global Configuration

Usage The allowable range for forward-time is 4-30 seconds.

The forward delay, max-age, and hello time parameters should be set according

to the following formula, as specified in IEEE Standard 802.1d:

2 x (forward delay - 1.0 seconds) >= max-age

max-age >= 2 x (hello time + 1.0 seconds)

Example awplus# configure terminal

awplus(config)# spanning-tree forward-time 6

Commands

show spanning-tree

spanning-tree forward-time

spanning-tree hello-time

spanning-tree mode

Parameter Description

<forward-delay> <4-30> The forwarding time delay in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 624

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE GUARD ROOT

spanning-tree guard root

Overview Use this command in Interface Configuration mode for a switch port only to enable

the Root Guard feature for the switch port. The root guard feature disables

reception of superior BPDUs. You can use this command for RSTP, STP or MSTP.

Use the no variant of this command to disable the root guard feature for the port.

Syntax spanning-tree guard root

no spanning-tree guard root

Mode Interface Configuration mode for a switch port interface only.

Usage The Root Guard feature makes sure that the port on which it is enabled is a

designated port. If the Root Guard enabled port receives a superior BPDU, it goes

to a Listening state (for STP) or discarding state (for RSTP and MSTP).

Example awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree guard root

C613-50292-01 Rev A Command Reference for IE210L Series 625

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE HELLO-TIME

spanning-tree hello-time

Overview Use this command to set the hello-time. This sets the time in seconds between the

transmission of device spanning tree configuration information when the device is

the Root Bridge of the spanning tree or is trying to become the Root Bridge.

Use this command for RSTP, STP or MSTP.

Use the no variant of this command to restore the default of the hello time.

Syntax spanning-tree hello-time <hello-time>

no spanning-tree hello-time

Default Default is 2 seconds.

Mode Global Configuration and Interface Configuration for switch ports.

Usage The allowable range of values is 1-10 seconds.

The forward delay, max-age, and hello time parameters should be set according to

the following formula, as specified in IEEE Standard 802.1d:

2 x (forward delay - 1.0 seconds) >= max-age

max-age>= 2 x (hello time + 1.0 seconds)

Example awplus# configure terminal

awplus(config)# spanning-tree hello-time 3

Commands

spanning-tree forward-time

spanning-tree max-age

show spanning-tree

Parameter Description

<hello-time><1-10> The hello BPDU interval in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 626

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE LINK-TYPE

spanning-tree link-type

Overview Use this command in Interface Configuration mode for a switch port interface only

to enable or disable point-to-point or shared link types on the switch port.

Use this command for RSTP or MSTP only.

Use the no variant of this command to return the port to the default link type.

Syntax spanning-tree link-type {point-to-point|shared}

no spanning-tree link-type

Default The default link type is point-to-point.

Mode Interface Configuration mode for a switch port interface only.

Usage You may want to set link type to shared if the port is connected to a hub with

multiple devices connected to it.

Examples awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree link-type point-to-point

Parameter Description

shared Disable rapid transition.

point-to-point Enable rapid transition.

C613-50292-01 Rev A Command Reference for IE210L Series 627

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MAX-AGE

spanning-tree max-age

Overview Use this command to set the max-age. This sets the maximum age, in seconds, that

dynamic spanning tree configuration information is stored in the device before it

is discarded.

Use this command for RSTP, STP or MSTP.

Use the no variant of this command to restore the default of max-age.

Syntax spanning-tree max-age <max-age>

no spanning-tree max-age

Default The default of spanning-tree max-age is 20 seconds.

Mode Global Configuration

Usage Max-age is the maximum time in seconds for which a message is considered valid.

Configure this value sufficiently high, so that a frame generated by the root bridge

can be propagated to the leaf nodes without exceeding the max-age.

The forward delay, max-age, and hello time parameters should be set according

to the following formula, as specified in IEEE Standard 802.1d:

2 x (forward delay - 1.0 seconds) >= max-age

max-age >= 2 x (hello time + 1.0 seconds)

Example awplus# configure terminal

awplus(config)# spanning-tree max-age 12

Commands

show spanning-tree

spanning-tree forward-time

spanning-tree hello-time

Parameter Description

<max-age><6-40> The maximum time, in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 628

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MAX-HOPS (MSTP)

spanning-tree max-hops (MSTP)

Overview Use this command to specify the maximum allowed hops for a BPDU in an MST

region. This parameter is used by all the instances of the MST region.

Use the no variant of this command to restore the default.

Use this command for MSTP only.

Syntax spanning-tree max-hops <hop-count>

no spanning-tree max-hops <hop-count>

Default The default max-hops in a MST region is 20.

Mode Global Configuration

Usage Specifying the max hops for a BPDU prevents the messages from looping

indefinitely in the network. The hop count is decremented by each receiving port.

When a device receives an MST BPDU that has a hop count of zero, it discards the

BPDU.

Examples awplus# configure terminal

awplus(config)# spanning-tree max-hops 25

awplus# configure terminal

awplus(config)# no spanning-tree max-hops

Parameter Description

<hop-count> Specify the maximum hops the BPDU will be valid for in the range

<1-40>.

C613-50292-01 Rev A Command Reference for IE210L Series 629

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MODE

spanning-tree mode

Overview Use this command to change the spanning tree protocol mode on the device. The

spanning tree protocol mode on the device can be configured to either STP, RSTP

or MSTP.

Syntax spanning-tree mode {stp|rstp|mstp}

Default The default spanning tree protocol mode on the device is RSTP.

Mode Global Configuration

Usage With no configuration, the device will have spanning tree enabled, and the

spanning tree mode will be set to RSTP. Use this command to change the spanning

tree protocol mode on the device. MSTP is VLAN aware, but RSTP and STP are not

VLAN aware. To enable or disable spanning tree operation, see the spanning-tree

enable command.

Examples To change the spanning tree mode from the default of RSTP to MSTP, use the

following commands:

awplus# configure terminal

awplus(config)# spanning-tree mode mstp

Commands

spanning-tree enable

C613-50292-01 Rev A Command Reference for IE210L Series 630

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MST CONFIGURATION

spanning-tree mst configuration

Overview Use this command to enter the MST Configuration mode to configure the Multiple

Spanning-Tree Protocol.

Syntax spanning-tree mst configuration

Mode Global Configuration

Examples The following example uses this command to enter MST Configuration mode. Note

the change in the command prompt.

awplus# configure terminal

awplus(config)# spanning-tree mst configuration

awplus(config-mst)#

C613-50292-01 Rev A Command Reference for IE210L Series 631

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MST INSTANCE

spanning-tree mst instance

Overview Use this command to assign a Multiple Spanning Tree instance (MSTI) to a switch

port or channel group.

Note that ports are automatically configured to send and receive spanning-tree

information for the associated MSTI when VLANs are assigned to MSTIs using the

instance vlan (MSTP) command.

Use the no variant of this command in Interface Configuration mode to remove the

MSTI from the specified switch port or channel group.

Syntax spanning-tree mst instance <instance-id>

no spanning-tree mst instance <instance-id>

Default A port automatically becomes a member of an MSTI when it is assigned to a VLAN.

Mode Interface Configuration mode for a switch port or channel group.

Usage You can disable automatic configuration of member ports of a VLAN to an

associated MSTI by using a no spanning-tree mst instance command to remove

the member port from the MSTI. Use the spanning-tree mst instance command

to add a VLAN member port back to the MSTI.

Examples To assign instance 3 to a switch port, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree mst instance 3

To remove instance 3 from a switch port, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no spanning-tree mst instance 3

Commands

instance vlan (MSTP)

spanning-tree mst instance path-cost

spanning-tree mst instance priority

spanning-tree mst instance restricted-role

spanning-tree mst instance restricted-tcn

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15. The MST instance must

have already been created using the instance vlan (MSTP)

command.

C613-50292-01 Rev A Command Reference for IE210L Series 632

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MST INSTANCE PATH-COST

spanning-tree mst instance path-cost

Overview Use this command to set the cost of a path associated with a switch port, for the

specified MSTI.

This specifies the switch port’s contribution to the cost of a path to the MSTI

regional root via that port. This applies when the port is the root port for the MSTI.

Use the no variant of this command to restore the default cost value of the path.

Syntax spanning-tree mst instance <instance-id> path-cost <path-cost>

no spanning-tree mst instance <instance-id> path-cost

Default The default path cost values and the range of recommended path cost values

depend on the port speed, as shown in the following table from the IEEE

802.1q-2003 standard.

Mode Interface Configuration mode for a switch port interface only.

Usage Before you can use this command to set a path-cost in a VLAN configuration, you

must explicitly add an MST instance to a port using the spanning-tree mst instance

command.

Examples To set a path cost of 1000 on instance 3, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree mst instance 3 path-cost 1000

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15.

<path-cost> Specify the cost of path in the range of <1-200000000>, where

a lower path-cost indicates a greater likelihood of the specific

interface becoming a root.

Port speed Default path cost Recommended path cost range

Less than 100 Kb/s

1Mbps

10Mbps

100 Mbps

1 Gbps

10 Gbps

100 Gbps

1Tbps

10 Tbps

200,000,000

20,000,000

2,000,000

200,000

20,000

2,000

200

20,000,000-200,000,000

2,000,000-20,000,000

200,000-2,000,000

20,000-200,000

2,000-20,000

200-2,000

20-200

2-200

2-20

C613-50292-01 Rev A Command Reference for IE210L Series 633

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MST INSTANCE PATH-COST

To return the path cost to its default value on instance 3, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no spanning-tree mst instance 3 path-cost

Commands

instance vlan (MSTP)

spanning-tree mst instance

spanning-tree mst instance priority

spanning-tree mst instance restricted-role

spanning-tree mst instance restricted-tcn

C613-50292-01 Rev A Command Reference for IE210L Series 634

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MST INSTANCE PRIORITY

spanning-tree mst instance priority

Overview Use this command in Interface Configuration mode for a switch port interface only

to set the port priority for an MST instance (MSTI).

Use the no variant of this command to restore the default priority value (128).

Syntax spanning-tree mst instance <instance-id> priority <priority>

no spanning-tree mst instance <instance-id> [priority]

Default The default is 128.

Mode Interface Configuration mode for a switch port interface.

Usage This command sets the value of the priority field contained in the port identifier.

The MST algorithm uses the port priority when determining the root port for the

switch in the MSTI. The port with the lowest value has the highest priority, so it will

be chosen as root port over a port that is equivalent in all other aspects but with a

higher priority value.

Examples To set the priority to 112 on instance 3, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree mst instance 3 priority 112

To return the priority to its default value of 128 on instance 3, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no spanning-tree mst instance 3 priority

Commands

instance vlan (MSTP)

spanning-tree priority (port priority)

spanning-tree mst instance

spanning-tree mst instance path-cost

spanning-tree mst instance restricted-role

spanning-tree mst instance restricted-tcn

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15.

<priority>This must be a multiple of 16 and within the range <0-240>. A

lower priority indicates greater likelihood of the port becoming

the root port.

C613-50292-01 Rev A Command Reference for IE210L Series 635

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MST INSTANCE RESTRICTED-ROLE

spanning-tree mst instance restricted-role

Overview Use this command in Interface Configuration mode for a switch port interface only

to enable the restricted role for an MSTI (Multiple Spanning Tree Instance) on a

switch port. Configuring the restricted role for an MSTI on a switch port prevents

the switch port from becoming the root port in a spanning tree topology.

Use the no variant of this command to disable the restricted role for an MSTI on a

switch port. Removing the restricted role for an MSTI on a switch port allows the

switch port to become the root port in a spanning tree topology.

Syntax spanning-tree mst instance <instance-id> restricted-role

no spanning-tree mst instance <instance-id> restricted-role

Default The restricted role for an MSTI instance on a switch port is disabled by default.

Mode Interface Configuration mode for a switch port interface only.

Usage The root port is the port providing the best path from the bridge to the root bridge.

Use this command to disable a port from becoming a root port. Use the no variant

of this command to enable a port to become a root port. See the STP Feature

Overview and Configuration Guide for root port information.

Examples To prevent a switch port from becoming the root port, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree mst instance 3 restricted-role

To stop preventing the switch port from becoming the root port, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no spanning-tree mst instance 3

restricted-role

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15. The MST instance must

have already been created using the instance vlan (MSTP)

command.

C613-50292-01 Rev A Command Reference for IE210L Series 636

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MST INSTANCE RESTRICTED-ROLE

Commands

instance vlan (MSTP)

spanning-tree priority (port priority)

spanning-tree mst instance

spanning-tree mst instance path-cost

spanning-tree mst instance restricted-tcn

C613-50292-01 Rev A Command Reference for IE210L Series 637

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE MST INSTANCE RESTRICTED-TCN

spanning-tree mst instance restricted-tcn

Overview Use this command to prevent a switch port from propagating received topology

change notifications and topology changes to other switch ports. This is named

restricted TCN (Topology Change Notification). A TCN is a simple Bridge Protocol

Data Unit (BPDU) that a bridge sends out to its root port to signal a topology

change.

Use the no variant of this command to stop preventing the switch port from

propagating received topology change notifications and topology changes to

other switch ports for the specified MSTI (Multiple Spanning Tree Instance).

The restricted TCN setting applies only to the specified MSTI (Multiple Spanning

Tree Instance).

Syntax spanning-tree mst instance <instance-id> restricted-tcn

no spanning-tree mst instance <instance-id> restricted-tcn

Default Disabled. By default, switch ports propagate TCNs.

Mode Interface Configuration mode for a switch port interface only.

Examples To prevent a switch port from propagating received topology change notifications

and topology changes to other switch ports, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree mst instance 3 restricted-tcn

To stop preventing a switch port from propagating received topology change

notifications and topology changes to other switch ports, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no spanning-tree mst instance 3

restricted-tcn

Commands

instance vlan (MSTP)

spanning-tree priority (port priority)

spanning-tree mst instance

spanning-tree mst instance path-cost

spanning-tree mst instance restricted-role

Parameter Description

<instance-id>Specify an MSTP instance in the range 1-15. The MST instance must

have already been created using the instance vlan (MSTP)

command.

C613-50292-01 Rev A Command Reference for IE210L Series 638

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE PATH-COST

spanning-tree path-cost

Overview Use this command in Interface Configuration mode for a switch port interface only

to set the cost of a path for the specified port. This value then combines with others

along the path to the root bridge in order to determine the total cost path value

from the particular port, to the root bridge. The lower the numeric value, the

higher the priority of the path. This applies when the port is the root port.

Use this command for RSTP, STP or MSTP. When MSTP mode is configured, this will

apply to the port’s path cost for the CIST.

Syntax spanning-tree path-cost <pathcost>

no spanning-tree path-cost

Default The default path cost values and the range of recommended path cost values

depend on the port speed, as shown in the following table from the IEEE

802.1q-2003 and IEEE 802.1d-2004 standards.

Mode Interface Configuration mode for switch port interface only.

Example awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree path-cost 123

Parameter Description

<pathcost><1-200000000> The cost to be assigned to the port.

Port speed Default path cost Recommended path cost range

Less than 100 Kb/s

1Mbps

10Mbps

100 Mbps

1 Gbps

10 Gbps

100 Gbps

1Tbps

10 Tbps

200,000,000

20,000,000

2,000,000

200,000

20,000

2,000

200

20,000,000-200,000,000

2,000,000-20,000,000

200,000-2,000,000

20,000-200,000

2,000-20,000

200-2, 000

20-200

2-200

2-20

C613-50292-01 Rev A Command Reference for IE210L Series 639

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE PORTFAST (STP)

spanning-tree portfast (STP)

Overview Use this command in Interface Configuration mode for a switch port interface only

to set a port as an edge-port. The portfast feature enables a port to rapidly move

to the forwarding state, without having first to pass through the intermediate

spanning tree states. This command has the same effect as the spanning-tree

edgeport (RSTP and MSTP) command, but the configuration displays differently in

the output of some show commands.

NOTE: You can run either of two additional parameters with this command. To simplify

the syntax these are documented as separate commands. See the following additional

portfast commands:

•spanning-tree portfast bpdu-filter command

•spanning-tree portfast bpdu-guard command.

You can obtain the same effect by running the spanning-tree edgeport (RSTP and

MSTP) command. However, the configuration output may display differently in

some show commands.

Use the no variant of this command to set a port to its default state (not an

edge-port).

Syntax spanning-tree portfast

no spanning-tree portfast

Default Not an edge port.

Mode Interface Configuration mode for a switch port interface only.

Usage Portfast makes a port move from a blocking state to a forwarding state, bypassing

both listening and learning states. The portfast feature is meant to be used for

ports connected to end-user devices. Enabling portfast on ports that are

connected to a workstation or server allows devices to connect to the network

without waiting for spanning-tree to converge.

For example, you may need hosts to receive a DHCP address quickly and waiting

for STP to converge would cause the DHCP request to time out. Ensure you do not

use portfast on any ports connected to another device to avoid creating a

spanning-tree loop on the network.

Use this command on a switch port that connects to a LAN with no other bridges

attached. An edge port should never receive BPDUs. Therefore if an edge port

receives a BPDU, the portfast feature takes one of three actions.

• Cease to act as an edge port and pass BPDUs as a member of a spanning tree

network (spanning-tree portfast (STP) command disabled).

• Filter out the BPDUs and pass only the data and continue to act as a edge

port (spanning-tree portfast bpdu-filter command enabled).

• Block the port to all BPDUs and data (spanning-tree portfast bpdu-guard

command enabled).

C613-50292-01 Rev A Command Reference for IE210L Series 640

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE PORTFAST (STP)

Example awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree portfast

Commands

spanning-tree edgeport (RSTP and MSTP)

show spanning-tree

spanning-tree portfast bpdu-filter

spanning-tree portfast bpdu-guard

C613-50292-01 Rev A Command Reference for IE210L Series 641

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE PORTFAST BPDU-FILTER

spanning-tree portfast bpdu-filter

Overview This command sets the bpdu-filter feature and applies a filter to any BPDUs (Bridge

Protocol Data Units) received. Enabling this feature ensures that configured ports

will not transmit any BPDUs and will ignore (filter out) any BPDUs received. BPDU

Filter is not enabled on a port by default.

Using the no variant of this command to turn off the bpdu-filter, but retain the

port’s status as an enabled port. If the port then receives a BPDU it will change its

role from an edge-port to a non edge-port.

Syntax (Global

Configuration) spanning-tree portfast bpdu-filter

no spanning-tree portfast bpdu-filter

Syntax (Interface

Configuration) spanning-tree portfast bpdu-filter

{default|disable|enable}

no spanning-tree portfast bpdu-filter

Default BPDU Filter is not enabled on any ports by default.

Mode Global Configuration and Interface Configuration

Usage This command filters the BPDUs and passes only data to continue to act as an edge

port. Using this command in Global Configuration mode applies the portfast

bpdu-filter feature to all ports on the device. Using it in Interface mode applies the

feature to a specific port, or range of ports.The command will operate in both RSTP

and MSTP networks.

Use the show spanning-tree command to display status of the bpdu-filter

parameter for the switch ports.

Example To enable STP BPDU filtering in Global Configuration mode, enter the commands:

awplus# configure terminal

awplus(config)# spanning-tree portfast bpdu-filter

Parameter Description

bpdu-filter A port that has bpdu-filter enabled will not transmit any BPDUs and

will ignore any BPDUs received. This port type has one of the

following parameters (in Interface Configuration mode):

default Takes the setting that has been configured for the whole

device, i.e. the setting made from the Global

configuration mode.

disable Turns off BPDU filter.

enable Turns on BPDU filter.

C613-50292-01 Rev A Command Reference for IE210L Series 642

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE PORTFAST BPDU-FILTER

To enable STP BPDU filtering in Interface Configuration mode, enter the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree portfast bpdu-filter enable

Commands

spanning-tree edgeport (RSTP and MSTP)

show spanning-tree

spanning-tree portfast (STP)

spanning-tree portfast bpdu-guard

C613-50292-01 Rev A Command Reference for IE210L Series 643

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE PORTFAST BPDU-GUARD

spanning-tree portfast bpdu-guard

Overview This command applies a BPDU (Bridge Protocol Data Unit) guard to the port. A port

with the bpdu-guard feature enabled will block all traffic (BPDUs and user data), if

it starts receiving BPDUs.

Use this command in Global Configuration mode to apply BPDU guard to all ports

on the device. Use this command in Interface mode for an individual interface or a

range of interfaces specified. BPDU Guard is not enabled on a port by default.

Use the no variant of this command to disable the BPDU Guard feature on a device

in Global Configuration mode or to disable the BPDU Guard feature on a port in

Interface mode.

Syntax (Global

Configuration) spanning-tree portfast bpdu-guard

no spanning-tree portfast bpdu-guard

Syntax (Interface

Configuration) spanning-tree portfast bpdu-guard

{default|disable|enable}

no spanning-tree portfast bpdu-guard

Default BPDU Guard is not enabled on any ports by default.

Mode Global Configuration or Interface Configuration

Usage This command blocks the port(s) to all devices and data when enabled. BPDU

Guard is a port-security feature that changes how a portfast-enabled port behaves

if it receives a BPDU. When bpdu-guard is set, then the port shuts down if it

receives a BPDU. It does not process the BPDU as it is considered suspicious. When

bpdu-guard is not set, then the port will negotiate spanning-tree with the device

sending the BPDUs. By default, bpdu- guard is not enabled on a port.

You can configure a port disabled by the bpdu-guard to re-enable itself after a

specific time interval. This interval is set with the spanning-tree errdisable-timeout

interval command. If you do not use the errdisable-timeout feature, then you will

need to manually re-enable the port by using the no shutdown command.

Parameter Description

bpdu-guard A port that has bpdu-guard turned on will enter the STP blocking state

if it receives a BPDU. This port type has one of the following

parameters (in Interface Configuration mode):

default Takes the setting that has been configured for the whole

device, i.e. the setting made from the Global configuration

mode.

disable Turns off BPDU guard.

enable Turns on BPDU guard and will also set the port as an edge

port.

C613-50292-01 Rev A Command Reference for IE210L Series 644

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE PORTFAST BPDU-GUARD

Use the show spanning-tree command to display the device and port

configurations for the BPDU Guard feature. It shows both the administratively

configured and currently running values of bpdu-guard.

Example To enable STP BPDU guard in Global Configuration mode, enter the below

commands:

awplus# configure terminal

awplus(config)# spanning-tree portfast bpdu-guard

To enable STP BPDU guard in Interface Configuration mode, enter the below

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree portfast bpdu-guard enable

Commands

spanning-tree edgeport (RSTP and MSTP)

show spanning-tree

spanning-tree portfast (STP)

spanning-tree portfast bpdu-filter

C613-50292-01 Rev A Command Reference for IE210L Series 645

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE PRIORITY (BRIDGE PRIORITY)

spanning-tree priority (bridge priority)

Overview Use this command to set the bridge priority for the device. A lower priority value

indicates a greater likelihood of the device becoming the root bridge.

Use this command for RSTP, STP or MSTP. When MSTP mode is configured, this will

apply to the CIST.

Use the no variant of this command to reset it to the default.

Syntax spanning-tree priority <priority>

no spanning-tree priority

Default The default priority is 32678.

Mode Global Configuration

Usage To force a particular device to become the root bridge use a lower value than other

devices in the spanning tree.

Example awplus# configure terminal

awplus(config)# spanning-tree priority 4096

Commands

spanning-tree mst instance priority

show spanning-tree

Parameter Description

<priority><0-61440> The bridge priority, which will be rounded to a multiple of

4096.

C613-50292-01 Rev A Command Reference for IE210L Series 646

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE PRIORITY (PORT PRIORITY)

spanning-tree priority (port priority)

Overview Use this command in Interface Configuration mode for a switch port interface only

to set the port priority for port. A lower priority value indicates a greater likelihood

of the port becoming part of the active topology.

Use this command for RSTP, STP, or MSTP. When the device is in MSTP mode, this

will apply to the CIST.

Use the no variant of this command to reset it to the default.

Syntax spanning-tree priority <priority>

no spanning-tree priority

Default The default priority is 128.

Mode Interface Configuration mode for a switch port interface only.

Usage To force a port to be part of the active topology (for instance, become the root port

or a designated port) use a lower value than other ports on the device. (This

behavior is subject to network topology, and more significant factors, such as

bridge ID.)

Example awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree priority 16

Commands

spanning-tree mst instance priority

spanning-tree priority (bridge priority)

show spanning-tree

Parameter Description

<priority><0-240>, in increments of 16. The port priority, which will be rounded

down to a multiple of 16.

C613-50292-01 Rev A Command Reference for IE210L Series 647

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE RESTRICTED-ROLE

spanning-tree restricted-role

Overview Use this command in Interface Configuration mode for a switch port interface only

to restrict the port from becoming a root port.

Use the no variant of this command to disable the restricted role functionality.

Syntax spanning-tree restricted-role

no spanning-tree restricted-role

Default The restricted role is disabled.

Mode Interface Configuration mode for a switch port interface only.

Example awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree restricted-role

C613-50292-01 Rev A Command Reference for IE210L Series 648

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE RESTRICTED-TCN

spanning-tree restricted-tcn

Overview Use this command in Interface Configuration mode for a switch port interface only

to prevent TCN (Topology Change Notification) BPDUs (Bridge Protocol Data

Units) from being sent on a port. If this command is enabled, after a topology

change a bridge is prevented from sending a TCN to its designated bridge.

Use the no variant of this command to disable the restricted TCN functionality.

Syntax spanning-tree restricted-tcn

no spanning-tree restricted-tcn

Default The restricted TCN is disabled.

Mode Interface Configuration mode for a switch port interface only.

Example awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# spanning-tree restricted-tcn

C613-50292-01 Rev A Command Reference for IE210L Series 649

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

SPANNING-TREE TRANSMIT-HOLDCOUNT

spanning-tree transmit-holdcount

Overview Use this command to set the maximum number of BPDU transmissions that are

held back.

Use the no variant of this command to restore the default transmit hold-count

value.

Syntax spanning-tree transmit-holdcount

no spanning-tree transmit-holdcount

Default Transmit hold-count default is 3.

Mode Global Configuration

Example awplus# configure terminal

awplus(config)# spanning-tree transmit-holdcount

C613-50292-01 Rev A Command Reference for IE210L Series 650

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

SPANNING TREE COMMANDS

UNDEBUG MSTP

undebug mstp

Overview This command applies the functionality of the no debug mstp (RSTP and STP)

command.

C613-50292-01 Rev A Command Reference for IE210L Series 651

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Unidirectional Link

Detection (UDLD)

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

the Unidirectional Link Detection (UDLD) protocol.

UDLD is a data link protocol which monitors network cables and detects broken

bidirectional links. It complements the spanning tree protocol (STP), which is used

to eliminate Layer 2 loops.

A license is required to use this feature. Please contact your authorized Allied

Telesis representative for more information.

Command List •“debug udld” on page 652

•“show debugging udld” on page 653

•“show udld” on page 654

•“show udld neighbors” on page 655

•“show udld port” on page 656

•“udld aggressive-mode” on page 657

•“udld enable” on page 658

•“udld port” on page 659

•“udld port aggressive-mode” on page 660

•“udld port disable” on page 661

•“udld reset” on page 662

•“udld time disable-period” on page 663

•“udld time message-interval” on page 664

•“undebug udld” on page 665

C613-50292-01 Rev A Command Reference for IE210L Series 652

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

DEBUG UDLD

debug udld

Overview Use this command to enable UDLD debugging.

Use the no variant of this command to disable UDLD debugging.

Syntax debug udld [info|pkt|state|nsm|all]

no debug udld [info|pkt|state|nsm|all]

Default Debugging is disabled for all by default.

Mode Global Configuration

Privileged Exec

Example To enable UDLD packet debugging, use the commands:

awplus# configure terminal

awplus(config)# debug udld pkt

Commands

show debugging udld

undebug udld

Parameter Description

info Enable or disable general UDLD debugging information.

pkt Enable or disable debugging of UDLD packets.

state Enable or disable UDLD state transition debugging.

nsm Enable or disable UDLD Network Service Module (NSM)

debugging information.

all Enable or disable the all UDLD debugging.

C613-50292-01 Rev A Command Reference for IE210L Series 653

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

SHOW DEBUGGING UDLD

show debugging udld

Overview Use this command to show which UDLD debugging options are set.

Syntax show debugging udld

Mode Privileged Exec

Example To show which UDLD debugging options are set, use the command:

awplus# show debugging udld

Output Figure 18-1: Example output from show debugging udld

Commands

debug udld

awplus# show debugging udld

UDLD debugging status:

Info debugging : off

Packet debugging: off

State debugging : on

NSM debugging : off

C613-50292-01 Rev A Command Reference for IE210L Series 654

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

SHOW UDLD

show udld

Overview Use this command to display global UDLD status and configuration settings.

Syntax show udld

Mode Privileged Exec

Example To show global UDLD information, use the command:

awplus# show udld

Output Figure 18-2: Example output from show udld

Commands

udld port

udld port disable

udld enable

awplus#show udld

Status : Enabled

Mode : Normal

Message-Interval: 7 seconds

Timeout-Interval: 5 seconds

Disable-Period : 15 seconds



[Fiber-Ports]

Port Status Mode Directional-State

------------ -------- ---------- -----------------

port1.0.1 Enabled Aggressive Bidirectional

port1.0.2 Disabled Normal -

C613-50292-01 Rev A Command Reference for IE210L Series 655

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

SHOW UDLD NEIGHBORS

show udld neighbors

Overview Use this command to display UDLD neighbor status.

Syntax show udld neighbors [<interface-name>] [detail]

Mode Privileged Exec

Example To show UDLD information for all neighbors, use the command:

awplus# show udld neighbors

To show detailed UDLD neighbor information for port1.0.1, use the command:

awplus# show udld neighbours port1.0.1 detail

Output Figure 18-3: Example output from show udld neighbors

Figure 18-4: Example output from show udld neighbor port1.0.1 detail

Commands

udld port

udld port disable

udld enable

Parameter Description

<interface-name>Show UDLD neighbor information for a specified interface.

detail This option provides a greater level of detail.

awplus#show udld neighbors

Port Device-ID Port-ID Device-Name Neighbor-State

----------- ------------ ------------ ------------- --------------

port1.0.1 0000F4272DA2 port2.0.1 X930 Bidirectional

port1.0.2 0000F5572632 port1.0.15 X610 Bidirectional

awplus# show udld neighbor port1.0.1 detail

[port1.0.1]

Device-ID : 0000F4272DA2

Port-ID : port2.0.1

Device-Name : X930

Operational-State: Bidirectional

Expiration-time : 35 seconds

Message-Interval : 15 seconds

Timeout-Interval : 5 seconds



Neighbors in Echo:

Device-ID Port-ID 

------------ ------------ 

0000F4272DA2 port2.0.1 

0000F5572632 port1.0.15

C613-50292-01 Rev A Command Reference for IE210L Series 656

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

SHOW UDLD PORT

show udld port

Overview Use this command to display UDLD port status and configuration settings.

Syntax show udld port [<interface-name>] [detail]

Mode Privileged Exec

Example To show UDLD information for all ports, use the command:

awplus# show udld port

To show detailed UDLD information for port1.0.1, use the command:

awplus# show udld port port1.0.1 detail

Output Figure 18-5: Example output from show udld port

Figure 18-6: Example output from show udld port port1.0.1 detail

Commands

udld port

udld port disable

udld enable

Parameter Description

<interface-name>Show UDLD information for a specified interface.

detail This option provides a greater level of detail.

awplus#show udld port

Port Status Mode Directional-State

------------ -------- ---------- -----------------

port1.0.1 Enabled Aggressive Bidirectional

port1.0.2 Disabled Normal -

awplus#show udld port port1.0.1 detail

[port1.0.1]

Status : Enabled

Mode : Aggressive

Directional-State: Bidirectional

Operational-State: Advertisement - single neighbor detected



Neighbors:

Device-ID Port-ID Device-Name Directional-State

------------ ------------ ---------------- -----------------

0000F4272DA2 port2.0.1 awplus Bidirectional

C613-50292-01 Rev A Command Reference for IE210L Series 657

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

UDLD AGGRESSIVE-MODE

udld aggressive-mode

Overview Use this command to set UDLD to aggressive mode on all interfaces.

In normal mode, when the UDLD information times out:

• No action is taken by UDLD.

• The UDLD port state is set to undetermined.

• The port behaves according to its STP state.

In aggressive mode, when the UDLD information times out:

• UDLD tries to re-establish the state of the port.

• If not successful, after 8 retries, the port is disabled.

Use the no variant of this command to disable aggressive mode on all interfaces.

Syntax udld aggressive-mode

no udld aggressive-mode

Default Aggressive mode is disabled by default.

Mode Global Configuration

Example To enable aggressive mode on interfaces, use the commands:

awplus# configure terminal

awplus(config)# udld aggressive-mode

To disable aggressive mode, use the commands:

awplus# configure terminal

awplus(config)# no udld aggressive-mode

Commands

udld port aggressive-mode

show udld

C613-50292-01 Rev A Command Reference for IE210L Series 658

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

UDLD ENABLE

udld enable

Overview Use this command to enable UDLD on all of a device’s fiber-optic ports. It has no

effect on copper ports. Use the udld port command to enable UDLD on copper

ports.

Use the no variant of this command to disable the UDLD feature on all of a device’s

fiber interfaces.

Syntax udld enable

no udld enable

Default UDLD is disabled by default.

Mode Global Configuration

Example To enable the UDLD feature on all fiber interfaces, use the command:

awplus# configure terminal

awplus(config)# udld enable

Commands

show udld

show udld neighbors

udld aggressive-mode

udld port

udld port disable

udld reset

udld time disable-period

udld time message-interval

C613-50292-01 Rev A Command Reference for IE210L Series 659

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

UDLD PORT

udld port

Overview Use this command to enable UDLD on an interface.This command enables UDLD

on both copper and fiber ports.

Use the no variant of this command to disable UDLD on an interface.

Syntax udld port

no udld port

Default UDLD is disabled on an interface by default.

Mode Interface Configuration

Usage • This command always enables the UDLD feature on a port.

•The udld port disable command overwrites this command and disables

UDLD on an interface.

• If UDLD has been set globally, using the udld enable command, then

AlliedWare Plus ignores the no udld port command on a fiber interface.

Example To enable UDLD on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# udld port

To disable UDLD on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no udld port

Commands

show udld port

show udld neighbors

udld enable

udld port disable

udld reset

udld time disable-period

udld time message-interval

C613-50292-01 Rev A Command Reference for IE210L Series 660

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

UDLD PORT AGGRESSIVE-MODE

udld port aggressive-mode

Overview Use this command to enable UDLD aggressive mode on an interface.

In normal mode, when the UDLD information times out:

• No action is taken by UDLD.

• The UDLD port state is set to undetermined.

• The port behaves according to its STP state.

In aggressive mode, when the UDLD information times out:

• UDLD tries to re-establish the state of the port.

• If not successful, after 8 retries, the port is disabled.

Use the no variant of this command to disable aggressive mode on an interface.

Syntax udld port aggressive-mode

no udld port aggressive-mode

Default Aggressive mode is disabled on an interface by default.

Mode Interface Configuration

Example To change the UDLD mode to aggressive on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# udld port aggressive-mode

To disable aggressive mode on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no port aggressive-mode

Commands

udld aggressive-mode

show udld port

C613-50292-01 Rev A Command Reference for IE210L Series 661

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

UDLD PORT DISABLE

udld port disable

Overview Use this command to disable UDLD on an interface. This command disables UDLD

on both copper and fiber ports

Use the no variant of this command to allow UDLD on a fiber port.

Syntax udld port disable

no udld port disable

Default UDLD disable is not set by default.

Usage • This command always disables the UDLD feature on a port.

•The udld port command overwrites this command and enables UDLD on an

interface.

• If UDLD has been set globally, using the udld enable command, then

AlliedWare Plus ignores the no udld port command on a fiber interface.

Mode Interface Configuration

Example To disable UDLD on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# udld port disable

To enable UDLD on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no udld port disable

Commands

udld enable

udld port

show udld port

C613-50292-01 Rev A Command Reference for IE210L Series 662

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

UDLD RESET

udld reset

Overview Use this command to reset the status of any interface disabled by UDLD.

Syntax udld reset

Mode Global Configuration

Example To reset an interface that has been disabled by UDLD, use the commands:

awplus# configure terminal

awplus(config)# udld reset

Output Figure 18-7: Example output from udld reset, when 2 ports are disabled

Figure 18-8: Example output from udld reset, when no ports are disabled

Commands

show udld

udld enable

awplus#udld reset

2 ports disabled by udld reset

awplus#udld reset

No ports are disabled by udld reset

C613-50292-01 Rev A Command Reference for IE210L Series 663

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

UDLD TIME DISABLE-PERIOD

udld time disable-period

Overview Use this command to set the UDLD disable period on all interfaces. The disable

period is the time (in seconds) that a port is marked disabled before UDLD

attempts to recheck it.

Manually reset the UDLD status of a port using the udld reset command.

Use the no variant of this command to reset the disable period to infinite.

Syntax udld time disable-period <seconds>

no udld time disable-period

Default The default time disable period is infinite.

Mode Global Configuration

Example To change the UDLD disable period to 60 sec on all interfaces, use the commands:

awplus# configure terminal

awplus(config)# udld time disable-period 60

To reset the disable period to infinite, use the commands:

awplus# configure terminal

awplus(config)# no udld time disable-period

Commands

udld enable

udld port

show udld

Parameter Description

<seconds>30-86400 

Specify the disable period in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 664

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

UDLD TIME MESSAGE-INTERVAL

udld time message-interval

Overview Use this command to set the UDLD message send interval on all interfaces.

This is the time, in seconds, between UDLD probe messages.

Use the no variant of this command to reset the message send interval to 15

seconds.

Syntax udld time message-interval <seconds>

no udld time message-interval

Default The default message send interval is 15 seconds.

Mode Global Configuration

Example To change UDLD message sending interval to 30 sec on all interfaces, use the

commands:

awplus# configure terminal

awplus(config)# udld time message-interval 30

To reset the message sending interval to 15 seconds, use the commands:

awplus# configure terminal

awplus(config)# no udld time message-interval

Commands

udld enable

udld port

show udld

Parameter Description

<seconds>7-90

Specify the message send interval in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 665

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

UNIDIRECTIONAL LINK DETECTION (UDLD) COMMANDS

UNDEBUG UDLD

undebug udld

Overview This command applies the functionality of the no debug udld command.

C613-50292-01 Rev A Command Reference for IE210L Series 666

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Link Aggregation

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure a

static channel group (static aggregator) and dynamic channel group (LACP

channel group, etherchannel or LACP aggregator). Link aggregation is also

sometimes referred to as channeling.

NOTE: AlliedWare Plus™ supports IEEE 802.3ad link aggregation and uses the Link

Aggregation Control Protocol (LACP). LACP does not interoperate with devices that use

Port Aggregation Protocol (PAgP).

Link aggregation does not necessarily achieve exact load balancing across the links.

The load sharing algorithm is designed to ensure that any given data flow always goes

down the same link. It also aims to spread data flows across the links as evenly as

possible.

For example, for a 2 Gbps LAG that is a combination of two 1 Gbps ports, any one flow

of traffic can only ever reach a maximum throughput of 1 Gbps. However, the hashing

algorithm should spread the flows across the links so that when many flows are

operating, the full 2 Gbps can be utilized.

For information about load balancing see the platform load-balancing command.

For a description of static and dynamic link aggregation (LACP), and configuration

examples, see the Link Aggregation Feature Overview and Configuration Guide.

Command List •“channel-group” on page 668

•“clear lacp counters” on page 670

•“debug lacp” on page 671

•“lacp global-passive-mode enable” on page 672

•“lacp port-priority” on page 673

•“lacp system-priority” on page 674

•“lacp timeout” on page 675

•“platform load-balancing” on page 677

C613-50292-01 Rev A Command Reference for IE210L Series 667

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

•“show debugging lacp” on page 678

•“show diagnostic channel-group” on page 679

•“show etherchannel” on page 681

•“show etherchannel detail” on page 682

•“show etherchannel summary” on page 683

•“show lacp sys-id” on page 684

•“show lacp-counter” on page 685

•“show port etherchannel” on page 686

•“show static-channel-group” on page 687

•“static-channel-group” on page 688

•“undebug lacp” on page 690

C613-50292-01 Rev A Command Reference for IE210L Series 668

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

CHANNEL-GROUP

channel-group

Overview Use this command to create a dynamic channel group, or to add a port to an

existing dynamic channel group.

You can create up to 128 channel groups, in any combination of static and

dynamic (LACP) groups. This means you can create up to 128 dynamic channel

groups, if you have no static channel groups.

Use the no variant of this command to turn off link aggregation on the device port.

You will be returned to Global Configuration mode from Interface Configuration

mode.

Syntax channel-group <dynamic-channel-group-number> mode

{active|passive}

no channel-group

Mode Interface Configuration

Usage All the device ports in a channel-group must belong to the same VLANs, have the

same tagging status, and can only be operated on as a group. All device ports

within a channel group must have the same port speed and be in full duplex mode.

Once the LACP channel group has been created, it is treated as a device port. You

can specify it in other commands. If you are specifying it in:

• an LACP command, then use the channel-group number on its own. For

example, use the command show etherchannel 2 to show details about

channel group 2.

• a non-LACP command, then use po followed by the channel-group number.

For example, use the command show interface po2 to show details about

channel group 2's interface.

For more information about LACP, see the Link Aggregation Feature Overview and

Configuration Guide which is available on our website at alliedtelesis.com.

Parameter Description

<dynamic-channel-

group-number><1-248> Dynamic channel group number for an LACP link.

You can create up to 128 dynamic channel groups,

numbered in the range 1-248.

active Enables initiation of LACP negotiation on a port. The port

will transmit LACP dialogue messages whether or not it

receives them from the partner device.

passive Disables initiation of LACP negotiation on a port. The port

will only transmit LACP dialogue messages if the partner

device is transmitting them, i.e., the partner is in the active

mode.

C613-50292-01 Rev A Command Reference for IE210L Series 669

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

CHANNEL-GROUP

Examples To add device port1.0.2 to a newly created LACP channel group 2, in active mode,

use the commands below:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# channel-group 2 mode active

To remove device port1.0.2 from any created LACP channel groups, use the

command below:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no channel-group

To reference channel group 2 as an interface, use the following commands:

awplus# configure terminal

awplus(config)# interface po2

awplus(config-if)#

Commands

show etherchannel

show etherchannel detail

show etherchannel summary

show port etherchannel

Command

changes

Version 5.4.9-0.1: Ability added to create up to 128 groups as any combination of

static and dynamic channel groups. Also, numbering changed to 1-248.

C613-50292-01 Rev A Command Reference for IE210L Series 670

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

CLEAR LACP COUNTERS

clear lacp counters

Overview Use this command to clear all counters of all present LACP aggregators (channel

groups) or a given LACP aggregator.

Syntax clear lacp [<1-248>] counters

Mode Privileged Exec

Example awplus# clear lacp 2 counters

Parameter Description

<1-248>Channel-group number.

C613-50292-01 Rev A Command Reference for IE210L Series 671

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

DEBUG LACP

debug lacp

Overview Use this command to enable all LACP troubleshooting functions.

Use the no variant of this command to disable this function.

Syntax debug lacp {all|cli|event|ha|packet|sync|timer[detail]}

no debug lacp {all|cli|event|ha|packet|sync|timer[detail]}

Mode Privileged Exec and Global Configuration

Examples awplus# debug lacp timer detail

awplus# debug lacp all

Commands

show debugging lacp

undebug lacp

Parameter Description

all Turn on all debugging for LACP.

cli Specifies debugging for CLI messages.

Echoes commands to the console.

event Specifies debugging for LACP events.

Echoes events to the console.

ha Specifies debugging for HA (High Availability) events.

Echoes High Availability events to the console.

packet Specifies debugging for LACP packets.

Echoes packet contents to the console.

sync Specified debugging for LACP synchronization.

Echoes synchronization to the console.

timer Specifies debugging for LACP timer.

Echoes timer expiry to the console.

detail Optional parameter for LACP timer-detail.

Echoes timer start/stop details to the console.

C613-50292-01 Rev A Command Reference for IE210L Series 672

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

LACP GLOBAL-PASSIVE-MODE ENABLE

lacp global-passive-mode enable

Overview Use this command to enable LACP channel-groups to dynamically self-configure

when they are connected to another device that has LACP channel-groups

configured with Active Mode.

Syntax lacp global-passive-mode enable

no lacp global-passive-mode enable

Default Enabled

Mode Global Configuration

Usage Do not mix LACP configurations (manual and dynamic). When LACP global passive

mode is turned on (by using the lacp global-passive-mode enable command),

we do not recommend using a mixed configuration in a LACP channel-group; i.e.

some links are manually configured (by the channel-group command) and others

are dynamically learned in the same channel-group.

Example To enable global passive mode for LACP channel groups, use the command:

awplus(config)# lacp global-passive-mode enable

To disable global passive mode for LACP channel groups, use the command:

awplus(config)# no lacp global-passive-mode enable

Commands

show etherchannel

show etherchannel detail

C613-50292-01 Rev A Command Reference for IE210L Series 673

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

LACP PORT-PRIORITY

lacp port-priority

Overview Use this command to set the priority of a device port. Ports are selected for

aggregation based on their priority, with the higher priority (numerically lower)

ports selected first.

Use the no variant of this command to reset the priority of port to the default.

Syntax lacp port-priority <1-65535>

no lacp port-priority

Default The default is 32768.

Mode Interface Configuration

Example awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# lacp port-priority 34

Parameter Description

<1-65535> Specify the LACP port priority.

C613-50292-01 Rev A Command Reference for IE210L Series 674

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

LACP SYSTEM-PRIORITY

lacp system-priority

Overview Use this command to set the system priority of a local system. This is used in

determining the system responsible for resolving conflicts in the choice of

aggregation groups.

Use the no variant of this command to reset the system priority of the local system

to the default.

Syntax lacp system-priority <1-65535>

no lacp system-priority

Default The default is 32768.

Mode Global Configuration

Example awplus# configure terminal

awplus(config)# lacp system-priority 6700

Parameter Description

<1-65535> LACP system priority. Lower numerical values have higher priorities.

C613-50292-01 Rev A Command Reference for IE210L Series 675

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

LACP TIMEOUT

lacp timeout

Overview Use this command to set the short or long timeout on a port. Ports will time out of

the aggregation if three consecutive updates are lost.

Syntax lacp timeout {short|long}

Default The default is long timeout (30 seconds).

Mode Interface Configuration

Usage This command enables the device to indicate the rate at which it expects to receive

LACPDUs from its neighbor.

If the timeout is set to long, then the device expects to receive an update every 30

seconds, and this will time a port out of the aggregation if no updates are seen for

90 seconds (i.e. 3 consecutive updates are lost).

If the timeout is set to short, then the device expects to receive an update every

second, and this will time a port a port out of the aggregation if no updates are

seen for 3 seconds (i.e. 3 consecutive updates are lost).

The device indicates its preference by means of the Timeout field in the Actor

section of its LACPDUs. If the Timeout field is set to 1, then the device has set the

short timeout. If the Timeout field is set to 0, then the device has set the long

timeout.

Setting the short timeout enables the device to be more responsive to

communication failure on a link, and does not add too much processing overhead

to the device (1 packet per second).

NOTE: It is not possible to configure the rate that the device sends LACPDUs; the device

must send at the rate which the neighbor indicates it expects to receive LACPDUs.

Examples The following commands set the LACP long timeout period for 30 seconds on

port1.0.2.

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# lacp timeout long

Parameter Description

timeout Number of seconds before invalidating a received LACP data unit

(DU).

short LACP short timeout. The short timeout value is 1 second.

long LACP long timeout. The long timeout value is 30 seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 676

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

LACP TIMEOUT

The following commands set the LACP short timeout for 1 second on port1.0.2.

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# lacp timeout short

C613-50292-01 Rev A Command Reference for IE210L Series 677

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

PLATFORM LOAD-BALANCING

platform load-balancing

Overview This command selects which address fields are used as inputs into the load

balancing algorithm for aggregated links. The output from this algorithm is used

to select which individual path a given packet will traverse within an aggregated

link.

The no variant of this command applies its default setting.

Syntax platform load-balancing {src-dst-mac|src-dst-ip}

no platform load-balancing

Default The default is src-dst-ip.

Mode Global configuration

Examples To set the load balancing algorithm to include only Layer 2 MAC addresses, use the

commands:

awplus# configure terminal

awplus(config)# platform load-balancing src-dst-mac

To set the load balancing algorithm to include only Layer 3 IP addresses and Layer

4 ports, use the commands:

awplus# configure terminal

awplus(config)# platform load-balancing src-dst-ip

Commands

show platform

Parameter Description

src-dst-mac Include the source and destination MAC addresses (Layer 2)

src-dst-ip Include the source and destination IP addresses (Layer 3) and

UDP/TCP source and destination ports.

If you choose this option, the algorithm will use MAC addresses

to calculate load balancing for Layer 2 and non-IP packets.

C613-50292-01 Rev A Command Reference for IE210L Series 678

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW DEBUGGING LACP

show debugging lacp

Overview Use this command to display the LACP debugging option set.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show debugging lacp

Mode User Exec and Privileged Exec

Example awplus# show debugging lacp

Output Figure 19-1: Example output from the show debugging lacp command

Commands

debug lacp

LACP debugging status:

LACP timer debugging is on

LACP timer-detail debugging is on

LACP cli debugging is on

LACP packet debugging is on

LACP event debugging is on

LACP sync debugging is on

C613-50292-01 Rev A Command Reference for IE210L Series 679

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW DIAGNOSTIC CHANNEL-GROUP

show diagnostic channel-group

Overview This command displays dynamic and static channel group interface status

information. The output of this command is useful for Allied Telesis authorized

service personnel for diagnostic purposes.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show diagnostic channel-group

Mode User Exec and Privileged Exec

Example awplus# show diagnostic channel-group

Output Figure 19-2: Example output from the show diagnostic channel-group

command



awplus#show diagnostic channel-group



Channel Group Info based on NSM:

Note: Pos - position in hardware table

-------------------------------------------------------------

Dev Interface IfIndex Member port IfIndex Active Pos

-------------------------------------------------------------

sa3 4503 port1.0.15 5015 No

sa3 4503 port1.0.18 5018 No

po1 4601 port1.0.7 5007 No

po1 4601 port1.0.8 5008 No

po1 4601 port1.0.9 5009 No



Channel Group Info based on HSL:

Note: Pos - position in hardware table

-------------------------------------------------------------

Dev Interface IfIndex Member port IfIndex Active Pos

-------------------------------------------------------------

sa3 4503 N/a

po1 4601 N/a



Channel Group Info based on IPIFWD:

Note: Pos - position in hardware table

-------------------------------------------------------------

Dev Interface IfIndex Member port IfIndex Active Pos

-------------------------------------------------------------

sa3 4503 N/a

po1 4601 N/a

C613-50292-01 Rev A Command Reference for IE210L Series 680

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW DIAGNOSTIC CHANNEL-GROUP

Commands

show tech-support



Channel Group Info based on HW:

Note: Pos - position in hardware table

Only entries from first device are displayed.

-------------------------------------------------------------

Dev Interface IfIndex Member port IfIndex Active Pos

-------------------------------------------------------------

sa3 4503 N/a

po1 4601 N/a



No error found

C613-50292-01 Rev A Command Reference for IE210L Series 681

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW ETHERCHANNEL

show etherchannel

Overview Use this command to display information about an LACP channel specified by the

channel group number.

The command output also shows the thrash limiting status. If thrash limiting is

detected and the action parameter of the thrash-limiting command is set to

vlan-disable, the output will also show the VLANs on which thrashing is detected.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide, which is

available on our website at alliedtelesis.com.

Syntax show etherchannel [<1-248>]

Mode User Exec and Privileged Exec

Example awplus# show etherchannel

Output Figure 19-3: Example output from show etherchannel

Example awplus# show etherchannel 1

Output Figure 19-4: Example output from show etherchannel for a particular channel

Parameter Description

<1-248>Channel-group number.

awplus#show etherchannel 

LAG Maximum : 128

LAG Static Count : 0

LAG Dynamic Count : 1

LAG Total Count : 1

Lacp Aggregator: po1

Member:

port1.0.1

port1.0.2

awplus#show etherchannel 1

Aggregator po1 (4601)

Mac address: 00:00:00:00:00:00

Admin Key: 0001 - Oper Key 0000

Receive link count: 0 - Transmit link count: 0

Individual: 0 - Ready: 0

Partner LAG: 0x0000,00-00-00-00-00-00

Link: port1.0.1 (5001) disabled

Link: port1.0.2 (5002) disabled

C613-50292-01 Rev A Command Reference for IE210L Series 682

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW ETHERCHANNEL DETAIL

show etherchannel detail

Overview Use this command to display detailed information about all LACP channels.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide, which is

available on our website at alliedtelesis.com.

Syntax show etherchannel detail

Mode User Exec and Privileged Exec

Example awplus# show etherchannel detail

Output Example output from show etherchannel detail

awplus#show etherchannel detail

Aggregator po1 (IfIndex: 4601)

Mac address: 00:00:cd:37:05:17

Admin Key: 0001 - Oper Key 0001

Receive link count: 2 - Transmit link count: 2

Individual: 0 - Ready: 1

Partner LAG: 0x8000,00-00-cd-37-02-9a,0x0001

Link: port1.0.1 (IfIndex: 8002) synchronized

Link: port1.0.2 (IfIndex: 20002) synchronized

Aggregator po2 (IfIndex: 4602)

Mac address: 00:00:cd:37:05:17

Admin Key: 0002 - Oper Key 0002

Receive link count: 2 - Transmit link count: 2

Individual: 0 - Ready: 1

Partner LAG: 0x8000,ec-cd-6d-aa-c8-56,0x0002

Link: port1.0.3 (IfIndex: 8001) synchronized

Link: port1.0.4 (IfIndex: 20001) synchronized

C613-50292-01 Rev A Command Reference for IE210L Series 683

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW ETHERCHANNEL SUMMARY

show etherchannel summary

Overview Use this command to display a summary of all LACP channels.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide, which is

available on our website at alliedtelesis.com.

Syntax show etherchannel summary

Mode User Exec and Privileged Exec

Example awplus# show etherchannel summary

Output Example output from show etherchannel summary



awplus#show etherchannel summary

Aggregator po10 (IfIndex: 4610)

Admin Key: 0010 - Oper Key 0010

Link: port1.0.1 (IfIndex: 7007) synchronized

Link: port1.0.2 (IfIndex: 8007) synchronized

Link: port1.0.3 (IfIndex: 11007) synchronized

C613-50292-01 Rev A Command Reference for IE210L Series 684

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW LACP SYS-ID

show lacp sys-id

Overview Use this command to display the LACP system ID and priority.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide, which is

available on our website at alliedtelesis.com.

Syntax show lacp sys-id

Mode User Exec and Privileged Exec

Example awplus# show lacp sys-id

Output Example output from show lacp sys-id

System Priority: 0x8000 (32768)

MAC Address: 0200.0034.5684

C613-50292-01 Rev A Command Reference for IE210L Series 685

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW LACP-COUNTER

show lacp-counter

Overview Use this command to display the packet traffic on all ports of all present LACP

aggregators, or a given LACP aggregator.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide, which is

available on our website at alliedtelesis.com.

Syntax show lacp-counter [<1-248>]

Mode User Exec and Privileged Exec

Example awplus# show lacp-counter 2

Output Example output from show lacp-counter

Parameter Description

<1-248>Channel-group number.

% Traffic statistics

Port LACPDUs Marker Pckt err

Sent Recv Sent Recv Sent Recv

% Aggregator po2 (IfIndex: 4604)

port1.0.2 0 0 0 0 0 0

C613-50292-01 Rev A Command Reference for IE210L Series 686

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW PORT ETHERCHANNEL

show port etherchannel

Overview Use this command to show LACP details of the device port specified.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide, which is

available on our website at alliedtelesis.com.

Syntax show port etherchannel <port>

Mode User Exec and Privileged Exec

Example awplus# show port etherchannel port1.0.2

Output Example output from show port etherchannel

Parameter Description

<port> Name of the device port to display LACP information about.

awplus#show port etherchannel port1.0.2

LACP link info: port1.0.2 - 7007

Link: port1.0.2 (IfIndex: 7007)

Aggregator: po10 (IfIndex: 4610)

Receive machine state: Current

Periodic Transmission machine state: Slow periodic

Mux machine state: Collecting/Distributing

Actor Information: Partner Information:

Selected ................. Selected Partner Sys Priority ....... 0x8000

Physical Admin Key .............. 2 Partner System .. ec-cd-6d-d1-64-d0

Port Key ....................... 10 Port Key ....................... 10

Port Priority ............... 32768 Port Priority ............... 32768

Port Number .................. 7007 Port Number .................. 5001

Mode ....................... Active Mode ....................... Active

Timeout ...................... Long Timeout ...................... Long

Individual .................... Yes Individual .................... Yes

Synchronised .................. Yes Synchronised .................. Yes

Collecting .................... Yes Collecting .................... Yes

Distributing .................. Yes Distributing .................. Yes

Defaulted ...................... No Defaulted ...................... No

Expired ........................ No Expired ........................ No

C613-50292-01 Rev A Command Reference for IE210L Series 687

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

SHOW STATIC-CHANNEL-GROUP

show static-channel-group

Overview Use this command to display all configured static channel groups and their

corresponding member ports. Note that a static channel group is the same as a

static aggregator.

The command output also shows the thrash limiting status. If thrash limiting is

detected and the action parameter of the thrash-limiting command is set to

vlan-disable, the output will also show the VLANs on which thrashing is detected.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide, which is

available on our website at alliedtelesis.com.

Syntax show static-channel-group

Mode User Exec and Privileged Exec

Example awplus# show static-channel-group

Output Example output from show static-channel-group

Commands

static-channel-group

% LAG Maximum : 128

% LAG Static Count : 2

% LAG Dynamic Count : 0

% LAG Total Count : 2

% Static Aggregator: sa2

% Member:

port1.0.1

port1.0.2

% Static Aggregator: sa3

% Member:

port1.0.3

port1.0.4

C613-50292-01 Rev A Command Reference for IE210L Series 688

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

STATIC-CHANNEL-GROUP

static-channel-group

Overview Use this command to create a static channel group, or to add a port to an existing

static channel group. Static channel groups are also known as static aggregators.

You can create up to 128 channel groups, in any combination of static and

dynamic (LACP) groups. This means you can create up to 128 static channel

groups, if you have no dynamic channel groups.

Use the no variant of this command to remove the device port from the static

channel group.

Syntax static-channel-group <static-channel-group-number>

no static-channel-group

Mode Interface Configuration

Usage This command adds the device port to the static channel group with the specified

channel group number. If the channel group does not exist, it is created, and the

port is added to it. The no prefix detaches the port from the static channel group.

If the port is the last member to be removed, the static channel group is deleted.

All the ports in a channel group must have the same VLAN configuration: they

must belong to the same VLANs and have the same tagging status, and can only

be operated on as a group.

Once the static channel group has been created, it is treated as a device port. You

can specify it in other commands by using sa followed by the channel-group

number. For example, use the command show interface sa2 to show details

about channel group 2's interface:

Examples To define static channel group 2 on port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# static-channel-group 2

To reference static channel group 2 as an interface, use the commands:

awplus# configure terminal

awplus(config)# interface sa2

awplus(config-if)#

Commands

show static-channel-group

Parameter Description

<static-channel-

group-number> <1-248> Static channel group number.

You can create up to 128 static channel groups, numbered in

the range 1-248.

C613-50292-01 Rev A Command Reference for IE210L Series 689

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

STATIC-CHANNEL-GROUP

Command

changes

Version 5.4.9-0.1: Ability added to create up to 128 groups as any combination of

static and dynamic channel groups. Also, numbering changed to 1-248.

C613-50292-01 Rev A Command Reference for IE210L Series 690

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LINK AGGREGATION COMMANDS

UNDEBUG LACP

undebug lacp

Overview This command applies the functionality of the no debug lacp command.

C613-50292-01 Rev A Command Reference for IE210L Series 691

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Power over

Ethernet

Commands

Introduction

Overview This chapter contains an alphabetical list of commands used to configure Power

over Ethernet (PoE). Each command contains a functional description and shows

examples of configuration and output screens for show commands. These

commands are only supported on PoE capable ports. An error message will display

on the console if you enter a PoE command on a port that does not support PoE.

The following documents offer further information for configuring PoE on

AlliedWare Plus switches.

•the PoE Feature Overview and Configuration_Guide.

•the Support for Allied Telesis Enterprise_MIBs_in AlliedWare Plus, for

information about which PoE MIB objects are supported.

•the SNMP Feature Overview and Configuration_Guide, for information about

SNMP traps.

Power over Ethernet (PoE) is a technology allowing devices such as security

cameras to receive power over LAN cabling.

The Powered Device (PD) referred to throughout this chapter is a PoE or PoE+

powered device, such as an IP phone or a Wireless Access Point (WAP).

Command List •“clear power-inline counters interface” on page 693

•“debug power-inline” on page 694

•“power-inline allow-legacy” on page 696

•“power-inline description” on page 697

•“power-inline enable” on page 698

•“power-inline max” on page 699

•“power-inline priority” on page 701

•“power-inline usage-threshold” on page 703

•“service power-inline” on page 704

C613-50292-01 Rev A Command Reference for IE210L Series 692

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

•“show debugging power-inline” on page 705

•“show power-inline” on page 706

•“show power-inline counters” on page 709

•“show power-inline interface” on page 711

•“show power-inline interface detail” on page 714

C613-50292-01 Rev A Command Reference for IE210L Series 693

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

CLEAR POWER-INLINE COUNTERS INTERFACE

clear power-inline counters interface

Overview This command will clear the counters from a specified port, a range of ports, or all

ports on the switch. If no ports are entered then PoE counters for all ports are

cleared. It will also clear all Power over Ethernet (PoE) counters supported by the

Power Ethernet MIB (RFC 3621).

Syntax clear power-inline counters interface [<port-list>]

Mode Privileged Exec

Usage The PoE counters are displayed with the show power-inline counters command.

Examples To clear the PoE counters for port1.0.2 only, use the following command:

awplus# clear power-inline counters interface port1.0.2

To clear the PoE counters for port1.0.5 through port1.0.8, use the following

command:

awplus# clear power-inline counters interface

port1.0.5-port1.0.8

To clear the PoE counters for all ports, use the following command:

awplus# clear power-inline counters interface

Commands

show power-inline counters

Command

changes

Version 5.4.8-0.2: added to x550 series products

Parameter Description

<port-list>Selects the port or ports whose counters are to be cleared.

C613-50292-01 Rev A Command Reference for IE210L Series 694

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

DEBUG POWER-INLINE

debug power-inline

Overview This command enables debugging display for messages that are specific to Power

over Ethernet (PoE).

Use the no variant of this command to disable the specified PoE debugging

messages.

Syntax debug power-inline [all|event|info|power]

no debug power-inline [all|event|info|power]

Default No debug messages are enabled by default.

Mode Privileged Exec

Usage Use the terminal monitor command to display PoE debug messages on the

console.

Use the show debugging power-inline command to show the PoE debug

configuration.

Examples To enable PoE debugging and start the display of PoE event and info debug

messages on the console, use the following commands:

awplus# terminal monitor

awplus# debug power-inline event info

To enable PoE debugging and start the display of all PoE debugging messages on

the console, use the following commands:

awplus# terminal monitor

awplus# debug power-inline all

To stop the display of PoE info debug messages on the console, use the following

command:

awplus# no debug power-inline info

To disable all PoE debugging and stop the display of any PoE debugging messages

on the console, use the following command:

awplus# no debug power-inline all

Parameter Description

all Displays all (event, info, nsm, power) debug messages.

event Displays event debug information, showing any error conditions

that may occur during PoE operation.

info Displays informational level debug information, showing high-level

essential debugging, such as information about message types.

power Displays power management debug information.

C613-50292-01 Rev A Command Reference for IE210L Series 695

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

DEBUG POWER-INLINE

Commands

show debugging power-inline

terminal monitor

Command

changes

Version 5.4.8-0.2: added to x550 series products

C613-50292-01 Rev A Command Reference for IE210L Series 696

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

POWER-INLINE ALLOW-LEGACY

power-inline allow-legacy

Overview This command enables detection of pre-IEEE 802.3af Power Ethernet standard

legacy Powered Devices (PDs).

The no variant of this command disables detection of pre-IEEE 802.3af Power

Ethernet standard legacy Powered Devices (PDs).

Syntax power-inline allow-legacy

no power-inline allow-legacy

Default Detection of legacy PDs is disabled on all ports

Mode Global Configuration

Examples To enable detection of legacy PDs, use the following commands:

awplus# configure terminal

awplus(config)# power-inline allow-legacy

To disable detection of legacy PDs, use the following commands:

awplus# configure terminal

awplus(config)# no power-inline allow-legacy

Validation

Commands

show power-inline

show running-config power-inline

Command

changes

Version 5.4.8-0.2: added to x550 series products

Version 5.4.9-0.1: default changed to “disabled”

C613-50292-01 Rev A Command Reference for IE210L Series 697

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

POWER-INLINE DESCRIPTION

power-inline description

Overview This command adds a description for a Powered Device (PD) connected to a PoE

port.

The no variant of this command clears a previously entered description for a

connected PD, resetting the PD description to the default (null).

Syntax power-inline description <pd-description>

no power-inline description

Default No description for a connected PD is set by default.

Mode Interface Configuration

Usage Select a PoE port, a list of PoE ports, or a range of PoE ports with the preceding

interface (to configure) command. If you specify a range or list of ports they must

all be PoE capable ports.

Examples To add the description “Desk Phone” for a connected PD on port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# power-inline description Desk Phone

To clear the description for the connected PD on port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no power-inline description

Commands

show power-inline interface

show running-config <power-inline>

Command

changes

Version 5.4.8-0.2: added to x550 series products

Parameter Description

<pd-description>Description of the PD connected to the PoE capable port

(with a maximum 256 character string limit per PD

description).

C613-50292-01 Rev A Command Reference for IE210L Series 698

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

POWER-INLINE ENABLE

power-inline enable

Overview This command enables Power over Ethernet (PoE) to detect a connected Powered

Device (PD) and supply power.

The no variant of this command disables PoE functionality on the selected PoE

port(s). No power is supplied to a connected PD after PoE is disabled on the

selected PoE port(s).

Ports still provide Ethernet connectivity after PoE is disabled.

Syntax power-inline enable

no power-inline enable

Default PoE is enabled by default on all ports

Mode Interface Configuration for one or more ports.

Usage No PoE log messages are generated for ports on which PoE is disabled.

Examples To disable PoE on port1.0.1 to port1.0.4, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1-port1.0.4

awplus(config-if)# no power-inline enable

To enable PoE on port1.0.1 to port1.0.4, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1-port1.0.4

awplus(config-if)# power-inline enable

Commands

show power-inline

show power-inline interface

show power-inline interface detail

show running-config power-inline

Command

changes

Version 5.4.8-0.2: added to x550 series products

C613-50292-01 Rev A Command Reference for IE210L Series 699

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

POWER-INLINE MAX

power-inline max

Overview This command sets the maximum power allocated to a Power over an Ethernet

(PoE and PoE+) port. The amount of power actually supplied to the port depends

on the power requirements of the connected PD. It is also a function of the total

PoE power loading on the switch and the PoE priority set for the port by the

power-inline priority command. However this command (power-inline max) does

apply a maximum value to the power that the port is able to supply.

Note that the value set by this command will be the figure the switch will use when

apportioning the power budget for its ports. For example, if 15.4 W is assigned to

a port whose PD only consumes 5 W, the switch will reserve the full 15.4 W for this

port when determining its total power PoE power requirement.

The no variant of this command sets the maximum power supplied to a PoE port

to the default, which is set to the maximum power limit for the class of the

connected Powered Device (PD).

Syntax power-inline max <4000-30000>

no power-inline max

Default The switch supplies the maximum power limit for the class of the PD connected to

the port by default.

NOTE: See the PoE Feature Overview and Configuration Guide for further information

about power classes.

Mode Interface Configuration for one or more ports. If you specify a range or list of ports,

they must all be PoE capable ports.

Usage If you select a range of PoE ports in Interface Configuration mode before issuing

this command, then each port in the range selected will have the same maximum

power value configured. If the PoE port attempts to draw more than the maximum

power, this is logged and all power is removed.

Note that the value entered is rounded up to the next value supported by the

hardware. The actual value used is displayed after you enter the command, such as

in the following sample console output:

Parameter Description

<4000-30000>The maximum power supplied to a PoE port in milliwatts

(mW).

C613-50292-01 Rev A Command Reference for IE210L Series 700

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

POWER-INLINE MAX

See the LLDP Feature Overview and Configuration Guide for information about

power monitoring at the PD.

Note the difference in power supplied from the PSE to the power available at the

PD due to line loss.

See the PoE Feature Overview and Configuration Guide for further information

about the difference between the power supplied from the PSE and the power

available at the PD.

Examples To set the maximum power supplied to ports in the range port1.0.1 to port1.0.4 to

6450mW per port, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2-port1.0.4

awplus(config-if)# power-inline max 6450

To clear the user-configured maximum power supplied to port1.0.1, and revert to

using the default maximum power, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no power-inline max

Commands

show power-inline interface

show running-config power-inline

Command

changes

Version 5.4.8-0.2: added to x550 series products



awplus#configure terminal



awplus(config)#interface port1.0.1



awplus(config-if)#power-line max 5300



% The maximum power has been rounded to 5450mW in hardware.

C613-50292-01 Rev A Command Reference for IE210L Series 701

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

POWER-INLINE PRIORITY

power-inline priority

Overview This command sets the Power over Ethernet (PoE) priority level of a PoE port to one

of three available priority levels:

•low

•high

•critical

The no variant of this command restores the PoE port priority to the default (low).

Syntax power-inline priority {low|high|critical}

no power-inline priority

Default The default priority is low for all PoE ports

Mode Interface Configuration

Usage Select a PoE port, a list of PoE ports, or a range of PoE ports with the preceding

interface (to configure) command. If you specify a range or list of ports they must

all be PoE capable ports.

PoE ports with higher priorities are given power before PoE ports with lower

priorities. If the priorities for two PoE ports are the same then the lower numbered

PoE port is given power before the higher numbered PoE port.

See the PoE Feature Overview and Configuration Guide for further information

about PoE priority.

Examples To set the priority level to high on port1.0.1 to port1.0.4, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.1-port1.0.4

awplus(config-if)# power-inline priority high

Parameter Description

low The lowest priority for a PoE enabled port (default). PoE ports

set to low only receive power if all the PoE ports assigned to

the other two levels are already receiving power.

high The second highest priority for a PoE enabled port. PoE ports

set to high receive power only if all the ports set to critical

are already receiving power.

critical The highest priority for a PoE enabled port. PoE ports set to

critical are guaranteed power before any ports assigned to

the other two priority levels. Ports assigned to the other

priority levels receive power only if all critical ports are

receiving power.

C613-50292-01 Rev A Command Reference for IE210L Series 702

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

POWER-INLINE PRIORITY

To reset the priority level to the default of low on port1.0.1 to port1.0.4, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1-port1.0.4

awplus(config-if)# no power-inline priority

Commands

power-inline usage-threshold

show power-inline

show power-inline interface

show running-config power-inline

Command

changes

Version 5.4.8-0.2: added to x550 series products

C613-50292-01 Rev A Command Reference for IE210L Series 703

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

POWER-INLINE USAGE-THRESHOLD

power-inline usage-threshold

Overview This command sets the level at which the switch will issue a message that the

power supplied to all Powered Devices (PDs) has reached a critical level of the

nominal power rating for the switch. The level is set as a percentage of total

available power.

The no variant of this command resets the notification usage-threshold to the

default (80% of the nominal power rating).

Syntax power-inline usage-threshold <1-99>

no power-inline usage-threshold

Default The default power usage threshold is 80% of the nominal power rating

Mode Global Configuration

Usage Use the snmp-server enable trap command to configure SNMP notification. An

SNMP notification is sent when the usage-threshold, as configured in the example,

is exceeded.

Examples To generate SNMP notifications when power supplied exceeds 70% of the nominal

power rating, use the following commands:

awplus# configure terminal

awplus(config)# snmp-server enable trap power-inline

awplus(config)# power-inline usage-threshold 70

To reset the notification threshold to the default (80% of the nominal power

rating), use the following commands:

awplus# configure terminal

awplus(config)# no power-inline usage-threshold

Commands

snmp-server enable trap

show power-inline interface

show running-config power-inline

Command

changes

Version 5.4.8-0.2: added to x550 series products

Parameter Description

<1-99>The usage-threshold percentage configured with this

command.

C613-50292-01 Rev A Command Reference for IE210L Series 704

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SERVICE POWER-INLINE

service power-inline

Overview This command enables Power over Ethernet (PoE) globally on the switch, for all

PoE ports.

Syntax service power-inline

no service power-inline

Default PoE functionality is enabled by default

Mode Global Configuration

Examples To disable PoE, use the following commands:

awplus# configure terminal

awplus(config)# no service power-inline

To re-enable PoE, if PoE has been disabled, use the following commands:

awplus# configure terminal

awplus(config)# service power-inline

Commands

show power-inline

show running-config power-inline

Command

changes

Version 5.4.8-0.2: added to x550 series products

C613-50292-01 Rev A Command Reference for IE210L Series 705

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW DEBUGGING POWER-INLINE

show debugging power-inline

Overview This command displays Power over Ethernet (PoE) debug settings.

Syntax show debugging power-inline

Mode User Exec and Privileged Exec

Example To display PoE debug settings, use the following command:

awplus# show debugging power-inline

Output Figure 20-1: Example output from the show debugging power-inline

command

Commands

debug power-inline

terminal monitor

Command

changes

Version 5.4.8-0.2: added to x550 series products

awplus#show debugging power-inline

PoE Debugging status:

PoE Informational debugging is disabled

PoE Event debugging is disabled

PoE Power Management debugging is disabled



PoE NSM debugging is enabled

C613-50292-01 Rev A Command Reference for IE210L Series 706

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE

show power-inline

Overview This command displays the Power over Ethernet (PoE) status for all ports.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show power-inline

Mode User Exec and Privileged Exec

Example To display the PoE status for all ports, use the following command:

awplus# show power-inline

Output Figure 20-2: Example output from show power-inline.

awplus#show power-inline



PoE Status:



Nominal Power: 247W

Power Allocated: 15W

Actual Power Consumption: 2W

Operational Status: On

Power Usage Threshold: 80% (198W)

Detection of legacy devices is enabled

RPS Boost Mode: Disabled

Power management mode: Static



PoE Interface:

Interface Admin Pri Oper Power Device Class Max

(mW) (mW)

port1.0.1 Enabled Low Off 0 n/a n/a n/a

port1.0.2 Enabled Low Off 0 n/a n/a n/a

port1.0.3 Enabled Low Off 0 n/a n/a n/a

port1.0.4 Enabled Low Powered 2427 n/a 0 15400 [C]

....

Table 1: Parameters in the show power-inline command output

Parameter Description

Nominal Power The nominal power available on the switch in watts (W).

Power Allocated The current power allocated in watts (W) that is available to

be drawn by any connected Powered Devices (PDs). This is

updated every 5 seconds.

Actual Power

Consumption

The current power consumption in watts (W) drawn by all

connected Powered Devices (PDs). This is updated every 5

seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 707

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE

Operational Status The operational status of the PSU hardware when this

command was issued:

•On if the PSU is installed and switched on.

•Off when the PSU is switched off (an RPS may be

connected to the switch to power PoE instead of the

PSU).

•Fault when there is an issue with the PSU hardware.

Power Usage Threshold

(%)

The configured SNMP trap / log threshold, as configured

from a power-inline usage-threshold command.

Power management

mode: Static

Indicates that PoE power is allocated statically. By default,

each port is allocated the maximum amount of power that

is required for the power class of the PD that is attached to

that port. Alternatively, you can use the power-inline max

command to specify the maximum for a port.

Interface The PoE port(s) in the format portx.y.z, where x is the device

number, y is the module number within the device, and z is

the PoE port number within the module.

Admin The administrative state of PoE on a PoE port, either

Enabled or Disabled.

Pri The current PoE priorities for PoE ports, as configured using

the power-inline priority command:

•Low is the lowest priority (this is the default).

•High is the second highest priority.

•Crit (critical) is the highest priority.

If the switch cannot supply all ports, it will supply critical

ports, then high-priority ports, then low-priority ports.

Oper The current PoE port state when this command was issued:

•Powered displays if there is a PD connected and power

is being supplied.

•Denied displays if supplying power would make the

switch go over the power budget.

•Off displays if the port is not supplying power but has

not been denied power by the switch. This is the default

state for ports that are not connected to a PD.

•Disabled displays if the PoE port is administratively

disabled.

•Syncing displays if PoE is still initializing the port when

you issue the command.

•Fault displays if there is a problem with PoE on the port.

•Unknown displays if PoE cannot determine the state of

the port.

Table 1: Parameters in the show power-inline command output (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 708

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE

Commands

show power-inline counters

show power-inline interface

Command

changes

Version 5.4.8-0.2: added to x550 series products

Power The power consumption in milliwatts (mW) for the PoE

port when this command was entered.

Device The description of the connected PD device if a description

has been added with the power-inline description

command. No description is shown for PDs not configured

with the power-inline description command.

Class The class of the connected PD, if power is being supplied to

the PD.

Max (mW) The power in milliwatts (mW) allocated for the PoE port.

Additionally, note the following as displayed per PoE port:

•[U] if the power limit for a port was user configured (with

the power-inline max command).

•[L] if the power limit for a port was supplied by LLDP.

•[C] if the power limit for a port was supplied by the PD

class.

Table 1: Parameters in the show power-inline command output (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 709

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE COUNTERS

show power-inline counters

Overview This command displays Power over Ethernet (PoE) event counters for ports on the

Power Sourcing Equipment (PSE). The PoE event counters displayed can also be

accessed by objects in the PoE MIB (RFC 3621). See the MIB Objects Feature

Overview and Configuration Guide for information about which PoE MIB objects

are supported.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show power-inline counters [<port-list>]

Mode User Exec and Privileged Exec

Examples To display all PoE event counters for all PoE ports, use the command:

awplus# show power-inline counters

To display the PoE event counters for the port range 1.0.1 to 1.0.3, use the

command:

awplus# show power-inline counters interface port1.0.1-1.0.3

Output Figure 20-3: Example output from the show power-inline counters command

Parameter Description

<port-list>Enter the PoE port(s) to display PoE event counters for them.

awplus#show power-inline counters interface port1.0.4-port1.0.12

PoE Counters:

Interface MPSAbsent Overload Short Invalid Denied

port1.0.4 0 0 0 0 0

port1.0.5 0 0 0 0 0

port1.0.6 0 0 0 0 0

port1.0.7 0 0 0 0 0

port1.0.8 0 0 0 0 0

port1.0.9 0 0 0 0 0

port1.0.10 0 0 0 0 0

port1.0.11 0 0 0 0 0

port1.0.12 0 0 0 0 0

C613-50292-01 Rev A Command Reference for IE210L Series 710

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE COUNTERS

Commands

clear power-inline counters interface

show power-inline

show power-inline interface

Command

changes

Version 5.4.8-0.2: added to x550 series products

Table 2: Parameters in the show power-inline counters command output

Parameter Description

Interface The PoE port(s) in the format portx.y.z, where x is the device

number, y is the module number within the device, and z is the

PoE port number within the module.

MPSAbsent The number of instances when the PoE MPS (Maintain Power

Signature) signal has been lost. The PoE MPS signal is lost when a

PD is disconnected from the PSE. Also increments

pethPsePortMPSAbsentCounter in the PoE MIB.

Overload The number of instances when a PD exceeds its configured power

limit (as configured by the power-inline max command). Also

increments pethPsePortOverLoadCounter in the PoE MIB.

Short The number of short circuits that have happened with a PD. Also

increments pethPsePortShortCounter in the PoE MIB.

Invalid The number of times a PD with an Invalid Signature (where the PD

has an open or short circuit, or is a legacy PD) is detected. Also

increments pethPseInvalidSignatureCounter in the PoE

MIB.

Denied The number of times a PD has been refused power due to power

budget limitations for the PSE. Also increments

pethPsePortPowerDeniedCounter in the PoE MIB.

C613-50292-01 Rev A Command Reference for IE210L Series 711

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE INTERFACE

show power-inline interface

Overview This command displays a summary of Power over Ethernet (PoE) information for

specified ports. If no ports are specified then PoE information is displayed for all

ports.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show power-inline interface [<port-list>]

Mode User Exec and Privileged Exec

Example To display the PoE port-specific information for all PoE ports on the switch, use the

following command:

awplus# show power-inline interface

To display the PoE port specific information for the port range1.0.1 to 1.0.4, use the

following command:

awplus# show power-inline interface port1.0.1-port1.0.4

Output Figure 20-4: Example output from show power-inline interface

Parameter Description

<port-list>Enter the PoE port(s) to display PoE specific information in the show

output.

awplus#show power-inline interface port1.0.1-port1.0.4

Interface Admin Pri Oper Power Device Class Max(mW)

port1.0.1 Disabled Low Disabled 0 n/a n/a n/a

port1.0.2 Enabled High Powered 3840 Desk Phone 1 5000 [U]

port1.0.3 Enabled Crit Powered 6720 AccessPoint 2 7000 [C]

port1.0.4 Disabled Low Disabled 0 n/a n/a n/a

Table 3: Parameters in show power-inline interface output

Parameter Description

Interface The PoE port(s) in the format portx.y.z, where x is the device

number, y is the module number within the device, and z is the

PoE port number within the module.

Admin The administrative state of PoE on a PoE port, either Enabled or

Disabled.

C613-50292-01 Rev A Command Reference for IE210L Series 712

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE INTERFACE

Commands

show power-inline

show power-inline interface detail

Pri The current PoE priorities for PoE ports on the PSE, as configured

from a power-inline priority command:

•Low displays when the low parameter is issued. The lowest

priority for a PoE enabled port (default).

•High displays when the high parameter is issued. The

second highest priority for a PoE enabled port.

•Crit displays when the critical parameter is issued. The

highest priority for a PoE enabled port.

Oper The current PoE port state when this command was issued:

•Powered displays if there is a PD connected and power is

being supplied.

•Denied displays if supplying power would make the switch

go over the power budget.

•Off displays if the port is not supplying power but has not

been denied power by the switch. This is the default state for

ports that are not connected to a PD.

•Disabled displays if the PoE port is administratively disabled.

•Syncing displays if PoE is still initializing the port when you

issue the command.

•Fault displays if there is a problem with PoE on the port.

•Unknown displays if PoE cannot determine the state of the

port.

Power The power consumption in milliwatts (mW) for the PoE port

when this command was entered.

Device The description of the connected PD device if a description has

been added with the power-inline description command. No

description is shown for PDs not configured with the

power-inline description command.

Class The class of the connected PD, if power is being supplied to the

PD from the PSE.

See the PoE Feature Overview and Configuration Guide for

further information about power classes.

Max (mW) The power in milliwatts (mW) allocated for the PoE port.

Additionally, note the following is displayed per PoE port:

•[U] if the power limit for a port was user configured (with the

power-inline max command).

•[L] if the power limit for a port was supplied by LLDP.

•[C] if the power limit for a port was supplied by the PD class.

Table 3: Parameters in show power-inline interface output (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 713

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE INTERFACE

Command

changes

Version 5.4.8-0.2: added to x550 series products

C613-50292-01 Rev A Command Reference for IE210L Series 714

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE INTERFACE DETAIL

show power-inline interface detail

Overview This command displays detailed information for one or more Power over Ethernet

(PoE) ports.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show power-inline interface [<port-list>] detail

Mode User Exec and Privileged Exec

Usage The power allocated to each port is listed in the Power allocated row, and is

limited by the maximum power per Powered Device (PD) class, or a user

configured power limit.

Examples To display detailed PoE port specific information for the port range 1.0.1 to 1.0.3,

use the command:

awplus# show power-inline interface port1.0.1-1.0.3 detail

Output Figure 20-5: Example output from show power-inline interface detail

Parameter Description

<port-list>Enter the PoE port(s) to display information about only the specified

port or ports.

awplus#show power-inline interface port1.0.2 detail

Interface port1.0.2

Powered device type: Access Point #3

PoE admin: on

Configured Priority: Low

Actual Priority: Low

Detection status: Powered

Current power consumption: 6720 mW

Powered device class: 2

Power allocated: 7000 mW (from powered device class)

Detection of legacy devices is enabled

Powered pairs: Data

C613-50292-01 Rev A Command Reference for IE210L Series 715

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE INTERFACE DETAIL

Table 4: Parameters in show power-inline interface detail output

Parameter Description

Interface The PoE port(s) in the format portx.y.z, where x is the device

number, y is the module number within the device, and z is the

PoE port number within the module.

Powered

device type: The name of the PD, if connected and if power is being supplied

to the PD from the PSE, configured with the power-inline

description command. n/a displays if a description has not been

configured for the PD.

PoE admin The administrative state of PoE on a PoE capable port, either

Enabled or Disabled as configured from the power-inline enable

command or the no power-inline enable command

respectively.

Priority The PoE priority of a port, which is either Low, or High, or

Critical, as configured by the power-inline priority command.

Detection

status: The current PSE PoE port state when this command was issued:

•Powered displays when there is a PD connected and power is

being supplied from the PSE.

•Denied displays when supplying power would make the PSE

go over the power budget.

•Disabled displays when the PoE port is administratively

disabled.

•Off displays when PoE has been disabled for the port.

•Fault displays when a PSE goes over its power allocation.

Current power

consumption: The power consumption for the PoE port when this command

was entered. Note that the power consumption may have

changed since the command was entered and the power is

displayed.

Powered

device class: The class of the connected PD if connected, and if power is being

supplied to the PD from the PSE.

See the PoE Feature Overview and Configuration Guide for

further information about power classes.

Power

allocated: The power in milliwatts (mW) allocated for the PoE port.

Additionally, note the following as displayed per PoE port:

•[U] if the power limit for a port was user configured (with the

power-inline max command).

•[L] if the power limit for a port was supplied by LLDP.

•[C] if the power limit for a port was supplied by the PD class.

Detection of

legacy

devices is

The status of legacy PoE detection on the PoE port (enabled or

disabled), as configured for the PoE port with the power-inline

allow-legacy command. Legacy detection involves measuring for

a large capacitance value to confirm the presence of a legacy PD.

Powered

pairs: The IEEE 802.3af and IEEE 802.3at standards allow for either data

or spare twisted pairs to be used to transfer power to a PD.

C613-50292-01 Rev A Command Reference for IE210L Series 716

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

POWER OVER ETHERNET COMMANDS

SHOW POWER-INLINE INTERFACE DETAIL

Commands

show power-inline

show power-inline interface

Command

changes

Version 5.4.8-0.2: added to x550 series products

C613-50292-01 Rev A Command Reference for IE210L Series 717

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP Commands

Introduction

Overview With GVRP enabled the switch can exchange VLAN configuration information with

other GVRP enabled switches. VLANs can be dynamically created and managed

through trunk ports.

• There is a limit of 400 VLANs supported by the AlliedWare Plus GVRP

implementation. VLANs may be numbered 1-4094, but a limit of 400 of these

VLANs are supported.

• MSTP is not supported by the AlliedWare Plus GVRP implementation. GVRP

and MSTP are mutually exclusive. STP and RSTP are supported by GVRP.

This chapter provides an alphabetical reference for commands used to configure

GVRP. For information about GVRP, including configuration, see the GVRP Feature

Overview and Configuration Guide.

Command List •“clear gvrp statistics” on page 718

•“debug gvrp” on page 719

•“gvrp (interface)” on page 721

•“gvrp dynamic-vlan-creation” on page 722

•“gvrp enable (global)” on page 723

•“gvrp registration” on page 724

•“gvrp timer” on page 725

•“show debugging gvrp” on page 726

•“show gvrp configuration” on page 727

•“show gvrp machine” on page 728

•“show gvrp statistics” on page 729

•“show gvrp timer” on page 730

C613-50292-01 Rev A Command Reference for IE210L Series 718

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

CLEAR GVRP STATISTICS

clear gvrp statistics

Overview Use this command to clear the GVRP statistics for all switchports, or for a specific

switchport.

Syntax clear gvrp statistics {all|<interface>}

Mode Privileged Exec

Usage Use this command together with the show gvrp statistics command to

troubleshoot GVRP.

Examples To clear all GVRP statistics for all switchport on the switch, enter the command:

awplus# clear gvrp statistics all

Commands

show gvrp statistics

Parameter Description

all Specify all switchports to clear GVRP statistics.

<interface>Specify the switchport to clear GVRP statistics.

C613-50292-01 Rev A Command Reference for IE210L Series 719

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

DEBUG GVRP

debug gvrp

Overview Use this command to debug GVRP packets and commands, sending output to the

console.

Use the no variant of this command to turn off debugging for GVRP packets and

commands.

Syntax debug gvrp {all|cli|event|packet}

no debug gvrp {all|cli|event|packet}

Mode Privileged Exec and Global Configuration

Examples To send debug output to the console for GVRP packets and GVRP commands, and

to enable the display of debug output on the console first, enter the commands:

awplus# terminal monitor

awplus# configure terminal

awplus(config)# debug gvrp all

To send debug output for GVRP packets to the console, enter the commands:

awplus# terminal monitor

awplus# configure terminal

awplus(config)# debug gvrp packets

To send debug output for GVRP commands to the console, enter the commands:

awplus# terminal monitor

awplus# configure terminal

awplus(config)# debug gvrp cli

To stop sending debug output for GVRP packets and GVRP commands to the

console, and to stop the display of any debug output on the console, enter the

commands:

awplus# terminal no monitor

awplus# configure terminal

awplus(config)# no debug gvrp all

Parameter Description

all Specifies debugging for all levels.

cli Specifies debugging for commands.

event Specified debugging for events.

packet Specifies debugging for packets.

C613-50292-01 Rev A Command Reference for IE210L Series 720

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

DEBUG GVRP

Commands

show debugging gvrp

terminal monitor

C613-50292-01 Rev A Command Reference for IE210L Series 721

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

GVRP (INTERFACE)

gvrp (interface)

Overview Use this command to enable GVRP for switchport interfaces.

Use the no variant of this command to disable GVRP for switchport interfaces.

Syntax gvrp

no gvrp

Mode Interface Configuration (for switchport interfaces).

Default Disabled by default.

Usage Use this command to enable GVRP on switchport interfaces. Note this command

does not enable GVRP for the switch. To enable GVRP on switchports use this

command in Interface Configuration mode. You must issue a gvrp enable (global)

command before issuing a gvrp (interface) command.

You must enable GVRP on both ends of a link for GVRP to propagate VLANs

between links.

NOTE: MSTP is not supported by the current AlliedWare Plus GVRP implementation.

GVRP and MSTP are mutually exclusive. STP and RSTP are supported by GVRP.

Private VLAN trunk ports are not supported by the current AlliedWare Plus GVRP

implementation. GVRP and private VLAN trunk ports are mutually exclusive.

Validation

Commands

show gvrp configuration

Commands

gvrp dynamic-vlan-creation

gvrp enable (global)

C613-50292-01 Rev A Command Reference for IE210L Series 722

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

GVRP DYNAMIC-VLAN-CREATION

gvrp dynamic-vlan-creation

Overview Use this command to enable dynamic VLAN creation globally for the switch.

Use the no variant of this command to disable dynamic VLAN creation globally for

the switch.

Syntax gvrp dynamic-vlan-creation

no gvrp dynamic-vlan-creation

Mode Global Configuration

Default Disabled by default.

Usage You must enable GVRP on both ends of a link for GVRP to propagate VLANs

between links.

You must also enable GVRP globally in Global Configuration mode before enabling

GVRP on an interface in Interface Configuration mode. Both of these tasks must

occur to create VLANs.

NOTE: There is limit of 400 VLANs supported by the AlliedWare Plus GVRP

implementation. VLANs may be numbered 1-4094, but a limit of 400 of these VLANs are

supported.

Examples Enter the following commands for switches with hostnames switch1 and

switch2 respectively, so switch1 propagates VLANs to switch2 and

switch2 propagates VLANs to switch1:

Switch1:

switch1# configure terminal

switch1(config)# gvrp enable

switch1(config)# gvrp dynamic-vlan-creation

Switch2:

switch2# configure terminal

switch2(config)# gvrp enable

switch2(config)# gvrp dynamic-vlan-creation

To disable GVRP dynamic VLAN creation on the switch, enter the commands:

awplus# configure terminal

awplus(config)# no gvrp dynamic-vlan-creation

Validation

Commands

show gvrp configuration

Commands

gvrp enable (global)

C613-50292-01 Rev A Command Reference for IE210L Series 723

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

GVRP ENABLE (GLOBAL)

gvrp enable (global)

Overview Use this command to enable GVRP globally for the switch.

Use the no variant of this command to disable GVRP globally for the switch.

Syntax gvrp enable

no gvrp enable

Mode Global Configuration

Default Disabled by default.

Usage Use this command to enable GVRP on the switch. Note that this command does

not enable GVRP on switchports. To enable GVRP on switchports use the gvrp

(interface) command in Interface Configuration mode. You must issue a gvrp

enable (global) command before issuing a gvrp (interface) command.

You must enable GVRP on both ends of a link for GVRP to propagate VLANs

between links.

NOTE: MSTP is not supported by the current AlliedWare Plus GVRP implementation.

GVRP and MSTP are mutually exclusive. STP and RSTP are supported by GVRP.

Private VLAN trunk ports are not supported by the current AlliedWare Plus GVRP

implementation. GVRP and private VLAN trunk ports are mutually exclusive.

Examples To enable GVRP for the switch, before enabling GVRP on switchports, enter the

commands:

awplus# configure terminal

awplus(config)# gvrp enable

To disable GVRP on the switch, which will also disable GVRP enabled on

switchports, enter the commands:

awplus# configure terminal

awplus(config)# no gvrp enable

Validation

Commands

show gvrp configuration

Commands

gvrp (interface)

gvrp dynamic-vlan-creation

C613-50292-01 Rev A Command Reference for IE210L Series 724

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

GVRP REGISTRATION

gvrp registration

Overview Use this command to set GVRP registration to normal, fixed, and forbidden

registration modes.

Use the no variant of this command to disable GVRP registration.

Syntax gvrp registration {normal|fixed|forbidden}

no gvrp registration {normal|fixed|forbidden}

Mode Interface Configuration

Default Normal registration is the default.

Usage Configuring a trunk port in normal registration mode allows dynamic creation of

VLANs. Normal mode is the default mode. Validate using the show gvrp

configuration command.

Configuring a trunk port in fixed registration mode allows manual creation of

VLANs.

Configuring a trunk port in forbidden registration mode prevents VLAN creation

on the port.

Validation

Commands

show gvrp configuration

Parameter Description

normal Specify dynamic GVRP registration and deregistration of VLANs.

fixed Specify fixed GVRP registration and deregistration of VLANs.

forbidden Specify no GVRP registration of VLANs. VLANs are deregistered.

C613-50292-01 Rev A Command Reference for IE210L Series 725

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

GVRP TIMER

gvrp timer

Overview Use this command to set GVRP timers in Interface Configuration mode for a given

interface.

Use the no variant of this command to reset the GVRP timers to the defaults

specified in the table below.

Syntax gvrp timer {join <timer-value>|leave <timer-value>|leaveall

<timer-value>}

no gvrp timer {join|leave|leaveall}

Mode Interface Configuration

Defaults The default join time value is 20 centiseconds (200 milliseconds), the default leave

timer value is 60 centiseconds (600 milliseconds), and the default leaveall timer

value is 1000 centiseconds (10,000 milliseconds).

Usage When configuring the leave timer, set it to more than or equal to three times the

join timer value. The settings for the leave and join timers must be the same

for all GVRP enabled switches. See also the section “Setting the GVRP Timers” in the

GVRP Feature Overview and Configuration Guide.

Use the show gvrp timer command to confirm GVRP timers set with this command.

Commands

show gvrp timer

Parameter Description

join Specifies the timer for joining the group (default is 20

centiseconds / hundredths of a second, or 200 milliseconds).

leave Specifies the timer for leaving a group (default is 60 centiseconds /

hundredths of a second, or 600 milliseconds).

leaveall Specifies the timer for leaving all groups (default is 1000

centiseconds / hundredths of a second, or 10,000 milliseconds).

<timer-value><1-65535> The timer value in hundredths of a second

(centiseconds).

C613-50292-01 Rev A Command Reference for IE210L Series 726

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

SHOW DEBUGGING GVRP

show debugging gvrp

Overview Use this command to display the GVRP debugging option set.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show debugging gvrp

Mode User Exec and Privileged Exec

Example Enter the following commands to display GVRP debugging output on the console:

awplus# configure terminal

awplus(config)# debug gvrp all

awplus(config)# exit

awplus# show debugging gvrp

Output See sample output from the show debugging gvrp command after entering

debug gvrp all:

Commands

debug gvrp

GVRP debugging status:

GVRP Event debugging is on

GVRP CLI debugging is on

GVRP Timer debugging is on

GVRP Packet debugging is on

C613-50292-01 Rev A Command Reference for IE210L Series 727

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

SHOW GVRP CONFIGURATION

show gvrp configuration

Overview Use this command to display GVRP configuration data for a switch.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show gvrp configuration

Mode User Exec and Privileged Exec

Example To show GVRP configuration for the switch, enter the command:

awplus# show gvrp configuration

Output The following is an output of this command displaying the GVRP configuration for

a switch:

C613-50292-01 Rev A Command Reference for IE210L Series 728

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

SHOW GVRP MACHINE

show gvrp machine

Overview Use this command to display the state machine for GVRP.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show gvrp machine

Mode User Exec and Privileged Exec

Example To show the GVRP state machine for the switch, enter the command:

awplus# show gvrp machine

Output See the following output of this command displaying the GVRP state machine.

C613-50292-01 Rev A Command Reference for IE210L Series 729

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

SHOW GVRP STATISTICS

show gvrp statistics

Overview Use this command to display a statistical summary of GVRP information for the

switch.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show gvrp statistics [<interface>]

Mode User Exec and Privileged Exec

Usage Use this command together with the clear gvrp statistics command to

troubleshoot GVRP.

Examples To show the GVRP statistics for all switchport interfaces, enter the command:

awplus# show gvrp statistics

Commands

clear gvrp statistics

Parameter Description

<interface> The name of the switchport interface.

C613-50292-01 Rev A Command Reference for IE210L Series 730

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

GVRP COMMANDS

SHOW GVRP TIMER

show gvrp timer

Overview Use this command to display data for the GVRP timers set with the gvrp timer

command.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show gvrp timer <interface>

Mode User Exec and Privileged Exec

Examples To show the GVRP timers for all switchport interfaces, enter the command:

awplus# show gvrp timer

Commands

gvrp timer

Parameter Description

<interface> The name of the switchport interface.

C613-50292-01 Rev A Command Reference for IE210L Series 731

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Part 3: Layer 3 Switching

C613-50292-01 Rev A Command Reference for IE210L Series 732

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP Addressing and

Protocol Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

various IP features, including the following protocols:

• Address Resolution Protocol (ARP)

For more information, see the IP Feature Overview and Configuration Guide.

Command List •“arp-aging-timeout” on page 734

•“arp” on page 735

•“arp log” on page 736

•“arp opportunistic-nd” on page 739

•“arp-reply-bc-dmac” on page 740

•“clear arp-cache” on page 741

•“debug ip packet interface” on page 742

•“ip address (IP Addressing and Protocol)” on page 744

•“ip gratuitous-arp-link” on page 746

•“ip redirects” on page 748

•“ip tcp synack-retries” on page 749

•“ip unreachables” on page 750

•“ping” on page 752

•“show arp” on page 753

•“show debugging ip packet” on page 754

•“show ip flooding-nexthops” on page 756

•“show ip interface” on page 757

•“show ip sockets” on page 758

C613-50292-01 Rev A Command Reference for IE210L Series 733

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

•“show ip traffic” on page 761

•“tcpdump” on page 763

•“traceroute” on page 764

•“undebug ip packet interface” on page 765

C613-50292-01 Rev A Command Reference for IE210L Series 734

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

ARP-AGING-TIMEOUT

arp-aging-timeout

Overview This command sets a timeout period on dynamic ARP entries associated with a

specific interface. If your device stops receiving traffic for the host specified in a

dynamic ARP entry, it deletes the ARP entry from the ARP cache after this timeout

is reached.

Your device times out dynamic ARP entries to ensure that the cache does not fill

with entries for hosts that are no longer active. Static ARP entries are not aged or

automatically deleted.

By default the time limit for dynamic ARP entries is 300 seconds on all interfaces.

The no variant of this command sets the time limit to the default of 300 seconds.

Syntax arp-aging-timeout <0-432000>

no arp-aging timeout

Default 300 seconds (5 minutes)

Mode Interface Configuration for a VLAN interface.

Example To set the ARP entries on interface vlan2 to time out after two minutes, use the

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# arp-aging-timeout 120

Commands

clear arp-cache

show arp

Parameter Description

<0-432000> The timeout period in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 735

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

ARP

arp

Overview This command adds a static ARP entry to the ARP cache. This is typically used to

add entries for hosts that do not support ARP or to speed up the address resolution

function for a host. The ARP entry must not already exist. Use the alias parameter

to allow your device to respond to ARP requests for this IP address.

The no variant of this command removes the static ARP entry. Use the clear

arp-cache command to remove the dynamic ARP entries in the ARP cache.

Syntax arp <ip-addr> <mac-address> [<port-number>] [alias]

no arp <ip-addr>

Mode Global Configuration

Examples To add the IP address 10.10.10.9 with the MAC address 0010.2533.4655 into the

ARP cache, and have your device respond to ARP requests for this address, use the

commands:

awplus# configure terminal

awplus(config)# arp 10.10.10.9 0010.2355.4566 alias

Commands

clear arp-cache

show arp

Parameter Description

<ip-addr> The IPv4 address of the device you are adding as a static ARP

entry.

<mac-address> The MAC address of the device you are adding as a static ARP

entry, in hexadecimal notation with the format

HHHH.HHHH.HHHH.

<port-number> The port number associated with the IP address. Specify this

when the IP address is part of a VLAN.

alias Allows your device to respond to ARP requests for the IP

address. Proxy ARP must be enabled on the interface before

using this parameter.

C613-50292-01 Rev A Command Reference for IE210L Series 736

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

ARP LOG

arp log

Overview This command enables the logging of dynamic and static ARP entries in the ARP

cache. The ARP cache contains mappings of device ports, VLAN IDs, and IP

addresses to physical MAC addresses for hosts.

This command can display the MAC addresses in the ARP log either using the

notation HHHH.HHHH.HHHH, or using the IEEE standard hexadecimal notation

(HH-HH-HH-HH-HH-HH).

Use the no variant of this command to disable the logging of ARP entries.

Syntax arp log [mac-address-format ieee]

no arp log [mac-address-format ieee]

Default The ARP logging feature is disabled by default.

Mode Global Configuration

Usage You have the option to change how the MAC address is displayed in the ARP log

message. The output can either use the notation HHHH.HHHH.HHHH or

HH-HH-HH-HH-HH-HH.

Enter arp log to use HHHH.HHHH.HHHH notation.

Enter arp log mac-address-format ieee to use HH-HH-HH-HH-HH-HH notation.

Enter no arp log mac-address-format ieee to revert from HH-HH-HH-HH-HH-HH

to HHHH.HHHH.HHHH.

Enter no arp log to disable ARP logging.

To display ARP log messages use the command show log | include ARP_LOG.

Examples To enable ARP logging and specify that the MAC address in the log message is

displayed in HHHH.HHHH.HHHH notation, use the following commands:

awplus# configure terminal

awplus(config)# arp log

To disable ARP logging on the device, use the following commands:

awplus# configure terminal

awplus(config)# no arp log

Parameter Description

mac-address-format ieee Display the MAC address in the standard IEEE

format (HH-HH-HH-HH-HH-HH), instead of

displaying the MAC address with the format

HHHH.HHHH.HHHH.

C613-50292-01 Rev A Command Reference for IE210L Series 737

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

ARP LOG

To enable ARP logging and specify that the MAC address in the log message is

displayed in the standard IEEE format hexadecimal notation

(HH-HH-HH-HH-HH-HH), use the following commands:

awplus# configure terminal

awplus(config)# arp log mac-address-format ieee

To leave ARP logging enabled, but stop using HH-HH-HH-HH-HH-HH format and

use HHHH.HHHH.HHHH format instead, use the following commands:

awplus# configure terminal

awplus(config)# no arp log mac-address-format ieee

To display ARP log messages, use the following command:

awplus# show log | include ARP_LOG

Output Figure 22-1: Output from show log | include ARP_LOG after enabling ARP

logging using arp log. Note that this output uses

HHHH.HHHH.HHHH format.

Figure 22-2: Output from show log | include ARP_LOG after enabling ARP

logging using arp log mac-address format ieee. Note that this

output uses HH-HH-HH-HH-HH-HH format.

awplus#configure terminal

awplus(config)#arp log

awplus(config)#exit

awplus#show log | include ARP_LOG

2018 Oct 6 06:21:01 user.notice awplus HSL[1007]: ARP_LOG port1.0.1 vlan1 add 

0013.4078.3b98 (192.168.2.4)

2018 Oct 6 06:22:30 user.notice awplus HSL[1007]: ARP_LOG port1.0.1 vlan1 del 

0013.4078.3b98 (192.168.2.4)

2018 Oct 6 06:23:26 user.notice awplus HSL[1007]: ARP_LOG port1.0.1 vlan1 add 

0030.940e.136b (192.168.2.20)

2018 Oct 6 06:23:30 user.notice awplus IMISH[1830]: show log | include ARP_LOG

awplus#configure terminal

awplus(config)#arp log mac-address-format ieee

awplus(config)#exit

awplus#show log | include ARP_LOG

2018 Oct 6 06:25:28 user.notice awplus HSL[1007]: ARP_LOG port1.0.1 vlan1 add

00-17-9a-b6-03-69 (192.168.2.12)

2018 Oct 6 06:25:30 user.notice awplus HSL[1007]: ARP_LOG port1.0.1 vlan1 add

00-03-37-6b-a6-a5 (192.168.2.10)

2018 Oct 6 06:26:53 user.notice awplus HSL[1007]: ARP_LOG port1.0.1 vlan1 del

00-30-94-0e-13-6b (192.168.2.20)

2018 Oct 6 06:27:31 user.notice awplus HSL[1007]: ARP_LOG port1.0.1 vlan1 del

00-17-9a-b6-03-69 (192.168.2.12)

2018 Oct 6 06:28:09 user.notice awplus HSL[1007]: ARP_LOG port1.0.1 vlan1 del

00-03-37-6b-a6-a5 (192.168.2.10)

2018 Oct 6 06:28:14 user.notice awplus IMISH[1830]: show log | include ARP_LOG

C613-50292-01 Rev A Command Reference for IE210L Series 738

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

ARP LOG

The following table lists the parameters in output of the show log | include

ARP_LOG command. The ARP log message format is:

<date> <time> <severity> <hostname> <program-name> 

ARP_LOG <port-number> <vid> <operation> <MAC> <IP>

Commands

show log

show running-config

Table 22-1: Parameters in the output from show log | include ARP_LOG

Parameter Description

ARP_LOG Indicates that ARP log entry information follows.

<port-number>Indicates device port number for the ARP log entry.

<vid>Indicates the VLAN ID for the ARP log entry.

<operation>Indicates “add” if the ARP log entry displays an ARP addition.

Indicates “del” if the ARP log entry displays an ARP deletion.

<MAC>Indicates the MAC address for the ARP log entry, either in the

default hexadecimal notation (HHHH.HHHH.HHHH) or in the

IEEE standard format hexadecimal notation

(HH-HH-HH-HH-HH-HH) as specified with the arp log or the arp

log mac-address-format ieee command.

<IP>Indicates the IP address for the ARP log entry.

C613-50292-01 Rev A Command Reference for IE210L Series 739

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

ARP OPPORTUNISTIC-ND

arp opportunistic-nd

Overview Use this command to enable opportunistic neighbor discovery for the global ARP

cache. This command changes the behavior for unsolicited ARP packet forwarding

on the device.

Use the no variant of this command to disable opportunistic neighbor discovery

for the global ARP cache.

Syntax arp opportunistic-nd

no arp opportunistic-nd

Default Opportunistic neighbor discovery is disabled by default.

Mode Global Configuration

Usage When opportunistic neighbor discovery is enabled, the device will reply to any

received unsolicited ARP packets (but not gratuitous ARP packets). The source

MAC address for the unsolicited ARP packet is added to the ARP cache, so the

device forwards the ARP packet. When opportunistic neighbor discovery is

disabled, the source MAC address for the ARP packet is not added to the ARP

cache, so the ARP packet is not forwarded by the device.

Examples To enable opportunistic neighbor discovery for the global ARP cache, enter:

awplus# configure terminal

awplus(config)# arp opportunistic-nd

To disable opportunistic neighbor discovery for the global ARP cache, enter:

awplus# configure terminal

awplus(config)# no arp opportunistic-nd

Commands

ipv6 opportunistic-nd

show arp

show running-config interface

C613-50292-01 Rev A Command Reference for IE210L Series 740

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

ARP-REPLY-BC-DMAC

arp-reply-bc-dmac

Overview Use this command to allow processing of ARP replies that arrive with a broadcast

destination MAC (ffff.ffff.ffff). This makes neighbors reachable if they send ARP

responses that contain a broadcast destination MAC.

Use the no variant of this command to turn off processing of ARP replies that arrive

with a broadcast destination MAC.

Syntax arp-reply-bc-dmac

no arp-reply-bc-dmac

Default By default, this functionality is disabled.

Mode Interface Configuration for VLAN interfaces

Example To allow processing of ARP replies that arrive on vlan2 with a broadcast destination

MAC, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# arp-reply-bc-dmac

Commands

clear arp-cache

show arp

C613-50292-01 Rev A Command Reference for IE210L Series 741

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

CLEAR ARP-CACHE

clear arp-cache

Overview This command deletes dynamic ARP entries from the ARP cache. You can

optionally specify the IPv4 address of an ARP entry to be cleared from the ARP

cache.

Syntax clear arp-cache [<ip-address>]

Mode Privileged Exec

Usage To display the entries in the ARP cache, use the show arp command. To remove

static ARP entries, use the no variant of the arp command.

Example To clear all dynamic ARP entries, use the command:

awplus# clear arp-cache

To clear all dynamic ARP entries associated with the IPv4 address 192.168.1.1, use

the command:

awplus# clear arp-cache 192.168.1.1

Commands

arp

show arp

Parameter Description

<ip-address> The IPv4 address of an ARP entry that is to be cleared from the

ARP cache.

C613-50292-01 Rev A Command Reference for IE210L Series 742

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

DEBUG IP PACKET INTERFACE

debug ip packet interface

Overview The debug ip packet interface command enables IP packet debug and is

controlled by the terminal monitor command.

If the optional icmp keyword is specified then ICMP packets are shown in the

output.

The no variant of this command disables the debug ip interface command.

Syntax debug ip packet interface {<interface-name>|all} [address

<ip-address>|verbose|hex|arp|udp|tcp|icmp]

no debug ip packet interface [<interface-name>]

Mode Privileged Exec and Global Configuration

Parameter Description

<interface> Specify a single Layer 3 interface name (not a range of interfaces)

This keyword can be specified as either all or as a single Layer 3

interface to show debugging for either all interfaces or a single

interface.

all Specify all Layer 3 interfaces on the device.

<ip-address> Specify an IPv4 address.

If this keyword is specified, then only packets with the specified IP

address as specified in the ip-address placeholder are shown in the

output.

verbose Specify verbose to output more of the IP packet.

If this keyword is specified then more of the packet is shown in the

output.

hex Specify hex to output the IP packet in hexadecimal.

If this keyword is specified, then the output for the packet is shown

in hex.

arp Specify arp to output ARP protocol packets.

If this keyword is specified, then ARP packets are shown in the

output.

udp Specify udp to output UDP protocol packets.

If this keyword is specified then UDP packets are shown in the

output.

tcp Specify tcp to output TCP protocol packets.

If this keyword is specified, then TCP packets are shown in the

output.

icmp Specify icmp to output ICMP protocol packets.

If this keyword is specified, then ICMP packets are shown in the

output.

C613-50292-01 Rev A Command Reference for IE210L Series 743

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

DEBUG IP PACKET INTERFACE

Examples To turn on ARP packet debugging on vlan2, use the command:

awplus# debug ip packet interface vlan2 arp

To turn off IP packet interface debugging on interface vlan2, use the command:

awplus# no debug ip packet interface vlan2

To turn on all packet debugging on all interfaces on the device, use the command:

awplus# debug ip packet interface all

To turn off IP packet interface debugging on all interfaces, use the command:

awplus# no debug ip packet interface

To turn on TCP packet debugging on vlan2 and IP address 192.168.2.4, use the

command:

awplus# debug ip packet interface vlan2 address 192.168.2.4 tcp

Commands

no debug all

tcpdump

terminal monitor

undebug ip packet interface

C613-50292-01 Rev A Command Reference for IE210L Series 744

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

IP ADDRESS (IP ADDRESSING AND PROTOCOL)

ip address (IP Addressing and Protocol)

Overview This command sets a static IP address on an interface.

The no variant of this command removes the IP address from the interface.

You cannot remove the primary address when a secondary address is present.

Syntax ip address <ip-addr/prefix-length> [secondary] [label <label>]

no ip address [<ip-addr/prefix-length>] [secondary]

Mode Interface Configuration for a VLAN interface or a local loopback interface.

Usage To set the primary IP address on the interface, specify only ip address

<ip-address/m>. This overwrites any configured primary IP address. To add

additional IP addresses on this interface, use the secondary parameter. You must

configure a primary address on the interface before configuring a secondary

address.

NOTE: Use show running-config interface not show ip interface brief when you

need to view a secondary address configured on an interface. show ip interface brief

will only show the primary address, not a secondary address for an interface.

Examples To add the IP address 10.10.10.50/24 to the interface vlan2, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip address 10.10.10.50/24

To add the secondary IP address 10.10.11.50/24 to the same interface, use the

following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip address 10.10.11.50/24 secondary

Parameter Description

<ip-addr/prefix-

length> The IPv4 address and prefix length you are assigning to the

interface.

secondary Secondary IP address.

label Adds a user-defined description of the secondary IP address.

<label> A user-defined description of the secondary IP address. Valid

characters are any printable character and spaces.

C613-50292-01 Rev A Command Reference for IE210L Series 745

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

IP ADDRESS (IP ADDRESSING AND PROTOCOL)

To add the IP address 10.10.11.50/24 to the local loopback interface lo, use the

following commands:

awplus# configure terminal

awplus(config)# interface lo

awplus(config-if)# ip address 10.10.11.50/24

Commands

interface (to configure)

show ip interface

show running-config interface

C613-50292-01 Rev A Command Reference for IE210L Series 746

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

IP GRATUITOUS-ARP-LINK

ip gratuitous-arp-link

Overview This command sets the Gratuitous ARP time limit for all switchports. The time limit

restricts the sending of Gratuitous ARP packets to one Gratuitous ARP packet

within the time in seconds.

NOTE: This command specifies time between sequences of Gratuitous ARP packets,

and time between individual Gratuitous ARP packets occurring in a sequence, to allow

legacy support for older devices and interoperation between other devices that are not

ready to receive and forward data until several seconds after linkup.

Additionally, jitter has been applied to the delay following linkup, so Gratuitous ARP

packets applicable to a given port are spread over a period of 1 second so are not all

sent at once. Remaining Gratuitous ARP packets in the sequence occur after a fixed

delay from the first one.

Syntax ip gratuitous-arp-link <0-300>

no ip gratuitous-arp-link

Default The default Gratuitous ARP time limit for all switchports is 8 seconds.

Mode Global Configuration

Usage Every switchport will send a sequence of 3 Gratuitous ARP packets to each VLAN

that the switchport is a member of, whenever the switchport moves to the

forwarding state. The first Gratuitous ARP packet is sent 1 second after the

switchport becomes a forwarding switchport. The second and third Gratuitous

ARP packets are each sent after the time period specified by the Gratuitous ARP

time limit.

Additionally, the Gratuitous ARP time limit specifies the minimum time between

the end of one Gratuitous ARP sequence and the start of another Gratuitous ARP

sequence. When a link is flapping, the switchport’s state is set to forwarding several

times. The Gratuitous ARP time limit is imposed to prevent Gratuitous ARP packets

from being sent undesirably often.

Examples To disable the sending of Gratuitous ARP packets, use the commands :

awplus# configure terminal

awplus(config)# ip gratuitous-arp-link 0

Parameter Description

<0-300>Specify the minimum time between sequences of Gratuitous ARPs and

the fixed time between Gratuitous ARPs occurring in a sequence, in

seconds.

0 disables the sending of Gratuitous ARP packets.

The default is 8 seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 747

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

IP GRATUITOUS-ARP-LINK

To restrict the sending of Gratuitous ARP packets to one every 20 seconds, use the

commands:

awplus# configure terminal

awplus(config)# ip gratuitous-arp-link 20

Validation

Commands

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 748

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

IP REDIRECTS

ip redirects

Overview This command enables the device to send ICMP redirects on one or more

interfaces.

Use the no variant of this command to stop the device from sending ICMP redirects

on one or more interfaces.

Syntax ip redirects

no ip redirects

Default ICMP redirects are disabled by default.

Mode Interface Configuration for a VLAN interface.

Usage ICMP redirect messages are used to notify hosts that a better route is available to a

destination.

ICMP redirects are used when a packet is routed into the device on the same

interface that the packet is routed out of the device. ICMP redirects are only sent to

packet sources that are directly connected to the device.

Examples To enable the device to send ICMP redirects on interface vlan2, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip redirects

To stop the device from sending ICMP redirects on interface vlan2, use the

following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ip redirects

C613-50292-01 Rev A Command Reference for IE210L Series 749

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

IP TCP SYNACK-RETRIES

ip tcp synack-retries

Overview Use this command to specify how many times the switch will retry sending a SYN

ACK for a TCP connection for which it has received a SYN but not an ACK. Such

connections are called half-open TCP connections. This command allows you to

influence how long half-open TCP connections take to time out.

Use the no variant of this command to return to the default setting of 5 retries.

Syntax ip tcp synack-retries <0-255>

no ip tcp synack-retries

Default 5 retries

Mode Global Configuration

Usage The following table shows the approximate correlation between the number of

retries and the time half-open TCP connections take to time out.

Example To retry twice, which leads to a timeout of approximately 7 seconds, use the

commands:

awplus# configure terminal

awplus(config)# ip tcp synack-retries 2

Commands

show running-config

Command

changes

Version 5.4.7-0.2: command added

Parameter Description

<0-255> Number of times to retry sending the SYN ACK

Number of retries Approximate lower bound for the timeout

0 retries 1 second

1 retry 3 seconds

2 retries 7 seconds

3 retries 15 seconds

4 retries 31 seconds

5 retries 63 seconds

C613-50292-01 Rev A Command Reference for IE210L Series 750

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

IP UNREACHABLES

ip unreachables

Overview Use this command to enable ICMP (Internet Control Message Protocol) type 3,

destination unreachable, messages.

Use the no variant of this command to disable destination unreachable messages.

This prevents an attacker from using these messages to discover the topology of a

network.

Syntax ip unreachables

no ip unreachables

Default Destination unreachable messages are enabled by default.

Mode Global Configuration

Usage When a device receives a packet for a destination that is unreachable it returns an

ICMP type 3 message, this message includes a reason code, as per the table below.

An attacker can use these messages to obtain information regarding the topology

of a network. Disabling destination unreachable messages, using the no ip

unreachables command, secures your network against this type of probing.

NOTE: Disabling ICMP destination unreachable messages breaks applications such as

traceroute and Path MTU Discovery (PMTUD), which depend on these messages to

operate correctly.

Table 22-2: ICMP type 3 reason codes and description

Code Description [RFC]

0Network unreachable [RFC792]

1Host unreachable [RFC792]

2Protocol unreachable [RFC792]

3Port unreachable [RFC792]

4Fragmentation required, and DF flag set [RFC792]

5Source route failed [RFC792]

6Destination network unknown [RFC1122]

7Destination host unknown [RFC1122]

8Source host isolated [RFC1122]

9Network administratively prohibited [RFC768]

10 Host administratively prohibited [RFC869]

11 Network unreachable for Type of Service [RFC908]

12 Host unreachable for Type of Service [RFC938]

13 Communication administratively prohibited [RFC905]

C613-50292-01 Rev A Command Reference for IE210L Series 751

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

IP UNREACHABLES

Example To disable destination unreachable messages, use the commands

awplus# configure terminal

awplus(config)# no ip unreachables

To enable destination unreachable messages, use the commands

awplus# configure terminal

awplus(config)# ip unreachables

14 Host Precedence Violation [RFC1812]

15 Precedence cutoff in effect [RFC1812]

Table 22-2: ICMP type 3 reason codes and description (cont.)

Code Description [RFC]

C613-50292-01 Rev A Command Reference for IE210L Series 752

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

PING

ping

Overview This command sends a query to another IPv4 host (send Echo Request messages).

Syntax ping [ip] <host> [broadcast] [df-bit {yes|no}] [interval

<0-128>] [pattern <hex-data-pattern>] [repeat

{<1-2147483647>|continuous}] [size <36-18024>] [source

<ip-addr>] [timeout <1-65535>] [tos <0-255>]

Mode User Exec and Privileged Exec

Example To ping the IP address 10.10.0.5 use the following command:

awplus# ping 10.10.0.5

Parameter Description

<host>The destination IP address or hostname.

broadcast Allow pinging of a broadcast address.

df-bit Enable or disable the do-not-fragment bit in the IP header.

interval <0-128> Specify the time interval in seconds between sending ping

packets. The default is 1. You can use decimal places to

specify fractions of a second. For example, to ping every

millisecond, set the interval to 0.001.

pattern <hex-

data-pattern> Specify the hex data pattern.

repeat Specify the number of ping packets to send.

<1-2147483647> Specify repeat count. The default is 5.

continuous Continuous ping

size <36-18024> The number of data bytes to send, excluding the 8 byte ICMP

header. The default is 56 (64 ICMP data bytes).

source <ip-addr> The IP address of a configured IP interface to use as the

source in the IP header of the ping packet.

timeout

<1-65535> The time in seconds to wait for echo replies if the ARP entry is

present, before reporting that no reply was received. If no

ARP entry is present, it does not wait.

tos <0-255> The value of the type of service in the IP header.

C613-50292-01 Rev A Command Reference for IE210L Series 753

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW ARP

show arp

Overview Use this command to display entries in the ARP routing and forwarding table—the

ARP cache contains mappings of IP addresses to physical addresses for hosts. To

have a dynamic entry in the ARP cache, a host must have used the ARP protocol to

access another host.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show arp

Mode User Exec and Privileged Exec

Usage Running this command with no additional parameters will display all entries in the

ARP routing and forwarding table.

Example To display all ARP entries in the ARP cache, use the following command:

awplus# show arp

Output Figure 22-3: Example output from the show arp command

Commands

arp

clear arp-cache

Command

changes

Version 5.4.9-0.1: Link layer addresses now shown as the hardware address (MAC

Address output parameter has been renamed to LL Address).

awplus#show arp

IP Address LL Address Interface Port Type

192.168.27.10 192.168.4.1 vlan1 port1.0.1 dynamic

192.168.27.100 0000.daaf.cd24 vlan1 port1.0.2 dynamic

192.168.1.100 192.168.20.1 vlan2 port1.0.3 static

Table 23: Parameters in the output of the show arp command

Parameter Meaning

IP Address IP address of the network device this entry maps to.

LL Address Hardware address of the network device.

Interface Interface over which the network device is accessed.

Port Physical port that the network device is attached to.

Type Whether the entry is a static or dynamic entry. Static

entries are added using the arp command. Dynamic entries

are learned from ARP request/reply message exchanges.

C613-50292-01 Rev A Command Reference for IE210L Series 754

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW DEBUGGING IP PACKET

show debugging ip packet

Overview Use this command to show the IP interface debugging status. IP interface

debugging is set using the debug ip packet interface command.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show debugging ip packet

Mode User Exec and Privileged Exec

Example To display the IP interface debugging status when the terminal monitor off, use the

command:

awplus# terminal no monitor

awplus# show debug ip packet

Output Figure 22-4: Example output from the show debugging ip packet command

with terminal monitor off

Example To display the IP interface debugging status when the terminal monitor is on, use

the command:

awplus# terminal monitor

awplus# show debug ip packet

Output Figure 22-5: Example output from the show debugging ip packet command

with terminal monitor on

awplus#terminal no monitor



awplus#show debug ip packet



IP debugging status:



interface all tcp (stopped)



interface vlan1 arp verbose (stopped)

awplus#terminal monitor



awplus#show debug ip packet



IP debugging status:



interface all tcp (running)



interface vlan1 arp verbose (running)

C613-50292-01 Rev A Command Reference for IE210L Series 755

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW DEBUGGING IP PACKET

Commands

debug ip packet interface

terminal monitor

C613-50292-01 Rev A Command Reference for IE210L Series 756

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW IP FLOODING-NEXTHOPS

show ip flooding-nexthops

Overview Use this command to display the static and dynamic ARP entries in the ARP cache

that flood packets to multiple ports.

Syntax show ip flooding-nexthops

Mode User Exec and Privileged Exec

Example To display all of the flooding nexthop entries in the ARP cache, use the command:

awplus# show ip flooding-nexthops

Output Figure 22-6: Example output from show ip flooding-nexthops

Commands

show arp

Command

changes

Version 5.4.8-2.1: command added

awplus#show ip flooding-nexthops 

IP Address MAC Address Interface Flooding Mode Type

11.11.11.10 0300.0000.0011 vlan1 port-group static

C613-50292-01 Rev A Command Reference for IE210L Series 757

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW IP INTERFACE

show ip interface

Overview Use this command to display information about interfaces and the IP addresses

assigned to them. To display information about a specific interface, specify the

interface name with the command.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip interface [<interface-list>] [brief]

Mode User Exec and Privileged Exec

Examples To show brief information for the assigned IP address for interface port1.0.2 use

the command:

awplus# show ip interface port1.0.2 brief

To show the IP addresses assigned to vlan2, use the command:

awplus# show ip interface vlan2 brief

Output Figure 22-7: Example output from the show ip interface brief command

Parameter Description

<interface-list> The interfaces to display information about. An interface-list

can be:

•a VLAN (e.g. vlan2)

• the loopback interface (lo)

• a continuous range of interfaces separated by a hyphen

(e.g. vlan10-20)

• a comma-separated list (e.g. vlan1,vlan10-20). Do not mix

interface types in a list.

The specified interfaces must exist.

Interface IP-Address Status Protocol

port1.0.1 unassigned admin up down

...

vlan1 192.168.1.1 admin up running

...

C613-50292-01 Rev A Command Reference for IE210L Series 758

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW IP SOCKETS

show ip sockets

Overview Use this command to display information about the IP or TCP sockets that are

present on the device. It includes TCP and UDP listen sockets, and displays the

associated IP address and port.

The information displayed for established TCP sessions includes the remote IP

address, port, and session state. Raw IP protocol listen socket information is also

displayed for protocols such as ICMP6, which are configured to receive IP packets

with the associated protocol number.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip sockets

Mode Privileged Exec

Usage Use this command to verify that the socket being used is opening correctly. If there

is a local and remote endpoint, a connection is established with the ports

indicated.

Note that this command does not display sockets that are used internally for

exchanging data between the various processes that exist on the device and are

involved in its operation and management. It only displays sockets that are present

for the purposes of communicating with other external devices.

Example To display IP sockets currently present on the device, use the command:

awplus# show ip sockets

Output Figure 22-8: Example output from show ip sockets



Socket information



Not showing 40 local connections

Not showing 7 local listening ports



Typ Local Address Remote Address State

tcp 0.0.0.0:111 0.0.0.0:* LISTEN

tcp 0.0.0.0:80 0.0.0.0:* LISTEN

tcp 0.0.0.0:23 0.0.0.0:* LISTEN

tcp 0.0.0.0:443 0.0.0.0:* LISTEN

tcp 0.0.0.0:4743 0.0.0.0:* LISTEN

tcp 0.0.0.0:873 0.0.0.0:* LISTEN

tcp :::23 :::* LISTEN

udp 0.0.0.0:111 0.0.0.0:*

udp 226.94.1.1:5405 0.0.0.0:*

udp 0.0.0.0:161 0.0.0.0:*

udp :::161 :::*

raw 0.0.0.0:112 0.0.0.0:* 112

raw :::58 :::* 58

raw :::112 :::* 112

C613-50292-01 Rev A Command Reference for IE210L Series 759

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW IP SOCKETS

Table 22-1: Parameters in the output from show ip sockets

Parameter Description

Not showing

local

connections

This field refers to established sessions between processes internal

to the device, that are used in its operation and management.

These sessions are not displayed as they are not useful to the user.

<number> is some positive integer.

Not showing

local

listening

ports

This field refers to listening sockets belonging to processes internal

to the device, that are used in its operation and management. They

are not available to receive data from other devices. These sessions

are not displayed as they are not useful to the user. <number> is

some positive integer.

Typ This column displays the type of the socket. Possible values for this

column are:

tcp : IP Protocol 6

udp : IP Protocol 17

raw : Indicates that socket is for a non port-orientated protocol (i.e.

a protocol other than TCP or UDP) where all packets of a specified IP

protocol type are accepted. For raw socket entries the protocol type

is indicated in subsequent columns.

Local

Address For TCP and UDP listening sockets this shows the destination IP

address and destination TCP or UDP port number for which the

socket will receive packets. The address and port are separated by ’:’.

If the socket will accept packets addressed to any of the device’s IP

addresses, the IP address will be 0.0.0.0 for IPv4 or :: for IPv6. For

active TCP sessions the IP address will display which of the devices

addresses the session was established with. For raw sockets this

displays the IP address and IP protocol for which the socket will

accept IP packets. The address and protocol are separated by ’:’. If

the socket will accept packets addressed to any of the device’s IP

addresses, the IP address will be 0.0.0.0 for IPv4 and :: for IPv6. IP

Protocol assignments are described

at:www.iana.org/assignments/protocol-numbers

C613-50292-01 Rev A Command Reference for IE210L Series 760

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW IP SOCKETS

Remote

Address For TCP and UDP listening sockets this shows the source IP address

(either IPv4 or IPv6) and source TCP or UDP port number for which

the socket will accept packets. The address and port are separated

by ’:’. If the socket will accept packets addressed from any IP

address, the IP address will be 0.0.0.0 for IPv4 . This is the usual case

for a listening socket. Normally for a listen socket any source port

will be accepted. This is indicated by “. For active TCP sessions the IP

address will display the remote address and port the session was

established with. For raw sockets the entry in this column will be

0.0.0.0: for IPv4 .

State This column shows the state of the socket. For TCP sockets this

shows the state of the TCP state machine. For UDP sockets this

column is blank. For raw sockets it contains the IP protocol number.

The possible TCP states are:

LISTEN

SYN-SENT

SYN-RECEIVED

ESTABLISHED

FIN-WAIT-1

FIN-WAIT-2

CLOSE-WAIT

CLOSING

LAST-ACK

TIME-WAIT

CLOSED

RFC793 contains the TCP state machine diagram with Section 3.2

describing each of the states.

Table 22-1: Parameters in the output from show ip sockets (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 761

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW IP TRAFFIC

show ip traffic

Overview Use this command to display statistics regarding IP traffic sent and received by all

interfaces on the device, showing totals for IP and IPv6 and then broken down into

sub-categories such as TCP, UDP, ICMP and their IPv6 equivalents when

appropriate.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip traffic

Mode Privileged Exec

Example To display IP traffic statistics, use the command:

awplus# show ip traffic

Output Figure 22-9: Example output from the show ip traffic command

awplus#show ip traffic 

IP: 

168475 packets received 

168475 delivered 

208099 sent 

35 dropped due to missing route 

22646409 bytes received 

126783216 bytes sent 

InCsumErrors 0 

InNoECTPkts 168475 

InECT1Pkts 0 

InECT0Pkts 0 

InCEPkts 0 

In107 Destination Unreachable 

Out11 Destination Unreachable 

IPv6: 

14 packets received 

14 received packets delivered 

18 packets transmitted 

...

ICMP6: 

4 messages sent 

...

UDP6: 

Udp6RcvbufErrors 0 

...

UDPLite6: 

UdpLite6RcvbufErrors 0 

...

C613-50292-01 Rev A Command Reference for IE210L Series 762

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

SHOW IP TRAFFIC

TCP: 

8 remote connections established 

...

UDP: 

79797 datagrams received 

...

UDPLite: 

InCsumErrors 0 

...

C613-50292-01 Rev A Command Reference for IE210L Series 763

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

TCPDUMP

tcpdump

Overview Use this command to start a tcpdump, which gives the same output as the

Unix-like tcpdump command to display TCP/IP traffic. Press <ctrl> + c to stop

a running tcpdump.

Syntax tcpdump <line>

Mode Privileged Exec

Example To start a tcpdump running to capture IP packets, enter the command:

awplus# tcpdump ip

Output Figure 22-10: Example output from the tcpdump command

Commands

debug ip packet interface

Parameter Description

<line>Specify the dump options. For more information on the

options for this placeholder see

http://www.tcpdump.org/tcpdump_man.html

03:40:33.221337 IP 192.168.1.1 > 224.0.0.13: PIMv2, Hello, 

length: 34

1 packets captured

2 packets received by filter

0 packets dropped by kernel

C613-50292-01 Rev A Command Reference for IE210L Series 764

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

TRACEROUTE

traceroute

Overview Use this command to trace the route to the specified IPv4 host.

Syntax traceroute {<ip-addr>|<hostname>}

Mode User Exec and Privileged Exec

Example awplus# traceroute 10.10.0.5

Parameter Description

<ip-addr> The destination IPv4 address. The IPv4 address uses the

format A.B.C.D.

<hostname>The destination hostname.

C613-50292-01 Rev A Command Reference for IE210L Series 765

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IP ADDRESSING AND PROTOCOL COMMANDS

UNDEBUG IP PACKET INTERFACE

undebug ip packet interface

Overview This command applies the functionality of the no debug ip packet interface

command.

C613-50292-01 Rev A Command Reference for IE210L Series 766

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Domain Name

Service (DNS)

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

the Domain Name Service (DNS) client.

For more information about DNS for Switches, see the Domain Name System (DNS)

for AlliedWare Plus Switches Feature Overview and Configuration Guide

Command List •“ip domain-list” on page 767

•“ip domain-lookup” on page 768

•“ip domain-name” on page 769

•“ip name-server” on page 770

•“ip name-server preferred-order” on page 772

•“show hosts” on page 773

•“show ip domain-list” on page 774

•“show ip domain-name” on page 775

•“show ip name-server” on page 776

C613-50292-01 Rev A Command Reference for IE210L Series 767

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

IP DOMAIN-LIST

ip domain-list

Overview This command adds a domain to the DNS list. Domains are appended to

incomplete host names in DNS requests. Each domain in this list is tried in turn in

DNS lookups. This list is ordered so that the first entry you create is checked first.

The no variant of this command deletes a domain from the list.

Syntax ip domain-list <domain-name>

no ip domain-list <domain-name>

Mode Global Configuration

Usage If there are no domains in the DNS list, then your device uses the domain specified

with the ip domain-name command. If any domain exists in the DNS list, then the

device does not use the domain set using the ip domain-name command.

Example To add the domain example.net to the DNS list, use the following commands:

awplus# configure terminal

awplus(config)# ip domain-list example.net

Commands

ip domain-lookup

ip domain-name

show ip domain-list

Parameter Description

<domain-name> Domain string, for example “company.com”.

C613-50292-01 Rev A Command Reference for IE210L Series 768

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

IP DOMAIN-LOOKUP

ip domain-lookup

Overview This command enables the DNS client on your device. This allows you to use

domain names instead of IP addresses in commands. The DNS client resolves the

domain name into an IP address by sending a DNS inquiry to a DNS server,

specified with the ip name-server command.

The no variant of this command disables the DNS client. The client will not attempt

to resolve domain names. You must use IP addresses to specify hosts in

commands.

Syntax ip domain-lookup

no ip domain-lookup

Mode Global Configuration

Usage The client is enabled by default. However, it does not attempt DNS inquiries unless

there is a DNS server configured.

Examples To enable the DNS client on your device, use the following commands:

awplus# configure terminal

awplus(config)# ip domain-lookup

To disable the DNS client on your device, use the following commands:

awplus# configure terminal

awplus(config)# no ip domain-lookup

Commands

ip domain-list

ip domain-name

ip name-server

show hosts

show ip name-server

C613-50292-01 Rev A Command Reference for IE210L Series 769

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

IP DOMAIN-NAME

ip domain-name

Overview This command sets a default domain for the DNS. The DNS client appends this

domain to incomplete host-names in DNS requests.

The no variant of this command removes the domain-name previously set by this

command.

Syntax ip domain-name <domain-name>

no ip domain-name <domain-name>

Mode Global Configuration

Usage If there are no domains in the DNS list (created using the ip domain-list command)

then your device uses the domain specified with this command. If any domain

exists in the DNS list, then the device does not use the domain configured with this

command.

When your device is using its DHCP client for an interface, it can receive Option 15

from the DHCP server. This option replaces the domain name set with this

command.

Example To configure the domain name, enter the following commands:

awplus# configure terminal

awplus(config)# ip domain-name company.com

Commands

ip domain-list

show ip domain-list

show ip domain-name

C613-50292-01 Rev A Command Reference for IE210L Series 770

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

IP NAME-SERVER

ip name-server

Overview This command adds IPv4 or IPv6 DNS server addresses. The DNS client on your

device sends DNS queries to IP addresses in this list when trying to resolve a host

name. Host names cannot be resolved until you have added at least one server to

this list. A maximum of three name servers can be added to this list.

The no variant of this command removes the specified DNS name-server address.

Syntax ip name-server <ip-addr>

no ip name-server <ip-addr>

Mode Global Configuration

Usage To allow the device to operate as a DNS proxy, your device must have learned

about a DNS name-server to forward requests to. Name-servers can be learned

through the following means:

• Manual configuration, using the ip name-server command

• Learned from DHCP server with Option 6

This command is used to statically configure a DNS name-server for the device to

use.

The order that you enter the servers in, is the order in which they will be used.

Examples To allow a device to send DNS queries to a DNS server with the IPv4 address

10.10.10.5, use the commands:

awplus# configure terminal

awplus(config)# ip name-server 10.10.10.5

To enable your device to send DNS queries to a DNS server with the IPv6 address

2001:0db8:010d::1, use the commands:

awplus# configure terminal

awplus(config)# ip name-server 2001:0db8:010d::1

Commands

ip domain-list

ip domain-lookup

ip domain-name

Parameter Description

<ip-addr> The IP address of the DNS server that is being added to the name

server list. The address is entered in the form A.B.C.D for an IPv4

address, or in the form X:X::X:X for an IPv6 address.

The order that you enter the servers in, is the order in which they

will be used.

C613-50292-01 Rev A Command Reference for IE210L Series 771

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

IP NAME-SERVER

ip name-server

show ip name-server

C613-50292-01 Rev A Command Reference for IE210L Series 772

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

IP NAME-SERVER PREFERRED-ORDER

ip name-server preferred-order

Overview Use this command to choose between using statically-configured DNS servers or

dynamically-learned DNS servers.

Use the no variant of this command to set the DNS servers back to the default

setting of dynamic.

Syntax ip name-server preferred-order {dynamic|static}

no ip name-server preferred-order

Default dynamic

Mode Global Configuration

Usage This command is used to choose which DNS server set to use first. Select either the

dynamic or static parameter.

Examples To configure the preference to use static servers first, use the commands:

awplus# configure terminal

awplus(config)# ip name-server preferred-order static

To configure the preference to use dynamically-learned servers first, use the

commands:

awplus# configure terminal

awplus(config)# ip name-server preferred-order dynamic

awplus# configure terminal

awplus(config)# no ip name-server preferred-order

Commands

ip address dhcp

ip name-server

ipv6 address dhcp

show ip name-server

Command

changes

Version 5.4.9-0.1: command added

Parameter Description

dynamic Use dynamically learned DNS servers first.

static Use statically configured DNS servers first.

C613-50292-01 Rev A Command Reference for IE210L Series 773

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

SHOW HOSTS

show hosts

Overview This command shows the default domain, domain list, and name servers

configured on your device.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show hosts

Mode User Exec and Privileged Exec

Example To display the default domain, use the command:

awplus# show hosts

Output Figure 23-1: Example output from the show hosts command when no ip

domain-lookup is configured

Figure 23-2: Example output from the show hosts command when ip

domain-lookup is configured

Commands

ip domain-list

ip domain-lookup

ip domain-name

ip name-server

awplus#show hosts



Default domain is not set

Name/address lookup is disabled

awplus#show hosts



Default domain is mycompany.com

Domain list: company.com

Name/address lookup uses domain service

Name servers are 10.10.0.2 10.10.0.88

C613-50292-01 Rev A Command Reference for IE210L Series 774

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

SHOW IP DOMAIN-LIST

show ip domain-list

Overview This command shows the domains configured in the domain list. The DNS client

uses the domains in this list to append incomplete hostnames when sending a

DNS inquiry to a DNS server.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip domain-list

Mode User Exec and Privileged Exec

Example To display the list of domains in the domain list, use the command:

awplus# show ip domain-list

Output Figure 23-3: Example output from the show ip domain-list command

Commands

ip domain-list

ip domain-lookup

awplus#show ip domain-list

alliedtelesis.com

mycompany.com

C613-50292-01 Rev A Command Reference for IE210L Series 775

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

SHOW IP DOMAIN-NAME

show ip domain-name

Overview This command shows the default domain configured on your device. When there

are no entries in the DNS list, the DNS client appends this domain to incomplete

hostnames when sending a DNS inquiry to a DNS server.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip domain-name

Mode User Exec and Privileged Exec

Example To display the default domain configured on your device, use the command:

awplus# show ip domain-name

Output Figure 23-4: Example output from the show ip domain-name command

Commands

ip domain-name

ip domain-lookup

awplus#show ip domain-name

alliedtelesis.com

C613-50292-01 Rev A Command Reference for IE210L Series 776

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

DOMAIN NAME SERVICE (DNS) COMMANDS

SHOW IP NAME-SERVER

show ip name-server

Overview This command displays a list of IPv4 and IPv6 DNS server addresses that your

device will send DNS requests to. This is a static list configured using the ip

name-server command.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip name-server

Mode User Exec and Privileged Exec

Example To display the list of DNS servers that your device sends DNS requests to, use the

command:

awplus# show ip name-server

Output Figure 23-5: Example output from the show ip name-server command

Commands

ip domain-lookup

ip name-server

awplus# show ip name-server

10.10.0.123

10.10.0.124

2001:0db8:010d::1

C613-50292-01 Rev A Command Reference for IE210L Series 777

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPv6 Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

IPv6. For more information, see the IPv6 Feature Overview and Configuration

Guide.

Command List •“clear ipv6 neighbors” on page 779

•“ipv6 address” on page 780

•“ipv6 address autoconfig” on page 782

•“ipv6 address suffix” on page 784

•“ipv6 enable” on page 785

•“ipv6 eui64-linklocal” on page 787

•“ipv6 forwarding” on page 788

•“ipv6 multicast forward-slow-path-packet” on page 789

•“ipv6 nd accept-ra-pinfo” on page 790

•“ipv6 nd current-hoplimit” on page 791

•“ipv6 nd managed-config-flag” on page 792

•“ipv6 nd minimum-ra-interval” on page 793

•“ipv6 nd other-config-flag” on page 794

•“ipv6 nd prefix” on page 795

•“ipv6 nd ra-interval” on page 797

•“ipv6 nd ra-lifetime” on page 798

•“ipv6 nd raguard” on page 799

•“ipv6 nd reachable-time” on page 801

•“ipv6 nd retransmission-time” on page 802

C613-50292-01 Rev A Command Reference for IE210L Series 778

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

•“ipv6 nd suppress-ra” on page 803

•“ipv6 neighbor” on page 804

•“ipv6 opportunistic-nd” on page 805

•“ipv6 unreachables” on page 806

•“optimistic-nd” on page 807

•“ping ipv6” on page 808

•“show ipv6 forwarding” on page 810

•“show ipv6 interface brief” on page 811

•“show ipv6 neighbors” on page 812

•“show ipv6 route” on page 813

•“show ipv6 route summary” on page 815

•“traceroute ipv6” on page 816

C613-50292-01 Rev A Command Reference for IE210L Series 779

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

CLEAR IPV6 NEIGHBORS

clear ipv6 neighbors

Overview Use this command to clear all dynamic IPv6 neighbor entries.

Syntax clear ipv6 neighbors

Mode Privileged Exec

Example awplus# clear ipv6 neighbors

C613-50292-01 Rev A Command Reference for IE210L Series 780

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ADDRESS

ipv6 address

Overview Use this command to set the IPv6 address of an interface. The command also

enables IPv6 on the interface, which creates an EUI-64 link-local address as well as

enabling RA processing and SLAAC.

To stop the device from processing prefix information (routes and addresses from

the received Router Advertisements) use the command no ipv6 nd

accept-ra-pinfo.

To remove the EUI-64 link-local address, use the command no ipv6

eui64-linklocal.

Use the no variant of this command to remove the IPv6 address assigned and

disable IPv6. Note that if no global addresses are left after removing the IPv6

address then IPv6 is disabled.

Syntax ipv6 address <ipv6-addr/prefix-length>

no ipv6 address <ipv6-addr/prefix-length>

Mode Interface Configuration for a VLAN interface.

Usage Note that link-local addresses are retained in the system until they are negated by

using the no variant of the command that established them. See the ipv6 enable

command for more information.

Also note that the link-local address is retained in the system if the global address

is removed using another command, which was not used to establish the link-local

address. For example, if a link local address is established with the ipv6 enable

command then it will not be removed using a no ipv6 address command.

Examples To assign the IPv6 address 2001:0db8::a2/64 to the VLAN interface vlan2, use the

following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 address 2001:0db8::a2/64

To remove the IPv6 address 2001:0db8::a2/64 from the VLAN interface vlan2, use

the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 address 2001:0db8::a2/64

Parameter Description

<ipv6-addr/prefix-

length>Specifies the IPv6 address to be set. The IPv6

address uses the format X:X::X:X/Prefix-Length. The

prefix-length is usually set between 0 and 64.

C613-50292-01 Rev A Command Reference for IE210L Series 781

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ADDRESS

Commands

ipv6 address autoconfig

ipv6 address dhcp

ipv6 enable

ipv6 eui64-linklocal

show running-config

show ipv6 interface brief

C613-50292-01 Rev A Command Reference for IE210L Series 782

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ADDRESS AUTOCONFIG

ipv6 address autoconfig

Overview Use this command to enable IPv6 stateless address autoconfiguration (SLAAC) for

an interface. This configures an IPv6 address on an interface derived from the MAC

address on the interface.

Use the no variant of this command to disable IPv6 SLAAC on an interface. Note

that if no global addresses are left after removing all IPv6 autoconfigured

addresses then IPv6 is disabled.

Syntax ipv6 address autoconfig

no ipv6 address autoconfig

Mode Interface Configuration for a VLAN interface.

Usage This command enables automatic configuration of IPv6 addresses using stateless

autoconfiguration on an interface and enables IPv6.

IPv6 hosts can configure themselves when connected to an IPv6 network using

ICMPv6 (Internet Control Message Protocol version 6) router discovery messages.

Configured routers respond with a Router Advertisement (RA) containing

configuration parameters for IPv6 hosts.

The SLAAC process derives the interface identifier of the IPv6 address from the

MAC address of the interface. When applying SLAAC to an interface, note that the

MAC address of the default VLAN is applied to the interface if the interface does not

have its own MAC address.

Note that link-local addresses are retained in the system until they are negated by

using the no variant of the command that established them. See the ipv6 enable

command for more information.

Also note that the link-local address is retained in the system if the global address

is removed using another command that was not used to establish the link-local

address. For example, if a link local address is established with the ipv6 enable

command then it will not be removed using a no ipv6 address command.

Examples To enable SLAAC on vlan2, use the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 address autoconfig

To disable SLAAC on vlan2, use the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 address autoconfig

C613-50292-01 Rev A Command Reference for IE210L Series 783

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ADDRESS AUTOCONFIG

Commands

ipv6 address

ipv6 enable

show ipv6 interface brief

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 784

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ADDRESS SUFFIX

ipv6 address suffix

Overview Use this command to configure the suffix to use when generating an address from

prefix information. Any addresses that were created with the EUI-64 suffix will be

removed, and new addresses will be added after the next Router Advertisement.

Use the no variant of this command to set it back to the default of disabled or set

to :: for the same result as the no variant.

Syntax ipv6 address suffix <ipv6-addr-suffix>

no ipv6 address suffix

Default Disabled

Mode Interface Configuration

Example To configure the suffix to use when generating an address from prefix information

on vlan2, use the command:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 address suffix ::a2d8:0fd8

Commands

ipv6 nd accept-ra-pinfo

show running-config interface

Command

changes

Version 5.4.8-2.1: command added

Parameter Description

<ipv6-addr-suffix> In the format of ::X:X:X:X, for example ::a2d8:0fd8

C613-50292-01 Rev A Command Reference for IE210L Series 785

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ENABLE

ipv6 enable

Overview Use this command to enable automatic configuration of a link-local IPv6 address

on an interface using Stateless Automatic Address Configuration (SLAAC). By

default, the EUI-64 method is used to generate the link-local address.

Use the no variant of this command to disable IPv6 on an interface without a global

address. Note, to stop EUI-64 from generating the automatic link-local address, use

the command no ipv6 eui64-linklocal.

Syntax ipv6 enable

no ipv6 enable

Mode Interface Configuration for a VLAN interface.

Usage The ipv6 enable command automatically configures an IPv6 link-local address on

the interface and enables the interface for IPv6 processing.

A link-local address is an IP (Internet Protocol) address that is only used for

communications in the local network, or for a point-to-point connection. Routing

does not forward packets with link-local addresses. IPv6 requires that a link-local

address is assigned to each interface that has the IPv6 protocol enabled, and when

addresses are assigned to interfaces for routing IPv6 packets.

Note that link-local addresses are retained in the system until they are negated by

using the no variant of the command that established them.

Also note that the link-local address is retained in the system if the global address

is removed using another command that was not used to establish the link-local

address. For example, if a link local address is established with the ipv6 enable

command then it will not be removed using a no ipv6 address command.

Default All interfaces default to IPv6-down with no address.

Examples To enable IPv6 with only a link-local IPv6 address on the VLAN interface vlan2, use

the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 enable

To disable IPv6 with only a link-local IPv6 address on the VLAN interface vlan2, use

the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 enable

C613-50292-01 Rev A Command Reference for IE210L Series 786

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ENABLE

Commands

ipv6 address

ipv6 address autoconfig

ipv6 address dhcp

show ipv6 interface brief

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 787

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 EUI64-LINKLOCAL

ipv6 eui64-linklocal

Overview When IPv6 is enabled on an interface, an EUI link-local address is generated and

installed on the interface. In other words, ipv6 eui64-linklocal is enabled by

default on any IPv6 enabled interface.

Use the no variant of this command to disallow the automatic generation of the

EUI-64 link-local address on an IPv6 enabled interface.

Syntax ipv6 eui64-linklocal

no ipv6 eui64-linklocal

Default The command ipv6 eui64-linklocal is enabled by default on any IPv6 enabled

interface.

Mode Interface

Example To enable IPv6 on the interface vlan1, and use the link-local address of fe80 : :1/10

instead of the EUI-64 link-local that is automatically generated, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan1

awplus(config-if)# ipv6 enable

awplus(config-if)# no ipv6 eui64-linklocal

awplus(config-if)# ipv6 address fe80::1/10

Commands

ipv6 address

ipv6 address autoconfig

ipv6 enable

Command

changes

Version 5.4.7-0.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 788

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 FORWARDING

ipv6 forwarding

Overview Use this command to turn on IPv6 unicast routing for IPv6 packet forwarding.

Execute this command globally on your device prior to issuing ipv6 enable on

individual interfaces.

Use this no variant of this command to turn off IPv6 unicast routing. Note IPv6

unicast routing is disabled by default.

Syntax ipv6 forwarding

no ipv6 forwarding

Mode Global Configuration

Default IPv6 unicast forwarding is disabled by default.

Usage Enable IPv6 unicast forwarding globally for all interface on your device with this

command. Use the no variant of this command to disable IPv6 unicast forwarding

globally for all interfaces on your device.

IPv6 unicast forwarding allows devices to communicate with devices that are more

than one hop away, providing that there is a route to the destination address. If

IPv6 forwarding is not enabled then pings to addresses on devices that are more

than one hop away will fail, even if there is a route to the destination address.

Examples To enable IPv6 unicast routing, use this command as shown below:

awplus# configure terminal

awplus(config)# ipv6 forwarding

To disable IPv6 unicast routing, use the no variant of this command as shown

below:

awplus# configure terminal

awplus(config)# no ipv6 forwarding

Commands

ipv6 enable

C613-50292-01 Rev A Command Reference for IE210L Series 789

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 MULTICAST FORWARD-SLOW-PATH-PACKET

ipv6 multicast forward-slow-path-packet

Overview Use this command to enable multicast packets to be forwarded to the CPU.

Enabling this command will ensure that the layer L3 MTU is set correctly for each

IP multicast group and will apply the value of the smallest MTU among the

outgoing interfaces for the multicast group.

It will also ensure that a received packet that is larger than the MTU value will result

in the generation of an ICMP Too Big message.

Use the no variant of this command to disable the above functionality.

Syntax ipv6 multicast forward-slow-path-packet

no ipv6 multicast forward-slow-path-packet

Default Disabled.

Mode Privileged Exec

Example To enable the ipv6 multicast forward-slow-path-packet function, use the following

commands:

awplus# configure terminal

awplus(config)# ip multicast forward-slow-path-packet

Commands

show ipv6 forwarding

C613-50292-01 Rev A Command Reference for IE210L Series 790

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND ACCEPT-RA-PINFO

ipv6 nd accept-ra-pinfo

Overview Use this command to allow the processing of the prefix information included in a

received RA (Router Advertisement) on an IPv6 enabled interface.

Use the no variant of this command to disable an IPv6 interface from using the

prefix information within a received RA.

Syntax ipv6 nd accept-ra-pinfo

no ipv6 nd accept-ra-pinfo

Default The command ipv6 nd accept-ra-pinfo is enabled by default on any IPv6

interface.

Mode Interface

Usage By default, when IPv6 is enabled on an interface, SLAAC is also enabled. SLAAC

addressing along with the EUI-64 process, uses the prefix information included in

a received RA to generate an automatic link-local address on the IPv6 interface.

Note: an AlliedWare Plus device will, by default, add a prefix for the connected

interface IPv6 address(es) to the RA it transmits. However, this behavior can be

changed by using the command no ipv6 nd prefix auto-advertise, so there is no

guarantee that an RA will contain a prefix.

Example To enable IPv6 on vlan1 without installing a SLAAC address on the interface, use

the following commands:

awplus# configure terminal

awplus(config)# interface vlan1

awplus(config-if)# ipv6 enable

awplus(config-if)# no ipv6 nd accept-ra-pinfo

Commands

ipv6 address

ipv6 address autoconfig

ipv6 enable

Command

changes

Version 5.4.7-0.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 791

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND CURRENT-HOPLIMIT

ipv6 nd current-hoplimit

Overview Use this command to specify the advertised current hop limit used between IPv6

Routers.

Use the no variant of this command to reset the current advertised hop limit to its

default “0”.

Syntax ipv6 nd current-hoplimit <hoplimit>

no ipv6 nd current-hoplimit

Default 0 (No advertised current hop limit specified)

Mode Interface Configuration for a VLAN interface.

Examples To set the advertised current hop limit to 2 between IPv6 Routers on vlan2, use the

following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd current-hoplimit 2

To reset the advertised current hop limit to the default 0 on vlan2, use the

following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 nd current-hoplimit

Commands

ipv6 nd managed-config-flag

ipv6 nd prefix

ipv6 nd suppress-ra

Parameter Description

<hoplimit>Specifies the advertised current hop limit value.

Valid values are from 0 to 255 hops.

C613-50292-01 Rev A Command Reference for IE210L Series 792

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND MANAGED-CONFIG-FLAG

ipv6 nd managed-config-flag

Overview Use this command to set the managed address configuration flag, contained

within the router advertisement field.

Setting this flag indicates the operation of a stateful autoconfiguration protocol

such as DHCPv6 for address autoconfiguration, and that address information (i.e.

the network prefix) and other (non-address) information can be requested from

the device.

An unset flag enables hosts receiving the advertisements to use a stateless

autoconfiguration mechanism to establish their IPv6 addresses. The default is flag

unset.

Use the no variant of this command to reset this command to its default of having

the flag unset.

Syntax ipv6 nd managed-config-flag

no ipv6 nd managed-config-flag

Default Unset

Mode Interface Configuration for a VLAN interface.

Usage Advertisement flags will not be transmitted unless you have applied the ipv6 nd

suppress-ra command. This step is included in the example below.

Example To set the managed address configuration flag on the VLAN interface vlan2, use

the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd managed-config-flag

awplus(config-if)# no ipv6 nd suppress-ra

Commands

ipv6 nd suppress-ra

ipv6 nd prefix

ipv6 nd other-config-flag

C613-50292-01 Rev A Command Reference for IE210L Series 793

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND MINIMUM-RA-INTERVAL

ipv6 nd minimum-ra-interval

Overview Use this command in Interface Configuration mode to set a minimum Router

Advertisement (RA) interval for a VLAN interface.

Use the no variant of this command in Interface Configuration mode to remove the

minimum RA interval for a VLAN interface.

Syntax ipv6 nd minimum-ra-interval <seconds>

no ipv6 nd minimum-ra-interval

Default The RA interval for a VLAN interface is unset by default.

Mode Interface Configuration for a VLAN interface.

Examples To set the minimum RA interval for the VLAN interface vlan2, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd minimum-ra-interval 60

To remove the minimum RA interval for the VLAN interface vlan2, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 nd minimum-ra-interval

Commands

ipv6 nd ra-interval

ipv6 nd suppress-ra

ipv6 nd prefix

ipv6 nd other-config-flag

Parameter Description

<seconds>Specifies the number of seconds between IPv6 Router

Advertisements (RAs). Valid values are from 3 to 1350

seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 794

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND OTHER-CONFIG-FLAG

ipv6 nd other-config-flag

Overview Use this command to set the other stateful configuration flag (contained within

the router advertisement field) to be used for IPv6 address auto-configuration. This

flag is used to request the router to provide information in addition to providing

addresses.

Setting the ipv6 nd managed-config-flag command implies that the ipv6 nd

other-config-flag will also be set.

Use no variant of this command to reset the value to the default.

Syntax ipv6 nd other-config-flag

no ipv6 nd other-config-flag

Default Unset

Mode Interface Configuration for a VLAN interface.

Usage Advertisement flags will not be transmitted unless you have applied the ipv6 nd

suppress-ra command. This step is included in the example below.

Example To set the IPv6 other-config-flag on the VLAN interface vlan2, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd other-config-flag

awplus(config-if)# no ipv6 nd suppress-ra

Commands

ipv6 nd suppress-ra

ipv6 nd prefix

ipv6 nd managed-config-flag

C613-50292-01 Rev A Command Reference for IE210L Series 795

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND PREFIX

ipv6 nd prefix

Overview Use this command in Interface Configuration mode for a VLAN interface to specify

the IPv6 prefix information that is advertised by the router advertisement for IPv6

address auto-configuration.

Use the no parameter with this command to reset the IPv6 prefix for a VLAN

interface in Interface Configuration mode.

Syntax ipv6 nd prefix <ipv6-prefix/length>

ipv6 nd prefix <ipv6-prefix/length> [<valid-lifetime>]

ipv6 nd prefix <ipv6-prefix/length>

<valid-lifetime><preferred-lifetime> [no-autoconfig]

ipv6 nd prefix <ipv6-prefix/length>

<valid-lifetime><preferred-lifetime> off-link [no-autoconfig]

no ipv6 nd prefix [<ipv6-addr/prefix-length>|all]

Default Valid-lifetime default is 2592000 seconds (30 days). Preferred-lifetime default is

604800 seconds (7 days).

Mode Interface Configuration for a VLAN interface.

Parameter Description

<ipv6-prefix/

length> The prefix to be advertised by the router advertisement

message.

The IPv6 address prefix uses the format X:X::/prefix-length.

The prefix-length is usually set between 0 and 64. The

default is X:X::/64.

<valid-lifetime> The the period during which the specified IPv6 address

prefix is valid. This can be set to a value between 0 and

4294967295 seconds. The default is 2592000 (30 days).

Note that this period should be set to a value greater than

that set for the prefix preferred-lifetime.

<preferred-

lifetime> Specifies theIPv6 prefix preferred lifetime. This is the period

during which the IPv6 address prefix is considered a current

(undeprecated) value. After this period, the command is still

valid but should not be used in new communications. Set to

a value between 0 and 4294967295 seconds. The default is

604800 seconds (7 days).

Note that this period should be set to a value less than that

set for the prefix valid-lifetime.

off-link Specify the IPv6 prefix off-link flag. The default is flag set.

no-autoconfig Specify the IPv6 prefix no autoconfiguration flag. Setting

this flag indicates that the prefix is not to be used for

autoconfiguration. The default is flag set.

all Specify all IPv6 prefixes associated with the VLAN interface.

C613-50292-01 Rev A Command Reference for IE210L Series 796

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND PREFIX

Usage This command specifies the IPv6 prefix flags that are advertised by the router

advertisement message.

Examples To configure the device to issue router advertisements on vlan2, and advertise the

address prefix of 2001:0db8::/64, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd prefix 2001:0db8::/64

To configure the device to issue router advertisements on vlan2, and advertise the

address prefix of 2001:0db8::/64 with a valid lifetime of 10 days and a preferred

lifetime of 5 days, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd prefix 2001:0db8::/64 864000 432000

To configure the device to issue router advertisements on vlan2 and advertise the

address prefix of 2001:0db8::/64 with a valid lifetime of 10 days, a preferred lifetime

of 5 days, and no prefix used for autoconfiguration, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd prefix 2001:0db8::/64 864000 432000

no-autoconfig

To reset router advertisements on vlan2, so the address prefix of 2001:0db8::/64 is

not advertised from the device, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 nd prefix 2001:0db8::/64

To reset all router advertisements on vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 nd prefix all

Commands

ipv6 nd suppress-ra

C613-50292-01 Rev A Command Reference for IE210L Series 797

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND RA-INTERVAL

ipv6 nd ra-interval

Overview Use this command to specify the interval between IPv6 Router Advertisements

(RA) transmissions.

Use no parameter with this command to reset the value to the default value (600

seconds).

Syntax ipv6 nd ra-interval <seconds>

no ipv6 nd ra-interval

Default 600 seconds.

Mode Interface Configuration for a VLAN interface.

Usage Advertisement flags will not be transmitted unless you have applied the ipv6 nd

suppress-ra command as shown in the example below.

Example To set the advertisements interval on vlan2 to be 60 seconds, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd ra-interval 60

awplus(config-if)# no ipv6 nd suppress-ra

Commands

ipv6 nd minimum-ra-interval

ipv6 nd suppress-ra

ipv6 nd prefix

Parameter Description

<seconds>Specifies the number of seconds between IPv6 Router

Advertisements (RAs). Valid values are from 4 to 1800 seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 798

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND RA-LIFETIME

ipv6 nd ra-lifetime

Overview Use this command to specify the time period that this router can usefully act as a

default gateway for the network. Each router advertisement resets this time

period.

Use no parameter with this command to reset the value to default.

Syntax ipv6 nd ra-lifetime <seconds>

no ipv6 nd ra-lifetime

Default 1800 seconds

Mode Interface Configuration for a VLAN interface.

Usage This command specifies the lifetime of the current router to be announced in IPv6

Router Advertisements.

Advertisement flags will not be transmitted unless you have applied the ipv6 nd

suppress-ra command. This instruction is included in the example shown below.

Examples To set the advertisement lifetime of 8000 seconds on the VLAN interface vlan2, use

the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd ra-lifetime 8000

awplus(config-if)# no ipv6 nd suppress-ra

Commands

ipv6 nd suppress-ra

ipv6 nd prefix

Parameter Description

<seconds>Time period in seconds. Valid values are from 0 to 9000.

Note that you should set this time period to a value greater than the

value you have set using the ipv6 nd ra-interval command.

C613-50292-01 Rev A Command Reference for IE210L Series 799

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND RAGUARD

ipv6 nd raguard

Overview Use this command to apply the Router Advertisements (RA) Guard feature from the

Interface Configuration mode for a device port. This blocks all RA messages

received on a device port.

For more information about RA Guard, see the IPv6 Feature Overview and

Configuration Guide.

Use the no parameter with this command to disable RA Guard for a specified

device port.

Syntax ipv6 nd raguard

no ipv6 nd raguard

Default RA Guard is not disabled by default.

Mode Interface Configuration for a port.

Usage Router Advertisements (RAs) are used by Routers to announce themselves on the

link. Applying RA Guard to a device port disallows Router Advertisements and

redirect messages. RA Guard blocks RAs from untrusted hosts. Blocking RAs stops

untrusted hosts from flooding malicious RAs and stops any misconfigured hosts

from disrupting traffic on the local network.

Enabling RA Guard on a port blocks RAs from a connected host and indicates the

port and host are untrusted. Disabling RA Guard on a port allows RAs from a

connected host and indicates the port and host are trusted. Ports and hosts are

trusted by default to allow RAs.

Example To enable RA Guard on port1.0.1-port1.0.4, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1-port1.0.4

awplus(config-if)# ipv6 nd raguard

To verify RA Guard is enabled on port1.0.1, use the command:

awplus# show running-config interface port1.0.1

To disable RA Guard on port1.0.1-port1.0.4, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1-port1.0.4

awplus(config-if)# no ipv6 nd raguard

When RA Guard is disabled on a port it is not displayed in show running-config

output.

Output Example output from using show running-config interface port1.0.1 to verify RA

Guard:

C613-50292-01 Rev A Command Reference for IE210L Series 800

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND RAGUARD

Commands

show running-config interface

!

interface port1.0.1

switchport mode access



ipv6 nd raguard

C613-50292-01 Rev A Command Reference for IE210L Series 801

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND REACHABLE-TIME

ipv6 nd reachable-time

Overview Use this command to specify the reachable time in the router advertisement to be

used for detecting reachability of the IPv6 neighbor.

Use the no variant of this command to reset the value to default.

Syntax ipv6 nd reachable-time <milliseconds>

no ipv6 nd reachable-time

Default 0 milliseconds

Mode Interface Configuration for a VLAN interface.

Usage This command specifies the reachable time of the current router to be announced

in IPv6 Router Advertisements.

Advertisement flags will not be transmitted unless you have applied the ipv6 nd

suppress-ra command. This instruction is included in the example shown below.

Example To set the reachable-time in router advertisements on the VLAN interface vlan2 to

be 1800000 milliseconds, enter the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd reachable-time 1800000

awplus(config-if)# no ipv6 nd suppress-ra

To reset the reachable-time in router advertisements on the VLAN interface vlan2

to an unspecified reachable-time (0 milliseconds), enter the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 nd reachable-time

Commands

ipv6 nd suppress-ra

ipv6 nd prefix

Parameter Description

<milliseconds>Time period in milliseconds. Valid values are from 1000 to

3600000.

Setting this value to 0 indicates an unspecified reachable-time.

C613-50292-01 Rev A Command Reference for IE210L Series 802

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND RETRANSMISSION-TIME

ipv6 nd retransmission-time

Overview Use this command to specify the advertised retransmission interval for Neighbor

Solicitation in milliseconds between IPv6 Routers.

Use the no variant of this command to reset the retransmission time to the default

(1 second).

Syntax ipv6 nd retransmission-time <milliseconds>

no ipv6 nd retransmission-time

Default 1000 milliseconds (1 second)

Mode Interface Configuration for a VLAN interface.

Examples To set the retransmission-time of Neighbor Solicitation on the VLAN interface

vlan2 to be 800000 milliseconds, enter the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 nd retransmission-time 800000

To reset the retransmission-time of Neighbor Solicitation on the VLAN interface

vlan2 to the default 1000 milliseconds (1 second), enter the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 nd retransmission-time

Commands

ipv6 nd suppress-ra

ipv6 nd prefix

Parameter Description

<milliseconds>Time period in milliseconds. Valid values are from 1000 to

3600000.

C613-50292-01 Rev A Command Reference for IE210L Series 803

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 ND SUPPRESS-RA

ipv6 nd suppress-ra

Overview Use this command to inhibit IPv6 Router Advertisement (RA) transmission for the

current interface. Router advertisements are used when applying IPv6 stateless

auto-configuration.

Use no parameter with this command to enable Router Advertisement

transmission.

Syntax ipv6 nd suppress-ra

no ipv6 nd suppress-ra

Default Router Advertisement (RA) transmission is suppressed by default.

Mode Interface Configuration for a VLAN interface.

Example To enable the transmission of router advertisements from vlan2 on the device, use

the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 nd suppress-ra

Commands

ipv6 nd ra-interval

ipv6 nd prefix

C613-50292-01 Rev A Command Reference for IE210L Series 804

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 NEIGHBOR

ipv6 neighbor

Overview Use this command to add a static IPv6 neighbor entry.

Use the no variant of this command to remove a specific IPv6 neighbor entry.

Syntax ipv6 neighbor <ipv6-address> <vlan-name> <mac-address>

<port-list>

no ipv6 neighbor <ipv6-address> <vlan-name> <port-list>

Mode Global Configuration

Usage Use this command to clear a specific IPv6 neighbor entry. To clear all dynamic

address entries, use the clear ipv6 neighbors command.

Example To create a static neighbor entry for IPv6 address 2001:0db8::a2, on vlan2, with

MAC address 0000.cd28.0880, on port1.0.1, use the command:

awplus# configure terminal

awplus(config)# ipv6 neighbor 2001:0db8::a2 vlan2

0000.cd28.0880 port1.0.1

Commands

clear ipv6 neighbors

Parameter Description

<ipv6-address>Specify the neighbor’s IPv6 address in the format X:X::X:X.

<vlan-name>Specify the neighbor’s VLAN name.

<mac-address>Specify the MAC hardware address in hexadecimal notation in

the format HHHH.HHHH.HHHH.

<port-list> Specify the port number, or port range.

C613-50292-01 Rev A Command Reference for IE210L Series 805

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 OPPORTUNISTIC-ND

ipv6 opportunistic-nd

Overview Use this command to enable opportunistic neighbor discovery for the global IPv6

ND cache. Opportunistic neighbor discovery changes the behavior for unsolicited

ICMPv6 ND packet forwarding on the device.

Use the no variant of this command to disable opportunistic neighbor discovery

for the global IPv6 ND cache.

Syntax ipv6 opportunistic-nd

no ipv6 opportunistic-nd

Default Opportunistic neighbor discovery is disabled by default.

Mode Global Configuration

Usage When opportunistic neighbor discovery is enabled, the device will reply to any

received unsolicited ICMPv6 ND packets. The source MAC address for the

unsolicited ICMPv6 ND packet is added to the IPv6 ND cache, so the device

forwards the ICMPv6 ND packet. When opportunistic neighbor discovery is

disabled, the source MAC address for the ICMPv6 packet is not added to the IPv6

ND cache, so the ICMPv6 ND packet is not forwarded by the device.

Examples To enable opportunistic neighbor discovery for the IPv6 ND cache, enter:

awplus# configure terminal

awplus(config)# ipv6 opportunistic-nd

To disable opportunistic neighbor discovery for the IPv6 ND cache, enter:

awplus# configure terminal

awplus(config)# no ipv6 opportunistic-nd

Commands

arp opportunistic-nd

show ipv6 neighbors

show running-config interface

C613-50292-01 Rev A Command Reference for IE210L Series 806

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

IPV6 UNREACHABLES

ipv6 unreachables

Overview Use this command to enable ICMPv6 (Internet Control Message Protocol version 6)

type 1, destination unreachable, messages.

Use the no variant of this command to disable destination unreachable messages.

This prevents an attacker from using these messages to discover the topology of a

network.

Syntax ipv6 unreachables

no ipv6 unreachables

Default Destination unreachable messages are enabled by default.

Mode Global Configuration

Usage When a device receives a packet for a destination that is unreachable it returns an

ICMPv6 type 1 message. This message includes a reason code, as per the table

below. An attacker can use these messages to obtain information regarding the

topology of a network. Disabling destination unreachable messages, using the no

ipv6 unreachables command, secures your network against this type of probing.

NOTE: Disabling ICMPv6 destination unreachable messages breaks applications such

as traceroute, which depend on these messages to operate correctly.

Example To disable destination unreachable messages, use the commands

awplus# configure terminal

awplus(config)# no ipv6 unreachables

To enable destination unreachable messages, use the commands

awplus# configure terminal

awplus(config)# ipv6 unreachables

Table 24-1: ICMPv6 type 1 reason codes and description

Code Description [RFC]

0No route to destination [RFC4443]

1Communication with destination administratively prohibited [RFC4443]

2Beyond scope of source address [RFC4443]

3Address unreachable [RF4443]

4Port unreachable [RFC4443]

5Source address failed ingress/egress policy [RFC4443]

6Reject route to destination [RFC4443

7Error in Source Routing Header [RFC6554]

C613-50292-01 Rev A Command Reference for IE210L Series 807

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

OPTIMISTIC-ND

optimistic-nd

Overview Use this command to enable the optimistic neighbor discovery feature for both

IPv4 and IPv6.

Use the no variant of this command to disable the optimistic neighbor discovery

feature.

Syntax optimistic-nd

no optimistic-nd

Default The optimistic neighbor discovery feature is enabled by default.

Mode Interface Configuration for a VLAN interface.

Usage The optimistic neighbor discovery feature allows the device, after learning an IPv4

or IPv6 neighbor, to refresh the neighbor before the neighbor is deleted from the

hardware L3 switching table. The device puts the neighbour entry into the "stale"

state in the software switching table if is it not refreshed, then the 'stale' neighbors

are deleted from the hardware L3 switching table.

The optimistic neighbor discovery feature enables the device to sustain L3 traffic

switching to a neighbor without interruption. Without the optimistic neighbor

discovery feature enabled L3 traffic is interrupted when a neighbor is “stale” and is

then deleted from the L3 switching table.

If a neighbor receiving optimistic neighbor solicitations does not answer

optimistic neighbor solicitations with neighbor advertisements, then the neighbor

will be put into the “stale” state, and subsequently deleted from both the software

and the hardware L3 switching tables.

Examples To enable the optimistic neighbor discovery feature on vlan2, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# optimistic-nd

To disable the optimistic neighbor discovery feature on vlan2, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no optimistic-nd

Commands

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 808

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

PING IPV6

ping ipv6

Overview This command sends a query to another IPv6 host (send Echo Request messages).

Syntax ping ipv6 {<host>|<ipv6-address>} [repeat

{<1-2147483647>|continuous}] [size <10-1452>] [interface

<interface-list>] [timeout <1-65535>]

Mode User Exec and Privileged Exec

Example awplus# ping ipv6 2001:0db8::a2

Parameter Description

<ipv6-addr> The destination IPv6 address. The IPv6 address uses the

format X:X::X:X.

<hostname>The destination hostname.

repeat Specify the number of ping packets to send.

<1-2147483647> Specify repeat count. The default is 5.

size <10-1452> The number of data bytes to send, excluding the 8 byte ICMP

header. The default is 56 (64 ICMP data bytes).

interface

<interface-list> The interface or range of configured IP interfaces to use as the

source in the IP header of the ping packet. The interface can

be one of:

•a VLAN (e.g. vlan2)

• the loopback interface (lo)

• a continuous range of interfaces separated by a hyphen

(e.g. vlan10-20)

• a comma-separated list (e.g. vlan1,vlan10-20). Do not mix

interface types in a list.

You can only specify the interface when pinging a link local

address.

timeout

<1-65535> The time in seconds to wait for echo replies if the ARP entry is

present, before reporting that no reply was received. If no ARP

entry is present, it does not wait.

repeat Specify the number of ping packets to send.

<1-2147483647> Specify repeat count. The default is 5.

continuous Continuous ping.

size <10-1452> The number of data bytes to send, excluding the 8 byte ICMP

header. The default is 56 (64 ICMP data bytes).

timeout

<1-65535> The time in seconds to wait for echo replies if the ARP entry is

present, before reporting that no reply was received. If no ARP

entry is present, it does not wait.

C613-50292-01 Rev A Command Reference for IE210L Series 809

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

PING IPV6

Commands

traceroute ipv6

C613-50292-01 Rev A Command Reference for IE210L Series 810

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

SHOW IPV6 FORWARDING

show ipv6 forwarding

Overview Use this command to display IPv6 forwarding status.

Syntax show ipv6 forwarding

Mode User Exec and Privileged Exec

Example awplus# show ipv6 forwarding

Output Figure 24-1: Example output from the show ipv6 forwarding command



ipv6 forwarding is on

C613-50292-01 Rev A Command Reference for IE210L Series 811

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

SHOW IPV6 INTERFACE BRIEF

show ipv6 interface brief

Overview Use this command to display brief information about interfaces and the IPv6

address assigned to them.

For information on filtering and saving command output, see the “Getting_Started

with AlliedWare Plus” Feature Overview and Configuration_Guide.

Syntax show ipv6 interface [brief]

Mode User Exec and Privileged Exec

Examples awplus# show ipv6 interface brief

Output Figure 24-2: Example output from the show ipv6 interface brief command

Commands

show interface brief

Parameter Description

brief Specify this optional parameter to display brief IPv6 interface

information.

awplus#show ipv6 interface brief

Interface IPv6-Address Status Protocol

lo unassigned admin up running

vlan1 2001:db8::1/48 admin up down

fe80::215:77ff:fee9:5c50/64

C613-50292-01 Rev A Command Reference for IE210L Series 812

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

SHOW IPV6 NEIGHBORS

show ipv6 neighbors

Overview Use this command to display all IPv6 neighbors.

For information on filtering and saving command output, see the “Getting_Started

with AlliedWare Plus” Feature Overview and Configuration_Guide.

Syntax show ipv6 neighbors

Mode User Exec and Privileged Exec

C613-50292-01 Rev A Command Reference for IE210L Series 813

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

SHOW IPV6 ROUTE

show ipv6 route

Overview Use this command to display the IPv6 routing table for a protocol or from a

particular table.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ipv6 route

<ipv6-addr/prefix-length>)]

Mode User Exec and Privileged Exec

Example To display an IP route with all parameters turned on, use the following command:

awplus# show ipv6 route

To display all database entries for an IP route, use the following command:

awplus# show ipv6 route database

Parameter Description

connected Displays only the routes learned from connected

interfaces.

database Displays only the IPv6 routing information extracted

from the database.

static Displays only the IPv6 static routes you have configured.

summary Displays summary information from the IPv6 routing

table.

<ipv6-address> Displays the routes for the specified address in the IP

routing table. The IPv6 address uses the format

X:X::X:X/Prefix-Length. The prefix-length is usually set

between 0 and 64.

<ipv6-prefix/length> Displays only the routes for the specified IP prefix.

C613-50292-01 Rev A Command Reference for IE210L Series 814

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

SHOW IPV6 ROUTE

Output Figure 24-3: Example output of the show ipv6 route command

Output Figure 24-4: Example output of the show ipv6 route database command



IPv6 Routing Table

Codes: C - connected, S - static, R - RIP, O - OSPF, B - BGP

S ::/0 [1/0] via 2001::a:0:0:c0a8:a6, vlan10

C 2001:db8::a:0:0:0:0/64 via ::, vlan10

C 2001:db8::14:0:0:0:0/64 via ::, vlan20

C 2001:db8::0:0:0:0/64 via ::, vlan30

C 2001:db8::28:0:0:0:0/64 via ::, vlan40

C 2001:db8::fa:0:0:0:0/64 via ::, vlan250

C 2001:db8::/64 via ::, vlan250

C 2001:db8::/64 via ::, vlan40

C 2001:db8::/64 via ::, vlan20

C 2001:db8::/64 via ::, vlan10



IPv6 Routing Table

Codes: C - connected, S - static, R - RIP, O - OSPF, B - BGP

> - selected route, * - FIB route, p - stale info

Timers: Uptime



S ::/0 [1/0] via 2001::a:0:0:c0a8:a01 inactive, 6d22h12m

[1/0] via 2001::fa:0:0:c0a8:fa01 inactive, 6d22h12m

C613-50292-01 Rev A Command Reference for IE210L Series 815

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

SHOW IPV6 ROUTE SUMMARY

show ipv6 route summary

Overview Use this command to display the summary of the current NSM RIB entries.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ipv6 route summary

Mode User Exec and Privileged Exec

Example To display IP route summary, use the following command:

awplus# show ipv6 route summary

Output Figure 24-5: Example output from the show ipv6 route summary command

Commands

show ip route database

IPv6 routing table name is Default-IPv6-Routing-Table(0)

IPv6 routing table maximum-paths is 4

RouteSource Networks

connected 4

rip 5

Total 9

FIB 5

C613-50292-01 Rev A Command Reference for IE210L Series 816

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 COMMANDS

TRACEROUTE IPV6

traceroute ipv6

Overview Use this command to trace the route to the specified IPv6 host.

Syntax traceroute ipv6 {<ipv6-addr>|<hostname>}

Mode User Exec and Privileged Exec

Example To run a traceroute for the IPv6 address 2001:0db8::a2, use the following

command:

awplus# traceroute ipv6 2001:0db8::a2

Commands

ping ipv6

Parameter Description

<ipv6-addr> The destination IPv6 address. The IPv6 address uses the format

X:X::X:X.

<hostname>The destination hostname.

C613-50292-01 Rev A Command Reference for IE210L Series 817

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Routing Commands

Introduction

Overview This chapter provides an alphabetical reference of routing commands that are

common across the routing IP protocols. For more information, see the Route

Selection Feature Overview and Configuration Guide.

Command List •“ip route” on page 818

•“ipv6 route” on page 820

•“maximum-paths” on page 821

•“show ip route” on page 822

•“show ip route database” on page 824

•“show ip route summary” on page 825

•“show ipv6 route” on page 826

•“show ipv6 route summary” on page 828

C613-50292-01 Rev A Command Reference for IE210L Series 818

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

IP ROUTE

ip route

Overview This command adds a static route to the Routing Information Base (RIB). If this

route is the best route for the destination, then your device adds it to the

Forwarding Information Base (FIB). Your device uses the FIB to advertise routes to

neighbors and forward packets.

The no variant of this command removes the static route from the RIB and FIB.

Syntax ip route <subnet&mask> {<gateway-ip>|<interface>} [<distance>]

no ip route <subnet&mask> {<gateway-ip>|<interface>}

[<distance>]

Mode Global Configuration

Default The default administrative distance for a static route is 1.

Usage You can use administrative distance to determine which routes take priority over

other routes.

Examples To add the destination 192.168.3.0 with the mask 255.255.255.0 as a static route

available through the device at “10.10.0.2” with the default administrative

distance, use the commands:

awplus# configure terminal

awplus(config)# ip route 192.168.3.0 255.255.255.0 10.10.0.2

Parameter Description

<subnet&mask>The IPv4 address of the destination subnet defined using either a

prefix length or a separate mask specified in one of the following

formats:

• The IPv4 subnet address in dotted decimal notation followed by

the subnet mask, also in dotted decimal notation.

• The IPv4 subnet address in dotted decimal notation, followed

by a forward slash, then the prefix length

<gateway-ip>The IPv4 address of the gateway device.

<interface>The interface that connects your device to the network. Enter the

name of the VLAN or its VID.

The gateway IP address or the interface is required.

<distance>The administrative distance for the static route in the range

<1-255>. Static routes by default have an administrative distance

of 1, which gives them the highest priority possible.

C613-50292-01 Rev A Command Reference for IE210L Series 819

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

IP ROUTE

To remove the destination 192.168.3.0 with the mask 255.255.255.0 as a static

route available through the device at “10.10.0.2” with the default administrative

distance, use the commands:

awplus# configure terminal

awplus(config)# no ip route 192.168.3.0 255.255.255.0 10.10.0.2

To add the destination 192.168.3.0 with the mask 255.255.255.0 as a static route

available through the device at “10.10.0.2” with an administrative distance of 128,

use the commands:

awplus# configure terminal

awplus(config)# ip route 192.168.3.0 255.255.255.0 10.10.0.2

128

Commands

show ip route

show ip route database

C613-50292-01 Rev A Command Reference for IE210L Series 820

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

IPV6 ROUTE

ipv6 route

Overview This command adds a static IPv6 route to the Routing Information Base (RIB). If this

route is the best route for the destination, then your device adds it to the

Forwarding Information Base (FIB). Your device uses the FIB to advertise routes to

neighbors and forward packets.

The no variant of this command removes the static route.

Syntax ipv6 route <dest-prefix> <dest-prefix/length>

{<gateway-ip>|<gateway-name>} [<distvalue>]

no ipv6 route <dest-prefix> <dest-prefix/length>

{<gateway-ip>|<gateway-name>} [<distvalue>]

Mode Global Configuration

Usage You can use administrative distance to determine which routes take priority over

other routes.

Example awplus# configure terminal

awplus(config)# ipv6 route 2001:0db8::1/128 vlan2 32

Validation

Commands

show running-config

show ipv6 route

Parameter Description

<dest-prefix/

length>Specifies the IP destination prefix.

The IPv6 address prefix uses the format X:X::/prefix-length.

The prefix-length is usually set between 0 and 64.

<gateway-ip>Specifies the IP gateway (or next hop) address. The IPv6

address uses the format X:X::X:X/Prefix-Length. The

prefix-length is usually set between 0 and 64.

<gateway-name>Specifies the name of the gateway (or next hop) interface.

<distvalue>Specifies the administrative distance for the route. Valid

values are from 1 to 255.

C613-50292-01 Rev A Command Reference for IE210L Series 821

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

MAXIMUM-PATHS

maximum-paths

Overview This command enables ECMP on your device, and sets the maximum number of

paths that each route has in the Forwarding Information Base (FIB). ECMP is

enabled by default.

The no variant of this command sets the maximum paths to the default of 4.

Syntax maximum-paths <1-8>

no maximum-paths

Default By default the maximum number of paths is 4.

Mode Global Configuration

Examples To set the maximum number of paths for each route in the FIB to 5, use the

command:

awplus# configure terminal

awplus(config)# maximum-paths 5

To set the maximum paths for a route to the default of 4, use the command:

awplus# configure terminal

awplus(config)# no maximum-paths

Parameter Description

<1-8> The maximum number of paths that a route can have in the FIB.

C613-50292-01 Rev A Command Reference for IE210L Series 822

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

SHOW IP ROUTE

show ip route

Overview Use this command to display routing entries in the FIB (Forwarding Information

Base). The FIB contains the best routes to a destination, and your device uses these

routes when forwarding traffic. You can display a subset of the entries in the FIB

based on protocol.

To modify the lines displayed, use the | (output modifier token); to save the output

to a file, use the > output redirection token.

Syntax show ip route [connected|static|<ip-addr>|

<ip-addr/prefix-length>]

Mode User Exec and Privileged Exec

Example To display the static routes in the FIB, use the command:

awplus# show ip route static

Output Each entry in the output from this command has a code preceding it, indicating the

source of the routing entry. The first few lines of the output list the possible codes

that may be seen with the route entries.

Typically, route entries are composed of the following elements:

•code

• a second label indicating the sub-type of the route

• network or host IP address

• administrative distance and metric

• next hop IP address

• outgoing interface name

• time since route entry was added

Parameter Description

connected Displays only the routes learned from connected

interfaces.

static Displays only the static routes you have configured.

<ip-addr> Displays the routes for the specified address. Enter

an IPv4 address.

<ip-addr/prefix-length> Displays the routes for the specified network. Enter

an IPv4 address and prefix length.

C613-50292-01 Rev A Command Reference for IE210L Series 823

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

SHOW IP ROUTE

Figure 25-1: Example output from the show ip route command

Connected Route The connected route entry consists of:

This route entry denotes:

• Route entries for network 10.10.31.0/24 are derived from the IP address of

local interface vlan2.

• These routes are marked as Connected routes (C) and always preferred over

routes for the same network learned from other routing protocols.

Commands

ip route

maximum-paths

show ip route database

Codes: C - connected, S - static, R - RIP, B - BGP

O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

* - candidate default



C 3.3.3.0/24 is directly connected, vlan1

C 10.10.31.0/24 is directly connected, vlan2

C 10.70.0.0/24 is directly connected, vlan4

C 33.33.33.33/32 is directly connected, lo

C 10.10.31.0/24 is directly connected, vlan2

C613-50292-01 Rev A Command Reference for IE210L Series 824

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

SHOW IP ROUTE DATABASE

show ip route database

Overview This command displays the routing entries in the RIB (Routing Information Base).

When multiple entries are available for the same prefix, RIB uses the routes’

administrative distances to choose the best route. All best routes are entered into

the FIB (Forwarding Information Base). To view the routes in the FIB, use the show

ip route command.

To modify the lines displayed, use the | (output modifier token); to save the output

to a file, use the > output redirection token.

Syntax show ip route database [connected|static]

Mode User Exec and Privileged Exec

Example To display the static routes in the RIB, use the command:

awplus# show ip route database static

Output Figure 25-2: Example output from the show ip route database command

Commands

maximum-paths

show ip route

Parameter Description

connected Displays only the routes learned from connected interfaces.

static Displays only the static routes you have configured.

awplus#show ip route database

Codes: C - connected, S - static, R - RIP, B - BGP

O - OSPF, D - DHCP, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

> - selected route, * - FIB route, p - stale info



S *> 0.0.0.0/0 [1/0] via 10.34.1.1, vlan1

C *> 10.34.0.0/16 is directly connected, vlan1

S 192.168.2.0/24 [1/0] is directly connected, vlan2 inactive



Gateway of last resort is not set

C613-50292-01 Rev A Command Reference for IE210L Series 825

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

SHOW IP ROUTE SUMMARY

show ip route summary

Overview This command displays a summary of the current RIB (Routing Information Base)

entries.

To modify the lines displayed, use the | (output modifier token); to save the output

to a file, use the > output redirection token.

Syntax show ip route summary

Mode User Exec and Privileged Exec

Example To display a summary of the current RIB entries, use the command:

awplus# show ip route summary

Output Figure 25-3: Example output from the show ip route summary command

Commands

show ip route

show ip route database

IP routing table name is Default-IP-Routing-Table(0)

IP routing table maximum-paths is 4

Route Source Networks

connected 5

Total 8

C613-50292-01 Rev A Command Reference for IE210L Series 826

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

SHOW IPV6 ROUTE

show ipv6 route

Overview Use this command to display the IPv6 routing table for a protocol or from a

particular table.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ipv6 route

<ipv6-addr/prefix-length>)]

Mode User Exec and Privileged Exec

Example To display an IP route with all parameters turned on, use the following command:

awplus# show ipv6 route

To display all database entries for an IP route, use the following command:

awplus# show ipv6 route database

Parameter Description

connected Displays only the routes learned from connected

interfaces.

database Displays only the IPv6 routing information extracted

from the database.

static Displays only the IPv6 static routes you have configured.

summary Displays summary information from the IPv6 routing

table.

<ipv6-address> Displays the routes for the specified address in the IP

routing table. The IPv6 address uses the format

X:X::X:X/Prefix-Length. The prefix-length is usually set

between 0 and 64.

<ipv6-prefix/length> Displays only the routes for the specified IP prefix.

C613-50292-01 Rev A Command Reference for IE210L Series 827

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

SHOW IPV6 ROUTE

Output Figure 25-4: Example output of the show ipv6 route command

Output Figure 25-5: Example output of the show ipv6 route database command



IPv6 Routing Table

Codes: C - connected, S - static, R - RIP, O - OSPF, B - BGP

S ::/0 [1/0] via 2001::a:0:0:c0a8:a6, vlan10

C 2001:db8::a:0:0:0:0/64 via ::, vlan10

C 2001:db8::14:0:0:0:0/64 via ::, vlan20

C 2001:db8::0:0:0:0/64 via ::, vlan30

C 2001:db8::28:0:0:0:0/64 via ::, vlan40

C 2001:db8::fa:0:0:0:0/64 via ::, vlan250

C 2001:db8::/64 via ::, vlan250

C 2001:db8::/64 via ::, vlan40

C 2001:db8::/64 via ::, vlan20

C 2001:db8::/64 via ::, vlan10



IPv6 Routing Table

Codes: C - connected, S - static, R - RIP, O - OSPF, B - BGP

> - selected route, * - FIB route, p - stale info

Timers: Uptime



S ::/0 [1/0] via 2001::a:0:0:c0a8:a01 inactive, 6d22h12m

[1/0] via 2001::fa:0:0:c0a8:fa01 inactive, 6d22h12m

C613-50292-01 Rev A Command Reference for IE210L Series 828

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

ROUTING COMMANDS

SHOW IPV6 ROUTE SUMMARY

show ipv6 route summary

Overview Use this command to display the summary of the current NSM RIB entries.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ipv6 route summary

Mode User Exec and Privileged Exec

Example To display IP route summary, use the following command:

awplus# show ipv6 route summary

Output Figure 25-6: Example output from the show ipv6 route summary command

Commands

show ip route database

IPv6 routing table name is Default-IPv6-Routing-Table(0)

IPv6 routing table maximum-paths is 4

RouteSource Networks

connected 4

rip 5

Total 9

FIB 5

C613-50292-01 Rev A Command Reference for IE210L Series 829

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Part 4: Multicast Applications

C613-50292-01 Rev A Command Reference for IE210L Series 830

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP and IGMP

Snooping

Commands

Introduction

Overview Devices running AlliedWare Plus use IGMP (Internet Group Management Protocol)

and MLD (Multicast Listener Discovery) to track which multicast groups their clients

belong to. This enables them to send the correct multimedia streams to the correct

destinations. IGMP is used for IPv4 multicasting, and MLD is used for IPv6

multicasting.

This chapter describes the commands to configure IGMP Querier behaviour and

selection and IGMP Snooping.

Command List •“clear ip igmp” on page 832

•“clear ip igmp group” on page 833

•“clear ip igmp interface” on page 834

•“debug igmp” on page 835

•“ip igmp” on page 836

•“ip igmp access-group” on page 837

•“ip igmp flood specific-query” on page 838

•“ip igmp immediate-leave” on page 839

•“ip igmp last-member-query-count” on page 840

•“ip igmp last-member-query-interval” on page 841

•“ip igmp limit” on page 842

•“ip igmp maximum-groups” on page 843

•“ip igmp querier-timeout” on page 845

•“ip igmp query-holdtime” on page 846

•“ip igmp query-interval” on page 848

•“ip igmp query-max-response-time” on page 850

C613-50292-01 Rev A Command Reference for IE210L Series 831

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

•“ip igmp ra-option” on page 852

•“ip igmp robustness-variable” on page 853

•“ip igmp snooping” on page 854

•“ip igmp snooping fast-leave” on page 855

•“ip igmp snooping mrouter” on page 856

•“ip igmp snooping querier” on page 857

•“ip igmp snooping report-suppression” on page 858

•“ip igmp snooping routermode” on page 859

•“ip igmp snooping source-timeout” on page 861

•“ip igmp snooping tcn query solicit” on page 862

•“ip igmp source-address-check” on page 864

•“ip igmp static-group” on page 865

•“ip igmp startup-query-count” on page 867

•“ip igmp startup-query-interval” on page 868

•“ip igmp trusted” on page 869

•“ip igmp version” on page 870

•“show debugging igmp” on page 871

•“show ip igmp groups” on page 872

•“show ip igmp interface” on page 874

•“show ip igmp snooping mrouter” on page 876

•“show ip igmp snooping routermode” on page 877

•“show ip igmp snooping source-timeout” on page 878

•“show ip igmp snooping statistics” on page 879

•“undebug igmp” on page 881

C613-50292-01 Rev A Command Reference for IE210L Series 832

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

CLEAR IP IGMP

clear ip igmp

Overview Use this command to clear all IGMP group membership records on all VLAN

interfaces.

Syntax clear ip igmp

Mode Privileged Exec

Example awplus# clear ip igmp

Commands

clear ip igmp group

clear ip igmp interface

show ip igmp interface

show running-config

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

C613-50292-01 Rev A Command Reference for IE210L Series 833

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

CLEAR IP IGMP GROUP

clear ip igmp group

Overview Use this command to clear IGMP group membership records for a specific group

on either all interfaces, a single interface, or for a range of interfaces.

Syntax clear ip igmp group *

clear ip igmp group <ip-address> <interface>

Mode Privileged Exec

Usage This command applies to groups learned by IGMP or IGMP Snooping.

In addition to the group, an interface can be specified. Specifying this will mean

that only entries with the group learned on the interface will be deleted.

Examples To delete all group records, use the command:

awplus# clear ip igmp group *

To delete records for 224.1.1.1 on vlan1, use the command:

awplus# clear ip igmp group 224.1.1.1 vlan1

Commands

clear ip igmp

clear ip igmp interface

show ip igmp interface

show running-config

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

Parameter Description

*Clears all groups on all interfaces. This has the same effect as the

clear ip igmp command.

<ip-address> Specifies the group whose membership records will be cleared

from all interfaces, entered in the form A.B.C.D.

<interface>Specifies the name of the interface; all groups learned on this

interface are deleted.

C613-50292-01 Rev A Command Reference for IE210L Series 834

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

CLEAR IP IGMP INTERFACE

clear ip igmp interface

Overview Use this command to clear IGMP group membership records on a particular

interface.

Syntax clear ip igmp interface <interface>

Mode Privileged Exec

Usage This command applies to interfaces configured for IGMP or IGMP Snooping.

Example To delete records for vlan1, use the command:

awplus# clear ip igmp interface vlan1

Commands

clear ip igmp

clear ip igmp group

show ip igmp interface

show running-config

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

Parameter Description

<interface>Specifies the name of the interface. All groups learned on this

interface are deleted.

C613-50292-01 Rev A Command Reference for IE210L Series 835

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

DEBUG IGMP

debug igmp

Overview Use this command to enable debugging of either all IGMP or a specific component

of IGMP.

Use the no variant of this command to disable all IGMP debugging, or debugging

of a specific component of IGMP.

Syntax debug igmp {all|decode|encode|events|fsm|tib}

no debug igmp {all|decode|encode|events|fsm|tib}

Modes Privileged Exec and Global Configuration

Example awplus# configure terminal

awplus(config)# debug igmp all

Commands

show debugging igmp

undebug igmp

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

Parameter Description

all Enable or disable all debug options for IGMP

decode Debug of IGMP packets that have been received

encode Debug of IGMP packets that have been sent

events Debug IGMP events

fsm Debug IGMP Finite State Machine (FSM)

tib Debug IGMP Tree Information Base (TIB)

C613-50292-01 Rev A Command Reference for IE210L Series 836

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP

ip igmp

Overview Use this command to enable IGMP on an interface. The command configures the

device as an IGMP querier.

Use the no variant of this command to return all IGMP related configuration to the

default on this interface.

Syntax ip igmp

no ip igmp

Default Disabled

Mode Interface Configuration for a VLAN interface.

Usage An IP address must be assigned to the interface first, before this command will

work.

Example To specify an interface as an IGMP querier, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp

Validation

Commands

show ip igmp interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 837

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP ACCESS-GROUP

ip igmp access-group

Overview This command adds an access control list to a VLAN interface configured for IGMP

or IGMP Snooping. The access control list is used to control and filter the multicast

groups learned on the VLAN interface.

The no variant of this command disables the access control filtering on the

interface.

Syntax ip igmp access-group {<access-list-number>|<access-list-name>}

no ip igmp access-group

Default By default there are no access lists configured on any interface.

Mode Interface Configuration for a VLAN interface.

Usage This command applies to VLAN interfaces configured for IGMP or IGMP Snooping.

Example In the following example, hosts serviced by VLAN interface vlan2 can only join the

group 225.2.2.2:

awplus# configure terminal

awplus(config)# access-list 1 permit 225.2.2.2 0.0.0.0

awplus(config)# interface vlan2

awplus(config-if)# ip igmp access-group 1

Parameter Description

<access-list-number>Standard IP access-list number, in the range <1-99>.

<access-list-name>Standard IP access-list name.

C613-50292-01 Rev A Command Reference for IE210L Series 838

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP FLOOD SPECIFIC-QUERY

ip igmp flood specific-query

Overview Use this command if you want IGMP to flood specific queries to all VLAN member

ports, instead of only sending the queries to multicast group member ports.

Use the no variant of this command if you want IGMP to only send the queries to

multicast group member ports.

Syntax ip igmp flood specific-query

no ip igmp flood specific-query

Default By default, specific queries are flooded to all VLAN member ports.

Mode Global Configuration

Usage In an L2 switched network running IGMP, it is considered more robust to flood all

specific queries. In most cases, the benefit of flooding specific queries to all VLAN

member ports outweighs the disadvantages.

However, sometimes this is not the case. For example, if hosts with very low CPU

capability receive specific queries for multicast groups they are not members of,

their performance may degrade unacceptably. In this situation, it is desirable for

IGMP to send specific queries to known member ports only. This minimizes the

performance degradation of such hosts. In those circumstances, use this

command to turn off flooding of specific queries.

Example To cause IGMP to flood specific queries only to multicast group member ports, use

the commands:

awplus# configure terminal

awplus(config)# no ip igmp flood specific-query

Commands

show ip igmp interface

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

C613-50292-01 Rev A Command Reference for IE210L Series 839

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP IMMEDIATE-LEAVE

ip igmp immediate-leave

Overview In IGMP version 2, use this command to minimize the leave latency of IGMP

memberships for specified multicast groups. The specified access list number or

name defines the multicast groups in which the immediate leave feature is

enabled.

Use the no variant of this command to disable this feature.

Syntax ip igmp immediate-leave group-list

{<access-list-number>|<access-list-number-expanded>|

<access-list-name>}

no ip igmp immediate-leave

Default Disabled by default.

Mode Interface Configuration for a VLAN interface.

Usage This command applies to VLAN interfaces configured for IGMP or IGMP Snooping.

Example The following example shows how to enable the immediate-leave feature on the

VLAN interface vlan2 for a specific range of multicast groups:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp immediate-leave group-list 34

awplus(config-if)# exit

awplus(config)# access-list 34 permit 225.192.20.0 0.0.0.255

Commands

ip igmp last-member-query-interval

Parameter Description

<access-list-number>Access-list number, in the range <1-99>.

<access-list-number-expanded>Access-list number (expanded range), in

the range <1300-1999>.

<access-list-name>Standard IP access-list name.

C613-50292-01 Rev A Command Reference for IE210L Series 840

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP LAST-MEMBER-QUERY-COUNT

ip igmp last-member-query-count

Overview Use this command to set the last-member query-count value for an interface.

Use the no variant of this command to return to the default on an interface.

Syntax ip igmp last-member-query-count <2-7>

no ip igmp last-member-query-count

Default The default last member query count value is 2.

Mode Interface Configuration for a VLAN interface.

Usage This command applies to VLAN interfaces configured for IGMP or IGMP Snooping.

Example To set the last-member query-count to 3 on vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp last-member-query-count 3

Commands

ip igmp last-member-query-interval

ip igmp startup-query-count

show ip igmp interface

show running-config

Parameter Description

<2-7>Last member query count value.

C613-50292-01 Rev A Command Reference for IE210L Series 841

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP LAST-MEMBER-QUERY-INTERVAL

ip igmp last-member-query-interval

Overview Use this command to configure the frequency at which the router sends IGMP

group specific host query messages.

Use the no variant of this command to set this frequency to the default.

Syntax ip igmp last-member-query-interval <interval>

no ip igmp last-member-query-interval

Default 1000 milliseconds

Mode Interface Configuration for a VLAN interface.

Usage This command applies to VLAN interfaces configured for IGMP or IGMP Snooping.

Example To change the IGMP group-specific host query message interval to 2 seconds

(2000 milliseconds) on vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp last-member-query-interval 2000

Commands

ip igmp last-member-query-count

show ip igmp interface

show running-config

Parameter Description

<interval>The frequency in milliseconds at which IGMP group-specific host

query messages are sent, in the range 1000-25500.

C613-50292-01 Rev A Command Reference for IE210L Series 842

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP LIMIT

ip igmp limit

Overview Use this command to configure the limit on the maximum number of group

membership entries for the device as a whole or for the specified interface (if in

interface mode). Once the specified number of group memberships is reached, all

further membership reports will be ignored.

Optionally, you can configure an access-list to stop certain addresses from being

subject to the limit.

Use the no variant of this command to unset the limit and any specified exception

access-list.

Syntax ip igmp limit <limit-value> [except

{<access-list-number>|<access-list-number-extended>|

<access-list-name>}]

no ip igmp limit

Default The default limit, which is reset by the no variant of this command, is 512.

Mode Global Configuration and Interface Configuration for a VLAN interface.

Usage This command applies to VLAN interfaces configured for IGMP or IGMP Snooping.

Example To configure an IGMP limit of 100 group membership entries on vlan2, use the

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp limit 100

To configure an IGMP limit of 100 group membership entries across all interfaces

on which IGMP is enabled, and exclude group 224.1.1.1 from this limitation, use

the commands:

awplus# configure terminal

awplus(config)# access-list 1 permit 224.1.1.1 0.0.0.0

awplus(config)# ip igmp limit 100 except 1

Parameter Description

<limit-value> Maximum number of group membership

entries, from 2 to 512.

<access-list-number>Access-list number, in the range 1 to 99.

<access-list-number-extended>Access-list number (expanded range), in

the range 1300 to 1999.

<access-list-name>IP access-list name.

C613-50292-01 Rev A Command Reference for IE210L Series 843

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP MAXIMUM-GROUPS

ip igmp maximum-groups

Overview Use this command to set a limit, per switch port, on the number of IGMP groups

clients can join. This stops a single client from using all the switch’s available

group-entry resources, and ensures that clients on all ports have a chance to join

IGMP groups.

Use the no variant of this command to remove the limit.

Syntax ip igmp maximum-groups <0-65535>

no ip igmp maximum-groups

Default The default is 0, which means no limit

Mode Interface mode for a switch port

Usage We recommend using this command with IGMP snooping fast leave on the

relevant VLANs. To enable fast leave, use the command:

awplus(config-if)# ip igmp snooping fast-leave

The device keeps count of the number of groups learned by each port. This counter

is incremented when group joins are received via IGMP reports. It is decremented

when:

• Group memberships time out

• Group leaves are received via leave messages or reports

Also, the port's group counter is cleared when:

• The port goes down

• You run the command clear ip igmp group *

• The port is removed from a VLAN

You can see the current value of the group counter by using either of the

commands:

awplus# show ip igmp snooping statistics interface <port-list>

awplus# show ip igmp interface <port>

Parameter Description

<0-65535> The maximum number of IGMP groups clients can join on this

switch port. 0 means no limit.

C613-50292-01 Rev A Command Reference for IE210L Series 844

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP MAXIMUM-GROUPS

Example To limit clients to 10 groups on port 1.0.1, which is in vlan1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# ip igmp maximum-groups 10

awplus(config-if)# exit

awplus(config)# interface vlan1

awplus(config-if)# ip igmp snooping fast-leave

Commands

clear ip igmp group

ip igmp snooping fast-leave

show ip igmp interface

show ip igmp snooping statistics

C613-50292-01 Rev A Command Reference for IE210L Series 845

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP QUERIER-TIMEOUT

ip igmp querier-timeout

Overview Use this command to configure the timeout period before the device takes over as

the querier for the interface after the previous querier has stopped querying.

Use the no variant of this command to restore the default.

Syntax ip igmp querier-timeout <timeout>

no ip igmp querier-timeout

Default The default timeout interval is 255 seconds.

Mode Interface Configuration for a VLAN interface.

Usage This command applies to VLAN interfaces configured for IGMP.

The timeout value should not be less than the current active querier’s general

query interval.

Example To configure the device to wait 130 seconds from the time it received the last query

before it takes over as the querier for vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp querier-timeout 130

Commands

ip igmp query-interval

show ip igmp interface

show running-config

Parameter Description

<timeout>IGMP querier timeout interval value in seconds, in the range 1-

65535.

C613-50292-01 Rev A Command Reference for IE210L Series 846

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP QUERY-HOLDTIME

ip igmp query-holdtime

Overview This command sets the time that an IGMP Querier waits after receiving a query

solicitation before it sends an IGMP Query. IGMP General Query messages will not

be sent during the hold time interval.

Use the no variant of this command to return to the default query hold time

period.

Syntax ip igmp query-holdtime <interval>

no ip igmp query-holdtime

Default By default the delay before sending IGMP General Query messages is 500

milliseconds.

Mode Interface Configuration for a VLAN interface.

Usage Use this command to configure a value for the IGMP query hold time in the current

network. IGMP Queries can be generated after receiving Query Solicitation (QS)

packets and there is a possibility of a DoS (Denial of Service) attack if a stream of

Query Solicitation (QS) packets are sent to the IGMP Querier, eliciting a rapid

stream of IGMP Queries. This command applies to interfaces on which the device

is acting as an IGMP Querier.

Use the ip igmp query-interval command when a delay for IGMP general query

messages is required and IGMP general query messages are required. The ip igmp

query-holdtime command stops IGMP query messages during the configured

holdtime interval, so the rate of IGMP Queries that can be sent out of an interface

can be restricted.

See the IGMP Feature Overview and Configuration Guide for introductory

information about the Query Solicitation feature.

Examples To set the IGMP query holdtime to 900 ms for vlan20, use the following commands:

awplus# configure terminal

awplus(config)# interface vlan20

awplus(config-if)# ip igmp query-holdtime 900

To reset the IGMP query holdtime to the default (500 ms) for vlan10, use the

following commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no ip igmp query-holdtime

Parameter Description

<interval>Query interval value in milliseconds, in the range <100-5000>.

C613-50292-01 Rev A Command Reference for IE210L Series 847

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP QUERY-HOLDTIME

Commands

ip igmp query-interval

ip igmp snooping tcn query solicit

show ip igmp interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 848

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP QUERY-INTERVAL

ip igmp query-interval

Overview Use this command to configure the period for sending IGMP General Query

messages.

The IGMP query interval specifies the time between IGMP General Query messages

being sent.

Use the no variant of this command to return to the default query interval period.

NOTE: The IGMP query interval must be greater than IGMP query maximum response

time.

Syntax ip igmp query-interval <interval>

no ip igmp query-interval

Default The default IGMP query interval is 125 seconds.

Mode Interface Configuration for a VLAN interface.

Usage This command applies to interfaces configured for IGMP. Note that the IGMP query

interval is automatically set to a greater value than the IGMP query max response

time.

For example, if you set the IGMP query max response time to 2 seconds using the

ip igmp query-max-response-time command, and the IGMP query interval is

currently less than 3 seconds, then the IGMP query interval period will be

automatically reconfigured to be 3 seconds, so it is greater than the IGMP query

maximum response time.

Use the ip igmp query-interval command when a non-default interval for IGMP

General Query messages is required.

The ip igmp query-holdtime command can occasionally delay the sending of IGMP

Queries.

Examples To set the period between IGMP host-query messages to 3 minutes (180 seconds)

for vlan20, use the following commands:

awplus# configure terminal

awplus(config)# interface vlan20

awplus(config-if)# ip igmp query-interval 180

Parameter Description

<interval>Query interval value in seconds, in the range <2-18000>.

C613-50292-01 Rev A Command Reference for IE210L Series 849

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP QUERY-INTERVAL

To reset the period between sending IGMP host-query messages to the default

(125 seconds) for vlan10, use the following commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no ip igmp query-interval

Commands

ip igmp query-holdtime

ip igmp query-max-response-time

ip igmp startup-query-interval

show ip igmp interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 850

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP QUERY-MAX-RESPONSE-TIME

ip igmp query-max-response-time

Overview Use this command to configure the maximum response time advertised in IGMP

Queries.

Use the no variant of this command to restore the default.

NOTE: The IGMP query maximum response time must be less than the IGMP query

interval.

Syntax ip igmp query-max-response-time <response-time>

no ip igmp query-max-response-time

Default The default IGMP query maximum response time is 10 seconds.

Mode Interface Configuration for a VLAN interface.

Usage This command applies to interfaces configured for IGMP.

Note that the IGMP query interval is automatically set to a greater value than the

IGMP query maximum response time.

For example, if you set the IGMP query interval to 3 seconds using the ip igmp

query-interval command, and the current IGMP query interval is less than 3

seconds, then the IGMP query maximum response time will be automatically

reconfigured to be 2 seconds, so it is less than the IGMP query interval time.

To get the network to converge faster, use the ip igmp

query-max-response-time command and set a low response time value, such as

one or two seconds, so that the clients will respond immediately with a report as a

response to the IGMP Queries.

Examples To set a maximum response time of 8 seconds for vlan20, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan20

awplus(config-if)# ip igmp query-max-response-time 8

To reset the default maximum response time to the default (10 seconds) for vlan10,

use the following commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no ip igmp query-max-response-time

Parameter Description

<response-time>Response time value in seconds, in the range 1-3180.

C613-50292-01 Rev A Command Reference for IE210L Series 851

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP QUERY-MAX-RESPONSE-TIME

Commands

ip igmp query-interval

show ip igmp interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 852

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP RA-OPTION

ip igmp ra-option

Overview Use this command to enable strict Router Alert (RA) option validation. With strict

RA option enabled, IGMP packets without RA options are ignored.

Use the no variant of this command to disable strict RA option validation.

Syntax ip igmp ra-option

no ip igmp ra-option

Default The default state of RA validation is unset.

Mode Interface Configuration for a VLAN interface.

Usage This command applies to interfaces configured for IGMP and IGMP Snooping.

Examples To enable strict Router Alert (RA) option validation on vlan20, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan20

awplus(config-if)# ip igmp ra-option

C613-50292-01 Rev A Command Reference for IE210L Series 853

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP ROBUSTNESS-VARIABLE

ip igmp robustness-variable

Overview Use this command to change the robustness variable value on an interface.

Use the no variant of this command to return to the default on an interface.

Syntax ip igmp robustness-variable <1-7>

no ip igmp robustness-variable

Default The default robustness variable value is 2.

Mode Interface Configuration for a VLAN interface.

Usage This command applies to interfaces configured for IGMP and IGMP Snooping.

Examples To set the robustness variable to 3 on vlan20, use the following commands:

awplus# configure terminal

awplus(config)# interface vlan20

awplus(config-if)# ip igmp robustness-variable 3

Commands

show ip igmp interface

show running-config

Parameter Description

<1-7>The robustness variable value.

C613-50292-01 Rev A Command Reference for IE210L Series 854

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING

ip igmp snooping

Overview Use this command to enable IGMP Snooping. When this command is used in the

Global Configuration mode, IGMP Snooping is enabled at the device level. When

this command is used in Interface Configuration mode, IGMP Snooping is enabled

for the specified VLANs.

Use the no variant of this command to either globally disable IGMP Snooping, or

disable IGMP Snooping on a specified interface.

NOTE: IGMP snooping cannot be disabled on an interface if IGMP snooping has

already been disabled globally. IGMP snooping can be disabled on both an interface

and globally if disabled on the interface first and then disabled globally.

Syntax ip igmp snooping

no ip igmp snooping

Default By default, IGMP Snooping is enabled both globally and on all VLANs.

Mode Global Configuration and Interface Configuration for a VLAN interface.

Usage For IGMP snooping to operate on particular VLAN interfaces, it must be enabled

both globally by using this command in Global Configuration mode, and on

individual VLAN interfaces by using this command in Interface Configuration

mode (both are enabled by default.)

Both IGMP snooping and MLD snooping must be enabled globally on the device

for IGMP snooping to operate. MLD snooping is also enabled by default. To enable

it if it has been disabled, use the ipv6 mld snooping command in Global

Configuration mode.

Examples To enable IGMP Snooping on vlan2, use the commands:

awplus# configure terminal

awplus(config)# ip igmp snooping

awplus(config)# interface vlan2

awplus(config-if)# ip igmp snooping

Commands

ipv6 mld snooping

show ip igmp interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 855

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING FAST-LEAVE

ip igmp snooping fast-leave

Overview Use this command to enable IGMP Snooping fast-leave processing. Fast-leave

processing is analogous to immediate-leave processing. The IGMP

group-membership entry is removed as soon as an IGMP leave group message is

received, without sending out a group-specific query.

Use the no variant of this command to disable fast-leave processing.

Syntax ip igmp snooping fast-leave

no ip igmp snooping fast-leave

Default IGMP Snooping fast-leave processing is disabled.

Mode Interface Configuration for a VLAN interface.

Usage This IGMP Snooping command can only be configured on VLAN interfaces.

Example To enable fast-leave processing on vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp snooping fast-leave

Commands

show ip igmp interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 856

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING MROUTER

ip igmp snooping mrouter

Overview Use this command to statically configure the specified port as a multicast router

port for IGMP Snooping for an interface. This command applies to interfaces

configured for IGMP Snooping.

Use the no variant of this command to remove the static configuration of the port

as a multicast router port.

Syntax ip igmp snooping mrouter interface <port>

no ip igmp snooping mrouter interface <port>

Mode Interface Configuration for a VLAN interface.

Example To configure port1.0.2 statically as a multicast router interface for vlan2, use the

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp snooping mrouter interface port1.0.2

Commands

show ip igmp snooping mrouter

Parameter Description

<port>The port may be a device port (e.g. port1.0.2), a static channel group

(e.g. sa3), or a dynamic (LACP) channel group (e.g. po4).

C613-50292-01 Rev A Command Reference for IE210L Series 857

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING QUERIER

ip igmp snooping querier

Overview Use this command to enable IGMP querier operation when no multicast routing

protocol is configured. When enabled, the IGMP Snooping querier sends out

periodic IGMP queries for all interfaces. This command applies to interfaces

configured for IGMP Snooping.

Use the no variant of this command to disable IGMP querier configuration.

Syntax ip igmp snooping querier

no ip igmp snooping querier

Mode Interface Configuration for a VLAN interface.

Usage The IGMP Snooping querier uses the 0.0.0.0 Source IP address because it only

masquerades as a proxy IGMP querier for faster network convergence.

It does not start, or automatically cease, the IGMP Querier operation if it detects

query message(s) from a multicast router.

If an IP address is assigned to a VLAN, which has IGMP querier enabled on it, then

the IGMP Snooping querier uses the VLAN’s IP address as the Source IP Address in

IGMP queries.

The IGMP Snooping Querier will not stop sending IGMP Queries if there is another

IGMP Snooping Querier in the network with a lower Source IP Address.

NOTE: Do not enable the IGMP Snooping Querier feature on a Layer 2 device when

there is an operational IGMP Querier in the network.

Example To configure vlan2 as a Snooping querier, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp snooping querier

Commands

show ip igmp interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 858

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING REPORT-SUPPRESSION

ip igmp snooping report-suppression

Overview Use this command to enable report suppression for IGMP versions 1 and 2. This

command applies to interfaces configured for IGMP Snooping.

Report suppression stops reports being sent to an upstream multicast router port

when there are already downstream ports for this group on this interface.

Use the no variant of this command to disable report suppression.

Syntax ip igmp snooping report-suppression

no ip igmp snooping report-suppression

Default Report suppression does not apply to IGMPv3, and is turned on by default for

IGMPv1 and IGMPv2 reports.

Mode Interface Configuration for a VLAN interface.

Example To enable report suppression for IGMPv2 reports for vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp version 2

awplus(config-if)# ip igmp snooping report-suppression

Commands

show ip igmp interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 859

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING ROUTERMODE

ip igmp snooping routermode

Overview Use this command to set the destination IP addresses as router multicast

addresses.

Use the no variant of this command to set it to the default. You can also remove a

specified IP address from a custom list of multicast addresses.

Syntax ip igmp snooping routermode

{all|default|ip|multicastrouter|address <ip-address>}

no ip igmp snooping routermode [address <ip-address>]

Default The default routermode is default (not all) and shows the following reserved

multicast addresses:

Mode Global Configuration

Parameter Description

all All reserved multicast addresses (224.0.0.x).

Packets from all possible addresses in range 224.0.0.x are

treated as coming from routers.

default Default set of reserved multicast addresses.

Packets from 224.0.0.1, 224.0.0.2, 224.0.0.4, 224.0.0.5,

224.0.0.6, 224.0.0.9, 224.0.0.13, 224.0.0.15 and 224.0.0.24

are treated as coming from routers.

ip Custom reserved multicast addresses.

Packets from custom IP address in the 224.0.0.x range are

treated as coming from routers.

multicastrouter Packets from DVMRP (224.0.0.4) and PIM (224.0.0.13)

multicast addresses are treated as coming from routers.

address

<ip-address> Packets from the specified multicast address are treated as

coming from routers. The address must be in the 224.0.0.x

range.

Router mode.............Def



Reserved multicast address

224.0.0.1

224.0.0.2

224.0.0.4

224.0.0.5

224.0.0.6

224.0.0.9

224.0.0.13

224.0.0.15

224.0.0.24

C613-50292-01 Rev A Command Reference for IE210L Series 860

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING ROUTERMODE

Examples To set ip igmp snooping routermode for all default reserved addresses enter:

awplus(config)# ip igmp snooping routermode default

To remove the multicast address 224.0.0.5 from the custom list of multicast

addresses enter:

awplus(config)# no ip igmp snooping routermode address

224.0.0.5

commands

ip igmp trusted

show ip igmp snooping routermode

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

C613-50292-01 Rev A Command Reference for IE210L Series 861

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING SOURCE-TIMEOUT

ip igmp snooping source-timeout

Overview Use this command to set the global IGMP Snooping source time-out value (in

seconds) on the switch.

Use the no variant of this command to set the source time-out value to be the

same as the group membership timeout.

Syntax ip igmp snooping source-timeout <timeout>

no ip igmp snooping source-timeout <timeout>

Default Global IGMP Snooping source-timeout is disabled by default, and unregistered

multicast will be timed-out like normal entries.

Interface IGMP Snooping source timeout is disabled by default, and unregistered

multicast will be timed-out like normal entries.

Mode Interface/Global Configuration

Usage The timeout determines how long unregistered multicast entries will be kept for.

If the value ‘0’ is specified, then effectively all unregistered multicast entries will

never be timed out, and can only be cleared by using the command clear ip igmp

group. The interface settings will always take precedence over the global setting.

Example To configure IGMP Snooping source timeout on ‘vlan1’, use the commands:

awplus# configure terminal

awplus(config)# interface vlan1

awplus(config-if)# ip igmp snooping source-timeout 200

Commands

show ip igmp snooping source-timeout

Parameter Description

<timeout> Time-out value in seconds <0-86400>

C613-50292-01 Rev A Command Reference for IE210L Series 862

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING TCN QUERY SOLICIT

ip igmp snooping tcn query solicit

Overview Use this command to enable IGMP (Internet Group Management Protocol)

Snooping TCN (Topology Change Notification) Query Solicitation feature. When

this command is used in the Global Configuration mode, Query Solicitation is

enabled.

Use the no variant of this command to disable IGMP Snooping TCN Query

Solicitation. When the no variant of this command is used in Interface

Configuration mode, this overrides the Global Configuration mode setting and

Query Solicitation is disabled.

Syntax ip igmp snooping tcn query solicit

no ip igmp snooping tcn query solicit

Default IGMP Snooping TCN Query Solicitation is disabled by default on the device, unless

the device is the Master Node in an EPSR ring, or is the Root Bridge in a Spanning

Tree.

When the device is the Master Node in an EPSR ring, or the device is the Root

Bridge in a Spanning Tree, then IGMP Snooping TCN Query Solicitation is enabled

by default and cannot be disabled using the Global Configuration mode

command. However, Query Solicitation can be disabled for specified interfaces

using the no variant of this command from the Interface Configuration mode.

Mode Global Configuration, and Interface Configuration for a VLAN interface.

Usage Once enabled, if the device is not an IGMP Querier, on detecting a topology

change, the device generates IGMP Query Solicit messages that are sent to all the

ports of the vlan configured for IGMP Snooping on the device.

On a device that is not the Master Node in an EPSR ring or the Root Bridge in a

Spanning Tree, Query Solicitation can be disabled using the no variant of this

command after being enabled.

If the device that detects a topology change is an IGMP Querier then the device will

generate an IGMP Query message.

Note that the no variant of this command when issued in Global Configuration

mode has no effect on a device that is the Master Node in an EPSR ring or on a

device that is a Root Bridge in a Spanning Tree. Query Solicitation is not disabled

for the device these instances. However, Query Solicitation can be disabled on a

per-vlan basis from the Interface Configuration mode.

See the following state table that shows when Query Solicit messages are sent in

these instances:

C613-50292-01 Rev A Command Reference for IE210L Series 863

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SNOOPING TCN QUERY SOLICIT

See the IGMP Feature Overview and Configuration Guide for introductory

information about the Query Solicitation feature.

Examples To enable Query Solicitation on a device, use the commands:

awplus# configure terminal

awplus(config)# ip igmp snooping tcn query solicit

To disable Query Solicitation on a device, use the commands:

awplus# configure terminal

awplus(config)# no ip igmp snooping tcn query solicit

To enable Query Solicitation for vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp snooping tcn query solicit

To disable Query Solicitation for vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ip igmp snooping tcn query solicit

Commands

ip igmp query-holdtime

show ip igmp interface

show running-config

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

Command

issued from

Global

Configuration

Command issued

from Interface

Configuration

Device is STP Root

Bridge or the

EPSR Master Node

IGMP Query Solicit

message sent on VLAN

No Yes Yes Yes

Yes No Yes No

Yes Yes Yes Yes

C613-50292-01 Rev A Command Reference for IE210L Series 864

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP SOURCE-ADDRESS-CHECK

ip igmp source-address-check

Overview This command enables the checking of the Source Address for an IGMP Report,

rejecting any IGMP Reports originating on devices outside of the local subnet.

Use the no variant of this command to disable the checking of the Source Address

for an IGMP Report, which allows IGMP Reports from devices outside of the local

subnet.

Syntax ip igmp source-address-check

no ip igmp source-address-check

Default Source address checking for IGMP Reports is enabled by default.

Mode Interface Configuration for a VLAN interface.

Usage This is a security feature, and should be enabled unless IGMP Reports from outside

the local subnet are expected, for example, if Multicast VLAN Registration is active

in the network.

The no variant of this command is required to disable the IGMP Report source

address checking feature in networks that use Multicast VLAN Registration to allow

IGMP Reports from devices outside of the local subnet.

Examples To deny IGMP Reports from outside the current subnet for vlan20, use the

following commands:

awplus# configure terminal

awplus(config)# interface vlan20

awplus(config-if)# ip igmp source-address-check

To allow IGMP Reports from outside the current subnet for vlan10, use the

following commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no ip igmp source-address-check

Validation

Commands

show ip igmp interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 865

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP STATIC-GROUP

ip igmp static-group

Overview Use this command to statically configure multicast group membership entries on

a VLAN interface, or to statically forward a multicast channel out a particular port

or port range.

To statically add only a group membership, do not specify any parameters.

To statically add a (*,g) entry to forward a channel out of a port, specify only the

multicast group address and the switch port range.

To statically add an (s,g) entry to forward a channel out of a port, specify the

multicast group address, the source IP address, and the switch port range.

Use the no variant of this command to delete static group membership entries.

Syntax ip igmp static-group <ip-address> [source {<ip-source-addr>}]

[interface <port>]

no ip igmp static-group <ip-address> [source

{<ip-source-addr>}] [interface <port>]

Mode Interface Configuration for a VLAN interface.

Usage This command applies to IGMP operation, or to IGMP Snooping on a VLAN

interface.

Parameter Description

<ip-address> Standard IP Multicast group address, entered in the form

A.B.C.D, to be configured as a static group member.

source Optional.

<ip-source-addr> Standard IP source address, entered in the form A.B.C.D, to be

configured as a static source from where multicast packets

originate.

interface Use this parameter to specify a specific switch port or switch

port range to statically forward the multicast group out of. If

not used, static configuration is applied on all ports in the

VLAN.

<port>The port or port range to statically forward the group out of.

The port may be a switch port (e.g. port1.0.4), a static

channel group (e.g. sa2), or a dynamic (LACP) channel group

(e.g. po2).

C613-50292-01 Rev A Command Reference for IE210L Series 866

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP STATIC-GROUP

Example The following example show how to statically add group and source records for

IGMP on vlan3:

awplus# configure terminal

awplus(config)# interface vlan3

awplus(config-if)# ip igmp

awplus(config-if)# ip igmp static-group 226.1.2.4 source

10.2.3.4

C613-50292-01 Rev A Command Reference for IE210L Series 867

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP STARTUP-QUERY-COUNT

ip igmp startup-query-count

Overview Use this command to configure the IGMP startup query count for an interface. The

IGMP startup query count is the number of IGMP General Query messages sent by

a querier at startup. The default IGMP startup query count is 2.

Syntax ip igmp startup-query-count <startup-query-count>

no ip igmp startup-query-count

Default The default IGMP startup query count is 2.

Mode Interface Configuration for a VLAN interface.

Example To set the IGMP startup query count to 4 on vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp startup-query-count 4

Commands

ip igmp last-member-query-count

ip igmp startup-query-interval

Parameter Description

<startup-query-count> Specify the IGMP startup query count, in the range

2-10.

C613-50292-01 Rev A Command Reference for IE210L Series 868

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP STARTUP-QUERY-INTERVAL

ip igmp startup-query-interval

Overview Use this command to configure the IGMP startup query interval for an interface.

The IGMP startup query interval is the amount of time in seconds between

successive IGMP General Query messages sent by a querier during startup. The

default IGMP startup query interval is one quarter of the IGMP query interval value.

Syntax ip igmp startup-query-interval <startup-query-interval>

no ip igmp startup-query-interval

Default The default IGMP startup query interval is one quarter of the IGMP query interval

value.

NOTE: The IGMP startup query interval must be one quarter of the IGMP query interval.

Mode Interface Configuration for a VLAN interface.

Example To set the IGMP startup query interval to 15 seconds for vlan2, which is one quarter

of the IGMP query interval of 60 seconds, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp query-interval 60

awplus(config-if)# ip igmp startup-query-interval 15

Commands

ip igmp last-member-query-interval

ip igmp query-interval

ip igmp startup-query-count

Parameter Description

<startup-query-interval> Specify the IGMP startup query interval, in the

range of 2-1800 seconds. The value must be one

quarter of the IGMP query interval value.

C613-50292-01 Rev A Command Reference for IE210L Series 869

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP TRUSTED

ip igmp trusted

Overview Use this command to allow IGMP to process packets received on certain trusted

ports only.

Use the no variant of this command to stop IGMP from processing specified

packets if the packets are received on the specified ports or aggregator.

Syntax ip igmp trusted {all|query|report|routermode}

no ip igmp trusted {all|query|report|routermode}

Default By default, all ports and aggregators are trusted interfaces, so IGMP is allowed to

process all IGMP query, report, and router mode packets arriving on all interfaces.

Mode Interface mode for one or more switch ports or aggregators

Usage Because all ports are trusted by default, use this command in its no variant to stop

IGMP processing packets on ports you do not trust.

For example, you can use this command to make sure that only ports attached to

approved IGMP routers are treated as router ports.

Example To stop ports port1.0.3-port1.0.6 from being treated as router ports by IGMP, use

the commands:

awplus(config)# interface port1.0.3-port1.0.6

awplus(config-if)# no ip igmp trusted routermode

Parameter Description

all Specifies whether or not the interface is allowed to receive all

IGMP and other routermode packets

query Specifies whether or not the interface is allowed to receive IGMP

queries

report Specifies whether or not the interface is allowed to receive IGMP

membership reports

routermode Specifies whether or not the interface is allowed to receive

routermode packets

C613-50292-01 Rev A Command Reference for IE210L Series 870

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

IP IGMP VERSION

ip igmp version

Overview Use this command to set the current IGMP version (IGMP version 1, 2 or 3) on an

interface.

Use the no variant of this command to return to the default version.

Syntax ip igmp version <1-3>

no ip igmp version

Default The default IGMP version is 3.

Mode Interface Configuration for a VLAN interface.

Example To set the IGMP version to 2 for vlan2, use the commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ip igmp version 2

Commands

show ip igmp interface

Parameter Description

version <1-3>IGMP protocol version number

C613-50292-01 Rev A Command Reference for IE210L Series 871

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW DEBUGGING IGMP

show debugging igmp

Overview Use this command to display the IGMP debugging options set.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show debugging igmp

Mode User Exec and Privileged Exec

Example To display the IGMP debugging options set, enter the command:

awplus# show debugging igmp

Output Figure 26-1: Example output from the show debugging igmp command

Commands

debug igmp

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

IGMP Debugging status:

IGMP Decoder debugging is on

IGMP Encoder debugging is on

IGMP Events debugging is on

IGMP FSM debugging is on

IGMP Tree-Info-Base (TIB) debugging is on

C613-50292-01 Rev A Command Reference for IE210L Series 872

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW IP IGMP GROUPS

show ip igmp groups

Overview Use this command to display the multicast groups with receivers directly

connected to the router, and learned through IGMP.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip igmp groups [<ip-address>|<interface> detail | brief]

Mode User Exec and Privileged Exec

Example The following command displays local-membership information for all ports in all

interfaces:

awplus# show ip igmp groups

Output Figure 26-2: Example output from show ip igmp groups

Parameter Description

<ip-address> Address of the multicast group, entered in the form A.B.C.D.

<interface> Interface name for which to display local information.

brief Brief display of all interfaces

IGMP Connected Group Membership 

Group Address Interface U ptime Expires Last Reporter 

224.0.1.1 port1.0.1 00:00:09 00:04:17 10.10.0.82 

224.0.1.24 port1.0.2 00:00:06 00:04:14 10.10.0.84 

...

Table 26-1: Parameters in the output of show ip igmp groups

Parameter Description

Group

Address Address of the multicast group.

Interface Port through which the group is reachable.

Uptime The time in weeks, days, hours, minutes, and seconds that this

multicast group has been known to the device.

Expires Time (in hours, minutes, and seconds) until the entry expires.

Last

Reporter Last host to report being a member of the multicast group.

C613-50292-01 Rev A Command Reference for IE210L Series 873

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW IP IGMP GROUPS

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

Version 5.4.8-2.3: brief parameter added.

C613-50292-01 Rev A Command Reference for IE210L Series 874

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW IP IGMP INTERFACE

show ip igmp interface

Overview Use this command to display the state of IGMP Snooping for a specified VLAN, or

all VLANs. IGMP is shown as Active or Disabled in the show output. You can also

display the number of groups a switch port belongs to.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip igmp interface [<interface>]

Mode User Exec and Privileged Exec

Output The following output shows IGMP interface status for vlan2 with IGMP Snooping

enabled:

The following output shows IGMP interface status for vlan2 with IGMP Snooping

disabled:

Parameter Description

<interface>The name of the interface.

If you specify a switch port number, the output displays the number

of groups the port belongs to, and the port’s group membership

limit, if a limit has been set (with the command ip igmp

maximum-groups).

awplus#show ip igmp interface vlan2

Interface vlan2 (Index 202)

IGMP Disabled, Inactive, Version 3 (default)

IGMP interface has 0 group-record states

IGMP activity: 0 joins, 0 leaves

IGMP robustness variable is 2

IGMP last member query count is 2

IGMP query interval is 125 seconds

IGMP query holdtime is 500 milliseconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1000 milliseconds

Group Membership interval is 260 seconds

Strict IGMPv3 ToS checking is disabled on this interface

Source Address checking is enabled

IGMP Snooping is globally enabled

IGMP Snooping query solicitation is globally disabled

Num. query-solicit packets: 57 sent, 0 recvd

IGMP Snooping is enabled on this interface

IGMP Snooping fast-leave is not enabled

IGMP Snooping querier is not enabled

IGMP Snooping report suppression is enabled

C613-50292-01 Rev A Command Reference for IE210L Series 875

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW IP IGMP INTERFACE

The following output displays membership information for port1.0.1:

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

awplus#show ip igmp interface vlan2

Interface vlan2 (Index 202)

IGMP Disabled, Inactive, Version 3 (default)

IGMP interface has 0 group-record states

IGMP activity: 0 joins, 0 leaves

IGMP robustness variable is 2

IGMP last member query count is 2

IGMP query interval is 125 seconds

IGMP query holdtime is 500 milliseconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1000 milliseconds

Group Membership interval is 260 seconds

Strict IGMPv3 ToS checking is disabled on this interface

Source Address checking is enabled

IGMP Snooping is globally enabled

IGMP Snooping query solicitation is globally disabled

Num. query-solicit packets: 57 sent, 0 recvd

IGMP Snooping is not enabled on this interface

IGMP Snooping fast-leave is not enabled

IGMP Snooping querier is not enabled

IGMP Snooping report suppression is enabled

awplus#show ip igmp interface port1.0.1

IGMP information for port1.0.1

Maximum groups limit set: 10

Number of groups port belongs to: 0

C613-50292-01 Rev A Command Reference for IE210L Series 876

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW IP IGMP SNOOPING MROUTER

show ip igmp snooping mrouter

Overview Use this command to display the multicast router ports, both static and dynamic,

in a VLAN.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip igmp snooping mrouter [interface <interface>]

Mode User Exec and Privileged Exec

Example To show all multicast router interfaces, use the command:

awplus# show ip igmp snooping mrouter

To show the multicast router interfaces in vlan1, use the command:

awplus# show ip igmp snooping mrouter interface vlan1

Output Figure 26-3: Example output from show ip igmp snooping mrouter

Figure 26-4: Example output from show ip igmp snooping mrouter interface

vlan1

Commands

ip igmp snooping mrouter

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

Parameter Description

interface A specific interface.

<interface>The name of the VLAN interface.

VLAN Interface Static/Dynamic

1 port1.0.1 Statically configured

200 port1.0.2 Statically configured

VLAN Interface Static/Dynamic

1 port1.0.1 Statically configured

C613-50292-01 Rev A Command Reference for IE210L Series 877

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW IP IGMP SNOOPING ROUTERMODE

show ip igmp snooping routermode

Overview Use this command to display the current router mode and the list of IP addresses

set as router multicast addresses from the ip igmp snooping routermode

command.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip igmp snooping routermode

Mode User Exec and Privileged Exec

Example To show the router mode and the list of router multicast addresses, use the

command:

awplus# show ip igmp snooping routermode

Output Figure 26-5: Example output from show ip igmp snooping routermode

Commands

ip igmp snooping routermode

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

awplus#show ip igmp snooping routermode

Router mode.............Def

Reserved multicast address



224.0.0.1

224.0.0.2

224.0.0.4

224.0.0.5

224.0.0.6

224.0.0.9

224.0.0.13

224.0.0.15

224.0.0.24

C613-50292-01 Rev A Command Reference for IE210L Series 878

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW IP IGMP SNOOPING SOURCE-TIMEOUT

show ip igmp snooping source-timeout

Overview Use this command to display the configured IGMP snooping source timeouts for a

specified VLAN or VLAN range.

Syntax show ip igmp snooping source-timeout [interface|

<interface-range>]

Mode Privileged Exec

Example To display the configured IGMP snooping source timeouts for all VLANs, use the

command:

awplus# show ip igmp snooping source-timeout

Output Figure 26-6: Example output from show ip igmp snooping source-timeout

Commands

ip igmp snooping source-timeout

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

Parameter Description

<interface-range>The name of the VLAN interface or VLAN range

awplus#show ip igmp snooping source-timeout 

Global IGMP snooping source-timeout is enabled (60 secs)



vlan1 enabled (300 secs)

vlan2 inherits global setting

vlan1000 inherits global settingawplus#show ip igmp

snooping source-timeout int vlan1

Global IGMP snooping source-timeout is enabled (60 secs)vlan1

enabled (300 secs)

C613-50292-01 Rev A Command Reference for IE210L Series 879

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW IP IGMP SNOOPING STATISTICS

show ip igmp snooping statistics

Overview Use this command to display IGMP Snooping statistics data.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ip igmp snooping statistics interface <interface-range>

[group [<ip-address>]]

Mode Privileged Exec

Example To display IGMP statistical information for vlan1 and vlan2, use the command:

awplus# show ip igmp snooping statistics interface vlan1-vlan2

Output Figure 26-7: Example output from the show ip igmp snooping statistics

command for VLANs

Parameter Description

<ip-address> Optionally specify the address of the multicast group, entered in

the form A.B.C.D.

<interface> Specify the name of the interface or interface range. If you

specify a port number, the output displays the number of

groups the port belongs to, and the port’s group membership

limit, if a limit has been set (with the command ip igmp

maximum-groups)

awplus#show ip igmp interface vlan1-vlan2

IGMP Snooping statistics for vlan1

Interface: port1.0.1

Group: 224.1.1.1

Uptime: 00:00:09

Group mode: Exclude (Expires: 00:04:10)

Last reporter: 10.4.4.5

Source list is empty

IGMP Snooping statistics for vlan2

Interface: port1.0.2

Group: 224.1.1.2

Uptime: 00:00:19

Group mode: Exclude (Expires: 00:05:10)

Last reporter: 10.4.4.6

Source list is empty

C613-50292-01 Rev A Command Reference for IE210L Series 880

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

SHOW IP IGMP SNOOPING STATISTICS

Figure 26-8: Example output from the show ip igmp snooping statistics

command for a switch port

Command

changes

Version 5.4.7-1.1: VRF-lite support added SBx8100.

Version 5.4.8-1.1: VRF-lite support added x930, SBx908 GEN2.

awplus#show ip igmp interface port1.0.1

IGMP information for port1.0.1

Maximum groups limit set: 10

Number of groups port belongs to: 0

C613-50292-01 Rev A Command Reference for IE210L Series 881

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IGMP AND IGMP SNOOPING COMMANDS

UNDEBUG IGMP

undebug igmp

Overview This command applies the functionality of the no debug igmp command.

C613-50292-01 Rev A Command Reference for IE210L Series 882

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD Snooping

Commands

Introduction

Overview This chapter provides an alphabetical reference of configuration, clear, and show

commands related to MLD Snooping.

Command List •“clear ipv6 mld” on page 883

•“clear ipv6 mld group” on page 884

•“clear ipv6 mld interface” on page 885

•“debug mld” on page 886

•“ipv6 mld immediate-leave” on page 887

•“ipv6 mld limit” on page 888

•“ipv6 mld snooping” on page 890

•“ipv6 mld snooping fast-leave” on page 892

•“ipv6 mld snooping mrouter” on page 893

•“ipv6 mld snooping querier” on page 895

•“ipv6 mld snooping report-suppression” on page 896

•“ipv6 mld static-group” on page 898

•“show debugging mld” on page 900

•“show ipv6 mld groups” on page 901

•“show ipv6 mld interface” on page 902

•“show ipv6 mld snooping mrouter” on page 903

•“show ipv6 mld snooping statistics” on page 904

C613-50292-01 Rev A Command Reference for IE210L Series 883

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

CLEAR IPV6 MLD

clear ipv6 mld

Overview Use this command to clear all MLD local memberships on all interfaces.

Syntax clear ipv6 mld

Mode Privileged Exec

Example awplus# clear ipv6 mld

Commands

clear ipv6 mld group

clear ipv6 mld interface

C613-50292-01 Rev A Command Reference for IE210L Series 884

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

CLEAR IPV6 MLD GROUP

clear ipv6 mld group

Overview Use this command to clear MLD specific local-membership(s) on all interfaces, for

a particular group.

Syntax clear ipv6 mld group {*|<ipv6-address>}

Mode Privileged Exec

Example awplus# clear ipv6 mld group *

Commands

clear ipv6 mld

clear ipv6 mld interface

Parameter Description

*Clears all groups on all interfaces. This is an alias to the clear

ipv6 mld command.

<ipv6-address>Specify the group address for which MLD local-memberships

are to be cleared from all interfaces.

Specify the IPv6 multicast group address in the format in the

format X:X::X:X.

C613-50292-01 Rev A Command Reference for IE210L Series 885

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

CLEAR IPV6 MLD INTERFACE

clear ipv6 mld interface

Overview Use this command to clear MLD interface entries.

Syntax clear ipv6 mld interface <interface>

Mode Privileged Exec

Example awplus# clear ipv6 mld interface vlan2

Commands

clear ipv6 mld

clear ipv6 mld group

Parameter Description

<interface> Specifies name of the interface; all groups learned from this interface

are deleted.

C613-50292-01 Rev A Command Reference for IE210L Series 886

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

DEBUG MLD

debug mld

Overview Use this command to enable all MLD debugging modes, or a specific MLD

debugging mode.

Use the no variant of this command to disable all MLD debugging modes, or a

specific MLD debugging mode.

Syntax debug mld {all|decode|encode|events|fsm|tib}

no debug mld {all|decode|encode|events|fsm|tib}

Mode Privileged Exec and Global Configuration

Examples awplus# configure terminal

awplus(config)# debug mld all

awplus# configure terminal

awplus(config)# debug mld decode

awplus# configure terminal

awplus(config)# debug mld encode

awplus# configure terminal

awplus(config)# debug mld events

Commands

show debugging mld

Parameter Description

all Debug all MLD.

decode Debug MLD decoding.

encode Debug MLD encoding.

events Debug MLD events.

fsm Debug MLD Finite State Machine (FSM).

tib Debug MLD Tree Information Base (TIB).

C613-50292-01 Rev A Command Reference for IE210L Series 887

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD IMMEDIATE-LEAVE

ipv6 mld immediate-leave

Overview Use this command to minimize the leave latency of MLD memberships.

Use the no variant of this command to disable this feature.

Syntax ipv6 mld immediate-leave group-list <IPv6-access-list-name>

no ipv6 mld immediate-leave

Default Disabled

Mode Interface Configuration for a specified VLAN interface or a range of VLAN

interfaces.

Example The following example shows how to enable the immediate-leave feature on an

interface for a specific range of multicast groups. In this example, the router

assumes that the group access-list consists of groups that have only one node

membership at a time per interface:

awplus# configure terminal

awplus(config)# ipv6 forwarding

awplus(config)# ipv6 multicast-routing

awplus(config)# interface vlan2

awplus(config-if)# ipv6 enable

awplus(config-if)# ipv6 mld immediate-leave v6grp

awplus(config-if)# exit

Parameter Description

<IPv6-access-

list-name> Specify a Standard or an Extended software IPv6 access-list

name that defines multicast groups in which the

immediate leave feature is enabled.

See IPv6 Software Access Control List (ACL) Commands for

supported IPv6 ACLs.

C613-50292-01 Rev A Command Reference for IE210L Series 888

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD LIMIT

ipv6 mld limit

Overview Use this command to configure a limit on the maximum number of group

memberships that may be learned. The limit may be set for the device as a whole,

or for a specific interface.

Once the specified group membership limit is reached, all further

local-memberships will be ignored.

Optionally, an exception access-list can be configured to specify the

group-address(es) that are exempted from being subject to the limit.

Use the no variant of this command to unset the limit and any specified exception

access-list.

Syntax ipv6 mld limit <limitvalue> [except <IPv6-access-list-name>]

no ipv6 mld limit

Default The default limit, which is reset by the no variant of this command, is the same as

maximum number of group membership entries that can be learned with the ipv6

mld limit command.

The default limit of group membership entries that can be learned is 512 entries.

Mode Global Configuration and Interface Configuration for a specified VLAN interface or

a range of VLAN interfaces.

Usage This command applies to interfaces configured for MLD Layer-3 multicast

protocols and learned by MLD Snooping.

Examples The following example configures an MLD limit of 100 group-memberships across

all VLAN interfaces on which MLD is enabled, and excludes groups in the range

ff1e:0db8:0001::/64 from this limitation:

awplus# configure terminal

awplus(config)# ipv6 forwarding

awplus(config)# ipv6 multicast-routing

awplus(config)# ipv6 access-list standard v6grp permit

ff1e:0db8:0001::/64

awplus(config)# ipv6 mld limit 100 except v6grp

Parameter Description

<limitvalue><2-512> Maximum number of group membership states.

<IPv6-access-list-

name>Specify a Standard or an Extended software IPv6 access-list

name that defines multicast groups, which are exempted

from being subject to the configured limit.

See IPv6 Software Access Control List (ACL) Commands for

supported IPv6 ACLs.

C613-50292-01 Rev A Command Reference for IE210L Series 889

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD LIMIT

The following example configures an MLD limit of 100 group-membership states

on the VLAN interface vlan2:

awplus# configure terminal

awplus(config)# ipv6 forwarding

awplus(config)# ipv6 multicast-routing

awplus(config)# interface vlan2

awplus(config-if)# ipv6 enable

awplus(config-if)# ipv6 mld limit 100

The following example configures an MLD limit of 100 group-membership states

on the VLAN interfaces vlan2-vlan4:

awplus# configure terminal

awplus(config)# ipv6 forwarding

awplus(config)# ipv6 multicast-routing

awplus(config)# interface vlan2-vlan4

awplus(config-if)# ipv6 enable

awplus(config-if)# ipv6 mld limit 100

Commands

ipv6 mld immediate-leave

show ipv6 mld groups

C613-50292-01 Rev A Command Reference for IE210L Series 890

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD SNOOPING

ipv6 mld snooping

Overview Use this command to enable MLD Snooping. When this command is issued in the

Global Configuration mode, MLD Snooping is enabled globally for the device.

When this command is issued in Interface mode for a VLAN then MLD Snooping is

enabled for the specified VLAN. Note that MLD Snooping is enabled on the VLAN

only if it is enabled globally and on the VLAN.

Use the no variant of this command to globally disable MLD Snooping in Global

Configuration mode, or for the specified VLAN interface in Interface mode.

Syntax ipv6 mld snooping

no ipv6 mld snooping

Default By default, MLD Snooping is enabled both globally and on all VLANs.

Mode Global Configuration and Interface Configuration for a specified VLAN interface or

a range of VLAN interfaces.

Usage For MLD Snooping to operate on particular VLAN interfaces, it must be enabled

both globally by using this command in Global Configuration mode, and on

individual VLAN interfaces by using this command in Interface Configuration

mode (both are enabled by default).

MLD requires memory for storing data structures, as well as the hardware tables to

implement hardware routing. As the number of ports, VLANs, static and dynamic

groups increases then more memory is consumed. You can track the memory used

for MLD with the command:

awplus# show memory pools nsm | grep MLD

Static and dynamic groups (LACP), ports and VLANs are not limited for MLD. For

VLANs, this allows you to configure MLD across more VLANs with fewer ports per

VLAN, or fewer VLANs with more ports per VLAN. For LACPs, you can configure

MLD across more LACP groups with fewer ports per LACP, or fewer LACP groups

with more ports per LACP.

Examples To configure MLD Snooping on the VLAN interfaces vlan2-vlan4, enter the

following commands:

awplus# configure terminal

awplus(config)# interface vlan2-vlan4

awplus(config-if)# ipv6 mld snooping

To disable MLD Snooping for the VLAN interfaces vlan2-vlan4, enter the

following commands:

awplus# configure terminal

awplus(config)# interface vlan2-vlan4

awplus(config)# no ipv6 mld snooping

C613-50292-01 Rev A Command Reference for IE210L Series 891

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD SNOOPING

To configure MLD Snooping globally for the device, enter the following

commands:

awplus# configure terminal

awplus(config)# ipv6 mld snooping

To disable MLD Snooping globally for the device, enter the following commands:

awplus# configure terminal

awplus(config)# no ipv6 mld snooping

C613-50292-01 Rev A Command Reference for IE210L Series 892

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD SNOOPING FAST-LEAVE

ipv6 mld snooping fast-leave

Overview Use this command to enable MLD Snooping fast-leave processing. Fast-leave

processing is analogous to immediate-leave processing; the MLD

group-membership is removed as soon as an MLD leave group message is

received, without sending out a group-specific query.

Use the no variant of this command to disable fast-leave processing.

Syntax ipv6 mld snooping fast-leave

no ipv6 mld snooping fast-leave

Default MLD Snooping fast-leave processing is disabled.

Mode Interface Configuration for a specified VLAN interface or a range of VLAN

interfaces.

Usage This MLD Snooping command can only be configured on VLAN interfaces.

Examples This example shows how to enable fast-leave processing on the VLAN interface

vlan2.

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 mld snooping fast-leave

This example shows how to enable fast-leave processing on the VLAN interface

vlan2- vlan4.

awplus# configure terminal

awplus(config)# interface vlan2-vlan4

awplus(config-if)# ipv6 mld snooping fast-leave

C613-50292-01 Rev A Command Reference for IE210L Series 893

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD SNOOPING MROUTER

ipv6 mld snooping mrouter

Overview Use this command to statically configure the specified port as a Multicast Router

interface for MLD Snooping within the specified VLAN.

See detailed usage notes below to configure static multicast router ports when

using static IPv6 multicast routes with EPSR, and the destination VLAN is an EPSR

data VLAN.

Use the no variant of this command to remove the static configuration of the

interface as a Multicast Router interface.

Syntax ipv6 mld snooping mrouter interface <port>

no ipv6 mld snooping mrouter interface <port>

Mode Interface Configuration for a specified VLAN interface or a range of VLAN

interfaces.

Usage This MLD Snooping command statically configures a switch port as a Multicast

Router interface.

Note that if static IPv6 multicast routing is being used with EPSR and the

destination VLAN is an EPSR data VLAN, then multicast router (mrouter) ports must

be statically configured. This minimizes disruption for multicast traffic in the event

of ring failure or restoration.

When configuring the EPSR data VLAN, statically configure mrouter ports so that

the multicast router can be reached in either direction around the EPSR ring.

For example, if port1.0.1 and port1.0.6 are ports on an EPSR data VLAN vlan101,

which is the destination for a static IPv6 multicast route, then configure both ports

as multicast router (mrouter) ports as shown in the example commands listed

below:

Figure 27-1: Example ipv6 mld snooping mrouter commands when static IPv6

multicast routing is being used and the destination VLAN is an EPSR

data VLAN:

Parameter Description

<port>Specify the name of the port.

awplus>enable

awplus#configure terminal

awplus(config)#interface vlan101

awplus(config-if)#ipv6 mld snooping mrouter interface port1.0.1

awplus(config-if)#ipv6 mld snooping mrouter interface port1.0.6

C613-50292-01 Rev A Command Reference for IE210L Series 894

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD SNOOPING MROUTER

Examples This example shows how to specify the next-hop interface to the multicast router

for VLAN interface vlan2:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 mld snooping mrouter interface

port1.0.5

This example shows how to specify the next-hop interface to the multicast router

for VLAN interfaces vlan2-vlan4:

awplus# configure terminal

awplus(config)# interface vlan2-vlan4

awplus(config-if)# ipv6 mld snooping mrouter interface

port1.0.5

C613-50292-01 Rev A Command Reference for IE210L Series 895

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD SNOOPING QUERIER

ipv6 mld snooping querier

Overview Use this command to enable MLD querier operation on a subnet (VLAN) when no

multicast routing protocol is configured in the subnet (VLAN). When enabled, the

MLD Snooping querier sends out periodic MLD queries for all interfaces on that

VLAN.

Use the no variant of this command to disable MLD querier configuration.

Syntax ipv6 mld snooping querier

no ipv6 mld snooping querier

Mode Interface Configuration for a specified VLAN interface.

Usage This command can only be configured on a single VLAN interface - not on multiple

VLANs.

The MLD Snooping querier uses the 0.0.0.0 Source IP address because it only

masquerades as an MLD querier for faster network convergence.

The MLD Snooping querier does not start, or automatically cease, the MLD Querier

operation if it detects query message(s) from a multicast router. It restarts as an

MLD Snooping querier if no queries are seen within the other querier interval.

Example awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 mld snooping querier

C613-50292-01 Rev A Command Reference for IE210L Series 896

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD SNOOPING REPORT-SUPPRESSION

ipv6 mld snooping report-suppression

Overview Use this command to enable report suppression from hosts for Multicast Listener

Discovery version 1 (MLDv1) on a VLAN in Interface Configuration mode.

Use the no variant of this command to disable report suppression on a VLAN in

Interface Configuration mode.

Syntax ipv6 mld snooping report-suppression

no ipv6 mld snooping report-suppression

Default Report suppression does not apply to MLDv2, and is turned on by default for

MLDv1 reports.

Mode Interface Configuration for a specified VLAN interface or a range of VLAN

interfaces.

Usage This MLD Snooping command can only be configured on VLAN interfaces.

MLDv1 Snooping maybe configured to suppress reports from hosts. When a

querier sends a query, only the first report for particular set of group(s) from a host

will be forwarded to the querier by the MLD Snooping device. Similar reports (to

the same set of groups) from other hosts, which would not change group

memberships in the querier, will be suppressed by the MLD Snooping device to

prevent 'flooding' of query responses.

Examples This example shows how to enable report suppression for MLD reports on VLAN

interface vlan2:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 mld snooping report-suppression

This example shows how to disable report suppression for MLD reports on VLAN

interface vlan2:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# no ipv6 mld snooping report-suppression

This example shows how to enable report suppression for MLD reports on VLAN

interfaces vlan2-vlan4:

awplus# configure terminal

awplus(config)# interface vlan2-vlan4

awplus(config-if)# ipv6 mld snooping report-suppression

C613-50292-01 Rev A Command Reference for IE210L Series 897

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD SNOOPING REPORT-SUPPRESSION

This example shows how to disable report suppression for MLD reports on VLAN

interfaces vlan2-vlan4:

awplus# configure terminal

awplus(config)# interface vlan2-vlan4

awplus(config-if)# no ipv6 mld snooping report-suppression

C613-50292-01 Rev A Command Reference for IE210L Series 898

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD STATIC-GROUP

ipv6 mld static-group

Overview Use this command to statically configure IPv6 group membership entries on an

interface. To statically add only a group membership, do not specify any

parameters.

Use the no variant of this command to delete static group membership entries.

Syntax ipv6 mld static-group <ipv6-group-address> [source

<ipv6-source-address>] [interface <port>]

no ipv6 mld static-group <ipv6-group-address> [source

<ipv6-source-address>] [interface <port>]

Mode Interface Configuration for a VLAN interface.

Usage This command applies to MLD Snooping on a VLAN interface to statically add

groups and/or source records.

Examples To add a static group record, use the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 mld static-group ff1e::10

To add a static group and source record, use the following commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 mld static-group ff1e::10 source

fe80::2fd:6cff:fe1c:b

Parameter Description

<ipv6-group-

address>Specify a standard IPv6 Multicast group address to be

configured as a static group member.

The IPv6 address uses the format X:X::X:X.

<ipv6-source-

address>Optional. Specify a standard IPv6 source address to be

configured as a static source from where multicast

packets originate.

The IPv6 address uses the format X:X::X:X.

<port>Optional. Physical interface. This parameter specifies a

physical port. If this parameter is used, the static

configuration is applied to just to that physical interface.

If this parameter is not used, the static configuration is

applied on all ports in the VLAN.

C613-50292-01 Rev A Command Reference for IE210L Series 899

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

IPV6 MLD STATIC-GROUP

To add a static group record on a specific port on vlan2, use the following

commands:

awplus# configure terminal

awplus(config)# interface vlan2

awplus(config-if)# ipv6 mld static-group ff1e::10 interface

port1.0.4

C613-50292-01 Rev A Command Reference for IE210L Series 900

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

SHOW DEBUGGING MLD

show debugging mld

Overview Use this command to display the MLD debugging modes enabled with the debug

mld command.

For information on filtering and saving command output, see the “Getting_Started

with AlliedWare Plus” Feature Overview and Configuration_Guide.

Syntax show debugging mld

Mode Privileged Exec

Example awplus# show debugging mld

Output

Commands

debug mld

show debugging mld 

MLD Debugging status: 

MLD Decoder debugging is on 

MLD Encoder debugging is on 

MLD Events debugging is on 

MLD FSM debugging is on 

MLD Tree-Info-Base (TIB) debugging is on 

C613-50292-01 Rev A Command Reference for IE210L Series 901

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

SHOW IPV6 MLD GROUPS

show ipv6 mld groups

Overview Use this command to display the multicast groups that have receivers directly

connected to the router and learned through MLD.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ipv6 mld groups [<ipv6-address>|<interface>] [detail]

Mode User Exec and Privileged Exec

Examples The following command displays local-membership information for all interfaces:

awplus# show ipv6 mld groups

Output Figure 27-2: Example output for show ipv6 mld groups

The following command displays local-membership information for all interfaces:

awplus# show ipv6 mld groups detail

Parameter Description

<ipv6-address>Optional. Specify Address of the multicast group in format

X:X::X:X.

<interface>Optional. Specify the Interface name for which to display local

information.

awplus#show ipv6 mld groups 

MLD Connected Group Membership 

Group Address Interface Uptime Expires 

Last Reporter 

ff08::1 vlan10 (port1.0.1) 00:07:27 00:03:10 

fe80::200:1ff:fe20:b5ac

C613-50292-01 Rev A Command Reference for IE210L Series 902

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

SHOW IPV6 MLD INTERFACE

show ipv6 mld interface

Overview Use this command to display the state of MLD and MLD Snooping for a specified

interface, or all interfaces.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show ipv6 mld interface [<interface>]

Mode User Exec and Privileged Exec

Example The following command displays MLD interface status on all interfaces enabled for

MLD:

awplus# show ipv6 mld interface

Output

Parameter Description

<interface>Interface name.

awplus#show ipv6 mld interface



Interface vlan1 (Index 301)

MLD Enabled, Active, Querier, Version 2 (default)

Internet address is fe80::215:77ff:fec9:7468

MLD interface has 0 group-record states

MLD activity: 0 joins, 0 leaves

MLD robustness variable is 2 

MLD last member query count is 2 

MLD query interval is 125 seconds

MLD querier timeout is 255 seconds

MLD max query response time is 10 seconds

Last member query response interval is 1000 milliseconds

Group Membership interval is 260 seconds

MLD Snooping is globally enabled

MLD Snooping is enabled on this interface

MLD Snooping fast-leave is not enabled

MLD Snooping querier is enabled

MLD Snooping report suppression is enabled

C613-50292-01 Rev A Command Reference for IE210L Series 903

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

SHOW IPV6 MLD SNOOPING MROUTER

show ipv6 mld snooping mrouter

Overview Use this command to display the multicast router interfaces, both configured and

learned, in a VLAN. If you do not specify a VLAN interface then all the VLAN

interfaces are displayed.

For information on filtering and saving command output, see the “Getting_Started

with AlliedWare Plus” Feature Overview and Configuration_Guide.

Syntax show ipv6 mld snooping mrouter [<interface>]

Mode User Exec and Privileged Exec

Examples The following command displays the multicast router interfaces in vlan2:

awplus# show ipv6 mld snooping mrouter vlan2

Output

The following command displays the multicast router interfaces for all VLAN

interfaces:

awplus# show ipv6 mld snooping mrouter

Output

Parameter Description

<interface>Optional. Specify the name of the VLAN interface. Note: If you do not

specify a single VLAN interface, then all VLAN interfaces are shown.

awplus#show ipv6 mld snooping mrouter vlan2

VLAN Interface Static/Dynamic

2 port1.0.2 Dynamically Learned

2 port1.0.3 Dynamically Learned

awplus#show ipv6 mld snooping mrouter

VLAN Interface Static/Dynamic

2 port1.0.2 Dynamically Learned

2 port1.0.3 Dynamically Learned

3 port1.0.4 Statically Assigned

3 port1.0.5 Statically Assigned

C613-50292-01 Rev A Command Reference for IE210L Series 904

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

MLD SNOOPING COMMANDS

SHOW IPV6 MLD SNOOPING STATISTICS

show ipv6 mld snooping statistics

Overview Use this command to display MLD Snooping statistics data.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus”_Feature Overview and Configuration Guide.

Syntax show ipv6 mld snooping statistics interface <interface>

Mode User Exec and Privileged Exec

Example The following command displays MLDv2 statistical information for vlan1:

awplus# show ipv6 mld snooping statistics interface vlan1

Output

Parameter Description

<interface>The name of the VLAN interface.

awplus#show ipv6 mld snooping statistics interface vlan1

MLD Snooping statistics for vlan1 

Interface: port1.0.1

Group: ff08::1 

Uptime: 00:02:18 

Group mode: Include () 

Last reporter: fe80::eecd:6dff:fe6b:4783 

Group source list: (R - Remote, M - SSM Mapping, S - Static ) 

Source Address Uptime v2 Exp Fwd Flags 

2001:db8::1 00:02:18 00:02:02 Yes R 

2001:db8::3 00:02:18 00:02:02 Yes R

C613-50292-01 Rev A Command Reference for IE210L Series 905

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Part 5: Access and Security

C613-50292-01 Rev A Command Reference for IE210L Series 906

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPv4 Hardware

Access Control List

(ACL) Commands

Introduction

Overview This chapter provides an alphabetical reference of IPv4 Hardware Access Control

List (ACL) commands. It contains detailed command information and command

examples about IPv4 hardware ACLs, which you can apply directly to interfaces

using the access-group command.

To apply ACLs to an LACP channel group, apply it to all the individual switch ports

in the channel group. To apply ACLs to a static channel group, apply it to the static

channel group itself.

Most ACL command titles include information in parentheses:

• When the command title ends with words in parentheses, these words

indicate usage instead of keywords to enter into the CLI. For example, the

title access-list (numbered hardware ACL for ICMP) indicates that the

command is used to create an ACL with the syntax:

access-list <3000-3699> <action> icmp <source-ip> <dest-ip>

[icmp-type <number>] [vlan <1-4094>]

• When the command title is completely surrounded by parentheses, the title

indicates the type of ACL filter instead of keywords to enter into the CLI. For

example, the title (named hardware ACL: ICMP entry) represents a

command with the syntax:

[<sequence-number>] <action> icmp <source-ip> <dest-ip>

[icmp-type <number>] [vlan <1-4094>]

Hardware ACLs will permit access unless explicitly denied by an ACL action.

Sub-modes Many of the ACL commands operate from sub-modes that are specific to particular

ACL types. The following table shows the CLI prompts at which ACL commands are

entered.

C613-50292-01 Rev A Command Reference for IE210L Series 907

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

References For descriptions of ACLs, and further information about rules when applying them,

see the ACL Feature Overview and Configuration Guide.

For more information on link aggregation see the following references:

•the Link Aggregation Feature Overview_and_Configuration_Guide.

•Link Aggregation Commands

Command List •“access-group” on page 909

•“access-list (numbered hardware ACL for ICMP)” on page 911

Table 28-1: IPv4 Hardware Access List Commands and Prompts

Command Name Command Mode Prompt

show interface access-group Privileged Exec awplus#

show access-group Privileged Exec awplus#

show access-list (IPv4 Hardware ACLs) Privileged Exec awplus#

show interface access-group Privileged Exec awplus#

access-list (numbered hardware ACL for IP

packets)

Global Configuration awplus(config)#

access-list (numbered hardware ACL for

ICMP)

Global Configuration awplus(config)#

access-list (numbered hardware ACL for IP

protocols)

Global Configuration awplus(config)#

access-list (numbered hardware ACL for

TCP or UDP)

Global Configuration awplus(config)#

access-list (numbered hardware ACL for

MAC addresses)

Global Configuration awplus(config)#

access-list hardware (named hardware

ACL)

Global Configuration awplus(config)#

(named hardware ACL entry for IP packets) IPv4 Hardware ACL

Configuration awplus(config-ip-hw-acl)#

(named hardware ACL entry for ICMP) IPv4 Hardware ACL

Configuration awplus(config-ip-hw-acl)#

(named hardware ACL entry for IP

protocols)

IPv4 Hardware ACL

Configuration awplus(config-ip-hw-acl)#

(named hardware ACL entry for TCP or

UDP)

IPv4 Hardware ACL

Configuration awplus(config-ip-hw-acl)#

(named hardware ACL entry for MAC

addresses)

IPv4 Hardware ACL

Configuration awplus(config-ip-hw-acl)#

commit (IPv4) IPv4 Hardware ACL

Configuration awplus(config-ip-hw-acl)#

access-group Interface Configuration awplus(config-if)#

C613-50292-01 Rev A Command Reference for IE210L Series 908

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

•“access-list (numbered hardware ACL for IP packets)” on page 915

•“access-list (numbered hardware ACL for IP protocols)” on page 918

•“access-list (numbered hardware ACL for MAC addresses)” on page 923

•“access-list (numbered hardware ACL for TCP or UDP)” on page 926

•“access-list hardware (named hardware ACL)” on page 930

•“(named hardware ACL entry for ICMP)” on page 932

•“(named hardware ACL entry for IP packets)” on page 936

•“(named hardware ACL entry for IP protocols)” on page 940

•“(named hardware ACL entry for MAC addresses)” on page 945

•“(named hardware ACL entry for TCP or UDP)” on page 948

•“commit (IPv4)” on page 952

•“show access-group” on page 953

•“show access-list (IPv4 Hardware ACLs)” on page 954

•“show interface access-group” on page 956

C613-50292-01 Rev A Command Reference for IE210L Series 909

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-GROUP

access-group

Overview This command adds or removes a hardware-based access-list to or from a switch

port interface or interfaces. The number of hardware numbered and named

access-lists that can be added to a switch port interface is determined by the

available memory in hardware-based packet classification tables.

This command works in Interface Configuration mode to apply hardware

access-lists to selected switch port interfaces.

The no variant of this command removes the selected access-list from an interface.

Syntax access-group

[<3000-3699>|<4000-4699>|<hardware-access-list-name>]

no access-group

[<3000-3699>|<4000-4699>|<hardware-access-list-name>]

Mode Interface Configuration for a switch port interface or interfaces

Default Any traffic on an interface controlled by a hardware ACL that does not explicitly

match a filter is permitted.

Usage First create an IP access-list that applies the appropriate permit/deny requirements

with the access-list (numbered hardware ACL for IP packets) command, the

access-list (numbered hardware ACL for MAC addresses) command or the

access-list hardware (named hardware ACL) command. Then use this command to

apply this hardware access- list to a specific port or port range. Note that this

command will apply the access-list only to incoming data packets.

To apply ACLs to an LACP aggregated link, apply it to all the individual switch ports

in the aggregated group. To apply ACLs to a static channel group, apply it to the

static channel group itself. An ACL can even be applied to a static aggregated link

that spans more than one switch instance (Link Aggregation Commands).

Note that you cannot apply software numbered ACLs to switch port interfaces with

the access-group command. This command will only apply hardware ACLs.

NOTE: Hardware ACLs will permit access unless explicitly denied by an ACL action.

Parameter Description

<3000-3699> Hardware IP access-list.

<4000-4699>Hardware MAC access-list.

<hardware-access-list-name>The hardware access-list name.

C613-50292-01 Rev A Command Reference for IE210L Series 910

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-GROUP

Examples To add the numbered hardware access-list 3005 to switch port interface port1.0.1,

enter the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# access-group 3005

To add the named hardware access-list “hw-acl” to switch port interface port1.0.2,

enter the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# access-group hw-acl

To apply an ACL to static channel group 2 containing switch port1.0.3 and

port1.0.4, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.3-port1.0.4

awplus(config-if)# static-channel-group 2

awplus(config)# interface sa2

awplus(config-if)# access-group 3000

Commands

access-list hardware (named hardware ACL)

access-list (numbered hardware ACL for IP packets)

access-list (numbered hardware ACL for MAC addresses)

show interface access-group

C613-50292-01 Rev A Command Reference for IE210L Series 911

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR ICMP)

access-list (numbered hardware ACL for

ICMP)

Overview This command creates an access-list for use with hardware classification. The

access-list will match on ICMP packets that have the specified source and

destination IP addresses and, optionally, ICMP type. You can use the value any

instead of source or destination address if an address does not matter.

Once you have configured the ACL, you can use the access-group or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map.

The optional vlan parameter can be used to match tagged (802.1q) packets.

The no variant of this command removes the previously specified access-list.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax access-list <3000-3699> <action> icmp <source-ip> <dest-ip>

[icmp-type <number>] [vlan <1-4094>]

no access-list <3000-3699>

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 912

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR ICMP)

Parameter Description

<3000-3699>An ID number for this hardware IP access-list.

<action> The action that the switch will take on matching packets. See the

table above for valid values.

icmp Match against ICMP packets

<source-ip> The source addresses to match against. You can specify a single

host, a subnet, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source IP address.

host <ip-addr> Match a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any source IP address within

the specified subnet. Specify the

subnet by entering the IPv4 address,

then a forward slash, then the prefix

length.

<ip-addr>

<reverse-mask>Match any source IP address within

the specified subnet. Specify the

subnet by entering a reverse mask in

dotted decimal format. For example,

entering “192.168.1.1 0.0.0.255” is the

same as entering 192.168.1.1/24.

<dest-ip>The destination addresses to match against. You can specify a

single host, a subnet, or all destination addresses. The following

are the valid formats for specifying the destination:

any Match any destination IP address.

host <ip-addr> Match a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any destination IP address

within the specified subnet. Specify

the subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

<ip-addr>

<reverse-mask>Match any destination IP address

within the specified subnet. Specify

the subnet by entering a reverse

mask in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

icmp-type

<number>The type of ICMP message to match against, as defined in RFC792

and RFC950. Values include:

0Echo replies.

C613-50292-01 Rev A Command Reference for IE210L Series 913

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR ICMP)

Mode Global Configuration

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage This command creates an ACL for use with hardware classification. Once you have

configured the ACL, use the access-group or the match access-group command to

apply this ACL to a port, VLAN or QoS class-map.

ACLs numbered in the range 3000-3699 match on packets that have the specified

source and destination IP addresses.

ICMP ACLs will match any ICMP packet that has the specified source and

destination IP addresses and ICMP type. The ICMP type is an optional parameter.

Examples To create an access-list that will permit ICMP packets with a source address of

192.168.1.0/24 with any destination address and an ICMP type of 5 enter the

following commands:

awplus# configure terminal

awplus(config)# access-list 3000 permit icmp 192.168.1.0/24 any

icmp-type 5

To destroy the access-list with an access-list identity of 3000 enter the following

commands:

awplus# configure terminal

awplus(config)# no access-list 3000

Commands

access-group

3Destination unreachable messages.

4Source quench messages.

5Redirect (change route) messages.

8Echo requests.

11 Time exceeded messages.

12 Parameter problem messages.

13 Timestamp requests.

14 Timestamp replies.

15 Information requests.

16 Information replies.

17 Address mask requests.

18 Address mask replies.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 914

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR ICMP)

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 915

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR IP PACKETS)

access-list (numbered hardware ACL for IP

packets)

Overview This command creates an access-list for use with hardware classification. The

access-list will match on packets that have the specified source and destination IP

addresses. You can use the value any instead of source or destination address if an

address does not matter.

Once you have configured the ACL, you can use the access-group or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map.

The optional vlan parameter can be used to match tagged (802.1q) packets.

The no variant of this command removes the previously specified IP hardware

access-list.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax access-list <3000-3699> <action> ip <source-ip> <dest-ip> [vlan

<1-4094>]

no access-list <3000-3699>

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 916

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR IP PACKETS)

Table 28-2: IP and ICMP parameters in access-list (hardware IP numbered)

Parameter Description

<3000-3699>An ID number for this hardware IP access-list.

<action> The action that the switch will take on matching packets. See the

table above for valid values.

ip Match against IP packets

<source-ip> The source addresses to match against. You can specify a single

host, a subnet, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source IP address.

host <ip-addr> Match a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any source IP address within

the specified subnet. Specify the

subnet by entering the IPv4 address,

then a forward slash, then the prefix

length.

<ip-addr>

<reverse-mask>Match any source IP address within

the specified subnet. Specify the

subnet by entering a reverse mask in

dotted decimal format. For example,

entering “192.168.1.1 0.0.0.255” is

the same as entering 192.168.1.1/24.

<dest-ip>The destination addresses to match against. You can specify a

single host, a subnet, or all destination addresses. The following

are the valid formats for specifying the destination:

any Match any destination IP address.

host <ip-addr> Match a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any destination IP address

within the specified subnet. Specify

the subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

<ip-addr>

<reverse-mask>Match any destination IP address

within the specified subnet. Specify

the subnet by entering a reverse

mask in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

C613-50292-01 Rev A Command Reference for IE210L Series 917

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR IP PACKETS)

Mode Global Configuration

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage This command creates an ACL for use with hardware classification. Once you have

configured the ACL, use the access-group or the match access-group command to

apply this ACL to a port, VLAN or QoS class-map.

ACLs numbered in the range 3000-3699 match on packets that have the specified

source and destination IP addresses.

Examples To create an access-list that will permit IP packets with a source address of

192.168.1.1 and any destination address, enter the commands:

awplus# configure terminal

awplus(config)# access-list 3000 permit ip 192.168.1.1/32 any

To destroy the access-list with an access-list identity of 3000 enter the following

commands:

awplus# configure terminal

awplus(config)# no access-list 3000

Commands

access-group

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 918

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR IP PROTOCOLS)

access-list (numbered hardware ACL for IP

protocols)

Overview This command creates an access-list for use with hardware classification. The

access-list will match on packets that have the specified source and destination IP

addresses and IP protocol number. You can use the value any instead of source or

destination address if an address does not matter.

Once you have configured the ACL, you can use the access-group or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map.

The optional vlan parameter can be used to match tagged (802.1q) packets.

The no variant of this command removes the previously specified IP hardware

access-list.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax access-list <3000-3699> <action> proto <1-255> <source-ip>

<dest-ip> [vlan <1-4094>]

no access-list <3000-3699>

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 919

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR IP PROTOCOLS)

Table 28-3: Parameters in access-list (hardware IP numbered)

Parameter Description

<3000-3699>An ID number for this hardware IP access-list.

<action> The action that the switch will take on matching packets. See the

table above for valid values.

proto <1-255>The IP protocol number to match against, as defined by IANA

(Internet Assigned Numbers Authority

www.iana.org/assignments/protocol-numbers)

See below for a list of IP protocol numbers and their descriptions.

<source-ip> The source addresses to match against. You can specify a single

host, a subnet, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source IP address.

host <ip-addr> Match a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any source IP address within

the specified subnet. Specify the

subnet by entering the IPv4 address,

then a forward slash, then the prefix

length.

<ip-addr>

<reverse-mask>Match any source IP address within

the specified subnet. Specify the

subnet by entering a reverse mask in

dotted decimal format. For example,

entering “192.168.1.1 0.0.0.255” is

the same as entering 192.168.1.1/24.

<dest-ip>The destination addresses to match against. You can specify a

single host, a subnet, or all destination addresses. The following

are the valid formats for specifying the destination:

any Match any destination IP address.

host <ip-addr> Match a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any destination IP address

within the specified subnet. Specify

the subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

C613-50292-01 Rev A Command Reference for IE210L Series 920

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR IP PROTOCOLS)

<ip-addr>

<reverse-mask>Match any destination IP address

within the specified subnet. Specify

the subnet by entering a reverse

mask in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Table 28-4: IP protocol number and description

Protocol Number Protocol Description [RFC]

1Internet Control Message [RFC792]

2Internet Group Management [RFC1112]

3Gateway-to-Gateway [RFC823]

4IP in IP [RFC2003]

5Stream [RFC1190] [RFC1819]

6TCP (Transmission Control Protocol) [RFC793]

8EGP (Exterior Gateway Protocol) [RFC888]

9IGP (Interior Gateway Protocol) [IANA]

11 Network Voice Protocol [RFC741]

17 UDP (User Datagram Protocol) [RFC768]

20 Host monitoring [RFC869]

27 RDP (Reliable Data Protocol) [RFC908]

28 IRTP (Internet Reliable Transaction Protocol) [RFC938]

29 ISO-TP4 (ISO Transport Protocol Class 4) [RFC905]

30 Bulk Data Transfer Protocol [RFC969]

33 DCCP (Datagram Congestion Control Protocol) [RFC4340]

48 DSR (Dynamic Source Routing Protocol) [RFC4728]

50 ESP (Encap Security Payload) [RFC2406]

51 AH (Authentication Header) [RFC2402]

54 NARP (NBMA Address Resolution Protocol) [RFC1735]

58 ICMP for IPv6 [RFC1883]

59 No Next Header for IPv6 [RFC1883]

60 Destination Options for IPv6 [RFC1883]

Table 28-3: Parameters in access-list (hardware IP numbered) (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 921

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR IP PROTOCOLS)

Mode Global Configuration

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage This command creates an ACL for use with hardware classification. Once you have

configured the ACL, use the access-group or the match access-group command to

apply this ACL to a port, VLAN or QoS class-map.

ACLs numbered in the range 3000-3699 match on packets that have the specified

source and destination IP addresses.

Examples To create an access-list that will deny all IGMP packets (IP protocol 2) from the

192.168.0.0 network, enter the commands:

awplus# configure terminal

awplus(config)# access-list 3000 deny proto 2 192.168.0.0/16

any

To destroy the access-list with an access-list identity of 3000 enter the following

commands:

awplus# configure terminal

awplus(config)# no access-list 3000

Commands

access-group

88 EIGRP (Enhanced Interior Gateway Routing Protocol)

89 OSPFIGP [RFC1583]

97 Ethernet-within-IP Encapsulation / RFC3378

98 Encapsulation Header / RFC1241

108 IP Payload Compression Protocol / RFC2393

112 Virtual Router Redundancy Protocol / RFC3768

134 RSVP-E2E-IGNORE / RFC3175

135 Mobility Header / RFC3775

136 UDPLite / RFC3828

137 MPLS-in-IP / RFC4023

138 MANET Protocols / RFC-ietf-manet-iana-07.txt

139-252 Unassigned / IANA

253 Use for experimentation and testing / RFC3692

254 Use for experimentation and testing / RFC3692

255 Reserved / IANA

Table 28-4: IP protocol number and description (cont.)

Protocol Number Protocol Description [RFC]

C613-50292-01 Rev A Command Reference for IE210L Series 922

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR IP PROTOCOLS)

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 923

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR MAC ADDRESSES)

access-list (numbered hardware ACL for

MAC addresses)

Overview This command creates an access-list for use with hardware classification. The

access-list will match on packets that have the specified source and destination

MAC addresses. You can use the value any instead of source or destination address

if an address does not matter.

Once you have configured the ACL, you can use the access-group or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map.

The no variant of this command removes the specified MAC hardware filter

access-list.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax access-list <4000-4699> <action> {<source-mac>|any}

{<dest-mac>|any} [vlan <1-4094>] [inner-vlan

<1-4094>]

no access-list <4000-4699>

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 924

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR MAC ADDRESSES)

Mode Global Configuration

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage This command creates an ACL for use with hardware classification. Once you have

configured the ACL, use the access-group or the match access-group command to

apply this ACL to a port, VLAN or QoS class-map.

ACLs numbered in the range 4000-4699 match on packets that have the specified

source and destination MAC addresses.

Examples To create an access-list that will permit packets with a source MAC address of

0000.00ab.1234 and any destination address, use the commands:

awplus# configure terminal

awplus(config)# access-list 4000 permit 0000.00ab.1234

0000.0000.0000 any

Parameter Description

<4000-4699>Hardware MAC access-list.

<action> The action that the switch will take on matching packets. See the

table above for valid values.

<source-mac> The source MAC address to match against, followed by the mask.

Enter the address in the format <HHHH.HHHH.HHHH>, where each

H is a hexadecimal number.

Enter the mask in the format <HHHH.HHHH.HHHH>, where each H

is a hexadecimal number. For a mask, each value is either 0 or F,

where FF = Ignore, and 00 = Match.

any Match against any source MAC address.

<dest-mac> The destination MAC address to match against, followed by the

mask.

Enter the address in the format <HHHH.HHHH.HHHH>, where each

H is a hexadecimal number.

Enter the mask in the format <HHHH.HHHH.HHHH>, where each H

is a hexadecimal number. For a mask, each value is either 0 or F,

where FF = Ignore, and 00 = Match.

any Match against any destination MAC address.

vlan <1-4094>Match against the specified ID in the packet’s VLAN tag.

inner-vlan

<1-4094>Match against the inner VLAN tag (VID). This parameter is used

within double-tagged VLANs. It is sometimes referred to as the

C-TAG (Customer VLAN TAG), where the vlan VID tag is referred to as

the S-TAG (Service VLAN TAG).

C613-50292-01 Rev A Command Reference for IE210L Series 925

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR MAC ADDRESSES)

To create an access-list that will permit packets if their source MAC address starts

with 0000.00ab, use the commands:

awplus# configure terminal

awplus(config)# access-list 4001 permit 0000.00ab.1234

0000.0000.FFFF any

To create an access-list that will send a copy of packets to the mirror port if their

source MAC address starts with 0000.00ab, use the commands:

awplus# configure terminal

awplus(config)# access-list 4001 copy-to-mirror 0000.00ab.1234

0000.0000.FFFF any

You also need to configure the mirror port with the mirror interface command.

To destroy the access-list with an access-list identity of 4000 enter the commands:

awplus# configure terminal

awplus(config)# no access-list 4000

Commands

access-group

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 926

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR TCP OR UDP)

access-list (numbered hardware ACL for TCP

or UDP)

Overview This command creates an access-list for use with hardware classification. The

access-list will match on TCP or UDP packets that have the specified source and

destination IP addresses and optionally, port values. You can use the value any

instead of source or destination IP address if an address does not matter.

Once you have configured the ACL, you can use the access-group or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map.

You can use the optional vlan parameter to match tagged (802.1q) packets.

The no variant of this command removes the specified IP hardware access-list.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax access-list <3000-3699> <action> {tcp|udp} <source-ip>

[<source-ports>] <dest-ip> [<dest-ports>] [vlan <1-4094>]

no access-list <3000-3699>

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 927

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR TCP OR UDP)

Parameter Description

<3000-3699>An ID number for this hardware IP access-list.

<action> The action that the switch will take on matching packets. See the

table above for valid values.

tcp Match against TCP packets.

udp Match against UDP packets.

<source-ip> The source addresses to match against. You can specify a single

host, a subnet, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source IP address.

host <ip-addr> Match a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any source IP address within

the specified subnet. Specify the

subnet by entering the IPv4 address,

then a forward slash, then the prefix

length.

<ip-addr>

<reverse-mask>Match any source IP address within

the specified subnet. Specify the

subnet by entering a reverse mask in

dotted decimal format. For example,

entering “192.168.1.1 0.0.0.255” is

the same as entering 192.168.1.1/24.

<source-ports

>Match source TCP or UDP port numbers. Port numbers are

specified as integers between 0 and 65535. You can specify one or

more port numbers as follows:

eq <0-65535> Match a single port number.

lt <0-65535> Match all port numbers that are less

than the specified port number.

gt <0-65535> Match all port numbers that are

greater than the specified port

number.

ne <0-65535> Match all port numbers except the

specified port number.

range <start-port>

<end-port>Match a range of port numbers.

<dest-ip>The destination addresses to match against. You can specify a

single host, a subnet, or all destination addresses. The following

are the valid formats for specifying the destination:

any Match any destination IP address.

host <ip-addr> Match a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

C613-50292-01 Rev A Command Reference for IE210L Series 928

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR TCP OR UDP)

Mode Global Configuration

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage This command creates an ACL for use with hardware classification. Once you have

configured the ACL, use the access-group or the match access-group command to

apply this ACL to a port, VLAN or QoS class-map.

ACLs numbered in the range 3000-3699 match on packets that have the specified

source and destination IP addresses.

Examples To create an access-list that will permit TCP packets with a destination address of

192.168.1.1, a destination port of 80, and any source address and source port, enter

the commands:

awplus# configure terminal

awplus(config)# access-list 3000 permit tcp any 192.168.1.1/32

eq 80

<ip-addr>/<prefix>Match any destination IP address

within the specified subnet. Specify

the subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

<ip-addr>

<reverse-mask>Match any destination IP address

within the specified subnet. Specify

the subnet by entering a reverse

mask in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<dest-ports>Match destination TCP or UDP port numbers. Port numbers are

specified as integers between 0 and 65535. You can specify one or

more port numbers as follows:

eq <0-65535> Match a single port number.

lt <0-65535> Match all port numbers that are less

than the specified port number.

gt <0-65535> Match all port numbers that are

greater than the specified port

number.

ne <0-65535> Match all port numbers except the

specified port number.

range <start-port>

<end-port>Match a range of port numbers.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 929

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (NUMBERED HARDWARE ACL FOR TCP OR UDP)

To create an access-list that will copy TCP packets to the mirror port, if they have a

destination address of 192.168.1.1, a destination port of 80, and any source address

and source port, enter the commands:

awplus# configure terminal

awplus(config)# access-list 3000 copy-to-mirror tcp any

192.168.1.1/32 eq 80

You also need to configure the mirror port with the mirror interface command.

Commands

access-group

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 930

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST HARDWARE (NAMED HARDWARE ACL)

access-list hardware (named hardware ACL)

Overview This command creates a named hardware access-list and puts you into IPv4

Hardware ACL Configuration mode, where you can add filter entries to the ACL.

Once you have configured the ACL, you can use the access-group or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map.

The no variant of this command removes the specified named hardware ACL.

Syntax access-list hardware <name>

no access-list hardware <name>

Mode Global Configuration

Default Any traffic on an interface controlled by a hardware ACL that does not explicitly

match a filter is permitted.

Usage Use this command to name a hardware ACL and enter the IPv4 Hardware ACL

Configuration mode. If the named hardware ACL does not exist, it will be created

after entry. If the named hardware ACL already exists, then this command puts you

into IPv4 Hardware ACL Configuration mode for that existing ACL.

Entering this command moves you to the IPv4 Hardware ACL Configuration mode

(config-ip-hw-acl prompt), so you can enter ACL filters with sequence numbers.

From this prompt, configure the filters for the ACL. See the ACL Feature Overview

and Configuration Guide for complete examples of configured sequenced

numbered ACLs.

NOTE: Hardware ACLs will permit access unless explicitly denied by an ACL action.

Examples To create the hardware access-list named “ACL-1” and enter the IPv4 Hardware

ACL Configuration mode to specify the ACL filter entry, use the commands:

awplus# configure terminal

awplus(config)# access-list hardware ACL-1

awplus(config-ip-hw-acl)#

To remove the hardware access-list named “ACL-1”, use the commands:

awplus# configure terminal

awplus(config)# no access-list hardware ACL-1

Parameter Description

<name>Specify a name for the hardware ACL.

C613-50292-01 Rev A Command Reference for IE210L Series 931

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST HARDWARE (NAMED HARDWARE ACL)

Commands

access-group

(named hardware ACL entry for ICMP)

(named hardware ACL entry for IP protocols)

(named hardware ACL entry for TCP or UDP)

(access-list standard named filter)

show access-list (IPv4 Hardware ACLs)

C613-50292-01 Rev A Command Reference for IE210L Series 932

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR ICMP)

(named hardware ACL entry for ICMP)

Overview Use this command to add a new ICMP filter entry to the current hardware

access-list. The filter will match on any ICMP packet that has the specified source

and destination IP addresses and (optionally) ICMP type. You can specify the value

any if source or destination address does not matter.

If you specify a sequence number, the switch inserts the new filter at the specified

location. Otherwise, the switch adds the new filter to the end of the access-list.

The no variant of this command removes an ICMP filter entry from the current

hardware access-list. You can specify the ICMP filter entry for removal by entering

either its sequence number (e.g. no 100), or by entering its ICMP filter profile

without specifying its sequence number (e.g. no permit icmp 192.168.1.0/24 any

icmp-type 11).

You can find the sequence number by running the show access-list (IPv4 Hardware

ACLs) command.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax [<sequence-number>] <action> icmp <source-ip> <dest-ip>

[icmp-type <number>] [vlan <1-4094>]

no <sequence-number>

no <action> icmp <source-ip> <dest-ip> [icmp-type <number>]

[vlan <1-4094>]

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

C613-50292-01 Rev A Command Reference for IE210L Series 933

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR ICMP)

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

Parameter Description

<sequence-



number>The sequence number for the filter entry of the selected access

control list, in the range 1-65535. If you do not specify a

sequence number, the switch puts the entry at the end of the

ACL and assigns it the next available multiple of 10 as its

sequence number. .

<action> The action that the switch will take on matching packets. See

the table above for valid values.

icmp Match against ICMP packets

<source-ip> The source addresses to match against. You can specify a single

host, a subnet, or all source addresses. The following are the

valid formats for specifying the source:

any Match any source IP address.

host <ip-addr> Match a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any source IP address within

the specified subnet. Specify the

subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

<ip-addr>

<reverse-mask>Match any source IP address within

the specified subnet. Specify the

subnet by entering a reverse mask

in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<dest-ip>The destination addresses to match against. You can specify a

single host, a subnet, or all destination addresses. The following

are the valid formats for specifying the destination:

any Match any destination IP address.

host <ip-addr> Match a single destination host

with the IP address given by

<ip-addr> in dotted decimal

notation.

Values for the <action> parameter

C613-50292-01 Rev A Command Reference for IE210L Series 934

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR ICMP)

Mode IPv4 Hardware ACL Configuration (accessed by running the command access-list

hardware (named hardware ACL))

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage To use this command, first run the command access-list hardware (named

hardware ACL) and enter the desired access-list name. This changes the prompt to

awplus(config-ip-hw-acl)#.

Then use this command (and the other “named hardware ACL: entry” commands)

to add filter entries. You can add multiple filter entries to an ACL. You can insert a

<ip-addr>/<prefix>Match any destination IP address

within the specified subnet.

Specify the subnet by entering the

IPv4 address, then a forward slash,

then the prefix length.

<ip-addr>

<reverse-mask>Match any destination IP address

within the specified subnet.

Specify the subnet by entering a

reverse mask in dotted decimal

format. For example, entering

“192.168.1.1 0.0.0.255” is the same

as entering 192.168.1.1/24.

icmp-type

<number>The type of ICMP message to match against, as defined in

RFC792 and RFC950. Values include:

0Echo replies.

3Destination unreachable

messages.

4Source quench messages.

5Redirect (change route) messages.

8Echo requests.

11 Time exceeded messages.

12 Parameter problem messages.

13 Timestamp requests.

14 Timestamp replies.

15 Information requests.

16 Information replies.

17 Address mask requests.

18 Address mask replies.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 935

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR ICMP)

new filter entry into the middle of an existing list by specifying the appropriate

sequence number. If you do not specify a sequence number, the switch puts the

entry at the end of the ACL and assigns it the next available multiple of 10 as its

sequence number.

Then use the access-group or the match access-group command to apply this ACL

to a port, VLAN or QoS class-map. Note that the ACL will only apply to incoming

data packets.

Examples To add an access-list filter entry with a sequence number of 100 to the access-list

named “my-list” that will permit ICMP packets with a source address of

192.168.1.0/24, any destination address and an ICMP type of 5, use the commands:

awplus# configure terminal

awplus(config)# access-list hardware my-list

awplus(config-ip-hw-acl)# 100 permit icmp 192.168.1.0/24 any

icmp-type 5

To remove an access-list filter entry with a sequence number of 100 from the

access-list named “my-list”, use the commands:

awplus# configure terminal

awplus(config)# access-list hardware my-list

awplus(config-ip-hw-acl)# no 100

Commands

access-group

access-list hardware (named hardware ACL)

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 936

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR IP PACKETS)

(named hardware ACL entry for IP packets)

Overview Use this command to add an IP packet filter entry to the current hardware

access-list. The filter will match on IP packets that have the specified IP and/or MAC

addresses. You can use the value any instead of source or destination IP or MAC

address if an address does not matter.

If you specify a sequence number, the switch inserts the new filter at the specified

location. Otherwise, the switch adds the new filter to the end of the access-list.

The no variant of this command removes a filter entry from the current hardware

access-list. You can specify the filter entry for removal by entering either its

sequence number (e.g. no 100), or by entering its filter profile without specifying

its sequence number (e.g. no deny ip 192.168.0.0/16 any).

You can find the sequence number by running the show access-list (IPv4 Hardware

ACLs) command.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax [<sequence-number>] <action> ip <source-ip> <dest-ip>

[<source-mac> <dest-mac>] [vlan <1-4094>]

no <sequence-number>

no <action> ip <source-ip> <dest-ip> [<source-mac> <dest-mac>]

[vlan <1-4094>]

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 937

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR IP PACKETS)

Parameter Description

<sequence-



number>The sequence number for the filter entry of the selected access

control list, in the range 1-65535. If you do not specify a sequence

number, the switch puts the entry at the end of the ACL and

assigns it the next available multiple of 10 as its sequence

number. .

<action> The action that the switch will take on matching packets. See the

table above for valid values.

ip Match against IP packets

<source-ip> The source addresses to match against. You can specify a single

host, a subnet, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source IP address.

dhcpsnooping Match the source address learned

from the DHCP Snooping binding

database.

host <ip-addr> Match a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any source IP address within

the specified subnet. Specify the

subnet by entering the IPv4 address,

then a forward slash, then the prefix

length.

<ip-addr>

<reverse-mask>Match any source IP address within

the specified subnet. Specify the

subnet by entering a reverse mask

in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<dest-ip>The destination addresses to match against. You can specify a

single host, a subnet, or all destination addresses. The following

are the valid formats for specifying the destination:

any Match any destination IP address.

host <ip-addr> Match a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any destination IP address

within the specified subnet. Specify

the subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

C613-50292-01 Rev A Command Reference for IE210L Series 938

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR IP PACKETS)

Mode IPv4 Hardware ACL Configuration (accessed by running the command access-list

hardware (named hardware ACL))

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

<ip-addr>

<reverse-mask>Match any destination IP address

within the specified subnet. Specify

the subnet by entering a reverse

mask in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<source-mac> The source MAC address to match against. You can specify a

single MAC address, a range (through a mask), the address

learned from DHCP snooping, or any:

any Match against any source MAC

address.

<source-mac> The source MAC address to match

against, followed by the mask.

Enter the address in the format

<HHHH.HHHH.HHHH>, where each

H is a hexadecimal number.

Enter the mask in the format

<HHHH.HHHH.HHHH>, where each

H is a hexadecimal number. For a

mask, each value is either 0 or F,

where FF = Ignore, and 00 = Match.

dhcpsnooping Match the source address learned

from the DHCP Snooping binding

database.

<dest-mac> The destination MAC address to match against. You can specify a

single MAC address, a range (through a mask), or any:

any Match against any destination MAC

address.

<dest-mac> The destination MAC address to

match against, followed by the

mask.

Enter the address in the format

<HHHH.HHHH.HHHH>, where each

H is a hexadecimal number.

Enter the mask in the format

<HHHH.HHHH.HHHH>, where each

H is a hexadecimal number. For a

mask, each value is either 0 or F,

where FF = Ignore, and 00 = Match.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 939

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR IP PACKETS)

Usage To use this command, first run the command access-list hardware (named

hardware ACL) and enter the desired access-list name. This changes the prompt to

awplus(config-ip-hw-acl)#.

Then use this command (and the other “named hardware ACL: entry” commands)

to add filter entries. You can add multiple filter entries to an ACL. You can insert a

new filter entry into the middle of an existing list by specifying the appropriate

sequence number. If you do not specify a sequence number, the switch puts the

entry at the end of the ACL and assigns it the next available multiple of 10 as its

sequence number.

Then use the access-group or the match access-group command to apply this ACL

to a port, VLAN or QoS class-map. Note that the ACL will only apply to incoming

data packets.

Examples To add a filter entry to the access-list named “my-list” that will permit any IP packet

with a source address of 192.168.1.1, use the commands:

awplus# configure terminal

awplus(config)# access-list hardware my-list

awplus(config-ip-hw-acl)# permit ip 192.168.1.1/32 any

To add a filter entry to the access-list named “my-list” that will permit any IP packet

with a source address of 192.168.1.1and a MAC source address of ffee.ddcc.bbaa,

use the commands:

awplus# configure terminal

awplus(config)# access-list hardware my-list

awplus(config-ip-hw-acl)# permit ip 192.168.1.1/32 any mac

ffee.ddcc.bbaa 0000.0000.0000 any

To add a filter entry to the access-list named “my-list” that will deny all IP packets

on vlan 2, use the commands:

awplus# enable

awplus(config)# configure terminal

awplus(config)# access-list hardware my-list

awplus(config-ip-hw-acl)# deny ip any any vlan 2

Commands

access-group

access-list hardware (named hardware ACL)

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 940

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR IP PROTOCOLS)

(named hardware ACL entry for IP protocols)

Overview Use this command to add an IP protocol type filter entry to the current hardware

access-list. The filter will match on IP packets that have the specified IP protocol

number, and the specified IP and/or MAC addresses. You can use the value any

instead of source or destination IP or MAC address if an address does not matter.

If you specify a sequence number, the switch inserts the new filter at the specified

location. Otherwise, the switch adds the new filter to the end of the access-list.

The no variant of this command removes a filter entry from the current hardware

access-list. You can specify the filter entry for removal by entering either its

sequence number (e.g. no 100), or by entering its filter profile without specifying

its sequence number (e.g. no deny proto 2 192.168.0.0/16 any).

You can find the sequence number by running the show access-list (IPv4 Hardware

ACLs) command.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax [<sequence-number>] <action> proto <1-255> <source-ip>

<dest-ip> [<source-mac> <dest-mac>] [vlan <1-4094>]

no <sequence-number>

no <action> proto <1-255> <source-ip> <dest-ip> [<source-mac>

<dest-mac>] [vlan <1-4094>]

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 941

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR IP PROTOCOLS)

Table 28-5: Parameters in IP protocol ACL entries

Parameter Description

<sequence-



number>The sequence number for the filter entry of the selected access

control list, in the range 1-65535. If you do not specify a sequence

number, the switch puts the entry at the end of the ACL and

assigns it the next available multiple of 10 as its sequence

number. .

<action> The action that the switch will take on matching packets. See the

table above for valid values.

proto <1-255>The IP protocol number to match against, as defined by IANA

(Internet Assigned Numbers Authority

www.iana.org/assignments/protocol-numbers)

See below for a list of IP protocol numbers and their descriptions.

<source-ip> The source addresses to match against. You can specify a single

host, a subnet, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source IP address.

dhcpsnooping Match the source address learned

from the DHCP Snooping binding

database.

host <ip-addr> Match a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any source IP address within

the specified subnet. Specify the

subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

<ip-addr>

<reverse-mask>Match any source IP address within

the specified subnet. Specify the

subnet by entering a reverse mask

in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<dest-ip>The destination addresses to match against. You can specify a

single host, a subnet, or all destination addresses. The following

are the valid formats for specifying the destination:

any Match any destination IP address.

host <ip-addr> Match a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any destination IP address

within the specified subnet. Specify

the subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

C613-50292-01 Rev A Command Reference for IE210L Series 942

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR IP PROTOCOLS)

<ip-addr>

<reverse-mask>Match any destination IP address

within the specified subnet. Specify

the subnet by entering a reverse

mask in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<source-mac> The source MAC address to match against. You can specify a

single MAC address, a range (through a mask), the address

learned from DHCP snooping, or any:

any Match against any source MAC

address.

<source-mac> The source MAC address to match

against, followed by the mask.

Enter the address in the format

<HHHH.HHHH.HHHH>, where each

H is a hexadecimal number.

Enter the mask in the format

<HHHH.HHHH.HHHH>, where each

H is a hexadecimal number. For a

mask, each value is either 0 or F,

where FF = Ignore, and 00 = Match.

dhcpsnooping Match the source address learned

from the DHCP Snooping binding

database.

<dest-mac> The destination MAC address to match against. You can specify a

single MAC address, a range (through a mask), or any:

any Match against any destination MAC

address.

<dest-mac> The destination MAC address to

match against, followed by the

mask.

Enter the address in the format

<HHHH.HHHH.HHHH>, where each

H is a hexadecimal number.

Enter the mask in the format

<HHHH.HHHH.HHHH>, where each

H is a hexadecimal number. For a

mask, each value is either 0 or F,

where FF = Ignore, and 00 = Match.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Table 28-5: Parameters in IP protocol ACL entries (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 943

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR IP PROTOCOLS)

Table 28-6: IP protocol number and description

Protocol Number Protocol Description [RFC]

1Internet Control Message [RFC792]

2Internet Group Management [RFC1112]

3Gateway-to-Gateway [RFC823]

4IP in IP [RFC2003]

5Stream [RFC1190] [RFC1819]

6TCP (Transmission Control Protocol) [RFC793]

8EGP (Exterior Gateway Protocol) [RFC888]

9IGP (Interior Gateway Protocol) [IANA]

11 Network Voice Protocol [RFC741]

17 UDP (User Datagram Protocol) [RFC768]

20 Host monitoring [RFC869]

27 RDP (Reliable Data Protocol) [RFC908]

28 IRTP (Internet Reliable Transaction Protocol) [RFC938]

29 ISO-TP4 (ISO Transport Protocol Class 4) [RFC905]

30 Bulk Data Transfer Protocol [RFC969]

33 DCCP (Datagram Congestion Control Protocol)

[RFC4340]

48 DSR (Dynamic Source Routing Protocol) [RFC4728]

50 ESP (Encap Security Payload) [RFC2406]

51 AH (Authentication Header) [RFC2402]

54 NARP (NBMA Address Resolution Protocol) [RFC1735]

58 ICMP for IPv6 [RFC1883]

59 No Next Header for IPv6 [RFC1883]

60 Destination Options for IPv6 [RFC1883]

88 EIGRP (Enhanced Interior Gateway Routing Protocol)

89 OSPFIGP [RFC1583]

97 Ethernet-within-IP Encapsulation / RFC3378

98 Encapsulation Header / RFC1241

108 IP Payload Compression Protocol / RFC2393

112 Virtual Router Redundancy Protocol / RFC3768

134 RSVP-E2E-IGNORE / RFC3175

135 Mobility Header / RFC3775

136 UDPLite / RFC3828

C613-50292-01 Rev A Command Reference for IE210L Series 944

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR IP PROTOCOLS)

Mode IPv4 Hardware ACL Configuration (accessed by running the command access-list

hardware (named hardware ACL))

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage To use this command, run the command access-list hardware (named hardware

ACL) and enter the desired access-list name. This changes the prompt to

awplus(config-ip-hw-acl)#.

Then use this command (and the other “named hardware ACL: entry” commands)

to add filter entries. You can add multiple filter entries to an ACL. You can insert a

new filter entry into the middle of an existing list by specifying the appropriate

sequence number. If you do not specify a sequence number, the switch puts the

entry at the end of the ACL and assigns it the next available multiple of 10 as its

sequence number.

Then use the access-group or the match access-group command to apply this ACL

to a port, VLAN or QoS class-map. Note that the ACL will only apply to incoming

data packets.

Examples To add a filter entry to the access-list named “my-list” that will deny all IGMP

packets (protocol 2) from the 192.168.0.0 subnet, and give it a sequence number

of 50, use the commands:

awplus# configure terminal

awplus(config)# access-list hardware my-list

awplus(config-ip-hw-acl)# 50 deny proto 2 192.168.0.0/16 any

Commands

access-group

access-list hardware (named hardware ACL)

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

137 MPLS-in-IP / RFC4023

138 MANET Protocols / RFC-ietf-manet-iana-07.txt

139-252 Unassigned / IANA

253 Use for experimentation and testing / RFC3692

254 Use for experimentation and testing / RFC3692

255 Reserved / IANA

Table 28-6: IP protocol number and description (cont.)

Protocol Number Protocol Description [RFC]

C613-50292-01 Rev A Command Reference for IE210L Series 945

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR MAC ADDRESSES)

(named hardware ACL entry for MAC

addresses)

Overview Use this command to add a MAC address filter entry to the current hardware

access-list. The access-list will match on packets that have the specified source and

destination MAC addresses. You can use the value any instead of source or

destination MAC address if an address does not matter.

If you specify a sequence number, the switch inserts the new filter at the specified

location. Otherwise, the switch adds the new filter to the end of the access-list.

The no variant of this command removes a filter entry from the current hardware

access-list. You can specify the filter entry for removal by entering either its

sequence number (e.g. no 100), or by entering its filter profile without specifying

its sequence number (e.g. no permit mac aaaa.bbbb.cccc 0000.0000.0000 any).

You can find the sequence number by running the show access-list (IPv4 Hardware

ACLs) command.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax [<sequence-number>] <action> mac {<source-mac>|any}

{<dest-mac>|any} [vlan <1-4094>] [inner-vlan <1-4094>]

no <sequence-number>

no <action> mac {<source-mac>|any} {<dest-mac>|any} [vlan

<1-4094>] [inner-vlan <1-4094>]

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

C613-50292-01 Rev A Command Reference for IE210L Series 946

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR MAC ADDRESSES)

Mode IPv4 Hardware ACL Configuration (accessed by running the command access-list

hardware (named hardware ACL))

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage To use this command, first run the command access-list hardware (named

hardware ACL) and enter the desired access-list name. This changes the prompt to

awplus(config-ip-hw-acl)#.

Then use this command (and the other “named hardware ACL: entry” commands)

to add filter entries. You can add multiple filter entries to an ACL. You can insert a

new filter entry into the middle of an existing list by specifying the appropriate

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

Parameter Description

<4000-4699>Hardware MAC access-list.

<action> The action that the switch will take on matching packets. See the

table above for valid values.

mac Match against MAC address

<source-mac> The source MAC address to match against, followed by the mask.

Enter the address in the format <HHHH.HHHH.HHHH>, where each

H is a hexadecimal number.

Enter the mask in the format <HHHH.HHHH.HHHH>, where each H

is a hexadecimal number. For a mask, each value is either 0 or F,

where FF = Ignore, and 00 = Match.

any Match against any source MAC address.

<dest-mac> The destination MAC address to match against, followed by the

mask.

Enter the address in the format <HHHH.HHHH.HHHH>, where each

H is a hexadecimal number.

Enter the mask in the format <HHHH.HHHH.HHHH>, where each H

is a hexadecimal number. For a mask, each value is either 0 or F,

where FF = Ignore, and 00 = Match.

any Match against any destination MAC address.

vlan <1-4094>Match against the specified ID in the packet’s VLAN tag.

inner-vlan

<1-4094>Match against the inner VLAN tag (VID). This parameter is used

within double-tagged VLANs. It is sometimes referred to as the

C-TAG (Customer VLAN TAG), and the vlan VID tag is referred to as

the S-TAG (Service VLAN TAG).

Values for the <action> parameter

C613-50292-01 Rev A Command Reference for IE210L Series 947

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR MAC ADDRESSES)

sequence number. If you do not specify a sequence number, the switch puts the

entry at the end of the ACL and assigns it the next available multiple of 10 as its

sequence number.

Then use the access-group or the match access-group command to apply this ACL

to a port, VLAN or QoS class-map. Note that the ACL will only apply to incoming

data packets.

Examples To add a filter entry to the access-list named “my-list” that will permit packets with

a source MAC address of 0000.00ab.1234 and any destination MAC address, use

the commands:

awplus# configure terminal

awplus(config)# access-list hardware my-list

awplus(config-ip-hw-acl)# permit mac 0000.00ab.1234

0000.0000.0000 any

To remove a filter entry that permit packets with a source MAC address of

0000.00ab.1234 and any destination MAC address, use the commands:

awplus# configure terminal

awplus(config)# access-list hardware my-list

awplus(config-ip-hw-acl)# no permit mac 0000.00ab.1234

0000.0000.0000 any

Commands

access-group

access-list hardware (named hardware ACL)

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 948

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR TCP OR UDP)

(named hardware ACL entry for TCP or UDP)

Overview Use this command to add a TCP or UDP filter entry to the current hardware

access-list. The access-list will match on TCP or UDP packets that have the specified

source and destination IP addresses and optionally, port values. You can use the

value any instead of source or destination IP address if an address does not matter.

If you specify a sequence number, the switch inserts the new filter at the specified

location. Otherwise, the switch adds the new filter to the end of the access-list.

The no variant of this command removes a filter entry from the current hardware

access-list. You can specify the filter entry for removal by entering either its

sequence number (e.g. no 100), or by entering its filter profile without specifying

its sequence number (e.g. no permit udp 192.168.0.0/16 any).

You can find the sequence number by running the show access-list (IPv4 Hardware

ACLs) command.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax [<sequence-number>] <action> {tcp|udp} <source-ip>

[<source-ports>] <dest-ip> [<dest-ports>] [vlan <1-4094>]

no <sequence-number>

no <action> {tcp|udp} <source-ip> [<source-ports>] <dest-ip>

[<dest-ports>] [vlan <1-4094>]

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 949

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR TCP OR UDP)

Parameter Description

<sequence-



number>The sequence number for the filter entry of the selected access

control list, in the range 1-65535. If you do not specify a sequence

number, the switch puts the entry at the end of the ACL and

assigns it the next available multiple of 10 as its sequence

number. .

<action> The action that the switch will take on matching packets. See the

table above for valid values.

tcp Match against TCP packets.

udp Match against UDP packets.

<source-ip> The source addresses to match against. You can specify a single

host, a subnet, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source IP address.

host <ip-addr> Match a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any source IP address within

the specified subnet. Specify the

subnet by entering the IPv4 address,

then a forward slash, then the prefix

length.

<ip-addr>

<reverse-mask>Match any source IP address within

the specified subnet. Specify the

subnet by entering a reverse mask

in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<source-



ports> Match source TCP or UDP port numbers. Port numbers are

specified as integers between 0 and 65535. You can specify one or

more port numbers as follows:

eq <0-65535> Match a single port number.

lt <0-65535> Match all port numbers that are less

than the specified port number.

gt <0-65535> Match all port numbers that are

greater than the specified port

number.

ne <0-65535> Match all port numbers except the

specified port number.

range <start-port>

<end-port>Match a range of port numbers.

<dest-ip>The destination addresses to match against. You can specify a

single host, a subnet, or all destination addresses. The following

are the valid formats for specifying the destination:

C613-50292-01 Rev A Command Reference for IE210L Series 950

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR TCP OR UDP)

Mode IPv4 Hardware ACL Configuration (accessed by running the command access-list

hardware (named hardware ACL))

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage To use this command, first run the command access-list hardware (named

hardware ACL) and enter the desired access-list name. This changes the prompt to

awplus(config-ip-hw-acl)#.

Then use this command (and the other “named hardware ACL: entry” commands)

to add filter entries. You can add multiple filter entries to an ACL. You can insert a

new filter entry into the middle of an existing list by specifying the appropriate

sequence number. If you do not specify a sequence number, the switch puts the

any Match any destination IP address.

host <ip-addr> Match a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/<prefix>Match any destination IP address

within the specified subnet. Specify

the subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

<ip-addr>

<reverse-mask>Match any destination IP address

within the specified subnet. Specify

the subnet by entering a reverse

mask in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<dest-ports>Match destination TCP or UDP port numbers. Port numbers are

specified as integers between 0 and 65535. You can specify one or

more port numbers as follows:

eq <0-65535> Match a single port number.

lt <0-65535> Match all port numbers that are less

than the specified port number.

gt <0-65535> Match all port numbers that are

greater than the specified port

number.

ne <0-65535> Match all port numbers except the

specified port number.

range <start-port>

<end-port>Match a range of port numbers.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 951

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED HARDWARE ACL ENTRY FOR TCP OR UDP)

entry at the end of the ACL and assigns it the next available multiple of 10 as its

sequence number.

Then use the access-group or the match access-group command to apply this ACL

to a port, VLAN or QoS class-map. Note that the ACL will only apply to incoming

data packets.

Example To add a filter entry to access-list named “my-list” that will permit TCP packets with

a destination address of 192.168.1.1, a destination port of 80, from any source, use

the commands:

awplus# configure terminal

awplus(config)# access-list hardware my-list

awplus(config-ip-hw-acl)# permit tcp any 192.168.1.1/32 eq 80

Commands

access-group

access-list hardware (named hardware ACL)

match access-group

show running-config

show access-list (IPv4 Hardware ACLs)

Command

changes

Version 5.4.6-2.1: send-to-vlan-port action parameter added

C613-50292-01 Rev A Command Reference for IE210L Series 952

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

COMMIT (IPV4)

commit (IPv4)

Overview Use this command to commit the IPv4 ACL filter configuration entered at the

console to the hardware immediately without exiting the IPv4 Hardware ACL

Configuration mode.

This command forces the associated hardware and software IPv4 ACLs to

synchronize.

Syntax commit

Mode IPv4 Hardware ACL Configuration

Usage Normally, when an IPv4 hardware ACL is edited, the new configuration state of the

IPv4 ACL is not written to hardware until you exit IPv4 Hardware ACL Configuration

mode. By entering this command you can ensure that the current state of a

hardware access-list that is being edited is written to hardware immediately.

Scripts typically do not include the exit command to exit configuration modes,

potentially leading to IPv4 ACL filters in hardware not being correctly updated.

Using this commit command in a configuration script after specifying an IPv4

hardware ACL filter ensures that it is updated in the hardware immediately.

Example To update the hardware with the IPv4 ACL filter configuration, use the command:

awplus# configure terminal

awplus(config)# access-list hardware my-hw-list

awplus(config-ip-hw-acl)# commit

Commands

access-list hardware (named hardware ACL)

C613-50292-01 Rev A Command Reference for IE210L Series 953

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

SHOW ACCESS-GROUP

show access-group

Overview Use this command to show the access-lists attached globally. If an access-list is

specified, only that access-list will be displayed.

Syntax show access-group

[{<3000-3699>|<4000-4699>|<access-list-name>}]

Mode User Exec and Privileged Exec

Example To show all access-lists attached globally:

awplus# show access-group

Output Figure 28-1: Example output from the show access-group command

Commands

access-group

show interface access-group

Parameter Description

<3000-3699>Specify a Hardware IP access-list.

<4000-4699>Specify a Hardware MAC access-list.

<access-list-name>Specify a Hardware IPv4 access-list name.

Global access control list

access-group 3000

access-group 4000

C613-50292-01 Rev A Command Reference for IE210L Series 954

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

SHOW ACCESS-LIST (IPV4 HARDWARE ACLS)

show access-list (IPv4 Hardware ACLs)

Overview Use this command to display the specified access-list, or all access-lists if none have

been specified. Note that only defined access-lists are displayed. An error message

is displayed for an undefined access-list.

Syntax show access-list

[<1-99>|<100-199>|<1300-1999>|<2000-2699>|<3000-3699>|<4000-44

99>|<access-list-name>]

Mode User Exec and Privileged Exec

Examples To show all access-lists configured on the switch:

awplus# show access-list

To show the access-list with an ID of 20:

awplus# show access-list 20

The following error message is displayed if you try to show an undefined

access-list.

awplus# show access-list 2

Parameter Description

<1-99>IP standard access-list.

<1300-1999>IP standard access-list (standard - expanded range).

<3000-3699>Hardware IP access-list.

<4000-4499>Hardware MAC access-list.

<access-list-name>IP named access-list.

Standard IP access list 1

deny 172.16.2.0, wildcard bits 0.0.0.255

Standard IP access list 20

deny 192.168.10.0, wildcard bits 0.0.0.255

deny 192.168.12.0, wildcard bits 0.0.0.255

Hardware IP access list 3001

permit ip 192.168.20.0 255.255.255.0 any

Hardware IP access list 3020

permit tcp any 192.0.2.0/24

awplus#show access-list 20

Standard IP access-list 20

deny 192.168.10.0, wildcard bits 0.0.0.255

deny 192.168.12.0, wildcard bits 0.0.0.255

C613-50292-01 Rev A Command Reference for IE210L Series 955

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

SHOW ACCESS-LIST (IPV4 HARDWARE ACLS)

Commands

access-list extended (named)

access-list (numbered hardware ACL for MAC addresses)

access-list hardware (named hardware ACL)

% Can't find access-list 2

C613-50292-01 Rev A Command Reference for IE210L Series 956

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

SHOW INTERFACE ACCESS-GROUP

show interface access-group

Overview Use this command to display the access groups attached to a port. If an access

group is specified, then the output only includes the ports that the specified access

group is attached to. If no access group is specified then this command displays all

access groups that are attached to the ports that are specified with <port-list>.

Note that access group is the term given for an access-list when it is applied to an

interface.

Syntax show interface <port-list> access-group

[<3000-3699>|<4000-4699>]

Mode User Exec and Privileged Exec

Example To show all access-lists attached to port1.0.1, use the command:

awplus# show interface port1.0.1 access-group

Output Figure 28-2: Example output from the show interface access-group command

Commands

access-group

Parameter Description

<port-list> Specify the ports to display information. A port-list can be

either:

• a switch port (e.g. port1.0.6) a static channel group (e.g.

sa2) or a dynamic (LACP) channel group (e.g. po2)

• a continuous range of ports separated by a hyphen, e.g.

port1.0.1-1.0.6 or port1.0.1-port1.0.6 or po1-po2

• a comma-separated list of ports and port ranges, e.g.

port1.0.1,port1.0.3-1.0.6. Do not mix switch ports, static

channel groups, and LACP channel groups in the same

list.

access group Select the access group whose details you want to show.

<3000-3699> Specifies the Hardware IP access-list.

<4000-4699> Specifies the Hardware MAC access-list.

Interface port1.0.1

access-group 3000

access-group 3002

access-group 3001

C613-50292-01 Rev A Command Reference for IE210L Series 957

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPv4 Software

Access Control List

(ACL) Commands

Introduction

Overview This chapter provides an alphabetical reference for the IPv4 Software Access

Control List (ACL) commands, and contains detailed command information and

command examples about IPv4 software ACLs as applied to Routing and

Multicasting, which are not applied to interfaces.

For information about ACLs, see the ACL Feature Overview and Configuration

Guide.

To apply ACLs to an LACP channel group, apply it to all the individual switch ports

in the channel group. To apply ACLs to a static channel group, apply it to the static

channel group itself. For more information on link aggregation see the following

references:

•the Link Aggregation Feature Overview_and Configuration Guide.

•Link Aggregation Commands

NOTE: Text in parenthesis in command names indicates usage not keyword entry. For

example, access-list hardware (named) indicates named IPv4 hardware ACLs

entered as access-list hardware <name> where <name> is a placeholder not

a keyword.

Parenthesis surrounding ACL filters indicates the type of ACL filter not the keyword

entry in the CLI, such as (access-list standard numbered filter) represents command

entry in the format shown in the syntax:

[<sequence-number>] {deny|permit} {<source-address>|host

<host-address>|any}

NOTE: Software ACLs will deny access unless explicitly permitted by an ACL action.

Sub-modes Many of the ACL commands operate from sub-modes that are specific to particular

ACL types. The following table shows the CLI prompts at which ACL commands are

entered.

C613-50292-01 Rev A Command Reference for IE210L Series 958

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

Command List •“access-list extended (named)” on page 959

•“access-list (extended numbered)” on page 967

•“(access-list extended ICMP filter)” on page 970

•“(access-list extended IP filter)” on page 972

•“(access-list extended IP protocol filter)” on page 975

•“(access-list extended TCP UDP filter)” on page 979

•“access-list standard (named)” on page 981

•“access-list (standard numbered)” on page 983

•“(access-list standard named filter)” on page 985

•“(access-list standard numbered filter)” on page 987

•“maximum-access-list” on page 989

•“show access-list (IPv4 Software ACLs)” on page 990

•“show ip access-list” on page 992

•“vty access-class (numbered)” on page 993

Table 29-1: IPv4 Software Access List Commands and Prompts

Command Name Command Mode Prompt

show ip access-list Privileged Exec awplus#

access-group Global Configuration awplus(config)#

access-list (extended named) Global Configuration awplus(config)#

access-list (extended numbered) Global Configuration awplus(config)#

access-list (standard named) Global Configuration awplus(config)#

access-list (standard numbered) Global Configuration awplus(config)#

maximum-access-list Global Configuration awplus(config)#

(access-list extended ICMP filter) IPv4 Extended ACL

Configuration awplus(config-ip-ext-acl)#

(access-list extended IPfilter) IPv4 Extended ACL

Configuration awplus(config-ip-ext-acl)#

(access-list extended IP protocol filter) IPv4 Extended ACL

Configuration awplus(config-ip-ext-acl)#

(access-list extended TCP UDP filter) IPv4 Extended ACL

Configuration awplus(config-ip-ext-acl)#

(access-list standard named filter) IPv4 Standard ACL

Configuration awplus(config-ip-std-acl)#

(access-list standard numbered filter) IPv4 Standard ACL

Configuration awplus(config-ip-std-acl)#

C613-50292-01 Rev A Command Reference for IE210L Series 959

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST EXTENDED (NAMED)

access-list extended (named)

Overview This command configures an extended named access-list that permits or denies

packets from specific source and destination IP addresses. You can either create an

extended named ACL together with an ACL filter entry in the Global Configuration

mode, or you can use the IPv4 Extended ACL Configuration mode for sequenced

ACL filter entry after entering a list name.

The no variant of this command removes a specified extended named access-list.

Syntax

[list-name] access-list extended <list-name>

no access-list extended <list-name>

Syntax [icmp] access-list extended <list-name>{deny|permit} icmp <source>

<destination> [icmp-type <type-number>] [log]

no access-list extended <list-name>{deny|permit} icmp <source>

<destination> [icmp-type <type-number>] [log]

Parameter Description

<list-name>A user-defined name for the access-list

Table 29-2: Parameters in the access-list extended (named) command - icmp

Parameter Description

<list-name>A user-defined name for the access-list.

deny The access-list rejects packets that match the type, source, and

destination filtering specified with this command.

permit The access-list permits packets that match the type, source, and

destination filtering specified with this command.

icmp The access-list matches only ICMP packets.

icmp-type Matches only a specified type of ICMP messages. This is valid only

when the filtering is set to match ICMP packets.

C613-50292-01 Rev A Command Reference for IE210L Series 960

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST EXTENDED (NAMED)

<source> The source address of the packets. You can specify a single host, a

subnet, or all sources. The following are the valid formats for

specifying the source:

any Matches any source IP address.

host<ip-addr> Matches a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/

<prefix>An IPv4 address, followed by a forward

slash, then the prefix length. This

matches any source IP address within

the specified subnet.

<ip-addr>

<reverse-mask>Alternatively, you can enter a reverse

mask in dotted decimal format. For

example, entering 192.168.1.1

0.0.0.255 is the same as entering

192.168.1.1/24.

<destination>The destination address of the packets. You can specify a single

host, a subnet, or all destinations. The following are the valid

formats for specifying the destination:

any Matches any destination IP address.

host<ip-addr> Matches a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/

<prefix>An IPv4 address, followed by a forward

slash, then the prefix length. This

matches any destination IP address

within the specified subnet.

<ip-addr>

<reverse-mask>Alternatively, you can enter a reverse

mask in dotted decimal format. For

example, entering 192.168.1.1

0.0.0.255 is the same as entering

192.168.1.1/24.

Table 29-2: Parameters in the access-list extended (named) command - icmp

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 961

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST EXTENDED (NAMED)

Syntax [tcp|udp] access-list extended <list-name> {deny|permit} {tcp|udp}

<source> [eq <sourceport>|lt <sourceport>|gt <sourceport>|ne

<sourceport>] <destination> [eq <destport>|lt <destport>|gt

<destport>|ne <destport>] [log]

no access-list extended <list-name> {deny|permit} {tcp|udp}

<source> [eq <sourceport>|lt <sourceport>|gt <sourceport>|ne

<sourceport>] <destination> [eq <destport> |lt <destport>|gt

<destport>|ne <destport>][log]

<type-number>The ICMP type, as defined in RFC792 and RFC950. Specify one of

the following integers to create a filter for the ICMP message type:

0Echo replies.

3Destination unreachable messages.

4Source quench messages.

5Redirect (change route) messages.

8Echo requests.

11 Time exceeded messages.

12 Parameter problem messages.

13 Timestamp requests.

14 Timestamp replies.

15 Information requests.

16 Information replies.

17 Address mask requests.

18 Address mask replies.

log Logs the results.

Table 29-2: Parameters in the access-list extended (named) command - icmp

Parameter Description

Table 29-3: Parameters in the access-list extended (named) command - tcp|udp

Parameter Description

<list-name>A user-defined name for the access-list.

deny The access-list rejects packets that match the type, source, and

destination filtering specified with this command.

permit The access-list permits packets that match the type, source, and

destination filtering specified with this command.

tcp The access-list matches only TCP packets.

udp The access-list matches only UDP packets.

C613-50292-01 Rev A Command Reference for IE210L Series 962

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST EXTENDED (NAMED)

<source> The source address of the packets. You can specify a single host, a

subnet, or all sources. The following are the valid formats for

specifying the source:

any Matches any source IP address.

host<ip-addr> Matches a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/

<prefix>An IPv4 address, followed by a forward

slash, then the prefix length. This

matches any source IP address within

the specified subnet.

<ip-addr>

<reverse-mask>Alternatively, you can enter a reverse

mask in dotted decimal format. For

example, entering 192.168.1.1

0.0.0.255 is the same as entering

192.168.1.1/24.

<destination>The destination address of the packets. You can specify a single

host, a subnet, or all destinations. The following are the valid

formats for specifying the destination:

any Matches any destination IP address.

host<ip-addr> Matches a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/

<prefix>An IPv4 address, followed by a forward

slash, then the prefix length. This

matches any destination IP address

within the specified subnet.

<ip-addr>

<reverse-mask>Alternatively, you can enter a reverse

mask in dotted decimal format. For

example, entering 192.168.1.1

0.0.0.255 is the same as entering

192.168.1.1/24.

<sourceport>The source port number, specified as an integer between 0 and

65535.

<destport>The destination port number, specified as an integer between 0

and 65535.

eq Matches port numbers equal to the port number specified

immediately after this parameter.

lt Matches port numbers less than the port number specified

immediately after this parameter.

gt Matches port numbers greater than the port number specified

immediately after this parameter.

Table 29-3: Parameters in the access-list extended (named) command - tcp|udp

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 963

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST EXTENDED (NAMED)

Syntax

[proto|any| ip] access-list extended <list-name> {deny|permit} {proto

<ip-protocol>|any|ip} {<source>} {<destination>} [log]

no access-list extended <list-name>{deny|permit} {proto

<ip-protocol>|any|ip}{<source>}{<destination>}[log]

ne Matches port numbers not equal to the port number specified

immediately after this parameter.

log Log the results.

Table 29-3: Parameters in the access-list extended (named) command - tcp|udp

Parameter Description

Table 29-4: Parameters in the access-list extended (named) command -

proto|ip|any

Parameter Description

<list-name>A user-defined name for the access-list.

deny The access-list rejects packets that match the type, source, and

destination filtering specified with this command.

permit The access-list permits packets that match the type, source, and

destination filtering specified with this command.

proto Matches only a specified type of IP Protocol.

any The access-list matches any type of IP packet.

ip The access-list matches only IP packets.

<source> The source address of the packets. You can specify a single host, a

subnet, or all sources. The following are the valid formats for

specifying the source:

any Matches any source IP address.

host<ip-addr> Matches a single source host with the IP

address given by <ip-addr> in dotted

decimal notation.

<ip-addr>/

<prefix>An IPv4 address, followed by a forward

slash, then the prefix length. This matches

any source IP address within the specified

subnet.

<ip-addr>

<reverse-mask>Alternatively, you can enter a reverse mask

in dotted decimal format. For example,

entering 192.168.1.1 0.0.0.255 is

the same as entering 192.168.1.1/24.

C613-50292-01 Rev A Command Reference for IE210L Series 964

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST EXTENDED (NAMED)

<destination>The destination address of the packets. You can specify a single

host, a subnet, or all destinations. The following are the valid

formats for specifying the destination:

any Matches any destination IP address.

host<ip-addr> Matches a single destination host with the

IP address given by <ip-addr> in dotted

decimal notation.

<ip-addr>/

<prefix>An IPv4 address, followed by a forward

slash, then the prefix length. This matches

any destination IP address within the

specified subnet.

<ip-addr>

<reverse-mask>Alternatively, you can enter a reverse mask

in dotted decimal format. For example,

entering 192.168.1.1 0.0.0.255 is

the same as entering 192.168.1.1/24.

log Logs the results.

<ip-protocol> The IP protocol number, as defined by IANA (Internet Assigned

Numbers Authority

www.iana.org/assignments/protocol-numbers) 

See below for a list of IP protocol numbers and their descriptions.

Table 29-5: IP protocol number and description

Protocol Number Protocol Description [RFC]

1Internet Control Message [RFC792]

2Internet Group Management [RFC1112]

3Gateway-to-Gateway [RFC823]

4IP in IP [RFC2003]

5Stream [RFC1190] [RFC1819]

6TCP (Transmission Control Protocol) [RFC793]

8EGP (Exterior Gateway Protocol) [RFC888]

9IGP (Interior Gateway Protocol) [IANA]

11 Network Voice Protocol [RFC741]

17 UDP (User Datagram Protocol) [RFC768]

20 Host monitoring [RFC869]

27 RDP (Reliable Data Protocol) [RFC908]

28 IRTP (Internet Reliable Transaction Protocol) [RFC938]

Table 29-4: Parameters in the access-list extended (named) command -

proto|ip|any (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 965

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST EXTENDED (NAMED)

Mode Global Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Usage Use this command when configuring access-lists for filtering IP software packets.

You can either create access-lists from within this command, or you can enter

access-list extended followed by only the name. Entering only the name moves

you to the IPv4 Extended ACL Configuration mode for the selected access-list.

29 ISO-TP4 (ISO Transport Protocol Class 4) [RFC905]

30 Bulk Data Transfer Protocol [RFC969]

33 DCCP (Datagram Congestion Control Protocol)

[RFC4340]

48 DSR (Dynamic Source Routing Protocol) [RFC4728]

50 ESP (Encap Security Payload) [RFC2406]

51 AH (Authentication Header) [RFC2402]

54 NARP (NBMA Address Resolution Protocol) [RFC1735]

58 ICMP for IPv6 [RFC1883]

59 No Next Header for IPv6 [RFC1883]

60 Destination Options for IPv6 [RFC1883]

88 EIGRP (Enhanced Interior Gateway Routing Protocol)

89 OSPFIGP [RFC1583]

97 Ethernet-within-IP Encapsulation / RFC3378

98 Encapsulation Header / RFC1241

108 IP Payload Compression Protocol / RFC2393

112 Virtual Router Redundancy Protocol / RFC3768

134 RSVP-E2E-IGNORE / RFC3175

135 Mobility Header / RFC3775

136 UDPLite / RFC3828

137 MPLS-in-IP / RFC4023

138 MANET Protocols / RFC-ietf-manet-iana-07.txt

139-252 Unassigned / IANA

253 Use for experimentation and testing / RFC3692

254 Use for experimentation and testing / RFC3692

255 Reserved / IANA

Table 29-5: IP protocol number and description (cont.)

Protocol Number Protocol Description [RFC]

C613-50292-01 Rev A Command Reference for IE210L Series 966

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST EXTENDED (NAMED)

From there you can configure your access-lists by using the commands (access-list

extended ICMP filter), (access-list extended IP filter), and (access-list extended IP

protocol filter).

Note that packets must match both the source and the destination details.

NOTE: Software ACLs will deny access unless explicitly permitted by an ACL action.

Examples You can enter the extended named ACL in the Global Configuration mode

together with the ACL filter entry on the same line, as shown below:

awplus# configure terminal

awplus(config)# access-list extended TK deny tcp 2.2.2.3/24 eq

14 3.3.3.4/24 eq 12 log

Alternatively, you can enter the extended named ACL in Global Configuration

mode before specifying the ACL filter entry in the IPv4 Extended ACL

Configuration mode, as shown below:

awplus# configure terminal

awplus(config)# access-list extended TK

awplus(config-ip-ext-acl)# deny tcp 2.2.2.3/24 eq 14 3.3.3.4/24

eq 12 log

Commands

(access-list extended ICMP filter)

(access-list extended IP filter)

(access-list extended TCP UDP filter)

show running-config

show ip access-list

C613-50292-01 Rev A Command Reference for IE210L Series 967

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (EXTENDED NUMBERED)

access-list (extended numbered)

Overview This command configures an extended numbered access-list that permits or

denies packets from specific source and destination IP addresses. You can either

create an extended numbered ACL together with an ACL filter entry in the Global

Configuration mode, or you can use the IPv4 Extended ACL Configuration mode

for sequenced ACL filter entry after entering a list number.

The no variant of this command removes a specified extended named access-list.

Syntax

[list-number] access-list {<100-199>|<2000-2699>}

no access-list {<100-199>|<2000-2699>}

Syntax [deny|

permit] access-list {<100-199>|<2000-2699>} {deny|permit} ip <source>

no access-list {<100-199>|<2000-2699>}{deny|permit} ip <source>

Parameter Description

<100-199>IP extended access-list.

<2000-2699>IP extended access-list (expanded range).

Parameter Description

<100-199>IP extended access-list.

<2000-2699>IP extended access-list (expanded range).

deny Access-list rejects packets that match the source and destination

filtering specified with this command.

permit Access-list permits packets that match the source and destination

filtering specified with this command.

<source>The source address of the packets. You can specify a single host, a

subnet, or all sources. The following are the valid formats for

specifying the source:

any Matches any source IP address.

host<ip-addr> Matches a single source host with the IP

address given by <ip-addr> in dotted

decimal notation.

<ip-addr>

<reverse-mask>An IPv4 address, followed by a reverse

mask in dotted decimal format. For

example, entering 192.168.1.1

0.0.0.255 is the same as entering

192.168.1.1/24. This matches any

source IP address within the specified

subnet.

C613-50292-01 Rev A Command Reference for IE210L Series 968

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (EXTENDED NUMBERED)

Mode Global Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Usage Use this command when configuring access-list for filtering IP software packets.

You can either create access-lists from within this command, or you can enter

access-list followed by only the number. Entering only the number moves you to

the IPv4 Extended ACL Configuration mode for the selected access-list. From there

you can configure your access-lists by using the commands (access-list extended

ICMP filter), (access-list extended IP filter), and (access-list extended IP protocol

filter).

Note that packets must match both the source and the destination details.

NOTE: Software ACLs will deny access unless explicitly permitted by an ACL action.

Examples You can enter the extended ACL in the Global Configuration mode together with

the ACL filter entry on the same line, as shown below:

awplus# configure terminal

awplus(config)# access-list 101 deny ip 172.16.10.0 0.0.0.255

any

Alternatively, you can enter the extended ACL in Global Configuration mode

before specifying the ACL filter entry in the IPv4 Extended ACL Configuration

mode, as shown below:

awplus# configure terminal

awplus(config)# access-list 101

awplus(config-ip-ext-acl)# deny ip 172.16.10.0 0.0.0.255 any

<destination>The destination address of the packets. You can specify a single

host, a subnet, or all destinations. The following are the valid

formats for specifying the destination:

any Matches any destination IP address.

host<ip-addr> Matches a single destination host with the

IP address given by <ip-addr> in dotted

decimal notation.

<ip-addr>

<reverse-mask>An IPv4 address, followed by a reverse

mask in dotted decimal format. For

example, entering 192.168.1.1

0.0.0.255 is the same as entering

192.168.1.1/24. This matches any

destination IP address within the specified

subnet.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 969

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (EXTENDED NUMBERED)

Commands

(access-list extended ICMP filter)

(access-list extended IP filter)

(access-list extended TCP UDP filter)

show running-config

show ip access-list

C613-50292-01 Rev A Command Reference for IE210L Series 970

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED ICMP FILTER)

(access-list extended ICMP filter)

Overview Use this ACL filter to add a new ICMP filter entry to the current extended access-list.

If the sequence number is specified, the new filter is inserted at the specified

location. Otherwise, the new filter is added at the end of the access-list.

The no variant of this command removes an ICMP filter entry from the current

extended access-list. You can specify the ICMP filter entry for removal by entering

either its sequence number (e.g. no 10), or by entering its ICMP filter profile

without specifying its sequence number.

Note that the sequence number can be found by running the show access-list (IPv4

Software ACLs) command.

Syntax [icmp] [<sequence-number>] {deny|permit} icmp <source> <destination>

[icmp-type <icmp-value>] [log]

no {deny|permit} icmp <source> <destination>[icmp-type

<icmp-value>] [log]

no <sequence-number>

Parameter Description

<sequence-

number><1-65535>

The sequence number for the filter entry of the selected access

control list.

deny Access-list rejects packets that match the source and destination

filtering specified with this command.

permit Access-list permits packets that match the source and destination

filtering specified with this command.

icmp ICMP packet type.

<source>The source address of the packets. You can specify a single host, a

subnet, or all sources. The following are the valid formats for

specifying the source:

<ip-addr>/

<prefix>An IPv4 address, followed by a

forward slash, then the prefix length.

This matches any source IP address

within the specified subnet.

any Matches any source IP address.

<destination>The destination address of the packets. You can specify a single

host, a subnet, or all destinations. The following are the valid

formats for specifying the destination:

<ip-addr>/

<prefix>An IPv4 address, followed by a

forward slash, then the prefix length.

This matches any destination IP

address within the specified subnet.

any Matches any destination IP address.

C613-50292-01 Rev A Command Reference for IE210L Series 971

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED ICMP FILTER)

Mode IPv4 Extended ACL Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Usage An ACL can be configured with multiple ACL filters using sequence numbers. If the

sequence number is omitted, the next available multiple of 10 will be used as the

sequence number for the new filter. A new ACL filter can be inserted into the

middle of an existing list by specifying the appropriate sequence number.

NOTE: The access control list being configured is selected by running the access-list

(extended numbered) command or the access-list extended (named) command, with

the required access control list number, or name - but with no further parameters

selected.

Software ACLs will deny access unless explicitly permitted by an ACL action.

Examples To add a new entry in access-list called my-list that will reject ICMP packets from

10.0.0.1 to 192.168.1.1, use the commands:

awplus# configure terminal

awplus(config)# access-list extended my-list

awplus(config-ip-ext-acl)# deny icmp 10.0.0.1/32 192.168.1.1/32

Use the following commands to add a new filter at sequence number 5 position of

the access-list called my-list. The filter will accept the ICMP type 8 packets from

10.1.1.0/24 network, to 192.168.1.0 network:

awplus# configure terminal

awplus(config)# access-list extended my-list

awplus(config-ip-ext-acl)# 5 permit icmp 10.1.1.0/24

192.168.1.0/24 icmp-type 8

Commands

access-group

show running-config

show ip access-list

icmp-type The ICMP type.

<icmp-value>The value of the ICMP

type.

log Log the results.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 972

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED IP FILTER)

(access-list extended IP filter)

Overview Use this ACL filter to add a new IP filter entry to the current extended access-list. If

the sequence number is specified, the new filter is inserted at the specified

location. Otherwise, the new filter is added at the end of the access-list.

The no variant of this command removes an IP filter entry from the current

extended access-list. You can specify the IP filter entry for removal by entering

either its sequence number (e.g. no 10), or by entering its IP filter profile without

specifying its sequence number.

Note that the sequence number can be found by running the show access-list (IPv4

Software ACLs) command.

Syntax [ip] [<sequence-number>] {deny|permit} ip <source> <destination>

no {deny|permit} ip <source> <destination>

no <sequence-number>

Parameter Description

<sequence-

number><1-65535>

The sequence number for the filter entry of the selected access

control list.

deny Access-list rejects packets that match the source and destination

filtering specified with this command.

permit Access-list permits packets that match the source and destination

filtering specified with this command.

<source> The source address of the packets. You can specify a single host, a

subnet, or all sources. The following are the valid formats for

specifying the source:

any Matches any source IP address.

host<ip-addr> Matches a single source host with the IP

address given by <ip-addr> in dotted

decimal notation.

<ip-addr>

<reverse-mask>Alternatively, enter an IPv4 address

followed by a reverse mask in dotted

decimal format. For example, enter

192.168.1.1 0.0.0.255.

C613-50292-01 Rev A Command Reference for IE210L Series 973

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED IP FILTER)

Mode Extended ACL Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Usage An ACL can be configured with multiple ACL filters using sequence numbers. If the

sequence number is omitted, the next available multiple of 10 will be used as the

sequence number for the new filter. A new ACL filter can be inserted into the

middle of an existing list by specifying the appropriate sequence number.

NOTE: The access control list being configured is selected by running the access-list

(extended numbered) command or the access-list extended (named) command, with

the required access control list number, or name - but with no further parameters

selected.

Software ACLs will deny access unless explicitly permitted by an ACL action.

Example 1

[list-number]

First use the following commands to enter the IPv4 Extended ACL Configuration

mode and define a numbered extended access-list 101:

awplus# configure terminal

awplus(config)# access-list 101

awplus(config-ip-ext-acl)#

Then use the following commands to add a new entry to the numbered extended

access- list 101 that will reject packets from 10.0.0.1 to 192.168.1.1:

awplus(config-ip-ext-acl)# deny ip host 10.0.0.1 host

192.168.1.1

awplus(config-ip-ext-acl)# 20 permit ip any any

Example 2

[list-name]

First use the following commands to enter the IPv4 Extended ACL Configuration

mode and define a named access-list called my-acl:

awplus# configure terminal

awplus(config)# access-list extended my-acl

awplus(config-ip-ext-acl)#

<destination>The destination address of the packets. You can specify a single

host, a subnet, or all destinations. The following are the valid

formats for specifying the destination:

any Matches any destination IP address.

host<ip-addr> Matches a single destination host with the

IP address given by <ip-addr> in dotted

decimal notation.

<ip-addr>

<reverse-mask>Alternatively, enter an IPv4 address

followed by a reverse mask in dotted

decimal format. For example, enter

192.168.1.1 0.0.0.255.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 974

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED IP FILTER)

Then use the following commands to add a new entry to the named access-list

my-acl that will reject packets from 10.0.0.1 to 192.168.1.1:

awplus(config-ip-ext-acl)# deny ip host 10.0.0.1 host

192.168.1.1

awplus(config-ip-ext-acl)# 20 permit ip any any

Example 3

[list-number]

Use the following commands to remove the access-list filter entry with sequence

number 20 from extended numbered access-list 101.

awplus# configure terminal

awplus(config)# access-list 101

awplus(config-ip-ext-acl)# no 20

Example 4

[list-name]

Use the following commands to remove the access-list filter entry with sequence

number 20 from extended named access-list my-acl:

awplus# configure terminal

awplus(config)# access-list extended my-acl

awplus(config-ip-ext-acl)# no 20

Commands

access-list extended (named)

access-list (extended numbered)

show running-config

show ip access-list

C613-50292-01 Rev A Command Reference for IE210L Series 975

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED IP PROTOCOL FILTER)

(access-list extended IP protocol filter)

Overview Use this ACL filter to add a new IP protocol type filter entry to the current extended

access-list. If the sequence number is specified, the new filter is inserted at the

specified location. Otherwise, the new filter is added at the end of the access-list.

The no variant of this command removes an IP protocol filter entry from the

current extended access-list. You can specify the IP filter entry for removal by

entering either its sequence number (e.g. no 10), or by entering its IP filter profile

without specifying its sequence number.

Note that the sequence number can be found by running the show access-list (IPv4

Software ACLs) command.

Syntax [proto] [<sequence-number>] {deny|permit} proto <ip-protocol> <source>

<destination> [log]

no {deny|permit} proto <ip-protocol> <source> <destination>

[log]

no <sequence-number>

Parameter Description

<sequence-

number><1-65535>

The sequence number for the filter entry of the selected access

control list.

deny Access-list rejects packets that match the source and destination

filtering specified with this command.

permit Access-list permits packets that match the source and destination

filtering specified with this command.

proto

<ip-protocol><1-255>

Specify IP protocol number, as defined by IANA (Internet Assigned

Numbers Authority

www.iana.org/assignments/protocol-numbers)

See below for a list of IP protocol numbers and their descriptions.

<source>The source address of the packets. You can specify a single host, a

subnet, or all sources. The following are the valid formats for

specifying the source:

<ip-addr>/

<prefix>An IPv4 address, followed by a forward

slash, then the prefix length. This matches

any source IP address within the specified

subnet.

any Matches any source IP address.

C613-50292-01 Rev A Command Reference for IE210L Series 976

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED IP PROTOCOL FILTER)

<destination>The destination address of the packets. You can specify a single

host, a subnet, or all destinations. The following are the valid

formats for specifying the destination:

<ip-addr>/

<prefix>An IPv4 address, followed by a forward

slash, then the prefix length. This matches

any destination IP address within the

specified subnet.

any Matches any destination IP address.

log Log the results.

Table 29-6: IP protocol number and description

Protocol Number Protocol Description [RFC]

1Internet Control Message [RFC792]

2Internet Group Management [RFC1112]

3Gateway-to-Gateway [RFC823]

4IP in IP [RFC2003]

5Stream [RFC1190] [RFC1819]

6TCP (Transmission Control Protocol) [RFC793]

8EGP (Exterior Gateway Protocol) [RFC888]

9IGP (Interior Gateway Protocol) [IANA]

11 Network Voice Protocol [RFC741]

17 UDP (User Datagram Protocol) [RFC768]

20 Host monitoring [RFC869]

27 RDP (Reliable Data Protocol) [RFC908]

28 IRTP (Internet Reliable Transaction Protocol) [RFC938]

29 ISO-TP4 (ISO Transport Protocol Class 4) [RFC905]

30 Bulk Data Transfer Protocol [RFC969]

33 DCCP (Datagram Congestion Control Protocol)

[RFC4340]

48 DSR (Dynamic Source Routing Protocol) [RFC4728]

50 ESP (Encap Security Payload) [RFC2406]

51 AH (Authentication Header) [RFC2402]

54 NARP (NBMA Address Resolution Protocol) [RFC1735]

58 ICMP for IPv6 [RFC1883]

59 No Next Header for IPv6 [RFC1883]

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 977

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED IP PROTOCOL FILTER)

Mode IPv4 Extended ACL Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Usage An ACL can be configured with multiple ACL filters using sequence numbers. If the

sequence number is omitted, the next available multiple of 10 will be used as the

sequence number for the new filter. A new ACL filter can be inserted into the

middle of an existing list by specifying the appropriate sequence number.

NOTE: The access control list being configured is selected by running the access-list

(extended numbered) command or the access-list extended (named) command, with

the required access control list number, or name - but with no further parameters

selected.

Software ACLs will deny access unless explicitly permitted by an ACL action.

Example 1

[creating a list]

Use the following commands to add a new access-list filter entry to the access-list

named my-list that will reject IP packets from source address 10.10.1.1/32

to destination address 192.68.1.1/32:

awplus# configure terminal

awplus(config)# access-list extended my-list

awplus(config-ip-ext-acl)# deny ip 10.10.1.1/32 192.168.1.1/32

60 Destination Options for IPv6 [RFC1883]

88 EIGRP (Enhanced Interior Gateway Routing Protocol)

89 OSPFIGP [RFC1583]

97 Ethernet-within-IP Encapsulation / RFC3378

98 Encapsulation Header / RFC1241

108 IP Payload Compression Protocol / RFC2393

112 Virtual Router Redundancy Protocol / RFC3768

134 RSVP-E2E-IGNORE / RFC3175

135 Mobility Header / RFC3775

136 UDPLite / RFC3828

137 MPLS-in-IP / RFC4023

138 MANET Protocols / RFC-ietf-manet-iana-07.txt

139-252 Unassigned / IANA

253 Use for experimentation and testing / RFC3692

254 Use for experimentation and testing / RFC3692

255 Reserved / IANA

Table 29-6: IP protocol number and description (cont.)

Protocol Number Protocol Description [RFC]

C613-50292-01 Rev A Command Reference for IE210L Series 978

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED IP PROTOCOL FILTER)

Example 2

[adding to a list]

Use the following commands to add a new access-list filter entry at sequence

position 5 in the access-list named my-list that will accept packets from source

address 10.10.1.1/24 to destination address 192.68.1.1/24:

awplus# configure terminal

awplus(config)# access-list extended my-list

awplus(config-ip-ext-acl)# 5 permit ip 10.10.1.1/24

192.168.1.1/ 24

Commands

access-list extended (named)

access-list (extended numbered)

show running-config

show ip access-list

C613-50292-01 Rev A Command Reference for IE210L Series 979

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED TCP UDP FILTER)

(access-list extended TCP UDP filter)

Overview Use this ACL filter to add a new TCP or UDP filter entry to the current extended

access-list. If the sequence number is specified, the new filter is inserted at the

specified location. Otherwise, the new filter is added at the end of the access-list.

The no variant of this command removes a TCP or UDP filter entry from the current

extended access-list. You can specify the TCP or UDP filter entry for removal by

entering either its sequence number (e.g. no 10), or by entering its TCP or UDP

filter profile without specifying its sequence number.

Note that the sequence number can be found by running the show access-list (IPv4

Software ACLs) command.

Syntax [tcp|udp] [<sequence-number>] {deny|permit} {tcp|udp} <source> {eq

<sourceport> |lt <sourceport>|gt <sourceport>|ne <sourceport>}

<destination> [eq <destport>|lt <destport>|gt <destport>|ne

<destport>] [log]

no [<sequence-number>]{deny|permit} {tcp|udp} <source> {eq

<sourceport> |lt <sourceport>|gt <sourceport>|ne <sourceport>}

<destination> [eq <destport>|lt <destport>|gt <destport>|ne

<destport>] [log]

no <sequence-number>

Mode IPv4 Extended ACL Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Usage An ACL can be configured with multiple ACL filters using sequence numbers. If the

sequence number is omitted, the next available multiple of 10 will be used as the

sequence number for the new filter. A new ACL filter can be inserted into the

middle of an existing list by specifying the appropriate sequence number.

NOTE: The access control list being configured is selected by running the access-list

(extended numbered) command or the access-list extended (named) command, with

the required access control list number, or name - but with no further parameters

selected.

Software ACLs will deny access unless explicitly permitted by an ACL action.

Example 1

[creating a list]

To add a new entry to the access-list named my-list that will reject TCP packets

from 10.0.0.1on TCP port 10 to 192.168.1.1 on TCP port 20, use the

commands:

awplus# configure terminal

awplus(config)# access-list extended my-list

awplus(config-ip-ext-acl)# deny tcp 10.0.0.1/32 eq 10

192.168.1.1/32 eq 20

C613-50292-01 Rev A Command Reference for IE210L Series 980

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST EXTENDED TCP UDP FILTER)

Example 2

[adding to a list]

To insert a new entry with sequence number 5 of the access-list named my-list

that will accept UDP packets from 10.1.1.0/24 network to 192.168.1.0/24

network on UDP port 80, use the commands:

awplus# configure terminal

awplus(config)# access-list extended my-list

awplus(config-ip-ext-acl)# 5 permit udp 10.1.1.0/24

192.168.1.0/24 eq 80

Commands

access-list extended (named)

access-list (extended numbered)

show running-config

show ip access-list

C613-50292-01 Rev A Command Reference for IE210L Series 981

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST STANDARD (NAMED)

access-list standard (named)

Overview This command configures a standard named access-list that permits or denies

packets from a specific source IP address. You can either create a standard named

ACL together with an ACL filter entry in the Global Configuration mode, or you can

use the IPv4 Standard ACL Configuration mode for sequenced ACL filter entry after

first entering an access-list name.

The no variant of this command removes a specified standard named access-list.

Syntax

[list-name] access-list standard <standard-access-list-name>

no access-list standard <standard-access-list-name>

Syntax

[deny|permit] access-list standard <standard-access-list-name> {deny|permit}

no access-list standard <standard-access-list-name>

{deny|permit} <source>

Mode Global Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Parameter Description

<standard-access-list-name

>Specify a name for the standard access-list.

Parameter Description

<standard-

access-list-

name>

Specify a name for the standard access-list.

deny The access-list rejects packets that match the source filtering

specified with this command.

permit The access-list permits packets that match the source filtering

specified with this command.

<source>The source address of the packets. You can specify a single host, a

subnet, or all sources. The following are the valid formats for

specifying the source:

<ip-addr>/<prefix>An IPv4 address, followed by a

forward slash, then the prefix

length. This matches any source

IP address within the specified

subnet.

any Matches any source IP address.

C613-50292-01 Rev A Command Reference for IE210L Series 982

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST STANDARD (NAMED)

Usage Use this command when configuring a standard named access-list for filtering IP

software packets.

You can either create access-lists from within this command, or you can enter

access-list standard followed by only the name. Entering only the name moves

you to the IPv4 Standard ACL Configuration mode for the selected access-list. From

there you can configure your access-lists by using the command (access-list

standard named filter).

NOTE: Software ACLs will deny access unless explicitly permitted by an ACL action.

Examples To define a standard access-list named my-list and deny any packets from any

source, use the commands:

awplus# configure terminal

awplus(config)# access-list standard my-list deny any

Alternatively, to define a standard access-list named my-list and enter the IPv4

Standard ACL Configuration mode to deny any packets from any source, use the

commands:

awplus# configure terminal

awplus(config)# access-list standard my-list

awplus(config-ip-std-acl)# 5 deny any

Commands

(access-list standard named filter)

show running-config

show ip access-list

C613-50292-01 Rev A Command Reference for IE210L Series 983

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (STANDARD NUMBERED)

access-list (standard numbered)

Overview This command configures a standard numbered access-list that permits or denies

packets from a specific source IP address. You can either create a standard

numbered ACL together with an ACL filter entry in the Global Configuration mode,

or you can use the IPv4 Standard ACL Configuration mode for sequenced ACL filter

entry after first entering an access-list number.

The no variant of this command removes a specified standard numbered

access-list.

Syntax

[list-number] access-list {<1-99>|<1300-1999>}

no access-list {<1-99>|<1300-1999>}

Syntax [deny|

permit] access-list {<1-99>|<1300-1999>} {deny|permit} <source>

no access-list {<1-99>|<1300-1999>} {deny|permit} <source>

Mode Global Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Usage Use this command when configuring a standard numbered access-list for filtering

IP software packets.

Parameter Description

<1-99>IP standard access-list.

<1300-1999>IP standard access-list (expanded range).

Parameter Description

<1-99>IP standard access-list.

<1300-1999>IP standard access-list (expanded range).

deny Access-list rejects packets from the specified source.

permit Access-list accepts packets from the specified source.

<source>The source address of the packets. You can specify a single host, a

subnet, or all sources. The following are the valid formats for

specifying the source:

<ip-addr>

<reverse-mask>Enter an IPv4 address followed by a reverse

mask in dotted decimal format. For example,

entering 192.168.1.1 0.0.0.255 is

the same as entering 192.168.1.1/24.

any Matches any source IP address.

C613-50292-01 Rev A Command Reference for IE210L Series 984

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

ACCESS-LIST (STANDARD NUMBERED)

You can either create access-lists from within this command, or you can enter

access-list followed by only the number. Entering only the number moves you to

the IPv4 Standard ACL Configuration mode for the selected access-list. From there

you can configure your access-lists by using the command (access-list standard

numbered filter).

NOTE: Software ACLs will deny access unless explicitly permitted by an ACL action.

Examples To create ACL number 67 that will deny packets from subnet 172.16.10, use the

commands:

awplus# configure terminal

awplus(config)# access-list 67 deny 172.16.10.0 0.0.0.255

Alternatively, to enter the IPv4 Standard ACL Configuration mode to create the

ACL filter and deny packets from subnet 172.16.10.0 for the standard

numbered access-list 67, use the commands:

awplus# configure terminal

awplus(config)# access-list 67

awplus(config-ip-std-acl)# deny 172.16.10.0 0.0.0.255

Commands

(access-list standard named filter)

show running-config

show ip access-list

C613-50292-01 Rev A Command Reference for IE210L Series 985

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST STANDARD NAMED FILTER)

(access-list standard named filter)

Overview This ACL filter adds a source IP address filter entry to a current named standard

access-list. If the sequence number is specified, the new filter entry is inserted at

the specified location. Otherwise, the new entry is added at the end of the

access-list.

The no variant of this command removes a source IP address filter entry from the

current named standard access-list. You can specify the source IP address filter

entry for removal by entering either its sequence number (e.g. no 10), or by

entering its source IP address filter profile without specifying its sequence number.

Note that the sequence number can be found by running the show access-list (IPv4

Software ACLs) command.

Syntax [<sequence-number>] {deny|permit} {<source> [exact-match]|any}

no {deny|permit} {<source> [exact-match]|any}

no <sequence-number>

Mode IPv4 Standard ACL Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Parameter Description

<sequence-number><1-65535>

The sequence number for the filter entry of the

selected access control list.

deny Access-list rejects packets of the source filtering

specified.

permit Access-list allows packets of the source filtering

specified

<source>The source address of the packets. You can specify

either a subnet or all sources. The following are the

valid formats for specifying the source:

<ip-addr>/

<prefix>An IPv4 address, followed by a

forward slash, then the prefix

length. This matches any

destination IP address within

the specified subnet.

<ip-addr> An IPv4 address in a.b.c.d

format.

exact-match Specify an exact IP prefix to match on.

any Matches any source IP address.

C613-50292-01 Rev A Command Reference for IE210L Series 986

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST STANDARD NAMED FILTER)

Usage An ACL can be configured with multiple ACL filters using sequence numbers. If the

sequence number is omitted, the next available multiple of 10 will be used as the

sequence number for the new filter. A new ACL filter can be inserted into the

middle of an existing list by specifying the appropriate sequence number.

NOTE: The access control list being configured is selected by running the access-list

standard (named) command with the required access control list name, but with no

further parameters selected.

Software ACLs will deny access unless explicitly permitted by an ACL action.

Examples Use the following commands to add a new filter entry to access-list my-list that

will reject IP address 10.1.1.1:

awplus# configure terminal

awplus(config)# access-list standard my-list

awplus(config-ip-std-acl)# deny 10.1.1.1/32

Use the following commands to insert a new filter entry into access-list my-list

at sequence position number 15 that will accept IP network 10.1.2.0:

awplus# configure terminal

awplus(config)# access-list standard my-list

awplus(config-ip-std-acl)# 15 permit 10.1.2.0/24

Commands

access-list standard (named)

show running-config

show ip access-list

C613-50292-01 Rev A Command Reference for IE210L Series 987

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST STANDARD NUMBERED FILTER)

(access-list standard numbered filter)

Overview This ACL filter adds a source IP address filter entry to a current standard numbered

access-list. If a sequence number is specified, the new filter entry is inserted at the

specified location. Otherwise, the new filter entry is added at the end of the

access-list.

The no variant of this command removes a source IP address filter entry from the

current standard numbered access-list. You can specify the source IP address filter

entry for removal by entering either its sequence number (e.g. no 10), or by

entering its source IP address filter profile without specifying its sequence number.

Note that the sequence number can be found by running the show access-list (IPv4

Software ACLs) command.

Syntax [<sequence-number>] {deny|permit} {<source>|host

<host-address>|any}

no {deny|permit} {<source>|host <host-address>|any}

no <sequence-number>

Mode IPv4 Standard ACL Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Parameter Description

<sequence-number><1-65535>

The sequence number for the filter entry of the

selected access control list.

deny Access-list rejects packets of the type specified.

permit Access-list allows packets of the type specified

<source>The source address of the packets. You can specify

either a subnet or all sources. The following are the

valid formats for specifying the source:

<ip-addr>

<reverse-mask>Enter a reverse mask for the

source address in dotted

decimal format. For example,

entering 192.168.1.1

0.0.0.255 is the same as

entering 192.168.1.1/24.

<ip-addr> An IPv4 address in a.b.c.d

format.

host A single source host.

<host-address>Single source host address.

any Matches any source IP address.

C613-50292-01 Rev A Command Reference for IE210L Series 988

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(ACCESS-LIST STANDARD NUMBERED FILTER)

Usage An ACL can be configured with multiple ACL filters using sequence numbers. If the

sequence number is omitted, the next available multiple of 10 will be used as the

sequence number for the new filter. A new ACL filter can be inserted into the

middle of an existing list by specifying the appropriate sequence number.

NOTE: The access control list being configured is selected by running the access-list

(standard numbered) command with the required access control list number but with

no further parameters selected.

Software ACLs will deny access unless explicitly permitted by an ACL action.

Example To add a new entry accepting the IP network 10.1.1.0/24 at the sequence

number 15 position, use the commands:

awplus# configure terminal

awplus(config)# access-list 99

awplus(config-ip-std-acl)# 15 permit 10.1.2.0 0.0.0.255

Commands

access-list (standard numbered)

show running-config

show ip access-list

C613-50292-01 Rev A Command Reference for IE210L Series 989

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

MAXIMUM-ACCESS-LIST

maximum-access-list

Overview Use this command to set the maximum number of filters that can be added to any

access-list. These are access-lists within the ranges 1-199, 1300-1999 and

2000-2699, and named standard and extended access-lists.

The no variant of this command removes the limit on the number of filters that can

be added to a software access-list.

Syntax maximum-access-list <1-4294967294>

no maximum-access-list

Mode Global Configuration

Example To set the maximum number of software filters to 200, use the commands:

awplus# configure terminal

awplus(config)# maximum-access-list 200

Parameter Description

<1-4294967294>Filter range.

C613-50292-01 Rev A Command Reference for IE210L Series 990

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

SHOW ACCESS-LIST (IPV4 SOFTWARE ACLS)

show access-list (IPv4 Software ACLs)

Overview Use this command to display the specified access-list, or all access-lists if none have

been specified. Note that only defined access-lists are displayed. An error message

is displayed for an undefined access-list

Syntax show access-list

[<1-99>|<100-199>|<1300-1999>|<2000-2699>|<3000-3699>|

<4000-4499>|<access-list-name>]

Mode User Exec and Privileged Exec

Examples To show all access-lists configured on the switch:

awplus# show access-list

To show the access-list with an ID of 20:

awplus# show access-list 20

Parameter Description

<1-99>IP standard access-list.

<100-199>IP extended access-list.

<1300-1999>IP standard access-list (standard - expanded range).

<2000-2699>IP extended access-list (extended - expanded range).

<3000-3699>Hardware IP access-list.

<4000-4499>Hardware MAC access-list.

<access-list-name>IP named access-list.



Standard IP access list 1

deny 172.16.2.0, wildcard bits 0.0.0.255

Standard IP access list 20

deny 192.168.10.0, wildcard bits 0.0.0.255

deny 192.168.12.0, wildcard bits 0.0.0.255

Hardware IP access list 3001

permit ip 192.168.20.0 255.255.255.0 any

Hardware IP access list 3020

permit tcp any 192.0.2.0/24

awplus#show access-list 20

C613-50292-01 Rev A Command Reference for IE210L Series 991

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

SHOW ACCESS-LIST (IPV4 SOFTWARE ACLS)

Note the following error message is displayed if you attempt to show an undefined

access-list:

awplus# show access-list 2

Commands

access-list standard (named)

access-list (standard numbered)



Standard IP access-list 20

deny 192.168.10.0, wildcard bits 0.0.0.255

deny 192.168.12.0, wildcard bits 0.0.0.255



% Can't find access-list 2

C613-50292-01 Rev A Command Reference for IE210L Series 992

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

SHOW IP ACCESS-LIST

show ip access-list

Overview Use this command to display IP access-lists.

Syntax show ip access-list

[<1-99>|<100-199>|<1300-1999>|<2000-2699>|<access-list-name>]

Mode User Exec and Privileged Exec

Example awplus# show ip access-list

Output Figure 29-1: Example output from the show ip access-list command

Parameter Description

<1-99>IP standard access-list.

<100-199>IP extended access-list.

<1300-1999>IP standard access-list (expanded range).

<2000-2699>IP extended access-list (expanded range).

<access-list-name>IP named access-list.

Standard IP access-list 1

permit 172.168.6.0, wildcard bits 0.0.0.255

permit 192.168.6.0, wildcard bits 0.0.0.255

C613-50292-01 Rev A Command Reference for IE210L Series 993

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV4 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

VTY ACCESS-CLASS (NUMBERED)

vty access-class (numbered)

Overview For IPv4, use this command to set a standard numbered software access list to be

the management ACL. This is then applied to all available VTY lines for controlling

remote access by Telnet and SSH. This command allows or denies packets

containing the IP addresses included in the ACL to create a connection to your

device.

ACLs that are attached using this command have an implicit deny-all filter as the

final entry in the ACL. So a typical configuration would be to permit a specific

address, or range of addresses, and rely on the deny-all filter to block all other

access.

Use the no variant of this command to remove the access list.

Syntax vty access-class {<1-99>|<1300-1999>}

no vty access-class [<1-99>|<1300-1999>]

Mode Global Configuration

Examples To set access-list 4 to be the management ACL, use the following commands:

awplus# configure terminal

awplus(config)# vty access-class 4

To remove access-list 4 from the management ACL, use the following commands:

awplus# configure terminal

awplus(config)# no vty access-class 4

Output Figure 29-2: Example output from the show running-config command

Commands

show running-config

vty ipv6 access-class (named)

Parameter Description

<1-99> IPv4 standard access-list number

<1300-1999> IPv4 standard access-list number (expanded range)

awplus#show running-config|grep access-class



vty access-class 4

C613-50292-01 Rev A Command Reference for IE210L Series 994

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPv6 Hardware

Access Control List

(ACL) Commands

Introduction

Overview This chapter provides an alphabetical reference for the IPv6 Hardware Access

Control List (ACL) commands, and contains detailed command information and

command examples about IPv6 hardware ACLs, which are applied directly to

interfaces using the ipv6 traffic-filter command.

For information about ACLs, see the ACL Feature Overview and Configuration

Guide.

To apply ACLs to an LACP channel group, apply it to all the individual switch ports

in the channel group. To apply ACLs to a static channel group, apply it to the static

channel group itself. For more information on link aggregation see the following

references:

•Link Aggregation Feature Overview_and_Configuration_Guide.

•Link Aggregation Commands

Most ACL command titles include usage information in parentheses. When the

command title is completely surrounded by parentheses, the title indicates the

type of ACL filter instead of keywords to enter into the CLI. For example, the title

(named IPv6 hardware ACL: IP protocol entry) represents a command with the

syntax:

[<sequence-number>] <action> proto <1-255> <source-addr>

<dest-addr> [vlan <1-4094>]

Hardware ACLs will permit access unless explicitly denied by an ACL action.

Sub-modes Many of the ACL commands operate from sub-modes that are specific to particular

ACL types. The following table shows the CLI prompts at which ACL commands are

entered.

C613-50292-01 Rev A Command Reference for IE210L Series 995

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

Command List •“commit (IPv6)” on page 996

•“ipv6 access-list (named IPv6 hardware ACL)” on page 997

•“(named IPv6 hardware ACL: ICMP entry)” on page 999

•“(named IPv6 hardware ACL: IPv6 packet entry)” on page 1003

•“(named IPv6 hardware ACL: IP protocol entry)” on page 1006

•“(named IPv6 hardware ACL: TCP or UDP entry)” on page 1011

•“ipv6 traffic-filter” on page 1015

•“show ipv6 access-list (IPv6 Hardware ACLs)” on page 1016

Table 30-1: IPv6 Hardware Access List Commands and Prompts

Command Name Command Mode Prompt

show ipv6 access-list (IPv6 Hardware

ACLs)

Privileged Exec awplus#

ipv6 access-list (named IPv6

hardware ACL)

Global Configuration awplus(config)#

ipv6 traffic-filter Interface Configuration awplus(config-if)#

commit (IPv6) IPv6 Hardware ACL

Configuration awplus(config-ipv6-hw-acl)#

(named IPv6 hardware ACL: IPv6

packet entry)

IPv6 Hardware ACL

Configuration awplus(config-ipv6-hw-acl)#

(named IPv6 hardware ACL: ICMP

entry)

IPv6 Hardware ACL

Configuration awplus(config-ipv6-hw-acl)#

(named IPv6 hardware ACL: IP

protocol entry)

IPv6 Hardware ACL

Configuration awplus(config-ipv6-hw-acl)#

(named IPv6 hardware ACL: TCP or

UDP entry)

IPv6 Hardware ACL

Configuration awplus(config-ipv6-hw-acl)#

C613-50292-01 Rev A Command Reference for IE210L Series 996

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

COMMIT (IPV6)

commit (IPv6)

Overview Use this command to commit the IPv6 ACL filter configuration entered at the

console to the hardware immediately without exiting the IPv6 Hardware ACL

Configuration mode.

This command forces the associated hardware and software IPv6 ACLs to

synchronize.

Syntax commit

Mode IPv6 Hardware ACL Configuration

Usage Normally, when an IPv6 hardware ACL is edited, the new configuration state of the

IPv6 ACL is not written to hardware until you exit IPv6 Hardware ACL Configuration

mode. By entering this command you can ensure that the current state of a

hardware access-list that is being edited is written to hardware immediately.

Scripts typically do not include the exit command to exit configuration modes,

potentially leading to IPv6 ACL filters in hardware not being correctly updated.

Using this commit command in a configuration script after specifying an IPv6

hardware ACL filter ensures that it is updated in the hardware.

Example To update the hardware with the IPv6 ACL filter configuration, use the command:

awplus# configure terminal

awplus(config)# ipv6 access-list my-ipv6-acl

awplus(config-ipv6-hw-acl)# commit

Commands

ipv6 access-list (named IPv6 hardware ACL)

C613-50292-01 Rev A Command Reference for IE210L Series 997

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

IPV6 ACCESS-LIST (NAMED IPV6 HARDWARE ACL)

ipv6 access-list (named IPv6 hardware ACL)

Overview Use this command to either create a new IPv6 hardware access-list, or to select an

existing IPv6 hardware access-list in order to apply a filter entry to it.

Use the no variant of this command to delete an existing IPv6 hardware access-list.

NOTE: Before you can delete an access-list, you must first remove it from any interface

it is assigned to.

Syntax ipv6 access-list <ipv6-access-list-name>

no ipv6 access-list <ipv6-access-list-name>

Mode Global Configuration

Default Any traffic on an interface controlled by a hardware ACL that does not explicitly

match a filter is permitted.

Usage Use IPv6 hardware named access-lists to control the transmission of IPv6 packets

on an interface, and restrict the content of routing updates. The switch stops

checking the IPv6 hardware named access-list when a match is encountered.

This command moves you to the (config-ipv6-hw-acl) prompt for the selected IPv6

hardware named access-list number. From there you can configure the filters for

this selected IPv6 hardware named access-list.

Once you have configured the ACL, use the ipv6 traffic-filter or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map. Note

that the ACL will only apply to incoming data packets.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

Examples To create an IPv6 access-list named “my-ipv6-acl”, use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-ipv6-acl

awplus(config-ipv6-hw-acl)#

To delete the IPv6 access-list named “my-ipv6-acl”, use the commands:

awplus# configure terminal

awplus(config)# no ipv6 access-list my-ipv6-acl

Commands

(named IPv6 hardware ACL: ICMP entry)

Parameter Description

<ipv6-access-list-name> Specify an IPv6 access-list name.

C613-50292-01 Rev A Command Reference for IE210L Series 998

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

IPV6 ACCESS-LIST (NAMED IPV6 HARDWARE ACL)

(named IPv6 hardware ACL: IPv6 packet entry)

(named IPv6 hardware ACL: IP protocol entry)

(named IPv6 hardware ACL: TCP or UDP entry)

ipv6 traffic-filter

match access-group

show ipv6 access-list (IPv6 Hardware ACLs)

C613-50292-01 Rev A Command Reference for IE210L Series 999

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: ICMP ENTRY)

(named IPv6 hardware ACL: ICMP entry)

Overview Use this command to add a new ICMP filter entry to the current IPv6 hardware

access-list. The filter will match on any ICMP packet that has the specified IPv6

source and destination IP addresses and (optionally) ICMP type. You can specify

the value any if source or destination address does not matter.

The no variant of this command removes a filter entry from the current IPv6

hardware access-list. You can specify the filter entry for removal by entering either

its sequence number (e.g. no 100), or by entering its filter profile without

specifying its sequence number (e.g. no deny icmp 2001:0db8::0/64 any).

You can find the sequence number by running the show ipv6 access-list (IPv6

Hardware ACLs) command.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax [<sequence-number>] <action> icmp <source-addr> <dest-addr>

[icmp-type <number>] [vlan <1-4094>]

no <sequence-number>

no <action> icmp <source-addr> <dest-addr> [icmp-type <number>]

[vlan <1-4094>]

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 1000

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: ICMP ENTRY)

Parameter Description

<sequence-



number>The sequence number for the filter entry of the selected access

control list, in the range 1-65535.

<action> The action that the switch will take on matching packets. See the

table above for valid values.

icmp Match against ICMP packets

<source-addr> The source addresses to match against. You can specify a single

host, a range, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source host.

<ipv6-src-address/



prefix-length>Match the specified source

address and prefix length.

The IPv6 address prefix uses the

format X:X::/prefix-length. The

prefix-length is usually set

between 0 and 64.

<ipv6-src-address>

<ipv6-src-wildcard>Match the specified IPv6 source

address, masked using wildcard

bits.

The IPv6 address uses the format

X:X::X:X.

In the wildcard bits, 1 represents

bits to ignore, and 0 represents

bits to match

host

<ipv6-source-host>Match a single source host

address.

The IPv6 address uses the format

X:X::X:X.

<dest-addr> The destination addresses to match against. You can specify a

single host, a range, or all destination addresses. The following are

the valid formats for specifying the destination:

any Match any destination host.

<ipv6-dest-address/



prefix-length>Match the specified destination

address and prefix length.

The IPv6 address prefix uses the

format X:X::/prefix-length. The

prefix-length is usually set

between 0 and 64.

<ipv6-dest-address>

<ipv6-dest-wildcard>Match the specified destination

address, masked using wildcard

bits.

The IPv6 address uses the format

X:X::X:X.

In the wildcard bits, 1 represents

bits to ignore, and 0 represents

bits to match

C613-50292-01 Rev A Command Reference for IE210L Series 1001

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: ICMP ENTRY)

Mode IPv6 Hardware ACL Configuration (accessed by running the command ipv6

access-list (named IPv6 hardware ACL))

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage To use this command, first run the command ipv6 access-list (named IPv6

hardware ACL) and enter the desired access-list name. This changes the prompt to

awplus(config-ipv6-hw-acl)#.

Then use this command (and the other “named IPv6 hardware ACL: entry”

commands) to add filter entries. You can add multiple filter entries to an ACL.

If you specify a sequence number, the new entry is inserted at the specified

location. If you do not specify a sequence number, the switch puts the entry at the

end of the ACL and assigns it the next available multiple of 10 as its sequence

number.

Once you have configured the ACL, use the ipv6 traffic-filter or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map. Note

that the ACL will only apply to incoming data packets.

host

<ipv6-dest-host>Match a single destination host

address.

The IPv6 address uses the format

X:X::X:X.

icmp-type

<number>The type of ICMP message to match against, as defined in RFC792

and RFC950. Values include:

0Echo replies.

3Destination unreachable

messages.

4Source quench messages.

5Redirect (change route) messages.

8Echo requests.

11 Time exceeded messages.

12 Parameter problem messages.

13 Timestamp requests.

14 Timestamp replies.

15 Information requests.

16 Information replies.

17 Address mask requests.

18 Address mask replies.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1002

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: ICMP ENTRY)

Examples To add a filter entry to the ACL named “my-acl”, to block ICMP packets sent from

network 2001:0db8::0/64 , use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl

awplus(config-ipv6-hw-acl)# deny icmp 2001:0db8::0/64 any

To remove a filter entry from the ACL named “my-acl” that blocks all ICMP packets

sent from network 2001:0db8::0/ 64 , use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl

awplus(config-ipv6-hw-acl)# no deny icmp 2001:0db8::0/64 any

To specify an ACL named “my-acl1” and add a filter entry that blocks all ICMP6 echo

requests, enter the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl1

awplus(config-ipv6-hw-acl)# deny icmp any any icmp-type 128

To specify an ACL named “my-acl2” and add a filter entry that blocks all ICMP6 echo

requests on the default VLAN (vlan1), enter the following commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl2

awplus(config-ipv6-hw-acl)# deny icmp any any icmp-type 128

vlan 1

To remove a filter entry that blocks all ICMP6 echo requests from the ACL named

“my-acl1”, enter the following commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl1

awplus(config-ipv6-hw-acl)# no deny icmp any any icmp-type 128

Commands

ipv6 access-list (named IPv6 hardware ACL)

ipv6 traffic-filter

match access-group

show ipv6 access-list (IPv6 Hardware ACLs)

Command

changes

Version 5.4.7-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1003

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: IPV6 PACKET ENTRY)

(named IPv6 hardware ACL: IPv6 packet

entry)

Overview Use this command to add an IPv6 packet filter entry to the current hardware

access-list. The filter will match on IPv6 packets that have the specified source and

destination IPv6 address and (optionally) prefix. You can use the value any instead

of source or destination IPv6 address if an address does not matter.

The no variant of this command removes a filter entry from the current hardware

access-list. You can specify the filter entry for removal by entering either its

sequence number (e.g. no 100), or by entering its filter profile without specifying

its sequence number (e.g. no deny ipv6 2001:0db8::0/64 any).

You can find the sequence number by running the show ipv6 access-list (IPv6

Hardware ACLs) command.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax [<sequence-number>] <action> ipv6 <source-addr> <dest-addr>

[vlan <1-4094>]

no <sequence-number>

no <action> ipv6 <source-addr> <dest-addr> [vlan <1-4094>]

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 1004

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: IPV6 PACKET ENTRY)

Parameter Description

<sequence-



number>The sequence number for the filter entry of the selected access

control list, in the range 1-65535.

<action> The action that the switch will take on matching packets. See the

table above for valid values.

ipv6 Match against IPv6 packets

<source-addr> The source addresses to match against. You can specify a single

host, a range, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source host.

<ipv6-src-address/



prefix-length>Match the specified source

address and prefix length.

The IPv6 address prefix uses the

format X:X::/prefix-length. The

prefix-length is usually set

between 0 and 64.

<ipv6-src-address>

<ipv6-src-wildcard>Match the specified IPv6 source

address, masked using wildcard

bits.

The IPv6 address uses the format

X:X::X:X.

In the wildcard bits, 1 represents

bits to ignore, and 0 represents

bits to match

host

<ipv6-source-host>Match a single source host

address.

The IPv6 address uses the format

X:X::X:X.

<dest-addr> The destination addresses to match against. You can specify a

single host, a range, or all destination addresses. The following are

the valid formats for specifying the destination:

any Match any destination host.

<ipv6-dest-address/



prefix-length>Match the specified destination

address and prefix length.

The IPv6 address prefix uses the

format X:X::/prefix-length. The

prefix-length is usually set

between 0 and 64.

<ipv6-dest-address>

<ipv6-dest-wildcard>Match the specified destination

address, masked using wildcard

bits.

The IPv6 address uses the format

X:X::X:X.

In the wildcard bits, 1 represents

bits to ignore, and 0 represents

bits to match

C613-50292-01 Rev A Command Reference for IE210L Series 1005

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: IPV6 PACKET ENTRY)

Mode IPv6 Hardware ACL Configuration (accessed by running the command ipv6

access-list (named IPv6 hardware ACL))

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage To use this command, first run the command ipv6 access-list (named IPv6

hardware ACL) and enter the desired access-list name. This changes the prompt to

awplus(config-ipv6-hw-acl)#.

Then use this command (and the other “named IPv6 hardware ACL: entry”

commands) to add filter entries. You can add multiple filter entries to an ACL.

If you specify a sequence number, the new entry is inserted at the specified

location. If you do not specify a sequence number, the switch puts the entry at the

end of the ACL and assigns it the next available multiple of 10 as its sequence

number.

Once you have configured the ACL, use the ipv6 traffic-filter or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map. Note

that the ACL will only apply to incoming data packets.

Examples To add a filter entry to the ACL named “my-acl” to block IPv6 traffic sent from

network 2001:0db8::0/64, use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl

awplus(config-ipv6-hw-acl)# deny ipv6 2001:0db8::0/64 any

To remove a filter entry from the ACL named “my-acl” that blocks all IPv6 traffic

sent from network 2001:0db8::0/ 64, use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl

awplus(config-ipv6-hw-acl)# no deny ipv6 2001:0db8::0/64 any

Commands

ipv6 access-list (named IPv6 hardware ACL)

ipv6 traffic-filter

match access-group

show ipv6 access-list (IPv6 Hardware ACLs)

Command

changes

Version 5.4.7-2.1: command added

host

<ipv6-dest-host>Match a single destination host

address.

The IPv6 address uses the format

X:X::X:X.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1006

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: IP PROTOCOL ENTRY)

(named IPv6 hardware ACL: IP protocol

entry)

Overview Use this command to add an IP protocol type filter entry to the current IPv6

hardware access-list. The filter will match on IPv6 packets that have the specified

IP protocol number, and the specified IPv6 addresses. You can use the value any

instead of source or destination IPv6 address if an address does not matter.

The no variant of this command removes a filter entry from the current hardware

access-list. You can specify the filter entry for removal by entering either its

sequence number (e.g. no 100), or by entering its filter profile without specifying

its sequence number (e.g. no deny proto 2 2001:0db8::0/64 any).

You can find the sequence number by running the show ipv6 access-list (IPv6

Hardware ACLs) command.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax [<sequence-number>] <action> proto <1-255> <source-addr>

<dest-addr> [vlan <1-4094>]

no <sequence-number>

no <action> proto <1-255> <source-addr> <dest-addr> [vlan

<1-4094>]

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 1007

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: IP PROTOCOL ENTRY)

Table 30-2: Parameters in IP protocol ACL entries

Parameter Description

<sequence-



number>The sequence number for the filter entry of the selected access

control list, in the range 1-65535.

<action> The action that the switch will take on matching packets. See the

table above for valid values.

proto <1-255>The IP protocol number to match against, as defined by IANA

(Internet Assigned Numbers Authority

www.iana.org/assignments/protocol-numbers)

See below for a list of IP protocol numbers and their descriptions.

<source-addr> The source addresses to match against. You can specify a single

host, a range, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source host.

<ipv6-src-address/



prefix-length>Match the specified source

address and prefix length.

The IPv6 address prefix uses the

format X:X::/prefix-length. The

prefix-length is usually set

between 0 and 64.

<ipv6-src-address>

<ipv6-src-wildcard>Match the specified IPv6 source

address, masked using wildcard

bits.

The IPv6 address uses the format

X:X::X:X.

In the wildcard bits, 1 represents

bits to ignore, and 0 represents

bits to match

host

<ipv6-source-host>Match a single source host

address.

The IPv6 address uses the format

X:X::X:X.

<dest-addr> The destination addresses to match against. You can specify a

single host, a range, or all destination addresses. The following are

the valid formats for specifying the destination:

any Match any destination host.

<ipv6-dest-address/



prefix-length>Match the specified destination

address and prefix length.

The IPv6 address prefix uses the

format X:X::/prefix-length. The

prefix-length is usually set

between 0 and 64.

C613-50292-01 Rev A Command Reference for IE210L Series 1008

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: IP PROTOCOL ENTRY)

<ipv6-dest-address>

<ipv6-dest-wildcard>Match the specified destination

address, masked using wildcard

bits.

The IPv6 address uses the format

X:X::X:X.

In the wildcard bits, 1 represents

bits to ignore, and 0 represents

bits to match

host

<ipv6-dest-host>Match a single destination host

address.

The IPv6 address uses the format

X:X::X:X.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Table 30-3: IP protocol number and description

Protocol Number Protocol Description [RFC]

1Internet Control Message [RFC792]

2Internet Group Management [RFC1112]

3Gateway-to-Gateway [RFC823]

4IP in IP [RFC2003]

5Stream [RFC1190] [RFC1819]

6TCP (Transmission Control Protocol) [RFC793]

8EGP (Exterior Gateway Protocol) [RFC888]

9IGP (Interior Gateway Protocol) [IANA]

11 Network Voice Protocol [RFC741]

17 UDP (User Datagram Protocol) [RFC768]

20 Host monitoring [RFC869]

27 RDP (Reliable Data Protocol) [RFC908]

28 IRTP (Internet Reliable Transaction Protocol) [RFC938]

29 ISO-TP4 (ISO Transport Protocol Class 4) [RFC905]

30 Bulk Data Transfer Protocol [RFC969]

33 DCCP (Datagram Congestion Control Protocol) [RFC4340]

48 DSR (Dynamic Source Routing Protocol) [RFC4728]

50 ESP (Encap Security Payload) [RFC2406]

51 AH (Authentication Header) [RFC2402]

Table 30-2: Parameters in IP protocol ACL entries (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1009

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: IP PROTOCOL ENTRY)

Mode IPv6 Hardware ACL Configuration (accessed by running the command ipv6

access-list (named IPv6 hardware ACL))

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage To use this command, first run the command ipv6 access-list (named IPv6

hardware ACL) and enter the desired access-list name. This changes the prompt to

awplus(config-ipv6-hw-acl)#.

Then use this command (and the other “named IPv6 hardware ACL: entry”

commands) to add filter entries. You can add multiple filter entries to an ACL.

If you specify a sequence number, the new entry is inserted at the specified

location. If you do not specify a sequence number, the switch puts the entry at the

end of the ACL and assigns it the next available multiple of 10 as its sequence

number.

Once you have configured the ACL, use the ipv6 traffic-filter or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map. Note

that the ACL will only apply to incoming data packets.

54 NARP (NBMA Address Resolution Protocol) [RFC1735]

58 ICMP for IPv6 [RFC1883]

59 No Next Header for IPv6 [RFC1883]

60 Destination Options for IPv6 [RFC1883]

88 EIGRP (Enhanced Interior Gateway Routing Protocol)

89 OSPFIGP [RFC1583]

97 Ethernet-within-IP Encapsulation / RFC3378

98 Encapsulation Header / RFC1241

108 IP Payload Compression Protocol / RFC2393

112 Virtual Router Redundancy Protocol / RFC3768

134 RSVP-E2E-IGNORE / RFC3175

135 Mobility Header / RFC3775

136 UDPLite / RFC3828

137 MPLS-in-IP / RFC4023

138 MANET Protocols / RFC-ietf-manet-iana-07.txt

139-252 Unassigned / IANA

253 Use for experimentation and testing / RFC3692

254 Use for experimentation and testing / RFC3692

255 Reserved / IANA

Table 30-3: IP protocol number and description (cont.)

Protocol Number Protocol Description [RFC]

C613-50292-01 Rev A Command Reference for IE210L Series 1010

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: IP PROTOCOL ENTRY)

Examples To add a filter entry to the ACL named “my-acl” to deny IGMP packets from

2001:0db8::0/64 , use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl

awplus(config-ipv6-hw-acl)# deny proto 2 2001:0db8::0/64 any

To remove a filter entry that blocks IGMP packets from network 2001:0db8::0/64

from the ACL named “my-acl”, use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl

awplus(config-ipv6-hw-acl)# no deny proto 2 2001:0db8::0/64 any

Commands

ipv6 access-list (named IPv6 hardware ACL)

ipv6 traffic-filter

match access-group

show ipv6 access-list (IPv6 Hardware ACLs)

Command

changes

Version 5.4.7-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1011

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: TCP OR UDP ENTRY)

(named IPv6 hardware ACL: TCP or UDP

entry)

Overview Use this command to add a TCP or UDP filter entry to the current IPv6 hardware

access-list. The access-list will match on TCP or UDP packets that have the specified

source and destination IP addresses and optionally, port values. You can use the

value any instead of source or destination IP address if an address does not matter.

The no variant of this command removes a filter entry from the current hardware

access-list. You can specify the filter entry for removal by entering either its

sequence number (e.g. no 100), or by entering its filter profile without specifying

its sequence number (e.g. no deny tcp 2001:0db8::0/64 any).

You can find the sequence number by running the show ipv6 access-list (IPv6

Hardware ACLs) command.

Hardware ACLs will permit access unless explicitly denied by an ACL action.

CAUTION: Specifying a “send” action enables you to use ACLs to redirect packets from

their original destination. Use such ACLs with caution. They could prevent control

packets from reaching the correct destination, such as EPSR healthcheck messages

and AMF messages.

Syntax [<sequence-number>] <action> {tcp|udp} <source-addr>

[<source-ports>] <dest-addr> [<dest-ports>] [vlan <1-4094>]

no <sequence-number>

no <action> {tcp|udp} <source-addr> [<source-ports>]

<dest-addr> [<dest-ports>] [vlan <1-4094>]

The following actions are available for hardware ACLs:

Values for the <action> parameter

deny Reject packets that match the source and destination

filtering specified with this command.

permit Permit packets that match the source and destination

filtering specified with this command.

copy-to-cpu Send a copy of matching packets to the CPU.

copy-to-mirror Send a copy of matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-mirror Send matching packets to the mirror port.

Use the mirror interface command to configure the mirror

port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified port, tagged with

the specified VLAN. The specified port must belong to the

specified VLAN.

send-to-cpu Send matching packets to the CPU.

C613-50292-01 Rev A Command Reference for IE210L Series 1012

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: TCP OR UDP ENTRY)

Parameter Description

<sequence-



number>The sequence number for the filter entry of the selected access

control list, in the range 1-65535. If you do not specify a sequence

number, the switch puts the entry at the end of the ACL and

assigns it the next available multiple of 10 as its sequence

number. .

<action> The action that the switch will take on matching packets. See the

table above for valid values.

tcp Match against TCP packets.

udp Match against UDP packets.

<source-addr> The source addresses to match against. You can specify a single

host, a subnet, or all source addresses. The following are the valid

formats for specifying the source:

any Match any source IP address.

host <ip-addr> Match a single source host with the

IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/

<prefix>Match any source IP address within

the specified subnet. Specify the

subnet by entering the IPv4 address,

then a forward slash, then the prefix

length.

<ip-addr>

<reverse-mask>Match any source IP address within

the specified subnet. Specify the

subnet by entering a reverse mask

in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<source-ports>Match source TCP or UDP port numbers. Port numbers are

specified as integers between 0 and 65535. You can specify one or

more port numbers as follows:

eq <0-65535> Match a single port number.

lt <0-65535> Match all port numbers that are less

than the specified port number.

gt <0-65535> Match all port numbers that are

greater than the specified port

number.

ne <0-65535> Match all port numbers except the

specified port number.

range <start-port>

<end-port>Match a range of port numbers.

<dest-addr>The destination addresses to match against. You can specify a

single host, a subnet, or all destination addresses. The following

are the valid formats for specifying the destination:

C613-50292-01 Rev A Command Reference for IE210L Series 1013

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: TCP OR UDP ENTRY)

Mode IPv6 Hardware ACL Configuration (accessed by running the command ipv6

access-list (named IPv6 hardware ACL))

Default On an interface controlled by a hardware ACL, any traffic that does not explicitly

match a filter is permitted.

Usage To use this command, first run the command ipv6 access-list (named IPv6

hardware ACL) and enter the desired access-list name. This changes the prompt to

awplus(config-ipv6-hw-acl)#.

Then use this command (and the other “named IPv6 hardware ACL: entry”

commands) to add filter entries. You can add multiple filter entries to an ACL.

If you specify a sequence number, the new entry is inserted at the specified

location. If you do not specify a sequence number, the switch puts the entry at the

any Match any destination IP address.

host <ip-addr> Match a single destination host with

the IP address given by <ip-addr> in

dotted decimal notation.

<ip-addr>/

<prefix>Match any destination IP address

within the specified subnet. Specify

the subnet by entering the IPv4

address, then a forward slash, then

the prefix length.

<ip-addr>

<reverse-mask>Match any destination IP address

within the specified subnet. Specify

the subnet by entering a reverse

mask in dotted decimal format. For

example, entering “192.168.1.1

0.0.0.255” is the same as entering

192.168.1.1/24.

<dest-ports>Match destination TCP or UDP port numbers. Port numbers are

specified as integers between 0 and 65535. You can specify one or

more port numbers as follows:

eq <0-65535> Match a single port number.

lt <0-65535> Match all port numbers that are less

than the specified port number.

gt <0-65535> Match all port numbers that are

greater than the specified port

number.

ne <0-65535> Match all port numbers except the

specified port number.

range <start-port>

<end-port>Match a range of port numbers.

vlan <1-4094> The VLAN to match against. The ACL will match against the

specified ID in the packet’s VLAN tag.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1014

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

(NAMED IPV6 HARDWARE ACL: TCP OR UDP ENTRY)

end of the ACL and assigns it the next available multiple of 10 as its sequence

number.

Once you have configured the ACL, use the ipv6 traffic-filter or the match

access-group command to apply this ACL to a port, VLAN or QoS class-map. Note

that the ACL will only apply to incoming data packets.

Examples To add a filter entry that blocks all SSH traffic from network 2001:0db8::0/64 to the

hardware IPv6 access-list named “my-acl”, use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl

awplus(config-ipv6-hw-acl)# deny tcp 2001:0db8::0/64 any eq 22

To add a filter entry that blocks all SSH traffic from network 2001:0db8::0/64 on the

default VLAN (vlan1) to the hardware IPv6 access-list named “my-acl”, use the

commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl

awplus(config-ipv6-hw-acl)# deny tcp 2001:0db8::0/64 any eq 22

vlan 1

To remove an ACL filter entry that blocks all SSH traffic from network 2001:0db8::0/

64 from the hardware IPv6 access-list named “my-acl”, use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list my-acl

awplus(config-ipv6-hw-acl)# no deny tcp 2001:0db8::0/64 any eq

Commands

ipv6 access-list (named IPv6 hardware ACL)

ipv6 traffic-filter

match access-group

show ipv6 access-list (IPv6 Hardware ACLs)

Command

changes

Version 5.4.7-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1015

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

IPV6 TRAFFIC-FILTER

ipv6 traffic-filter

Overview This command adds an IPv6 hardware-based access-list to an interface. The

number of access-lists that can be added is determined by the amount of available

space in the hardware-based packet classification tables.

Use the no variant of this command to remove an IPv6 hardware-based access-list

from an interface.

Syntax ipv6 traffic-filter <ipv6-access-list-name>

no ipv6 traffic-filter <ipv6-access-list-name>

Mode Interface Configuration (to apply an IPv6 hardware ACL to a specific switch port).

Usage This command adds an IPv6 hardware-based access-list to an interface. The

number of access-lists that can be added is determined by the amount of available

space in the hardware-based packet classification tables.

Examples To add access-list “acl1” as a traffic-filter to interface port1.0.1, enter the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# ipv6 traffic-filter acl1

To remove access-list “acl1” as a traffic-filter from interface port1.0.1, enter the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no ipv6 traffic-filter acl1

Commands

ipv6 access-list (named IPv6 hardware ACL)

(named IPv6 hardware ACL: ICMP entry)

(named IPv6 hardware ACL: IPv6 packet entry)

(named IPv6 hardware ACL: IP protocol entry)

(named IPv6 hardware ACL: TCP or UDP entry)

show ipv6 access-list (IPv6 Hardware ACLs)

Parameter Description

<ipv6-access-list-name> Hardware IPv6 access-list name.

C613-50292-01 Rev A Command Reference for IE210L Series 1016

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 HARDWARE ACCESS CONTROL LIST (ACL) COMMANDS

SHOW IPV6 ACCESS-LIST (IPV6 HARDWARE ACLS)

show ipv6 access-list (IPv6 Hardware ACLs)

Overview Use this command to display all configured hardware IPv6 access-lists or the IPv6

access-list specified by name. Omitting the optional name parameter will display

all IPv6 ACLs.

Syntax show ipv6 access-list [<name>]

Mode User Exec and Privileged Exec

Example To show all configured IPv6 access-lists use the command:

awplus# show ipv6 access-list

Output Figure 30-1: Example output from the show ipv6 access-list command

Commands

ipv6 access-list (named IPv6 hardware ACL)

(named IPv6 hardware ACL: ICMP entry)

(named IPv6 hardware ACL: IPv6 packet entry)

(named IPv6 hardware ACL: IP protocol entry)

(named IPv6 hardware ACL: TCP or UDP entry)

ipv6 traffic-filter

Parameter Description

<name> Hardware IPv6 access-list name.

IPv6 access-list deny_ssh

deny tcp abcd::0/64 any eq 22

C613-50292-01 Rev A Command Reference for IE210L Series 1017

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPv6 Software

Access Control List

(ACL) Commands

Introduction

Overview This chapter provides an alphabetical reference for the IPv6 Software Access

Control List (ACL) commands, and contains detailed command information and

command examples about IPv6 software ACLs as applied to Routing and

Multicasting, which are not applied to interfaces.

For information about ACLs, see the ACL Feature Overview and Configuration

Guide.

To apply ACLs to an LACP channel group, apply it to all the individual switch ports

in the channel group. To apply ACLs to a static channel group, apply it to the static

channel group itself. For more information on link aggregation see the following

references:

•the Link Aggregation Feature Overview_and_Configuration Guide.

•Link Aggregation Commands

Note that text in parenthesis in command names indicates usage not keyword

entry. For example, ipv6-access-list (named) indicates named IPv6 ACLs entered

as ipv6-access-list <name> where <name> is a placeholder not a keyword.

Note also that parenthesis surrounding ACL filters indicates the type of ACL filter

not the keyword entry in the CLI. For example, (ipv6 access-list standard IPv6

filter) represents command entry in the format shown in the syntax:

[<sequence-number>] {deny|permit}

{<source-ipv6-address/prefix-length>|any}

NOTE: Software ACLs will deny access unless explicitly permitted by an ACL action.

Sub-modes Many of the ACL commands operate from sub-modes that are specific to particular

ACL types. The following table shows the CLI prompts at which ACL commands are

entered.

C613-50292-01 Rev A Command Reference for IE210L Series 1018

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

Command List •“ipv6 access-list standard (named)” on page 1019

•“(ipv6 access-list standard filter)” on page 1021

•“show ipv6 access-list (IPv6 Software ACLs)” on page 1023

•“vty ipv6 access-class (named)” on page 1024

Table 31-1: IPv6 Software Access List Commands and Prompts

Command Name Command Mode Prompt

show ipv6 access-list (IPv6 Software

ACLs)

Privileged Exec awplus#

ipv6 access-list standard (named) Global Configuration awplus(config)#

(ipv6 access-list standard filter) IPv6 Standard ACL

Configuration awplus(config-ipv6-std-acl)#

C613-50292-01 Rev A Command Reference for IE210L Series 1019

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

IPV6 ACCESS-LIST STANDARD (NAMED)

ipv6 access-list standard (named)

Overview This command configures an IPv6 standard access-list for filtering frames that

permit or deny IPv6 packets from a specific source IPv6 address.

The no variant of this command removes a specified IPv6 standard access-list.

Syntax

[list-name] ipv6 access-list standard <ipv6-acl-list-name>

no ipv6 access-list standard <ipv6-acl-list-name>

Syntax [deny|

permit] ipv6 access-list standard <ipv6-acl-list-name> [{deny|permit}

{<ipv6-source-address/prefix-length>|any} [exact-match]]

no ipv6 access-list standard <ipv6-acl-list-name>

[{deny|permit} {<ipv6-source-address/prefix-length>|any}

[exact-match]]

Mode Global Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Usage Use IPv6 standard access-lists to control the transmission of IPv6 packets on an

interface, and restrict the content of routing updates. The switch stops checking

the IPv6 standard access-list when a match is encountered.

Parameter Description

<ipv6-acl-list-name> A user-defined name for the IPv6 software standard

access-list.

Parameter Description

<ipv6-acl-list-name> A user-defined name for the IPv6 software standard

access-list.

deny The IPv6 software standard access-list rejects

packets that match the type, source, and destination

filtering specified with this command.

permit The IPv6 software standard access-list permits

packets that match the type, source, and destination

filtering specified with this command.

<ipv6-source-address/

prefix-length> Specifies a source address and prefix length.

The IPv6 address prefix uses the format

X:X::/prefix-length. The prefix-length is usually set

between 0 and 64.

any Matches any source IPv6 address.

exact-match Exact match of the prefixes.

C613-50292-01 Rev A Command Reference for IE210L Series 1020

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

IPV6 ACCESS-LIST STANDARD (NAMED)

For backwards compatibility you can either create IPv6 standard access-lists from

within this command, or you can enter ipv6 access-list standard

followed by only the IPv6 standard access-list name. This latter (and preferred)

method moves you to the (config-ipv6-std-acl) prompt for the selected

IPv6 standard access-list, and from here you can configure the filters for this

selected IPv6 standard access-list.

NOTE: Software ACLs will deny access unless explicitly permitted by an ACL action.

Example To enter the IPv6 Standard ACL Configuration mode for the access-list named

my-list, use the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list standard my-list

awplus(config-ipv6-std-acl)#

Commands

(ipv6 access-list standard filter)

show ipv6 access-list (IPv6 Software ACLs)

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1021

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(IPV6 ACCESS-LIST STANDARD FILTER)

(ipv6 access-list standard filter)

Overview Use this ACL filter to add a filter entry for an IPv6 source address and prefix length

to the current standard IPv6 access-list. If a sequence number is specified, the new

entry is inserted at the specified location. Otherwise, the new entry is added at the

end of the access-list.

The no variant of this command removes a filter entry for an IPv6 source address

and prefix from the current standard IPv6 access-list. You can specify the filter

entry for removal by entering either its sequence number, or its filter entry profile.

Syntax [icmp] [<sequence-number>] {deny|permit}

{<ipv6-source-address/prefix-length>|any}

no {deny|permit} {<ipv6-source-address/prefix-length>|any}

no <sequence-number>

Mode IPv6 Standard ACL Configuration

Default Any traffic controlled by a software ACL that does not explicitly match a filter is

denied.

Usage The filter entry will match on any IPv6 packet that has the specified IPv6 source

address and prefix length. The parameter any may be specified if an address does

not matter.

NOTE: Software ACLs will deny access unless explicitly permitted by an ACL action.

Examples To add an ACL filter entry with sequence number 5 that will deny any IPv6 packets

to the standard IPv6 access-list named my-list, enter the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list standard my-list

awplus(config-ipv6-std-acl)# 5 deny any

Parameter Description

<sequence-number><1-65535>

The sequence number for the filter entry of the selected

access control list.

deny Specifies the packets to reject.

permit Specifies the packets to accept.

<ipv6-source-

address/prefix-

length>

IPv6 source address and prefix-length in the form X:X::X:X/P.

any Any IPv6 source host address.

C613-50292-01 Rev A Command Reference for IE210L Series 1022

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

(IPV6 ACCESS-LIST STANDARD FILTER)

To remove the ACL filter entry that will deny any IPv6 packets from the standard

IPv6 access-list named my-list, enter the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list standard my-list

awplus(config-ipv6-std-acl)# no deny any

Alternately, to remove the ACL filter entry with sequence number 5 to the

standard IPv6 access-list named my-list, enter the commands:

awplus# configure terminal

awplus(config)# ipv6 access-list standard my-list

awplus(config-ipv6-std-acl)# no 5

Commands

ipv6 access-list standard (named)

show ipv6 access-list (IPv6 Software ACLs)

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1023

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

SHOW IPV6 ACCESS-LIST (IPV6 SOFTWARE ACLS)

show ipv6 access-list (IPv6 Software ACLs)

Overview Use this command to display all configured IPv6 access-lists or the IPv6 access-list

specified by name.

Syntax show ipv6 access-list [<access-list-name>]

show ipv6 access-list standard [<access-list-name>]

Mode User Exec and Privileged Exec

Example To show all configured IPv6 access-lists, use the following command:

awplus# show ipv6 access-list

Output Figure 31-1: Example output from show ipv6 access-list

Example To show the IPv6 access-list named deny_icmp, use the following command:

awplus# show ipv6 access-list deny_icmp

Output Figure 31-2: Example output from show ipv6 access-list for a named ACL

Commands

ipv6 access-list standard (named)

(ipv6 access-list standard filter)

Parameter Description

<access-list-name>Only display information about an IPv6 access-list with

the specified name.

standard Only display information about standard access-lists.



IPv6 access-list deny_icmp

deny icmp any any vlan 1



IPv6 access-list deny_ssh

deny tcp abcd::0/64 any eq 22



IPv6 access-list deny_icmp

deny icmp any any vlan 1

C613-50292-01 Rev A Command Reference for IE210L Series 1024

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

IPV6 SOFTWARE ACCESS CONTROL LIST (ACL) COMMANDS

VTY IPV6 ACCESS-CLASS (NAMED)

vty ipv6 access-class (named)

Overview For IPv6, use this command to set a standard named software access list to be the

management ACL. This is then applied to all available VTY lines for controlling

remote access by Telnet and SSH. This command allows or denies packets

containing the IPv6 addresses included in the ACL to create a connection to your

device.

ACLs that are attached using this command have an implicit ‘deny-all’ filter as the

final entry in the ACL. A typical configuration is to permit a specific address, or

range of addresses, and rely on the ‘deny-all’ filter to block all other access.

Use the no variant of this command to remove the access list.

Syntax vty ipv6 access-class <access-name>

no vty ipv6 access-class [<access-name>]

Mode Global Configuration

Examples To set the named standard access-list named access-ctrl to be the IPv6

management ACL, use the following commands:

awplus# configure terminal

awplus(config)# vty ipv6 access-class access-ctrl

To remove access-ctrl from the management ACL, use the following commands:

awplus# configure terminal

awplus(config)# no vty ipv6 access-class access-ctrl

Output Figure 31-3: Example output from the show running-config command

Commands

show running-config

vty access-class (numbered)

Parameter Description

<access-name> Specify an IPv6 standard software access-list name

awplus#showrunning-config|grep access-class



vty ipv6 access-class access-ctrl

C613-50292-01 Rev A Command Reference for IE210L Series 1025

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QoS Commands

Introduction

Overview This chapter provides an alphabetical reference for Quality of Service commands.

QoS uses ACLs. For more information about ACLs, see the ACL Feature Overview

and Configuration Guide.

Command List •“class” on page 1027

•“class-map” on page 1028

•“clear mls qos interface policer-counters” on page 1029

•“default-action” on page 1030

•“description (QoS policy-map)” on page 1031

•“egress-rate-limit” on page 1032

•“match access-group” on page 1033

•“match cos” on page 1035

•“match dscp” on page 1036

•“match eth-format protocol” on page 1037

•“match inner-cos” on page 1040

•“match inner-vlan” on page 1041

•“match ip-precedence” on page 1042

•“match mac-type” on page 1043

•“match tcp-flags” on page 1044

•“match vlan” on page 1045

•“mls qos cos” on page 1046

•“mls qos enable” on page 1047

•“mls qos map cos-queue” on page 1048

C613-50292-01 Rev A Command Reference for IE210L Series 1026

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

•“mls qos map premark-dscp” on page 1049

•“no police” on page 1051

•“police single-rate action” on page 1052

•“police twin-rate action” on page 1054

•“policy-map” on page 1056

•“priority-queue” on page 1057

•“remark-map” on page 1058

•“remark new-cos” on page 1060

•“service-policy input” on page 1062

•“show class-map” on page 1063

•“show mls qos” on page 1064

•“show mls qos interface” on page 1065

•“show mls qos interface policer-counters” on page 1068

•“show mls qos interface queue-counters” on page 1069

•“show mls qos interface storm-status” on page 1070

•“show mls qos maps cos-queue” on page 1071

•“show mls qos maps premark-dscp” on page 1072

•“show platform classifier statistics utilization brief” on page 1073

•“show policy-map” on page 1076

•“storm-action” on page 1077

•“storm-downtime” on page 1078

•“storm-protection” on page 1079

•“storm-rate” on page 1080

•“storm-window” on page 1081

•“trust dscp” on page 1082

•“wrr-queue disable queues” on page 1083

•“wrr-queue egress-rate-limit queues” on page 1084

•“wrr-queue weight queues” on page 1085

C613-50292-01 Rev A Command Reference for IE210L Series 1027

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

CLASS

class

Overview Use this command to associate an existing class-map to a policy or policy-map

(traffic classification), and to enter Policy Map Class Configuration mode to

configure the class- map.

Use the no variant of this command to delete an existing class-map.

If your class-map does not exist, you can create it by using the class-map

command.

Syntax class {<name>|default}

no class <name>

Mode Policy Map Configuration

Example The following example creates the policy-map pmap1(using the policy-map

command), then associates this to an already existing class-map named cmap1,

use the commands:

awplus# configure terminal

awplus(config)# policy-map pmap1

awplus(config-pmap)# class cmap1

awplus(config-pmap-c)#

Commands

class-map

policy-map

Parameter Description

<name>Name of the (already existing) class-map.

default Specify the default class-map.

C613-50292-01 Rev A Command Reference for IE210L Series 1028

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

CLASS-MAP

class-map

Overview Use this command to create a class-map.

Use the no variant of this command to delete the named class-map.

Syntax class-map <name>

no class-map <name>

Mode Global Configuration

Example This example creates a class-map called cmap1, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)#

Parameter Description

<name>Name of the class-map to be created.

C613-50292-01 Rev A Command Reference for IE210L Series 1029

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

CLEAR MLS QOS INTERFACE POLICER-COUNTERS

clear mls qos interface policer-counters

Overview Resets an interface’s policer counters to zero. You can either clear a specific

class-map, or you can clear all class-maps by not specifying a class map.

Syntax clear mls qos interface <port> policer-counters [class-map

<class-map>]

Mode Privileged Exec

Example To reset the policy counters to zero for all class-maps for port1.0.4, use the

command:

awplus# clear mls qos interface port1.0.4 policer-counters

Commands

show mls qos interface policer-counters

Parameter Description

<port>The port may be a switch port (e.g. port1.0.4), a static channel

group (e.g. sa3), or a dynamic (LACP) channel group (e.g. po4).

class-map Select a class-map.

<class-map>Class-map name.

C613-50292-01 Rev A Command Reference for IE210L Series 1030

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

DEFAULT-ACTION

default-action

Overview Sets the action for the default class-map belonging to a particular policy-map. The

action for a non-default class-map depends on the action of any ACL that is applied

to the policy-map.

The default action can therefore be thought of as specifying the action that will be

applied to any data that does not meet the criteria specified by the applied

matching commands.

Use the no variant of this command to reset to the default action of ‘permit’.

Syntax default-action <action>

no default-action

Default The default is permit.

Mode Policy Map Configuration

Examples To set the action for the default class-map to deny, use the command:

awplus(config-pmap)# default-action deny

To set the action for the default class-map to copy-to-mirror for use with the mirror

interface command, use the command:

awplus(config-pmap)# default-action copy-to-mirror

Commands

mirror interface

Parameter Description

<action>permit Packets to permit.

deny Packets to deny.

send-to-cpu Specify packets to send to the CPU.

copy-to-cpu Specify packets to copy to the CPU.

copy-to-mirror Specify packets to copy to the mirror port.

send-to-mirror Specify packets to send to the mirror port.

send-to-vlan-port

vlan <vid> port

<port-number>

Send matching packets to the specified

port, tagged with the specified VLAN. The

specified port must belong to the specified

VLAN.

C613-50292-01 Rev A Command Reference for IE210L Series 1031

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

DESCRIPTION (QOS POLICY-MAP)

description (QoS policy-map)

Overview Adds a textual description of the policy-map. This can be up to 80 characters long.

Use the no variant of this command to remove the current description from the

policy-map.

Syntax description <line>

no description

Mode Policy Map Configuration

Example To add the description, VOIP traffic, use the command:

awplus(config-pmap)# description VOIP traffic

Parameter Description

<line>Up to 80 character long line description.

C613-50292-01 Rev A Command Reference for IE210L Series 1032

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

EGRESS-RATE-LIMIT

egress-rate-limit

Overview Use this command to limit the amount of traffic that can be transmitted per second

from this port.

Use the no variant of this command to disable the limiting of traffic egressing on

the interface.

Syntax egress-rate-limit <rate-limit>

no egress-rate-limit

Mode Interface Configuration

Examples To enable egress rate limiting on a port, with a limit of approximately 500Mbps, use

the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# egress-rate-limit 500m

To disable egress rate limiting on a port, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no egress-rate-limit

Parameter Description

<rate-limit>Bandwidth <1-10000000 units per second> (usable units: k, m, g).

The egress rate limit can be configured in multiples of 64kbps. If

you configure a value that is not an exact multiple of 64kbps, then

the value will be rounded up to the nearest higher exact multiple

of 64kbps. The minimum is 64 Kb.

The default unit is Kb (k), but Mb (m) or Gb (g) can also be

specified. The command syntax is not case sensitive, so a value

such as 20m or 20M will be interpreted as 20 megabits.

C613-50292-01 Rev A Command Reference for IE210L Series 1033

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH ACCESS-GROUP

match access-group

Overview Use this command to apply an ACL to a class-map or VLAN.

Use the no variant of this command to remove the match.

Syntax match access-group {<hw-IP-ACL>|<hw-MAC-ACL>|<hw-named-ACL>}

no match access-group

{<hw-IP-ACL>|<hw-MAC-ACL>|<hw-named-ACL>}

Mode Class Map or VLAN Access-Map

Usage First create an access-list that applies the appropriate action to matching packets.

Then use the match access-group command to apply this access-list as desired.

Note that this command will apply the access-list matching only to incoming data

packets.

Examples To configure a class-map named “cmap1”, which matches traffic against access-list

3001, which allows IP traffic from any source to any destination, use the

commands:

awplus# configure terminal

awplus(config)# access-list 3001 permit ip any any

awplus(config)# class-map cmap1

awplus(config-cmap)# match access-group 3001

To configure a class-map named “cmap2”, which matches traffic against access-list

4001, which allows MAC traffic from any source to any destination, use the

commands:

awplus# configure terminal

awplus(config)# access-list 4001 permit any any

awplus(config)# class-map cmap2

awplus(config-cmap)# match access-group 4001

Parameter Description

<hw-IP-ACL>Specify a hardware IP ACL number in the range <3000-3699>.

<hw-MAC-ACL>Specify a hardware MAC ACL number in the range <4000-4699>.

<hw-named-ACL>Specify a hardware named ACL (IP, IPv6 or MAC address entries).

C613-50292-01 Rev A Command Reference for IE210L Series 1034

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH ACCESS-GROUP

To configure a class-map named “cmap3”, which matches traffic against access-list

“hw_acl”, which allows IP traffic from any source to any destination, use the

commands:

awplus# configure terminal

awplus(config)# access-list hardware hw_acl

awplus(config-ip-hw-acl)# permit ip any any

awplus(config)# class-map cmap3

awplus(config-cmap)# match access-group hw_acl

To apply ACL 3001 to VLAN 48, where the ACL drops IP traffic from any source to

any destination, use the commands:

awplus# configure terminal

awplus(config)# access-list 3001 deny ip any any

awplus(config)# vlan access-map deny_all

awplus(config-vlan-access-map)# match access-group 3001

awplus(config-vlan-access-map)# exit

awplus(config)# vlan filter deny_all vlan-list 48 input

Commands

class-map

vlan access-map

Command

changes

Version 5.4.6-2.1: support for VLAN access-maps added

C613-50292-01 Rev A Command Reference for IE210L Series 1035

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH COS

match cos

Overview Use this command to define a COS to match against incoming packets.

Use the no variant of this command to remove CoS.

Syntax match cos <0-7>

no match cos

Mode Class Map Configuration

Examples To set the class-map’s CoS to 4, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# match cos 4

To remove CoS from a class-map, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# no match cos

Parameter Description

<0-7>Specify the CoS value.

C613-50292-01 Rev A Command Reference for IE210L Series 1036

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH DSCP

match dscp

Overview Use this command to define the DSCP to match against incoming packets.

Use the no variant of this command to remove a previously defined DSCP.

Syntax match dscp <0-63>

no match dscp

Mode Class Map Configuration

Usage Use the match dscp command to define the match criterion after creating a

class-map.

Examples To configure a class-map named cmap1 with criterion that matches DSCP 56, use

the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# match dscp 56

To remove a previously defined DSCP from a class-map named cmap1, use the

commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# no match dscp

Commands

class-map

Parameter Description

<0-63>Specify DSCP value (only one value can be specified).

C613-50292-01 Rev A Command Reference for IE210L Series 1037

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH ETH-FORMAT PROTOCOL

match eth-format protocol

Overview This command sets the Ethernet format and the protocol for a class-map to match

on.

Select one Layer 2 format and one Layer 3 protocol when you issue this command.

Use the no variant of this command to remove the configured Ethernet format and

protocol from a class-map.

Syntax match eth-format <layer-two-format> protocol

<layer-three-protocol>

no match eth-format protocol

The following eth-formats and protocols are available (note that not all options are

available on all AlliedWare Plus switch models):

Parameter Description

<layer-two-formats>

802dot2-tagged 802.2 Tagged Packets (enter the parameter name).

802dot2-untagged 802.2 Untagged Packets (enter the parameter name).

ethii-tagged EthII Tagged Packets (enter the parameter name).

ethii-untagged EthII Untagged Packets (enter the parameter name).

ethii-any EthII Tagged or Untagged Packets (enter the parameter

name).

netwareraw-

tagged Netware Raw Tagged Packets (enter the parameter

name).

netwareraw-

untagged Netware Raw Untagged Packets (enter the parameter

name).

snap-tagged SNAP Tagged Packets (enter the parameter name).

snap-untagged SNAP Untagged Packets (enter the parameter name).

<layer-three-protocols>

<word> A Valid Protocol Number in hexidecimal.

any Note that the parameter “any” is only valid when used

with the netwarerawtagged and netwarerawuntagged

protocol options.

sna-path-control Protocol Number 04 (enter the parameter name or its

number).

proway-lan Protocol Number 0E (enter the parameter name or its

number).

eia-rs Protocol Number 4E (enter the parameter name or its number).

proway Protocol Number 8E (enter the parameter name or its number).

C613-50292-01 Rev A Command Reference for IE210L Series 1038

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH ETH-FORMAT PROTOCOL

ipx-802dot2 Protocol Number E0 (enter the parameter name or its

number).

netbeui Protocol Number F0 (enter the parameter name or its

number).

iso-clns-is Protocol Number FE (enter the parameter name or its

number).

xdot75-internet Protocol Number 0801(enter the parameter name or its

number).

nbs-internet Protocol Number 0802 (enter the parameter name or its

number).

ecma-internet Protocol Number 0803 (enter the parameter name or its

number).

chaosnet Protocol Number 0804 (enter the parameter name or its

number).

xdot25-level-3 Protocol Number 0805 (enter the parameter name or its

number).

arp Protocol Number 0806 (enter the parameter name or its

number).

xns-compat Protocol Number 0807 (enter the parameter name or its

number).

banyan-systems Protocol Number 0BAD (enter the parameter name or

its number).

bbn-simnet Protocol Number 5208 (enter the parameter name or its

number).

dec-mop-dump-ld Protocol Number 6001 (enter the parameter name or its

number).

dec-mop-rem-

cdons Protocol Number 6002 (enter the parameter name or its

number).

dec-decnet Protocol Number 6003 (enter the parameter name or its

number).

dec-lat Protocol Number 6004 (enter the parameter name or its

number).

dec-diagnostic Protocol Number 6005 (enter the parameter name or its

number).

dec-customer Protocol Number 6006 (enter the parameter name or its

number).

dec-lavc Protocol Number 6007 (enter the parameter name or its

number).

rarp Protocol Number 8035 (enter the parameter name or its

number).

dec-lanbridge Protocol Number 8038 (enter the parameter name or its

number).

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1039

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH ETH-FORMAT PROTOCOL

Mode Class Map Configuration

Examples To set the eth-format to ethii-tagged and the protocol to 0800 (IP) for class-map

cmap1, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# match eth-format ethii-tagged protocol

0800

awplus#

awplus(config-cmap)# match eth-format ethii-tagged protocol ip

To remove the eth-format and the protocol from the class-map cmap1, use the

commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# no match eth-format protocol

dec-encryption Protocol Number 803D (enter the parameter name or

its number).

appletalk Protocol Number 809B (enter the parameter name or its

number).

ibm-sna Protocol Number 80D5 (enter the parameter name or

its number).

appletalk-aarp Protocol Number 80F3 (enter the parameter name or its

number).

snmp Protocol Number 814CV.

ethertalk-2 Protocol Number 809B (enter the parameter name or its

number).

ethertalk-2-aarp Protocol Number 80F3 (enter the parameter name or its

number).

ipx-snap Protocol Number 8137 (enter the parameter name or its

number).

ipx-802dot3 Protocol Number FFFF (enter the parameter name or its

number).

ip Protocol Number 0800 (enter the parameter name or its

number).

ipx Protocol Number 8137 (enter the parameter name or its

number).

ipv6 Protocol Number 86DD (enter the parameter name or

its number).

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1040

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH INNER-COS

match inner-cos

Overview Sets the Inner CoS for a class-map to match on.

Use the no variant of this command to remove CoS.

Syntax match inner-cos <0-7>

no match inner-cos

Mode Class Map Configuration

Examples To set the class-map’s inner-cos to 4, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# match inner-cos 4

To remove CoS from the class-map, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# no match inner-cos

Parameter Description

<0-7>Specify the Inner CoS value.

C613-50292-01 Rev A Command Reference for IE210L Series 1041

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH INNER-VLAN

match inner-vlan

Overview Use this command to define the inner VLAN ID as match criteria.

Use the no variant of this command to disable the VLAN ID used as match criteria.

Syntax match inner-vlan <1-4094>

no match inner-vlan

Mode Class Map Configuration

Usage This command is used in double-tagged networks to match on a VLAN ID

belonging to the client network. For more information on VLAN double-tagged

networks, see the VLAN_Feature Overview and Configuration Guide.

Examples To configure a class-map named cmap1 to match traffic from inner VLAN 3, use the

commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# match inner-vlan 3

To disable the configured VLAN ID as a match criteria for the class-map named

cmap1, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# no match inner-vlan

Parameter Description

<1-4094>The VLAN number.

C613-50292-01 Rev A Command Reference for IE210L Series 1042

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH IP-PRECEDENCE

match ip-precedence

Overview Use this command to identify IP precedence values as match criteria.

Use the no variant of this command to remove IP precedence values from a

class-map.

Syntax match ip-precedence <0-7>

no match ip-precedence

Mode Class Map Configuration

Example To configure a class-map named cmap1 to match all IPv4 packets with a

precedence value of 5, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# match ip-precedence 5

Parameter Description

<0-7>The precedence value to be matched.

C613-50292-01 Rev A Command Reference for IE210L Series 1043

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH MAC-TYPE

match mac-type

Overview Use this command to set the MAC type for a class-map to match on.

Use no variant of this command to remove the MAC type match entry.

Syntax match mac-type {l2bcast|l2mcast|l2ucast}

no match mac-type

Mode Class Map Configuration

Examples To set the class-map’s MAC type to Layer 2 multicast, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# match mac-type l2mcast

To remove the class-map’s MAC type entry, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# no match mac-type

Parameter Description

l2bcast Layer 2 Broadcast traffic.

l2mcast Layer 2 Multicast traffic.

l2ucast Layer 2 Unicast traffic.

C613-50292-01 Rev A Command Reference for IE210L Series 1044

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH TCP-FLAGS

match tcp-flags

Overview Sets one or more TCP flags (control bits) for a class-map to match on.

Use the no variant of this command to remove one or more TCP flags for a

class-map to match on.

Syntax match tcp-flags [ack] [fin] [psh] [rst] [syn] [urg]

no match tcp-flags [ack] [fin] [psh] [rst] [syn] [urg]

Mode Class Map Configuration

Examples To set the class-map’s TCP flags to ack and syn, use the commands:

awplus# configure terminal

awplus(config)# class-map

awplus(config-cmap)# match tcp-flags ack syn

To remove the TCP flags ack and rst, use the commands:

awplus# configure terminal

awplus(config)# class-map

awplus(config-cmap)# no match tcp-flags ack rst

Parameter Description

ack Acknowledge.

fin Finish.

psh Push.

rst Reset.

syn Synchronize.

urg Urgent.

C613-50292-01 Rev A Command Reference for IE210L Series 1045

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MATCH VLAN

match vlan

Overview Use this command to define the VLAN ID as match criteria.

Use the no variant of this command to disable the VLAN ID used as match criteria.

Syntax match vlan <1-4094>

no match vlan

Mode Class Map Configuration

Examples To configure a class-map named cmap1 to include traffic from VLAN 3, use the

commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# match vlan 3

To disable the configured VLAN ID as a match criteria for the class-map named

cmap1, use the commands:

awplus# configure terminal

awplus(config)# class-map cmap1

awplus(config-cmap)# no match vlan

Parameter Description

<1-4094>The VLAN number.

C613-50292-01 Rev A Command Reference for IE210L Series 1046

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MLS QOS COS

mls qos cos

Overview This command assigns a CoS (Class of Service) user-priority value to untagged

frames entering a specified interface. By default, all untagged frames are assigned

a CoS value of 0.

Use the no variant of this command to return the interface to the default CoS

setting for untagged frames entering the interface.

Syntax mls qos cos <0-7>

no mls qos cos

Default By default, all untagged frames are assigned a CoS value of 0. Note that for tagged

frames, the default behavior is not to alter the CoS value.

Mode Interface Configuration

Example To assign a CoS user priority value of 2 to all untagged packets entering port1.0.1

to port1.0.4, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1-port1.0.4

awplus(config-if)# mls qos cos 2

Parameter Description

<0-7>The Class of Service, user-priority value.

C613-50292-01 Rev A Command Reference for IE210L Series 1047

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MLS QOS ENABLE

mls qos enable

Overview Use this command to enable QoS.

Use the no variant of this command to globally disable QoS and remove all QoS

configuration. The no variant of this command removes all class-maps,

policy-maps, and policers that have been created. Running the no mls qos

command will therefore remove all pre-existing QoS configurations on the switch.

Mode Global Configuration

Syntax mls qos enable

no mls qos

Example To enable QoS on the switch, use the commands:

awplus# configure terminal

awplus(config)# mls qos enable

C613-50292-01 Rev A Command Reference for IE210L Series 1048

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MLS QOS MAP COS-QUEUE

mls qos map cos-queue

Overview Use this command to set the default CoS to egress queue mapping. This is the

default queue mapping for packets that do not get assigned an egress queue via

any other QoS functionality.

Use the no variant of this command to reset the cos-queue map back to its default

setting. The default mappings for this command are:

Syntax mls qos map cos-queue <cos-priority> to <queue-number>

no mls qos map cos-queue

Mode Global Configuration

Examples To map CoS 2 to queue 0, use the command:

awplus# configure terminal

awplus(config)# mls qos map cos-queue 2 to 0

To set the cos-queue map back to its defaults, use the command:

awplus# configure terminal

awplus(config)# no mls qos map cos-queue

Commands

show mls qos interface

CoS Priority : 0 1 2 3 4 5 6 7

-----------------------------------

CoS QUEUE: 2 0 1 3 4 5 6 7

Parameter Description

<cos-priority>CoS priority value. Can take a value between 0 and 7.

<queue-number>Queue number. Can take a value between 0 and 7.

C613-50292-01 Rev A Command Reference for IE210L Series 1049

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MLS QOS MAP PREMARK-DSCP

mls qos map premark-dscp

Overview This command configures the premark-dscp map. It is used when traffic is

classified by a class-map that has trust dscp configured. Based on a lookup DSCP,

the map determines new QoS settings for the traffic.

The no variant of this command resets the premark-dscp map to its defaults. If no

DSCP is specified then all DSCP entries will be reset to their defaults.

Syntax mls qos map premark-dscp <0-63> to 

{[new-dscp <0-63>][new-cos <0-7>] 

[new-bandwidth-class {green|yellow|red}]}

no mls qos map premark-dscp [<0-63>]

Mode Global Configuration

Usage With the trust dscp command set, this command (mls qos map premark-dscp)

enables you to remap the DSCP, CoS, output queue, or bandwidth class values.

However, note that you cannot simultaneously change the DSCP and CoS, because

they use the same byte in the IP header.

Example To set the entry for DSCP 1 to use a new DSCP of 2, use the command:

awplus# configure terminal

awplus(config)# mls qos map premark-dscp 1 to new-dscp 2

Parameter Description

premark-dscp <0-63>The DSCP value on ingress.

new-dscp <0-63>The DSCP value that the packet will have on egress.

If unspecified, this value will remain the DSCP ingress

value.

new-cos <0-7>The CoS value that the packet will have on egress.

If unspecified, this value will retain its value on ingress.

new-bandwidth-class Modify Egress Bandwidth-class.

If unspecified, this value will be set to green.

green Egress Bandwidth-class green (marked down

Bandwidth-class).

yellow Egress Bandwidth-class yellow (marked down

Bandwidth-class).

red Egress Bandwidth-class red (marked down Bandwidth-

class).

C613-50292-01 Rev A Command Reference for IE210L Series 1050

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

MLS QOS MAP PREMARK-DSCP

Example To set the entry for DSCP 1 to use a new CoS of 3, and a new bandwidth class of

yellow, use the command:

awplus# configure terminal

awplus(config)# mls qos map premark-dscp 1 to new-cos 3

new-bandwidth-class yellow

Example To reset the entry for DSCP 1 use the command:

awplus# configure terminal

awplus(config)# no mls qos map premark-dscp 1

Commands

show mls qos maps premark-dscp

trust dscp

C613-50292-01 Rev A Command Reference for IE210L Series 1051

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

NO POLICE

no police

Overview Use this command to disable any policer previously configured on the class-map.

Syntax no police

Mode Policy Map Class Configuration

Usage This command disables any policer previously configured on the class-map.

Example To disable policing on a class-map, use the commands:

awplus# configure terminal

awplus(config)# policy-map name

awplus(config-pmap)# class classname

awplus(config-pmap-c)# no police

Commands

police single-rate action

police twin-rate action

C613-50292-01 Rev A Command Reference for IE210L Series 1052

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

POLICE SINGLE-RATE ACTION

police single-rate action

Overview Configures a single-rate policer for a class-map.

Syntax police single-rate <cir> <cbs> <ebs> action

{drop-red|remark-transmit}

Mode Policy Map Class Configuration

Usage You can use a policer to meter the traffic classified by the class-map and assign it

to one of three bandwidth classes.

The bandwidth classes are green (conforming), yellow (partially-conforming), and

red (non-conforming). A single-rate policer is based on three values. These are the

average rate, minimum burst and maximum burst.

Using an action of drop-red means that any packets classed as red are discarded.

NOTE: This command will not take effect when applied to a class-map that attaches to

a channel group whose ports span processor instances.

Note that the remark-map does not only apply to red traffic. If a remark-map is

configured on the same class-map as the policer, then the remark-map will apply

to green- colored and yellow-colored traffic irrespective of the value configured on

the action parameter of the policer. So, even if action is configured to drop-red,

the remark-map will be applied to green and yellow traffic. So, the action

parameter only applies to red- colored traffic. If action is set to drop-red, then red

Parameter Description

<cir>Specify the Committed Information Rate (CIR) (1-100000000 kbps).

<cbs>Specify the Committed Burst Size (CBS) (0-16777216 bytes).

<ebs>Specify a Excess Burst Size (EBS) (0-16777216 bytes).

action Specify the action if the rate is exceeded.

drop-red Drop the red packets.

remark-transmit Modify the packets using the remark map,

then transmit. You can configure the remark

map using the remark-map command.

Color Definition

green The traffic rate is less than the average rate and minimum burst.

yellow The traffic rate is between the minimum burst and the maximum

burst.

red The traffic rate exceeds the average rate and the maximum burst.

C613-50292-01 Rev A Command Reference for IE210L Series 1053

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

POLICE SINGLE-RATE ACTION

traffic is dropped; if action is set to remark-transmit, then the red traffic has the

action of the remark map applied to it, and is then transmitted.

Example To configure a single rate meter measuring traffic of 100 Mbps that drops a

sustained burst of traffic over this rate, use the commands:

awplus# configure terminal

awplus(config)# policy-map name

awplus(config-pmap)# class classname

awplus(config-pmap-c)# police single-rate 100000 1875000

1875000 action drop-red

Commands

no police

police twin-rate action

remark-map

C613-50292-01 Rev A Command Reference for IE210L Series 1054

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

POLICE TWIN-RATE ACTION

police twin-rate action

Overview Configures a twin-rate policer for a class-map.

Syntax police twin-rate <cir> <pir> <cbs> <pbs> action

{drop-red|remark-transmit}

Mode Policy Map Class Configuration

Usage A policer can be used to meter the traffic classified by the class-map and as a result

will be given one of three bandwidth classes. These are green (conforming), yellow

(partially- conforming), and red (non-conforming).

A twin-rate policer is based on four values. These are the minimum rate (CIR),

minimum burst size (CBS), maximum rate (PIR), and maximum burst size (PBS). The

following table shows how these values define the bandwidth classes.

Using an action of drop-red means that any packets classed as red will be

discarded.

Parameter Description

<cir>Specify the Committed Information Rate (CIR) (1-100000000 kbps).

<pir>Specify the Peak Information Rate (PIR) (1-100000000 kbps).

<cbs>Specify the Committed Burst Size (CBS) (0-16777216 bytes).

<pbs>Specify the Peak Burst Size (PBS) (0-16777216 bytes).

action Specify the action if rate is exceeded.

drop-red Drop the red packets.

remark-transmit Modify the packets using the remark map, then

transmit. You can configure the remark map

using the remark-map command.

Bandwidth

Class Definition

green The sum of the number of existing (buffered) bytes plus those arriving

at the port per unit time results in a value that is less than that set for

the CBS.

yellow The sum of the number of existing (buffered) bytes plus those arriving

at the port per unit time results in a value that is between those set for

the CBS and the PBS.

red The sum of the number of existing (buffered) bytes plus those arriving

at the port per unit time results in a value that exceeds that set for the

PBS.

C613-50292-01 Rev A Command Reference for IE210L Series 1055

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

POLICE TWIN-RATE ACTION

Using an action of remark-transmit means that the packet will be remarked with

the values configured in the policed-dscp map. The index into this map is

determined by the DSCP in the packet.

Note that the remark-map does not only apply to red traffic. If a remark-map is

configured on the same class-map as the policer, then the remark-map will apply

to green- colored and yellow-colored traffic irrespective of the value configured on

the action parameter of the policer. So, even if action is configured to drop-red,

the remark-map will be applied to green and yellow traffic. So, the action

parameter only applies to red-colored traffic. If action is set to drop-red, then red

traffic is dropped; if action is set to remark-transmit, then the red traffic has the

action of the remark map applied to it, and is then transmitted.

Example To configure a twin rate meter measuring a minimum rate of 10 Mbps and a

maximum rate of 20 Mbps, and drop red packets, use the commands:

awplus# configure terminal

awplus(config)# policy-map name

awplus(config-pmap)# class classname

awplus(config-pmap-c)# police twin-rate 10000 20000 1875000

3750000 action drop-red

To configure a twin rate meter measuring a minimum rate of 10 Mbps and a

maximum rate of 20 Mbps that uses the premark map to remark any

non-conforming traffic, use the commands:

awplus# configure terminal

awplus(config)# policy-map name

awplus(config-pmap)# class classname

awplus(config-pmap-c)# police twin-rate 10000 20000 1875000

3750000 action remark-transmit

Commands

no police

police single-rate action

C613-50292-01 Rev A Command Reference for IE210L Series 1056

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

POLICY-MAP

policy-map

Overview Use this command to create a policy-map and to enter Policy Map Configuration

mode to configure the specified policy-map.

Use the no variant of this command to delete an existing policy-map.

Syntax policy-map <name>

no policy-map <name>

Mode Global Configuration

Example To create a policy-map called pmap1, use the commands:

awplus# configure terminal

awplus(config)# policy-map pmap1

awplus(config-pmap)#

Commands

class-map

Parameter Description

<name>Name of the policy-map.

C613-50292-01 Rev A Command Reference for IE210L Series 1057

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

PRIORITY-QUEUE

priority-queue

Overview This command configures strict priority-based scheduling on the specified egress

queues. You must specify at least one queue.

Syntax priority-queue [0][1][2][3][4][5][6][7]

Mode Interface Configuration.

Usage By default, the queues on all ports are set for priority queuing. You can change the

queue emptying sequence to weighted round robin, by using the wrr-queue

weight queues command. You can then use the priority-queue command to reset

the selected queues to priority queuing.

Note that the emptying sequence for priority queuing is always highest queue

number to lowest queue number.

Example To apply priority-based scheduling to egress queues 1 and 2, use the commands:

awplus#configure terminal

awplus(config)#interface port1.0.1

awplus(config-if)#priority-queue 1 2

Commands

show mls qos interface

show mls qos interface queue-counters

wrr-queue weight queues

Parameter Description

[0][1]...[7] Specify the queues that will use strict priority scheduling. With

strict priority scheduling, the switch will completely empty the

highest numbered queue first, then start processing the next

lowest numbered queue.

C613-50292-01 Rev A Command Reference for IE210L Series 1058

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

REMARK-MAP

remark-map

Overview Use this command to configure the remark map. If a re-mark map is applied to a

class, and a policer is also applied to the same class, then:

• green and yellow traffic will all be acted upon by the remark-map, and

• red traffic will be either dropped or acted upon by the remark-map,

depending on whether the policer action is set to drop-red or

remark-transmit.

The no variant of this command resets the remark map to its defaults. Specifying

the bandwidth class is optional. If no bandwidth class is specified, then all

bandwidth classes are reset to their defaults.

Syntax remark-map [bandwidth-class {green|yellow|red}] to {[new-dscp

<0-63>] [new-bandwidth-class {green|yellow|red}]}

no remark-map [bandwidth-class {green|yellow|red}] to

{[new-dscp <0-63>] [new-bandwidth-class {green|yellow|red}]}

Mode Policy Map Class Configuration

Examples To remark the policed green traffic to a new DSCP of 2 and a new bandwidth class

of yellow, use the commands:

awplus# configure terminal

awplus(config)# policy-map pmap1

awplus(config-pmap)# class cmap1

awplus(config-pmap-c)# remark-map bandwidth-class green to

new-dscp 2 new-bandwidth-class yellow

Parameter Description

bandwidth-class Specify the bandwidth class of packets to remark.

green Remark green packets.

yellow Remark yellow packets.

red Remark red packets.

new-dscp Specify the new DSCP value.

<0-63>The DSCP value.

new-bandwidth-class Specify the new bandwidth class.

green Remark the packet green.

yellow Remark the packet yellow.

red Remark the packet red.

C613-50292-01 Rev A Command Reference for IE210L Series 1059

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

REMARK-MAP

To remark the policed green traffic to a new DSCP of 2, use the commands:

awplus# configure terminal

awplus(config)# policy-map pmap1

awplus(config-pmap)# class cmap1

awplus(config-pmap-c)# remark-map bandwidth-class green to

new-dscp 2

To reset the DSCP for all bandwidth classes, use the commands:

awplus# configure terminal

awplus(config)# policy-map pmap1

awplus(config-pmap)# class cmap1

awplus(config-pmap-c)# no remark-map to new-dscp

Commands

police single-rate action

police twin-rate action

C613-50292-01 Rev A Command Reference for IE210L Series 1060

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

REMARK NEW-COS

remark new-cos

Overview This command enables you to configure and remark either or both of:

• the CoS flag in the data packet

• the input into the CoS to queue map, thus changing the destination egress

queue.

Syntax remark new-cos <0-7> [internal|external|both]

no remark new-cos [internal|external|both]

Mode Policy Map Class Configuration

Usage The default CoS to Queue mappings are shown in the following table:

The relationship between this command and the CoS to queue map is shown in

the following figure.

Parameter Description

<0-7>The new value for the CoS flag and/or the input into the CoS to queue

map.

external Remarks the CoS flag in the packet.

internal Remarks the new-CoS input into the CoS to queue map.

both Remarks (with the same value) both the CoS flag in the packet and the

input to the CoS to queue map.

CoS Value 01234567

Egress Queue No 20134567

C613-50292-01 Rev A Command Reference for IE210L Series 1061

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

REMARK NEW-COS

Figure 32-1: Remarking and the CoS to Q map

Example For policy-map “pmap3” and class-map “cmap1”, set the CoS value to 2 and also set

the input to the CoS to queue map so that the traffic is assigned to egress queue 1:

awplus# configure terminal

awplus(config)# policy-map pmap3

awplus(config-pmap)# class cmap1

awplus(config-pmap-c)# remark new-cos 2 both

Commands

mls qos map cos-queue

show mls qos maps cos-queue

4HEABOVEMAPPINGISSETBYTHECOMMAND MLSQOSMAPCOSQUEUETOANDDISPLAYEDBYTHECOMMAND

SHOWMLSQOSMAPSCOSQUEUE7ITHTHE REMARKNEWCOSCOMMANDUNSETORSETTOEXTERNALTHEQUEUEMAPPING

TAKESITSINPUTFROMTHE%XISTING#O3VALUE7ITHTHE REMARKNEWCOSCOMMANDSETTOINTERNALORBOTHTHE

QUEUEMAPPINGTAKESITSINPUTFROMTHEVALUESETBYTHECOMMAND REMARKNEWCOS.OTETHATALTHOUGHTHE

#O3TO1UEUEMAPAPPLIESTOTHEWHOLESWITCHTHEREMARKNEWCOSCOMMANDAPPLIESPERINDIVIDUALCLASSMAP

%XISTING#O3VALUE

.EW#O3INTERNAL

%GRESSQUEUE

VALUE

#O36ALUE

%GRESS1UEUE



 

1O3??1?-AP?"

#OSTO1UEUE

-APPING

2EMARKNEWCOSEXTERNAL

#O3&LAGIN0ACKET

2EMARKNEWCOSBOTH

2EMARKNEWCOSINTERNAL

Table 32-1: CoS to egress queue remarking function

Input Command Output

CoS field = 1 Remark new-cos (not

configured)

CoS value = 1

Packet sent to egress queue 0

CoS field = 1 Remark new-cos 2 external CoS value = 2

Packet sent to egress queue 0

CoS set to 1 Remark new-cos 2 internal CoS value = 1

Packet sent to egress queue 1

CoS set to 1 Remark new-cos 2 both CoS value = 2

Packet sent to egress queue 1

Note: This table assumes that the CoS to Queue map is set to its default values.

C613-50292-01 Rev A Command Reference for IE210L Series 1062

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SERVICE-POLICY INPUT

service-policy input

Overview Use this command to apply a policy-map to the input of an interface.

Use the no variant of this command to remove a policy-map and interface

association.

Syntax service-policy input <policy-map>

no service-policy input <policy-map>

Mode Interface Configuration

Usage This command can be applied to switch ports or static channel groups, but not to

dynamic (LACP) channel groups.

Example To apply a policy-map named pmap1 to interface port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

wplus(config-if)# service-policy input pmap1

Parameter Description

<policy-map>Policy map name that will be applied to the input.

C613-50292-01 Rev A Command Reference for IE210L Series 1063

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW CLASS-MAP

show class-map

Overview Use this command to display the QoS class-maps’ criteria for classifying traffic.

Syntax show class-map [<class-map-name>]

Mode User Exec and Privileged Exec

Example To display a QoS class-map’s match criteria for classifying traffic, use the command:

awplus# show class-map cmap1

Output Figure 32-2: Example output from the show class-map command

Commands

class-map

Parameter Description

<class-map-name> Name of the class-map.

awplus#show class-map



CLASS-MAP-NAME: myClass

Match Mac Type: 2 l2mcast



CLASS-MAP-NAME: default

C613-50292-01 Rev A Command Reference for IE210L Series 1064

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW MLS QOS

show mls qos

Overview Use this command to display whether QoS is enabled or disabled on the switch.

Syntax show mls qos

Mode User Exec and Privileged Exec

Example To display whether QoS is enabled or disabled, use the command:

awplus# show mls qos

Output Figure 32-3: Example output from the show mls qos command

Commands

mls qos enable

awplus#show mls qos

Enable

C613-50292-01 Rev A Command Reference for IE210L Series 1065

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW MLS QOS INTERFACE

show mls qos interface

Overview Displays the current settings for the interface. This includes its default CoS and

queue, scheduling used for each queue, and any policies/maps that are attached.

Syntax show mls qos interface [<port>]

Mode User Exec and Privileged Exec

Example To display current CoS and queue settings for interface port1.0.1, use the

command:

awplus# show mls qos interface port1.0.1

Output Figure 32-4: Example output from the show mls qos interfacecommand for

port1.0.1

Parameter Description

<port>Switch port.

awplus#show mls qos interface port1.0.1



Interface: port1.0.1



Number of egress queues: 8



Egress Queue: 0

Status: Enabled

Scheduler: Strict Priority

Queue Limit: 12%

Egress Rate Limit: 0 Kb



Egress Queue: 1

Status: Enabled

Scheduler: Strict Priority

Queue Limit: 12%

Egress Rate Limit: 0 Kb

C613-50292-01 Rev A Command Reference for IE210L Series 1066

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW MLS QOS INTERFACE

Egress Queue: 2

Status: Enabled

Scheduler: Strict Priority

Queue Limit: 12%

Egress Rate Limit: 0 Kb

Egress Queue: 3

Status: Enabled

Scheduler: Wrr Group 2

Weight: 10

Queue Limit: 12%

Egress Rate Limit: 0 Kb

Egress Queue: 4

Status: Enabled

Scheduler: Wrr Group 1

Weight: 10

Queue Limit: 12%

Egress Rate Limit: 0 Kb

Egress Queue: 5

Status: Enabled

Scheduler: Strict Priority

Queue Limit: 12%

Egress Rate Limit: 0 Kb

Egress Queue: 6

Status: Enabled

Scheduler: Strict Priority

Queue Limit: 12%

Egress Rate Limit: 0 Kb

Egress Queue: 7

Status: Enabled

Scheduler: Strict Priority

Queue Limit: 12%

Egress Rate Limit: 0 Kb

Trust Mode: Ports default priority 

Port Default Priority: 0 

VLAN Priority Overide: Not Configured 

Egress Traffic Shaping: Not Configured 

The number of COS Values mapped: 8 

Cos (Queue): 0(0), 1(0), 2(0), 3(0), 4(0), 5(0), 6(0), 7(0) 

Dscp (Queue): 0(0), 1(0), 2(0), 3(0), 4(0), 5(0), 6(0), 7(0) 

Dscp (Queue): 8(0), 9(0), 10(0), 11(0), 12(0), 13(0), 14(0), 15(0) 

Dscp (Queue): 16(0), 17(0), 18(0), 19(0), 20(0), 21(0), 22(0), 23(0) 

Dscp (Queue): 24(0), 25(0), 26(0), 27(0), 28(0), 29(0), 30(0), 31(0) 

Dscp (Queue): 32(0), 33(0), 34(0), 35(0), 36(0), 37(0), 38(0), 39(0) 

Dscp (Queue): 40(0), 41(0), 42(0), 43(0), 44(0), 45(0), 46(0), 47(0) 

Dscp (Queue): 48(0), 49(0), 50(0), 51(0), 52(0), 53(0), 54(0), 55(0)

Dscp (Queue): 56(0), 57(0), 58(0), 59(0), 60(0), 61(0), 62(0), 63(0)

Table 32-2: Parameters in the output of the show mls qos interface command

Parameter Description

Number of egress

queues The total number of egress queues available on this

interface.

Egress Queue Number of this egress queue.

C613-50292-01 Rev A Command Reference for IE210L Series 1067

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW MLS QOS INTERFACE

Status Queue can either be enabled or disabled.

Scheduler The scheduling mode being used for servicing the

transmission of packets on this port.

Queue Limit The percentage of the port’s buffers that have been

allocated to this queue.

Egress Rate Limit The amount of traffic that can be transmitted via this

queue per second. 0 Kb means there is currently no

rate-limiting enabled.

Table 32-2: Parameters in the output of the show mls qos interface command

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1068

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW MLS QOS INTERFACE POLICER-COUNTERS

show mls qos interface policer-counters

Overview This command displays an interface’s policer counters. This can either be for a

specific class-map or for all class-maps attached to the interface. If no class-map is

specified then all class-map policer counters attached to the interface are

displayed.

Syntax show mls qos interface <port> policer-counters [class-map

<class-map>]

Mode User Exec and Privileged Exec

Usage Note that:

• The hardware does not record distinct counters for the number of Green or

Yellow bytes, so the field marked Green/Yellow is the summation of bytes

that have been marked Green or Yellow by the meter.

• The counters are based on metering performed on the specified class-map.

Therefore, the ‘Dropped Bytes’ counter is the number of bytes dropped due

to metering. This is different from packets dropped via a ‘deny’ action in the

ACL. If a policer is configured to perform re-marking, bytes can be marked

Red but are not dropped, and is shown with a value of 0 for the Dropped field

and a non-0 value for the ‘Red Bytes’ field.

Example To show the counters for all class-maps attached to port1.0.1, use the command:

awplus# show mls qos interface port1.0.1 policer-counters

Output Figure 32-5: Example output from show mls qos interface policer-counters on

a port

Parameter Description

<port>Switch port.

class-map Select a class-map.

<class-map>Class-map name.

awplus#show mls qos interface port1.0.1 policer-counters

Interface: port1.0.1

Class-map: default

Green/Yellow Bytes: 0

Red Bytes: 0

Dropped Bytes: 0

Non-dropped Bytes: 0

Class-map: cmap1

Green/Yellow Bytes: 1290

Red Bytes: 0

Dropped Bytes: 0

Non-dropped Bytes: 1290

C613-50292-01 Rev A Command Reference for IE210L Series 1069

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW MLS QOS INTERFACE QUEUE-COUNTERS

show mls qos interface queue-counters

Overview This command displays an interface’s egress queue counters. This can either be for

a specific queue or for all queues on the interface. If no queue is specified all queue

counters on the interface will be displayed.

The counters show the number of frames currently in the queue and the maximum

number of frames allowed in the queue, for individual egress queues and the port’s

queue (which will be a sum of all egress queues).

Syntax show mls qos interface <port> queue-counters [queue <number>]

Mode User Exec and Privileged Exec

Example To show the counters for all queues on port1.0.1, use the command:

awplus# show mls qos interface port1.0.1 queue-counters

Output Figure 32-6: Example output from show mls qos interface queue-counters

Parameter Description

<port>Switch port.

queue <number>Queue number, from 0 to 7.



Interface port1.0.1 Queue Counters:

Port queue length 1169

Egress Queue length:

Queue 0 0

Queue 1 0

Queue 2 1169

Queue 3 0

Queue 4 0

Queue 5 0

Queue 6 0

Queue 7 0

Table 32-3: Parameters in the output from show mls qos interface

queue-counters

Parameter Description

Interface Port we are showing the counters for.

Port queue length Number of frames in the port’s queue. This will be the

sum of all egress queues on the port.

Egress Queue length Number of frames in a specific egress queue.

C613-50292-01 Rev A Command Reference for IE210L Series 1070

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW MLS QOS INTERFACE STORM-STATUS

show mls qos interface storm-status

Overview Show the current configuration and status of the QoS Storm Protection (QSP) on

the given port.

Syntax show mls qos interface <port> storm-status

Mode User Exec and Privileged Exec

Example To see the QSP status on port1.0.1, use the command:

awplus# show mls qos interface port1.0.1 storm-status

Output Figure 32-7: Example output from show mls qos interface storm-status

Commands

storm-action

storm-downtime

storm-protection

storm-rate

storm-window

Parameter Description

<port>Switch port.

Interface: port1.0.1

Storm-Protection: Enabled

Port-status: Enabled

Storm Action: vlandisable

Storm Window: 5000 ms

Storm Downtime: 0 s

Timeout Remaining: 0 s

Last read data-rate: 0 kbps

Storm Rate: 1000 kbps

C613-50292-01 Rev A Command Reference for IE210L Series 1071

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW MLS QOS MAPS COS-QUEUE

show mls qos maps cos-queue

Overview Show the current configuration of the cos-queue map.

Syntax show mls qos maps cos-queue

Mode User Exec and Privileged Exec

Example To display the current configuration of the cos-queue map, use the command:

awplus# show mls qos maps cos-queue

Output Figure 32-8: Example output from show mls qos maps cos-queue

Commands

mls qos map cos-queue

COS-TO-QUEUE-MAP:

COS : 0 1 2 3 4 5 6 7

-----------------------------------

QUEUE: 2 0 1 3 4 5 6 7

C613-50292-01 Rev A Command Reference for IE210L Series 1072

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW MLS QOS MAPS PREMARK-DSCP

show mls qos maps premark-dscp

Overview This command displays the premark-dscp map. This map is used to replace the

DSCP, CoS and/or bandwidth class of a packet matching the class-map, based on a

lookup DSCP value.

Syntax show mls qos maps premark-dscp [<0-63>]

Mode User Exec and Privileged Exec

Example To display the premark-dscp map for DSCP 1, use the command:

awplus# show mls qos maps premark-dscp 1

Output Figure 32-9: Example output from the show mls qos maps premark-dscp

command

Commands

mls qos map premark-dscp

trust dscp

Parameter Description

<0-63>DSCP table entry.

PREMARK-DSCP-MAP:



DSCP 1

Bandwidth Class 

-------------------------

New DSCP 2 

New CoS 0

New Bandwidth Class green

C613-50292-01 Rev A Command Reference for IE210L Series 1073

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW PLATFORM CLASSIFIER STATISTICS UTILIZATION BRIEF

show platform classifier statistics utilization

brief

Overview This command displays the number of used entries available for various platform

functions, and the percentage that number of entries represents of the total

available.

Syntax show platform classifier statistics utilization brief

Mode Privileged Exec

Example To display the platform classifier utilization statistics, use the following command:

awplus# show platform classifier statistics utilization brief

Output Figure 32-10: Output from show platform classifier statistics utilization brief

Output Figure 32-11: Output from show platform classifier statistics utilization brief

In this example, there is one UFO VLAN and one upstream port consuming 3 FP

entries.

#show platform classifier statistics utilization brief

[Instance 0]

Capacity: 503

Number of Entries:

Policy Type Group ID Used / Allocated

----------------------------------------------

ACL 1476395010 0 / 119 ( 0%)

Interface 0

VACL 0

Flooding Nexthop Inactive 0 / 0 ( 0%)

Remote-Mirror Inactive 0 / 0 ( 0%)

UFO Inactive 0 / 0 ( 0%)

QoS Inactive 0 / 0 ( 0%)



Rule Limit Reached (clear on read): 0

Total Rule Limit Reached from startup: 0



Space will be allocated to QOS as required.

C613-50292-01 Rev A Command Reference for IE210L Series 1074

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW PLATFORM CLASSIFIER STATISTICS UTILIZATION BRIEF

Output

parameters

Depending on your switch, you will see some of the following parameters in the

output from show platform classifier statistics utilization brief

#show platform classifier statistics utilization brief



[Instance 4]

Number of Entries:

Policy Type Group ID Used / Total

---------------------------------------------- 

ACL 1476395010 0 / 117 ( 0%)

Interface 0

VACL 0

DoS Inactive 0 / 0 ( 0%

VLAN Counter

Group-Octet Inactive 0 / 0 ( 0%)

Group-Packet Inactive 0 / 0 ( 0%)

Floding Nexthop Inactive 0 / 0 ( 0%)

Remote-Mirror Inactive 0 / 0 ( 0%)

UFO 1476395012 3 / 128 ( 2%)

QoS 0 / 256 ( 0%)

[Instance 5]

Number of Entries:

Policy Type Group ID Used / Total

----------------------------------------------

ACL 1476395010 0 / 117 ( 0%)

Interface 0

VACL 0

DoS Inactive 0 / 0 ( 0%)

VLAN Counter

Group-Octet Inactive 0 / 0 ( 0%)

Group-Packet Inactive 0 / 0 ( 0%)

Floding Nexthop Inactive 0 / 0 ( 0%)

Remote-Mirror Inactive 0 / 0 ( 0%)

UFO 1476395012 3 / 128 ( 2%)

QoS 0 / 256 ( 0%)

Parameter Description

IPv6 Multicast Reserved hardware space for use by IPv6 multicast.

System Fixed system entries. For example, resiliency links make use of system ACLs.

MLD Snooping Entries to send various packets that MLD Snooping is interested in to the CPU.

DHCP Snooping Entries used to send DHCP and ARP packets to the CPU. User-added DHCP

Snooping filters under ACLs are counted under the ACL or QoS categories.

Loop Detection Entries uses to send the special loop detection frame to the CPU.

EPSR Entries used to send EPSR control traffic to the CPU.

CFM Entries used by Connectivity Fault Management.

C613-50292-01 Rev A Command Reference for IE210L Series 1075

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW PLATFORM CLASSIFIER STATISTICS UTILIZATION BRIEF

Commands

show platform

ipv6 access-list (named IPv6 hardware ACL)

G8032 Entries used to send G.8032 control traffic to the CPU.

Global ACLs Entries for ACLs appear here if the ACLs are applied globally instead of per

switchport.

ACL Entries for ACL filters that have been applied directly to ports using the

access-group command.

VACL Entries for VLAN-based ACLs (ACLs that are applied to VLANs instead of ports).

DOS Entries used for Denial of Service protection.

UFO Entries used by Upward Forwarding Only (UFO).

QoS Entries for ACL filters and other class-map configurations, such as policers, applied

through policy maps using the service input command.

RA Guard Entries used to block IPv6 router advertisements, configured with the ipv6 nd

raguard command.

AMFAPPS Entries used by AMF Application Proxy. These entries enable the SES Controller to

block infected ports.

Pre-Ingress Entries used for VLAN ID Translation (and also for subnet-based and MAC-based

VLAN entries on SBx81XLEM cards).

Egress Entries used for VLAN ID Translation.

UDB User Defined Bytes (UDB), which are a limited resource of bytes that can be used to

implement additional arbitrary matching on packet bytes on some switches. The

software manages the use and allocation of these bytes automatically. The output

of this table is intended for use by Allied Telesis Customer Support only.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1076

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

SHOW POLICY-MAP

show policy-map

Overview Displays the policy-maps configured on the switch. The output also shows

whether or not they are connected to a port (attached / detached) and shows their

associated class-maps.

Syntax show policy-map [<name>]

Mode User Exec and Privileged Exec

Example To display a listing of the policy-maps configured on the switch, use the command:

awplus# show policy-map

Output Figure 32-12: Example output from the show policy-map command

Commands

no police

service-policy input

Parameter Description

<name>The name of a specific policy-map.

POLICY-MAP-NAME: example 

Interfaces: 

Default class-map action: permit 



CLASS-MAP-NAME: default 

Policer counters enabled

C613-50292-01 Rev A Command Reference for IE210L Series 1077

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

STORM-ACTION

storm-action

Overview Sets the action to be taken when triggered by QoS Storm Protection (QSP). There

are three available options:

•portdisable will disable the port in software.

•vlandisable will disable the port from the VLAN matched by the class-map

in class-map. This option requires the match vlan class-map to be present in

the class-map

•linkdown will physically bring the port down. .

The no variant of this command will negate the action set by the storm-action

command.

Syntax storm-action {portdisable|vlandisable|linkdown}

no storm-action

Mode Policy Map Class Configuration

Examples To apply the storm protection of vlandisable to the policy-map named “pmap2”

and the class-map named “cmap1”, use the following commands:

awplus# configure terminal

awplus(config)# policy-map pmap2

awplus(config-pmap)# class cmap1

awplus(config-pmap-c# storm-action vlandisable

To negate the storm protection set on the policy-map named “pmap2” and the

class-map named “cmap1”, use the following commands:

awplus# configure terminal

awplus(config)# policy-map pmap2

awplus(config-pmap)# class cmap1

awplus(config-pmap-c# no storm-action

Commands

storm-downtime

storm-protection

storm-rate

storm-window

Parameter Description

portdisable Disable the port in software.

vlandisable Disable the VLAN.

linkdown Shutdown the port physically.

C613-50292-01 Rev A Command Reference for IE210L Series 1078

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

STORM-DOWNTIME

storm-downtime

Overview Sets the time to re-enable a port that has been disabled by QoS Storm Protection

(QSP). The time is given in seconds, from a minimum of one second to maximum

of 86400 seconds (i.e. one day).

The no variant of this command resets the time to the default value of 10 seconds.

Syntax storm-downtime <1-86400>

no storm-downtime

Default 10 seconds

Mode Policy Map Class Configuration

Examples To re-enable the port in 1 minute, use the following commands:

awplus# configure terminal

awplus(config)# policy-map pmap2

awplus(config-pmap)# class cmap1

awplus(config-pmap-c)# storm-downtime 60

To re-set the port to the default (10 seconds), use the following commands:

awplus# configure terminal

awplus(config)# policy-map pmap2

awplus(config-pmap)# class cmap1

awplus(config-pmap-c)# no storm-downtime

Commands

storm-action

storm-protection

storm-rate

storm-window

Parameter Description

<1-86400>Seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 1079

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

STORM-PROTECTION

storm-protection

Overview Use this command to enable policy-based Storm Protection (such as QSP - QoS

Storm Protection). Storm protection is activated as soon as a port is enabled.

However, it will only be functional after storm-rate and storm-window have been

set.

The no variant of this command disables policy-based Storm Protection.

Syntax storm-protection

no storm-protection

Default By default, storm protection is disabled.

Mode Policy Map Class Configuration

Examples To enable QSP on cmap2 in pmap2, use the following commands:

awplus# configure terminal

awplus(config)# policy-map pmap2

awplus(config-pmap)# class cmap2

awplus(config-pmap-c)# storm-protection

To disable QSP on cmap2 in pmap2, use the following commands:

awplus# policy-map pmap2

awplus(config-pmap)# class cmap2

awplus(config-pmap-c)# no storm-protection

Commands

show mls qos interface storm-status

storm-action

storm-downtime

storm-rate

storm-window

C613-50292-01 Rev A Command Reference for IE210L Series 1080

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

STORM-RATE

storm-rate

Overview Sets the data rate that triggers the storm-action. The rate is in kbps and the range

is from 1kbps to 40Gbps.

Note that this setting is made in conjunction with the storm-window command.

Use the no variant of this command to negate the storm-rate command.

Syntax storm-rate <1-40000000>

no storm-rate

Default No default

Mode Policy Map Class Configuration

Usage This setting is made in conjunction with the storm-window command.

Examples To limit the data rate to 100Mbps, use the following commands:

awplus# configure terminal

awplus(config)# policy-map pmap2

awplus(config-pmap)# class cmap2

awplus(config-pmap-c)# storm-rate 100000

To negate the limit set previously, use the following commands:

awplus# configure terminal

awplus(config)# policy-map pmap2

awplus(config-pmap)# class cmap2

awplus(config-pmap-c)# no storm-rate

Commands

storm-action

storm-downtime

storm-protection

storm-window

Parameter Description

<1-40000000>The range of the storm-rate.

C613-50292-01 Rev A Command Reference for IE210L Series 1081

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

STORM-WINDOW

storm-window

Overview Sets the window size of QoS Storm Protection (QSP). This sets the time to poll the

data-rate every given milliseconds. Minimum window size is 100 ms and the

maximum size is 60 sec.

Use the no variant of this command to negate the storm-window command.

Syntax storm-window <100-60000>

no storm-window

Default No default

Mode Policy Map Class Configuration

Usage This command should be set in conjunction with the storm-rate command.

Examples To set the QSP window size to 5000 ms, use the following commands:

awplus# configure terminal

awplus(config)# policy-map pmap2

awplus(config-pmap)# class cmap2

awplus(config-pmap-c)# storm-window 5000

To negate the QSP window size set previously, use the following commands:

awplus# configure terminal

awplus(config)# policy-map pmap2

awplus(config-pmap)# class cmap2

awplus(config-pmap-c)# no storm-window

Commands

storm-action

storm-downtime

storm-protection

storm-rate

Parameter Description

<100-60000>The window size, measured in milliseconds.

C613-50292-01 Rev A Command Reference for IE210L Series 1082

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

TRUST DSCP

trust dscp

Overview This command enables the premark-dscp map to replace the DSCP,

bandwidth-class and/or CoS of classified traffic based on a lookup DSCP value.

With the no variant of this command, no premark-dscp mapping function will be

applied for the selected class-map. QoS components of the packet existing either

at ingress, or applied by the class-map, will pass unchanged.

Syntax trust dscp

no trust

Mode Policy-Map Configuration

Examples To enable the premark-dscp map lookup for policy-map pmap1, use the

commands:

awplus# configure terminal

awplus(config)# policy-map pmap1

awplus(config-pmap)# trust dscp

To disable the premark-dscp map lookup for policy-map pmap1, use the

commands:

awplus# configure terminal

awplus(config)# policy-map pmap1

awplus(config-pmap)# no trust

Commands

mls qos map premark-dscp

C613-50292-01 Rev A Command Reference for IE210L Series 1083

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

WRR-QUEUE DISABLE QUEUES

wrr-queue disable queues

Overview Use this command to disable an egress queue from transmitting traffic.

The no variant of this command enables an egress queue to transmit traffic.

Syntax wrr-queue disable queues [0][1][2][3][4][5][6][7]

no wrr-queue disable queues [0][1][2][3][4][5][6][7]

Mode Interface Configuration

Examples To disable queue 1 on port1.0.1 from transmitting traffic, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# wrr-queue disable queues 1

To enable queue 1 on port1.0.1 to transmit traffic, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no wrr-queue disable queues 1

Commands

show mls qos interface

Parameter Description

[0][2]...[7] Selects one or more queues numbered 0 to 7.

C613-50292-01 Rev A Command Reference for IE210L Series 1084

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

WRR-QUEUE EGRESS-RATE-LIMIT QUEUES

wrr-queue egress-rate-limit queues

Overview Sets a limit on the amount of traffic that can be transmitted per second from these

queues. The default unit is in Kb, but Mb or Gb can also be specified. The minimum

is 651 Kb.

Syntax wrr-queue egress-rate-limit <bandwidth> queues

[0][1][2][3][4][5][6][7]

no wrr-queue egress-rate-limit <bandwidth> queues

[0][1][2][3][4][5][6][7]

Mode Interface Configuration

Example To limit the egress rate of queues 0, 1 and 2 on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# wrr-queue egress-rate-limit 500M queues 0 1

Commands

show mls qos interface

Parameter Description

<bandwidth>Bandwidth <1-100000000 kbits> (usable units: k, m, g).

[0][2]...[7] Selects one or more queues numbered 0 to 7.

C613-50292-01 Rev A Command Reference for IE210L Series 1085

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

QOS COMMANDS

WRR-QUEUE WEIGHT QUEUES

wrr-queue weight queues

Overview This command configures weighted round-robin based scheduling on the

specified egress queues on switch port interfaces only. The weights are specified

as ratios relative to each other.

Use the no wrr-queue command to remove weighted round-robin based

scheduling from the specified egress queue. The queue then reverts to its normal

priority-based scheduling.

Syntax wrr-queue weight <1-15> queues [0][1][2][3][4][5][6][7]

no wrr-queue <queue-number>

Mode Interface Configuration for switch port interfaces only (not for static aggregated

interfaces).

Usage You cannot apply weighted round-robin based scheduling to static aggregated

interfaces (for example, sa2).

Example To apply a WRR weight of 6 to queues 0 and 1 on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# wrr-queue weight 6 queues 0 1

To remove weighted round-robin scheduling from egress queue 2 on port1.0.1,

use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no wrr-queue 2

Commands

priority-queue

show mls qos interface

Parameter Description

<1-15>Weight (the higher the number the greater will be the queue

servicing).

[0][2]...[7] Selects one or more queues numbered 0 to 7.

<queue-number>Egress queue to revert to priority-based scheduling.

C613-50292-01 Rev A Command Reference for IE210L Series 1086

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

802.1X port access control. For more information, see the AAA and Port

Authentication_Feature Overview and Configuration Guide.

Command List •“dot1x accounting” on page 1088

•“dot1x authentication” on page 1089

•“debug dot1x” on page 1090

•“dot1x control-direction” on page 1091

•“dot1x eap” on page 1093

•“dot1x eapol-version” on page 1094

•“dot1x initialize interface” on page 1096

•“dot1x initialize supplicant” on page 1097

•“dot1x keytransmit” on page 1098

•“dot1x max-auth-fail” on page 1099

•“dot1x max-reauth-req” on page 1101

•“dot1x port-control” on page 1103

•“dot1x timeout tx-period” on page 1105

•“show debugging dot1x” on page 1107

•“show dot1x” on page 1108

•“show dot1x diagnostics” on page 1111

•“show dot1x interface” on page 1113

•“show dot1x sessionstatistics” on page 1118

•“show dot1x statistics interface” on page 1119

C613-50292-01 Rev A Command Reference for IE210L Series 1087

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

•“show dot1x supplicant” on page 1120

•“show dot1x supplicant interface” on page 1122

•“undebug dot1x” on page 1125

C613-50292-01 Rev A Command Reference for IE210L Series 1088

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X ACCOUNTING

dot1x accounting

Overview This command overrides the default RADIUS accounting method for IEEE

802.1X-based authentication on an interface by allowing you to apply a

user-defined named method list.

Use the no variant of this command to remove the named list from the interface

and apply the default method list.

Syntax dot1x accounting {default|<list-name>}

no dot1x accounting

Default The default method list is applied to an interface by default.

Mode Interface Mode

Example To apply the named list 'vlan10_acct' on the vlan10 interface, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# dot1x accounting vlan10_acct

To remove the named list from the vlan10 interface and set the authentication

method back to default, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no dot1x accounting

Commands

aaa accounting dot1x

Parameter Description

default Apply the default accounting method list

<list-name>Apply the user-defined named list

C613-50292-01 Rev A Command Reference for IE210L Series 1089

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X AUTHENTICATION

dot1x authentication

Overview This command overrides the default 802.1X-based authentication method on an

interface by allowing you to apply a user-defined named list.

Use the no variant of this command to remove the named list from the interface

and apply the default method.

Syntax dot1x authentication {default|<list-name>}

no dot1x authentication

Default The default method list is applied to an interface by default.

Mode Interface Mode

Example To apply the named list 'vlan10_auth' on the vlan10 interface, use the

commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# dot1x authentication vlan10_auth

To remove the named list from the vlan10 interface and set the authentication

method back to default, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no dot1x authentication

Commands

aaa authentication dot1x

Parameter Description

default Apply the default authentication method list

<list-name>Apply the user-defined named list

C613-50292-01 Rev A Command Reference for IE210L Series 1090

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DEBUG DOT1X

debug dot1x

Overview Use this command to enable 802.1X IEEE Port-Based Network Access Control

troubleshooting functions.

Use the no variant of this command to disable this function.

no debug all dot1x

Mode Privileged Exec and Global Configuration

Usage This command turns on a mode where trace-level information is output during?

authentication conversations. Be aware that this is a very verbose output.? It is

mostly useful to capture this as part of escalating an issue to ATI support.

Examples Use this command without any parameters to turn on normal 802.1X debug

information.

awplus# debug dot1x

awplus# show debugging dot1x

Commands

show debugging dot1x

undebug dot1x

Parameter Description

all Used with the no variant of this command exclusively; turns off all

debugging for 802.1X.

auth-web Specifies debugging for 802.1X auth-web information.

events Specifies debugging for 802.1X events.

nsm Specifies debugging for NSM messages.

packet Specifies debugging for 802.1X packets.

timer Specifies debugging for 802.1X timers.

802.1X debugging status:

802.1X events debugging is

802.1X timer debugging is on

802.1X packets debugging is on

802.1X NSM debugging is on

C613-50292-01 Rev A Command Reference for IE210L Series 1091

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X CONTROL-DIRECTION

dot1x control-direction

Overview This command sets the direction of the filter for the unauthorized interface.

If the optional in parameter is specified with this command then packets entering

the specified port are discarded. The in parameter discards the ingress packets

received from the supplicant.

If the optional both parameter is specified with this command then packets

entering (ingress) and leaving (egress) the specified port are discarded. The both

parameter discards the packets received from the supplicant and sent to the

supplicant.

The no variant of this command sets the direction of the filter to both. The port will

then discard both ingress and egress traffic.

Syntax dot1x control-direction {in|both}

no dot1x control-direction

Default The authentication port direction is set to both by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To set the port direction to the default (both) for port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no dot1x control-direction

To set the port direction to in for port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x control-direction in

To set the port direction to in for authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# dot1x control-direction in

Parameter Description

in Discard received packets from the supplicant (ingress

packets).

both Discard received packets from the supplicant (ingress

packets) and transmitted packets to the supplicant (egress

packets).

C613-50292-01 Rev A Command Reference for IE210L Series 1092

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X CONTROL-DIRECTION

To set the port direction to the default (both) for authentication profile ‘student’,

use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no dot1x control-direction

Commands

auth profile (Global Configuration)

show dot1x

show dot1x interface

show auth interface

C613-50292-01 Rev A Command Reference for IE210L Series 1093

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X EAP

dot1x eap

Overview This command selects the transmit mode for the EAP packet. If the authentication

feature is not enabled then EAP transmit mode is not enabled. The default setting

discards EAP packets.

Syntax dot1x eap {discard|forward|forward-untagged-vlan|forward-vlan}

Default The transmit mode is set to discard EAP packets by default.

Mode Global Configuration

Examples To set the transmit mode of EAP packet to forward to forward EAP packets to all

ports on the switch, use the commands:

awplus# configure terminal

awplus(config)# dot1x eap forward

To set the transmit mode of EAP packet to discard to discard EAP packets, use

the commands:

awplus# configure terminal

awplus(config)# dot1x eap discard

To set the transmit mode of EAP packet to forward-untagged-vlan to

forward EAP packets to ports with the same untagged vlan, use the commands:

awplus# configure terminal

awplus(config)# dot1x eap forward-untagged-vlan

To set the transmit mode of EAP packet to forward-vlan to forward EAP

packets to ports with the same vlan, use the commands:

awplus# configure terminal

awplus(config)# dot1x eap forward-vlan

Parameter Description

discard Discard.

forward Forward to all ports on the switch.

forward-untagged-vlan Forward to ports with the same untagged VLAN.

forward-vlan Forward to ports with the same VLAN.

C613-50292-01 Rev A Command Reference for IE210L Series 1094

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X EAPOL-VERSION

dot1x eapol-version

Overview This command sets the EAPOL protocol version for EAP packets when 802.1X port

authentication is applied.

Use the no variant of this command to set the EAPOL protocol version to 1.

The default EAPOL protocol version is version 1.

Syntax dot1x eapol-version {1|2}

no dot1x eapol-version

Default The EAP version for 802.1X authentication is set to 1 by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To set the EAPOL protocol version to 2 for port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x eapol-version 2

To set the EAPOL protocol version to the default version (1) for interface port1.0.2,

use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no dot1x eapol-version

To set the EAPOL protocol version to 2 for authentication profile 'student', use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# dot1x eapol-version 2

To set the EAPOL protocol version to the default version (1) for authentication

profile 'student', use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no dot1x eapol-version

Parameter Description

1EAPOL version.

2EAPOL version.

C613-50292-01 Rev A Command Reference for IE210L Series 1095

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X EAPOL-VERSION

Validation

Commands

auth profile (Global Configuration)

show dot1x

show dot1x interface

C613-50292-01 Rev A Command Reference for IE210L Series 1096

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X INITIALIZE INTERFACE

dot1x initialize interface

Overview This command removes authorization for a specified connected interface. The

connection will attempt to re-authorize when the specified port attempts to make

use of the network connection.

NOTE: Reauthentication could be a long time after the use of this command because

the reauthorization attempt is not triggered by this command. The attempt is triggered

by the first packet from the interface trying to access the network resources.

Syntax dot1x initialize interface <interface-list>

Mode Privileged Exec

Examples To initialize 802.1X port authentication on the interface port1.0.2, use the

command:

awplus# dot1x initialize interface port1.0.2

To unauthorize switch port1.0.1 and attempt reauthentication on switch port1.0.1,

use the command:

awplus# dot1x initialize interface port1.0.1

To unauthorize all switch ports for a 24-port device and attempt reauthentication,

use the command:

awplus# dot1x initialize interface port1.0.1-port1.0.24

Validation

Commands

show dot1x

show dot1x interface

Commands

dot1x initialize supplicant

Parameter Description

<interface-list> The interfaces or ports to configure. An interface-list can be:

• an interface (e.g. vlan2), a switch port (e.g. port1.0.6),

a static channel group (e.g. sa2) or a dynamic (LACP)

channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.6, or sa1-2,

or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.2-1.0.4. Do not mix interface

types in a list

The specified interfaces must exist.

C613-50292-01 Rev A Command Reference for IE210L Series 1097

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X INITIALIZE SUPPLICANT

dot1x initialize supplicant

Overview This command removes authorization for a connected supplicant with the

specified MAC address or username. The connection will attempt to re-authorize

when the specified supplicant attempts to make use of the network connection.

NOTE: Reauthentication could be a long time after the use of this command because

the reauthorization attempt is not triggered by this command. The attempt is triggered

by the first packet from the supplicant trying to access the network resources.

Syntax dot1x initialize supplicant {<macadd>|username}

Mode Privileged Exec

Example To initialize the supplicant authentication, use the commands

awplus# configure terminal

awplus(config)# dot1x initialize supplicant 0090.99ab.a020

awplus(config)# dot1x initialize supplicant guest

Validation

Commands

show dot1x

show dot1x supplicant

Commands

dot1x initialize interface

Parameter Description

dot1x IEEE 802.1X Port-Based Access Control.

initialize Initialize the port to attempt reauthentication.

supplicant Specify the supplicant to initialize.

<macadd>MAC (hardware address of the supplicant.

username The name of the supplicant entry.

C613-50292-01 Rev A Command Reference for IE210L Series 1098

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X KEYTRANSMIT

dot1x keytransmit

Overview This command enables key transmission on the interface specified previously in

Interface mode.

The no variant of this command disables key transmission on the interface

specified.

Syntax dot1x keytransmit

no dot1x keytransmit

Default Key transmission for port authentication is enabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port.

Usage Use this command to enable key transmission over an Extensible Authentication

Protocol (EAP) packet between the authenticator and supplicant. Use the no

variant of this command to disable key transmission.

Examples To enable the key transmit feature on interface port1.0.2, after it has been disabled

by negation, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x keytransmit

To disable the key transmit feature from the default startup configuration on

interface port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no dot1x keytransmit

Validation

Commands

show dot1x

show dot1x interface

C613-50292-01 Rev A Command Reference for IE210L Series 1099

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X MAX-AUTH-FAIL

dot1x max-auth-fail

Overview Use this command to configure the maximum number of login attempts for a

supplicant (client device) using the auth-fail vlan feature, when using 802.1X port

authentication on an interface.

The no variant of this command resets the maximum login attempts for a

supplicant (client device) using the auth-fail vlan feature, to the default

configuration of 3 login attempts.

Syntax dot1x max-auth-fail <0-10>

no dot1x max-auth-fail

Default The default maximum number of login attempts for a supplicant on an interface

using 802.1X port authentication is three (3) login attempts.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage This command sets the maximum number of login attempts for supplicants on an

interface. The supplicant is moved to the auth-fail VLAN from the Guest VLAN after

the number of failed login attempts using 802.1X authentication is equal to the

number set with this command.

See the AAA and Port Authentication Feature Overview and Configuration Guide

for information about:

• the auth-fail VLAN feature, and

• restrictions regarding combinations of authentication enhancements

working together

Examples To configure the maximum number of login attempts for a supplicant on interface

port1.0.2 to a single (1) login attempt, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x max-auth-fail 1

To configure the maximum number of login attempts for a supplicant on interface

port1.0.2 to the default number of three (3) login attempts, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no dot1x max-auth-fail

Parameter Description

<0-10>Specify the maximum number of login attempts for supplicants

on an interface using 802.1X port authentication.

C613-50292-01 Rev A Command Reference for IE210L Series 1100

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X MAX-AUTH-FAIL

To configure the maximum number of login attempts for a supplicant on

authentication profile 'student' to a single (1) login attempt, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# dot1x max-auth-fail 1

To configure the maximum number of login attempts for a supplicant on

authentication profile 'student' to the default number of three (3) login attempts,

use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no dot1x max-auth-fail

Validation

Commands

show running-config

show dot1x interface

Commands

auth auth-fail vlan

auth profile (Global Configuration)

dot1x max-reauth-req

C613-50292-01 Rev A Command Reference for IE210L Series 1101

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X MAX-REAUTH-REQ

dot1x max-reauth-req

Overview This command sets the number of reauthentication attempts before an interface

is unauthorized.

The no variant of this command resets the reauthentication delay to the default.

Syntax dot1x max-reauth-req <1-10>

no dot1x max-reauth-req

Default The default maximum reauthentication attempts for interfaces using 802.1X port

authentication is two (2) reauthentication attempts, before an interface is

unauthorized.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage Use this command to set the maximum reauthentication attempts after failure.

Examples To configure the maximum number of reauthentication attempts for interface

port1.0.2 to a single (1) reauthentication request, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x max-reauth-req 1

To configure the maximum number of reauthentication attempts for interface

port1.0.2 to the default maximum number of two (2) reauthentication attempts,

use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no dot1x max-reauth-req

To configure the maximum number of reauthentication attempts for

authentication profile 'student' to a single (1) reauthentication request, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# dot1x max-reauth-req 1

Parameter Description

<1-10>Specify the maximum number of reauthentication attempts for

supplicants on an interface using 802.1X port authentication.

C613-50292-01 Rev A Command Reference for IE210L Series 1102

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X MAX-REAUTH-REQ

To configure the maximum number of reauthentication attempts for

authentication profile 'student' to the default maximum number of two (2)

reauthentication attempts, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no dot1x max-reauth-req

Validation

Commands

show running-config

Commands

auth profile (Global Configuration)

dot1x max-auth-fail

show dot1x interface

C613-50292-01 Rev A Command Reference for IE210L Series 1103

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X PORT-CONTROL

dot1x port-control

Overview This command enables 802.1X port authentication on the interface specified, and

sets the control of the authentication port.

The no variant of this command disables the port authentication on the interface

specified.

Syntax dot1x port-control {force-unauthorized|force-authorized|auto}

no dot1x port-control

Default 802.1X port control is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage Use this command to force a port state.

When port-control is set to auto, the 802.1X authentication feature is executed on

the interface, but only if the aaa authentication dot1x command has been issued.

Examples To enable port authentication on the interface port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x port-control auto

To enable port authentication force authorized on the interface port1.0.2, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x port-control force-authorized

Parameter Description

force-unauthorized Force the port state to unauthorized.

Specify this to force a port to always be in an unauthorized

state.

force-authorized Force the port state to authorized.

Specify this to force a port to always be in an authorized

state.

auto Allow the port client to negotiate authentication.

Specify this to enable authentication on the port.

C613-50292-01 Rev A Command Reference for IE210L Series 1104

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X PORT-CONTROL

To disable port authentication on the interface port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no dot1x port-control

To enable port authentication on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# dot1x port-control auto

To enable port authentication force authorized on authentication profile ‘student’,

use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# dot1x port-control

force-authorized

To disable port authentication on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no dot1x port-control

Validation

Commands

show dot1x interface

Commands

aaa authentication dot1x

auth profile (Global Configuration)

C613-50292-01 Rev A Command Reference for IE210L Series 1105

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X TIMEOUT TX-PERIOD

dot1x timeout tx-period

Overview This command sets the transmit timeout for the authentication request on the

specified interface.

The no variant of this command resets the transmit timeout period to the default

(30 seconds).

Syntax dot1x timeout tx-period <1-65535>

no dot1x timeout tx-period

Default The default transmit period for port authentication is 30 seconds.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage Use this command to set the interval between successive attempts to request an

ID.

Examples To set the transmit timeout period to 5 seconds on interface port1.0.2, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x timeout tx-period 5

To reset transmit timeout period to the default (30 seconds) on interface port1.0.2,

use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no dot1x timeout tx-period

To set the transmit timeout period to 5 seconds on authentication profile ‘student’,

use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# dot1x timeout tx-period 5

To reset transmit timeout period to the default (30 seconds) on authentication

profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no dot1x timeout tx-period

Parameter Description

<1-65535>Seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 1106

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

DOT1X TIMEOUT TX-PERIOD

Validation

Commands

auth profile (Global Configuration)

show dot1x

show dot1x interface

C613-50292-01 Rev A Command Reference for IE210L Series 1107

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DEBUGGING DOT1X

show debugging dot1x

Overview Use this command to display the 802.1X debugging option set.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show debugging dot1x

Mode User Exec and Privileged Exec

Usage This is a sample output from the show debugging dot1x command.

awplus# debug dot1x

awplus# show debugging dot1x

Commands

debug dot1x

802.1X debugging status:

802.1X events debugging is on

802.1X timer debugging is on

802.1X packets debugging is on

802.1X NSM debugging is on

C613-50292-01 Rev A Command Reference for IE210L Series 1108

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X

show dot1x

Overview This command shows authentication information for dot1x (802.1X) port

authentication.

If you specify the optional all parameter then this command also displays all

authentication information for each port available on the switch.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare_Plus” Feature Overview and Configuration Guide.

Syntax show dot1x [all]

Mode Privileged Exec

Example awplus# show dot1x all

Parameter Description

all Displays all authentication information for each port available on the

switch.

Table 1: Example output from the show dot1x all command

awplus# show dot1x all

802.1X Port-Based Authentication Enabled

RADIUS server address: 150.87.18.89:1812

Next radius message id: 5

RADIUS client address: not configured

Authentication info for interface port1.0.2

portEnabled: true - portControl: Auto

portStatus: Authorized

reAuthenticate: disabled

reAuthPeriod: 3600

PAE: quietPeriod: 60 - maxReauthReq: 2 - txPeriod: 30

PAE: connectTimeout: 30

BE: suppTimeout: 30 - serverTimeout: 30

CD: adminControlledDirections: in

KT: keyTxEnabled: false

critical: disabled

guestVlan: disabled

dynamicVlanCreation: single-dynamic-vlan

multiVlanSession: disabled

assignFailActionRule: deny

hostMode: multi-supplicant

maxSupplicant:

1024

C613-50292-01 Rev A Command Reference for IE210L Series 1109

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X

dot1x: enabled

protocolVersion: 1

authMac: enabled

method: PAP

reauthRelearning: disabled

authWeb: enabled

method: PAP

lockCount: 3

packetForwarding: disabled

twoStepAuthentication:

configured: enabled

actual: enabled

SupplicantMac: none

supplicantMac: none

Supplicant name: manager

Supplicant address: 00d0.59ab.7037

authenticationMethod: 802.1X Authentication

portStatus: Authorized - currentId: 1

abort:F fail:F start:F timeout:F success:T

PAE: state: Authenticated - portMode: Auto

PAE: reAuthCount: 0 - rxRespId: 0

PAE: quietPeriod: 60 - maxReauthReq: 2 - txPeriod: 30

BE: state: Idle - reqCount: 0 - idFromServer: 0

CD: adminControlledDirections: in - operControlledDirections: in

CD: bridgeDetected: false

KR: rxKey: false

KT: keyAvailable: false - keyTxEnabled: false

criticalState: off

dynamicVlanId: 2

802.1X statistics for interface port1.0.2

EAPOL Frames Rx: 5 - EAPOL Frames Tx: 16

EAPOL Start Frames Rx: 0 - EAPOL Logoff Frames Rx: 0

EAP Rsp/Id Frames Rx: 3 - EAP Response Frames Rx: 2

EAP Req/Id Frames Tx: 8 - EAP Request Frames Tx: 2

Invalid EAPOL Frames Rx: 0 - EAP Length Error Frames Rx: 0

EAPOL Last Frame Version Rx: 1 - EAPOL Last Frame Src: 00d0.59ab.7037

Authentication session statistics for interface port1.0.2

session user name: manager

session authentication method: Remote server

session time: 19440 secs

session terminate cause: Not terminated yet

Authentication Diagnostics for interface port1.0.2

Supplicant address: 00d0.59ab.7037

authEnterConnecting: 2

authEaplogoffWhileConnecting: 1

authEnterAuthenticating: 2

authSuccessWhileAuthenticating: 1

authTimeoutWhileAuthenticating: 1

authFailWhileAuthenticating: 0

authEapstartWhileAuthenticating: 0

Table 1: Example output from the show dot1x all command (cont.)

C613-50292-01 Rev A Command Reference for IE210L Series 1110

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X

authEaplogoggWhileAuthenticating: 0

authReauthsWhileAuthenticated: 0

authEapstartWhileAuthenticated: 0

authEaplogoffWhileAuthenticated: 0

BackendResponses: 2

BackendAccessChallenges: 1

BackendOtherrequestToSupplicant: 3

BackendAuthSuccess: 1

BackendAuthFails: 0

Table 1: Example output from the show dot1x all command (cont.)

C613-50292-01 Rev A Command Reference for IE210L Series 1111

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X DIAGNOSTICS

show dot1x diagnostics

Overview This command shows 802.1X authentication diagnostics for the specified interface

(optional), which may be a static channel (or static aggregator) or a dynamic (or

LACP) channel group or a switch port.

If no interface is specified then authentication diagnostics are shown for all

interfaces.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show dot1x diagnostics [interface <interface-list>]

Mode Privileged Exec

Example See the sample output below showing 802.1X authentication diagnostics for

port1.0.2:

awplus# show dot1x diagnostics interface port1.0.2

Parameter Description

interface Specify a port to show.

<interface-list> The interfaces or ports to configure. An interface-list can be:

• an interface (e.g. vlan2), a switch port (e.g. port1.0.6),

a static channel group (e.g. sa2) or a dynamic (LACP)

channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or

sa1-2, or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.2-1.0.4. Do not mix interface

types in a list

The specified interfaces must exist.

C613-50292-01 Rev A Command Reference for IE210L Series 1112

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X DIAGNOSTICS

Output Figure 33-1: Example output from the show dot1x diagnostics command

Authentication Diagnostics for interface port1.0.2

Supplicant address: 00d0.59ab.7037

authEnterConnecting: 2

authEaplogoffWhileConnecting: 1

authEnterAuthenticating: 2

authSuccessWhileAuthenticating: 1

authTimeoutWhileAuthenticating: 1

authFailWhileAuthenticating: 0

authEapstartWhileAuthenticating: 0

authEaplogoggWhileAuthenticating: 0

authReauthsWhileAuthenticated: 0

authEapstartWhileAuthenticated: 0

authEaplogoffWhileAuthenticated: 0

BackendResponses: 2

BackendAccessChallenges: 1

BackendOtherrequestToSupplicant: 3

BackendAuthSuccess: 1

C613-50292-01 Rev A Command Reference for IE210L Series 1113

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X INTERFACE

show dot1x interface

Overview This command shows the status of 802.1X port-based authentication on the

specified interface, which may be a static channel (or static aggregator) or a

dynamic (or LACP) channel group or a switch port.

Use the optional diagnostics parameter to show authentication diagnostics for

the specified interfaces. Use the optional sessionstatistics parameter to show

authentication session statistics for the specified interfaces. Use the optional

statistics parameter to show authentication diagnostics for the specified

interfaces. Use the optional supplicant parameter to show the supplicant state for

the specified interfaces.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare_Plus” Feature Overview and Configuration Guide.

Syntax show dot1x interface <interface-list>

[diagnostics|sessionstatistics|statistics|supplicant [brief]]

Mode Privileged Exec

Examples See the sample output below showing 802.1X authentication status for port1.0.2:

awplus# show dot1x interface port1.0.2

Parameter Description

<interface-list> The interfaces or ports to configure. An interface-list can be:

• an interface (e.g. vlan2), a switch port (e.g.

port1.0.6), a static channel group (e.g. sa2) or a

dynamic (LACP) channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or

sa1-2, or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.3-1.0.5. Do not mix

interface types in a list

The specified interfaces must exist.

diagnostics Diagnostics.

sessionstatistics Session statistics.

statistics Statistics.

supplicant Supplicant.

brief Brief summary of supplicant state.

C613-50292-01 Rev A Command Reference for IE210L Series 1114

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X INTERFACE

See the sample output below showing 802.1X authentication session statistics for

port1.0.2:

awplus# show dot1x interface port1.0.2 sessionstatistics

See sample output below showing 802.1X authentication diagnostics for port1.0.2:

awplus# show dot1x interface port1.0.2 diagnostics

Table 2: Example output from the show dot1x interface command for a port

awplus#show dot1x interface port1.0.2

Authentication info for interface port1.0.2

portEnabled: true - portControl: Auto

portStatus: Authorized

reAuthenticate: disabled

reAuthPeriod: 3600

PAE: quietPeriod: 60 - maxReauthReq: 2 - txPeriod: 30

PAE: connectTimeout: 30 

BE: suppTimeout: 30 - serverTimeout: 30

CD: adminControlledDirections: in

KT: keyTxEnabled: false

critical: disabled

guestVlan: disabled

dynamicVlanCreation: single-dynamic-vlan

assignFailActionRule: deny

multiVlanSession: disabled

hostMode: multi-supplicant

maxSupplicant:

1024

dot1x: enabled

protocolVersion: 1

authMac: enabled

method: PAP

reauthRelearning: disabled

authWeb: enabled

method: PAP

lockCount: 3

packetForwarding: disabled

twoStepAuthentication:

configured: enabled

actual: enabled

supplicantMac: none

awplus#show dot1x interface port1.0.2 sessionstatistics

Authentication session statistics for interface port1.0.2

session user name: manager

session authentication method: Remote server

session time: 19440 secs

session terminat cause: Not terminated yet

C613-50292-01 Rev A Command Reference for IE210L Series 1115

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X INTERFACE

See sample output below showing the supplicant on the interface port1.0.2:

awplus# show dot1x interface port1.0.2 supplicant

See sample output below showing 802.1X (dot1x) authentication statistics for

port1.0.2:

awplus# show dot1x statistics interface port1.0.2

awplus#show dot1x interface port1.0.2 diagnostics

Authentication Diagnostics for interface port1.0.2

Supplicant address: 00d0.59ab.7037

authEnterConnecting: 2

authEaplogoffWhileConnecting: 1

authEnterAuthenticating: 2

authSuccessWhileAuthenticating: 1

authTimeoutWhileAuthenticating: 1

authFailWhileAuthenticating: 0

authEapstartWhileAuthenticating: 0

authEaplogoggWhileAuthenticating: 0

authReauthsWhileAuthenticated: 0

authEapstartWhileAuthenticated: 0

authEaplogoffWhileAuthenticated: 0

BackendResponses: 2

BackendAccessChallenges: 1

BackendOtherrequestToSupplicant: 3

BackendAuthSuccess: 1

awplus#show dot1x interface port1.0.2 supplicant

authenticationMethod: dot1x

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 1

webBasedAuthenticationSupplicantNum: 0

Supplicant name: manager

Supplicant address: 00d0.59ab.7037

authenticationMethod: dot1x

portStatus: Authorized - currentId: 4

abort:F fail:F start:F timeout:F success:T

PAE: state: Authenticated - portMode: Auto

PAE: reAuthCount: 0 - rxRespId: 0

PAE: quietPeriod: 60 - maxReauthReq: 2 - txPeriod: 30

BE: state: Idle - reqCount: 0 - idFromServer: 3

BE: suppTimeout: 30 - serverTimeout: 30

CD: adminControlledDirections: in -

operControlledDirections: in

CD: bridgeDetected: false

KR: rxKey: false

KT: keyAvailable: false - keyTxEnabled: false

C613-50292-01 Rev A Command Reference for IE210L Series 1116

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X INTERFACE

awplus#show dot1x statistics interface port1.0.2

802.1X statistics for interface port1.0.2

EAPOL Frames Rx: 5 - EAPOL Frames Tx: 16

EAPOL Start Frames Rx: 0 - EAPOL Logoff Frames Rx: 0

EAP Rsp/Id Frames Rx: 3 - EAP Response Frames Rx: 2

EAP Req/Id Frames Tx: 8 - EAP Request Frames Tx: 2

Invalid EAPOL Frames Rx: 0 - EAP Length Error Frames Rx: 0

EAPOL Last Frame Version Rx: 1 - EAPOL Last Frame 

Src:00d0.59ab.7037

Table 33-1: Parameters in the output of show dot1x interface

Parameter Description

portEnabled Interface operational status

(Up-true/down-false).

portControl Current control status of the port for 802.1X

control.

portStatus 802.1X status of the port

(authorized/unauthorized).

reAuthenticate Reauthentication enabled/disabled status on

port.

reAuthPeriod Value holds meaning only if reauthentication

is enabled.

abort Indicates that authentication should be

aborted when set to true.

fail Indicates failed authentication attempt when

set to false.

start Indicates authentication should be started

when set to true.

timeout Indicates authentication attempt timed out

when set to true.

success Indicates authentication successful when set

to true.

state Current 802.1X operational state of interface.

mode Configured 802.1X mode.

reAuthCount Reauthentication count.

quietperiod Time between reauthentication attempts.

reAuthMax Maximum reauthentication attempts.

C613-50292-01 Rev A Command Reference for IE210L Series 1117

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X INTERFACE

Commands

show auth diagnostics

show dot1x sessionstatistics

show dot1x statistics interface

show dot1x supplicant interface

BE Backend authentication state machine

variables and constants.

state State of the state machine.

reqCount Count of requests sent to server.

suppTimeout Supplicant timeout.

serverTimeout Server timeout.

maxReq Maximum requests to be sent.

CD Controlled Directions State machine.

adminControlledDirections Administrative value (Both/In).

operControlledDirections Operational Value (Both/In).

KR Key receive state machine.

rxKey True when EAPOL-Key message is received by

supplicant or authenticator. false when key is

transmitted.

KT Key Transmit State machine.

keyAvailable False when key has been transmitted by

authenticator, true when new key is available

for key exchange.

keyTxEnabled Key transmission enabled/disabled status.

Table 33-1: Parameters in the output of show dot1x interface (cont.)

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1118

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X SESSIONSTATISTICS

show dot1x sessionstatistics

Overview This command shows authentication session statistics for the specified interface,

which may be a static channel (or static aggregator) or a dynamic (or LACP)

channel group or a switch port.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show dot1x sessionstatistics [interface <interface-list>]

Mode Privileged Exec

Example See sample output below showing 802.1X (dot1x) authentication session statistics

for port1.0.2:

awplus# show dot1x sessionstatistics interface port1.0.2

Parameter Description

interface Specify a port to show.

<interface-list> The interfaces or ports to configure. An interface-list can be:

•an interface (e.g. vlan2), a switch port (e.g. port1.0.6),

a static channel group (e.g. sa2) or a dynamic (LACP)

channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or

sa1-2, or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.4-1.0.6. Do not mix interface

types in a list

The specified interfaces must exist.

Authentication session statistics for interface port1.0.2

session user name: manager

session authentication method: Remote server

session time: 19440 secs

session terminat cause: Not terminated yet

C613-50292-01 Rev A Command Reference for IE210L Series 1119

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X STATISTICS INTERFACE

show dot1x statistics interface

Overview This command shows the authentication statistics for the specified interface,

which may be a static channel (or static aggregator) or a dynamic (or LACP)

channel group or a switch port.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show dot1x statistics interface <interface-list>

Mode Privileged Exec

Example See sample output below showing 802.1X authentication statistics for port1.0.2:

awplus# show dot1x statistics interface port1.0.2

Parameter Description

<interface-list> The interfaces or ports to configure. An interface-list can be:

•an interface (e.g. vlan2), a switch port (e.g. port1.0.6),

a static channel group (e.g. sa2) or a dynamic (LACP)

channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or sa1-2,

or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.4-1.0.6. Do not mix interface

types in a list

The specified interfaces must exist.

802.1X statistics for interface port1.0.2

EAPOL Frames Rx: 5 - EAPOL Frames Tx: 16

EAPOL Start Frames Rx: 0 - EAPOL Logoff Frames Rx: 0

EAP Rsp/Id Frames Rx: 3 - EAP Response Frames Rx: 2

EAP Req/Id Frames Tx: 8 - EAP Request Frames Tx: 2

Invalid EAPOL Frames Rx: 0 - EAP Length Error Frames Rx: 0

EAPOL Last Frame Version Rx: 1 - EAPOL Last Frame 

Src:00d0.59ab.7037

C613-50292-01 Rev A Command Reference for IE210L Series 1120

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X SUPPLICANT

show dot1x supplicant

Overview This command shows the supplicant state of the authentication mode set for the

switch.

This command shows a summary when the optional brief parameter is used.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare_Plus” Feature Overview and Configuration Guide.

Syntax show dot1x supplicant [<macadd>] [brief]

Mode Privileged Exec

Example See sample output below showing the 802.1X authenticated supplicant on the

switch:

awplus# show dot1x supplicant

Parameter Description

<macadd>MAC (hardware) address of the Supplicant.

brief Brief summary of the Supplicant state.

authenticationMethod: dot1x

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 1

webBasedAuthenticationSupplicantNum: 0

Supplicant name: manager

Supplicant address: 00d0.59ab.7037

authenticationMethod: dot1x

Two-Step Authentication:

firstAuthentication: Pass - Method: mac

secondAuthentication: Pass - Method: dot1x

portStatus: Authorized - currentId: 4

abort:F fail:F start:F timeout:F success:T

PAE: state: Authenticated - portMode: Auto

PAE: reAuthCount: 0 - rxRespId: 0

PAE: quietPeriod: 60 - maxReauthReq: 2 - txPeriod: 30

BE: state: Idle - reqCount: 0 - idFromServer: 3

BE: suppTimeout: 30 - serverTimeout: 30

CD: adminControlledDirections: in - operControlledDirections: in

CD: bridgeDetected: false

KR: rxKey: false

KT: keyAvailable: false - keyTxEnabled: false

RADIUS server group (auth): radius

RADIUS server (auth): 192.168.1.40

C613-50292-01 Rev A Command Reference for IE210L Series 1121

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X SUPPLICANT

See sample output below showing the supplicant on the switch using the brief

parameter:

awplus# show dot1x supplicant 00d0.59ab.7037 brief

See sample output below showing the supplicant on the switch using the brief

parameter:

awplus# show dot1x supplicant brief

For example, if two-step authentication is configured with 802.1X authentication

as the first method and web authentication as the second method then the output

is as follows:

Commands

show dot1x supplicant interface

Interface port1.0.2

authenticationMethod: dot1x

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 1

webBasedAuthenticationSupplicantNum: 0

Interface VID Mode MAC Address Status IP Address Username

========== === ==== =============== ============= ============== ========

port1.0.2 2 D 00d0.59ab.7037 Authenticated 192.168.2.201 manager

Interface port1.0.2 authenticationMethod: dot1x/web

Two-Step Authentication

firstMethod: dot1x

secondMethod: web

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 0

webBasedAuthenticationSupplicantNum: 1

otherAuthenticationSupplicantNum: 0



Interface VID Mode MAC Address Status IP Address Username

=========== ==== ==== ============== ================= =============== ========

port1.0.2 5 W 0008.0d5e.c216 Authenticated 192.168.1.200 web

C613-50292-01 Rev A Command Reference for IE210L Series 1122

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X SUPPLICANT INTERFACE

show dot1x supplicant interface

Overview This command shows the supplicant state of the authentication mode set for the

interface, which may be a static channel (or static aggregator) or a dynamic (or

LACP) channel group or a switch port.

This command shows a summary when the optional brief parameter is used.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare_Plus” Feature Overview and Configuration Guide.

Syntax show dot1x supplicant interface <interface-list> [brief]

Mode Privileged Exec

Examples See sample output below showing the supplicant on the interface port1.0.2:

awplus# show dot1x supplicant interface port1.0.2

Parameter Description

<interface-list> The interfaces or ports to configure. An interface-list can be:

•an interface (e.g. vlan2), a switch port (e.g. port1.0.6),

a static channel group (e.g. sa2) or a dynamic (LACP)

channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or

sa1-2, or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.4-1.0.6. Do not mix interface

types in a list

The specified interfaces must exist.

brief Brief summary of the Supplicant state.

C613-50292-01 Rev A Command Reference for IE210L Series 1123

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X SUPPLICANT INTERFACE

See sample output below showing the supplicant on the switch using the brief

parameter:

awplus# show dot1x supplicant interface brief

See the sample output below for static channel group (static aggregator) interface

sa1:

awplus# show dot1x interface sa1 supplicant brief

Interface port1.0.2

authenticationMethod: dot1x

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 1

webBasedAuthenticationSupplicantNum: 0

otherAuthenticationSupplicantNum: 0



Supplicant name: VCSPCVLAN10

Supplicant address: 0000.cd07.7b60

authenticationMethod: 802.1X

Two-Step Authentication:

firstAuthentication: Pass - Method: mac

secondAuthentication: Pass - Method: dot1x

portStatus: Authorized - currentId: 3

abort:F fail:F start:F timeout:F success:T

PAE: state: Authenticated - portMode: Auto

PAE: reAuthCount: 0 - rxRespId: 0

PAE: quietPeriod: 60 - maxReauthReq: 2

BE: state: Idle - reqCount: 0 - idFromServer: 2

CD: adminControlledDirections:in - 

operControlledDirections:in

CD: bridgeDetected: false

KR: rxKey: false

KT: keyAvailable: false - keyTxEnabled: false

Interface port1.0.2

authenticationMethod: dot1x

Two-Step Authentication:

firstMethod: mac

secondMethod: dot1x

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 1

webBasedAuthenticationSupplicantNum: 0



Interface VID Mode MAC Address Status IP Address Username

========= === ==== =========== ====== ========== ========

port1.0.2 2 D 00d0.59ab.7037 Authenticated 192.168.2.201 manager

C613-50292-01 Rev A Command Reference for IE210L Series 1124

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

SHOW DOT1X SUPPLICANT INTERFACE

Commands

show dot1x supplicant

awplus#show dot1x interface sa1 supplicant brief

Interface sa1

authenticationMethod: dot1x

Two-Step Authentication:

firstMethod: mac

secondMethod: dot1x

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 1

webBasedAuthenticationSupplicantNum: 0

otherAuthenticationSupplicantNum: 0



Interface VID Mode MAC Address Status IP Address Username

========= ==== ==== ============== ================= =============== ========

sa1 1 D 00d0.59ab.7037 Authenticated -- test1

C613-50292-01 Rev A Command Reference for IE210L Series 1125

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

802.1X COMMANDS

UNDEBUG DOT1X

undebug dot1x

Overview This command applies the functionality of the no variant of the debug dot1x

command.

C613-50292-01 Rev A Command Reference for IE210L Series 1126

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Authentication

Commands

Introduction

Overview This chapter provides an alphabetical reference for authentication commands. For

more information, see the AAA and Port Authentication Feature Overview and

Configuration Guide.

Command List •“auth auth-fail vlan” on page 1129

•“auth critical” on page 1131

•“auth dhcp-framed-ip-lease” on page 1132

•“auth dynamic-vlan-creation” on page 1134

•“auth guest-vlan” on page 1137

•“auth guest-vlan forward” on page 1139

•“auth host-mode” on page 1141

•“auth log” on page 1143

•“auth max-supplicant” on page 1145

•“auth multi-vlan-session” on page 1147

•“auth profile (Global Configuration)” on page 1148

•“auth profile (Interface Configuration)” on page 1149

•“auth reauthentication” on page 1150

•“auth roaming disconnected” on page 1151

•“auth roaming enable” on page 1153

•“auth supplicant-ip” on page 1155

•“auth supplicant-mac” on page 1157

•“auth timeout connect-timeout” on page 1160

C613-50292-01 Rev A Command Reference for IE210L Series 1127

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

•“auth timeout quiet-period” on page 1162

•“auth timeout reauth-period” on page 1163

•“auth timeout server-timeout” on page 1165

•“auth timeout supp-timeout” on page 1167

•“auth two-step enable” on page 1169

•“auth-mac accounting” on page 1172

•“auth-mac authentication” on page 1173

•“auth-mac enable” on page 1174

•“auth-mac method” on page 1176

•“auth-mac password” on page 1178

•“auth-mac reauth-relearning” on page 1179

•“auth-mac static” on page 1181

•“auth-mac username” on page 1182

•“auth-web accounting” on page 1183

•“auth-web authentication” on page 1184

•“auth-web enable” on page 1185

•“auth-web forward” on page 1187

•“auth-web max-auth-fail” on page 1190

•“auth-web method” on page 1192

•“auth-web-server blocking-mode” on page 1193

•“auth-web-server dhcp ipaddress” on page 1194

•“auth-web-server dhcp lease” on page 1195

•“auth-web-server dhcp-wpad-option” on page 1196

•“auth-web-server host-name” on page 1197

•“auth-web-server intercept-port” on page 1198

•“auth-web-server ipaddress” on page 1199

•“auth-web-server page language” on page 1200

•“auth-web-server login-url” on page 1201

•“auth-web-server page logo” on page 1202

•“auth-web-server page sub-title” on page 1203

•“auth-web-server page success-message” on page 1204

•“auth-web-server page title” on page 1205

•“auth-web-server page welcome-message” on page 1206

•“auth-web-server ping-poll enable” on page 1207

•“auth-web-server ping-poll failcount” on page 1208

C613-50292-01 Rev A Command Reference for IE210L Series 1128

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

•“auth-web-server ping-poll interval” on page 1209

•“auth-web-server ping-poll reauth-timer-refresh” on page 1210

•“auth-web-server ping-poll timeout” on page 1211

•“auth-web-server port” on page 1212

•“auth-web-server redirect-delay-time” on page 1213

•“auth-web-server redirect-url” on page 1214

•“auth-web-server session-keep” on page 1215

•“auth-web-server ssl” on page 1216

•“auth-web-server ssl intercept-port” on page 1217

•“copy proxy-autoconfig-file” on page 1218

•“copy web-auth-https-file” on page 1219

•“description (Authentication Profile)” on page 1220

•“erase proxy-autoconfig-file” on page 1221

•“erase web-auth-https-file” on page 1222

•“platform l3-vlan-hashing-algorithm” on page 1223

•“platform mac-vlan-hashing-algorithm” on page 1224

•“show auth” on page 1225

•“show auth diagnostics” on page 1227

•“show auth interface” on page 1229

•“show auth sessionstatistics” on page 1232

•“show auth statistics interface” on page 1233

•“show auth supplicant” on page 1234

•“show auth supplicant interface” on page 1237

•“show auth two-step supplicant brief” on page 1238

•“show auth-web-server” on page 1239

•“show auth-web-server page” on page 1240

•“show proxy-autoconfig-file” on page 1241

C613-50292-01 Rev A Command Reference for IE210L Series 1129

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH AUTH-FAIL VLAN

auth auth-fail vlan

Overview Use this command to enable the auth-fail vlan feature on the specified vlan

interface. This feature assigns supplicants (client devices) to the specified VLAN if

they fail port authentication.

Use the no variant of this command to disable the auth-fail vlan feature for a

specified VLAN interface.

Syntax auth auth-fail vlan <1-4094>

no auth auth-fail vlan

Default The auth-fail vlan feature is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage Use the auth-fail vlan feature when using Web-Authentication instead of the Guest

VLAN feature, when you need to separate networks where one supplicant (client

device) requires authentication and another supplicant does not require

authentication from the same interface.

This is because the DHCP lease time using the Web-Authentication feature is

shorter, and the auth-fail vlan feature enables assignment to a different VLAN if a

supplicant fails authentication.

To enable the auth-fail vlan feature with Web Authentication, you need to set the

Web Authentication Server virtual IP address by using the auth-web-server

ipaddress command or the auth-web-server dhcp ipaddress command.

When using 802.1X port authentication, use a dot1x max-auth-fail command to set

the maximum number of login attempts. Three login attempts are allowed by

default for 802.1X port authentication before supplicants trying to authenticate

are moved from the Guest VLAN to the auth-fail VLAN. See the dot1x max-auth-fail

on page 1099 for command information.

See the AAA and Port Authentication Feature Overview and Configuration Guide

for information about:

• the auth-fail VLAN feature, which allows the Network Administrator to

separate the supplicants who attempted authentication, but failed, from the

supplicants who did not attempt authentication, and

• restrictions regarding combinations of authentication enhancements

working together

Use appropriate ACLs (Access Control Lists) on interfaces for extra security if a

supplicant allocated to the designated auth-fail vlan can access the same network

Parameter Description

<1-4094>Assigns the VLAN ID to any supplicants that have failed port

authentication.

C613-50292-01 Rev A Command Reference for IE210L Series 1130

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH AUTH-FAIL VLAN

as a supplicant on the Guest VLAN. For more information about ACL concepts, and

configuring ACLs see the ACL Feature Overview and Configuration Guide. For

more information about ACL commands see:

•IPv4 Hardware Access Control List (ACL) Commands

•IPv4 Software Access Control List (ACL) Commands

•IPv6 Software Access Control List (ACL) Commands

Examples To enable the auth-fail vlan feature for port1.0.2 and assign VLAN 100, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth auth-fail vlan 100

To disable the auth-fail vlan feature for port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth auth-fail vlan

To enable the auth-fail vlan feature on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth auth-fail vlan 100

To disable the auth-fail vlan feature on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth auth-fail vlan

Commands

auth profile (Global Configuration)

dot1x max-auth-fail

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1131

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH CRITICAL

auth critical

Overview This command enables the critical port feature on the interface. When the critical

port feature is enabled on an interface, and all the RADIUS servers are unavailable,

then the interface becomes authorized.

The no variant of this command disables the critical port feature on the interface.

Syntax auth critical

no auth critical

Default The critical port of port authentication is disabled.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To enable the critical port feature on interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth critical

To disable the critical port feature on interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth critical

To enable the critical port feature on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth critical

To disable the critical port feature on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth critical

Commands

auth profile (Global Configuration)

show auth-web-server

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1132

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH DHCP-FRAMED-IP-LEASE

auth dhcp-framed-ip-lease

Overview Use this command to enable DHCP Framed IP Lease on an interface.

When the DHCP Framed IP Lease feature is enabled on an interface, supplicants

authenticated using 802.1x or MAC authentication will be assigned a specific IP

address, and other network settings, gathered from the RADIUS server during the

authentication process.

Use the no variant of this command to disable DHCP Framed IP Lease.

Syntax auth dhcp-framed-ip-lease

no auth dhcp-framed-ip-lease

Default DHCP Framed IP Lease is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage You need to complete the following steps to configure the DHCP Framed IP Lease

feature on your network.

On the RADIUS server:

• Configure the RADIUS server with the username and password for 802.1x or

MAC authentication

• Configure the following ‘framed’ RADIUS attributes on the RADIUS server for

the that user:

– Framed-IP-Address (8): the IPv4 address for the supplicant

– Framed-IP-Netmask (9): the netmask for the supplicant

– Framed-Route (22): the default gateway IPv4 address for the

supplicant

– Session-Timeout (27): IP address lease time for the supplicant

NOTE: The Frame-IP-Address (8) attribute must be configured for this feature to work.

All other attributes are optional.

On the DHCP server:

•Configure the RADIUS client

• Enable 802.1x or MAC authentication on the required interface/s

• Enable DHCP Framed IP Lease feature on the required interface/s

• Setup a DHCP pool with the network range for the IP address/es registered

on the RADIUS server

•Enable DHCP server

For more information, see the AAA and Port Authentication Feature Overview and

Configuration Guide.

C613-50292-01 Rev A Command Reference for IE210L Series 1133

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH DHCP-FRAMED-IP-LEASE

Example To enable DHCP Framed IP Lease on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# auth dhcp-framed-ip-lease

To disable DHCP Framed IP Lease on port1.0.1, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.1

awplus(config-if)# no auth dhcp-framed-ip-lease

Commands

show dot1x supplicant

show ip dhcp pool

Command

changes

Version 5.4.8-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1134

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH DYNAMIC-VLAN-CREATION

auth dynamic-vlan-creation

Overview This command enables and disables the Dynamic VLAN assignment feature.

The Dynamic VLAN assignment feature allows a supplicant (client device) to be

placed into a specific VLAN based on information returned from the RADIUS server

during authentication, on a given interface.

Use the no variant of this command to disable the Dynamic VLAN assignment

feature.

Syntax auth dynamic-vlan-creation [rule {deny|permit}] [type

{multi|single}]

no auth dynamic-vlan-creation

Default By default, the Dynamic VLAN assignment feature is disabled.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage If the Dynamic VLAN assignment feature is enabled, VLAN assignment is dynamic.

If the Dynamic VLAN assignment feature is disabled then RADIUS attributes are

ignored and configured VLANs are assigned to ports. Dynamic VLANs may be

associated with authenticated MAC addresses if the type parameter is applied

with the rule parameter.

The rule parameter deals with the case where there are multiple supplicants

attached to a port, and the type parameter has been set to single-vlan. The

parameter specifies how the switch should act if different VLAN IDs end up being

assigned to different supplicants. The keyword value deny means that once a

given VID has been assigned to the first supplicant, then if any subsequent

supplicant is assigned a different VID, that supplicant is rejected. The keyword

value permit means that once a given VID has been assigned to the first

supplicant, then if any subsequent supplicant is assigned a different VID, that

supplicant is accepted, but it is actually assigned the same VID as the first

supplicant.

Parameter Description

rule VLAN assignment rule.

deny Deny a differently assigned VLAN ID. This is the default rule.

permit Permit a differently assigned VLAN ID.

type Specifies whether multiple different VLANs can be assigned to

supplicants (client devices) attached to the port, or whether only a

single VLAN can be assigned to supplicants on the port.

multi Multiple Dynamic VLAN.

single Single Dynamic VLAN.

C613-50292-01 Rev A Command Reference for IE210L Series 1135

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH DYNAMIC-VLAN-CREATION

If you issue an auth dynamic-vlan-creation command without a rule parameter

then a second supplicant with a different VLAN ID is rejected. It is not assigned to

the first supplicant’s VLAN. Issuing an auth dynamic-vlan-creation command

without a rule parameter has the same effect as issuing an auth

dynamic-vlan-creation rule deny command rejecting supplicants with differing

VIDs.

The type parameter specifies whether multiple different VLANs can be assigned to

supplicants attached to the port, or whether only a single VLAN can be assigned to

supplicants on the port. The type parameter can select the port base VLAN or the

MAC base VLAN from the RADIUS VLAN ID. This can be used when the host-mode

is set to multi-supplicant. For single-host ports, the VLAN ID will be assigned to the

port. It is not supported with the Guest VLAN feature. Display the ID assigned using

a show vlan command. For multi-host ports, the VLAN ID will be assigned to the

MAC address of the authenticated supplicant. The VLAN ID assigned for the MAC

Base VLAN is displayed using the show platform table vlan command.

To configure Dynamic Vlan with Web Authentication, you need to set Web

Authentication Server virtual IP address by using the auth-web-server ipaddress

command or the auth-web-server dhcp ipaddress command. You also need to

create a hardware access-list that can be applied to the switch port interface.

You need to configure an IPv4 address for the VLAN interface on which Web

Authentication is running.

Examples To enable the Dynamic VLAN assignment feature on interface port1.0.2, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport access vlan 10

awplus(config-if)# auth-web enable

awplus(config-if)# auth dynamic-vlan-creation

awplus(config-if)# interface vlan10

awplus(config-if)# ip address 10.1.1.1/24

To enable the Dynamic VLAN assignment feature with Web Authentication on

interface port1.0.2 when Web Authentication is needed, use the commands:

awplus# configure terminal

awplus(config)# auth-web-server ipaddress 1.2.3.4

awplus(config)# access-list hardware acl-web send-to-cpu ip any

1.2.3.4

awplus(config)# interface port1.0.2

awplus(config-if)# auth-web enable

awplus(config-if)# auth dynamic-vlan-creation

awplus(config-if)# access-group acl-web

awplus(config-if)# interface vlan1

awplus(config-if)# ip address 10.1.1.1/24

C613-50292-01 Rev A Command Reference for IE210L Series 1136

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH DYNAMIC-VLAN-CREATION

To disable the Dynamic VLAN assignment feature on interface port1.0.2, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth dynamic-vlan-creation

To enable the Dynamic VLAN assignment feature on authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth dynamic-vlan-creation

To disable the Dynamic VLAN assignment feature on authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth dynamic-vlan-creation

Commands

auth profile (Global Configuration)

auth host-mode

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1137

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH GUEST-VLAN

auth guest-vlan

Overview This command enables and configures the Guest VLAN feature on the interface

specified by associating a Guest VLAN with an interface. This command does not

start authentication. The supplicant's (client device’s) traffic is associated with the

native VLAN of the interface if its not already associated with another VLAN. The

routing option enables routing from the Guest VLAN to another VLAN, so the

switch can lease DHCP addresses and accept access to a limited network.

The no variant of this command disables the guest VLAN feature on the interface

specified.

Syntax auth guest-vlan <1-4094> [routing]

no auth guest-vlan [routing]

Default The Guest VLAN authentication feature is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage The Guest VLAN feature may be used by supplicants (client devices) that have not

attempted authentication, or have failed the authentication process. Note that if a

port is in multi-supplicant mode with per-port dynamic VLAN configuration, after

the first successful authentication, subsequent hosts cannot use the guest VLAN

due to the change in VLAN ID. This may be avoided by using per-user dynamic

VLAN assignment.

When using the Guest VLAN feature with the multi-host mode, a number of

supplicants can communicate via a guest VLAN before authentication. A

supplicant’s traffic is associated with the native VLAN of the specified switch port.

The supplicant must belong to a VLAN before traffic from the supplicant can be

associated.

Note that you must enable 802.1X on the port and define a VLAN using the vlan

command before you can configure it as a guest VLAN.

Roaming Authentication cannot be enabled if DHCP snooping is enabled (service

dhcp-snooping command), and vice versa.

Note that Guest VLAN can use only untagged ports.

See the AAA and Port Authentication Feature Overview and Configuration Guide

for information about:

• Guest VLAN, and

Parameter Description

<1-4094>VLAN ID (VID).

routing Enables routing from the Guest VLAN to other VLANs.

C613-50292-01 Rev A Command Reference for IE210L Series 1138

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH GUEST-VLAN

• restrictions regarding combinations of authentication enhancements

working together

Examples To define vlan100 and assign the guest VLAN feature to vlan100 on interface

port1.0.2, and enable routing from the guest VLAN to other VLANs, use the

following commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# vlan 100

awplus(config-vlan)# exit

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x port-control auto

awplus(config-if)# auth guest-vlan 100 routing

To disable the guest VLAN feature on port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth guest-vlan

To define vlan100 and assign the guest VLAN feature to vlan100 on authentication

profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# vlan database

awplus(config-vlan)# vlan 100

awplus(config-vlan)# exit

awplus(config)# auth profile student

awplus(config-auth-profile)# auth guest-vlan 100

To disable the guest VLAN feature on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth guest-vlan

Commands

auth profile (Global Configuration)

auth guest-vlan forward

dot1x port-control

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1139

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH GUEST-VLAN FORWARD

auth guest-vlan forward

Overview Use this command to enable packet forwarding from the Guest VLAN to a

destination IP address or subnet. If this command is configured, the device can

lease DHCP addresses and accept access to a limited part of your network. Also,

when using NAP authentication, the supplicant can log on to a domain controller

to gain certification.

Use the no variant of this command to disable packet forwarding from the Guest

VLAN to a destination IP address or subnet.

Syntax auth guest-vlan forward {<ip-address>|<ip-address/mask>}

[dns|tcp <1-65535>|udp <1-65535>]

no auth guest-vlan forward {<ip-address>|<ip-address/mask>}

[dns|tcp <1-65535>|udp <1-65535>]

Default Forwarding is disabled by default.

Mode Interface Configuration mode for a specified switch port, or Authentication Profile

mode

Usage Before using this command, you must configure the guest VLAN with the auth

guest-vlan command.

Example To enable packet forwarding from the guest VLAN to the destination IP address on

interface port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth guest-vlan forward 10.0.0.1

To enable forwarding of DNS packets from the guest VLAN to the destination IP

address on interface port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth guest-vlan forward 10.0.0.1 dns

Parameter Description

<ip-address>

<ip-address/



mask>

The IP address or subnet to which the guest VLAN can forward

packets, in dotted decimal notation

dns Enable forwarding of DNS packets

tcp <1-65535>Enable forwarding of packets for the specified TCP port number

udp <1-65535>Enable forwarding of packets for the specified UDP port number

C613-50292-01 Rev A Command Reference for IE210L Series 1140

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH GUEST-VLAN FORWARD

To disable forwarding of DNS packets from the guest VLAN to the destination IP

address on port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth guest-vlan forward 10.0.0.1 dns

To enable the tcp forwarding port 137 on authentication profile 'student', use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth guest-vlan forward 10.0.0.1

tcp 137

To disable the tcp forwarding port 137 authentication profile 'student', use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth guest-vlan forward

10.0.0.1 tcp 137

Commands

auth guest-vlan

auth profile (Global Configuration)

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1141

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH HOST-MODE

auth host-mode

Overview This command selects the host mode on the specified interface.

Use the no variant of this command to set host mode to the default setting (single

host).

Syntax auth host-mode {single-host|multi-host|multi-supplicant}

no auth host-mode

Default The default host mode for port authentication is for a single host.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage Ports residing in the unauthorized state for host(s) or supplicant(s), change to an

authorized state when the host or supplicant has successfully authenticated with

the Authentication Server.

When multi-host mode is used or auth critical feature is used, all hosts do not need

to be authenticated.

Examples To set the host mode to multi-supplicant on interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth host-mode multi-supplicant

Parameter Description

single-host Single host mode. In this mode, only one host may be

authorized with the port. If other hosts out the interface

attempt to authenticate, the authenticator blocks the

attempt.

multi-host Multi host mode. In this mode, multiple hosts may be

authorized with the port; however only one host must be

successfully authenticated at the Authentication Server for

all hosts to be authorized with the port. Upon one host being

successfully authenticated (state Authenticated), the other

hosts will be automatically authorized at the port (state

ForceAuthorized). If no host is successfully authenticated,

then all hosts are not authorized with the port.

multi-supplicant Multi supplicant (client device) mode. In this mode, multiple

hosts may be authorized with the port, but each host must

be individually authenticated with the Authentication Server

to be authorized with the port. Supplicants which are not

authenticated are not authorized with the port, while

supplicants which are successfully authenticated are

authorized with the port.

C613-50292-01 Rev A Command Reference for IE210L Series 1142

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH HOST-MODE

To set the host mode to default (single host) on interface port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth host-mode

To set the host mode to multi-supplicant on authentication profile ‘student’, use

the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth host-mode multi-supplicant

To set the host mode to default (single host) on authentication profile ‘student’,

use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth host-mode

Commands

auth profile (Global Configuration)

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1143

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH LOG

auth log

Overview Use this command to configure the types of authentication feature log messages

that are output to the log file.

Use the no variant of this command to remove either specified types or all types of

authentication feature log messages that are output to the log file.

Syntax auth log {dot1x|auth-mac|auth-web}

{success|failure|logoff|all}

no auth log {dot1x|auth-mac|auth-web}

{success|failure|logoff|all}

Default All types of authentication log messages are output to the log file by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To configure the logging of MAC authentication failures to the log file for

supplicants (client devices) connected to interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth log auth-mac failure

Parameter Description

dot1x Specify only 802.1X-Authentication log messages are output to the log

file.

auth-mac Specify only MAC-Authentication log messages are output to the log

file.

auth-web Specify only Web-Authentication log messages are output to the log

file.

success Specify only successful authentication log messages are output to the

log file.

failure Specify only authentication failure log messages are output to the log

file.

logoff Specify only authentication log-off messages are output to the log file.

Note that link down, age out and expired ping polling messages will be

included.

all Specify all types of authentication log messages are output to the log

file. Note that this is the default behavior for the authentication logging

feature.

C613-50292-01 Rev A Command Reference for IE210L Series 1144

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH LOG

To disable the logging of all types of authentication log messages to the log file for

supplicants (client devices) connected to interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth log all

To configure the logging of web authentication failures to the log file for

supplicants (client devices) connected to authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth log auth-web failure

To disable the logging of all types of authentication log messages to the log file for

supplicants (client devices) connected to authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth log all

Commands

auth profile (Global Configuration)

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1145

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH MAX-SUPPLICANT

auth max-supplicant

Overview This command sets the maximum number of supplicants (client devices) that can

be authenticated on the selected port. Once this value is exceeded, further

supplicants will not be authenticated.

The no variant of this command resets the maximum supplicant number to the

default.

Syntax auth max-supplicant <2-1024>

no auth max-supplicant

Default The max supplicant of port authentication is 1024.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To set the maximum number of supplicants to 10 on interface port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth max-supplicant 10

To reset the maximum number of supplicants to the default value on interface

port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth max-supplicant

To set the maximum number of supplicants to 10 on authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth max-supplicant 10

To reset the maximum number of supplicants to the default value on

authentication profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth max-supplicant

Parameter Description

<2-1024>Limit number.

C613-50292-01 Rev A Command Reference for IE210L Series 1146

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH MAX-SUPPLICANT

Commands

auth profile (Global Configuration)

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1147

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH MULTI-VLAN-SESSION

auth multi-vlan-session

Overview Use this command to enable packet forwarding on multiple VLANs for an

authenticated supplicant attached to a trunked (tagged VLAN) port.

By default, AlliedWare Plus only allows packet forwarding on the VLAN that a

device was authenticated on. This command enables packet forwarding to the

attached device on any VLAN configured on the switchport. After the device

authenticates it will have access to all VLANs configured on the switchport.

Use the no variant of this command to disable packet forwarding on multiple

VLANs for an authenticated supplicant.

Syntax auth multi-vlan-session

no auth multi-vlan-session

Default By default, multi-vlan-session is disabled.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Example To allow a client attached to port1.0.2 to access all VLANs configured on the

AlliedWare Plus device, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport mode trunk

awplus(config-if)# switchport trunk allowed vlan all

awplus(config-if)# auth host-mode multi-supplicant

awplus(config-if)# auth multi-vlan-session

To disable multi-vlan-session on interface port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth multi-vlan-session

Commands

auth-mac enable

auth-web enable

dot1x port-control

show auth interface

show dot1x interface

Command

changes

Version 5.4.8-1.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1148

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH PROFILE (GLOBAL CONFIGURATION)

auth profile (Global Configuration)

Overview Use this command to enter port authentication profile mode and configure a port

authentication profile.

If the specified profile does not exist a new authentication profile is created with

the name provided.

Use the no variant of this command to delete the specified port authentication

profile.

Syntax auth profile <profile-name>

no auth profile <profile-name>

Default No port authentication profiles are created by default.

Mode Global Configuration

Usage A port authentication profile is a configuration object that aggregates multiple

port authentication commands. These profiles are attached or detached from an

interface using the auth profile (Interface Configuration) command.

Example To create a new authentication profile ‘student’, use the following commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)#

To delete an authentication profile ‘student’, use the following commands:

awplus# configure terminal

awplus(config)# no auth profile student

Commands

auth profile (Interface Configuration)

description (Authentication Profile)

Parameter Description

<varname>Name of the profile to create or configure.

C613-50292-01 Rev A Command Reference for IE210L Series 1149

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH PROFILE (INTERFACE CONFIGURATION)

auth profile (Interface Configuration)

Overview Use this command to attach a port authentication profile to the current interface.

Use the no variant of this command to detach a port authentication profile from

the current interface.

Syntax auth profile <profile-name>

no auth profile <profile-name>

Default No profile is attached by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage This command attaches a authentication profile, created using the auth profile

(Global Configuration) command, to a static channel, a dynamic (LACP) channel

group, or a switch port.

You can only attach one profile to an interface at a time, use the no variant of the

command to detach a profile before attempting to attach another one.

Example To attach the authentication profile ‘student’ to port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth profile student

To detach the authentication profile ‘student’ from port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth profile student

Commands

auth profile (Global Configuration)

Parameter Description

<profile-name>The name of the profile to attach to the current interface.

C613-50292-01 Rev A Command Reference for IE210L Series 1150

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH REAUTHENTICATION

auth reauthentication

Overview This command enables re-authentication on the interface specified in the Interface

mode, which may be a static channel group (or static aggregator) or a dynamic (or

LACP) channel group or a switch port.

Use the no variant of this command to disable reauthentication on the interface.

Syntax auth reauthentication

no auth reauthentication

Default Reauthentication of port authentication is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To enable reauthentication on interface port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth reauthentication

To disable reauthentication on interface port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth reauthentication

To enable reauthentication on authentication profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth reauthentication

To disable reauthentication on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth reauthentication

Commands

auth profile (Global Configuration)

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1151

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH ROAMING DISCONNECTED

auth roaming disconnected

Overview This command allows a supplicant to move to another authenticating interface

without reauthentication, even if the link is down for the interface that the

supplicant is currently connected to.

You must enter the auth roaming enable command on both interfaces before

using this command.

The no variant of this command disables roaming authentication on interfaces

that are link-down, and forces a supplicant to be reauthenticated when moving

between interfaces.

See the AAA and Port Authentication Feature Overview and Configuration Guide

for further information about this feature.

Syntax auth roaming disconnected

no auth roaming disconnected

Default By default, the authentication status for a roaming supplicant is deleted when an

interface goes down, so supplicants must reauthenticate.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage Note that 802.1X port authentication, MAC-authentication, or Web-authentication

must be configured before using this feature. The port that the supplicant is

moving to must have the same authentication configuration as the port the

supplicant is moving from.

Roaming Authentication cannot be enabled if DHCP snooping is enabled (service

dhcp-snooping command), and vice versa.

Examples To allow supplicants to move from port1.0.2 without reauthentication even when

the link is down, when using 802.1X authentication, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# dot1x port-control auto

awplus(config-if)# auth roaming enable

awplus(config-if)# auth roaming disconnected

To require supplicants to reauthenticate when moving from port1.0.2 if the link is

down, when using 802.1X authentication, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth roaming disconnected

C613-50292-01 Rev A Command Reference for IE210L Series 1152

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH ROAMING DISCONNECTED

To allow supplicants using authentication profile ‘student’ to move between ports

without reauthentication even when the link is down, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth roaming disconnected

To require supplicants using authentication profile ‘student’ to reauthenticate

when moving between ports if the link is down, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth roaming disconnected

Commands

auth profile (Global Configuration)

auth-mac enable

auth roaming enable

auth-web enable

dot1x port-control

show auth interface

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1153

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH ROAMING ENABLE

auth roaming enable

Overview This command allows a supplicant to move to another authenticating interface

without reauthentication, providing the link is up for the interface that the

supplicant is is currently connected to.

The no variant of this command disables roaming authentication on an interface,

and forces a supplicant to be reauthenticated when moving between interfaces.

See the AAA and Port Authentication Feature Overview and Configuration Guide

for further information about this feature.

Syntax auth roaming enable

no auth roaming enable

Default Roaming authentication is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage Note that 802.1X port authentication, MAC-authentication, or Web-authentication

must be configured before using this feature. The port that the supplicant is

moving to must have the same authentication configuration as the port the

supplicant is moving from.

This command only enables roaming authentication for links that are up. If you

want roaming authentication on links that are down, you must also use the

command auth roaming disconnected.

Roaming Authentication cannot be enabled if DHCP snooping is enabled (service

dhcp-snooping command), and vice versa.

Examples To enable roaming authentication for port1.0.4, when using auth-mac

authentication, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.4

awplus(config-if)# auth-mac enable

awplus(config-if)# auth roaming enable

To disable roaming authentication for port1.0.4, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.4

awplus(config-if)# no auth roaming enable

To enable roaming authentication for authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth roaming enable

C613-50292-01 Rev A Command Reference for IE210L Series 1154

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH ROAMING ENABLE

To disable roaming authentication for authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth roaming enable

Commands

auth profile (Global Configuration)

auth-mac enable

auth roaming disconnected

auth-web enable

dot1x port-control

show auth interface

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1155

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH SUPPLICANT-IP

auth supplicant-ip

Overview This command adds a supplicant (client device) IP address on a given interface and

provides parameters for its configuration.

Use the no variant of this command to delete the supplicant IP address and reset

other parameters to their default values. The IP address can be determined before

authentication for only auth-web client.

Syntax auth supplicant-ip <ip-addr> [max-reauth-req <1-10>]

[port-control {auto|force-authorized|force-unauthorized}]

[quiet-period <1-65535>] [reauth-period <1-4294967295>]

[supp-timeout <1-65535>] [server-timeout <1-65535>]

[reauthentication]

no auth supplicant-ip <ip-addr> [reauthentication]

Parameter Description

<ip-addr>IP address of the supplicant entry in A.B.C.D/P format.

max-reauth-req The number of reauthentication attempts before

becoming unauthorized.

<1-10>Count of reauthentication attempts (default 2).

port-control Port control commands.

auto A port control parameter that allows port clients to

negotiate authentication.

force-authorized A port control parameter that forces the port state to

authorized.

force-unauthorized A port control parameter that forces the port state to

unauthorized.

quiet-period Quiet period during which the port remains in the HELD

state (default 60 seconds).

<1-65535>Seconds for quiet period.

reauth-period Seconds between reauthorization attempts (default 3600

seconds).

<1-4294967295>Seconds for reauthorization attempts (reauth-period).

supp-timeout Supplicant response timeout.

<1-65535>Seconds for supplicant response timeout (default 30

seconds).

server-timeout The period, in seconds, before the authentication server

response times out.

<1-65535>The server-timeout period, in seconds, default 3600

seconds.

reauthentication Enable reauthentication on a port.

C613-50292-01 Rev A Command Reference for IE210L Series 1156

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH SUPPLICANT-IP

Default No supplicant IP address for port authentication exists by default until first created

with the auth supplicant-ip command. The defaults for parameters applied are as

shown in the table above.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To add the supplicant IP address 192.168.10.0/24 to force authorized port control

for interface port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth supplicant-ip 192.168.10.0/24

port-control force-authorized

To delete the supplicant IP address 192.168.10.0/24 for interface port1.0.2, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth supplicant-ip 192.168.10.0/24

To disable reauthentication for the supplicant(s) IP address 192.168.10.0/24 for

interface port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth supplicant-ip 192.168.10.0/24

reauthentication

To add the supplicant IP address 192.168.10.0/24 to force authorized port control

for auth profile 'student', use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth supplicant-ip

192.168.10.0/24 port-control force-authorized

To disable reauthentication for the supplicant IP address 192.168.10.0/24, for auth

profile 'student', use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-if)# no auth supplicant-ip 192.168.10.0/24

reauthentication

Commands

show auth

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1157

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH SUPPLICANT-MAC

auth supplicant-mac

Overview This command adds a supplicant (client device) MAC address or MAC mask on a

given interface with the parameters as specified in the table below.

Use the no variant of this command to delete the supplicant MAC address and

reset other parameters to their default values.

Syntax auth supplicant-mac <mac-addr> [mask <mac-addr-mask>]

[max-reauth-req <1-10>] [port-control

{auto|force-authorized|force-unauthorized|skip-second-auth}]

[quiet-period <1-65535>] [reauth-period <1-4294967295>]

[supp-timeout <1-65535>] [server-timeout <1-65535>]

[reauthentication]

no auth supplicant-mac <mac-addr> [reauthentication]

Parameter Description

<mac-addr>MAC (hardware) address of the supplicant entry in

HHHH.HHHH.HHHH MAC address hexadecimal format.

mask A mask applied to MAC addresses in order to select only

those addresses containing a specific string.

<mac-addr-mask> The mask comprises a string of three (period separated)

bytes, where each byte comprises four hexadecimal

characters that will generally be either 1or 0. When the

mask is applied to a specific MAC address, a match is only

required for characters that correspond to a 1 in the mask.

Characters that correspond to a 0 in the mask are

effectively ignored.

In the examples section below, the mask ffff.ff00.0000 is

applied for the MAC address 0000.5E00.0000. The applied

mask will then match only those MAC addresses that begin

with 0000.5E (in this case the OUI component). The

remaining portion of the addresses (in this case the NIC

component) will be ignored.

port-control Port control commands.

auto Allow port client to negotiate authentication.

force-authorized Force port state to authorized.

force-unauthorized Force port state to unauthorized.

skip-second-auth Skip the second authentication.

quiet-period Quiet period in the HELD state (default 60 seconds).

<1-65535>Seconds for quiet period.

reauth-period Seconds between reauthorization attempts (default 3600

seconds).

<1-4294967295>Seconds for reauthorization attempts (reauth-period).

C613-50292-01 Rev A Command Reference for IE210L Series 1158

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH SUPPLICANT-MAC

Default No supplicant MAC address for port authentication exists by default until first

created with the auth supplicant-mac command. The defaults for parameters are

shown in the table above.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To add the supplicant MAC address 0000.5E00.5343 to force authorized port

control for port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth supplicant-mac 0000.5E00.5343

port-control force-authorized

To apply the mask ffff.ff00.0000 in order to add any supplicant whose MAC address

begins with 000.5E, and then to force authorized port control for port 1.0.2, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth supplicant-mac 0000.5E00.0000 mask

ffff.ff00.0000 port-control force-authorized

To delete the supplicant MAC address 0000.5E00.5343 for port1.0.2, use the

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth supplicant-mac 0000.5E00.5343

To reset reauthentication to disabled for the supplicant MAC address

0000.5E00.5343 for port1.0.2, use the commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth supplicant-mac 0000.5E00.5343

reauthentication

supp-timeout Supplicant response timeout (default 30 seconds).

<1-65535>Seconds for supplicant response timeout.

server-timeout Authentication server response timeout (default 30

seconds).

<1-65535>Seconds for authentication server response timeout.

reauthentication Enable reauthentication on a port.

max-reauth-req No of reauthentication attempts before becoming

unauthorized (default 2).

<1-10>Count of reauthentication attempts.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1159

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH SUPPLICANT-MAC

To add the supplicant MAC address 0000.5E00.5343 to force authorized port

control for authentication profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth supplicant-mac

0000.5E00.5343 port-control force-authorized

To delete the supplicant MAC address 0000.5E00.5343 for authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth supplicant-mac

0000.5E00.5343

To disable reauthentication for the supplicant MAC address 0000.5E00.5343 for

authentication profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth supplicant-mac

0000.5E00.5343 reauthentication

Commands

show auth

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1160

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TIMEOUT CONNECT-TIMEOUT

auth timeout connect-timeout

Overview This command sets the connect-timeout period for the interface.

Use the no variant of this command to reset the connect-timeout period to the

default.

Syntax auth timeout connect-timeout <1-65535>

no auth timeout connect-timeout

Default The connect-timeout default is 30 seconds.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage This command is used for MAC- and Web-Authentication. If the connect-timeout

has lapsed and the supplicant has the state connecting, then the supplicant is

deleted. When auth-web-server session-keep or auth two-step enable is enabled,

we recommend you configure a longer connect-timeout period.

Examples To set the connect-timeout period to 3600 seconds for port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth timeout connect-timeout 3600

To reset the connect-timeout period to the default (30 seconds) for port1.0.2, use

the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth timeout connect-timeout

To set the connect-timeout period to 3600 seconds for authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth timeout connect-timeout 3600

Parameter Description

<1-65535>Specifies the connect-timeout period (in seconds).

C613-50292-01 Rev A Command Reference for IE210L Series 1161

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TIMEOUT CONNECT-TIMEOUT

To reset the connect-timeout period to the default (30 seconds) for authentication

profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth timeout connect-timeout

Commands

auth profile (Global Configuration)

show dot1x

show dot1x interface

C613-50292-01 Rev A Command Reference for IE210L Series 1162

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TIMEOUT QUIET-PERIOD

auth timeout quiet-period

Overview This command sets a time period for which another authentication request is not

accepted on a given interface, after an authentication request has failed.

Use the no variant of this command to reset the quiet period to the default.

Syntax auth timeout quiet-period <1-65535>

no auth timeout quiet-period

Default The quiet period for port authentication is 60 seconds.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To set the quiet period to 10 seconds for interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth timeout quiet-period 10

To reset the quiet period to the default (60 seconds) for interface port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth timeout quiet-period

To set the quiet period to 10 seconds for authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth timeout quiet-period 10

To reset the quiet period to the default (60 seconds) for authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth timeout quiet-period

Commands

auth profile (Global Configuration)

Parameter Description

<1-65535>Specifies the quiet period (in seconds).

C613-50292-01 Rev A Command Reference for IE210L Series 1163

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TIMEOUT REAUTH-PERIOD

auth timeout reauth-period

Overview This command sets the timer for reauthentication on a given interface. The

re-authentication for the supplicant (client device) is executed at this timeout. The

timeout is only applied if the auth reauthentication command is applied.

Use the no variant of this command to reset the reauth-period parameter to the

default (3600 seconds).

Syntax auth timeout reauth-period <1-4294967295>

no auth timeout reauth-period

Default The default reauthentication period for port authentication is 3600 seconds, when

reauthentication is enabled on the port.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To set the reauthentication period to 1 day for interface port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth timeout reauth-period 86400

To reset the reauthentication period to the default (3600 seconds) for interface

port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth timeout reauth-period

To set the reauthentication period to 1 day for authentication profile ‘student’, use

the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth timeout reauth-period 86400

To reset the reauthentication period to the default (3600 seconds) for

authentication profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth timeout reauth-period

Parameter Description

<1-4294967295>The reauthentication timeout period (in seconds).

C613-50292-01 Rev A Command Reference for IE210L Series 1164

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TIMEOUT REAUTH-PERIOD

Commands

auth profile (Global Configuration)

auth reauthentication

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1165

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TIMEOUT SERVER-TIMEOUT

auth timeout server-timeout

Overview This command sets the timeout for the waiting response from the RADIUS server

on a given interface.

The no variant of this command resets the server-timeout to the default (30

seconds).

Syntax auth timeout server-timeout <1-65535>

no auth timeout server-timeout

Default The server timeout for port authentication is 30 seconds.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To set the server timeout to 120 seconds for interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth timeout server-timeout 120

To set the server timeout to the default (30 seconds) for interface port1.0.2 use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth timeout server-timeout

To set the server timeout to 120 seconds for authentication profile ‘student’, use

the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth timeout server-timeout 120

To set the server timeout to the default (30 seconds) for authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth timeout server-timeout

Parameter Description

<1-65535>Server timeout period (in seconds).

C613-50292-01 Rev A Command Reference for IE210L Series 1166

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TIMEOUT SERVER-TIMEOUT

Commands

auth profile (Global Configuration)

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1167

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TIMEOUT SUPP-TIMEOUT

auth timeout supp-timeout

Overview This command sets the timeout of the waiting response from the supplicant (client

device) on a given interface.

The no variant of this command resets the supplicant timeout to the default (30

seconds).

Syntax auth timeout supp-timeout <1-65535>

no auth timeout supp-timeout

Default The supplicant timeout for port authentication is 30 seconds.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To set the supplicant timeout to 2 seconds for interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth timeout supp-timeout 2

To reset the supplicant timeout to the default (30 seconds) for interface port1.0.2,

use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth timeout supp-timeout

To set the supplicant timeout to 2 seconds for authentication profile ‘student’, use

the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth timeout supp-timeout 2

To reset the supplicant timeout to the default (30 seconds) for authentication

profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth timeout supp-timeout

Parameter Description

<1-65535>The supplicant timeout period (in seconds).

C613-50292-01 Rev A Command Reference for IE210L Series 1168

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TIMEOUT SUPP-TIMEOUT

Commands

auth profile (Global Configuration)

show dot1x

show dot1x interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1169

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TWO-STEP ENABLE

auth two-step enable

Overview This command enables a two-step authentication feature on an interface. When

this feature is enabled, the supplicant is authorized in a two-step process. If

authentication succeeds, the supplicant becomes authenticated. This command

will apply the two-step authentication method based on 802.1X-, MAC- or

Web-Authentication.

The no variant of this command disables the two-step authentication feature.

Syntax auth two-step enable

no auth two-step enable

Default Two step authentication is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage The single step authentication methods (either user or device authentication) have

a potential security risk:

• an unauthorized user can access the network with an authorized device, or

• an authorized user can access the network with an unauthorized device.

Two-step authentication solves this problem by authenticating both the user and

the device. The supplicant will only become authenticated if both these steps are

successful. If the first authentication step fails, then the second step is not started.

Examples To enable the two step authentication feature, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth two-step enable

To disable the two step authentication feature, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth two-step enable

To enable MAC-Authentication followed by 802.1X-Authentication, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport mode access

awplus(config-if)# auth-mac enable

awplus(config-if)# dot1x port-control auto

awplus(config-if)# auth dynamic-vlan-creation

awplus(config-if)# auth two-step enable

C613-50292-01 Rev A Command Reference for IE210L Series 1170

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TWO-STEP ENABLE

To enable MAC-Authentication followed by Web-Authentication, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport mode access

awplus(config-if)# auth-mac enable

awplus(config-if)# auth-web enable

awplus(config-if)# auth dynamic-vlan-creation

awplus(config-if)# auth two-step enable

To enable 802.1X-Authentication followed by Web-Authentication, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport mode access

awplus(config-if)# auth-web enable

awplus(config-if)# dot1x port-control auto

awplus(config-if)# auth dynamic-vlan-creation

awplus(config-if)# auth two-step enable

To enable the two step authentication feature for authentication profile ‘student’,

use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth two-step enable

To disable the two step authentication feature for authentication profile ‘student’,

use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth two-step enable

Validation

Commands

show startup-config

show auth supplicant

show dot1x supplicant

C613-50292-01 Rev A Command Reference for IE210L Series 1171

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH TWO-STEP ENABLE

Relat ed

Commands

auth profile (Global Configuration)

show auth two-step supplicant brief

show auth

show auth interface

show auth supplicant

show dot1x

show dot1x interface

show dot1x supplicant

C613-50292-01 Rev A Command Reference for IE210L Series 1172

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC ACCOUNTING

auth-mac accounting

Overview This command overrides the default RADIUS accounting method for MAC-based

authentication on an interface by allowing you to apply a user-defined named list.

Use the no variant of this command to remove the named list from the interface

and apply the default method.

Syntax auth-mac accounting {default|<list-name>}

no auth-mac accounting

Default The default method list is applied to an interface by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Example To apply the named list 'vlan10_acct' on the vlan10 interface, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# auth-mac accounting vlan10_acct

To remove the named list from the vlan10 interface and set the accounting

method back to default, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no auth-mac accounting

Commands

aaa accounting auth-mac

Command

changes

Version 5.4.8-2.1: Command added to AR2050V, AR3050S, AR4050S

Parameter Description

default Apply the default accounting method list

<list-name>Apply the user-defined named list

C613-50292-01 Rev A Command Reference for IE210L Series 1173

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC AUTHENTICATION

auth-mac authentication

Overview This command overrides the default MAC-based authentication method on an

interface by allowing you to apply a user-defined named list.

Use the no variant of this command to remove the named list from the interface

and apply the default method.

Syntax auth-mac authentication {default|<list-name>}

no auth-mac authentication

Default The default method list is applied to an interface by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Example To apply the named list 'vlan10_auth' on the vlan10 interface, use the

commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# auth-mac authentication vlan10_auth

To remove the named list from the vlan10 interface and set the authentication

method back to default, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no auth-mac authentication

Commands

aaa authentication auth-mac

Command

changes

Version 5.4.8-2.1: Command added to AR2050V, AR3050S, AR4050S

Parameter Description

default Apply the default authentication method list

<list-name>Apply a user-defined named list

C613-50292-01 Rev A Command Reference for IE210L Series 1174

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC ENABLE

auth-mac enable

Overview This command enables MAC-based authentication on the interface specified in the

Interface command mode.

Use the no variant of this command to disable MAC-based authentication on an

interface.

Syntax auth-mac enable

no auth-mac enable

Default MAC-Authentication is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage Enabling spanning-tree edgeport on ports after enabling MAC-based

authentication avoids unnecessary re-authentication when the port state changes,

which does not happen when spanning tree edgeport is enabled. Note that

re-authentication is correct behavior without spanning-tree edgeport enabled.

Applying switchport mode access on ports is also good practice to set the ports

to access mode with ingress filtering turned on, whenever ports for

MAC-Authentication are in a VLAN.

Examples To enable MAC-Authentication on interface port1.0.2 and enable spanning tree

edgeport to avoid unnecessary re-authentication, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth-mac enable

awplus(config-if)# spanning-tree edgeport

awplus(config-if)# switchport mode access

To disable MAC-Authentication on interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth-mac enable

To enable MAC authentication on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth-mac enable

C613-50292-01 Rev A Command Reference for IE210L Series 1175

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC ENABLE

To disable MAC authentication on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth-mac enable

Commands

auth profile (Global Configuration)

show auth

show auth interface

show running-config

Command

changes

Version 5.4.8-2.1: Command added to AR2050V, AR3050S, AR4050S

C613-50292-01 Rev A Command Reference for IE210L Series 1176

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC METHOD

auth-mac method

Overview This command sets the type of authentication method for MAC-Authentication

that is used with RADIUS on the interface specified in the Interface command

mode.

The no variant of this command resets the authentication method used to the

default method (PAP) as the RADIUS authentication method used by the

MAC-Authentication.

Syntax auth-mac method [eap-md5|pap]

no auth-mac method

Default The MAC-Authentication method is PAP.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To set the MAC-Authentication method to PAP on interface port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth-mac method pap

To set the MAC-Authentication method to the default on interface port1.0.2, use

the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth-mac method

To set the MAC-Authentication method to EAP-MD5 on authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth-mac method eap-md5

Parameter Description

eap-md5 Enable EAP-MD5 as the authentication method.

pap Enable PAP as the authentication method.

C613-50292-01 Rev A Command Reference for IE210L Series 1177

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC METHOD

To set the MAC-Authentication method to the default on authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth-mac method

Commands

auth profile (Global Configuration)

show auth

show auth interface

show running-config

Command

changes

Version 5.4.8-2.1: Command added to AR2050V, AR3050S, AR4050S

C613-50292-01 Rev A Command Reference for IE210L Series 1178

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC PASSWORD

auth-mac password

Overview This command changes the password for MAC-based authentication.

Use the no variant of this command to return the password to its default.

Syntax auth-mac [encrypted] password <password>

no auth-mac password

Default By default, the password is the MAC address of the supplicant.

Mode Global Configuration

Usage Changing the password increases the security of MAC-based authentication,

because the default password is easy for an attacker to discover. This is particularly

important if:

• some MAC-based supplicants on the network are intelligent devices, such as

computers, and/or

• you are using two-step authentication (see the “Ensuring Authentication

Methods Require Different Usernames and Passwords” section of the AAA

and Port Authentication Feature_Overview_and_Configuration_Guide).

Examples To change the password to verySecurePassword, use the commands:

awplus# configure terminal

awplus(config)# auth-mac password verySecurePassword

Commands

auth two-step enable

show auth

Command

changes

Version 5.4.8-2.1: Command added to AR2050V, AR3050S, AR4050S

Parameter Description

auth-mac MAC-based authentication

encrypted Specify an encrypted password

password Configure the password

<password>The new password. Passwords can be up to 64 characters in length

and can contain any printable characters except:

•?

• " (double quotes)

•space

C613-50292-01 Rev A Command Reference for IE210L Series 1179

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC REAUTH-RELEARNING

auth-mac reauth-relearning

Overview This command sets the MAC address learning of the supplicant (client device) to

re-learning for re-authentication on the interface specified in the Interface

command mode.

Use the no variant of this command to disable the auth-mac re-learning option.

Syntax auth-mac reauth-relearning

no auth-mac reauth-relearning

Default Re-learning for port authentication is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To enable the re-authentication re-learning feature on interface port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth-mac reauth-relearning

To disable the re-authentication re-learning feature on interface port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awpl us(config-if)# no auth-mac reauth-relearning

To enable the re-authentication re-learning feature on authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth-mac reauth-relearning

To disable the re-authentication re-learning feature on authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth-mac reauth-relearning

Commands

auth profile (Global Configuration)

show auth

show auth interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1180

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC REAUTH-RELEARNING

Command

changes

Version 5.4.8-2.1: Command added to AR2050V, AR3050S, AR4050S

C613-50292-01 Rev A Command Reference for IE210L Series 1181

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC STATIC

auth-mac static

Overview This command configures MAC authentication to use static entries in the FDB.

Static entries persist in the FDB, even if there is no traffic flow from the supplicant.

When static FDB entries are configured, the auth roaming disconnected command

is supported for MAC authentication. This command allows a supplicant to move

to another authenticating interface without re-authentication.

Use the no variant of this command to revert to dynamic FDB entries.

Syntax auth-mac static

no auth-mac static

Default By default MAC authentication supplicants are added to the FDB dynamically.

Mode Global Configuration

Example To configure MAC authentication to use static FDB entries, use the following

commands:

awplus# configure terminal

awplus(config)# auth-mac static

To configure MAC authentication to use dynamic FDB entries, use the following

commands:

awplus# configure terminal

awplus(config)# no auth-mac static

Commands

auth roaming disconnected

show auth

show dot1x

Command

changes

Version 5.4.7-2.4: Command added

Version 5.4.8-2.1: Command added to AR2050V, AR3050S, AR4050S

C613-50292-01 Rev A Command Reference for IE210L Series 1182

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-MAC USERNAME

auth-mac username

Overview Use this command to specify the format of the MAC address in the username and

password field when a request for MAC-based authorization is sent to a RADIUS

server.

Syntax auth-mac username {ietf|unformatted} {lower-case|upper-case}

Default auth-mac username ietf lower-case

Mode Global Configuration

Usage This command is provided to allow other vendors’, AlliedWare, and AlliedWare

Plus switches to share the same format on the RADIUS server.

Example To configure the format of the MAC address in the username and password field to

be changed to IETF and upper-case, use the following commands:

awplus# configure terminal

awplus(config)# auth-mac username ietf upper-case

Commands

auth-mac username

show running-config

Command

changes

Version 5.4.8-2.1: Command added to AR2050V, AR3050S, AR4050S

Parameter Description

ietf The MAC address includes a hyphen between each 2 bytes.

(Example: xx-xx-xx-xx-xx-xx)

unformatted The MAC address does not include hyphens. (Example:

xxxxxxxxxxxx)

lower-case The MAC address uses lower-case characters (a-f)

upper-case The MAC address uses upper-case characters (A-F)

C613-50292-01 Rev A Command Reference for IE210L Series 1183

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB ACCOUNTING

auth-web accounting

Overview This command overrides the default RADIUS accounting method for Web-based

authentication on an interface by allowing you to apply a user-defined named list.

Use the no variant of this command to remove the named list from the interface

and apply the default method.

Syntax auth-web accounting {default|<list-name>}

no auth-web accounting

Default The default method list is applied to an interface by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Example To apply the named list ‘vlan10_acct' on the vlan10 interface, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# auth-web accounting vlan10_acct

To remove the named list from the vlan10 interface and set the accounting

method back to default, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no auth-web accounting

Commands

aaa accounting auth-web

Parameter Description

default Apply the default accounting method list

<list-name>Apply a named accounting method list

C613-50292-01 Rev A Command Reference for IE210L Series 1184

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB AUTHENTICATION

auth-web authentication

Overview This command overrides the default Web-based authentication method on an

interface by allowing you to apply a user-defined named list.

Use the no variant of this command to remove the named list from the interface

and apply the default method.

Syntax auth-web authentication {default|<list-name>}

no auth-web authentication

Default The default method list is applied to an interface by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Example To apply the named list 'vlan10_auth' on the vlan10 interface, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# auth-web authentication vlan10_auth

To remove the named list from the vlan10 interface and set the authentication

method back to default, use the commands:

awplus# configure terminal

awplus(config)# interface vlan10

awplus(config-if)# no auth-web authentication

Commands

aaa authentication auth-web

Parameter Description

default Apply the default authentication method list

<list-name>Apply the user-defined named list

C613-50292-01 Rev A Command Reference for IE210L Series 1185

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB ENABLE

auth-web enable

Overview This command enables Web-based authentication in Interface mode on the

interface specified.

Use the no variant of this command to apply its default.

Syntax auth-web enable

no auth-web enable

Default Web-Authentication is disabled by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage Web-based authentication cannot be enabled if DHCP snooping is enabled by

using the service dhcp-snooping command, and vice versa. You need to configure

an IPv4 address for the VLAN interface on which Web Authentication is running.

Examples To enable Web-Authentication on static-channel-group 2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# static-channel-group 2

awplus(config-if)# exit

awplus(config)# interface sa2

awplus(config-if)# auth-web enable

To disable Web-Authentication on static-channel-group 2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# static-channel-group 2

awplus(config-if)# exit

awplus(config)# interface sa2

awplus(config-if)# no auth-web enable

To enable Web authentication on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth-web enable

C613-50292-01 Rev A Command Reference for IE210L Series 1186

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB ENABLE

To disable Web authentication on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth-web enable

Commands

auth profile (Global Configuration)

show auth

show auth interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1187

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB FORWARD

auth-web forward

Overview This command enables the Web-authentication packet forwarding feature on the

interface specified. This command also enables ARP forwarding, and adds

forwarded packets to the tcp or udp port number specified.

The no variant of this command disables the specified packet forwarding feature

on the interface.

Syntax auth-web forward [<ip-address>|<ip-address/prefix-length>]

{dns|tcp <1-65535>|udp <1-65535>}

auth-web forward {arp|dhcp|dns|tcp <1-65535>|udp <1-65535>}

The no variants of this command are:

no auth-web forward [<ip-address>|<ip-address/prefix-length>]

{dns|tcp <1-65535>|udp <1-65535>}

no auth-web forward {arp|dhcp|dns|tcp <1-65535>|udp <1-65535>}

Default Packet forwarding for port authentication is enabled by default for “arp”, “dhcp”

and “dns”.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Usage For more information about the <ip-address> parameter, and an example, see the

“auth-web forward” section in the Alliedware Plus Technical Tips and Tricks.

Parameter Description

<ip-address>

<ip-address/



prefix-length>

The IP address or subnet on which the Web-authentication is to

be enabled.

arp Enable forwarding of ARP.

dhcp Enable forwarding of DHCP (67/udp).

dns Enable forwarding of DNS (53/udp).

tcp Enable forwarding of TCP specified port number.

<1-65535> TCP Port number.

udp Enable forwarding of UDP specified port number.

<1-65535> UDP Port number.

C613-50292-01 Rev A Command Reference for IE210L Series 1188

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB FORWARD

Examples To enable the ARP forwarding feature on interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth-web forward arp

To add TCP forwarding port 137 on interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth-web forward tcp 137

To add the DNS Server IP address 192.168.1.10 on interface port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# switchport mode access

awplus(config-if)# auth-web enable

awplus(config-if)# auth dynamic-vlan-creation

awplus(config-if)# auth-web forward 192.168.1.10 dns

To disable the ARP forwarding feature on interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth-web forward arp

To delete TCP forwarding port 137 on interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth-web forward tcp 137

To delete all TCP forwarding on interface port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth-web forward tcp

To enable the ARP forwarding feature on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth-web forward arp

C613-50292-01 Rev A Command Reference for IE210L Series 1189

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB FORWARD

To add TCP forwarding port 137 on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth-web forward tcp 137

To disable the ARP forwarding feature on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth-web forward arp

To delete TCP forwarding port 137 on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth-web forward tcp 137

To delete all TCP forwarding on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth-web forward tcp

Commands

auth profile (Global Configuration)

show auth

show auth interface

C613-50292-01 Rev A Command Reference for IE210L Series 1190

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB MAX-AUTH-FAIL

auth-web max-auth-fail

Overview This command sets the number of authentication failures allowed before rejecting

further authentication requests. When the supplicant (client device) fails more

than the specified number of times, then login requests are refused during the

quiet period.

The no variant of this command resets the maximum number of authentication

failures to the default.

Syntax auth-web max-auth-fail <0-10>

no auth-web max-auth-fail

Default The maximum number of authentication failures is set to 3.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Examples To set the lock count to 5 on interface port1.0.2, use the following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth-web max-auth-fail 5

To set the lock count to the default on interface port1.0.2, use the following

commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# no auth-web max-auth-fail

To set the lock count to 5 on authentication profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth-web max-auth-fail 5

To set the lock count to the default on authentication profile ‘student’, use the

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth-web max-auth-fail

Parameter Description

<0-10>The maximum number of authentication failures allowed

before login requests are refused.

C613-50292-01 Rev A Command Reference for IE210L Series 1191

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB MAX-AUTH-FAIL

Commands

auth profile (Global Configuration)

auth timeout quiet-period

show auth

show auth interface

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1192

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB METHOD

auth-web method

Overview This command sets the Web-authentication access method that is used with

RADIUS on the interface specified.

The no variant of this command sets the authentication method to PAP for the

interface specified when Web-Authentication is also used with the RADIUS

authentication method.

Syntax auth-web method {eap-md5|pap}

no auth-web method

Default The Web-Authentication method is set to PAP by default.

Mode Interface Configuration for a static channel, a dynamic (LACP) channel group, or a

switch port; or Authentication Profile mode.

Example To set the Web-Authentication method to EAP-MD5 on interface port1.0.2, use the

following commands:

awplus# configure terminal

awplus(config)# interface port1.0.2

awplus(config-if)# auth-web method eap-md5

To set the web authentication method to EAP-MD5 for authentication profile

‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# auth-web method eap-md5

To reset the web authentication method to the default (PAP) for authentication

profile ‘student’, use the commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no auth-web method

Commands

auth profile (Global Configuration)

show auth

show auth interface

show running-config

Parameter Description

eap-md5 Enable EAP-MD5 as the authentication method.

pap Enable PAP as the authentication method.

C613-50292-01 Rev A Command Reference for IE210L Series 1193

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER BLOCKING-MODE

auth-web-server blocking-mode

Overview Use this command to enable blocking mode for the Web-Authentication server.

The blocking mode displays an authentication success or failure screen

immediately from the response result from a RADIUS server.

Use the no variant of this command to disable blocking mode for the

Web-Authentication server.

Syntax auth-web-server blocking-mode

no auth-web-server blocking-mode

Default By default, blocking mode is disabled for the Web-Authentication server.

Mode Global Configuration

Example To enable blocking mode for the Web-Authentication server, use the following

commands:

awplus# configure terminal

awplus(config)# auth-web-server blocking-mode

To disable blocking mode for the Web-Authentication server, use the following

commands:

awplus# configure terminal

awplus(config)# no auth-web-server blocking-mode

Commands

auth-web-server redirect-delay-time

show auth-web-server

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1194

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER DHCP IPADDRESS

auth-web-server dhcp ipaddress

Overview Use this command to assign an IP address and enable the DHCP service on the

Web-Authentication server for supplicants (client devices).

Use the no variant of this command to remove an IP address and disable the DHCP

service on the Web-Authentication server for supplicants.

Syntax auth-web-server dhcp ipaddress <ip-address/prefix-length>

no auth-web-server dhcp ipaddress

Default No IP address for the Web-Authentication server is set by default.

Mode Global Configuration

Usage See the AAA and Port Authentication Feature Overview and Configuration Guide

for information about:

• using DHCP with web authentication, and

• restrictions regarding combinations of authentication enhancements

working together

You cannot use the IPv4 address assigned to the device’s interface as the

Web-Authentication server address.

Examples To assign the IP address 10.0.0.1 to the Web-Authentication server, use the

following commands:

awplus# configure terminal

awplus(config)# auth-web-server dhcp ipaddress 10.0.0.1/8

To remove an IP address on the Web-Authentication server, use the following

commands:

awplus# configure terminal

awplus(config)# no auth-web-server dhcp ipaddress

Validation

Commands

show running-config

Commands

show auth-web-server

auth-web-server dhcp lease

Parameter Description

<ip-addr/

prefix-length>The IPv4 address and prefix length assigned for the DHCP

service on the Web-Authentication server for supplicants.

C613-50292-01 Rev A Command Reference for IE210L Series 1195

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER DHCP LEASE

auth-web-server dhcp lease

Overview Use this command to set the DHCP lease time for supplicants (client devices) using

the DHCP service on the Web-Authentication server.

Use the no variant of this command to reset to the default DHCP lease time for

supplicants using the DHCP service on the Web-Authentication server.

Syntax auth-web-server dhcp lease <20-60>

no auth-web-server dhcp lease

Default The default DHCP lease time for supplicants using the DHCP service on the Web-

Authentication server is set to 30 seconds.

Mode Global Configuration

Usage See the AAA and Port Authentication Feature Overview and Configuration Guide

for information about:

• using DHCP with web authentication, and

• restrictions regarding combinations of authentication enhancements

working together

Examples To set the DHCP lease time to 1 minute for supplicants using the DHCP service on

the Web-Authentication server, use the following commands:

awplus# configure terminal

awplus(config)# auth-web-server dhcp lease 60

To reset the DHCP lease time to the default setting (30 seconds) for supplicants

using the DHCP service on the Web-Authentication server, use the following

commands:

awplus# configure terminal

awplus(config)# no auth-web-server dhcp lease

Validation

Commands

show running-config

Commands

show auth-web-server

auth-web-server dhcp ipaddress

Parameter Description

<20-60>DHCP lease time for supplicants using the DHCP service on the Web-

Authentication server in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 1196

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER DHCP-WPAD-OPTION

auth-web-server dhcp-wpad-option

Overview This command sets the DHCP WPAD (Web Proxy Auto-Discovery) option for the

Web-Authentication temporary DHCP service.

For more information and examples, see the “Web Auth Proxy” section in the

Alliedware Plus Technical Tips and Tricks.

Use the no variant of this command to disable the DHCP WPAD function.

Syntax auth-web-server dhcp wpad-option <url>

no auth-web-server dhcp wpad-option

Default The Web-Authentication server DHCP WPAD option is not set.

Mode Global Configuration

Usage If the supplicant is configured to use WPAD, the supplicant’s web browser will use

TCP port 80 as usual. Therefore, the packet can be intercepted by

Web-Authentication as normal, and the Web-Authentication Login page can be

sent. However, after authentication, the browser does not know where to get the

WPAD file and so cannot access external web pages. The WPAD file is usually

named proxy.pac file and tells the browser what web proxy to use.

Use this command to tell the supplicant where it can get this file from. The switch

itself can be specified as the source for this file, and it can deliver it to the

supplicant on request.

Example To specify that the proxy.pac file is found on the server at 192.168.1.100, use the

following commands:

awplus# configure terminal

awplus(config)# auth-web-server dhcp wpad-option

http://192.168.1.100/proxy/proxy.pac

Commands

show auth-web-server

Parameter Description

<url>URL to the server which gets a .pac file.

C613-50292-01 Rev A Command Reference for IE210L Series 1197

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER HOST-NAME

auth-web-server host-name

Overview This command assigns a hostname to the web authentication server.

Use the no variant of this command to remove the hostname from the web

authentication server.

Syntax auth-web-server host-name <hostname>

no auth-web-server host-name

Default The web authentication server has no hostname.

Mode Global Configuration

Usage When the web authentication server uses HTTPS protocol, the web browser will

validate the certificate. If the certificate is invalid, the web page gives a warning

message before displaying server content. However, the web page will not give

warning message if the server has a hostname same as the one stored in the

installed certificate.

Examples To set the auth.example.com as the hostname of the web authentication server,

use the commands:

awplus# configure terminal

awplus(config)# auth-web-server host-name auth.example.com

To remove hostname auth.example.com from the web authentication server, use

the commands:

awplus# configure terminal

awplus(config)# no auth-web-server host-name

Commands

aaa authentication auth-web

auth-web enable

Parameter Description

<hostname>URL string of the hostname

C613-50292-01 Rev A Command Reference for IE210L Series 1198

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER INTERCEPT-PORT

auth-web-server intercept-port

Overview This command specifies any additional TCP port numbers that the

Web-Authentication server is to intercept.

Use the no variant of this command to stop intercepting the TCP port numbers.

Syntax auth-web-server intercept-port {<1-65535>|any}

no auth-web-server intercept-port {<1-65535>|any}

Default No additional TCP port numbers are intercepted by default.

Mode Global Configuration

Usage If this command is not specified, AlliedWare Plus Web-Authentication intercepts

the supplicant’s initial TCP port 80 connection to a web page and sends it the Web-

Authentication Login page. However, if the supplicant is configured to use a web

proxy, then it will usually be using TCP port 8080 (or another user configured port

number). In this case Web-Authentication cannot intercept the connection.

To overcome this limitation you can use this command to tell the switch which

additional port it should intercept, and then send the Web-Authentication Login

page to the supplicant.

When the web authentication switch is in a guest network, the switch does not

know the proxy server’s port number in the supplicant’s proxy setting. To

overcome this limitation, you can use the any option in this command to intercept

all TCP packets.

When you use this command in conjunction with a proxy server configured in the

web browser, you must add the proxy server’s network as a ‘No Proxy’ network.

You can specify ‘No Proxy’ networks in the proxy settings in your web browser. For

more information, see the “Web Auth Proxy” section in the Alliedware Plus

Technical Tips and Tricks.

Example To additionally intercept port number 3128, use the following commands:

awplus# configure terminal

awplus(config)# auth-web-server intercept-port 3128

Commands

show auth-web-server

Parameter Description

<1-65535>TCP port number.

any Intercept all TCP packets

C613-50292-01 Rev A Command Reference for IE210L Series 1199

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER IPADDRESS

auth-web-server ipaddress

Overview This command sets the IP address for the Web-Authentication server.

Use the no variant of this command to delete the IP address for the

Web-Authentication server.

You cannot use the IPv4 address assigned to the device’s interface as the

Web-Authentication server address.

Syntax auth-web-server ipaddress <ip-address>

no auth-web-server ipaddress

Default The Web-Authentication server address on the system is not set by default.

Mode Global Configuration

Examples To set the IP address 10.0.0.1 to the Web-Authentication server, use the

following commands:

awplus# configure terminal

awplus(config)# auth-web-server ipaddress 10.0.0.1

To delete the IP address from the Web-Authentication server, use the following

commands:

awplus# configure terminal

awplus(config)# no auth-web-server ipaddress

Validation

Commands

show auth

show auth-web-server

show running-config

Parameter Description

<ip-address>Web-Authentication server dotted decimal IP address in

A.B.C.D format.

C613-50292-01 Rev A Command Reference for IE210L Series 1200

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PAGE LANGUAGE

auth-web-server page language

Overview Use this command to set the presentation language of Web authentication pages.

Titles and subtitles of Web authentication pages will be set accordingly. Note that

presently only English or Japanese are offered.

Use the no variant of this command to set the presentation language of Web

authentication pages to its default (English).

Syntax auth-web-server page language {english|japanese}

no auth-web-server page language

Default Web authentication pages are presented in English by default.

Mode Global Configuration

Examples To set Japanese as the presentation language of Web authentication pages, use

the following commands:

awplus# configure terminal

awplus(config)# auth-web-server page language japanese

To set English as the presentation language of Web authentication pages, use the

following commands:

awplus# configure terminal

awplus(config)# auth-web-server page language english

To unset the presentation language of Web authentication pages and use English

as the default presentation language, use the following commands:

awplus# configure terminal

awplus(config)# no auth-web-server page language

Commands

auth-web-server page title

auth-web-server page sub-title

show auth-web-server page

Parameter Description

english Web authentication pages are presented in English.

japanese Web authentication pages are presented in Japanese.

C613-50292-01 Rev A Command Reference for IE210L Series 1201

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER LOGIN-URL

auth-web-server login-url

Overview This command sets the web-authentication login page URL. This lets you replace

the login page with your own page. See “Customising the Login Page” in the AAA

and Port Authentication Feature Overview and Configuration Guide for details.

Use the no variant of this command to delete the URL.

Syntax auth-web-server login-url <URL>

no auth-web-server login-url

Default The built-in login page is set by default.

Mode Global Configuration

Examples To set http://example.com/login.html as the login page, use the commands:

awplus# configure terminal

awplus(config)# auth-web-server login-url

http://example.com/login.html

To unset the login page URL, use the commands:

awplus# configure terminal

awplus(config)# no auth-web-server login-url

Commands

show running-config

Parameter Description

<URL>Set login page URL

C613-50292-01 Rev A Command Reference for IE210L Series 1202

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PAGE LOGO

auth-web-server page logo

Overview This command sets the type of logo that will be displayed on the web

authentication page.

Use the no variant of this command to set the logo type to auto.

Note that if you need to customize the login page extensively, you can instead

replace it with your own page. See “Customising the Login Page” in the AAA and

Port Authentication Feature Overview and Configuration Guide.

Syntax auth-web-server page logo {auto|default|hidden}

no auth-web-server page logo

Default Logo type is auto by default.

Mode Global Configuration

Examples To display the default logo with ignoring installed custom logo, use the

commands:

awplus# configure terminal

awplus(config)# auth-web-server page logo default

To set back to the default logo type auto, use the commands:

awplus# configure terminal

awplus(config)# no auth-web-server page logo

Validation

Commands

show auth-web-server page

Parameter Description

auto Display the custom logo if installed; otherwise display the

default logo

default Display the default logo

hidden Hide the logo

C613-50292-01 Rev A Command Reference for IE210L Series 1203

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PAGE SUB-TITLE

auth-web-server page sub-title

Overview This command sets the custom sub-title on the web authentication page.

Use the no variant of this command to reset the sub-title to its default.

Note that if you need to customize the login page extensively, you can instead

replace it with your own page. See “Customising the Login Page” in the AAA and

Port Authentication Feature Overview and Configuration Guide.

Syntax auth-web-server page sub-title {hidden|text <sub-title>}

no auth-web-server page sub-title

Default “Allied-Telesis” is displayed by default.

Mode Global Configuration

Examples To set the custom sub-title, use the commands:

awplus# configure terminal

awplus(config)# auth-web-server page sub-title text Web

Authentication

To hide the sub-title, use the commands:

awplus# configure terminal

awplus(config)# auth-web-server page sub-title hidden

To change back to the default title, use the commands:

awplus# configure terminal

awplus(config)# no auth-web-server page sub-title

Validation

Commands

show auth-web-server page

Parameter Description

hidden Hide the sub-title

<sub-title> Text string of the sub-title

C613-50292-01 Rev A Command Reference for IE210L Series 1204

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PAGE SUCCESS-MESSAGE

auth-web-server page success-message

Overview This command sets the success message on the web-authentication page.

Use the no variant of this command to remove the success message.

Note that if you need to customize the login page extensively, you can instead

replace it with your own page. See “Customising the Login Page” in the AAA and

Port Authentication Feature Overview and Configuration Guide.

Syntax auth-web-server page success-message text <success-message>

no auth-web-server page success-message

Default No success message is set by default.

Mode Global Configuration

Examples To set the success message on the web-authentication page, use the commands:

awplus# configure terminal

awplus(config)# auth-web-server page success-message text Your

success message

To unset the success message on the web-authentication page, use the

commands:

awplus# configure terminal

awplus(config)# no auth-web-server page success-message

Validation

Commands

show auth-web-server page

Parameter Description

<success-message> Text string of the success message

C613-50292-01 Rev A Command Reference for IE210L Series 1205

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PAGE TITLE

auth-web-server page title

Overview This command sets the custom title on the web authentication page.

Use the no variant of this command to remove the custom title.

Note that if you need to customize the login page extensively, you can instead

replace it with your own page. See “Customising the Login Page” in the AAA and

Port Authentication Feature Overview and Configuration Guide.

Syntax auth-web-server page title {hidden|text <title>}

no auth-web-server page title

Default “Web Access Authentication Gateway” is displayed by default.

Mode Global Configuration

Examples To set the custom title on the web authentication page, use the commands:

awplus# configure terminal

awplus(config)# auth-web-server page title text Login

To hide the title on the web authentication page, use the commands:

awplus# configure terminal

awplus(config)# auth-web-server page title hidden

To unset the custom title on the web authentication page, use the commands:

awplus# configure terminal

awplus(config)# no auth-web-server page title

Validation

Commands

show auth-web-server page

Parameter Description

hidden Hide the title

<title> Text string of the title

C613-50292-01 Rev A Command Reference for IE210L Series 1206

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PAGE WELCOME-MESSAGE

auth-web-server page welcome-message

Overview This command sets the welcome message on the web-authentication login page.

Use the no variant of this command to remove the welcome message.

Note that if you need to customize the login page extensively, you can instead

replace it with your own page. See “Customising the Login Page” in the AAA and

Port Authentication Feature Overview and Configuration Guide.

Syntax auth-web-server page welcome-message text <welcome-message>

no auth-web-server page welcome-message

Default No welcome message is set by default.

Mode Global Configuration

Examples To set the welcome message on the web-authentication page, use the commands:

awplus# configure terminal

awplus(config)# auth-web-server page welcome-message text Your

welcome message

To remove the welcome message on the web-authentication page, use the

commands:

awplus# configure terminal

awplus(config)# no auth-web-server page welcome-message

Validation

Commands

show auth-web-server page

Parameter Description

<welcome-message> Text string of the welcome message

C613-50292-01 Rev A Command Reference for IE210L Series 1207

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PING-POLL ENABLE

auth-web-server ping-poll enable

Overview This command enables the ping polling to the supplicant (client device) that is

authenticated by Web-Authentication.

The no variant of this command disables the ping polling to the supplicant that is

authenticated by Web-Authentication.

Syntax auth-web-server ping-poll enable

no auth-web-server ping-poll enable

Default The ping polling feature for Web-Authentication is disabled by default.

Mode Global Configuration

Examples To enable the ping polling feature for Web-Authentication, use the following

commands:

awplus# configure terminal

awplus(config)# auth-web-server ping-poll enable

To disable the ping polling feature for Web-Authentication, use the following

commands:

awplus# configure terminal

awplus(config)# no auth-web-server ping-poll enable

Validation

Commands

show auth

show auth-web-server

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1208

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PING-POLL FAILCOUNT

auth-web-server ping-poll failcount

Overview This command sets a fail count for the ping polling feature when used with

Web-Authentication. The failcount parameter specifies the number of

unanswered pings. A supplicant (client device) is logged off when the number of

unanswered pings are greater than the failcount set with this command.

Use the no variant of this command to resets the fail count for the ping polling

feature to the default (5 pings).

Syntax auth-web-server ping-poll failcount <1-100>

no auth-web-server ping-poll failcount

Default The default failcount for ping polling is 5 pings.

Mode Global Configuration

Examples To set the failcount of ping polling to 10 pings, use the following commands:

awplus# configure terminal

awplus(config)# auth-web-server ping-poll failcount 10

To set the failcount of ping polling to default, use the following commands:

awplus# configure terminal

awplus(config)# no auth-web-server ping-poll failcount

Validation

Commands

show auth

show auth-web-server

show running-config

Parameter Description

<1-100>Count.

C613-50292-01 Rev A Command Reference for IE210L Series 1209

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PING-POLL INTERVAL

auth-web-server ping-poll interval

Overview This command is used to change the ping poll interval. The interval specifies the

time period between pings when the supplicant (client device) is reachable.

Use the no variant of this command to reset to the default period for ping polling

(30 seconds).

Syntax auth-web-server ping-poll interval <1-65535>

no auth-web-server ping-poll interval

Default The interval for ping polling is 30 seconds by default.

Mode Global Configuration

Examples To set the interval of ping polling to 60 seconds, use the following commands:

awplus# configure terminal

awplus(config)# auth-web-server ping-poll interval 60

To set the interval of ping polling to the default (30 seconds), use the following

commands:

awplus# configure terminal

awplus(config)# no auth-web-server ping-poll interval

Validation

Commands

show auth

show auth-web-server

show running-config

Parameter Description

<1-65535>Seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 1210

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PING-POLL REAUTH-TIMER-REFRESH

auth-web-server ping-poll

reauth-timer-refresh

Overview This command modifies the reauth-timer-refresh parameter for the

Web-Authentication feature. The reauth-timer-refresh parameter specifies

whether a re-authentication timer is reset and when the response from a

supplicant (a client device) is received.

Use the no variant of this command to reset the reauth-timer-refresh parameter

to the default setting (disabled).

Syntax auth-web-server ping-poll reauth-timer-refresh

no auth-web-server ping-poll reauth-timer-refresh

Default The reauth-timer-refresh parameter is disabled by default.

Mode Global Configuration

Examples To enable the reauth-timer-refresh timer, use the following commands:

awplus# configure terminal

awplus(config)# auth-web-server ping-poll reauth-timer-refresh

To disable the reauth-timer-refresh timer, use the following commands:

awplus# configure terminal

awplus(config)# no auth-web-server ping-poll

reauth-timer-refresh

Validation

Commands

show auth

show auth-web-server

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1211

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PING-POLL TIMEOUT

auth-web-server ping-poll timeout

Overview This command modifies the ping poll timeout parameter for the

Web-Authentication feature. The timeout parameter specifies the time in seconds

to wait for a response to a ping packet.

Use the no variant of this command to reset the timeout of ping polling to the

default (1 second).

Syntax auth-web-server ping-poll timeout <1-30>

no auth-web-server ping-poll timeout

Default The default timeout for ping polling is 1 second.

Mode Global Configuration

Examples To set the timeout of ping polling to 2 seconds, use the command:

awplus# configure terminal

awplus(config)# auth-web-server ping-poll timeout 2

To set the timeout of ping polling to the default (1 second), use the command:

awplus# configure terminal

awplus(config)# no auth-web-server ping-poll timeout

Validation

Commands

show auth

show auth-web-server

show running-config

Parameter Description

<1-30>Seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 1212

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER PORT

auth-web-server port

Overview This command sets the HTTP port number for the Web-Authentication server.

Use the no variant of this command to reset the HTTP port number to the default

(80).

Syntax auth-web-server port <port-number>

no auth-web-server port

Default The Web-Authentication server HTTP port number is set to 80 by default.

Mode Global Configuration

Examples To set the HTTP port number 8080 for the Web-Authentication server, use the

following commands:

awplus# configure terminal

awplus(config)# auth-web-server port 8080

To reset to the default HTTP port number 80 for the Web-Authentication server,

use the following commands:

awplus# configure terminal

awplus(config)# no auth-web-server port

Validation

Commands

show auth

show auth-web-server

show running-config

Parameter Description

<port-number>Set the local Web-Authentication server port within the TCP

port number range 1 to 65535.

C613-50292-01 Rev A Command Reference for IE210L Series 1213

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER REDIRECT-DELAY-TIME

auth-web-server redirect-delay-time

Overview Use this command to set the delay time in seconds before redirecting the

supplicant to a specified URL when the supplicant is authorized.

Use the variant no to reset the delay time set previously.

Syntax auth-web-server redirect-delay-time <5-60>

no auth-web-server redirect-delay-time

Default The default redirect delay time is 5 seconds.

Mode Global Configuration

Examples To set the delay time to 60 seconds for the Web-Authentication server, use the

following commands:

awplus# configure terminal

awplus(config)# auth-web-server redirect-delay-time 60

To reset the delay time, use the following commands:

awplus# configure terminal

awplus(config)# no auth-web-server redirect-delay-time

Commands

auth-web-server blocking-mode

auth-web-server redirect-url

show auth-web-server

show running-config

Parameter Description

redirect-delay-time Set the delay time before jumping to a specified

URL after the supplicant is authorized.

<5-60>The time in seconds.

C613-50292-01 Rev A Command Reference for IE210L Series 1214

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER REDIRECT-URL

auth-web-server redirect-url

Overview This command sets a URL for supplicant (client device) authentication. When a

supplicant is authorized it will be automatically redirected to the specified URL.

Note that if the http redirect feature is used then this command is ignored.

Use the no variant of this command to delete the URL string set previously.

Syntax auth-web-server redirect-url <url>

no auth-web-server redirect-url

Default The redirect URL for the Web-Authentication server feature is not set by default

(null).

Mode Global Configuration

Examples To enable and set redirect a URL string www.alliedtelesis.com for the Web-

Authentication server, use the following commands:

awplus# configure terminal

awplus(config)# auth-web-server redirect-url

http://www.alliedtelesis.com

To delete a redirect URL string, use the following commands:

awplus# configure terminal

awplus(config)# no auth-web-server redirect-url

Commands

auth-web-server redirect-delay-time

show auth

show auth-web-server

show running-config

Parameter Description

<url>URL (hostname or dotted IP notation).

C613-50292-01 Rev A Command Reference for IE210L Series 1215

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER SESSION-KEEP

auth-web-server session-keep

Overview This command enables the session-keep feature to jump to the original URL after

being authorized by Web-Authentication.

Use the no variant of this command to disable the session keep feature.

Syntax auth-web-server session-keep

no auth-web-server session-keep

Default The session-keep feature is disabled by default.

Mode Global Configuration

Usage This function doesn't ensure to keep session information in all cases.

Authenticated supplicant may be redirected to unexpected page when

session-keep is enabled. This issue occurred by supplicant sending HTTP packets

automatically after authentication page is displayed and the URL is written.

Examples To enable the session-keep feature, use the following commands:

awplus# configure terminal

awplus(config)# auth-web-server session-keep

To disable the session-keep feature, use the following commands:

awplus# configure terminal

awplus(config)# no auth-web-server session-keep

Validation

Commands

show auth

show auth-web-server

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1216

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER SSL

auth-web-server ssl

Overview This command enables HTTPS functionality for the Web-Authentication server

feature.

Use the no variant of this command to disable HTTPS functionality for the

Web-Authentication server.

Syntax auth-web-server ssl

no auth-web-server ssl

Default HTTPS functionality for the Web-Authentication server feature is disabled by

default.

Mode Global Configuration

Examples To enable HTTPS functionality for the Web-Authentication server feature, use the

following commands:

awplus# configure terminal

awplus(config)# auth-web-server ssl

To disable HTTPS functionality for the Web-Authentication server feature, use the

following commands:

awplus# configure terminal

awplus(config)# no auth-web-server ssl

Validation

Commands

show auth

show auth-web-server

show running-config

C613-50292-01 Rev A Command Reference for IE210L Series 1217

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

AUTH-WEB-SERVER SSL INTERCEPT-PORT

auth-web-server ssl intercept-port

Overview Use this command to register HTTPS intercept port numbers when the HTTPS

server uses custom port number (not TCP port number 443).

Note that you need to use the auth-web-server intercept-port command to

Use the no variant of this command to delete registered port number.

Syntax auth-web-server ssl intercept-port <1-65535>

no auth-web-server ssl intercept-port <1-65535>

Default 443/TCP is registered by default.

Mode Global Configuration

Examples To register HTTPS port number 3128, use the commands:

awplus# configure terminal

awplus(config)# auth-web-server ssl intercept-port 3128

To delete HTTPS port number 3128, use the commands:

awplus# configure terminal

awplus(config)# no auth-web-server ssl intercept-port 3128

Validation

Commands

show auth-web-server

Commands

auth-web-server intercept-port

Parameter Description

<1-65535>TCP port number in the range from 1 through 65535

C613-50292-01 Rev A Command Reference for IE210L Series 1218

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

COPY PROXY-AUTOCONFIG-FILE

copy proxy-autoconfig-file

Overview Use this command to download the proxy auto configuration (PAC) file to your

switch. The Web-Authentication supplicant can get the downloaded file from the

system web server.

Syntax copy <filename> proxy-autoconfig-file

Mode Privileged Exec

Example To download the PAC file to this device, use the command:

awplus# copy tftp://server/proxy.pac proxy-autoconfig-file

Commands

show proxy-autoconfig-file

erase proxy-autoconfig-file

Parameter Description

<filename>The URL of the PAC file.

C613-50292-01 Rev A Command Reference for IE210L Series 1219

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

COPY WEB-AUTH-HTTPS-FILE

copy web-auth-https-file

Overview Use this command to download the SSL server certificate for web-based

authentication. The file must be in PEM (Privacy Enhanced Mail) format, and

contain the private key and the server certificate.

Syntax copy <filename> web-auth-https-file

Mode Privileged Exec

Example To download the server certificate file veriSign_cert.pem from the TFTP

server directory server, use the command:

awplus# copy tftp://server/veriSign_cert.pem

web-auth-https-file

Commands

auth-web-server ssl

erase web-auth-https-file

show auth-web-server

Parameter Description

<filename>The URL of the server certificate file.

C613-50292-01 Rev A Command Reference for IE210L Series 1220

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

DESCRIPTION (AUTHENTICATION PROFILE)

description (Authentication Profile)

Overview Use this command to add a description to an authentication profile in

Authentication Profile mode.

Use the no variant of this command to remove the current description.

Syntax description <description>

Default No description configured by default.

Mode Authentication Profile

Example To add a description to the authentication profile ‘student’, use the following

commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# description student room setting

To remove a description from the authentication profile ‘student’, use the

following commands:

awplus# configure terminal

awplus(config)# auth profile student

awplus(config-auth-profile)# no description

Commands

auth profile (Global Configuration)

Parameter Description

<description>Text describing the selected authentication profile.

C613-50292-01 Rev A Command Reference for IE210L Series 1221

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

ERASE PROXY-AUTOCONFIG-FILE

erase proxy-autoconfig-file

Overview Use this command to remove the proxy auto configuration file.

Syntax erase proxy-autoconfig-file

Mode Privileged Exec

Example To remove the proxy auto configuration file, use the command:

awplus# erase proxy-autoconfig-file

Commands

show proxy-autoconfig-file

copy proxy-autoconfig-file

C613-50292-01 Rev A Command Reference for IE210L Series 1222

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

ERASE WEB-AUTH-HTTPS-FILE

erase web-auth-https-file

Overview Use this command to remove the SSL server certificate for web-based

authentication.

Syntax erase web-auth-https-file

Mode Privileged Exec

Example To remove the SSL server certificate file for web-based authentication use the

command:

awplus# erase web-auth-https-file

Commands

auth-web-server ssl

copy web-auth-https-file

show auth-web-server

C613-50292-01 Rev A Command Reference for IE210L Series 1223

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

PLATFORM L3-VLAN-HASHING-ALGORITHM

platform l3-vlan-hashing-algorithm

Overview This command enables you to change the L3 VLAN hash-key-generating

algorithm.

The no variant of this command returns the hash-key algorithm to the default of

crc32l.

Syntax platform l3-vlan-hashing-algorithm

{crc16l|crc16u|crc32l|crc32u}

no platform l3-vlan-hashing-algorithm

Default The hash-key algorithm is crc32l by default.

Mode Global configuration

Usage Occasionally, when using the Multiple Dynamic VLAN feature, a supplicant cannot

be authenticated because a collision occurs within the VLAN L3 table. This can

happen when more than four different IP addresses produce the same hash-key.

When this situation occurs, collisions can sometimes be avoided by changing the

hashing algorithm from its default of crc32l. Several different algorithms may need

to be tried to rectify the problem.

You must restart the switch for this command to take effect.

Note that this command is intended for technical support staff, or advanced end

users.

Example To change the hash-key generating algorithm applying to the lower bits of CRC-16,

use the command:

awplus# configure terminal

awplus(config)# platform l3-vlan-hashing-algorithm crc16l

Commands

platform mac-vlan-hashing-algorithm

show platform

Parameter Description

crc16l The algorithm that will apply to the lower bits of CRC-16

crc16u The algorithm that will apply to the upper bits of CRC-16

crc32l The algorithm that will apply to the lower bits of CRC-32

crc32u The algorithm that will apply to the upper bits of CRC-32

C613-50292-01 Rev A Command Reference for IE210L Series 1224

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

PLATFORM MAC-VLAN-HASHING-ALGORITHM

platform mac-vlan-hashing-algorithm

Overview This command enables you to change the MAC VLAN hash-key-generating

algorithm.

The no variant of this command returns the hash-key algorithm to the default of

crc32l

Syntax platform mac-vlan-hashing-algorithm

{crc16l|crc16u|crc32l|crc32u}

no platform mac-vlan-hashing-algorithm

Default The hash-key algorithm is crc32l by default.

Mode Global configuration

Usage Occasionally, when using the Multiple Dynamic VLAN feature, a supplicant cannot

be authenticated because a collision occurs within the VLAN MAC table. This can

happen when more than four different MAC addresses produce the same

hash-key.

When this situation occurs, collisions can sometimes be avoided by changing the

hashing algorithm from its default of crc32l. Several different algorithms may need

to be tried to rectify the problem.

You must restart the switch for this command to take effect.

Note that this command is intended for technical support staff, or advanced end

users.

Example To change the hash-key generating algorithm applying to the lower bits of CRC-16,

use the command:

awplus# configure terminal

awplus(config)# platform mac-vlan-hashing-algorithm crc16l

Commands

platform l3-vlan-hashing-algorithm

show platform

Parameter Description

crc16l The algorithm that will apply to the lower bits of CRC-16

crc16u The algorithm that will apply to the upper bits of CRC-16

crc32l The algorithm that will apply to the lower bits of CRC-32

crc32u The algorithm that will apply to the upper bits of CRC-32

C613-50292-01 Rev A Command Reference for IE210L Series 1225

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH

show auth

Overview This command shows the configuration state of authentication.

Syntax show auth [all]

Mode Privileged Exec

Example To display all authentication information, enter the command:

awplus# show auth all

Output Figure 34-1: Example output from the show auth command

Parameter Description

all Display all authentication information for each authenticated

interface. This can be a static channel (or static aggregator), or a

dynamic (or LACP) channel group, or a switch port.

awplus# show auth all

802.1X Port-Based Authentication Enabled

MAC-based Port Authentication Disabled

WEB-based Port Authentication Enabled

RADIUS server address (auth): 150.87.17.192:1812

Last radius message id: 4

Authentication Info for interface port1.0.1

portEnabled: true - portControl: Auto

portStatus: Authorized

reAuthenticate: disabled

reAuthPeriod: 3600

PAE: quietPeriod: 60 - maxReauthReq: 2 - txPeriod: 30

BE: suppTimeout: 30 - serverTimeout: 30

CD: adminControlledDirections: in

KT: keyTxEnabled: false

critical: disabled

guestVlan: disabled

authFailVlan: disabled

dynamicVlanCreation: disabled

multiVlanCreation: disabled

hostMode: single-host

dot1x: enabled

protocolVersion: 1

authMac: disabled

authWeb: enabled

method: PAP

maxAuthFail: 3

packetForwarding:

10.0.0.1 80/tcp

dns

dhcp

C613-50292-01 Rev A Command Reference for IE210L Series 1226

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH

Commands

show dot1x

twoStepAuthentication:

configured: enabled

actual: enabled

supplicantMac: none

Supplicant name: oha

Supplicant address: 000d.6013.5398

authenticationMethod: WEB-based Authentication

Two-Step Authentication:

firstAuthentication: Pass - Method: dot1x

secondAuthentication: Pass - Method: web

portStatus: Authorized - currentId: 3

abort:F fail:F start:F timeout:F success:T

PAE: state: Authenticated - portMode: Auto

PAE: reAuthCount: 0 - rxRespId: 0

PAE: quietPeriod: 60 - maxReauthReq: 2

BE: state: Idle - reqCount: 0 - idFromServer: 2

CD: adminControlledDirections: in - operControlledDirections: in

CD: bridgeDetected: false

KR: rxKey: false

KT: keyAvailable: false - keyTxEnabled: false

C613-50292-01 Rev A Command Reference for IE210L Series 1227

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH DIAGNOSTICS

show auth diagnostics

Overview This command shows authentication diagnostics, optionally for the specified

interface, which may be a static channel (or static aggregator) or a dynamic (or

LACP) channel group or a switch port.

If no interface is specified then authentication diagnostics are shown for all

interfaces.

Syntax show auth diagnostics [interface <interface-list>]

Mode Privileged Exec

Example To display authentication diagnostics for port1.0.6, enter the command:

awplus# show auth diagnostics interface port1.0.6

Parameter Description

interface Specify ports to show.

<interface-list> The interfaces or ports to configure. An interface-list can be:

•an interface (e.g. vlan2), a switch port (e.g. port1.0.6),

a static channel group (e.g. sa2) or a dynamic (LACP)

channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or sa1-2,

or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.4-1.0.6. Do not mix interface

types in a list

The specified interfaces must exist.

C613-50292-01 Rev A Command Reference for IE210L Series 1228

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH DIAGNOSTICS

Output Figure 34-2: Example output from the show auth diagnostics command

Commands

show dot1x interface

Authentication Diagnostics for interface port1.0.6

Supplicant address: 00d0.59ab.7037

authEnterConnecting: 2

authEaplogoffWhileConnecting: 1

authEnterAuthenticating: 2

authSuccessWhileAuthenticating: 1

authTimeoutWhileAuthenticating: 1

authFailWhileAuthenticating: 0

authEapstartWhileAuthenticating: 0

authEaplogoggWhileAuthenticating: 0

authReauthsWhileAuthenticated: 0

authEapstartWhileAuthenticated: 0

authEaplogoffWhileAuthenticated: 0

BackendResponses: 2

BackendAccessChallenges: 1

BackendOtherrequestToSupplicant: 3

BackendAuthSuccess: 1

C613-50292-01 Rev A Command Reference for IE210L Series 1229

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH INTERFACE

show auth interface

Overview This command shows the status of port authentication on the specified interface,

which may be a static channel (or static aggregator) or a dynamic (or LACP)

channel group or a switch port.

Use the optional diagnostics parameter to show authentication diagnostics for

the specified interface. Use the optional sessionstatistics parameter to show

authentication session statistics for the specified interface. Use the optional

statistics parameter to show authentication diagnostics for the specified

interface. Use the optional supplicant (client device) parameter to show the

supplicant state for the specified interface.

Syntax show auth interface <interface-list>

[diagnostics|sessionstatistics|statistics|supplicant [brief]]

Mode Privileged Exec

Example To display the Web based authentication status for port1.0.6, enter the command:

awplus# show auth interface port1.0.6

If web-based authentication is not configured, the output will be

Parameter Description

<interface-list> The interfaces or ports to configure. An interface-list can be:

•an interface (e.g. vlan2), a switch port (e.g. port1.0.6),

a static channel group (e.g. sa2) or a dynamic (LACP)

channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or

sa1-2, or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.4-1.0.6. Do not mix interface

types in a list

The specified interfaces must exist.

diagnostics Diagnostics.

sessionstatistics Session statistics.

statistics Statistics.

supplicant Supplicant (client device).

brief Brief summary of supplicant state.

% Port-Control not configured on port1.0.6

C613-50292-01 Rev A Command Reference for IE210L Series 1230

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH INTERFACE

To display the Web based authentication status for port1.0.1, enter the command:

awplus# show auth interface port1.0.1

To display Web-Authentication diagnostics for port1.0.6, enter the command:

awplus# show auth interface port1.0.6 diagnostics

awplus# show auth interface port1.0.1

Authentication Info for interface port1.0.1

portEnabled: true - portControl: Auto

portStatus: Authorized

reAuthenticate: disabled

reAuthPeriod: 3600

PAE: quietPeriod: 60 - maxReauthReq: 2 - txPeriod: 30

BE: suppTimeout: 30 - serverTimeout: 30

CD: adminControlledDirections: in

KT: keyTxEnabled: false

critical: disabled

guestVlan: disabled

guestVlanForwarding:none

authFailVlan: disabled

dynamicVlanCreation: disabled

multiVlanCreation: disabled

hostMode: single-host

dot1x: enabled

protocolVersion: 1

authMac: disabled

authWeb: enabled

method: PAP

maxAuthFail: 3

packetForwarding:

10.0.0.1 80/tcp

dns

dhcp

twoStepAuthentication:

configured: enabled

actual: enabled

supplicantMac: none

C613-50292-01 Rev A Command Reference for IE210L Series 1231

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH INTERFACE

To display Web-Authentication session statistics for port1.0.6, enter the command:

awplus# show auth interface port1.0.6 sessionstatistics

To display Web-Authentication statistics for port1.0.6, enter the command:

awplus# show auth statistics interface port1.0.6

To display the Web-Authenticated supplicant on interface port1.0.6, enter the

command:

awplus# show auth interface port1.0.6 supplicant

Commands

show auth diagnostics

show dot1x sessionstatistics

show dot1x statistics interface

show dot1x supplicant interface

Authentication Diagnostics for interface port1.0.6 



Supplicant address: 00d0.59ab.7037

authEnterConnecting: 2

authEaplogoffWhileConnecting: 1

authEnterAuthenticating: 2

authSuccessWhileAuthenticating: 1

authTimeoutWhileAuthenticating: 1

authFailWhileAuthenticating: 0

authEapstartWhileAuthenticating: 0

authEaplogoggWhileAuthenticating: 0

authReauthsWhileAuthenticated: 0

authEapstartWhileAuthenticated: 0

authEaplogoffWhileAuthenticated: 0

BackendResponses: 2

BackendAccessChallenges: 1

BackendOtherrequestToSupplicant: 3

BackendAuthSuccess: 1

Authentication session statistics for interface port1.0.6

session user name: manager

session authentication method: Remote server

session time: 19440 secs

session terminat cause: Not terminated yet

C613-50292-01 Rev A Command Reference for IE210L Series 1232

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH SESSIONSTATISTICS

show auth sessionstatistics

Overview This command shows authentication session statistics for the specified interface,

which may be a static channel (or static aggregator) or a dynamic (or LACP)

channel group or a switch port.

Syntax show auth sessionstatistics [interface <interface-list>]

Mode Privileged Exec

Example To display authentication statistics for port1.0.6, enter the command:

awplus# show auth sessionstatistics interface port1.0.6

Output Figure 34-3: Example output from the show auth sessionstatistics command

Parameter Description

interface Specify ports to show.

<interface-list> The interfaces or ports to configure. An interface-list can be:

•an interface (e.g. vlan2), a switch port (e.g.

port1.0.6), a static channel group (e.g. sa2) or a

dynamic (LACP) channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by

a hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or

sa1-2, or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.4-1.0.6. Do not mix

interface types in a list

The specified interfaces must exist.

Authentication session statistics for interface port1.0.6

session user name: manager

session authentication method: Remote server

session time: 19440 secs

session terminat cause: Not terminated yet

C613-50292-01 Rev A Command Reference for IE210L Series 1233

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH STATISTICS INTERFACE

show auth statistics interface

Overview This command shows the authentication statistics for the specified interface,

which may be a static channel (or static aggregator) or a dynamic (or LACP)

channel group or a switch port.

Syntax show auth statistics interface <interface-list>

Mode Privileged Exec

Example To display Web-Authentication statistics for port1.0.4, enter the command:

awplus# show auth statistics interface port1.0.4

Commands

show dot1x interface

Parameter Description

<interface-list> The interfaces or ports to configure. An interface-list can be:

• an interface (e.g. vlan2), a switch port (e.g. port1.0.6),

a static channel group (e.g. sa2) or a dynamic (LACP)

channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or sa1-2,

or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.4-1.0.6. Do not mix interface

types in a list

The specified interfaces must exist.

C613-50292-01 Rev A Command Reference for IE210L Series 1234

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH SUPPLICANT

show auth supplicant

Overview This command shows the supplicant (client device) state when authentication is

configured for the switch. Use the optional brief parameter to show a summary of

the supplicant state.

Syntax show auth supplicant [<macadd>] [brief]

Mode Privileged Exec

Examples To display a summary of authenticated supplicant information on the device, enter

the command:

awplus# show auth supplicant brief

To display authenticated supplicant information on the device, enter the

command:

awplus# show auth supplicant

To display authenticated supplicant information for device with MAC address

0000.5E00.5301, enter the command:

awplus# show auth supplicant 0000.5E00.5301

Output Figure 34-4: Example output from show auth supplicant brief

Parameter Description

<macadd>Mac (hardware) address of the supplicant.

Entry format is HHHH.HHHH.HHHH (hexadecimal).

brief Brief summary of the supplicant state.

awplus#show auth supplicant brief

Interface port2.0.3

authenticationMethod: dot1x/mac/web

Two-Step Authentication

firstMethod: mac

secondMethod: dot1x/web

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 0

webBasedAuthenticationSupplicantNum: 1

otherAuthenticationSupplicantNum: 0RADIUS Group Configuration



Interface VID Mode MAC Address Status IP Address Username

=========== ==== ==== ============== ================= =============== ========

port2.0.3 1 W 001c.233e.e15a Authenticated 192.168.1.181 test

C613-50292-01 Rev A Command Reference for IE210L Series 1235

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH SUPPLICANT

Figure 34-5: Example output from show auth supplicant

Figure 34-6: Example output from show auth supplicant 0000.5E00.5301

awplus#show auth supplicant

Interface port2.0.3

authenticationMethod: dot1x/mac/web

Two-Step Authentication

firstMethod: mac

secondMethod: dot1x/web

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 0

webBasedAuthenticationSupplicantNum: 1

otherAuthenticationSupplicantNum: 0



Supplicant name: test

Supplicant address: 0000.5E00.5301

authenticationMethod: WEB-based Authentication

Two-Step Authentication:

firstAuthentication: Pass - Method: mac

secondAuthentication: Pass - Method: web

portStatus: Authorized - currentId: 1

abort:F fail:F start:F timeout:F success:T

PAE: state: Authenticated - portMode: Auto

PAE: reAuthCount: 0 - rxRespId: 0

PAE: quietPeriod: 60 - maxReauthReq: 2

BE: state: Idle - reqCount: 0 - idFromServer: 0

CD: adminControlledDirections: in - operControlledDirections: in

CD: bridgeDetected: false

KR: rxKey: false

KT: keyAvailable: false - keyTxEnabled: false

RADIUS server group (auth): radius

RADIUS server (auth): 192.168.1.40

awplus#show auth supplicant 0000.5E00.5301

Interface port2.0.3

Supplicant name: test

Supplicant address: 0000.5E00.5301

authenticationMethod: WEB-based Authentication

Two-Step Authentication:

firstAuthentication: Pass - Method: mac

secondAuthentication: Pass - Method: web

portStatus: Authorized - currentId: 1

abort:F fail:F start:F timeout:F success:T

PAE: state: Authenticated - portMode: Auto

PAE: reAuthCount: 0 - rxRespId: 0

PAE: quietPeriod: 60 - maxReauthReq: 2

BE: state: Idle - reqCount: 0 - idFromServer: 0

CD: adminControlledDirections: in - operControlledDirections: in

CD: bridgeDetected: false

KR: rxKey: false

KT: keyAvailable: false - keyTxEnabled: false

RADIUS server group (auth): radius

RADIUS server (auth): 192.168.1.40

C613-50292-01 Rev A Command Reference for IE210L Series 1236

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH SUPPLICANT

Commands

aaa accounting auth-mac

aaa accounting auth-web

aaa accounting dot1x

aaa authentication auth-mac

aaa authentication auth-web

aaa authentication dot1x

C613-50292-01 Rev A Command Reference for IE210L Series 1237

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH SUPPLICANT INTERFACE

show auth supplicant interface

Overview This command shows the supplicant (client device) state for the authentication

mode set for the interface, which may be a static channel (or static aggregator) or

a dynamic (or LACP) channel group or a switch port. Use the optional brief

parameter to show a summary of the supplicant state.

Syntax show auth-web supplicant interface <interface-list> [brief]

Mode Privileged Exec

Examples To display the authenticated supplicant on the interface port1.0.2, enter the

command:

awplus# show auth supplicant interface port1.0.2

To display brief summary output for the authenticated supplicant on the interface

port1.0.2, enter the command:

awplus# show auth supplicant interface port1.0.2 brief

Parameter Description

<interface-list> The interfaces or ports to configure. An interface-list can be:

•an interface (e.g. vlan2), a switch port (e.g. port1.0.6),

a static channel group (e.g. sa2) or a dynamic (LACP)

channel group (e.g. po2)

• a continuous range of interfaces, ports, static channel

groups or dynamic (LACP) channel groups separated by a

hyphen; e.g. vlan2-8, or port1.0.1-1.0.4, or sa1-2,

or po1-2

• a comma-separated list of the above; e.g.

port1.0.1,port1.0.4-1.0.6. Do not mix interface

types in a list

The specified interfaces must exist.

brief Brief summary of the supplicant state.

C613-50292-01 Rev A Command Reference for IE210L Series 1238

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH TWO-STEP SUPPLICANT BRIEF

show auth two-step supplicant brief

Overview This command displays the supplicant state of the two-step authentication feature

on the interface.

Syntax show auth two-step supplicant [interface <ifrange>] brief

Mode Privileged Exec

Usage Do not mix interface types in a list. The specified interfaces must exist.

Example To display the supplicant state of the two-step authentication feature, enter the

command:

awplus# show two-step supplicant interface port1.0.6 brief

Output Figure 34-7: Example output from show auth two-step supplicant brief

Commands

auth two-step enable

Parameter Description

interface The interface selected for display.

<ifrange>The interface types which can be specified as <ifrange>

• Switch port (e.g. port1.0.6)

• Static channel group (e.g. sa3)

• Dynamic (LACP) channel group (e.g. po4)

interface port1.0.6



authenticationMethod: dot1x/mac



Two-Step Authentication:

firstMethod:mac

secondMethod:dot1x

totalSupplicantNum: 1

authorizedSupplicantNum: 1

macBasedAuthenticationSupplicantNum: 0

dot1xAuthenticationSupplicantNum: 1

webBasedAuthenticationSupplicantNum: 0

otherAuthenticationSupplicantNum: 0



Interface VID Mode MAC Address Status FirstStep SecondStep

========== === ==== =========== ====== ========= ==========

port1.0.6 1 D 000b..db67.00f7 Authenticated Pass Pass

C613-50292-01 Rev A Command Reference for IE210L Series 1239

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH-WEB-SERVER

show auth-web-server

Overview This command shows the Web-Authentication server configuration and status on

the switch.

Syntax show auth-web-server

Mode Privileged Exec

Example To display Web-Authentication server configuration and status, enter the

command:

awplus# show auth-web-server

Output Figure 34-8: Example output from the show auth-web-server command

Commands

auth-web-server ipaddress

auth-web-server port

auth-web-server redirect-delay-time

auth-web-server redirect-url

auth-web-server session-keep

auth-web-server ssl

Web authentication server

Server status: enabled

Server mode: none

Server address: 192.168.1.1/24

DHCP server enabled

DHCP lease time: 20

DHCP WPAD Option URL: http://192.168.1.1/proxy.pac

HTTP Port No: 80

Security: disabled

Certification: default

SSL Port No: 443

Redirect URL: --

Redirect Delay Time: 5

HTTP Redirect: enabled

Session keep: disabled

PingPolling: disabled

PingInterval: 30

Timeout: 1

FailCount: 5

ReauthTimerReFresh: disabled

C613-50292-01 Rev A Command Reference for IE210L Series 1240

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW AUTH-WEB-SERVER PAGE

show auth-web-server page

Overview This command displays the web-authentication page configuration and status.

Syntax show auth-web-server page

Mode Privileged Exec

Examples To show the web-authentication page information, use the command:

awplus# show auth-web-server page

Figure 34-9: Example output from the show auth-web-server page command

Commands

auth-web forward

auth-web-server page logo

auth-web-server page sub-title

auth-web-server page success-message

auth-web-server page title

auth-web-server page welcome-message

awplus#show auth-web-server page

Web authentication page

Logo: auto

Title: default

Sub-Title: Web Authentication

Welcome message: Your welcome message 

Success message: Your success message

C613-50292-01 Rev A Command Reference for IE210L Series 1241

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AUTHENTICATION COMMANDS

SHOW PROXY-AUTOCONFIG-FILE

show proxy-autoconfig-file

Overview This command displays the contents of the proxy auto configuration (PAC) file.

Syntax show proxy-autoconfig-file

Mode Privileged Exec

Example To display the contents of the proxy auto configuration (PAC) file, enter the

command:

awplus# show auth proxy-autoconfig-file

Output Figure 34-10: Example output from show proxy-autoconfig-file

Commands

copy proxy-autoconfig-file

erase proxy-autoconfig-file

function FindProxyForURL(url,host)

{

if (isPlainHostName(host) ||

isInNet(host, “192.168.1.0”,”255.255.255.0”)) {

return “DIRECT”;

}

else {

return “PROXY 192.168.110.1:8080”;

}

C613-50292-01 Rev A Command Reference for IE210L Series 1242

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA Commands

Introduction

Overview This chapter provides an alphabetical reference for AAA commands for

Authentication, Authorization and Accounting. For more information, see the AAA

and Port_Authentication Feature Overview and Configuration Guide.

Command List •“aaa accounting auth-mac” on page 1244

•“aaa accounting auth-web” on page 1246

•“aaa accounting commands” on page 1248

•“aaa accounting dot1x” on page 1250

•“aaa accounting login” on page 1252

•“aaa accounting update” on page 1255

•“aaa authentication auth-mac” on page 1257

•“aaa authentication auth-web” on page 1259

•“aaa authentication dot1x” on page 1261

•“aaa authentication enable default group tacacs+” on page 1263

•“aaa authentication enable default local” on page 1265

•“aaa authentication login” on page 1266

•“aaa authorization commands” on page 1268

•“aaa authorization config-commands” on page 1270

•“aaa group server” on page 1271

•“aaa local authentication attempts lockout-time” on page 1273

•“aaa local authentication attempts max-fail” on page 1274

•“aaa login fail-delay” on page 1275

•“accounting login” on page 1276

C613-50292-01 Rev A Command Reference for IE210L Series 1243

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

•“authorization commands” on page 1277

•“clear aaa local user lockout” on page 1279

•“debug aaa” on page 1280

•“login authentication” on page 1281

•“proxy-port” on page 1282

•“radius-secure-proxy aaa” on page 1283

•“server (radsecproxy-aaa)” on page 1284

•“server mutual-authentication” on page 1286

•“server name-check” on page 1287

•“server trustpoint” on page 1288

•“show aaa local user locked” on page 1290

•“show aaa server group” on page 1291

•“show debugging aaa” on page 1292

•“show radius server group” on page 1293

•“undebug aaa” on page 1295

C613-50292-01 Rev A Command Reference for IE210L Series 1244

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING AUTH-MAC

aaa accounting auth-mac

Overview This command configures an accounting method list for MAC-based

authentication. An accounting method list specifies what type of accounting

messages are sent and which RADIUS servers the accounting messages are sent to.

Use this command to configure either the default method list, which is

automatically applied to interfaces with MAC-based authentication enabled, or a

named method list, which can be applied to an interface with the auth-mac

accounting command.

Use the no variant of this command to disable either the default or a named

accounting method list for MAC-based authentication. Once all method lists are

disabled, AAA accounting for MAC-based authentication is disabled globally.

Syntax aaa accounting auth-mac {default|<list-name>}

{start-stop|stop-only|none} group {<group-name>|radius}

no aaa accounting auth-mac {default|<list-name>}

Default RADIUS accounting for MAC-based Authentication is disabled by default

Mode Global Configuration

Usage This command can be used to configure either the default accounting method list

or a named accounting method list:

•default: the default accounting method list which is automatically applied

to all interfaces with MAC-based authentication enabled.

•<list-name>: a user named list which can be applied to an interface using the

auth-mac accounting command.

There are two ways to define servers where RADIUS accounting messages are sent:

•group radius: use all RADIUS servers configured by radius-server host

command

Parameter Description

default Configure the default accounting method list

<list-name>Configure a named accounting method list

start-stop Sends a start accounting message at the beginning of the session

and a stop accounting message at the end of the session.

stop-only Only sends a stop accounting message at the end of the session.

none No accounting record sent.

group Use a server group

<group-name>Server group name.

radius Use all RADIUS servers.

C613-50292-01 Rev A Command Reference for IE210L Series 1245

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING AUTH-MAC

•group <group-name>: use the specified RADIUS server group configured

with the aaa group server command

The accounting event to send to the RADIUS server is configured with the

following options:

•start-stop: sends a start accounting message at the beginning of a session

and a stop accounting message at the end of the session.

•stop-only: sends a stop accounting message at the end of a session.

•none: disables accounting.

Examples To enable the default RADIUS accounting for MAC-based authentication, and use

all available RADIUS servers, use the commands:

awplus# configure terminal

awplus(config)# aaa accounting auth-mac default start-stop

group radius

To disable RADIUS accounting for MAC-based Authentication, use the commands:

awplus# configure terminal

awplus(config)# no aaa accounting auth-mac default

To enable a named RADIUS accounting method list 'vlan10_acct' for MAC-based

authentication, with the RADIUS server group 'rad_group_vlan10, use the

commands:

awplus# configure terminal

awplus(config)# aaa accounting auth-mac vlan10_acct start-stop

group rad_group_vlan10

To disable a named RADIUS accounting method list 'vlan10_acct' for MAC-based

authentication, use the commands:

awplus# configure terminal

awplus(config)# no aaa accounting auth-mac vlan10_acct

Commands

aaa authentication auth-mac

aaa group server

auth-mac accounting

auth-mac enable

radius-server host

show aaa server group

C613-50292-01 Rev A Command Reference for IE210L Series 1246

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING AUTH-WEB

aaa accounting auth-web

Overview This command configures an accounting method list for Web-based

authentication. An accounting method list specifies what type of accounting

messages are sent and which RADIUS servers the accounting messages are sent to.

Use this command to configure either the default method list, which is

automatically applied to interfaces with Web-based authentication enabled, or a

named method list, which can be applied to an interface with the auth-web

accounting command.

Use the no variant of this command to disable either the default or a named

accounting method list for Web-based authentication. Once all method lists are

disabled, AAA accounting for Web-based authentication is disabled globally.

Syntax aaa accounting auth-web {default|<list-name>}

{start-stop|stop-only|none} group {<group-name>|radius}

no aaa accounting auth-web {default|<list-name>}

Default RADIUS accounting for Web-based authentication is disabled by default.

Mode Global Configuration

Usage This command can be used to configure either the default accounting method list

or a named accounting method list:

•default: the default accounting method list which is automatically applied

to all interfaces with Web-based authentication enabled.

•<list-name>: a user named list which can be applied to an interface using the

auth-web accounting command.

There are two ways to define servers where RADIUS accounting messages are sent:

•group radius: use all RADIUS servers configured by radius-server host

command

Parameter Description

default Configure the default accounting method list

<list-name>Configure a named accounting method list

start-stop Sends a start accounting message at the beginning of the session

and a stop accounting message at the end of the session.

stop-only Only sends a stop accounting message at the end of the session.

none No accounting record sent.

group Use a server group

<group-name>Server group name.

radius Use all RADIUS servers.

C613-50292-01 Rev A Command Reference for IE210L Series 1247

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING AUTH-WEB

•group <group-name>: use the specified RADIUS server group configured

with the aaa group server command

Configure the accounting event to be sent to the RADIUS server with the following

options:

•start-stop: sends a start accounting message at the beginning of a session

and a stop accounting message at the end of the session.

•stop-only: sends a stop accounting message at the end of a session.

•none: disables accounting.

Examples To enable the default RADIUS accounting method for Web-based authentication,

and use all available RADIUS servers, use the commands:

awplus# configure terminal

awplus(config)# aaa accounting auth-web default start-stop

group radius

To disable the default RADIUS accounting method for Web-based authentication,

use the commands:

awplus# configure terminal

awplus(config)# no aaa accounting auth-web default

To enable a named RADIUS accounting method list 'vlan10_acct' for Web-based

authentication, with the RADIUS server group 'rad_group_vlan10, use the

commands:

awplus# configure terminal

awplus(config)# aaa accounting auth-web vlan10_acct start-stop

group rad_group_vlan10

To disable a named RADIUS accounting method list 'vlan10_acct' for Web-based

authentication, use the commands:

awplus# configure terminal

awplus(config)# no aaa accounting auth-web vlan10_acct

Commands

aaa authentication auth-web

aaa group server

auth-web accounting

auth-web enable

radius-server host

show aaa server group

C613-50292-01 Rev A Command Reference for IE210L Series 1248

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING COMMANDS

aaa accounting commands

Overview This command configures and enables TACACS+ accounting on commands

entered at a specified privilege level. Once enabled for a privilege level, accounting

messages for commands entered at that privilege level will be sent to a TACACS+

server.

In order to account for all commands entered on a device, configure command

accounting for each privilege level separately.

The command accounting message includes, the command as entered, the date

and time the command finished executing, and the user-name of the user who

executed the command.

Use the no variant of this command to disable command accounting for a

specified privilege level.

Syntax aaa accounting commands <1-15> default stop-only group tacacs+

no aaa accounting commands <1-15> default

Default TACACS+ command accounting is disabled by default.

Mode Global Configuration

Usage This command only supports a default method list, this means that it is applied to

every console and VTY line.

The stop-only parameter indicates that the command accounting messages are

sent to the TACACS+ server when the commands have stopped executing.

The group tacacs+ parameters signifies that the command accounting messages

are sent to the TACACS+ servers configured by the tacacs-server host command.

Note that up to four TACACS+ servers can be configured for accounting. The

servers are checked for reachability in the order they are configured with only the

first reachable server being used. If no server is found, the accounting message is

dropped.

Parameter Description

<1-15>The privilege level being configured, in the range 1 to 15.

default Use the default method list, this means the command is applied

globally to all user exec sessions.

stop-only Send accounting message when the commands have stopped

executing.

group Specify the server group where accounting messages are sent.

Only the tacacs+ group is available for this command.

tacacs+ Use all TACACS+ servers configured by the tacacs-server host

command.

C613-50292-01 Rev A Command Reference for IE210L Series 1249

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING COMMANDS

Command accounting cannot coexist with triggers. An error message is displayed

if you attempt to enable command accounting while a trigger is configured.

Likewise, an error message is displayed if you attempt to configure a trigger while

command accounting is configured.

Examples To configure command accounting for privilege levels 1, 7, and 15, use the

following commands:

awplus# configure terminal

awplus(config)# aaa accounting commands 1 default stop-only

group tacacs+

awplus(config)# aaa accounting commands 7 default stop-only

group tacacs+

awplus(config)# aaa accounting commands 15 default stop-only

group tacacs+

To disable command accounting for privilege levels 1, 7, and 15, use the following

commands:

awplus# configure terminal

awplus(config)# no aaa accounting commands 1 default

awplus(config)# no aaa accounting commands 7 default

awplus(config)# no aaa accounting commands 15 default

Commands

aaa authentication login

aaa accounting login

accounting login

tacacs-server host

C613-50292-01 Rev A Command Reference for IE210L Series 1250

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING DOT1X

aaa accounting dot1x

Overview This command configures an accounting method list for IEEE 802.1X-based

authentication. An accounting method list specifies what type of accounting

messages are sent and which RADIUS servers the accounting messages are sent to.

Use this command to configure either the default method list, which is

automatically applied to interfaces with IEEE 802.1X-based authentication

enabled, or a named method list, which can be applied to an interface with the

dot1x accounting command.

Use the no variant of this command to disable either the default or a named

accounting method list for 802.1X-based authentication. Once all method lists are

disabled, AAA accounting for 802.1x-based authentication is disabled globally.

Syntax aaa accounting dot1x {default|<list-name>}

{start-stop|stop-only|none} group {<group-name>|radius}

no aaa accounting dot1x {default|<list-name>}

Default RADIUS accounting for 802.1X-based authentication is disabled by default (there

is no default server set by default).

Mode Global Configuration

Usage This command can be used to configure either the default accounting method list

or a named accounting method list:

•default: the default accounting method list which is automatically applied

to all interfaces with 802.1X-based authentication enabled.

•<list-name>: a user named list which can be applied to an interface using the

dot1x accounting command.

There are two ways to define servers where RADIUS accounting messages will be

sent:

Parameter Description

default Configure the default accounting method list

<list-name>Configure a named accounting method list

start-stop Sends a start accounting message at the beginning of the session

and a stop accounting message at the end of the session.

stop-only Only sends a stop accounting message at the end of the session.

none No accounting record sent.

group Use a server group

<group-name>Server group name.

radius Use all RADIUS servers.

C613-50292-01 Rev A Command Reference for IE210L Series 1251

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING DOT1X

•group radius: use all RADIUS servers configured by radius-server host

command.

•group <group-name>: use the specified RADIUS server group configured

with the aaa group server command.

The accounting event to send to the RADIUS server is configured by the following

options:

•start-stop: sends a start accounting message at the beginning of a session

and a stop accounting message at the end of the session.

•stop-only: sends a stop accounting message at the end of a session.

•none: disables accounting.

Examples To enable RADIUS accounting for 802.1X-based authentication, and use all

available RADIUS Servers, use the commands:

awplus# configure terminal

awplus(config)# aaa accounting dot1x default start-stop group

radius

To disable RADIUS accounting for 802.1X-based authentication, use the

commands:

awplus# configure terminal

awplus(config)# no aaa accounting dot1x default

To enable a named RADIUS accounting method list 'vlan10_acct' for 802.1X-based

authentication, with the RADIUS server group 'rad_group_vlan10, use the

commands:

awplus# configure terminal

awplus(config)# aaa accounting dot1x vlan10_acct start-stop

group rad_group_vlan10

To disable a named RADIUS accounting method list 'vlan10_acct' for 802.1X-based

authentication, use the commands:

awplus# configure terminal

awplus(config)# no aaa accounting dot1x vlan10_acct

Commands

aaa accounting update

aaa authentication dot1x

aaa group server

dot1x accounting

dot1x port-control

radius-server host

show aaa server group

C613-50292-01 Rev A Command Reference for IE210L Series 1252

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING LOGIN

aaa accounting login

Overview This command configures RADIUS and TACACS+ accounting for login shell

sessions. The specified method list name can be used by the accounting login

command in the Line Configuration mode. If the default parameter is specified,

then this creates a default method list that is applied to every console and VTY line,

unless another accounting method list is applied on that line.

Note that unlimited RADIUS servers and up to four TACACS+ servers can be

configured and consulted for accounting. The first server configured is regarded as

the primary server and if the primary server fails then the backup servers are

consulted in turn. A backup server is consulted if the primary server fails, i.e. is

unreachable.

Use the no variant of this command to remove an accounting method list for login

shell sessions configured by an aaa accounting login command. If the method list

being deleted is already applied to a console or VTY line, accounting on that line

will be disabled. If the default method list name is removed by this command, it will

disable accounting on every line that has the default accounting configuration.

Syntax aaa accounting login

{default|<list-name>}{start-stop|stop-only|none} {group

{radius|tacacs+|<group-name>}}

no aaa accounting login {default|<list-name>}

Default Accounting for login shell sessions is disabled by default.

Mode Global Configuration

Parameter Description

default Default accounting method list.

<list-name>Named accounting method list.

start-stop Start and stop records to be sent.

stop-only Stop records to be sent.

none No accounting record to be sent.

group Specify the servers or server group where accounting packets are

sent.

radius Use all RADIUS servers configured by the radius-server host

command.

tacacs+ Use all TACACS+ servers configured by the tacacs-server host

command.

<group-name> Use the specified RADIUS server group, as configured by the aaa

group server command.

C613-50292-01 Rev A Command Reference for IE210L Series 1253

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING LOGIN

Usage This command enables you to define a named accounting method list. The items

that you define in the accounting options are:

• the types of accounting packets that will be sent

• the set of servers to which the accounting packets will be sent

You can define a default method list with the name default and any number of

other named method lists. The name of any method list that you define can then

be used as the <list-name> parameter in the accounting login command.

If the method list name already exists, the command will replace the existing

configuration with the new one.

There are two ways to define servers where RADIUS accounting messages are sent:

•group radius : use all RADIUS servers configured by radius-server host

command

•group <group-name> : use the specified RADIUS server group configured

with the aaa group server command

There is one way to define servers where TACACS+ accounting messages are sent:

•group tacacs+ : use all TACACS+ servers configured by tacacs-server host

command

The accounting event to send to the RADIUS or TACACS+ server is configured with

the following options:

•start-stop : sends a start accounting message at the beginning of a session

and a stop accounting message at the end of the session.

•stop-only : sends a stop accounting message at the end of a session.

•none : disables accounting.

Examples To configure RADIUS accounting for login shell sessions, use the following

commands:

awplus# configure terminal

awplus(config)# aaa accounting login default start-stop group

radius

To configure TACACS+ accounting for login shell sessions, use the following

commands:

awplus# configure terminal

awplus(config)# aaa accounting login default start-stop group

tacacs+

To reset the configuration of the default accounting list, use the following

commands:

awplus# configure terminal

awplus(config)# no aaa accounting login default

C613-50292-01 Rev A Command Reference for IE210L Series 1254

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING LOGIN

Commands

aaa accounting commands

aaa authentication login

aaa accounting login

aaa accounting update

accounting login

radius-server host

tacacs-server host

C613-50292-01 Rev A Command Reference for IE210L Series 1255

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING UPDATE

aaa accounting update

Overview This command enables periodic accounting reporting to either the RADIUS or

TACACS+ accounting server(s) wherever login accounting has been configured.

Note that unlimited RADIUS servers and up to four TACACS+ servers can be

configured and consulted for accounting. The first server configured is regarded as

the primary server and if the primary server fails then the backup servers are

consulted in turn. A backup server is consulted if the primary server fails, i.e. is

unreachable.

Use the no variant of this command to disable periodic accounting reporting to

the accounting server(s).

Syntax aaa accounting update [periodic <1-65535>]

no aaa accounting update

Default Periodic accounting update is disabled by default.

Mode Global Configuration

Usage Use this command to enable the device to send periodic AAA login accounting

reports to the accounting server. When periodic accounting report is enabled,

interim accounting records are sent according to the interval specified by the

periodic parameter. The accounting updates are start messages.

If the no variant of this command is used to disable periodic accounting reporting,

any interval specified by the periodic parameter is reset to the default of 30

minutes when accounting reporting is reenabled, unless this interval is specified.

Examples To configure the switch to send period accounting updates every 30 minutes, the

default period, use the following commands:

awplus# configure terminal

awplus(config)# aaa accounting update

To configure the switch to send period accounting updates every 10 minutes, use

the following commands:

awplus# configure terminal

awplus(config)# aaa accounting update periodic 10

Parameter Description

periodic Send accounting records periodically.

<1-65535>The interval to send accounting updates (in minutes). The default is

30 minutes.

C613-50292-01 Rev A Command Reference for IE210L Series 1256

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA ACCOUNTING UPDATE

To disable periodic accounting update wherever accounting has been configured,

use the following commands:

awplus# configure terminal

awplus(config)# no aaa accounting update

Commands

aaa accounting auth-mac

aaa accounting auth-web

aaa accounting dot1x

aaa accounting login

C613-50292-01 Rev A Command Reference for IE210L Series 1257

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION AUTH-MAC

aaa authentication auth-mac

Overview This command enables MAC-based authentication globally and allows you to

enable either the default authentication method list (in this case, a list of RADIUS

servers), which is automatically applied to every interface running MAC-based

authentication, or a user named authentication method list, which is applied to an

interface with the auth-mac authentication command.

Use the no variant of this command to disable either the default or a named

method list for MAC-based authentication. Once all method lists are disabled

MAC-based authentication is disabled globally.

Syntax aaa authentication auth-mac {default|<list-name>} group

{<group-name>|radius}

no aaa authentication auth-mac {default|<list-name>}

Default MAC-based Port Authentication is disabled by default.

Mode Global Configuration

Usage This command can be used to configure either the default authentication method

list or a named authentication method list:

•default: the default authentication method list which is automatically

applied to all interfaces with Web-based authentication enabled.

•<list-name>: a user named list which can be applied to an interface using the

auth-web authentication command.

There are two ways to define servers where RADIUS accounting messages are sent:

•group radius: use all RADIUS servers configured by radius-server host

command

•group <group-name>: use the specified RADIUS server group configured

with the aaa group server command

All configured RADIUS Servers are automatically members of the server group

radius. If a server is added to a named group <group-name>, it also remains a

member of the group radius.

Parameter Description

default Configure the default authentication method list

<list-name>Configure a named authentication method list

group Use a server group

<group-name>Server group name.

radius Use all RADIUS servers.

C613-50292-01 Rev A Command Reference for IE210L Series 1258

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION AUTH-MAC

Examples To enable MAC-based authentication globally for all RADIUS servers, and use all

available RADIUS servers, use the commands:

awplus# configure terminal

awplus(config)# aaa authentication auth-mac default group

radius

To disable MAC-based authentication, use the commands:

awplus# configure terminal

awplus(config)# no aaa authentication auth-mac default

To enable MAC-based authentication for named list 'vlan10_auth', with RADIUS

server group 'rad_group_vlan10, use the commands:

awplus# configure terminal

awplus(config)# aaa authentication auth-mac vlan10_auth group

rad_group_vlan10

To disable MAC-based authentication for named list 'vlan10_auth', use the

commands:

awplus# configure terminal

awplus(config)# no aaa authentication auth-mac vlan10_acct

Commands

aaa accounting auth-mac

aaa group server

auth-mac authentication

auth-mac enable

radius-server host

show aaa server group

C613-50292-01 Rev A Command Reference for IE210L Series 1259

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION AUTH-WEB

aaa authentication auth-web

Overview This command enables Web-based authentication globally and allows you to

enable either the default authentication method list (in this case, a list of RADIUS

servers), which is automatically applied to every interface running Web-based

authentication, or a user named authentication method list, which is applied to an

interface with the auth-web authentication command.

Use the no variant of this command to disable either the default or a named

method list for Web-based authentication. Once all method lists are disabled

Web-based authentication is disabled globally.

Syntax aaa authentication auth-web {default|<list-name>} group

{<group-name>|radius}

no aaa authentication auth-web {default|<list-name>}

Default Web-based authentication is disabled by default.

Mode Global Configuration

Usage This command can be used to configure either the default authentication method

list or a named authentication method list:

•default: the default authentication method list which is automatically

applied to all interfaces with Web-based authentication enabled.

•<list-name>: a user named list which can be applied to an interface using the

auth-web authentication command.

There are two ways to define servers where RADIUS accounting messages are sent:

•group radius: use all RADIUS servers configured by radius-server host

command

•group <group-name>: use the specified RADIUS server group configured

with the aaa group server command

Note that you need to configure an IPv4 address for the VLAN interface on which

Web authentication is running.

Parameter Description

default Configure the default authentication method list

<list-name>Configure a named authentication method list

group Use a server group

<group-name>Server group name.

radius Use all RADIUS servers.

C613-50292-01 Rev A Command Reference for IE210L Series 1260

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION AUTH-WEB

Examples To enable Web-based authentication globally for all RADIUS servers, and use all

available RADIUS servers, use the commands:

awplus# configure terminal

awplus(config)# aaa authentication auth-web default group

radius

To disable Web-based authentication, use the commands:

awplus# configure terminal

awplus(config)# no aaa authentication auth-web default

To enable Web-based authentication for named list 'vlan10_auth', with RADIUS

server group 'rad_group_vlan10, use the commands:

awplus# configure terminal

awplus(config)# aaa authentication auth-web vlan10_auth group

rad_group_vlan10

To disable Web-based authentication for named list 'vlan10_auth', use the

commands:

awplus# configure terminal

awplus(config)# no aaa authentication vlan10_auth

Commands

aaa accounting auth-web

aaa group server

auth-web authentication

auth-web enable

radius-server host

C613-50292-01 Rev A Command Reference for IE210L Series 1261

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION DOT1X

aaa authentication dot1x

Overview This command enables IEEE 802.1X-based authentication globally and allows you

to enable either the default authentication method list (in this case, a list of RADIUS

servers), which is automatically applied to every interface running IEEE

802.1X-based authentication, or a user named authentication method list, which is

applied to an interface with the dot1x authentication command.

Use the no variant of this command to disable either the default or a named

method list for 802.1X-based authentication. Once all method lists are disabled

802.1x-based authentication is disabled globally.

Syntax aaa authentication dot1x {default|<list-name>} group

{<group-name>|radius}

no aaa authentication dot1x {default|<list-name>}

Default 802.1X-based Port Authentication is disabled by default.

Mode Global Configuration

Usage This command can be used to configure either the default authentication method

list or a named authentication method list:

•default: the default authentication method list which is automatically

applied to all interfaces with 802.1X-based authentication enabled.

•<list-name>: a user named list which can be applied to an interface using the

aaa authentication dot1x command.

There are two ways to define servers where RADIUS accounting messages are sent:

•group radius: use all RADIUS servers configured by radius-server host

command

•group <group-name>: use the specified RADIUS server group configured

with the aaa group server command

Examples To enable 802.1X-based authentication globally with all RADIUS servers, and use

all available RADIUS servers, use the command:

awplus# configure terminal

awplus(config)# aaa authentication dot1x default group radius

Parameter Description

default Configure the default authentication method list

<list-name>Configure a named authentication method list

group Use a server group

<group-name>Server group name.

radius Use all RADIUS servers.

C613-50292-01 Rev A Command Reference for IE210L Series 1262

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION DOT1X

To disable 802.1X-based authentication, use the command:

awplus# configure terminal

awplus(config)# no aaa authentication dot1x default

To enable 802.1X-based authentication for named list 'vlan10_auth', with RADIUS

server group 'rad_group_vlan10, use the commands:

awplus# configure terminal

awplus(config)# aaa authentication dot1x vlan10_auth group

rad_group_vlan10

To disable 802.1X-based authentication for named list 'vlan10_auth use the

commands:

awplus# configure terminal

awplus(config)# no aaa authentication dot1x vlan10_acct

Commands

aaa accounting dot1x

aaa group server

dot1x authentication

dot1x port-control

radius-server host

show aaa server group

C613-50292-01 Rev A Command Reference for IE210L Series 1263

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION ENABLE DEFAULT GROUP TACACS+

aaa authentication enable default group

tacacs+

Overview This command enables privilege level authentication against a TACACS+ server.

Use the no variant of this command to disable privilege level authentication.

Syntax aaa authentication enable default group tacacs+ [local] [none]

no aaa authentication enable default

Default Local privilege level authentication is enabled by default (aaa authentication

enable default local command).

Mode Global Configuration

Usage A user is configured on a TACACS+ server with a maximum privilege level. When

they enter the enable (Privileged Exec mode) command they are prompted for an

enable password which is authenticated against the TACACS+ server. If the

password is correct and the specified privilege level is equal to or less than the

users maximum privilege level, then they are granted access to that level. If the

user attempts to access a privilege level that is higher than their maximum

configured privilege level, then the authentication session will fail and they will

remain at their current privilege level.

NOTE: If both local and none are specified, you must always specify local first.

If the TACACS+ server goes offline, or is not reachable during enable password

authentication, and command level authentication is configured as:

•aaa authentication enable default group tacacs+

then the user is never granted access to Privileged Exec mode.

•aaa authentication enable default group tacacs+ local

then the user is authenticated using the locally configured enable password,

which if entered correctly grants the user access to Privileged Exec mode. If

no enable password is locally configured (enable password command),

then the enable authentication will fail until the TACACS+ server becomes

available again.

Parameter Description

local Use the locally configured enable password (enable password

command) for authentication.

none No authentication.

C613-50292-01 Rev A Command Reference for IE210L Series 1264

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION ENABLE DEFAULT GROUP TACACS+

•aaa authentication enable default group tacacs+ none

then the user is granted access to Privileged Exec mode with no

authentication. This is true even if a locally configured enable password is

configured.

•aaa authentication enable default group tacacs+ local none

then the user is authenticated using the locally configured enable password.

If no enable password is locally configured, then the enable authentication

will grant access to Privileged Exec mode with no authentication.

If the password for the user is not successfully authenticated by the server, then the

user is again prompted for an enable password when they enter enable via the CLI.

Examples To enable a privilege level authentication method that will not allow the user to

access Privileged Exec mode if the TACACS+ server goes offline, or is not reachable

during enable password authentication, use the following commands:

awplus# configure terminal

awplus(config)# aaa authentication enable default group tacacs+

To enable a privilege level authentication method that will allow the user to access

Privileged Exec mode if the TACACS+ server goes offline, or is not reachable during

enable password authentication, and a locally configured enable password is

configured, use the following commands:

awplus# configure terminal

awplus(config)# aaa authentication enable default group tacacs+

local

To disable privilege level authentication, use the following commands:

awplus# configure terminal

awplus(config)# no aaa authentication enable default

Commands

aaa authentication login

aaa authentication enable default local

enable (Privileged Exec mode)

enable password

enable secret

tacacs-server host

C613-50292-01 Rev A Command Reference for IE210L Series 1265

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION ENABLE DEFAULT LOCAL

aaa authentication enable default local

Overview This command enables local privilege level authentication.

Use the no variant of this command to disable local privilege level authentication.

Syntax aaa authentication enable default local

no aaa authentication enable default

Default Local privilege level authentication is enabled by default.

Mode Global Configuration

Usage The privilege level configured for a particular user in the local user database is the

privilege threshold above which the user is prompted for an enable (Privileged

Exec mode) command.

Examples To enable local privilege level authentication, use the following commands:

awplus# configure terminal

awplus(config)# aaa authentication enable default local

To disable local privilege level authentication, use the following commands:

awplus# configure terminal

awplus(config)# no aaa authentication enable default

Commands

aaa authentication login

enable (Privileged Exec mode)

enable password

enable secret

C613-50292-01 Rev A Command Reference for IE210L Series 1266

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION LOGIN

aaa authentication login

Overview Use this command to create an ordered list of methods to use to authenticate user

more of the options local or group, in the order you want them to be applied. If

the default method list name is specified, it is applied to every console and VTY

line immediately unless another method list is applied to that line by the login

authentication command. To apply a non-default method list, you must also use

the login authentication command.

Use the no variant of this command to remove an authentication method list for

user login. The specified method list name is deleted from the configuration. If the

method list name has been applied to any console or VTY line, user login

authentication on that line will fail.

Note that the no aaa authentication login default command does not remove

the default method list. This will return the default method list to its default state

(local is the default).

Syntax aaa authentication login {default|<list-name>} {[local] [group

{radius|tacacs+|<group-name>}]}

no aaa authentication login {default|<list-name>}

Default If the default server is not configured using this command, user login

authentication uses the local user database only.

If the default method list name is specified, it is applied to every console and VTY

line immediately unless a named method list server is applied to that line by the

loginauthentication command.

local is the default state for the default method list unless a named method list is

applied to that line by the login authentication command. Reset to the default

method list using the no aaa authentication login default command.

Mode Global Configuration

Parameter Description

default Set the default authentication server for user login.

<list-name>Name of authentication server.

local Use the local username database.

group Use server group.

radius Use all RADIUS servers configured by the radius-server

host command.

tacacs+ Use all TACACS+ servers configured by the tacacs-server

host command.

<group-name>Use the specified RADIUS server group, as configured by

the aaa group server command.

C613-50292-01 Rev A Command Reference for IE210L Series 1267

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHENTICATION LOGIN

Usage When a user attempts to log in, the switch sends an authentication request to the

first authentication server in the method list. If the first server in the list is reachable

and it contains a username and password matching the authentication request,

the user is authenticated and the login succeeds. If the authentication server

denies the authentication request because of an incorrect username or password,

the user login fails. If the first server in the method list is unreachable, the switch

sends the request to the next server in the list, and so on.

For example, if the method list specifies group tacacs+ local, and a user attempts

to log in with a password that does not match a user entry in the first TACACS+

server, if this TACACS+ server denies the authentication request, then the switch

does not try any other TACACS+ servers not the local user database; the user login

fails.

Examples To configure the default authentication method list for user login to first use all

available RADIUS servers for user login authentication, and then use the local user

database, use the following commands:

awplus# configure terminal

awplus(config)# aaa authentication login default group radius

local

To configure a user login authentication method list called USERS to first use the

RADIUS server group RAD_GROUP1 for user login authentication, and then use the

local user database, use the following commands:

awplus# configure terminal

awplus(config)# aaa authentication login USERS group RAD_GROUP1

local

To configure a user login authentication method list called USERS to first use the

TACACS+ servers for user login authentication, and then use the local user

database, use the following commands:

awplus# configure terminal

awplus(config)# aaa authentication login USERS group tacacs+

local

To return to the default method list (local is the default server), use the following

commands:

awplus# configure terminal

awplus(config)# no aaa authentication login default

To delete an existing authentication method list USERS created for user login

authentication, use the following commands:

awplus# configure terminal

awplus(config)# no aaa authentication login USERS

Commands

aaa accounting commands

aaa authentication enable default group tacacs+

C613-50292-01 Rev A Command Reference for IE210L Series 1268

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHORIZATION COMMANDS

aaa authorization commands

Overview This command configures a method list for commands authorization that can be

applied to console or VTY lines. When command authorization is enabled for a

privilege level, only authorized users can executed commands in that privilege

level.

Use the no variant of this command to remove a named method list or disable the

default method list for a privilege level.

Syntax aaa authorization commands <privilege-level>

{default|<list-name>} group tacac+ [none]

no aaa authorization commands <privilege-level>

{default|<list-name>}

Mode Global Configuration

Usage TACACS+ command authorization provides centralized control of the commands

available to a user of an AlliedWare Plus device. Once enabled:

• The command string and username are encrypted and sent to the first

available configured TACACS+ server (the first server configured) for

authorization.

Parameter Description

<privilege-level> The privilege level of the set of commands the method list

will be applied to.

AlliedWare Plus defines three sets of commands, that are

indexed by a level value:

Level = 1: All commands that can be accessed by a user

with privilege level between 1 and 6 inclusive

Level = 7: All commands that can be accessed by a user

with privilege level between 7 and 14 inclusive

Level = 15: All commands that can be accessed by a user

with privilege level 15

group Specify the server group where authorization messages are

sent. Only the tacacs+ group is available for this

command.

tacac+ Use all TACACS+ servers configured by the tacacs-server

host command.

default Configure the default authorization commands method list.

<list-name>Configure a named authorization commands method list

none If specified, this provides a local fallback to command

authorization so that if authorization servers become

unavailable then the device will accept all commands

normally allowed for the privilege level of the user.

C613-50292-01 Rev A Command Reference for IE210L Series 1269

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHORIZATION COMMANDS

• The TACACS+ server decides if the user is authorized to execute the

command and returns the decision to the AlliedWare Plus device.

• Depending on this decision the device will then either execute the

command or notify the user that authorization has failed.

If multiple TACACS+ servers are configured, and the first server is unreachable or

does not respond, the other servers will be queried, in turn, for an authorization

decision. If all servers are unreachable and a local fallback has been configured,

with the none parameter, then commands are authorized based on the user’s

privilege level; the same behavior as if command authorization had not been

configured. If, however, the local fallback is not configured and all servers become

unreachable then all commands except logout, exit, and quit will be denied.

The default method list is defined with a local fallback unless configured

differently using this command.

Example To configure a commands authorization method list, named TAC15, using all

TACACS+ servers to authorize commands for privilege level 15, with a local

fallback, use the following commands:

awplus# configure terminal

awplus(config)# aaa authorization commands 15 TAC15 group

tacacs+ none

To configure the default method list to authorize commands for privilege level 7,

with no local fallback, use the following commands:

awplus# configure terminal

awplus(config)# aaa authorization commands 7 default group

tacacs+

To remove the authorization method list TAC15, use the following commands:

awplus# configure terminal

awplus(config)# no aaa authorization commands 15 TAC15

Commands

aaa authorization config-commands

authorization commands

tacacs-server host

Command

changes

Version 5.4.6-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1270

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA AUTHORIZATION CONFIG-COMMANDS

aaa authorization config-commands

Overview Use this command to enable command authorization on configuration mode

commands. By default, command authorization applies to commands in exec

mode only.

Use the no variant of this command to disable command authorization on

configuration mode commands.

Syntax aaa authorization config-commands

no aaa authorization config-commands

Default By default, command authorization is disabled on configuration mode commands.

Mode Global Configuration

Usage If authorization of configuration mode commands is not enabled then all

configuration commands are accepted by default, including command

authorization commands.

NOTE: Authorization of configuration commands is required for a secure TACACS+

command authorization configuration as it prevents the feature from being disabled

to gain access to unauthorized exec mode commands.

Example To enable command authorization for configuration mode commands, use the

commands:

awplus# configure terminal

awplus(config)# aaa authorization config-commands

To disable command authorization for configuration mode commands, use the

commands:

awplus# configure terminal

awplus(config)# no aaa authorization config-commands

Commands

aaa authorization commands

authorization commands

tacacs-server host

Command

changes

Version 5.4.6-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1271

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA GROUP SERVER

aaa group server

Overview This command configures a RADIUS server group. A server group can be used to

specify a subset of RADIUS servers in aaa commands. The group name radius is

predefined, which includes all RADIUS servers configured by the radius-server

host command.

RADIUS servers are added to a server group using the server command. Each

RADIUS server should be configured using the radius-server host command.

Use the no variant of this command to remove an existing RADIUS server group.

Syntax aaa group server radius <group-name>

no aaa group server radius <group-name>

Mode Global Configuration

Usage Use this command to create an AAA group of RADIUS servers, and to enter Server

Group Configuration mode, in which you can add servers to the group. Use a server

group to specify a subset of RADIUS servers in AAA commands. Each RADIUS server

must be configured by the radius-server host command. To add RADIUS servers

to a server group, use the server command.

Examples To create a RADIUS server group named GROUP1 with hosts 192.168.1.1,

192.168.2.1 and 192.168.3.1, use the commands:

awplus(config)# aaa group server radius GROUP1

awplus(config-sg)# server 192.168.1.1 auth-port 1812 acct-port

1813

awplus(config-sg)# server 192.168.2.1 auth-port 1812 acct-port

1813

awplus(config-sg)# server 192.168.3.1 auth-port 1812 acct-port

1813

To remove a RADIUS server group named GROUP1 from the configuration, use the

command:

awplus(config)# no aaa group server radius GROUP1

Parameter Description

<group-name>Server group name.

C613-50292-01 Rev A Command Reference for IE210L Series 1272

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA GROUP SERVER

Commands

aaa accounting auth-mac

aaa accounting auth-web

aaa accounting dot1x

aaa accounting login

aaa authentication auth-mac

aaa authentication auth-web

aaa authentication dot1x

aaa authentication login

radius-server host

server (server group)

show radius server group

C613-50292-01 Rev A Command Reference for IE210L Series 1273

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA LOCAL AUTHENTICATION ATTEMPTS LOCKOUT-TIME

aaa local authentication attempts

lockout-time

Overview This command configures the duration of the user lockout period.

Use the no variant of this command to restore the duration of the user lockout

period to its default of 300 seconds (5 minutes).

Syntax aaa local authentication attempts lockout-time <lockout-tiime>

no aaa local authentication attempts lockout-time

Mode Global Configuration

Default The default for the lockout-time is 300 seconds (5 minutes).

Usage While locked out all attempts to login with the locked account will fail. The lockout

can be manually cleared by another privileged account using the clear aaa local

user lockout command.

Examples To configure the lockout period to 10 minutes (600 seconds), use the commands:

awplus# configure terminal

awplus(config)# aaa local authentication attempts lockout-time

600

To restore the default lockout period of 5 minutes (300 seconds), use the

commands:

awplus# configure terminal

awplus(config)# no aaa local authentication attempts

lockout-time

Commands

aaa local authentication attempts max-fail

Parameter Description

<lockout-time><0-10000>. Time in seconds to lockout the user.

C613-50292-01 Rev A Command Reference for IE210L Series 1274

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA LOCAL AUTHENTICATION ATTEMPTS MAX-FAIL

aaa local authentication attempts max-fail

Overview This command configures the maximum number of failed login attempts before a

user account is locked out. Every time a login attempt fails the failed login counter

is incremented.

Use the no variant of this command to restore the maximum number of failed

Syntax aaa local authentication attempts max-fail <failed-logins>

no aaa local authentication attempts max-fail

Mode Global Configuration

Default The default for the maximum number of failed login attempts is five failed login

attempts.

Usage When the failed login counter reaches the limit configured by this command that

user account is locked out for a specified duration configured by the aaa local

authentication attempts lockout-time command.

When a successful login occurs the failed login counter is reset to 0. When a user

account is locked out all attempts to login using that user account will fail.

Examples To configure the number of login failures that will lock out a user account to two

awplus# configure terminal

awplus(config)# aaa local authentication attempts max-fail 2

To restore the number of login failures that will lock out a user account to the

default number of login attempts (five login attempts), use the commands:

awplus# configure terminal

awplus(config)# no aaa local authentication attempts max-fail

Commands

aaa local authentication attempts lockout-time

clear aaa local user lockout

Parameter Description

<failed-logins><1-32>. Number of login failures allowed before locking out a

user.

C613-50292-01 Rev A Command Reference for IE210L Series 1275

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AAA LOGIN FAIL-DELAY

aaa login fail-delay

Overview Use this command to configure the minimum time period between failed login

attempts. This setting applies to login attempts via the console, SSH and Telnet.

Use the no variant of this command to reset the minimum time period to its default

value.

Syntax aaa login fail-delay <1-10>

no aaa login fail-delay

Default 1 second

Mode Global configuration

Example To apply a delay of at least 5 seconds between login attempts, use the following

commands:

awplus# configure terminal

awplus(config)# aaa login fail-delay 5

Commands

aaa authentication login

aaa local authentication attempts lockout-time

clear aaa local user lockout

Parameter Description

<1-10> The minimum number of seconds required between login

attempts

C613-50292-01 Rev A Command Reference for IE210L Series 1276

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

ACCOUNTING LOGIN

accounting login

Overview This command applies a login accounting method list to console or VTY lines for

user login. When login accounting is enabled using this command, logging events

generate an accounting record to the accounting server.

The accounting method list must be configured first using this command. If an

accounting method list is specified that has not been created by this command

then accounting will be disabled on the specified lines.

The no variant of this command resets AAA Accounting applied to console or VTY

lines for local or remote login. default login accounting is applied after issuing the

no accounting login command. Accounting is disabled with default.

Syntax accounting login {default|<list-name>}

no accounting login

Default By default login accounting is disabled in the default accounting server. No

accounting will be performed until accounting is enabled using this command.

Mode Line Configuration

Examples To apply the accounting server USERS to all VTY lines, use the following

commands:

awplus# configure terminal

awplus(config)# line vty 0 32

awplus(config-line)# accounting login USERS

To reset accounting for login sessions on the console, use the following

commands:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# no accounting login

Commands

aaa accounting commands

aaa accounting login

Parameter Description

default Default accounting method list.

<list-name>Named accounting method list.

C613-50292-01 Rev A Command Reference for IE210L Series 1277

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AUTHORIZATION COMMANDS

authorization commands

Overview This command applies a command authorization method list, defined using the

aaa authorization commands command, to console and VTY lines.

Use the no variant of this command to reset the command authorization

configuration on the console and VTY lines.

Syntax authorization commands <privilege-level> {default|<list-name>}

no authorization commands <privilege-level>

Default The default method list is applied to each console and VTY line by default.

Mode Line Configuration

Usage If the specified method list does not exist users will not be enable to execute any

commands in the specified method list on the specified VTY lines.

Example To apply the TAC15 command authorization method list with privilege level 15 to

VTY lines 0 to 5, use the following commands:

awplus# configure terminal

awplus(config)# line vty 0 5

awplus(config-line)# authorization commands 15 TAC15

To reset the command authorization configuration with privilege level 15 on VTY

lines 0 to 5, use the following commands:

awplus# configure terminal

awplus(config)# line vty 0 5

awplus(config-line)# no authorization commands 15

Commands

aaa authorization commands

Parameter Description

<privilege-level> The privilege level of the set of commands the method list

will be applied to.

AlliedWare Plus defines three sets of commands, that are

indexed by a level value:

Level = 1: All commands that can be accessed by a user with

privilege level between 1 and 6 inclusive

Level = 7: All commands that can be accessed by a user with

privilege level between 7 and 14 inclusive

Level = 15: All commands that can be accessed by a user

with privilege level 15

default Configure the default authorization commands method list.

<list-name>Configure a named authorization commands method list

C613-50292-01 Rev A Command Reference for IE210L Series 1278

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

AUTHORIZATION COMMANDS

aaa authorization config-commands

tacacs-server host

Command

changes

Version 5.4.6-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1279

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

CLEAR AAA LOCAL USER LOCKOUT

clear aaa local user lockout

Overview Use this command to clear the lockout on a specific user account or all user

accounts.

Syntax clear aaa local user lockout {username <username>|all}

Mode Privileged Exec

Examples To unlock the user account ‘bob’ use the following command:

awplus# clear aaa local user lockout username bob

To unlock all user accounts use the following command:

awplus# clear aaa local user lockout all

Commands

aaa local authentication attempts lockout-time

Parameter Description

username Clear lockout for the specified user.

<username> Specifies the user account.

all Clear lockout for all user accounts.

C613-50292-01 Rev A Command Reference for IE210L Series 1280

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

DEBUG AAA

debug aaa

Overview This command enables AAA debugging.

Use the no variant of this command to disable AAA debugging.

Syntax debug aaa [accounting|all|authentication|authorization]

no debug aaa [accounting|all|authentication|authorization]

Default AAA debugging is disabled by default.

Mode Privileged Exec

Examples To enable authentication debugging for AAA, use the command:

awplus# debug aaa authentication

To disable authentication debugging for AAA, use the command:

awplus# no debug aaa authentication

Commands

show debugging aaa

undebug aaa

Parameter Description

accounting Accounting debugging.

all All debugging options are enabled.

authentication Authentication debugging.

authorization Authorization debugging.

C613-50292-01 Rev A Command Reference for IE210L Series 1281

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

Overview Use this command to apply an AAA server for authenticating user login attempts

from a console or remote logins on these console or VTY lines. The authentication

method list must be specified by the aaa authentication login command. If the

method list has not been configured by the aaa authentication login command,

Use the no variant of this command to reset AAA Authentication configuration to

use the default method list for login authentication on these console or VTY lines.

Command

Syntax login authentication {default|<list-name>}

no login authentication

Default The default login authentication method list, as specified by the aaa

authentication login command, is used to authenticate user login. If this has not

been specified, the default is to use the local user database.

Mode Line Configuration

Examples To apply the authentication method list called CONSOLE to the console port

terminal line (asyn 0), use the following commands:

awplus# configure terminal

awplus(config)# line console 0

awplus(config-line)# login authentication CONSOLE

To reset user authentication configuration on all VTY lines, use the following

commands:

awplus# configure terminal

awplus(config)# line vty 0 32

awplus(config-line)# no login authentication

Commands

aaa authentication login

line

Parameter Description

default The default authentication method list. If the default method

list has not been configured by the aaa authentication login

command, the local user database is used for user login

authentication.

<list-name> Named authentication server.

C613-50292-01 Rev A Command Reference for IE210L Series 1282

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

PROXY-PORT

proxy-port

Overview Use this command to change the local UDP port used for communication between

local RADIUS client applications and the RadSecProxy AAA application. Any

unused UDP port may be selected. The default port is 1645.

Use the no variant of this command to change the UDP port back to the default of

1645.

Syntax proxy-port <port>

no proxy-port

Default The default port is 1645.

Mode RadSecProxy AAA Configuration Mode

Usage It is not necessary to change the value from the default unless UDP port 1645 is

required for another purpose.RADIUS requests received on this port from external

devices will be ignored. The port is only used for local (intra-device)

communication.

Example To configure change the UDP port to 7001, use the following commands:

awplus# configure terminal

awplus(config)# radius-secure-proxy aaa

awplus(config-radsecproxy-aaa)# proxy-port 7001

Commands

radius-secure-proxy aaa

server (radsecproxy-aaa)

server name-check

server trustpoint

Parameter Description

<port> UDP Port Number, 1-65536.

C613-50292-01 Rev A Command Reference for IE210L Series 1283

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

RADIUS-SECURE-PROXY AAA

radius-secure-proxy aaa

Overview Use this command to enter the RadSecProxy AAA (authentication, authorization,

and accounting) application configuration mode. This application allows local

RADIUS-based clients on system to communicate with remote RadSec servers via

a secure (TLS) proxy.

Syntax radius-secure-proxy aaa

Mode Global Configuration Mode

Example To change mode from User Exec mode to the RadSecProxy AAA configuration

mode, use the commands:

awplus# configure terminal

awplus(config)# radius-secure-proxy aaa

awplus(config-radsecproxy-aaa)#

Commands

proxy-port

server (radsecproxy-aaa)

server name-check

server trustpoint

C613-50292-01 Rev A Command Reference for IE210L Series 1284

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SERVER (RADSECPROXY-AAA)

server (radsecproxy-aaa)

Overview Use this command to add a server to the RadSecProxy AAA application. Local

RADIUS client applications will attempt, via the proxy, to communicate with any

RadSec servers that are operational (in addition to any non-TLS RADIUS servers

that are configured).

Use the no variant of this command to delete a previously-configured server from

the RadSecProxy AAA application.

Syntax server {<hostname>|<ip-addr>} [timeout <1-1000>] [name-check

{on|off}]

no server {<hostname>|<ip-addr>}

Mode RadSecProxy AAA Configuration Mode

Usage The server may be specified by its domain name or by its IPv4 address. If a domain

name is used, it must be resolvable using a configured DNS name server.

Each server may be configured with a timeout; if not specified, the global timeout

value for RADIUS servers will be used. The global timeout may be changed using

the radius-server timeout command. The default global timeout is 5 seconds.

Each server may be configured to use certificate name-checking; if not specified,

the global behavior defined by server name-check or no server name-check will

be used. If name checking is enabled, the Common Name portion of the subject

field of the server’s X.509 certificate must match the domain name or IP address

specified in this command.

Parameter Description

<hostname>Hostname of RadSec server

<ip-addr>Specify the client IPv4 address, in dotted decimal notation

(A.B.C.D).

timeout Specify the amount of time that the RadSecProxy AAA application

should wait for replies from this server. RADIUS server timeout

(which defaults to 5 seconds).

<1-1000> Time in seconds to wait for a server reply.

name-check Specify whether or not to enforce certificate name checking for

this client. If the parameter is not specified then the global

behavior, which defaults to on, is used.

on Enable name checking for this client.

off Disable name checking for this client.

C613-50292-01 Rev A Command Reference for IE210L Series 1285

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SERVER (RADSECPROXY-AAA)

Example To add a server ‘mynas.local’ with a timeout of 3 seconds, and name checking off,

use the commands:

awplus# configure terminal

awplus(config)# radius-secure-proxy aaa

awplus(config-radsecproxy-aaa)# server mynas.local name-check

off

Commands

proxy-port

radius-secure-proxy aaa

server name-check

server trustpoint

C613-50292-01 Rev A Command Reference for IE210L Series 1286

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SERVER MUTUAL-AUTHENTICATION

server mutual-authentication

Overview This command enables or disables mutual certificate authentication for all

RadSecProxy servers. When enabled, the RadSecProxy AAA application will send a

local X.509 certificate to the server when establishing a TLS connection.

Use the no variant of this command to disable mutual certificate validation

causing the RadSecProxy AAA application to not transmit a certificate to the server.

NOTE: If mutual authentication is disabled on the client (AAA) application but enabled

on the server, a connection will not be established.

Syntax server mutual-authentication

no server mutual-authentication

Default Mutual authentication is enabled by default.

Mode RadSecProxy AAA Configuration Mode

Example Disable mutual certificate validation with the following command:

awplus# configure terminal

awplus(config)# radius-secure-proxy aaa

awplus(config-radsecproxy-aaa)# no server

mutual-authentication

Commands

radius-secure-proxy aaa

server name-check

server (radsecproxy-aaa)

Command

changes

Version 5.4.6-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1287

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SERVER NAME-CHECK

server name-check

Overview This command sets the global behavior for certificate name-checking for the

RadSecProxy AAA application to on. This behavior will be used for all servers

associated with the application that do not specify a behavior on a per-server basis.

If name-checking is enabled, the Common Name portion of the subject field of the

client’s X.509 certificate must match the domain name or IP address specified in

the server (radsecproxy-aaa) command.

Use the no variant of this command to set the global behavior for certificate name

checking to off

Syntax server name-check

no server name-check

Default Certificate name checking is on by default.

Mode RadSecProxy AAA Configuration Mode

Example Disable certificate name checking globally with the following command:

awplus# configure terminal

awplus(config)# radius-secure-proxy aaa

awplus(config-radsecproxy-aaa)# no server name-check

Commands

proxy-port

radius-secure-proxy aaa

server (radsecproxy-aaa)

server trustpoint

C613-50292-01 Rev A Command Reference for IE210L Series 1288

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SERVER TRUSTPOINT

server trustpoint

Overview This command adds one or more trustpoints to be used with the RadSecProxy AAA

application. Multiple trustpoints may be specified, or the command may be

executed more than once, to add multiple trustpoints to the application.

The no version of this command removes one or more trustpoints from the list of

trustpoints associated with the application.

Syntax server trustpoint [<trustpoint-list>]

no server trustpoint [<trustpoint-list>]

Default By default, no trustpoints are associated with the application.

Mode RadSecProxy AAA Configuration Mode

Usage The device certificate associated with first trustpoint added to the application will

be transmitted to remote servers. The certificate received from the remote server

must have an issuer chain that terminates with the root CA certificate for any of the

trustpoints that are associated with the application.

If no trustpoints are specified in the command, the trustpoint list will be

unchanged.

If no server trustpoint is issued without specifying any trustpoints, then all

trustpoints will be disassociated from the application.

Example You can add multiple trustpoints to the RadSecProxy AAA application by

executing the command multiple times:

awplus# configure terminal

awplus(config)# radius-secure-proxy aaa

awplus(config-radsecproxy-aaa)# server trustpoint example_1

awplus(config-radsecproxy-aaa)# server trustpoint example_2

Alternatively, add multiple trustpoints with a single command:

awplus(config-radsecproxy-aaa)# server trustpoint example_3

example_4

Disassociate all trustpoints from the RadSecProxy AAA application using the

command:

awplus(config-radsecproxy-aaa)# no server trustpoint

Commands

proxy-port

radius-secure-proxy aaa

Parameter Description

<trustpoint-list> Specify one or more trustpoints to be added or deleted.

C613-50292-01 Rev A Command Reference for IE210L Series 1289

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SERVER TRUSTPOINT

server (radsecproxy-aaa)

server name-check

C613-50292-01 Rev A Command Reference for IE210L Series 1290

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SHOW AAA LOCAL USER LOCKED

show aaa local user locked

Overview This command displays the current number of failed attempts, last failure time and

location against each user account attempting to log into the device.

Note that once the lockout count has been manually cleared by another privileged

account using the clear aaa local user lockout command or a locked account

successfully logs into the system after waiting for the lockout time, this command

will display nothing for that particular account.

Syntax show aaa local user locked

Mode User Exec and Privileged Exec

Example To display the current failed attempts for local users, use the command:

awplus# show aaa local user locked

Output Figure 35-1: Example output from the show aaa local user locked command

Commands

aaa local authentication attempts lockout-time

aaa local authentication attempts max-fail

clear aaa local user lockout

awplus# show aaa local user locked

bob 3 05/23/14 16:21:37 ttyS0

manager 5 05/23/14 16:31:44 192.168.1.200

C613-50292-01 Rev A Command Reference for IE210L Series 1291

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SHOW AAA SERVER GROUP

show aaa server group

Overview Use this command to list AAA users and any method lists applied to them.

Syntax show aaa server group

Mode Privileged Exec

Example To show the AAA configuration on a device, use the command:

awplus# aaa server group

Output Figure 35-2: Example output from aaa server group

Commands

aaa accounting auth-mac

aaa accounting auth-web

aaa accounting dot1x

aaa accounting auth-mac

aaa authentication auth-web

aaa authentication dot1x

awplus#show aaa server group

User List Name Method Acct-Event

======== ==== ============= ================ ======= ==========

-------- ---- ------------- ---------------- ------- ----------

dot1x auth default radius group -

dot1x auth vlan30_auth rad_group_1 group -

dot1x auth vlan40_auth rad_group_2 group -

-------- ---- ------------- ---------------- ------- ----------

dot1x acct vlan30_acct rad_group_4 group start-stop

dot1x acct vlan40_acct rad_group_5 group start-stop

-------- ---- ------------- ---------------- ------- ----------

auth-mac auth default radius group -

auth-mac auth vlan10_auth rad_group_vlan10 group -

auth-mac auth vlan20_auth rad_group_vlan20 group -

-------- ---- ------------- ---------------- ------- ----------

auth-mac acct vlan10_acct rad_group_vlan10 group start-stop

auth-mac acct vlan20_acct rad_group_vlan20 group start-stop

-------- ---- ------------- ---------------- ------- ----------

auth-web auth default radius group -

-------- ---- ------------- ---------------- ------- ----------

auth-web acct default rad_group_3 group start-stop

-------- ---- ------------- ---------------- ------- ----------

C613-50292-01 Rev A Command Reference for IE210L Series 1292

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SHOW DEBUGGING AAA

show debugging aaa

Overview This command displays the current debugging status for AAA (Authentication,

Authorization, Accounting).

Syntax show debugging aaa

Mode User Exec and Privileged Exec

Example To display the current debugging status of AAA, use the command:

awplus# show debug aaa

Output Figure 35-3: Example output from the show debug aaa command

AAA debugging status:

Authentication debugging is on

Accounting debugging is off

C613-50292-01 Rev A Command Reference for IE210L Series 1293

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SHOW RADIUS SERVER GROUP

show radius server group

Overview Use this command to show the RADIUS server group configuration.

Syntax show radius server group [<group-name>]

Default Command name is set to something by default.

Mode Privileged Exec

Usage Use this command with the <group-name> parameter to display information for a

specific RADIUS server group, or without the parameter to display information for

all RADIUS server groups.

Example To display information for all RADIUS server groups, use the command:

awplus# show radius server group

To display a information for a RADIUS server group named ‘rad_group_list1’, use

the command:

awplus# show radius server group rad_group_list1

Output Figure 35-4: Example output from show radius server group

Parameter Description

<group-name>RADIUS server group name.

awplus#show radius server group

RADIUS Group Configuration

Group Name : radius?

Server Host/ Auth Acct Auth Acct

IP Address Port Port Status Status

------------------------------------------

192.168.1.101 1812 1813 Active Active

192.168.1.102 1812 1813 Active Active



Group Name : rad_group_list1

Server Host/ Auth Acct Auth Acct

IP Address Port Port Status Status

------------------------------------------

192.168.1.101 1812 1813 Active Active



Group Name : rad_group_list2

Server Host/ Auth Acct Auth Acct

IP Address Port Port Status Status

------------------------------------------

192.168.1.102 1812 1813 Active Active

C613-50292-01 Rev A Command Reference for IE210L Series 1294

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

SHOW RADIUS SERVER GROUP

Figure 35-5: Example output from show radius server group rad_group_list1

Commands

aaa group server

awplus#show radius server group rad_group_list1

RADIUS Group Configuration

Group Name : rad_group_list1

Server Host/ Auth Acct Auth Acct

IP Address Port Port Status Status

------------------------------------------

192.168.1.101 1812 1813 Active Active

C613-50292-01 Rev A Command Reference for IE210L Series 1295

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

AAA COMMANDS

UNDEBUG AAA

undebug aaa

Overview This command applies the functionality of the no debug aaa command.

C613-50292-01 Rev A Command Reference for IE210L Series 1296

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS Commands

Introduction

Overview This chapter provides an alphabetical reference for commands used to configure

the device to use RADIUS servers. For more information, see the RADIUS Feature

Overview and Configuration Guide.

Command List •“auth radius send nas-identifier” on page 1297

•“auth radius send service-type” on page 1298

•“deadtime (RADIUS server group)” on page 1299

•“debug radius” on page 1300

•“ip radius source-interface” on page 1301

•“radius-server deadtime” on page 1302

•“radius-server host” on page 1303

•“radius-server key” on page 1306

•“radius-server retransmit” on page 1307

•“radius-server timeout” on page 1309

•“server (server group)” on page 1311

•“show debugging radius” on page 1313

•“show radius” on page 1314

•“show radius statistics” on page 1317

•“undebug radius” on page 1318

C613-50292-01 Rev A Command Reference for IE210L Series 1297

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

AUTH RADIUS SEND NAS-IDENTIFIER

auth radius send nas-identifier

Overview Use this command to enable the device to include the NAS-Identifier(32) attribute

in RADIUS authentication requests.

Use the no variant of this command to stop including the NAS-Identifier attribute.

Syntax auth radius send nas-identifier [<name>|vlan-id]

no auth radius send nas-identifier

Mode Global Configuration

Example To use a user-defined identifier of NASID100 as the NAS-Identifier attribute, use the

commands:

awplus# configure terminal

awplus(config)# auth radius send nas-identifier NASID100

To use the VLAN ID as the NAS-Identifier attribute, use the commands:

awplus# configure terminal

awplus(config)# auth radius send nas-identifier vlan-id

To stop sending the NAS-Identifier attribute, use the commands:

awplus# configure terminal

awplus(config)# no auth radius send nas-identifier

Commands

auth radius send service-type

Parameter Description

<name> Send this user-defined text as the NAS-Identifier. You can specify

up to 253 characters.

vlan-id Send the VLAN ID of the authentication port as the NAS-Identifier.

This is the configured VLAN ID, not the dynamic VLAN ID or guest

VLAN ID.

C613-50292-01 Rev A Command Reference for IE210L Series 1298

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

AUTH RADIUS SEND SERVICE-TYPE

auth radius send service-type

Overview Use this command to enable the device to include the Service-Type(6) attribute in

RADIUS authentication requests. The Service-Type attribute has a value of:

• Framed(2) for 802.1x

• Call-Check(10) for MAC authentication

• Unbound(5) for Web authentication.

Use the no variant of this command to stop including the Service-Type attribute.

Syntax auth radius send service-type

no auth radius send service-type

Mode Global Configuration

Example To send the Service-Type attribute, use the commands:

awplus# configure terminal

awplus(config)# auth radius send service-type

Commands

auth radius send nas-identifier

C613-50292-01 Rev A Command Reference for IE210L Series 1299

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

DEADTIME (RADIUS SERVER GROUP)

deadtime (RADIUS server group)

Overview Use this command to configure the deadtime parameter for the RADIUS server

group. This command overrides the global dead-time configured by the

radius-server deadtime command. The configured deadtime is the time period in

minutes to skip a RADIUS server for authentication or accounting requests if the

server is “dead”. Note that a RADIUS server is considered “dead” if there is no

response from the server within a defined time period.

Use the no variant of this command to reset the deadtime configured for the

RADIUS server group. If the global deadtime for RADIUS server is configured the

value will be used for the servers in the group. The global deadtime for the RADIUS

server is set to 0 minutes by default.

Syntax deadtime <0-1440>

no deadtime

Default The deadtime is set to 0 minutes by default.

Mode Server Group Configuration

Usage If the RADIUS server does not respond to a request packet, the packet is

retransmitted the number of times configured for the retransmit parameter (after

waiting for a timeout period to expire). The server is then marked “dead”, and the

time is recorded. The deadtime parameter configures the amount of time to skip

a dead server; if a server is dead, no request message is sent to the server for the

deadtime period.

Examples To configure the deadtime for 5 minutes for the RADIUS server group “GROUP1”,

use the command:

awplus(config)# aaa group server radius GROUP1

awplus(config-sg)# server 192.168.1.1

awplus(config-sg)# deadtime 5

To remove the deadtime configured for the RADIUS server group “GROUP1”, use

the command:

awplus(config)# aaa group server radius GROUP1

awplus(config-sg)# no deadtime

Commands

aaa group server

radius-server deadtime

Parameter Description

<0-1440>Amount of time in minutes.

C613-50292-01 Rev A Command Reference for IE210L Series 1300

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

DEBUG RADIUS

debug radius

Overview This command enables RADIUS debugging. If no option is specified, all debugging

options are enabled.

Use the no variant of this command to disable RADIUS debugging. If no option is

specified, all debugging options are disabled.

Syntax debug radius [packet|event|all]

no debug radius [packet|event|all]

Default RADIUS debugging is disabled by default.

Mode Privileged Exec

Examples To enable debugging for RADIUS packets, use the command:

awplus# debug radius packet

To enable debugging for RADIUS events, use the command:

awplus# debug radius event

To disable debugging for RADIUS packets, use the command:

awplus# no debug radius packet

To disable debugging for RADIUS events, use the command:

awplus# no debug radius event

Commands

show debugging radius

undebug radius

Parameter Description

packet Debugging for RADIUS packets is enabled or disabled.

event Debugging for RADIUS events is enabled or disabled.

all Enable or disable all debugging options.

C613-50292-01 Rev A Command Reference for IE210L Series 1301

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

IP RADIUS SOURCE-INTERFACE

ip radius source-interface

Overview This command configures the source IP address of every outgoing RADIUS packet

to use a specific IP address or the IP address of a specific interface. If the specified

interface is down or there is no IP address on the interface, then the source IP

address of outgoing RADIUS packets depends on the interface the packets leave.

Use the no variant of this command to remove the source interface configuration.

The source IP address in outgoing RADIUS packets will be the IP address of the

interface from which the packets are sent.

Syntax ip radius source-interface {<interface>|<ip-address>}

no ip radius source-interface

Default Source IP address of outgoing RADIUS packets depends on the interface the

packets leave.

Mode Global Configuration

Examples To configure all outgoing RADIUS packets to use the IP address of the interface

“vlan1” for the source IP address, use the following commands:

awplus# configure terminal

awplus(config)# ip radius source-interface vlan1

To configure the source IP address of all outgoing RADIUS packets to use

192.168.1.10, use the following commands:

awplus# configure terminal

awplus(config)# ip radius source-interface 192.168.1.10

To reset the source interface configuration for all outgoing RADIUS packets, use

the following commands:

awplus# configure terminal

awplus(config)# no ip radius source-interface

Commands

radius-server host

show radius statistics

Parameter Description

<interface> Interface name.

<ip-address> IP address in the dotted decimal format A.B.C.D.

C613-50292-01 Rev A Command Reference for IE210L Series 1302

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

RADIUS-SERVER DEADTIME

radius-server deadtime

Overview Use this command to specify the global deadtime for all RADIUS servers. If a

RADIUS server is considered dead, it is skipped for the specified deadtime. This

command specifies for how many minutes a RADIUS server that is not responding

to authentication requests is passed over by requests for RADIUS authentication.

Use the no variant of this command to reset the global deadtime to the default of

0 seconds, so that RADIUS servers are not skipped even if they are dead.

Syntax radius-server deadtime <minutes>

no radius-server deadtime

Default The default RADIUS deadtime configured on the system is 0 seconds.

Mode Global Configuration

Usage The RADIUS client considers a RADIUS server to be dead if it fails to respond to a

request after it has been retransmitted as often as specified globally by the

radius-server retransmit command or for the server by the radius-server host

command. To improve RADIUS response times when some servers may be

unavailable, set a deadtime to skip dead servers.

Examples To set the dead time of the RADIUS server to 60 minutes, use the following

commands:

awplus# configure terminal

awplus(config)# radius-server deadtime 60

To disable the dead time of the RADIUS server, use the following commands:

awplus# configure terminal

awplus(config)# no radius-server deadtime

Commands

deadtime (RADIUS server group)

radius-server host

radius-server retransmit

show radius statistics

Parameter Description

<minutes> RADIUS server deadtime in minutes in the range 0 to 1440 (24 hours).

C613-50292-01 Rev A Command Reference for IE210L Series 1303

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

RADIUS-SERVER HOST

radius-server host

Overview Use this command to specify a remote RADIUS server host for authentication or

accounting, and to set server-specific parameters. The parameters specified with

this command override the corresponding global parameters for RADIUS servers.

This command specifies the IP address or host name of the remote RADIUS server

host and assigns authentication and accounting destination UDP port numbers.

This command adds the RADIUS server address and sets parameters to the RADIUS

server. The RADIUS server is added to the running configuration after you issue this

command. If parameters are not set using this command then common system

settings are applied.

Use the no variant of this command to remove the specified server host as a

RADIUS authentication and/or accounting server and set the destination port to

the default RADIUS server port number (1812).

Syntax radius-server host {<host-name>|<ip-address>} [acct-port

<0-65535>] [auth-port <0-65535>] [key <key-string>] [retransmit

<0-100>] [timeout <1-1000>]

no radius-server host {<host-name>|<ip-address>} [acct-port

<0-65535>] [auth-port <0-65535>]

Parameter Description

<host-name> Server host name. The DNS name of the RADIUS server host.

<ip-address> The IP address of the RADIUS server host.

acct-port Accounting port. Specifies the UDP destination port for RADIUS

accounting requests. If 0 is specified, the server is not used for

accounting. The default UDP port for accounting is 1813.

<0-65535>UDP port number

(Accounting port number is set to 1813 by default)

Specifies the UDP destination port for RADIUS accounting

requests. If 0 is specified, the host is not used for accounting.

auth-port Authentication port. Specifies the UDP destination port for

RADIUS authentication requests. If 0 is specified, the server is not

used for authentication. The default UDP port for authentication

is 1812.

<0-65535>UDP port number

(Authentication port number is set to 1812 by default)

Specifies the UDP destination port for RADIUS authentication

requests. If 0 is specified, the host is not used for authentication.

timeout Specifies the amount of time to wait for a response from the

server. If this parameter is not specified the global value

configured by the radius-server timeout command is used.

C613-50292-01 Rev A Command Reference for IE210L Series 1304

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

RADIUS-SERVER HOST

Default The RADIUS client address is not configured (null) by default. No RADIUS server is

configured.

Mode Global Configuration

Usage Multiple radius -server host commands can be used to specify multiple hosts. The

software searches for hosts in the order they are specified. If no host-specific

timeout, retransmit, or key values are specified, the global values apply to that

host. If there are multiple RADIUS servers for this client, use this command multiple

times—once to specify each server.

If you specify a host without specifying the auth port or the acct port, it will by

default be configured for both authentication and accounting, using the default

UDP ports. To set a host to be a RADIUS server for authentication requests only, set

the acct-port parameter to 0; to set the host to be a RADIUS server for accounting

requests only, set the auth-port parameter to 0.

A RADIUS server is identified by IP address, authentication port and accounting

port. A single host can be configured multiple times with different authentication

or accounting ports. All the RADIUS servers configured with this command are

<1-1000>Time in seconds to wait for a server reply

(timeout is set to 5 seconds by default)

The time interval (in seconds) to wait for the RADIUS server to

reply before retransmitting a request or considering the server

dead. This setting overrides the global value set by the radius-

server timeout command.

If no timeout value is specified for this server, the global value is

used.

retransmit Specifies the number of retries before skip to the next server. If

this parameter is not specified the global value configured by the

radius-server retransmit command is used.

<0-100>Maximum number of retries

(maximum number of retries is set to 3 by default)

The maximum number of times to resend a RADIUS request to

the server, if it does not respond within the timeout interval,

before considering it dead and skipping to the next RADIUS

server. This setting overrides the global setting of the radius-

server retransmit command.

If no retransmit value is specified, the global value is used.

key Set shared secret key with RADIUS servers

<key-string> Shared key string applied

Specifies the shared secret authentication or encryption key for

all RADIUS communications between this device and the RADIUS

server. This key must match the encryption used on the RADIUS

daemon. All leading spaces are ignored, but spaces within and at

the end of the string are used. If spaces are used in the string, do

not enclose the string in quotation marks unless the quotation

marks themselves are part of the key. This setting overrides the

global setting of the radius-server key c ommand. If no key

value is specified, the global value is used.

Parameter Description

C613-50292-01 Rev A Command Reference for IE210L Series 1305

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

RADIUS-SERVER HOST

included in the predefined RADIUS server group radius, which may be used by AAA

authentication, authorization and accounting commands. The client transmits

(and retransmits, according to the retransmit and timeout parameters) RADIUS

authentication or accounting requests to the servers in the order you specify them,

until it gets a response.

Examples To add the RADIUS server 10.0.0.20, use the following commands:

awplus# configure terminal

awplus(config)# radius-server host 10.0.0.20

To set the secret key to allied on the RADIUS server 10.0.0.20, use the following

commands:

awplus# configure terminal

awplus(config)# radius-server host 10.0.0.20 key allied

To delete the RADIUS server 10.0.0.20, use the following commands:

awplus# configure terminal

awplus(config)# no radius-server host 10.0.0.20

To configure rad1.company.com for authentication only, use the following

commands:

awplus# configure terminal

awplus(config)# radius-server host rad1.company.com acct-port 0

To remove the RADIUS server rad1.company.com configured for

authentication only, use the following commands:

awplus# configure terminal

awplus(config)# no radius-server host rad1.company.com

acct-port 0

To configure rad2.company.com for accounting only, use the following

commands:

awplus# configure terminal

awplus(config)# radius-server host rad2.company.com auth-port 0

To configure 192.168.1.1 with authentication port 1000, accounting port 1001 and

retransmit count 5, use the following commands:

awplus# configure terminal

awplus(config)# radius-server host 192.168.1.1 auth-port 1000

acct-port 1001 retransmit 5

Commands

aaa group server

radius-server key

radius-server retransmit

radius-server timeout

show radius statistics

C613-50292-01 Rev A Command Reference for IE210L Series 1306

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

RADIUS-SERVER KEY

radius-server key

Overview This command sets a global secret key for RADIUS authentication on the device.

The shared secret text string is used for RADIUS authentication between the device

and a RADIUS server.

Note that if no secret key is explicitly specified for a RADIUS server, the global

secret key will be used for the shared secret for the server.

Use the no variant of this command to reset the secret key to the default (null).

Syntax radius-server key <key>

no radius-server key

Default The RADIUS server secret key on the system is not set by default (null).

Mode Global Configuration

Usage Use this command to set the global secret key shared between this client and its

RADIUS servers. If no secret key is specified for a particular RADIUS server using the

radius-server host c ommand, this global key is used.

After enabling AAA authentication with the aaa authentication login command,

set the authentication and encryption key using the radius-server key command

so the key entered matches the key used on the RADIUS server.

Examples To set the global secret key to allied for RADIUS server, use the following

commands:

awplus# configure terminal

awplus(config)# radius-server key allied

To set the global secret key to secret for RADIUS server, use the following

commands:

awplus# configure terminal

awplus(config)# radius-server key secret

To delete the global secret key for RADIUS server, use the following commands:

awplus# configure terminal

awplus(config)# no radius-server key

Commands

radius-server host

show radius statistics

Parameter Description

<key>Shared secret among radius server and 802.1X client.

C613-50292-01 Rev A Command Reference for IE210L Series 1307

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

RADIUS-SERVER RETRANSMIT

radius-server retransmit

Overview This command sets the retransmit counter to use RADIUS authentication on the

device. This command specifies how many times the device transmits each

RADIUS request to the RADIUS server before giving up.

This command configures the retransmit parameter for RADIUS servers globally.

If the retransmit parameter is not specified for a RADIUS server by the

radius-server host command then the global configuration set by this command

is used for the server instead.

Use the no variant of this command to reset the re-transmit counter to the default

(3).

Syntax radius-server retransmit <retries>

no radius-server retransmit

Default The default RADIUS retransmit count on the device is 3.

Mode Global Configuration

Examples To set the RADIUS retransmit count to 1, use the following commands:

awplus# configure terminal

awplus(config)# radius-server retransmit 1

To set the RADIUS retransmit count to the default (3), use the following

commands:

awplus# configure terminal

awplus(config)# no radius-server retransmit

To configure the RADIUS retransmit count globally with 5, use the following

commands:

awplus# configure terminal

awplus(config)# radius-server retransmit 5

To disable retransmission of requests to a RADIUS server, use the following

commands:

awplus# configure terminal

awplus(config)# radius-server retransmit 0

Parameter Description

<retries> RADIUS server retries in the range <0-100>.

The number of times a request is resent to a RADIUS server that

does not respond, before the server is considered dead and the

next server is tried. If no retransmit value is specified for a

particular RADIUS server using the radius-server host

command, this global value is used.

C613-50292-01 Rev A Command Reference for IE210L Series 1308

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

RADIUS-SERVER RETRANSMIT

Commands

radius-server deadtime

radius-server host

show radius statistics

C613-50292-01 Rev A Command Reference for IE210L Series 1309

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

RADIUS-SERVER TIMEOUT

radius-server timeout

Overview Use this command to specify the RADIUS global timeout value. This is how long the

device waits for a reply to a RADIUS request before retransmitting the request, or

considering the server to be dead. If no timeout is specified for the particular

RADIUS server by the radius-server host command, it uses this global timeout

value.

Note that this command configures the timeout parameter for RADIUS servers

globally.

The no variant of this command resets the transmit timeout to the default (5

seconds).

Syntax radius-server timeout <seconds>

no radius-server timeout

Default The default RADIUS transmit timeout on the system is 5 seconds.

Mode Global Configuration

Examples To globally set the device to wait 20 seconds before retransmitting a RADIUS

request to unresponsive RADIUS servers, use the following commands:

awplus# configure terminal

awplus(config)# radius-server timeout 20

To set the RADIUS timeout parameter to 1 second, use the following commands:

awplus# configure terminal

awplus(config)# radius-server timeout 1

To set the RADIUS timeout parameter to the default (5 seconds), use the following

commands:

awplus# configure terminal

awplus(config)# no radius-server timeout

To configure the RADIUS server timeout period globally with 3 seconds, use the

following commands:

awplus# configure terminal

awplus(config)# radius-server timeout 3

Parameter Description

<seconds> RADIUS server timeout in seconds in the range 1 to 1000.

The global time in seconds to wait for a RADIUS server to reply to

a request before retransmitting the request, or considering the

server to be dead (depending on the radius-server retransmit

command).

C613-50292-01 Rev A Command Reference for IE210L Series 1310

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

RADIUS-SERVER TIMEOUT

To reset the global timeout period for RADIUS servers to the default, use the

following command:

awplus# configure terminal

awplus(config)# no radius-server timeout

Commands

radius-server deadtime

radius-server host

radius-server retransmit

show radius statistics

C613-50292-01 Rev A Command Reference for IE210L Series 1311

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

SERVER (SERVER GROUP)

server (server group)

Overview This command adds a RADIUS server to a server group in Server-Group

Configuration mode. The RADIUS server should be configured by the radius-server

host command.

The server is appended to the server list of the group and the order of

configuration determines the precedence of servers. If the server exists in the

server group already, it will be removed before added as a new server.

The server is identified by IP address and authentication and accounting UDP port

numbers. So a RADIUS server can have multiple entries in a group with different

authentication and/or accounting UDP ports. The auth-port specifies the UDP

destination port for authentication requests to the server. To disable

authentication for the server, set auth-port to 0. If the authentication port is

missing, the default port number is 1812. The acct-port specifies the UDP

destination port for accounting requests to the server. To disable accounting for

the server, set acct-port to 0. If the accounting port is missing, the default port

number is 1812.

Use the no variant of this command to remove a RADIUS server from the server

group.

Syntax server {<hostname>|<ip-address>} [auth-port

<0-65535>][acct-port <0-65535>]

no server {<hostname>|<ip-address>} [auth-port

<0-65535>][acct-port <0-65535>]

Parameter Description

<hostname> Server host name

<ip-address> Server IP address

The server is identified by IP address, authentication and

accounting UDP port numbers. So a RADIUS server can have

multiple entries in a group with different authentication and/or

accounting UDP ports.

auth-port Authentication port

The auth-port specifies the UDP destination port for

authentication requests to the server. To disable authentication

for the server, set auth-port to 0. If the authentication port is

missing, the default port number is 1812.

<0-65535>UDP port number (default: 1812)

acct-port Accounting port

The acct-port specifies the UDP destination port for accounting

requests to the server. To disable accounting for the server, set

acct-port to 0. If the accounting port is missing, the default port

number is 1813.

<0-65535>UDP port number (default: 1813)

C613-50292-01 Rev A Command Reference for IE210L Series 1312

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

SERVER (SERVER GROUP)

Default The default Authentication port number is 1812 and the default Accounting port

number is 1813.

Mode Server Group Configuration

Usage The RADIUS server to be added must be configured by the radius-server host

command. In order to add or remove a server, the auth-port and acct-port

parameters in this command must be the same as the corresponding parameters

in the radius-server host command.

Examples To create a RADIUS server group RAD_AUTH1 for authentication, use the following

commands:

awplus# configure terminal

awplus(config)# aaa group server radius RAD_AUTH1

awplus(config-sg)# server 192.168.1.1 acct-port 0

awplus(config-sg)# server 192.168.2.1 auth-port 1000 acct-port

To create a RADIUS server group RAD_ACCT1 for accounting, use the following

commands:

awplus# configure terminal

awplus(config)# aaa group server radius RAD_ACCT1

awplus(config-sg)# server 192.168.2.1 auth-port 0 acct-port

1001

awplus(config-sg)# server 192.168.3.1 auth-port 0

To remove server 192.168.3.1 from the existing server group GROUP1, use the

following commands:

awplus# configure terminal

awplus(config)# aaa group server radius GROUP1

awplus(config-sg)# no server 192.168.3.1

Commands

aaa accounting auth-mac

aaa accounting auth-web

aaa accounting dot1x

aaa accounting login

aaa authentication auth-mac

aaa authentication auth-web

aaa authentication login

aaa group server

radius-server host

C613-50292-01 Rev A Command Reference for IE210L Series 1313

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

SHOW DEBUGGING RADIUS

show debugging radius

Overview This command displays the current debugging status for the RADIUS servers.

Syntax show debugging radius

Mode User Exec and Privileged Exec

Example To display the current debugging status of RADIUS servers, use the command:

awplus# show debugging radius

Output Figure 36-1: Example output from the show debugging radius command

RADIUS debugging status:

RADIUS event debugging is off 

RADIUS packet debugging is off

C613-50292-01 Rev A Command Reference for IE210L Series 1314

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

SHOW RADIUS

show radius

Overview This command displays the current RADIUS server configuration and status.

Syntax show radius

Mode User Exec and Privileged Exec

Example To display the current status of RADIUS servers, use the command:

awplus# show radius

Output Figure 36-2: Example output from the show radius command showing RADIUS

servers

Example See the sample output below showing RADIUS client status and RADIUS

configuration:

awplus# show radius

RADIUS Global Configuration

Source Interface : not configured

Secret Key : secret

Timeout : 5 sec

Retransmit Count : 3

Deadtime : 20 min

Server Host : 192.168.1.10

Authentication Port : 1812

Accounting Port : 1813

Secret Key : secret

Timeout : 3 sec

Retransmit Count : 2

Server Host : 192.168.1.11

Authentication Port : 1812

Accounting Port : not configured



Server Name/ Auth Acct Auth Acct

IP Address Port Port Status Status

------------------------------------------------------------

192.168.1.10 1812 1813 Alive Alive

192.168.1.11 1812 N/A Alive N/A

C613-50292-01 Rev A Command Reference for IE210L Series 1315

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

SHOW RADIUS

Output Figure 36-3: Example output from the show radius command showing RADIUS

client status

RADIUS global interface name: awplus

Secret key:

Timeout: 5

Retransmit count: 3

Deadtime: 0



Server Address: 150.87.18.89

Auth destination port: 1812

Accounting port: 1813

Secret key: swg

Timeout: 5

Retransmit count: 3

Deadtime: 0show radius local-server group

Output Parameter Meaning

Source

Interface The interface name or IP address to be used for the source

address of all outgoing RADIUS packets.

Secret Key A shared secret key to a radius server.

Timeout A time interval in seconds.

Retransmit

Count The number of retry count if a RADIUS server does not

response.

Deadtime A time interval in minutes to mark a RADIUS server as “dead”.

Interim-Update A time interval in minutes to send Interim-Update Accounting

report.

Group Deadtime The deadtime configured for RADIUS servers within a server

group.

Server Host The RADIUS server hostname or IP address.

Authentication

Port The destination UDP port for RADIUS authentication requests.

Accounting Port The destination UDP port for RADIUS accounting requests.

C613-50292-01 Rev A Command Reference for IE210L Series 1316

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

SHOW RADIUS

Auth Status The status of the authentication port.

The status (“dead”, “error”, or “alive”) of the RADIUS authentica

tion server and, if dead, how long it has been dead for.

Alive The server is alive.

Error The server is not responding.

Dead The server is detected as dead and it will not be

used for deadtime period. The time displayed in

the output shows the server is in dead status for

that amount of time.

Unknown The server is never used or the status is unknown.

Acct Status The status of the accounting port.

The status (“dead”, “error”, or “alive”) of the RADIUS accounting

server and, if dead, how long it has been dead for.

Output Parameter Meaning

C613-50292-01 Rev A Command Reference for IE210L Series 1317

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

SHOW RADIUS STATISTICS

show radius statistics

Overview This command shows the RADIUS client statistics for the device.

Syntax show radius statistics

Mode User Exec and Privileged Exec

Example See the sample output below showing RADIUS client statistics and RADIUS

configuration:

awplus# show radius statistics

Output Figure 36-4: Example output from the show radius statistics command:

RADIUS statistics for Server: 150.87.18.89

Access-Request Tx : 5 - Retransmit : 0

Access-Accept Rx : 1 - Access-Reject Rx : 2

Access-Challenge Rx : 2

Unknown Type : 0 - Bad Authenticator : 0

Malformed Access-Resp : 0 - Wrong Identifier : 0

Bad Attribute : 0 - Packet Dropped : 0

TimeOut : 0 - Dead count : 0

Pending Request : 0

C613-50292-01 Rev A Command Reference for IE210L Series 1318

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

RADIUS COMMANDS

UNDEBUG RADIUS

undebug radius

Overview This command applies the functionality of the no debug radius command.

C613-50292-01 Rev A Command Reference for IE210L Series 1319

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Local RADIUS Server

Commands

Introduction

Overview This chapter provides an alphabetical reference for commands used to configure

the local RADIUS server on the device. For more information, see the Local RADIUS

Server Feature Overview and Configuration Guide.

Command List •“attribute” on page 1321

•“authentication” on page 1324

•“client (radsecproxy-srv)” on page 1325

•“client mutual-authentication” on page 1327

•“client name-check” on page 1328

•“client trustpoint” on page 1329

•“clear radius local-server statistics” on page 1330

•“copy fdb-radius-users (to file)” on page 1331

•“copy local-radius-user-db (from file)” on page 1333

•“copy local-radius-user-db (to file)” on page 1334

•“crypto pki enroll local (deleted)” on page 1335

•“crypto pki enroll local local-radius-all-users (deleted)” on page 1336

•“crypto pki enroll local user (deleted)” on page 1337

•“crypto pki export local pem (deleted)” on page 1338

•“crypto pki export local pkcs12 (deleted)” on page 1339

•“crypto pki trustpoint local (deleted)” on page 1340

•“debug crypto pki (deleted)” on page 1341

•“domain-style” on page 1342

•“egress-vlan-id” on page 1343

C613-50292-01 Rev A Command Reference for IE210L Series 1320

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

•“egress-vlan-name” on page 1345

•“group” on page 1347

•“nas” on page 1348

•“radius-secure-proxy local-server” on page 1349

•“radius-server local” on page 1350

•“server auth-port” on page 1351

•“server enable” on page 1352

•“show radius local-server group” on page 1353

•“show radius local-server nas” on page 1354

•“show radius local-server statistics” on page 1355

•“show radius local-server user” on page 1356

•“user (RADIUS server)” on page 1358

•“vlan (RADIUS server)” on page 1360

C613-50292-01 Rev A Command Reference for IE210L Series 1321

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

ATTRIBUTE

attribute

Overview Use this command to define a RADIUS attribute for the local RADIUS server user

group.

For a complete list of defined RADIUS attributes and values, see the Local RADIUS

Server Feature Overview and Configuration Guide.

When used with the help parameter the attribute command displays a list of

standard and vendor specific valid RADIUS attributes that are supported by the

local RADIUS server.

If an attribute name is specified with the help parameter, then the attribute

command displays a list of predefined attribute names. Note that you can only use

the defined RADIUS attribute names and not define your own.

When used with the value parameter the attribute command configures RADIUS

attributes to the user group. If the specified attribute is already defined then it is

replaced with the new value.

Use the no variant of this command to delete an attribute from the local RADIUS

server user group.

Syntax attribute [<attribute-name>|<attribute-id>] help

attribute {<attribute-name>|<attribute-id>} <value>

no attribute {<attribute-name>|<attribute-id>}

Default By default, no attributes are configured.

Mode RADIUS Server Group Configuration

Usage For the Standard attributes, the attribute may be specified using either the

attribute name, or its numeric identifier. For example, the command:

awplus(config-radsrv-group)# attribute acct-terminate-cause

help

will produce the same results as the command:

awplus(config-radsrv-group)# attribute 49 help

Parameter Description

<attribute-name>RADIUS attribute name for standard attributes or Vendor-

Specific attributes (see the Local RADIUS Server Feature

Overview and Configuration Guide for tables of attributes).

<attribute-id>RADIUS attribute numeric identifier for standard attributes.

<value>RADIUS attribute value.

help Display a list of available attribute types.

C613-50292-01 Rev A Command Reference for IE210L Series 1322

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

ATTRIBUTE

In the same way, where the specific attribute has a pre-defined value, the

parameter <value> may be substituted with the Value Name or with its numeric

value, for example the command:

awplus(config-radsrv-group)# attribute acct-terminate-cause

user-request

will produce the same results as the command:

awplus(config-radsrv-group)# attribute 49 1

or the command:

awplus(config-radsrv-group)# attribute acct-terminate-cause 1

Examples To check a list of all available defined RADIUS attribute names, use the following

commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group Admin

awplus(config-radsrv-group)# attribute help

A list of Vendor-specific Attributes displays after the list of defined Standard

Attributes.

To get help for valid RADIUS attribute values for the attribute Service-Type,

use the following commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group Admin

awplus(config-radsrv-group)# attribute Service-Type help

This results in the following output:

Service-Type : integer (Integer number)



Pre-defined values :

Administrative-User (6)

Authenticate-Only (8)

Authorize-Only (17)

Callback-Administrative (11)

Callback-Framed-User (4)

Callback-Login-User (3)

Callback-NAS-Prompt (9)

Call-Check (10)

Framed-User (2)

NAS-Prompt-User (7)

Outbound-User (5)

C613-50292-01 Rev A Command Reference for IE210L Series 1323

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

ATTRIBUTE

To define the attribute name ‘Service-Type’ with Administrative User (6) to the

RADIUS User Group ‘Admin’, use the following commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group Admin

awplus(config-radsrv-group)# attribute Service-Type 6

To delete the attribute ‘Service-Type’ from the RADIUS User Group ‘Admin’, use the

following commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group Admin

awplus(config-radsrv-group)# no attribute Service-Type

Commands

egress-vlan-id

egress-vlan-name

C613-50292-01 Rev A Command Reference for IE210L Series 1324

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

AUTHENTICATION

authentication

Overview Use this command to enable the specified authentication methods on the local

RADIUS server.

Use the no variant of this command to disable specified authentication methods

on the local RADIUS server.

Syntax authentication {mac|eapmd5|eaptls|peap}

no authentication {mac|eapmd5|eaptls|peap}

Default All authentication methods are enabled by default.

Mode RADIUS Server Configuration

Examples The following commands enable EAP-MD5 authentication methods on the local

RADIUS server.

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# authentication eapmd5

The following commands disable EAP-MD5 authentication methods on Local

RADIUS server.

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# no authentication eapmd5

Commands

server enable

show radius local-server statistics

Parameter Description

mac Enable MAC authentication method.

eapmd5 Enable EAP-MD5 authentication method.

eaptls Enable EAP-TLS authentication method.

peap Enable EAP-PEAP authentication method.

C613-50292-01 Rev A Command Reference for IE210L Series 1325

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CLIENT (RADSECPROXY-SRV)

client (radsecproxy-srv)

Overview Use this command to add a RadSec client (for example, a NAS device) to the

RadSecProxy local-server application. The application will accept RADIUS requests

from all configured clients.

Use the no variant of this command to delete a previously-configured client from

the RadSecProxy local-server application.

Syntax client {<hostname>|<ip-addr>} [name-check {on|off}]

no client {<hostname>|<ip-addr>}

Mode RadSecProxy Local Server Configuration

Usage The client may be specified by its domain name or by its IPv4 address. If a domain

name is used, it must be resolvable using a configured DNS name server.

Each client may be configured to use certificate name-checking; if not specified,

the global behavior defined by client name-check or no client name-check will

be used. If name checking is enabled, the Common Name portion of the subject

field of the client’s X.509 certificate must match the domain name or IP address

specified in this command.

NOTE: If mutual authentication is disabled then this parameter has no effect, see the

client mutual-authentication command.

Example To add a client called ‘mynas.local’ with certificate name checking off, use the

commands:

awplus# configure terminal

awplus(config)# radius-secure-proxy local-server

awplus(config-radsecproxy-srv)# client mynas.local name-check

off

Commands

client mutual-authentication

client name-check

Parameter Description

<hostname>Hostname of client.

<ip-addr>Specify the client IPv4 address, in dotted decimal notation

(A.B.C.D).

name-check Specify whether or not to enforce certificate name checking for

this client. If the parameter is not specified then the global

behavior, which defaults to on, is used.

on Enable name checking for this client.

off Disable name checking for this client.

C613-50292-01 Rev A Command Reference for IE210L Series 1326

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CLIENT (RADSECPROXY-SRV)

client trustpoint

radius-secure-proxy local-server

C613-50292-01 Rev A Command Reference for IE210L Series 1327

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CLIENT MUTUAL-AUTHENTICATION

client mutual-authentication

Overview This command enables or disables mutual certificate authentication for all

RadSecProxy clients. When enabled, the RadSecProxy local-server application will

request and validate an X.509 certificate from the client when establishing a

connection.

The no variant of this command disables mutual certificate validation. The

local-server application will still transmit the local server certificate to the client,

but will not expect or validate a certificate from the client.

Syntax client mutual-authentication

no client mutual-authentication

Default Mutual authentication is enabled by default.

Mode RadSecProxy Local Server Configuration

Example Disable mutual certificate validation with the following command:

awplus# configure terminal

awplus(config)# radius-secure-proxy local-server

awplus(config-radsecproxy-srv)# no client

mutual-authentication

Commands

client (radsecproxy-srv)

client name-check

radius-secure-proxy local-server

Command

changes

Version 5.4.6-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1328

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CLIENT NAME-CHECK

client name-check

Overview This command sets the global behavior for certificate name-checking for the

RadSecProxy localserver application to on. This behavior will be used for all clients

associated with the application that do not specify a behavior on a per-client basis.

If name-checking is enabled, the Common Name portion of the subject field of the

client’s X.509 certificate must match the domain name or IP address specified in

the client (radsecproxy-aaa) command.

Use the no variant of this command to set the global behavior for certificate name

checking to off

Syntax client name-check

no client name-check

Default Certificate name checking is on by default.

Mode RadSecProxy Local Server Configuration

Example Disable certificate name checking globally with the following command:

awplus# configure terminal

awplus(config)# radius-secure-proxy local-server

awplus(config-radsecproxy-srv)# no client name-check

Commands

client (radsecproxy-srv)

client trustpoint

radius-secure-proxy local-server

C613-50292-01 Rev A Command Reference for IE210L Series 1329

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CLIENT TRUSTPOINT

client trustpoint

Overview This command adds one or more trustpoints to be used with the RadSecProxy

local-server application. Multiple trustpoints may be specified, or the command

may be executedmore than once, to add multiple trustpoints to the application.

The no version of this command removes one or more trustpoints from the list of

trustpoints associated with the application.

Syntax client trustpoint [<trustpoint-list>]

no client trustpoint [<trustpoint-list>]

Mode RadSecProxy Local Server Configuration

Usage The device certificate associated with first trustpoint added to the application will

be transmitted to remote servers. The certificate received from the remote server

must have an issuer chain that terminates with the root CA certificate for any of the

trustpoints that are associated with the application.

If no trustpoints are specified in the command, the trustpoint list will be

unchanged.

If no client trustpoint is issued without specifying any trustpoints, then all

trustpoints will be disassociated from the application.

Example You can add multiple trustpoints to the RadSecProxy local-server by executing the

command multiple times:

awplus# configure terminal

awplus(config)# radius-secure-proxy local-server

awplus(config-radsecproxy-srv)# client trustpoint example_1

awplus(config-radsecproxy-srv)# client trustpoint example_2

Alternatively, add multiple trustpoints with a single command:

awplus(config-radsecproxy-srv)# client trustpoint example_3

example_4

Disassociate all trustpoints from the RadSecProxy local-server application using

the command:

awplus(config-radsecproxy-srv)# no client trustpoint

Commands

client (radsecproxy-srv)

client name-check

radius-secure-proxy local-server

Parameter Description

<trustpoint-list> Specify one or more trustpoints to be added or deleted.

C613-50292-01 Rev A Command Reference for IE210L Series 1330

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CLEAR RADIUS LOCAL-SERVER STATISTICS

clear radius local-server statistics

Overview Use this command to clear the statistics stored on the device for the local RADIUS

server.

Use this command without any parameters to clear all types of local RADIUS server

statistics.

Syntax clear radius local-server statistics [nas|server|user]

Mode Privileged Exec

Usage Refer to the sample output for the show radius local-server statistics for further

information about the type of statistics each parameter option for this command

clears. Both the nas and server parameters clear unknown username and invalid

passwords statistics, while the user parameter clears the number of successful

and failed logins for each local RADIUS server user.

Examples To clear the NAS (Network Access Server) statistics stored on the device, use the

command:

awplus# clear radius local-server statistics nas

To clear the local RADIUS server statistics stored on the device, use the command:

awplus# clear radius local-server statistics server

To clear the local RADIUS server user statistics stored on the device, use the

command:

awplus# clear radius local-server statistics user

Commands

show radius local-server statistics

Parameter Description

nas Clear the NAS (Network Access Server) statistics on the device. For

example, clearing statistics stored for NAS server invalid

passwords.

server Clear the Local RADIUS Server statistics on the device. For example,

clearing Local RADIUS Servers statistics for all failed login attempts.

user Clear the Local RADIUS Server user statistics. For example, clearing

statistics stored for the number of successful user logins.

C613-50292-01 Rev A Command Reference for IE210L Series 1331

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

COPY FDB-RADIUS-USERS (TO FILE)

copy fdb-radius-users (to file)

Overview Use this command to create a set of local RADIUS server users from MAC addresses

in the local FDB. A local RADIUS server user created using this command can be

used for MAC authentication.

Syntax copy fdb-radius-users

{local-radius-user-db|flash|card|debug|tftp|scp|

fserver|<url>} [interface <port>] [vlan <vid>] [group <name>]

[export-vlan [<radius-group-name>]]

Mode Privileged Exec

Usage The local RADIUS server users created are written to a specified destination file in

local RADIUS user CSV (Comma Separated Values) format. The local RADIUS server

users can then be imported to a local RADIUS server using the copy

local-radius-user-db (from file) command.

The name and password of the local RADIUS server users created use a MAC

address, which can be used for MAC authentication.

Parameter Description

local-radius-

user-db Copy the local RADIUS server users created to the local

RADIUS server.

flash Copy the local RADIUS server users created to Flash memory.

card Copy the local RADIUS server users created to SD card.

debug Copy the local RADIUS server users created to debug.

tftp Copy the local RADIUS server users created to the TFTP

destination.

scp Copy the local RADIUS server users created to the SCP

destination.

fserver Copy the local RADIUS server users created to the remote file

server.

<url>Copy the local RADIUS server users created to the specified

URL.

interface <port>Copy only MAC addresses learned on a specified device port.

Wildcards may be used when specifying an interface name.

vlan <vid>Copy only MAC addresses learned on a specified VLAN.

group <name>Assign a group name to the local RADIUS server users created.

export-vlan Export VLAN ID assigned to exported FDB entry.

<radius-group-

name> Prefix for Radius group name storing VLAN ID

C613-50292-01 Rev A Command Reference for IE210L Series 1332

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

COPY FDB-RADIUS-USERS (TO FILE)

This command does not copy a MAC address learned by the CPU or the

management port.

This command can filter FDB entries by the interface name and the VLAN ID. When

the interface name and the VLAN ID are specified, this command generates local

RADIUS server users from only the MAC address learned on the specified interface

and on the specified VLAN.

Examples To register the local RADIUS server users from the local FDB directly to the local

RADIUS server, use the command:

awplus# copy fdb-radius-users local-radius-user-db

To register the local RADIUS server users from the interface port1.0.1 to the local

RADIUS server, use the command:

awplus# copy fdb-radius-users local-radius-user-db interface

port1.0.1

To copy output generated as local RADIUS server user data from MAC addresses

learned on vlan10 on interface port1.0.1 to the file radius-user.csv, use the

command:

awplus# copy fdb-radius-users radius-user.csv interface

port1.0.1 vlan10

To copy output generated as local RADIUS server user data from MAC addresses

learned on vlan10 on interface port1.0.1 to a file on the remote file server, use the

command:

awplus# copy fdb-radius-users fserver interface port1.0.1

vlan10

Commands

copy local-radius-user-db (to file)

copy local-radius-user-db (from file)

C613-50292-01 Rev A Command Reference for IE210L Series 1333

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

COPY LOCAL-RADIUS-USER-DB (FROM FILE)

copy local-radius-user-db (from file)

Overview Use this command to copy the Local RADIUS server user data from a file. The file,

including the RADIUS user data in the file, must be in the CSV (Comma Separated

Values) format.

You can select add or replace as the copy method. The add parameter option

copies the contents of specified file to the local RADIUS server user database. If the

same user exists then the old user is removed before adding a new user. The

replace parameter option deletes all contents of the local RADIUS server user

database before copying the contents of specified file.

Syntax copy <source-url> local-radius-user-db [add|replace]

Default When no copy method is specified with this command the replace option is

applied.

Mode Privileged Exec

Examples To replace the current local RADIUS server user data to the contents of

http://datahost/ user.csv, use the following command:

awplus# copy http://datahost/user.csv local-radius-user-db

To add the contents of http://datahost/user.csv to the current local RADIUS server

user database, use the following command:

awplus# copy http://datahost/user.csv local-radius-user-db add

commands

copy fdb-radius-users (to file)

copy local-radius-user-db (to file)

Parameter Description

<source-url>URL of the source file.

add Add file contents to local RADIUS server user database.

replace Replace current local RADIUS server user database with

file contents.

C613-50292-01 Rev A Command Reference for IE210L Series 1334

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

COPY LOCAL-RADIUS-USER-DB (TO FILE)

copy local-radius-user-db (to file)

Overview Use this command to copy the local RADIUS server user data to a file. The output

file produced is CSV (Comma Separated Values) format.

Syntax copy local-radius-user-db

{flash|card|tftp|scp|<destination-url>}

Mode Privileged Exec

Example Copy the current local RADIUS server user data to http://datahost/user.csv.

awplus# copy local-radius-user-db http://datahost/user.csv

Commands

copy fdb-radius-users (to file)

copy local-radius-user-db (from file)

Parameter Description

flash Copy to Flash memory.

card Copy to SD card.

tftp Copy to TFTP destination.

scp Copy to SCP destination.

<destination-url>URL of the Destination file.

C613-50292-01 Rev A Command Reference for IE210L Series 1335

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CRYPTO PKI ENROLL LOCAL (DELETED)

crypto pki enroll local (deleted)

Overview This command is no longer available. Please use the following command instead:

crypto pki enroll <trustpoint>

Note that “local” is a valid name for a trustpoint, so you do not need to modify

existing configurations or scripts.

C613-50292-01 Rev A Command Reference for IE210L Series 1336

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CRYPTO PKI ENROLL LOCAL LOCAL-RADIUS-ALL-USERS (DELETED)

crypto pki enroll local local-radius-all-users

(deleted)

Overview This command is no longer available. Please use the following command instead:

crypto pki enroll <trustpoint> local-radius-all-users

Note that “local” is a valid name for a trustpoint, so you do not need to modify

existing configurations or scripts.

C613-50292-01 Rev A Command Reference for IE210L Series 1337

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CRYPTO PKI ENROLL LOCAL USER (DELETED)

crypto pki enroll local user (deleted)

Overview This command is no longer available. Please use the following command instead:

crypto pki enroll <trustpoint> user <username>

Note that “local” is a valid name for a trustpoint, so you do not need to modify

existing configurations or scripts.

C613-50292-01 Rev A Command Reference for IE210L Series 1338

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CRYPTO PKI EXPORT LOCAL PEM (DELETED)

crypto pki export local pem (deleted)

Overview This command is no longer available. Please use the crypto pki export pem

command instead:

crypto pki export <trustpoint> pem [terminal|<url>]

Note that “local” is a valid name for a trustpoint, so you do not need to modify

existing configurations or scripts.

C613-50292-01 Rev A Command Reference for IE210L Series 1339

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CRYPTO PKI EXPORT LOCAL PKCS12 (DELETED)

crypto pki export local pkcs12 (deleted)

Overview This command is no longer available. Please use the crypto pki export pkcs12

command instead:

crypto pki export <trustpoint> pkcs12 {ca|server|<username>}

<url>

Note that “local” is a valid name for a trustpoint, so you do not need to modify

existing configurations or scripts.

C613-50292-01 Rev A Command Reference for IE210L Series 1340

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

CRYPTO PKI TRUSTPOINT LOCAL (DELETED)

crypto pki trustpoint local (deleted)

Overview This command is no longer available. Please use the following command instead:

crypto pki trustpoint <trustpoint>

Note that “local” is a valid name for a trustpoint, so you do not need to modify

existing configurations or scripts.

C613-50292-01 Rev A Command Reference for IE210L Series 1341

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

DEBUG CRYPTO PKI (DELETED)

debug crypto pki (deleted)

Overview This command is no longer available.

C613-50292-01 Rev A Command Reference for IE210L Series 1342

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

DOMAIN-STYLE

domain-style

Overview Use this command to enable a specified domain style on the local RADIUS server.

The local RADIUS server decodes the domain portion of a username login string

when this command is enabled.

Use the no variant of this command to disable the specified domain style on the

local RADIUS server.

Syntax domain-style {suffix-atsign|ntdomain}

no domain-style {suffix-atsign|ntdomain}

Default This feature is disabled by default.

Mode RADIUS Server Configuration

Usage When both domain styles are enabled, the first domain style configured has the

highest priority. A username login string is matched against the first domain style

enabled. Then, if the username login string is not decoded, it is matched against

the second domain style enabled.

Examples To enable NT domain style on the local RADIUS server, use the commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# domain-style ntdomain

To disable NT domain style on the local RADIUS server, use the commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# no domain-style ntdomain

Commands

server enable

Parameter Description

suffix-atsign Enable at sign “@” delimited suffix style, i.e. “user@domain”.

ntdomain Enable NT domain style, i.e. “domain\user”.

C613-50292-01 Rev A Command Reference for IE210L Series 1343

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

EGRESS-VLAN-ID

egress-vlan-id

Overview Use this command to configure the standard RADIUS attribute “Egress-VLANID

(56)” for the local RADIUS Server user group.

Use the no variant of this command to remove the Egress-VLANID attribute from

the local RADIUS server user group.

Syntax egress-vlan-id <vid> [tagged|untagged]

no egress-vlan-id

Default By default, no Egress-VLANID attributes are configured.

Mode RADIUS Server Group Configuration

Usage When a Voice VLAN is configured for dynamic VLAN allocation (switchport voice

vlan command), the RADIUS server must be configured to send the VLAN

information when an IP phone is successfully authenticated. Use either the

egress-vlan-id command or the egress-vlan-name command, and specify the

tagged parameter.

Examples To set the “Egress-VLANID” attribute for the NormalUsers local RADIUS server user

group to VLAN identifier 200, with tagged frames, use the commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group NormalUsers

awplus(config-radsrv-group)# egress-vlan-id 200 tagged

To remove the “Egress-VLANID” attribute for the NormalUsers local RADIUS server

user group, use the commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group NormalUsers

awplus(config-radsrv-group)# no egress-vlan-id

Parameter Description

<vid>The VLAN identifier to be used for the Egress VLANID attribute, in

the range 1 to 4094.

tagged Set frames on the VLAN as tagged. This sets the tag indication field

to indicate that all frames on this VLAN are tagged.

untagged Set all frames on the VLAN as untagged. This sets the tag indication

field to indicate that all frames on this VLAN are untagged.

C613-50292-01 Rev A Command Reference for IE210L Series 1344

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

EGRESS-VLAN-ID

Commands

attribute

egress-vlan-name

switchport voice vlan

C613-50292-01 Rev A Command Reference for IE210L Series 1345

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

EGRESS-VLAN-NAME

egress-vlan-name

Overview Use this command to configure the standard RADIUS attribute

“Egress-VLAN-Name (58)” for the local RADIUS server user group.

Use the no variant of this command to remove the Egress-VLAN-Name attribute

from the local RADIUS server user group.

Syntax egress-vlan-name <vlan-name> [tagged|untagged]

no egress-vlan-name

Default By default, no Egress-VLAN-Name attributes are configured.

Mode RADIUS Server Group Configuration

Usage When a Voice VLAN is configured for dynamic VLAN allocation (switchport voice

vlan command), the RADIUS server must be configured to send the VLAN

information when an IP phone is successfully authenticated. Use either the

egress-vlan-id command or the egress-vlan-name command, and specify the

tagged parameter.

Examples To configure the “Egress-VLAN-Name” attribute for the RADIUS server user group

NormalUsers with the VLAN name vlan2 and all frames on this VLAN tagged, use

the commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group NormalUsers

awplus(config-radsrv-group)# egress-vlan-name vlan2 tagged

To delete the “Egress-VLAN-Name” attribute for the NormalUsers group, use the

commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group NormalUsers

awplus(config-radsrv-group)# no egress-vlan-name

Parameter Description

<vlan-name>The VLAN name to be configured as the Egress-VLAN-Name

attribute.

tagged Set frames on the VLAN as tagged. This sets the tag indication field

to indicate that all frames on this VLAN are tagged.

untagged Set all frames on the VLAN as untagged. This sets the tag indication

field to indicate that all frames on this VLAN are untagged.

C613-50292-01 Rev A Command Reference for IE210L Series 1346

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

EGRESS-VLAN-NAME

Commands

attribute

egress-vlan-id

switchport voice vlan

C613-50292-01 Rev A Command Reference for IE210L Series 1347

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

GROUP

group

Overview Use this command to create a local RADIUS server user group, and enter local

RADIUS Server User Group Configuration mode.

Use the no variant of this command to delete the local RADIUS server user group.

Syntax group <user-group-name>

no group <user-group-name>

Mode RADIUS Server Configuration

Examples The following command creates the user group NormalUsers.

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group NormalUsers

The following command deletes user group NormalUsers.

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# no group NormalUsers

Commands

user (RADIUS server)

show radius local-server user

vlan (RADIUS server)

Parameter Description

<user-group-name>User group name string.

C613-50292-01 Rev A Command Reference for IE210L Series 1348

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

NAS

nas

Overview This command adds a client device (the Network Access Server or the NAS) to the

list of devices that are able to send authentication requests to the local RADIUS

server. The NAS is identified by its IP address and a shared secret (also referred to

as a shared key) must be defined that the NAS will use to establish its identity.

Use the no variant of this command to remove a NAS client from the list of devices

that are allowed to send authentication requests to the local RADIUS server.

Syntax nas <ip-address> key <nas-keystring>

no nas <ip-address>

Mode RADIUS Server Configuration

Examples The following commands add the NAS with an IP address of 192.168.1.2 to the

list of clients that may send authentication requests to the local RADIUS server.

Note the shared key that this NAS will use to establish its identify is

NAS_PASSWORD.

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# nas 192.168.1.2 key NAS_PASSWORD

The following commands remove the NAS with an IP address of 192.168.1.2

from the list of clients that are allowed to send authentication requests to the local

RADIUS server:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# no nas 192.168.1.2

Commands

show radius local-server nas

Parameter Description

<ip-address>RADIUS NAS IP address.

<nas-keystring>NAS shared keystring.

C613-50292-01 Rev A Command Reference for IE210L Series 1349

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

RADIUS-SECURE-PROXY LOCAL-SERVER

radius-secure-proxy local-server

Overview Use this command to enter the RadSecProxy local-server application configuration

mode. This application allows remote RadSec clients to communicate with the

local RADIUS server process via a secure (TLS) proxy.

Syntax radius-secure-proxy local-server

Mode Global Configuration Mode

Example To change mode from User Exec mode to the RadSecProxy local-server

configuration mode, use the commands:

awplus# configure terminal

awplus(config)# radius-secure-proxy local-server

awplus(config-radsecproxy-srv)#

Commands

client (radsecproxy-srv)

client name-check

client trustpoint

C613-50292-01 Rev A Command Reference for IE210L Series 1350

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

RADIUS-SERVER LOCAL

radius-server local

Overview Use this command to navigate to the Local RADIUS server configuration

mode(config-radsrv) from the Global Configuration mode (config).

Syntax radius-server local

Mode Global Configuration

Example Local RADIUS Server commands are available from config-radsrv

configuration mode. To change mode from User Exec mode to the Local RADIUS

Server mode (config- radsrv), use the commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)#

Output

Commands

server enable

show radius local-server group

show radius local-server nas

show radius local-server statistics

show radius local-server user

awplus(config)#radius-server local

Creating Local CA repository.....OK

Enrolling Local System to local trustpoint..OK

awplus(config-radsrv)#

C613-50292-01 Rev A Command Reference for IE210L Series 1351

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

SERVER AUTH-PORT

server auth-port

Overview Use this command to change the UDP port number for local RADIUS server

authentication.

Use the no variant of this command to reset the RADIUS server authentication port

back to the default.

Syntax server auth-port <1-65535>

no server auth-port

Default The default local RADIUS server UDP authentication port number is 1812.

Mode RADIUS Server Configuration

Examples The following commands set the RADIUS server authentication port to 10000.

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# server auth-port 10000

The following commands reset the RADIUS server authentication port back to the

default UDP port of 1812.

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# no server auth-port

Commands

server enable

show radius local-server statistics

Parameter Description

<1-65535>UDP port number.

C613-50292-01 Rev A Command Reference for IE210L Series 1352

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

SERVER ENABLE

server enable

Overview This command enables the local RADIUS server. The local RADIUS server feature is

started immediately when this command is issued.

The no variant of this command disables local RADIUS server. When this command

is issued, the local RADIUS server stops operating.

Syntax server enable

no server enable

Default The local RADIUS server is disabled by default and must be enabled for use with

this command.

Mode RADIUS Server Configuration

Examples To enable the local RADIUS server, use the following commands:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# server enable

To disable the local RADIUS server, use the command:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# no server enable

Commands

server auth-port

show radius local-server statistics

C613-50292-01 Rev A Command Reference for IE210L Series 1353

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

SHOW RADIUS LOCAL-SERVER GROUP

show radius local-server group

Overview Use this command to display information about the local RADIUS server user

group.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show radius local-server group [<user-group-name>]

Mode User Exec and Privileged Exec

Example The following command displays Local RADIUS server user group information.

awplus# show radius local-server group

Output

Commands

group

Parameter Description

<user-group-name>User group name string.

Table 1: Example output from the show radius local-server group command

Group-Name Vlan

----------------------------------------------------------------

NetworkOperators ManagementNet

NormalUsers CommonNet

Table 2: Parameters in the output of the show radius local-server group

command

Parameter Description

Group-Name Group name.

Vlan VLAN name assigned to the group.

C613-50292-01 Rev A Command Reference for IE210L Series 1354

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

SHOW RADIUS LOCAL-SERVER NAS

show radius local-server nas

Overview Use this command to display information about NAS (Network Access Servers)

registered to the local RADIUS server.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show radius local-server nas [<ip-address>]

Mode User Exec and Privileged Exec

Example The following command displays NAS information.

awplus# show radius local-server nas

Output

Commands

nas

Parameter Description

<ip-address> Specify NAS IP address for show output.

Table 3: Example output from the show radius local-server nas command

NAS-Address Shared-Key

----------------------------------------------------------

127.0.0.1 awplus-local-radius-server

Table 4: Parameters in the output of the show radius local-server nas

command

Parameter Description

NAS-Address IP address of NAS.

Shared-Key Shared key used for RADIUS connection.

C613-50292-01 Rev A Command Reference for IE210L Series 1355

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

SHOW RADIUS LOCAL-SERVER STATISTICS

show radius local-server statistics

Overview Use this command to display statistics about the local RADIUS server.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show radius local-server statistics

Mode User Exec and Privileged Exec

Usage Both unknown usernames and invalid passwords will display as failed logins in the

show output.

Example The following command displays Local RADIUS server statistics.

awplus# show radius local-server statistics

Output

Commands

clear radius local-server statistics

radius-server local

server enable

server auth-port

Table 5: Example output from the show radius local-server statistics command



Server status : Run (administrative status is enable)

Enabled methods: MAC EAP-MD5 EAP-TLS EAP-PEAP



Successes :1 Unknown NAS :0

Failed Logins :0 Invalid packet from NAS :0

Internal Error :0 Unknown Error :0



NAS : 127.0.0.1

Successes :0 Shared key mismatch :0

Failed Logins :0 Unknown RADIUS message :0

Unknown EAP message :0 Unknown EAP auth type :0

Corrupted packet :0

NAS : 192.168.1.61

Successes :0 Shared key mismatch :0

Failed Logins :0 Unknown RADIUS message :0

Unknown EAP message :0 Unknown EAP auth type :0

Corrupted packet :0



Username Successes Failures

a 1 0

admin 0 0

C613-50292-01 Rev A Command Reference for IE210L Series 1356

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

SHOW RADIUS LOCAL-SERVER USER

show radius local-server user

Overview Use this command to display information about the local RADIUS server user.

For information on filtering and saving command output, see the “Getting Started

with AlliedWare Plus” Feature Overview and Configuration Guide.

Syntax show radius local-server user [<user-name>]

show radius local-server user [<user-name>] format csv

show radius local-server user [<user-name>] detail

Mode User Exec and Privileged Exec

Examples The following command displays Local RADIUS server user information for user

Tom.

awplus# show radius local-server user Tom

The following command displays all Local RADIUS server information for all users.

awplus# show radius local-server user

The following command displays Local RADIUS server user information for Tom in

CSV format.

awplus# show radius local-server user Tom format csv

The following command displays detailed Local RADIUS server user information

for all users.

awplus# show radius local-server detail

Parameter Description

<user-name>RADIUS user name. If no user name is specified, information for all

users is displayed.

format csv Format output as CSV.

detail display detailed information about the user.

Table 6: Example output from the show radius local-server user command

User-Name Password Group Vlan

----------------------------------------------------------------

Tom abcd NetworkOperators ManagementNet

Table 7: Example output from the show radius local-server user Tom format

csv command

true,"NetworkOperators","Tom","abcd",0,2099/01/01,1,"","","Managem

entNet",false,3600,false,0,"",false,"

C613-50292-01 Rev A Command Reference for IE210L Series 1357

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

SHOW RADIUS LOCAL-SERVER USER

Commands

group

user (RADIUS server)

Command

changes

Version 5.4.9-0.1: detail parameter added

Table 8: Example output from the show radius local-server detail command

awplus# show radius local-server user detail

------------------------------------------------------------------

Username : 00-00-cd-38-00-68

Password: mssv+c7URUgtfltKy46Rt0VgPefRdihWOXEUeCmS8Bw=

Group : GroupName

Vlan : VlanName

Username : Tom:port1.0.5:00-00-cd-38-00-68

Password: 0cVvLd4+oyQlO2eckFXtV9d9JO/lXbqlDiRvyTOd+Wk=

Group : GroupName

Vlan : VlanName

Table 9: Parameters in the output from the show radius local-server user

command

Parameter Description

User-Name User name.

Password User password.

Group Group name assigned to the user.

Vlan VLAN name assigned to the user.

C613-50292-01 Rev A Command Reference for IE210L Series 1358

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

USER (RADIUS SERVER)

user (RADIUS server)

Overview Use this command to register a user to the local RADIUS server.

Use the no variant of this command to delete a user from the local RADIUS server.

Syntax user <radius-user-name> [encrypted] password <user-password>

[group <user-group>]

no user <radius-user-name>

Mode RADIUS Server Configuration

Usage RADIUS user names cannot contain question mark (?), space ( ), or quote (“ “)

characters. RADIUS user names containing the below characters cannot use

certificate authentication:

/ \ ‘$ &()*;< > ‘|

Certificates cannot be created and exported for RADIUS user names that contain

the above characters. We advise you to avoid using these characters in RADIUS

user names if you need to use certificate authentication, because you will not be

able to create and export certificates.

You also can use the IEEE standard format hexadecimal notation

(HH-HH-HH-HH-HH-HH) to specify a supplicant MAC address to configure the

user name and user password parameters to use local RADIUS server for MAC

Authentication. See the AAA and Port_Authentication Feature Overview and

Configuration_Guide for a sample MAC configuration. See also the command user

Parameter Description

<radius-user-name>RADIUS user name. This can also be a MAC address in the

IEEE standard format of HH-HH-HH-HH-HH-HH if you are

configuring MAC authentication to use local RADIUS server.

encrypted Specifies that the password is being entered in its

encrypted form, so that it is not further encrypted.

When creating a new user, enter the password in plaintext,

and do not use the encrypted parameter.

Use the encrypted parameter only when referring to a user

that has previously been created. For instance, when

adding an existing user from another RADIUS server, use

the encrypted parameter, and enter the encrypted version

of the password that appears in the output of show

commands for the user.

<user-password>User password. This can also be a MAC address in the IEEE

standard format of HH-HH-HH-HH-HH-HH if you are

configuring MAC authentication to use local RADIUS server.

group Specify the group for the user.

<user-group>User group name.

C613-50292-01 Rev A Command Reference for IE210L Series 1359

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

USER (RADIUS SERVER)

00-db-59-ab-70-37 password 00-db-59-ab-70-37 as shown in the command

examples.

Examples The following commands add user “Tom” to the local RADIUS server and sets his

password to “QwerSD”.

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# user Tom password QwerSD

The following commands add user “Tom” to the local RADIUS server user group

“NormalUsers” and sets his password “QwerSD”.

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# user Tom password QwerSD group

NormalUsers

The following commands remove user “Tom” from the local RADIUS server:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# no user Tom

The following commands add the supplicant MAC address 00-d0-59-ab-70-37 to

the local RADIUS server:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# user 00-db-59-ab-70-37 password

00-db-59-ab-70-37

The following commands remove the supplicant MAC address 00-d0-59-ab-70-37

from the local RADIUS server:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# no user 00-db-59-ab-70-37

Commands

group

show radius local-server user

C613-50292-01 Rev A Command Reference for IE210L Series 1360

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

LOCAL RADIUS SERVER COMMANDS

VLAN (RADIUS SERVER)

vlan (RADIUS server)

Overview Use this command to set the VLAN ID or name for the local RADIUS server user

group. The VLAN information is used for authentication with the dynamic VLAN

feature.

Use the no variant of this command to clear the VLAN ID or VLAN name for the local

RADIUS server user group.

Syntax vlan {<vid>|<vlan-name>}

no vlan

Default VLAN information is not set by default.

Mode RADIUS Server Group Configuration

Examples The following commands set VLAN ID 200 to the group named NormalUsers:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group NormalUsers

awplus(config-radsrv-group)# vlan 200

The following commands remove VLAN ID 200 from the group named

NormalUsers:

awplus# configure terminal

awplus(config)# radius-server local

awplus(config-radsrv)# group NormalUsers

awplus(config-radsrv-group)# no vlan

Commands

group

show radius local-server user

Parameter Description

<vid>VLAN ID.

<vlan-name>VLAN name.

C613-50292-01 Rev A Command Reference for IE210L Series 1361

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

Public Key

Infrastructure

Commands

Introduction

Overview This chapter provides an alphabetical reference of commands used to configure

the Public Key Infrastructure (PKI) capabilities on an AlliedWare Plus device. For

more information about PKI, see the Public Key Infrastructure (PKI) Feature

Overview and Configuration Guide.

Command List •“crypto key generate rsa” on page 1362

•“crypto key zeroize” on page 1363

•“crypto pki authenticate” on page 1364

•“crypto pki enroll” on page 1365

•“crypto pki enroll user” on page 1366

•“crypto pki export pem” on page 1368

•“crypto pki export pkcs12” on page 1369

•“crypto pki import pem” on page 1371

•“crypto pki import pkcs12” on page 1373

•“crypto pki trustpoint” on page 1374

•“enrollment (trustpoint configuration mode)” on page 1375

•“fingerprint (trustpoint configuration mode)” on page 1376

•“no crypto pki certificate” on page 1378

•“rsakeypair (trustpoint configuration mode)” on page 1379

•“show crypto key mypubkey rsa” on page 1380

•“show crypto pki certificates” on page 1381

•“show crypto pki enrollment user” on page 1383

•“show crypto pki trustpoint” on page 1384

•“subject-name (trustpoint configuration)” on page 1385

C613-50292-01 Rev A Command Reference for IE210L Series 1362

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO KEY GENERATE RSA

crypto key generate rsa

Overview Use this command to generate a cryptographic public/private key pair for the

Rivest-Shamir-Adleman (RSA) encryption algorithm.

Syntax crypto key generate rsa [label <keylabel>] [<1024-4096>]

Mode Privileged Exec

Usage The generated key may be used for multiple server certificates in the system. A key

is referenced by its label. A bit length between 1024 and 4096 bits may be

specified. Larger bit lengths are more secure, but require more computation time.

The specified key must not already exist.

Example To create a key with the label "example-server-key" and a bit length of 2048, use

the commands:

awplus> enable

awplus# crypto key generate rsa label example-server-key 2048

Commands

crypto key zeroize

rsakeypair (trustpoint configuration mode)

show crypto key mypubkey rsa

Parameter Description

<keylabel> The name of the key to be created. The name must start with an

alphanumeric character, and may only contain alphanumeric

characters, underscores, dashes, or periods. The maximum length

of the name is 63 characters. If no label is specified the default

value “server-default” is used.

<1024-4096> The bit length for the key. If no bit length is specified the default

of 2048 is used.

C613-50292-01 Rev A Command Reference for IE210L Series 1363

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO KEY ZEROIZE

crypto key zeroize

Overview Use this command to delete one or all cryptographic public/private key pairs.

Syntax crypto key zeroize rsa <keylabel>

crypto key zeroize all

Mode Privileged Exec

Usage Note that this command has the same effect as using the delete command (it

deletes the file from Flash memory but does not overwrite it with zeros).

The specified key must exist but must not be in use for any existing server

certificates.

A key may not be deleted if it is associated with the server certificate or server

certificate signing request for an existing trustpoint. To remove a server certificate

so that the key may be deleted, use the no crypto pki enroll command to

de-enroll the server.

Example To delete an RSA key named "example-server-key", use the following command:

awplus# crypto key zeroize rsa example-server-key

Commands

crypto key generate rsa

show crypto key mypubkey rsa

Command

changes

Version 5.4.6-1.1: zeroize functionality added to x930 Series

Version 5.4.8-1.2: zeroize functionality added to x220, XS900MX, x550 Series

Version 5.4.8-2.1: zeroize functionality added to SBx908 GEN2, x950 Series

Parameter Description

rsa <keylabel> Delete a single key pair for the Rivest-Shamir-Adleman (RSA)

encryption algorithm.

all Delete all keys.

C613-50292-01 Rev A Command Reference for IE210L Series 1364

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI AUTHENTICATE

crypto pki authenticate

Overview Use this command to authenticate a trustpoint by generating or importing the

root CA certificate. This must be done before the server can be enrolled to the

trustpoint.

Syntax crypto pki authenticate <trustpoint>

Mode Privileged Exec

Usage If the trustpoint’s enrollment setting is “selfsigned”, then this command causes a

private key to be generated for the root CA, and a self-signed certificate to be

generated based on that key.

If the trustpoint’s enrollment setting is “terminal”, then this command prompts

the user to paste a certificate Privacy Enhanced Mail (PEM) file at the CLI terminal.

If the certificate is a valid selfsigned CA certificate, then it will be stored as the

trustpoint’s root CA certificate.

The specified trustpoint must already exist, and its enrollment mode must have

been defined.

Example To show the enrollment setting of a trustpoint named “example” and then

generate a certificate from it, use the commands:

awplus> enable

awplus# configure terminal

awplus(config)# crypto pki trustpoint example

awplus(ca-trustpoint)# enrollment selfsigned

awplus(config)# exit

awplus# exit

awplus# crypto pki authenticate example

Commands

crypto pki import pem

crypto pki trustpoint

enrollment (trustpoint configuration mode)

Parameter Description

<trustpoint> The name of the trustpoint to be authenticated.

C613-50292-01 Rev A Command Reference for IE210L Series 1365

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI ENROLL

crypto pki enroll

Overview Use this command to enroll the local server to the specified trustpoint.

Use the no variant of this command to de-enroll the server by removing its

certificate

Syntax crypto pki enroll <trustpoint>

no crypto pki enroll <trustpoint>

Mode Privileged Exec

Usage For the local server, “enrollment” is the process of creating of a certificate for the

server that has been signed by a CA associated with the trustpoint. The public

portion of the RSA key pair specified using the rsakeypair parameter for the

trustpoint will be included in the server certificate.

If the trustpoint represents a locally self-signed certificate authority, then this

command results in the direct generation of the server certificate, signed by the

root CA for the trustpoint.

If the trustpoint represents an external certificate authority, then this command

results in the generation of a Certificate Signing Request (CSR) file, which is

displayed at the terminal in Privacy-Enhanced Mail (PEM) format, suitable for

copying and pasting into a file or message. The CSR must be sent to the external

CA for processing. When the CA replies with the signed certificate, that certificate

should be imported using the crypto pki import pem command, to complete the

enrollment process.

The specified trustpoint must already exist, and it must already be authenticated.

Example To enroll the local server with the trustpoint “example”, use the following

commands:

awplus> enable

awplus# crypto pki enroll example

Commands

crypto pki enroll user

crypto pki import pem

crypto pki trustpoint

enrollment (trustpoint configuration mode)

Parameter Description

<trustpoint> The name of the trustpoint to be enrolled

C613-50292-01 Rev A Command Reference for IE210L Series 1366

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI ENROLL USER

crypto pki enroll user

Overview Use this command to enroll a single RADIUS user or all RADIUS users to the

specified trustpoint.

Use the no variant of this command to remove the PKCS#12 file from the system.

Note that the PKCS#12 files are generated in a temporary (volatile) file system, so a

system restart also results in removal of all of the files.

Syntax crypto pki enroll <trustpoint> 

{user <username>|local-radius-all-users}

no crypto pki enroll <trustpoint> 

{user <username>|local-radius-all-users}

Mode Privileged Exec

Usage For RADIUS users, “enrollment” is the process of generating a private key and a

corresponding client certificate for each user, with the certificate signed by the

root CA for the trustpoint. The resulting certificates may be exported to client

devices, for use with PEAP or EAP-TLS authentication with the local RADIUS server.

The specified trustpoint must represent a locally self-signed certificate authority.

The private key and certificate are packaged into a PKCS#12-formatted file,

suitable for export using the crypto pki export pkcs12 command. The private key

is encrypted for security, with a passphrase that is entered at the command line.

The passphrase is required when the PKCS#12 file is imported on the client system.

The passphrase is not stored anywhere on the device, so users are responsible for

remembering it until the export-import process is complete.

If local-radius-all-users is specified instead of an individual user, then keys and

certificates for all RADIUS users will be generated at once. All the keys will be

encrypted using the same passphrase.

The specified trustpoint must already exist, it must represent a locally self-signed

CA, and it must already have been authenticated.

Example To enroll the user “example-user” with the trustpoint “example”, use the following

commands:

awplus> enable

awplus# crypto pki enroll example user example-user

Parameter Description

<trustpoint> The name of the trustpoint to which users are to be enrolled.

<username> The name of the user to enroll to the trustpoint.

C613-50292-01 Rev A Command Reference for IE210L Series 1367

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI ENROLL USER

To enroll all local RADIUS users with the trustpoint “example”, use the following

commands:

awplus> enable

awplus# crypto pki enroll example local-radius-all-users

Commands

crypto pki export pkcs12

crypto pki trustpoint

C613-50292-01 Rev A Command Reference for IE210L Series 1368

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI EXPORT PEM

crypto pki export pem

Overview Use this command to export the root CA certificate for the given trustpoint to a file

in Privacy-Enhanced Mail (PEM) format. The file may be transferred to the specified

destination URL, or displayed at the terminal.

Syntax crypto pki export <trustpoint> pem [terminal|<url>]

Default The PEM will be displayed to the terminal by default.

Mode Privileged Exec

Usage The specified trustpoint must already exist, and it must already be authenticated.

Example To display the PEM file for the trustpoint “example” to the terminal, use the

following commands:

awplus> enable

awplus# crypto pki export example pem terminal

To export the PEM file “example.pem” for the trustpoint “example” to the URL

“tftp://server_a/”, use the following commands:

awplus> enable

awplus# crypto pki export example pem

tftp://server_a/example.pem

Commands

crypto pki authenticate

crypto pki import pem

crypto pki trustpoint

Parameter Description

<trustpoint> The name of the trustpoint for which the root CA certificate is

tobe exported.

terminal Display the PEM file to the terminal.

<url> Transfer the PEM file to the specified URL.

C613-50292-01 Rev A Command Reference for IE210L Series 1369

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI EXPORT PKCS12

crypto pki export pkcs12

Overview Use this command to export a certificate and private key for an entity in a

trustpoint to a file in PKCS#12 format at the specified URL. The private key is

encrypted with a passphrase for security.

Syntax crypto pki export <trustpoint> pkcs12 {ca|server|<username>}

<url>

Mode Privileged Exec

Usage If the ca option is specified, this command exports the root CA certificate and the

corresponding private key, if the trustpoint has been authenticated as a locally

selfsigned CA. (If the trustpoint represents an external CA, then there is no private

key on the system corresponding to the root CA certificate. Use the crypto pki

export pem file to export the certificate by itself.) The command prompts for a

passphrase to encrypt the private key.

If the server option is specified, this command exports the server certificate and

the corresponding private key, if the server has been enrolled to the trustpoint. The

command prompts for a passphrase to encrypt the private key.

If a RADIUS username is specified, this command exports the PKCS#12 file that was

generated using the crypto pki enroll user command. (The key within the file was

already encrypted as part of the user enrollment process.)

In the event that there is a RADIUS user named “ca” or “server”, enter “user:ca” or

“user:server” as the username.

The key and certificate must already exist.

Parameter Description

<trustpoint> The name of the trustpoint for which the certificate and key are

tobe exported.

ca If this option is specified, the command exports the root CA

certificate and corresponding key.

server If this option is specified, the command exports the server

certificate and corresponding key.

<username> If a RADIUS username is specified, the command exports the

PKCS#12 file that was previously generated using the crypto pki

enroll user command. To avoid ambiguity with keywords, the

username may be prefixed by the string “user:”.

<url> The destination URL for the PKCS#12 file. The format of the URLis

the same as any valid destination for a file copy command.

C613-50292-01 Rev A Command Reference for IE210L Series 1370

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI EXPORT PKCS12

Example To export the PKCS#12 file “example.pk12” for the trustpoint “example” to the URL

“tftp://backup/”, use the following commands:

awplus> enable

awplus# crypto pki export example pkcs12 ca

tftp://backup/example.pk12

Commands

crypto pki enroll user

crypto pki export pem

crypto pki import pkcs12

C613-50292-01 Rev A Command Reference for IE210L Series 1371

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI IMPORT PEM

crypto pki import pem

Overview This command imports a certificate for the given trustpoint from a file in

Privacy-Enhanced Mail (PEM) format. The file may be transferred from the specified

destination URL, or entered at the terminal.

Syntax crypto pki import <trustpoint> pem [terminal|<url>]

Default The PEM will be imported from the terminal by default.

Mode Privileged Exec

Usage The command is generally used for trustpoints representing external certificate

authorities. It accepts root CA certificates, intermediate CA certificates, and server

certificates. The system automatically detects the certificate type upon import.

Using this command to import root CA certificates at the terminal is identical to the

functionality provided by the crypto pki authenticate command, for external

certificate authorities. The imported certificate is validated to ensure it is a proper

CA certificate.

Intermediate CA certificates are validated to ensure they are proper CA certificates,

and that the issuer chain ends in a root CA certificate already installed for the

trustpoint. If there is no root CA certificate for the trustpoint (i.e., if the trustpoint is

unauthenticated) then intermediate CA certificates may not be imported.

Server certificates are validated to ensure that the issuer chain ends in a root CA

certificate already installed for the trustpoint. If there is no root CA certificate for

the trustpoint (i.e., if the trustpoint is unauthenticated) then server certificates may

not be imported.

The specified trustpoint must already exist. If the imported certificate is

self-signed, then no certificates may exist for the trustpoint. Otherwise, the issuer’s

certificate must already be present for the trustpoint.

Example To import the PEM file for the trustpoint “example” from the terminal, use the

following commands:

awplus> enable

awplus# crypto pki import example pem

Parameter Description

<trustpoint> The name of the trustpoint for which the root CA certificate is to

be imported.

terminal Optional parameter, If specified, the command prompts the user

to enter (or paste) the PEM file at the terminal. If parameter is

specified terminal is assumed by default.

<url> Optional parameter, If specified, the PEM file is transferred from

the specified URL

C613-50292-01 Rev A Command Reference for IE210L Series 1372

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI IMPORT PEM

To import the PEM file for the trustpoint “example” from the URL “tftp://server_a/”,

use the following commands:

awplus> enable

awplus# crypto pki import example pem

tftp://server_a/example.pem

Commands

crypto pki authenticate

crypto pki export pem

crypto pki trustpoint

C613-50292-01 Rev A Command Reference for IE210L Series 1373

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI IMPORT PKCS12

crypto pki import pkcs12

Overview This command imports a certificate and private key for an entity in a trustpoint

from a file in PKCS#12 format at the specified URL. The command prompts for a

passphrase to decrypt the private key within the file.

Syntax crypto pki import <trustpoint> pkcs12 {ca|server} <url>

Mode Privileged Exec

Usage If the ca option is specified, this command imports the root CA certificate and the

corresponding private key. This is only valid if the root CA certificate does not

already exist for the trustpoint (i.e., if the trustpoint is unauthenticated).

If the server option is specified, this command imports the server certificate and

the corresponding private key. The imported private key is given a new unique

label of the form “localN”, where N is a non-negative integer. This operation is only

valid if the server certificate does not already exist for the trustpoint (i.e., if the

server is not enrolled to the trustpoint).

PKCS#12 files for RADIUS users may not be imported with this command. (There is

no value in doing so, as the files are not needed on the local system.)

The specified trustpoint must already exist. The key and certificate must not

already exist.

Example To import the PKCS#12 file “example.pk12” for the trustpoint “example” to the URL

“tftp://backup/”, use the following commands:

awplus> enable

awplus# crypto pki import example pkcs12 ca

tftp://backup/example.pk12

Commands

crypto pki export pkcs12

crypto pki import pem

Parameter Description

<trustpoint> The name of the trustpoint for which the certificate and key are to

be imported.

ca If this option is specified, the command imports the root CA

certificate and corresponding key.

server If this option is specified, the command imports the server

certificate and corresponding key.

<url> The source URL for the PKCS#12 file. The format of the URLis the

same as any valid destination for a file copy command.

C613-50292-01 Rev A Command Reference for IE210L Series 1374

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

CRYPTO PKI TRUSTPOINT

crypto pki trustpoint

Overview Use this command to declare the named trustpoint and enter trustpoint

configuration mode.

Use the no variant of this command to destroy the trustpoint.

Syntax crypto pki trustpoint <trustpoint>

no crypto pki trustpoint <trustpoint>

Mode Global Configuration

Usage If the trustpoint did not previously exist, it is created as a new trustpoint. The

trustpoint will be empty (unauthenticated) unless the name “local” is selected, in

which case the system will automatically authenticate the trustpoint as a local

self-signed certificate authority.

The no variant of this command destroys the trustpoint by removing all CA and

server certificates associated with the trustpoint, as well as the private key

associated with the root certificate (if the root certificate was locally self-signed).

This is a destructive and irreversible operation, so this command should be used

with caution.

Example To configure a trustpoint named “example”, use the following commands:

awplus> enable

awplus# configure terminal

awplus(config)# crypto pki trustpoint example

Commands

show crypto pki certificates

show crypto pki trustpoint

Command

changes

Version 5.4.6-1.1: command added to x930 Series

Version 5.4.8-1: command added to x220, XS900MX, x550 Series

Version 5.4.8-2.1: command added to SBx908 GEN2, x950 Series

Parameter Description

<trustpoint> The name of the trustpoint. The name must start with an

alphanumeric character, and may only contain alphanumeric

characters, underscores, dashes, or periods. The maximum length

of the name is 63 characters.

C613-50292-01 Rev A Command Reference for IE210L Series 1375

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

ENROLLMENT (TRUSTPOINT CONFIGURATION MODE)

enrollment (trustpoint configuration mode)

Overview Use this command to declare how certificates will be added to the system for the

current trustpoint.

Syntax enrollment {selfsigned|terminal}

Mode Trustpoint Configuration

Usage If the enrollment is set to selfsigned, then the system will generate a root CA

certificate and its associated key when the crypto pki authenticate command is

issued. It will generate a server certificate (signed by the root CA certificate) when

the crypto pki enroll command is issued.

If the enrollment is set to terminal, then the system will prompt the user to paste

the root CA certificate Privacy Enhanced Mail (PEM) file at the terminal, when the

crypto pki authenticate command is issued. It will create a Certificate Signing

Request (CSR) file for the local server when the crypto pki enroll command is

issued. The server certificate received from the external CA should be imported

using the crypto pki import pem command.

The trustpoint named “local” may only use the selfsigned enrollment setting.

If no enrollment mode is specified, the crypto pki authenticate command will fail

for the trustpoint.

Example To configure the trustpoint named "example" and set its enrollment to selfsigned,

use the following commands:

awplus> enable

awplus# configure terminal

awplus(config)# crypto pki trustpoint example

awplus(ca-trustpoint)# enrollment selfsigned

Commands

crypto pki enroll

Parameter Description

selfsigned Sets the enrollment mode for the current trustpoint to selfsigned.

terminal Sets the enrollment mode for the current trustpoint to terminal.

C613-50292-01 Rev A Command Reference for IE210L Series 1376

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

FINGERPRINT (TRUSTPOINT CONFIGURATION MODE)

fingerprint (trustpoint configuration mode)

Overview Use this command to declare that certificates with the specified fingerprint should

be automatically accepted, when importing certificates from an external certificate

authority. This can affect the behavior of the crypto pki authenticate and crypto

pki import pem commands.

Use the no variant of this command to remove the specified fingerprint from the

pre-accepted list.

Syntax fingerprint <word>

no fingerprint <word>

Default By default, no fingerprints are pre-accepted for the trustpoint.

Mode Trustpoint Configuration

Usage Specifying a fingerprint adds it to a list of pre-accepted fingerprints for the

trustpoint. When a certificate is imported, if it matches any of the pre-accepted

values, then it will be saved in the system automatically. If the imported

certificate’s fingerprint does not match any pre-accepted value, then the user will

be prompted to verify the certificate contents and fingerprint visually.

This command is useful when certificates from an external certificate authority are

being transmitted over an insecure channel. If the certificate fingerprint is

delivered via a separate messaging channel, then pre-entering the fingerprint

value via cut-and-paste may be less errorprone than attempting to verify the

fingerprint value visually.

The fingerprint is a series of 40 hexadecimal characters. It may be entered as a

continuous string, or as a series of up to multiple strings separated by spaces. The

input format is flexible because different certificate authorities may provide the

fingerprint string in different formats.

Example To configure a fingerprint “5A81D34C 759CC4DA CFCA9F65 0303AD83 410B03AF”

for the trustpoint named “example”, use the following commands:

awplus> enable

awplus# configure terminal

awplus(config)# crypto pki trustpoint example

awplus(ca-trustpoint)# fingerprint 5A81D34C 759CC4DA CFCA9F65

0303AD83 410B03AF

Commands

crypto pki authenticate

Parameter Description

<word> The fingerprint as a series of 40 hexadecimal characters,

optionally separated into multiple character strings.

C613-50292-01 Rev A Command Reference for IE210L Series 1377

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

FINGERPRINT (TRUSTPOINT CONFIGURATION MODE)

crypto pki import pem

C613-50292-01 Rev A Command Reference for IE210L Series 1378

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

NO CRYPTO PKI CERTIFICATE

no crypto pki certificate

Overview Use this command to delete a certificate with the specified fingerprint from the

specified trustpoint.

Syntax no crypto pki certificate <trustpoint> <word>

Default By default, no fingerprints are pre-accepted for the trustpoint.

Mode Privileged Exec

Usage The fingerprint can be found in the output of the show crypto pki certificates

command. If there are dependent certificates in the trustpoint (i.e., if other

certificates were signed by the specified certificate), the command will be rejected.

If the specified certificate is the root CA certificate and the trustpoint represents a

locally selfsigned CA, then the corresponding private key is also deleted from the

system. Deleting the root CA certificate effectively resets the trustpoint to an

unauthenticated state.

Example To delete a certificate with the fingerprint "594EDEF9 C7C4308C 36D408E0

77E784F0 A59E8792" from the trustpoint “example”, use the following commands:

awplus> enable

awplus# no crypto pki certificate example 

594EDEF9 C7C4308C 36D408E0 77E784F0 A59E8792

Commands

no crypto pki trustpoint

show crypto pki certificates

Parameter Description

<trustpoint> The name of the trustpoint.

<word> The fingerprint as a series of 40 hexadecimal characters,

optionally separated into multiple character strings.

C613-50292-01 Rev A Command Reference for IE210L Series 1379

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

RSAKEYPAIR (TRUSTPOINT CONFIGURATION MODE)

rsakeypair (trustpoint configuration mode)

Overview Use this command to declare which RSA key pair should be used to enroll the local

server with the trustpoint. Note that this defines the key pair used with the server

certificate, not the key pair used with the root CA certificate.

Use the no variant of this command to restore the default value, “server-default”.

Syntax rsakeypair <keylabel> [<1024-4096>]

no rsakeypair

Default The default value for keylabel is “server-default”.

The default value for the key bit length is 2048.

Mode Trustpoint Configuration

Usage If the label specified does not refer to an existing key created by the crypto key

generate rsa command, the key will be implicitly generated when the crypto pki

enroll command is issued to generate the server certificate or the server certificate

signing request. The optional numeric parameter defines the bit length for the key,

and is only applicable for keys that are implicitly created during enrollment.

This command does not affect server certificates or server certificate signing

requests that have already been generated. The trustpoint’s server certificate is set

to use whatever key pair was specified for the trustpoint at the time the crypto pki

enroll command is issued.

The default key pair is “server-default”. The default bit length is 2048 bits.

Example To configure trustpoint "example" to use the key pair "example-server-key" with a

bit length of 2048, use the following commands:

awplus> enable

awplus# configure terminal

awplus(config)# crypto pki trustpoint example

awplus(ca-trustpoint)# rsakeypair example-server-key 2048

Commands

crypto key generate rsa

Parameter Description

<keylabel> The key to be used with the server certificate for this trustpoint.

The name must start with an alphanumeric character, and may

only contain alphanumeric characters, underscores, dashes, or

periods. The maximum length of the name is 63 characters.

<1024-4096>The bit length for the key, to be used if the key is implicitly

generated during server enrollment.

C613-50292-01 Rev A Command Reference for IE210L Series 1380

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

SHOW CRYPTO KEY MYPUBKEY RSA

show crypto key mypubkey rsa

Overview Use this command to display information about the specified

Rivest-Shamir-Adleman encryption key.

Syntax show crypto key mypubkey rsa [<keylabel>]

Default By default, all keys will be shown.

Mode Privileged Exec

Usage If no key label is specified, information about all keys is shown. The command

displays the bit length of the key, a key fingerprint (a hash of the key contents to

help uniquely identify a key), and a list of trustpoints in which the server certificate

is using the key.

The specified keys must exist.

Example To show all keys, use the following commands:

awplus> enable

awplus# show crypto key mypubkey rsa

Output Figure 38-1: Example output from show crypto key mypubkey rsa

Commands

crypto key generate rsa

Parameter Description

<keylabel> The name of the key to be shown, if specified.

awplus#show crypto key mypubkey rsa

--------------------

RSA Key Pair "example-server-key":

Key size : 2048 bits

Fingerprint : 1A605D73 C2274CB7 853886B3 1C802FC6 7CDE45FB

Trustpoints : example

--------------------

RSA Key Pair "server-default":

Key size : 2048 bits

Fingerprint : 34AC4D2D 5249A168 29D426A3 434FFC59 C4A19901

Trustpoints : local

C613-50292-01 Rev A Command Reference for IE210L Series 1381

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

SHOW CRYPTO PKI CERTIFICATES

show crypto pki certificates

Overview Use this command to display information about existing certificates for the

specified trustpoint.

Syntax show crypto pki certificates [<trustpoint>]

Default By default, the certificates for all trustpoints are shown.

Mode Privileged Exec

Usage If no trustpoint is specified, certificates for all trustpoints are shown. The command

displays the certificates organized into certificate chains. It starts with the server

certificate and then displays its issuer, and continues up the issuer chain until the

root CA certificate is reached.

For each certificate, the command displays the certificate type, the subject’s

distinguished name (the entity identified by the certificate), the issuer’s

distinguished name (the entity that signed the certificate), the validity dates for the

certificate, and the fingerprint of the certificate. The fingerprint is a cryptographic

hash of the certificate contents that uniquely identifies the certificate.

The specified trustpoints must already exist.

Example To show the certificates for the trustpoint “example”, use the following command:

awplus> enable

awplus# show crypto pki certificates example

Parameter Description

<trustpoint> The trustpoint for which the certificates are to be shown.

C613-50292-01 Rev A Command Reference for IE210L Series 1382

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

SHOW CRYPTO PKI CERTIFICATES

Output Figure 38-2: Example output from show crypto pki certificates

Commands

crypto pki trustpoint

awplus>enable

awplus#show crypto pki certificates example

--------------------

Trustpoint "example" Certificate Chain

--------------------

Server certificate

Subject : /O=local/CN=local.loc.lc

Issuer : /C=NZ/CN=local_Signing_CA

Valid From : Nov 11 15:35:21 2015 GMT

Valid To : Aug 31 15:35:21 2018 GMT

Fingerprint : 5A81D34C 759CC4DA CFCA9F65 0303AD83 410B03AF

Intermediate CA certificate

Subject : /C=NZ/CN=example_Signing_CA

Issuer : /C=NZ/CN=example_Root_CA

Valid From : Sep 3 18:45:01 2015 GMT

Valid To : Oct 10 18:45:01 2020 GMT

Fingerprint : AE2D5850 9867D258 ABBEE95E 2E0E3D81 60714920

Imported root certificate

Subject : /C=NZ/CN=example_Root_CA

Issuer : /C=NZ/CN=example_Root_CA

Valid From : Jul 23 18:12:10 2015 GMT

Valid To : May 12 18:12:10 2025 GMT

Fingerprint : 594EDEF9 C7C4308C 36D408E0 77E784F0 A59E8792

C613-50292-01 Rev A Command Reference for IE210L Series 1383

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

SHOW CRYPTO PKI ENROLLMENT USER

show crypto pki enrollment user

Overview Use this command to display a list of trustpoints for which RADIUS user

enrollments have been performed, using the crypto pki enroll user command.

This indicates that PKCS#12 files for the user are available for export for the given

trustpoints, using the crypto pki export pkcs12 command.

Syntax crypto pki enrollment user <username>

Mode Privileged Exec

Example To show the list of trustpoints to which user “exampleuser1” is enrolled, use the

following commands:

awplus> enable

awplus(config)# show crypto pki enrollment user exampleuser1

Output Figure 38-3: Example output from show crypto pki enrollment user

Commands

crypto pki enroll user

crypto pki export pkcs12

Parameter Description

<username> The user for which enrollments are to be shown.

awplus> enable

awplus# show crypto pki enrollment user exampleuser1

User "exampleuser1" is enrolled to the following trustpoints:

local,example

C613-50292-01 Rev A Command Reference for IE210L Series 1384

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

SHOW CRYPTO PKI TRUSTPOINT

show crypto pki trustpoint

Overview Use this command to display information about the specified trustpoint.

Syntax show crypto pki trustpoint [<trustpoint>]

Default By default, all trustpoints are shown.

Mode Privileged Exec

Usage If no trustpoint is specified, information about all trustpoints is shown. The

command displays the authentication status of the trustpoint, the fingerprint of

the root CA certificate (if it exists), the enrollment status of the local server with the

trustpoint, a list of any applications that are configured to use the trustpoint, and

the trustpoint parameters that were configured from trustpoint-configuration

mode.

The specified trustpoints must already exist.

Example To show the details of the trustpoint “example”, use the following commands:

awplus> enable

awplus# show crypto pki trustpoint example

Output Figure 38-4: Example output from show crypto pki trustpoint

Commands

crypto pki trustpoint

show crypto pki certificates

Parameter Description

<trustpoint> The name of the trustpoint to be shown

awplus> enable

awplus# show crypto pki trustpoint example

--------------------

Trustpoint "example"

Type : Self-signed certificate authority

Root Certificate: 50C1856B EEC7555A 0F3A61F6 690D9463 67DF74D1

Local Server : The server is enrolled to this trustpoint.

Server Key : example-server-key

Applications : RADIUS



Authentication and Enrollment Parameters:

Enrollment : selfsigned

RSA Key Pair : example-server-key (2048 bits)

--------------------

C613-50292-01 Rev A Command Reference for IE210L Series 1385

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

SUBJECT-NAME (TRUSTPOINT CONFIGURATION)

subject-name (trustpoint configuration)

Overview Use this command to specify the distinguished name string that should be used for

the subject field in the server certificate, when enrolling the server (generating the

server certificate or server certificate signing request).

Syntax subject-name <word>

Default If no subject name is specified for the trustpoint, then the system automatically

builds a name of the form “/O=AlliedWare Plus/CN=xxxx.yyyy.zzz”, where “xxxx” is

the hostname of the system and “yyyy.zzz” is the default search domain for the

system.

Mode Trustpoint Configuration

Usage The subject name is specified as a variable number of fields, where each field

begins with a forward-slash character (“/”). Each field is of the form “XX=value”,

where “XX” is the abbreviation of the node type in the tree.

Common values include:

• “C” (country),

• “ST” (state),

•“L” (locality),

• “O” (organization),

• “OU” (organizational unit), and

• “CN” (common name).

Of these fields, “CN” is usually the most important.

NOTE: For a server certificate, many applications require that the network name of the

server matches the common name in the server’s certificate.

Example To configure the trustpoint named "example" and set its subject name, use the

following commands:

awplus> enable

awplus# configure terminal

awplus(config)# crypto pki trustpoint example

awplus(ca-trustpoint)# subject-name "/O=My

Company/CN=192.168.1.1

Parameter Description

<word> Specify the subject name as a distinguished name string.

Complex strings (e.g., strings containing spaces) should be

surrounded with double-quote characters.

C613-50292-01 Rev A Command Reference for IE210L Series 1386

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

PUBLIC KEY INFRASTRUCTURE COMMANDS

SUBJECT-NAME (TRUSTPOINT CONFIGURATION)

Commands

crypto pki enroll

C613-50292-01 Rev A Command Reference for IE210L Series 1387

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

TACACS+

Commands

Introduction

Overview This chapter provides an alphabetical reference for commands used to configure

the device to use TACACS+ servers. For more information about TACACS+, see the

TACACS+ Feature Overview and Configuration Guide.

Command List •“authorization commands” on page 1388

•“aaa authorization commands” on page 1390

•“aaa authorization config-commands” on page 1392

•“ip tacacs source-interface” on page 1393

•“show tacacs+” on page 1394

•“tacacs-server host” on page 1396

•“tacacs-server key” on page 1398

•“tacacs-server timeout” on page 1399

C613-50292-01 Rev A Command Reference for IE210L Series 1388

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

TACACS+ COMMANDS

AUTHORIZATION COMMANDS

authorization commands

Overview This command applies a command authorization method list, defined using the

aaa authorization commands command, to console and VTY lines.

Use the no variant of this command to reset the command authorization

configuration on the console and VTY lines.

Syntax authorization commands <privilege-level> {default|<list-name>}

no authorization commands <privilege-level>

Default The default method list is applied to each console and VTY line by default.

Mode Line Configuration

Usage If the specified method list does not exist users will not be enable to execute any

commands in the specified method list on the specified VTY lines.

Example To apply the TAC15 command authorization method list with privilege level 15 to

VTY lines 0 to 5, use the following commands:

awplus# configure terminal

awplus(config)# line vty 0 5

awplus(config-line)# authorization commands 15 TAC15

To reset the command authorization configuration with privilege level 15 on VTY

lines 0 to 5, use the following commands:

awplus# configure terminal

awplus(config)# line vty 0 5

awplus(config-line)# no authorization commands 15

Commands

aaa authorization commands

Parameter Description

<privilege-level> The privilege level of the set of commands the method list

will be applied to.

AlliedWare Plus defines three sets of commands, that are

indexed by a level value:

Level = 1: All commands that can be accessed by a user with

privilege level between 1 and 6 inclusive

Level = 7: All commands that can be accessed by a user with

privilege level between 7 and 14 inclusive

Level = 15: All commands that can be accessed by a user

with privilege level 15

default Configure the default authorization commands method list.

<list-name>Configure a named authorization commands method list

C613-50292-01 Rev A Command Reference for IE210L Series 1389

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

TACACS+ COMMANDS

AUTHORIZATION COMMANDS

aaa authorization config-commands

tacacs-server host

Command

changes

Version 5.4.6-2.1: command added

C613-50292-01 Rev A Command Reference for IE210L Series 1390

AlliedWare Plus™ Operating System - Version 5.4.9-0.x

TACACS+ COMMANDS

AAA AUTHORIZATION COMMANDS

aaa authorization commands

Overview This command configures a method list for commands authorization that can be

applied to console or VTY lines. When command authorization is enabled for a

privilege level, only authorized users can executed commands in that privilege

level.

Use the no variant of this command to remove a named method list or disable the

default method list for a privilege level.

Syntax aaa authorization commands <privilege-level>

{default|<list-name>} group tacac+ [none]

no aaa authorization commands <privilege-level>

{default|<list-name>}

Mode Global Configuration

Usage TACACS+ command authorization provides centralized control of the commands

available to a user of an AlliedWare Plus device. Once enabled:

• The command string and username are encrypted and sent to the first

available configured TACACS+ server (the first server configured) for

authorization.

Parameter Description

<privilege-level> The privilege level of the set of commands the method list

will be applied to.

AlliedWare Plus defines three sets of commands, that are

indexed by a level value:

Level = 1: All commands that can be accessed by a user

with privilege level between 1 and 6 inclusive

Level = 7: All commands that can be accessed by a user

with privilege level between 7 and 14 inclusive

Level = 15: All commands that can be accessed by a user

with privilege level 15

group Specify the server group where authorization messages are

sent. Only the tacacs+ group is available for this

command.

tacac+ Use all TACACS+ servers configured by the tacacs-server

host command.

default Configure the default authorization commands method list.

<list-name>Configure a named authorization commands method list

none If specified, this provides a local fallback to command

authorization so that if authorization servers become

unavailable then the device will accept all commands

normally allowed for the privilege level of the user.

C613-50292-01 Rev A Command Reference for IE210L Series 1391