D-Link DXS-3600-32S 24-port Top Of Rack 10 Gigabit Managed User Manual

CLI Reference Guide

Product Model: DXS-3600 Series

Layer 2/3 Managed 10GbE Switch

Release: 1.10

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

DXS-3600 Series CLI Reference Guide

Software Release F/W: 1.10.023

Without our written permission this document may not be excerpted, reproduced, transmitted, or otherwise in all or part

by any party by any means.

Preface

Version Description

This manual’s command descriptions are based on the software release 1.10.023. The commands listed here are the

subset of commands that are supported by the DXS-3600 Series switch.

Audience

This reference manual is intended for network administrators and other IT networking professionals responsible for

managing the switch by using the Command Line Interface (CLI). The CLI is the primary management interface to the

DXS-3600 Series switch, which will be generally be referred to simply as the “switch” within this manual. This manual is

written in a way that assumes that you already have the experience and knowledge of Ethernet and modern networking

principles for Local Area Networks.

Document Layout

Other Documentation

The documents below are a further source of information in regards to configuring and troubleshooting the switch . All

the documents are available either from the CD, bundled with this switch, or from the D-Link website. Other documents

related to this switch are:

• DXS-3600 Series Hardware Installation Guide

• DXS-3600 Series Web UI Reference Guide

Conventions

Preface Describes how to use the CLI reference manual.

Table of Contents Lists out the chapters discussed throughout this manual.

Chapters Each chapter contains a specific grouping of CLI commands that are related to the

topic labelled.

Appendices Contains extra information related to this switch.

Convention Description

Boldface Font Commands, command options and keywords are printed in boldface. Keywords, in

the command line, are to be entered exactly as they are displayed.

UPPERCASE ITALICS Font Parameters or values that must be specified are printed in UPPERCASE ITALICS.

Parameters in the command line, are to be replaced with the actual values that are

desired to be used with the command.

[ ] Square brackets enclose an optional value or set of optional arguments.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

iii

Notes, Notices, and Cautions

Below are examples of the 3 types of indicators used in this manual. When administering your switch using the

information in this document, you should pay special attention to these indicators. Each example below provides an

explanatory remark regarding each type of indicator.

Command Descriptions

The information pertaining to each command in this reference guide is presented using a number of template fields.

The fields are:

• Description - This is a short and concise statement describing the commands functionality.

• Syntax - The precise form to use when entering and issuing the command. The form conventions are described in

the table shown under the section “Conventions” on page iv of this guide.

• Syntax Description - A table where each row describes the optional or required arguments, and their use, that

can be issued with the command.

• Default - If the command sets a configuration value or administrative state of the switch then any default settings

(i.e. without issuing the command) of the configuration is shown here.

• Command Mode - The mode in which the command can be issued. The modes are either User EXEC, Privileged

EXEC, Global Configuration or a specific configuration mode. These modes are described in the section titled

“Command Modes” on page v below.

• Command Usage - If necessary, a detailed description of the command and its various utilization scenarios is

given here.

• Example(s) - Each command is accompanied by a practical example of the command being issued in a suitable

scenario.

Command Modes

There are several command modes available in the command-line interface (CLI). The set of commands available to

the user depends on both the mode the user is currently in and their privilege level. For each case, the user can see all

the commands that are available in a particular command mode by entering a question mark (?) at the system prompt.

The command-line interface has five privilege levels:

• Basic User - Privilege Level 1. This user account level has the lowest priority of the user accounts. The purpose of

this type of user account level is for basic system checking.

• Advanced User - Privilege Level 3. This user account level is allowed to configure the terminal control setting.

This user account can only show limited information that is not related to security.

• Power User - Privilege 8. This user account level can execute fewer commands than operator, including configura-

tion commands other than the operator level and administrator level commands.

{a | b | c} Braces enclose alternative keywords seperated by vertical bars. Generally, one of

the keywords in the seperated list can be chosen.

[a | d | c] Optional values or arguements are enclosed in square barackets and seperated by

vertical bars. Generally, one or more of the vales or arguements in the seperated list

can be chosen.

Blue Courier Font

This convention is used to represent an example of a screen console display

including example entries of CLI command input with the corresponding output. All

examples used in this manual is based on the DXS-3600-32S switch in the DXS-

3600 Series.

NOTE: A note indicates important information that helps you make better use of your device

NOTICE: A notice indicates either potential damage to hardware or loss of data and tells you how to

avoid the problem

CAUTION: A caution indicates a potential for property damage, personal injury, or death.

Convention Description

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

• Operator - Privilege Level 12. This user account level is used to grant system configuration rights for users who

need to change or monitor system configuration, except for security related information such as user accounts and

SNMP account settings, etc.

• Administrator - Privilege Level 15. This administrator user account level can monitor all system information and

change any of the system configuration settings expressed in this configuration guide.

The command-line interface has a number of command modes. There are three basic command modes:

• User EXEC mode

• Privileged EXEC mode

• Global Configuration mode

All other sub-configuration modes can be accessed via global configuration mode.

When a user logs in to the Switch, the privilege level of the user determines the command mode the user will enter

after initially logging in. The user will either log into user EXEC mode or privileged EXEC mode. Users with a basic user

level will log into the Switch in user EXEC mode. Users with advanced user, power user, operator or administrator level

accounts will log into the Switch in privileged EXEC mode. Therefore, user EXEC mode can operate at basic user level

and privileged EXEC mode can operate at advanced user, power user, operator or administrator level. The user can

only enter global configuration mode from privileged EXEC mode. Therefore, global configuration mode can be

accessed by users who have advanced user, power user, operator or administrator level user accounts. As for sub-

configuration modes, a subset of those can only be accessed by users who have the highest secure administrator level

privileges.

The following table briefly lists the available command modes. Only the basic command modes and some of the sub-

configuration modes are enumerated. The basic command modes and basic sub-configuration modes are further

described in the following chapters. Descriptions for the rest of the sub-configuration modes are not provided in this

section. For more information on the additional sub-configuration modes, the user should refer to the chapters relating

to these functions.

The available command modes and privilege levels are described below:

Command Mode /

Privilege Level

Purpose

User EXEC Mode /

Basic User level

This level has the lowest priority of the user accounts. It is provided only to check

basic system settings.

Privileged EXEC Mode /

Advanced User level

This level is allowed to configure the terminal control setting. This user account can

only show limited information that is not related to security.

Privileged EXEC Mode /

Power User level

This level can execute less commands than operator, include the configure

commands other than the operator level and administrator level commands.

Privileged EXEC Mode /

Operator level

For changing both local and global terminal settings, monitoring, and performing

certain system administration tasks. The system administration tasks that can be

performed at this level includes the clearing of system configuration settings, except

for any security related information, such as user accounts, SNMP account settings

etc.

Privileged EXEC Mode /

Administrator level

This level is identical to privileged EXEC mode at power user level, except that a

user at the administrator level can monitor and clear security related settings.

Global Configuration Mode /

Power User level

For applying global settings, including the configuration commands other than the

operator level and administrator level commands.

Global Configuration Mode /

Operator level

For applying global settings, except for security related settings, on the entire Switch.

In addition to applying global settings on the entire Switch, the user can access other

sub-configuration modes from global configuration mode.

Global Configuration Mode /

Administrator level

For applying global settings on the entire Switch. In addition to applying global

settings on the entire Switch, the user can access other sub-configuration modes

from global configuration mode.

Interface Configuration Mode /

Administrator level

For applying interface related settings.

VLAN Interface Configuration

Mode

For applying VLAN interface related settings.

VLAN Configuration Mode For applying settings to a VLAN.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

User EXEC Mode at Basic User Level

This command mode is mainly designed for checking basic system settings. This command mode can be entered by

logging in as a basic user.

Privileged EXEC Mode at Advanced User Level

This command mode is mainly designed for checking basic system settings, allowing users to change the local

terminal session settings and carrying out basic network connectivity verification. One limitation of this command mode

is that it cannot be used to display information related to security. This command mode can be entered by logging in as

an advanced user.

Privileged EXEC Mode at Power User Level

User logged into the switch in privileged EXEC mode at this level can execute fewer commands than operator,

including the configuration commands other than the operator level and administrator level commands. The method to

enter privileged EXEC mode at power user level is to login to the switch with a user account that has a privileged level

of 8.

Privileged EXEC Mode at Operator Level

Users logged into the Switch in privileged EXEC mode at this level can change both local and global terminal settings,

monitor, and perform system administration tasks like clearing configuration settings (except for security related

information such as user accounts, SNMP account settings etc.) The method to enter privileged EXEC mode at

operator level is to login to the Switch with a user account that has a privilege level of 12.

Privileged EXEC Mode at Administrator Level

This command mode has a privilege level of 15. Users logged in with this command mode can monitor all system

information and change any system configuration settings mentioned in this Configuration Guide. The method to enter

privileged EXEC mode at administrator level is to login to the Switch with a user account that has a privilege level of 15.

Global Configuration Mode

The primary purpose of global configuration mode is to apply global settings on the entire Switch. Global configuration

mode can be accessed at advanced user, power user, operator or administrator level user accounts. However, security

related settings are not accessible at advanced user, power user or operator user accounts. In addition to applying

global settings on the entire Switch, the user can also access other sub-configuration modes. In order to access the

global configuration mode, the user must be logged in with the corresponding account level and use the configure

terminal command in privileged EXEC mode.

In the following example, the user is logged in as an Administrator in privileged EXEC mode and uses the configure

terminal command to access global configuration mode:

The exit command is used to exit global configuration mode and return to privileged EXEC mode.

The procedures to enter the different sub-configuration modes can be found in the related chapters in this

Configuration Guide. The command modes are used to configure the individual functions.

IP Access-List Configuration

Mode

For specifying filtering criteria for an IP access list.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#

DXS-3600-32S(config)#exit

DXS-3600-32S#

Command Mode /

Privilege Level

Purpose

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Interface Configuration Mode

Interface configuration mode is used to configure the parameters for an interface or a range of interfaces. An interface

can be a physical port, VLAN, or other virtual interface. Thus, interface configuration mode is distinguished further

according to the type of interface. The command prompt for each type of interface is slightly different.

VLAN Interface Configuration Mode

VLAN interface configuration mode is one of the available interface modes and is used to configure the parameters of

a VLAN interface.

To access VLAN interface configuration mode, use the following command in global configuration mode:

DXS-3600-32S(config)#interface vlan 1

DXS-3600-32S(config-if)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Table of Contents

Basic CLI Commands................................................................................................................................................1

802.1X Commands....................................................................................................................................................6

Access Control List (ACL) Commands....................................................................................................................17

Address Resolution Protocol (ARP) Commands.....................................................................................................40

Alternate Store and Forward (ASF) Commands......................................................................................................46

Authentication, Authorization, and Accounting (AAA) Commands..........................................................................48

Border Gateway Protocol (BGP) Commands..........................................................................................................65

Compound Authentication Commands..................................................................................................................172

Configuration Commands......................................................................................................................................175

Counter Commands ..............................................................................................................................................187

CPU Commands....................................................................................................................................................190

Debug Commands.................................................................................................................................................191

DHCP Relay Commands.......................................................................................................................................199

DHCP Server Commands .....................................................................................................................................205

Distance Vector Multicast Routing Protocol (DVMRP) Commands.......................................................................220

D-Link License Management System Commands ................................................................................................225

Domain Name System (DNS) Commands............................................................................................................227

DoS Attack Prevention Commands.......................................................................................................................230

Enhanced Transmission Selection (ETS) Commands ..........................................................................................233

File System Commands ........................................................................................................................................237

Filter Database (FDB) Commands........................................................................................................................243

GARP VLAN Registration Protocol (GVRP) Commands.......................................................................................251

Internet Group Management Protocol (IGMP) Commands ...................................................................................257

IGMP Snooping Commands..................................................................................................................................266

Interface Commands.............................................................................................................................................281

IP Access List Commands.....................................................................................................................................284

IP Address Commands..........................................................................................................................................287

IP Prefix List Commands.......................................................................................................................................290

IP Multicast (IPMC) Commands............................................................................................................................294

LINE Commands...................................................................................................................................................301

Link Aggregation Commands................................................................................................................................303

Link Layer Discovery Protocol (LLDP) Commands...............................................................................................309

LLDP-DCBX Commands.......................................................................................................................................327

LLDP-MED Commands.........................................................................................................................................332

Memory Commands..............................................................................................................................................337

Mirror Commands..................................................................................................................................................338

Multicast Filter Mode Commands..........................................................................................................................342

Multiprotocol Label Switching (MPLS) Commands ...............................................................................................344

Network Connectivity Test Commands .................................................................................................................377

Open Shortest Path First (OSPF) Version 2 Commands ......................................................................................379

Password Recovery Commands.....................................................................................................

......................417

Peripheral Commands...........................................................................................................................................419

Port Commands.....................................................................................................................................................421

Port Security Commands.......................................................................................................................................428

Priority-based Flow Control (PFC) Commands.....................................................................................................436

Protocol Independent Commands.........................................................................................................................439

Protocol Independent Multicast (PIM) Commands................................................................................................449

Quality of Service (QoS) Commands ....................................................................................................................467

Quantized Congestion Notification (QCN) Commands .........................................................................................487

RADIUS Commands..............................................................................................................................................497

Remote Network MONitoring (RMON) Commands...............................................................................................502

Routing Information Protocol (RIP) Commands....................................................................................................508

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Route Map Commands..........................................................................................................................................523

Secure Shell (SSH) Commands............................................................................................................................536

Simple Network Management Protocol (SNMP) Commands................................................................................539

Simple Network Time Protocol (SNTP) and Clock Commands.............................................................................551

Spanning Tree Protocol (STP) Commands...........................................................................................................557

Storm Control Commands.....................................................................................................................................574

Switch Management Commands...........................................................................................................................578

Syslog Commands ................................................................................................................................................584

TACACS+ Commands ..........................................................................................................................................591

TELNET Commands .............................................................................................................................................595

Time Range Commands........................................................................................................................................597

Traffic Segmentation Commands..........................................................................................................................599

Upgrade and Maintenance Commands.................................................................................................................601

Virtual LAN (VLAN) Commands............................................................................................................................603

Virtual Private LAN Service (VPLS) Commands...................................................................................................616

Virtual Private Wire Service (VPWS) Commands .................................................................................................628

Virtual Router Redundancy Protocol (VRRP) Commands ....................................................................................632

VLAN Mapping Commands...................................................................................................................................642

VLAN Tunnel Commands......................................................................................................................................646

VRF-Lite Commands.............................................................................................................................................653

Weighted Random Early Detection (WRED) Commands......................................................................................659

Appendix A - Password Recovery Procedure .......................................................................................................664

Appendix B - System Log Entries..........................................................................................................................665

Appendix C - Trap Entries.....................................................................................................................................685

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Basic CLI Commands

1-1 help

This command is used to display a brief description of the help system. Use the help command in any command mode.

help

Parameters

None.

Default

None.

Command Mode

Exec Mode

Privileged Mode

All Configuration Modes

Command Default Level

Level: 1

Usage Guideline

This command provides a brief description of the context-sensitive help system,

which functions as follow:

• To list all commands available for a particular command mode, enter a question

mark “?” at the system prompt.

• To obtain a list of commands that begin with a particular character string, enter

the abbreviated command entry immediately followed by a question mark “?”. Do

not leave a space between the keyword and question mark. This form of help is

called word help, because it lists only the keywords or arguments that begin with

the abbreviation you entered.

• To list the keywords and arguments associated with a command, enter a

question mark “?” in place of a keyword or argument on the command line.

Leave a space between the keyword and question mark. This form of help is

called command syntax help, because it lists the keywords or arguments that

apply based on the command, keywords, and arguments you have already

entered.

Note: To complete a partial command name, enter the abbreviated command name

followed by a <Tab> key. Example: ‘show addr <Tab>’. To enter the character “?” in

the command argument, press Ctrl+V immediately followed by the character “?”.

Example

This example shows how to display a brief description of the help system. The field

descriptions are self-explanatory.

DXS-3600-32S>help

Help may be requested at any point in a command by entering

a question mark '?'. If nothing matches, the help list will

be empty and you must backup until entering a '?' shows the

available options.

Two styles of help are provided:

1. Full help is available when you are ready to enter a

command argument (e.g. 'ip ?') and describes each possible

argument.

2. Partial help is provided when an abbreviated argument is entered

and you want to know what arguments match the input

(e.g. 'ip a?'.)

Note:

1. For completing a partial command name could enter the abbreviated

command name immediately followed by a <Tab> key.

2. If wants to enter the character '?' in the command argument,

please press ctrl+v immediately followed by the character '?'.

DXS-3600-32S>

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

1-2 prompt

This command is used to customize the CLI prompt. Execute the prompt command in global configuration mode. To

revert to the default prompt, execute the no form of this command.

prompt string

no prompt

Parameters

1-3 banner login

This command is used to configure and customized the banner that will be displayed before the username and

password login prompts. Use the banner login command in global configuration mode. To disable the customized login

banner, use no form of this command.

banner login c message c

no banner login

Example

This example shows how to use the word ‘help’ to display all the privileged mode

commands that begin with the letters “re”. The letters entered, before the question

mark, are reprinted on the next command line to allow the user to continue entering

the command.

DXS-3600-32S#re?

reboot rename

DXS-3600-32S#re

Example

This example shows how to use the command syntax, ‘help’, to display the next

argument of a partially completed ip access-list standard command. The

characters entered, before the question mark, is reprinted on the next command line

to allow the user to continue entering the command.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#ip access-list standard ?

WORD Access-list name(the first character must be a letter)

<1-1999> Standard IP access-list number

DXS-3600-32S(config)#ip access-list standard

string Enter the character string that will be displayed on screen as the CLI prompt here.

Default

The default prompt value is ‘DXS-3600-32S’.

Command Mode

Global Configuration Mode

Command Default Level

Level: 3

Usage Guideline

The default prompt string is the system’s name. To restore the prompt to the default

value, use the ‘no prompt’ command in global configuration mode.

Example

This example shows how to configure a customized prompt string, used in the CLI.

IN this example we’ll change the prompt to the word ‘Router’.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#prompt Router

Router(config)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Parameters

c Specifies the separator of the login banner message, for example a hash sign (#).

The delimiting character is not allowed in the login banner message.

message Enter the contents of the login banner, that will be displayed before the username

and password login prompts, here.

Default

Displays the switch type and other contents defined by the system.

Command Mode

Global Configuration Mode

Command Default Level

Level: 3

Usage Guideline

Follow the banner login command with one or more blank spaces and a delimiting

character of your choice. Enter one or more lines of text, terminating the message

with the second occurrence of the delimiting character. For example with a hash sign

(#) being the delimiting character, after inputting the delimiting character, press the

enter key, then the login banner contents can be typed. The delimiting character

need to be inputted then press enter to complete the type.

To reset the login banner contents to default, use the ‘no banner login’ command in

global configuration mode.

Note: The typed additional characters after the end delimiting character are invalid.

These characters will be discarded by the system. The delimiting character can not

be used in the text of login banner.

Example

This example shows how to configure the login banner. The hash sign (#) is used as

the delimiting character. The starting delimiting character, banner contents and

ending delimiting character will be entered before pressing the first enter key.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#banner login #Enter Command Line Interface#

DXS-3600-32S(config)#end

DXS-3600-32S#logout

Enter Command Line Interface

User Access Verification

Username:

Example

This example shows how to configure the login banner. The hash sign (#) is used as

the delimiting character.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#banner login #

LINE c banner-text c, where 'c' is a delimiting character

Enter Command Line Interface

DXS-3600-32S(config)#end

DXS-3600-32S#logout

Enter Command Line Interface

User Access Verification

Username:

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

1-4 exit

This command is used to exit any configuration mode to the next highest mode in the CLI mode hierarchy. Use the exit

command in any configuration mode. If the current mode is the highest mode (Exec Mode, Privileged Mode) in the CLI

mode hierarchy, execute the exit command to close the active terminal session by logging off the switch.

exit

1-5 end

This command is used to end the current configuration mode and return to the highest mode in the CLI mode hierarchy.

Use the end command in any configuration mode.

Parameters

None.

Default

None.

Command Mode

Exec Mode

Privileged Mode

All Configuration Modes

Command Default Level

Level: 1

Usage Guideline

Use the exit command in the highest mode (Exec Mode, Privileged Mode) to exit the

active session (exit from the mode process and log off from the device). If the current

session is console, the account will logout. if there is another session running, it will

be closed.

Use the exit command in any configuration mode to the next highest mode in the CLI

mode hierarchy. For example, use the exit command in global configuration mode to

return to privileged mode.

Example

This example shows how to exit from the Line Configuration Mode to return to the

Global Configuration Mode and exit from the Global Configuration Mode to return to

the privileged mode.

DXS-3600-32S(config-line)#exit

DXS-3600-32S(config)#exit

DXS-3600-32S#

Example

This example shows how to use the exit command, in the privileged mode, to logout

of the current account.

DXS-3600-32S#exit

Switch con0 is now available

Press any key to login...

16 2000-01-22 01:20:37 INFO(6) Logout through Console (Username: admin)

DXS-3600-32S TenGigabit Ethernet Switch

Command Line Interface

Firmware: Build 1.10.023

User Access Verification

Username:

Example

This example shows how to use the exit command, in the privileged mode, in a

Telnet session, to exit this mode and close the active session.

DXS-3600-32S#exit

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

end

Parameters

None.

Default

None.

Command Mode

Exec Mode

Privileged Mode

All Configuration Modes

Command Default Level

Level: 1

Usage Guideline

Execute this command to return back to the highest mode in the CLI mode hierarchy

regardless of what configuration mode or configuration sub-mode currently located.

Note: This global command can be used in any mode, but if the current located

mode is the highest mode in the CLI mode hierarchy (Exec Mode, Privileged Mode),

executing this command will not have any effect. If the current located mode is any

configuration mode, execute this command will return to the privileged mode.

Example

This example shows how to use the end command in the Line Configuration Mode to

return to the privileged mode.

DXS-3600-32S(config-line)#end

DXS-3600-32S#

Example

This example shows how to use the end command in the privileged and EXEC

mode.

DXS-3600-32S#end

DXS-3600-32S#disable

DXS-3600-32S>end

DXS-3600-32S>

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

802.1X Commands

2-1 dot1x default

This command is used to reset the IEEE 802.1X parameters on a specific port to their default settings.

dot1x default

2-2 dot1x port-control

This command is used to manually control the authorization state on a specific port. Use the no form of this command

to reset the authorization state of the specific port to its default state (auto).

dot1x port-control {auto | force-authorized | force-unauthorized}

no dot1x port-control

Parameters

None.

Default

Port control mode - Auto

Port PAE type - None

Port control direction - Both

Quiet period when authentication fails - 60 seconds

Re-authentication interval when authentication succeeds - 3600 seconds

Default timeout value waiting for a response from RADIUS - 30 seconds

Default timeout value waiting for a reply from Supplicant - 30 seconds

Default transmission interval from the Authenticator to the Supplicant - 30 seconds

Default maximum number of authentication request - 2 times

Re-authentication state on the port - Disabled

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

This command is used to reset all the IEEE 802.1X parameters on a specific port to

their default settings.

Example

This example shows how to reset the 802.1X parameters on port 1.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config-if)#dot1x default

DXS-3600-32S(config-if)#

auto Specifies to enable IEEE 802.1X authentication. The state (authorized or

unauthorized) for a specific port is determined according to the outcome of the

authentication.

force-authorized Specifies to force a specific port to change to the authorized state without an

authentication exchange.

force-unauthorized Specifies to deny all access on a specific port by forcing the port to change to the

unauthorized state, ignoring all authentication attempts.

Default

The default authorization state is auto.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

The configuration for this command on a specific port won’t be in operation if you

don’t configure the port as an IEEE 802.1X PAE authenticator by using the ‘dot1x

pae authenticator’ command.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

2-3 dot1x pae authenticator

This command is used to configure a specific port as an IEEE 802.1X port access entity (PAE) authenticator. Use the

no form of this command to disable IEEE 802.1X authentication on the port.

dot1x pae authenticator

no dot1x pae

2-4 dot1x control-direction

This command is used to configure the direction of the traffic on a controlled port as unidirectional (in) or bidirectional

(both). Use the no form of this command to reset the control direction of a port to its default value (both).

dot1x control-direction {both | in}

no dot1x control-direction

Parameters

Example

This example shows how to deny all access to port 1.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config-if)#dot1x port-control force-unauthorized

DXS-3600-32S(config-if)#

Parameters

None.

Default

The 802.1X is disabled on a port by default.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

You must also globally enable IEEE 802.1X authentication on the switch by using the

‘dot1x system-auth-control’ command.

Example

This example shows how to configure port 1 as an IEEE 802.1X PAE authenticator.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config-if)#dot1x pae authenticator

DXS-3600-32S(config-if)#

both Specifies to enable bidirectional control. Both incoming and outgoing traffic through

an IEEE 802.1X-enabled port are prevented if the port is not in the authorized state.

in Specifies to enable unidirectional control. Incoming traffic through an IEEE 802.1X-

enabled port is prohibited if the port is not the authorized state.

Default

The default is in bidirectional mode.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 8

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

2-5 dot1x timeout

This command is used to configure the IEEE 802.1X timers.

dot1x timeout {quiet-period <sec 0-65535> | reauth-period <sec 1-65535> | server-timeout <sec 1-65535> |

supp-timeout <sec 1-65535> | tx-period <sec 1-65535>}

Parameters

Usage Guideline

The configuration for this command on a specific port won’t be in operation if you

don’t configure the port as an IEEE 802.1X PAE authenticator by using the ‘dot1x

pae authenticator’ command.

When the port is in the force-unauthorized state or in the unauthorized state after

authentication, the traffic is controlled based on the setting of this command.

When the port is in the force-authorized state or becomes authorized after

authentication, the traffic will be allowed in both directions.

Example

This example shows how to specify the direction of traffic through Ethernet port 1.

The direction is set as unidirectional.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config-if)#dot1x control-direction in

DXS-3600-32S(config-if)#

quiet-period <sec 0-

65535>

Number of seconds that the switch will be in the quiet state in the wake of a failed

authentication process. The range is 0 to 65535

reauth-period <sec 1-

65535>

Number of seconds between re-authentication attempts. The range is 1 to 65535.

server-timeout <sec 1-

65535>

Number of seconds that the switch will wait for the request from the authentication

server before timing out the server. The range is 1 to 65535.

supp-timeout <sec 1-

65535>

Number of seconds that the switch will wait for the response from the supplicant

before timing out the supplicant. The range is 1 to 65535.

tx-period <sec 1-65535> Number of seconds that the switch will wait for a response to an EAP-Request or

Identity frame from the supplicant before retransmitting the request. The range is 1

to 65535

Default

The default quiet period when authentication fails is 60 seconds (quiet-period).

The default re-authentication interval when authentication succeeds is 3600 seconds

(reauth-period).

The default timeout value waiting for a response from RADIUS is 30 seconds

(server-timeout).

The default timeout value waiting for a reply from Supplicant is 30 seconds (supp-

timeout).

The default transmission interval from the Authenticator to the Supplicant is 30

seconds (tx-period).

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

The ‘dot1x timeout reauth-period’ command is in operation only if you have

enabled re-authentication by using the ‘dot1x re-authentication interface

configuration’ command.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

2-6 dot1x max-req

This command is used to configure the maximum number of times that the backend authentication state machine will

retransmit an Extensible Authentication Protocol (EAP) request frame to the supplicant before restarting the

authentication process. Use the no form of this command to reset the maximum number of times to its default value.

dot1x max-req <int 1-10>

no dot1x max-req

Parameters

2-7 dot1x reauthentication

This command is used to enable periodic reauthentication. Use the no form of this command to return to disable

periodic reuthentication.

dot1x reauthentication

no dot1x reauthentication

Example

This example shows how to configure the quiet period, reauthentication period,

server timeout value, supplicant timeout value, and transmission period for Ethernet

port 1 to be 20, 1000, 15, 15, and 10 seconds, respectively.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config-if)#dot1x timeout quiet-period 20

DXS-3600-32S(config-if)#dot1x timeout reauth-period 1000

DXS-3600-32S(config-if)#dot1x timeout server-timeout 15

DXS-3600-32S(config-if)#dot1x timeout supp-timeout 15

DXS-3600-32S(config-if)#dot1x timeout tx-period 10

DXS-3600-32S(config-if)#

max-req <int 1-10> Number of times that the switch retransmits an EAP frame to the supplicant before

restarting the authentication process. The range is 1 to 10.

Default

The default value is 2 times.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

This command is used to set the maximum number of times that the backend

authentication state machine will retransmit an Extensible Authentication Protocol

(EAP) request frame to the supplicant before restarting the authentication process.

Example

This example shows how to set the maximum number of retries allowed on port 1.

The maximum number of retries is set to 3.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config-if)#dot1x max-req 3

DXS-3600-32S(config-if)#

Parameters

None.

Default

The periodic reauthentication on interface is disabled by default.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 8

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

2-8 dot1x re-authenticate

This command is used to reauthenticate a specific port or a specific MAC address.

dot1x re-authenticate {interface <interface-id> | mac-address <mac-address>}

Parameters

2-9 dot1x initialize

This command is used to initialize the authenticator state machine on a specific port or associated with a specific MAC

address.

dot1x initialize {interface <interface-id> | mac-address H.H.H}

Parameters

Usage Guideline

You can configure the number of seconds between reauthentication attempts by

using the ‘dot1x timeout reauth-period’ command.

Example

This example shows how to enable periodic reauthentication on Ethernet port 1.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config-if)#dot1x reauthentication

DXS-3600-32S(config-if)#

interface <interface-id> (Optional) Specifies a port to reauthenticate. Valid interfaces are physical ports.

mac-address <mac-

address>

(Optional) Specifies a MAC address to re-authenticate. The function can be used

only if the authentication mode is host-based.

Default

This command has no default value.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

Under port-based mode, use the parameter interface <interface-id> to re-

authenticate a specific port. Under host-based mode, use the parameter mac-

address <mac-address> to reauthenticate a specific MAC address.

Example

This example shows how to reauthenticate Ethernet port 1.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#dot1x re-authenticate interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config)#

interface <interface-id> (Optional) Specifies a port on which the authenticator state machine will be

initialized. Valid interfaces are physical ports.

mac-address H.H.H (Optional) Specifies a MAC address with which the authenticator state machine

associates will be initialized. The function can be used only if the authentication

mode is host-based.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 8

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

2-10 dot1x system-auth-control

This command is used to globally enable IEEE 802.1X authentication on the switch. Use the no form of this command

to disable IEEE 802.1X function.

dot1x system-auth-control

no dot1x system-auth-control

2-11 dot1x system-max-user

This command is used to configure the maximum number of users that can be learned via 802.1X authentication. Use

the no form of this command to reset to the defaulting settings.

dot1x system-max-user <int 1-4096>

no dot1x system-max-user

Parameters

Usage Guideline

Under port-based mode, use the parameter interface <interface-id> to initialize a

specific port. Under host-based mode, use the parameter mac-address <mac-

address> to initialize a specific MAC address.

Example

This example shows how to initialize the authenticator state machine on Ethernet

port 1.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#dot1x initialize interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config)#

Parameters

None.

Default

802.1X is disabled globally by default.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

Use this command to enable 802.1X authentication globally.

Example

This example shows how to enable IEEE 802.1X authentication on the switch.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#dot1x system-auth-control

DXS-3600-32S(config)#

<int 1-4096> Specifies the maximum number of users.

Default

By default, the maximum number of users that can be learned via 802.1X

authentication is 4096.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

The setting is a global limitation on the maximum number of users that can be

learned via 802.1X authentication. In addition to the global limitation, the maximum

number of users per port is also limited.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

2-12 dot1x port-max-user

This command is used to configure the maximum number of users that can be learned via 802.1X authentication on a

specific port. Use the no form of this command to reset to the defaulting settings.

dot1x port-max-user <int 1-4096>

no dot1x port-max-user

Parameters

2-13 dot1x system-fwd-pdu

This command is used to globally control the forwarding of EAPOL PDUs. Use the no form of this command to reset to

the defaulting settings.

dot1x system-fwd-pdu

no dot1x system-fwd-pdu

Example

This example shows how to configure the maximum number of users, that is allowed

to be learned via the 802.1X authentication. The maximum number of users allowed

is 128.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#dot1x system-max-user 128

DXS-3600-32S(config)#

<int 1-4096> Specifies the maximum number of users on a port.

Default

By default, the maximum number of users that can be learned via 802.1X

authentication on a port is 16.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

The setting is an interface limitation on the maximum number of users that can be

learned via 802.1X authentication. In addition to the interface limitation, the global

maximum number of users is also limited.

Example

This example shows how to configure the maximum numbers of users allowed on

port 1. The maximum number of users allowed is 32.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config-if)#dot1x port-max-user 32

DXS-3600-32S(config-if)#

Parameters

None.

Default

802.1X can not forward EAPOL PDUs by default.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

When 802.1X functionality is disabled globally or for a port, and if 802.1X is set to

forward EAPOL PDUs both globally and for the port, a received EAPOL packet on

the port will be flooded in the same VLAN to those ports which have 802.1X

forwarding EAPOL PDUs enabled and 802.1X is disabled (globally or just for the

port). 802.1X can not forward EAPOL PDUs by default.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

2-14 dot1x port-fwd-pdu

This command used to control the forwarding of EAPOL PDUs on specific ports. Use the no form of this command to

reset to the defaulting settings.

dot1x port-fwd-pdu

no dot1x port-fwd-pdu

2-15 show dot1x

This command is used to display the IEEE 802.1X global configuration, interface configuration, authentication state,

statistics, diagnostics, and session statistics.

show dot1x [[interface INTERFACE-ID] {auth-configuration | auth-state | statistics | diagnostics | session-

statistics}]

Parameters

Example

This example shows how to enable the forwarding of EAPOL PDUs, globally, on the

switch.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#dot1x system-fwd-pdu

DXS-3600-32S(config)#

Parameters

None.

Default

802.1X can not forward EAPOL PDUs on all ports by default.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

This is a per-port setting to control the forwarding of EAPOL PDUs. When 802.1X

functionality is disabled globally or for a port, and if 802.1X is set to forward EAPOL

PDUs both globally and for the port, a received EAPOL packet on the port will be

flooded in the same VLAN to those ports which have 802.1X forwarding EAPOL

PDUs and 802.1X is disabled (globally or just for the port). 802.1X can not forward

EAPOL PDUs on all ports by default.

Example

This example shows how to enable the forwarding of EAPOL PDUs on port 1.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#dot1x system-fwd-pdu

DXS-3600-32S(config)#end

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1

DXS-3600-32S(config-if)#no dot1x pae

DXS-3600-32S(config-if)#dot1x port-fwd-pdu

DXS-3600-32S(config-if)#

interface INTERFACE-ID (Optional) Specifies a port to display authentication state, configuration, statistics,

diagnostics, or session statistics.

auth-configuration Displays the IEEE 802.1X interface configuration.

auth-state Displays the IEEE 802.1X authentication state.

statistics Displays the IEEE 802.1X information about the authenticator statistics

diagnostics Displays the IEEE 802.1X information about the authenticator diagnostics.

session-statistics Displays the IEEE 802.1X information about the authenticator session statistics.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Default

None.

Command Mode

Privileged EXEC Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command display the IEEE 802.1X global configuration, interface

configuration, authentication state, statistics, diagnostics, and session statistics.

When no interface is specified, information about all interfaces will be displayed.

Example

This example shows how to display the 802.1X global configuration.

DXS-3600-32S#show dot1x

802.1X : Disabled

Forward EAPOL PDU : Disabled

Max User : 4096

DXS-3600-32S#

Example

This example shows how to display the 802.1X configuration for the interface

TenGigabitEthernet1/0/1.

DXS-3600-32S#show dot1x interface tenGigabitEthernet 1/0/1 auth-configuration

Interface : TenGigabitEthernet1/0/1

Capability : None

AdminCrlDir : Both

OperCrlDir : Both

Port Control : Auto

QuietPeriod : 60 sec

TxPeriod : 30 sec

SuppTimeout : 30 sec

ServerTimeout : 30 sec

MaxReq : 2 times

ReAuthPeriod : 3600 sec

ReAuthenticate : Disabled

Forward EAPOL PDU On Port : Disabled

Max User On Port : 16

DXS-3600-32S#

Example

This example shows how to display the 802.1X authentication state.

DXS-3600-32S#show dot1x auth-state

Status: A - Authorized; U - Unauthorized; (P): Port-Based 802.1X;Pri:Priority

Interface MAC Address Auth PAE State Backend State Status VID Pri

VID

------------------------- ----------------- --- -------------- ------------- ------ ---- ---

TenGigabitEthernet1/0/1 00-00-00-00-00-01 10 Authenticated Idle A 4004 3

TenGigabitEthernet1/0/1 00-00-00-00-00-02 10 Authenticated Idle A 1234 -

TenGigabitEthernet1/0/1 00-00-00-00-00-04 30 Authenticating Response U - -

TenGigabitEthernet1/0/2 - (P) - Authenticating Request U - -

TenGigabitEthernet1/0/3 - (P) - Connecting Idle U - -

TenGigabitEthernet1/0/14 - (P) - Held Fail U - -

Total Authenticating Hosts :2

Total Authenticated Hosts :2

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Example

This example shows how to display the 802.1X statistics for the interface

TenGigabitEthernet1/0/1.

DXS-3600-32S#show dot1x interface tenGigabitEthernet 1/0/1 statistics

MAC Address : 00-00-00-00-00-02

Interface : TenGigabitEthernet1/0/1

EAPOLFramesRx 0

EAPOLFramesTx 6

EAPOLStartFramesRx 0

EAPOLReqIdFramesTx 6

EAPOLLogoffFramesRx 0

EAPOLReqFramesTx 0

EAPOLRespIdFramesRx 0

EAPOLRespFramesRx 0

InvalidEAPOLFramesRx 0

EapLengthErrorFramesRx 0

LastEAPOLFrameVersion 0

LastEAPOLFrameSource 00-00-00-00-00-03

DXS-3600-32S#

Example

This example shows how to display the 802.1X diagnostics for the interface

TenGigabitEthernet1/0/1.

DXS-3600-32S#show dot1x interface tenGigabitEthernet 1/0/1 diagnostics

MAC Address : 00-00-00-00-00-02

Interface : TenGigabitEthernet1/0/1

EntersConnecting 20

EapLogoffsWhileConnecting 0

EntersAuthenticating 0

SuccessWhileAuthenticating 0

TimeoutsWhileAuthenticating 0

FailWhileAuthenticating 0

ReauthsWhileAuthenticating 0

EapStartsWhileAuthenticating 0

EapLogoffWhileAuthenticating 0

ReauthsWhileAuthenticated 0

EapStartsWhileAuthenticated 0

EapLogoffWhileAuthenticated 0

BackendResponses 0

BackendAccessChallenges 0

BackendOtherRequestsToSupplicant 0

BackendNonNakResponsesFromSupplicant 0

BackendAuthSuccesses 0

BackendAuthFails 0

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Example

This example shows how to display the 802.1X session statistics for the interface

TenGigabitEthernet1/0/1.

DXS-3600-32S#show dot1x interface tenGigabitEthernet 1/0/1 session-statistics

MAC Address : 00-00-00-00-00-02

Interface : TenGigabitEthernet1/0/1

SessionOctetsRx 0

SessionOctetsTx 0

SessionFramesRx 0

SessionFramesTx 0

SessionId ether1_1-1

SessionAuthenticMethod Remote Authentication Server

SessionTime 3

SessionTerminateCause NotTerminatedYet

SessionUserName user_test

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Access Control List (ACL) Commands

Throughout this chapter, we'll refer to two abbreviates called:

ACL - Access Control List.

ACE - Access Control Entry

3-1 ip access-list standard

This command is used to create or modify a standard IP ACL. This command will enter into the standard IP access-list

configuration mode. Use the no command to remove a standard IP access-list.

ip access-list standard {[id | name]}

no ip access-list standard {id | name}

Parameters

3-2 permit | deny (ip standard access-list)

Use the permit command to add a permit entry. Use the deny command to add a deny entry. Use the no command to

remove an entry.

[sn] {permit | deny} {source source-wildcard | host source | any}

no sn

id Enter the ID of standard IP ACL here. This value must be between 1 and 1999.

name The name of the standard IP access-list to be configured. The name can be up to 32

characters.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

Standard IP ACL only filters the IPv4 packet.

The name must be unique among all (including MAC, IP, IPv6 or Expert) access-lists

and the first character of name must be a letter.

When creating an ACL, through assigning a name, an ID will be assigned

automatically. The ID assignment rule will start from the maximum ID of 1999 and

decrease 1 per new ACL.

When creating an ACL through assigning an ID, a name will be assigned

automatically. The name assignment rule is ‘std-ip’ + “-” + ID. If this name conflicts

with the name of an existing ACL, then it will be renamed based on the following rule:

‘std-ip’ + “-” + ID +”alt”.

Example

This example shows how to create a standard ACL.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#ip access-list standard Std-ip

DXS-3600-32S(config-std-nacl)#end

DXS-3600-32S#show access-list

Standard IP access list 1999 Std-ip

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Parameters

3-3 ip access-list extended

This command is used to create or modify an extended IP ACL. This command will enter into the extended IP access-

list configuration mode. Use the no command to remove an extended IP access-list.

ip access-list extended {[id | name]}

no ip access-list extended {id | name}

Parameters

sn (Optional) Specifies the ACE sequence number used. This number must be between

1 and 65535.

source source-wildcard Specifies the source IP address. Masks are used with IP addresses in IP ACLs to

specify what should be permitted and denied. Masks, in order to configure IP

addresses on interfaces, start with 255 and have the large values on the left side.

For example, IP address 209.165.202.129 with a 255.255.255.224 mask. Masks for

IP ACLs are the reverse, for example, mask 0.0.0.255. This is sometimes called an

inverse mask or a wildcard mask. When the value of the mask is broken down into

binary (0s and 1s), the results determine which address bits are to be considered in

processing the traffic. A 0 indicates that the address bits must be considered (exact

match); a 1 in the mask is not considered.

host source Specifies a specific source IP address.

any Means any source IP address.

Default

None.

Command Mode

Standard IP Access-list Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

A sequence number will be assigned automatically if the user does not assign it

manually. The automatically assign sequence number starts from 10, and increase

10 per new entry. The start sequence number and sequence increment of the IP

ACL can be configured manually.

Example

This example shows how to create a standard IP ACL, named Std-ip. This entry will

permit packets to the source network 10.20.0.0/16.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#ip access-list standard Std-acl

DXS-3600-32S(config-std-nacl)#permit 10.20.0.0 0.0.255.255

DXS-3600-32S(config-std-nacl)#end

DXS-3600-32S#show access-list

Standard IP access list 1998 Std-acl

10 permit 10.20.0.0 0.0.255.255

Standard IP access list 1999 Std-ip

DXS-3600-32S#

id Specifies the ID number of the extended IP ACL. This value must be between 2000

and 3999.

name Specifies the name of the extended IP access-list to be configured. The name can be

up to 32 characters.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 12

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-4 permit | deny (ip extended access-list)

Use the permit command to add a permit entry. Use the deny command to add a deny entry. Use the no command to

remove a specific entry.

Extended IP ACL:

[sn] {permit | deny} protocol {source source-wildcard | host source | any} {destination destination-wildcard | host

destination | any} [precedence precedence] [tos tos] [fragments] [time-range time-range-name]

Extended IP ACLs of some important protocols:

[sn] {permit | deny} tcp {source source-wildcard | host source | any} [operator port] {destination destination-

wildcard | host destination | any} [operator port] [tcp-flag] [precedence precedence] [tos tos] [fragments]

[time-range time-range-name]

[sn] {permit | deny} udp {source source–wildcard | host source | any} [operator port] {destination destination-

wildcard | host destination | any} [operator port] [precedence precedence] [tos tos] [fragments] [time-range

time-range-name]

[sn] {permit | deny} icmp {source source-wildcard | host source | any} {destination destination-wildcard | host

destination | any} [{icmp-type [icmp-code] | icmp-message}] [precedence precedence

] [tos tos] [fragments]

[time-range time-range-name]

no sn

Parameters

Usage Guideline

Extended IP ACL only filters IPv4 packets.

The name must be unique among all (including MAC, IP, IPv6 or Expert) access-lists

and the first character of the name must be a letter.

When creating an ACL through assigning a name, an ID will be assigned

automatically. The ID assignment rule will start from the maximum ID of 3999 and

decrease 1 per new ACL.

When creating an ACL through assigning an ID, a name will be assigned

automatically. The name assignment rule is ‘ext-ip’ + “-” + ID. If this name conflicts

with the name of an existing ACL, then it will be renamed based on the following rule:

‘ext-ip’ + “-” + ID +”alt”.

Example

This example shows how to create an extended ACL.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#ip access-list extended Ext-ip

DXS-3600-32S(config-ext-nacl)#end

DXS-3600-32S#show access-list

Standard IP access list 1998 Std-acl

10 permit 10.20.0.0 0.0.255.255

Standard IP access list 1999 Std-ip

Extended IP access list 3999 Ext-ip

DXS-3600-32S#

sn (Optional) Specifies the ACE sequence number used. This number must be between

1 and 65535.

protocol Specifies the name or number of an IP protocol: 'eigrp', 'esp', 'gre', 'igmp', 'ip', 'ipinip',

'ospf', 'pcp', 'pim', 'tcp', 'udp', 'icmp' or an integer in the range 0 to 255 representing

an IP protocol number. To match any Internet protocol. Additional specific

parameters for ‘tcp’, ‘udp’, and ‘icmp’. The ‘ip’ means any IP Protocol.

source Specifies the source IP address.

source-wildcard Applies wildcard bits to the source.

host source Specifies a specific source IP address.

any Means any source or destination IP address.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

destination Specifies the destination IP address.

destination-wildcard Applies wildcard bits to the destination.

host destination Specifies a specific destination IP address.

operator (Optional) Possible operators include ‘eq’ (equal), ‘gt’ (greater than), ‘lt’ (less than),

‘neq’ (not equal), and ‘range’ (inclusive range). A range needs two port numbers,

while other operators only need one port number.

port Specifies the Layer 4 port number as a decimal number (from 0 to 65535) or the

name of a Layer 4 port.

TCP ports used:

'bgp', 'chargen', 'daytime', 'discard', 'domain', 'echo', 'rexec', 'finger', 'ftp', 'ftp-data',

'gopher', 'hostname', 'ident', 'irc', 'klogin', 'kshell', 'login', 'lpd', 'nntp', 'snpp',

'pop2', 'pop3', 'smtp', 'sunrpc', 'shell', 'tacacs', 'telnet', 'time', 'uucp', 'whois',

'http'.

UDP ports used:

'biff', 'bootpc', 'bootps', 'discard', 'irc', 'domain', 'echo', 'isakmp', 'mobile-ip',

'nameserver', 'netbios-dgm', 'netbios-ns', 'netbios-ss', 'nat-t', 'ntp', 'snpp', 'rip',

'snmp', 'snmptrap', 'sunrpc', 'syslog', 'tacacs', 'talk', 'tftp', 'time', 'who', 'xdmcp'.

precedence precedence (Optional) Packets can be filtered by precedence level, as specified by a number

from 0 to 7 or by name: routine (0), priority (1), immediate (2), flash (3), flash-

override (4), critical (5), internet (6), network (7).

tos tos (Optional) Packets can be filtered by type of service level, as specified by a number

from 0 to 15 or by name: normal (0) , min-monetary-cost(1), max-reliability (2), max-

throughput (4), min-delay (8).

fragments (Optional) Packet fragment filtering.

time-range time-range-

name

(Optional) Specifies the name of time-period profile associated with the access-list

delineating its activation period.

tcp-flag (Optional) Specifies the TCP flag fields. The specified TCP header bits are: ack

(acknowledge), fin (finish), psh (push), rst (reset), syn (synchronize), or urg (urgent).

icmp-type (Optional) Specifies the ICMP message type. The valid number for the message type

is from 0 to 255.

icmp-code (Optional) Specifies the ICMP message code. The valid number for the message

code is from 0 to 255

icmp-message (Optional) Specifies the ICMP message type name or the ICMP message type and

code by name. Code names that can be used are 'administratively-prohibited',

'alternate-address', 'conversion-error', 'host-prohibited', 'net-prohibited', 'echo',

'echo-reply', 'pointer-indicates-error', 'host-isolated', 'host-precedence-violation',

'host-redirect', 'host-tos-redirect', 'host-tos-unreachable', 'host-unknown', 'host-

unreachable', 'information-reply', 'information-request', 'mask-reply', 'mask-request',

'mobile-redirect', 'net-redirect', 'net-tos-redirect', 'net-tos-unreachable', 'net-

unreachable', 'net-unknown', 'bad-length', 'option-missing', 'packet-fragment',

'parameter-problem', 'port-unreachable', 'precedence-cutoff', 'protocol-unreachable',

'reassembly-timeout', 'redirect-message', 'router-advertisement', 'router-solicitation',

'source-quench', 'source-route-failed', 'time-exceeded', 'timestamp-reply',

'timestamp-request', 'traceroute', 'ttl-expired', 'unreachable'.

Default

None.

Command Mode

Extended IP Access-list Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

A sequence number will be assigned automatically if the user did not assign it

manually. The automatic assign sequence number start from 10 and increases by 10

per new entry. The start sequence number and sequence increment of IP ACL can

be configured manually.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-5 ipv6 access-list

This command is used to create or modify an IPv6 ACL. This command will enter into the IPv6 access-list configuration

mode. Use the no command to remove an IPv6 access-list.

ipv6 access-list {name}

no ipv6 access-list {name}

Parameters

3-6 permit | deny (ipv6 access-list)

Use the permit command to add a permit entry. Use the deny command to add a deny entry. Use the no command to

remove an entry.

Extended IPv6 ACL:

[sn] {permit | deny} protocol {source-ipv6-prefix/prefix-length | host source-ipv6-address | any} {destination-ipv6-

prefix/prefix-length | host destination-ipv6-address | any} [dscp dscp] [flow-label flow-label] [fragments] [time-

range time-range-name]

Example

This example shows how to use the extended IP ACL. The purpose is to deny Telnet

access from the host, with the IP address 192.168.4.12, to any host in the network

192.168.1.0 and to permit any others.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#ip access-list extended Ext-ip

DXS-3600-32S(config-ext-nacl)#deny tcp host 192.168.4.12 192.168.1.0 0.0.255.255 eq telnet

DXS-3600-32S(config-ext-nacl)#permit ip any any

DXS-3600-32S(config-ext-nacl)#end

DXS-3600-32S#show access-list

Extended IP access list 3999 Ext-ip

10 deny tcp host 192.168.4.12 192.168.1.0 0.0.255.255 eq telnet

20 permit ip any any

DXS-3600-32S#

name Specifies the name of the IP access-list to be configured. The name can be up to 32

characters long.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

Extended IPv6 ACL only filters the IPv6 packet. The name must be unique among all

(including MAC, IP, IPv6 or Expert) access-lists and the first character of name must

be a letter.

Example

This example shows how to create an IPv6 ACL:

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#ipv6 access-list ext_ipv6

DXS-3600-32S(config-ipv6-nacl)#end

DXS-3600-32S#show access-list

Extended IP access list 3999 Ext-ip

10 deny tcp host 192.168.4.12 192.168.1.0 0.0.0.255 eq telnet

20 permit ip any any

Extended IPv6 access list ext_ipv6

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Extended IPv6 ACLs of some important protocols:

[sn] {permit | deny} tcp {source-ipv6-prefix/prefix-length | host source-ipv6-address | any} [operator port]

{destination-ipv6-prefix/prefix-length | host destination-ipv6-address | any} [operator port] [tcp-flag] [dscp dscp]

[flow-label flow-label] [fragments] [time-range time-range-name]

[sn] {permit | deny} udp {source-ipv6-prefix/prefix-length | host source-ipv6-address | any} [operator port]

{destination-ipv6-prefix/prefix-length | host destination-ipv6-address | any} [operator port] [dscp dscp] [flow-

label flow-label] [fragments] [time-range time-range-name]

[sn] {permit | deny} icmp {source-ipv6-prefix/prefix-length | host source-ipv6-address | any} {destination-ipv6-

prefix/prefix-length | host destination-ipv6-address | any} [{icmp-type [icmp-code] | icmp-message}] [dscp

dscp] [flow-label flow-label] [fragments] [time-range time-range-name]

no sn

Parameters

sn (Optional) Specifies the ACE sequence number used. This number must be between

1 and 65535.

protocol Specifies the name or number of an IPv6 protocol used. Protocol names, that can be

used are 'esp', 'ipv6', 'pcp', 'sctp', ‘tcp’, ‘udp’, ‘icmp’ or an integer in the range 0 to

255 representing an IP protocol number. Additional specific parameters are used for

‘tcp’, ‘udp’, and ‘icmp’. The ‘ipv6’ name means any IPv6 Protocol.

source-ipv6-prefix Specifies the source IPv6 network address or network type.

destination-ipv6-prefix Specifies the destination IPv6 network address or network type.

prefix-length Specifies the prefix mask length.

source-ipv6-address Specifies the source IPv6 address.

destination-ipv6-address Specifies the destination IPv6 address.

any Means any source or destination IPv6 address.

operator (Optional) Possible operators include ‘eq’ (equal), ‘gt’ (greater than), ‘lt’ (less than),

‘neq’ (not equal), and ‘range’ (inclusive range). Note that the range operator needs

two port numbers, while other operators only need one port number.

port Specifies the Layer 4 port number as a decimal number (from 0 to 65535) or the

name of a Layer 4 port.

TCP port names used:

'bgp', 'chargen', 'daytime', 'discard', 'domain', 'echo', 'rexec', 'finger', 'ftp', 'ftp-data',

'gopher', 'hostname', 'ident', 'irc', 'klogin', 'kshell', 'login', 'lpd', 'nntp', 'snpp',

'pop2', 'pop3', 'smtp', 'sunrpc', 'shell', 'tacacs', 'telnet', 'time', 'uucp', 'whois',

'http'.

UDP port names used:

'biff', 'bootpc', 'bootps', 'discard', 'irc', 'domain', 'echo', 'isakmp', 'mobile-ip',

'nameserver', 'netbios-dgm', 'netbios-ns', 'netbios-ss', 'nat-t', 'ntp', 'snpp', 'rip',

'snmp', 'snmptrap', 'sunrpc', 'syslog', 'tacacs', 'talk', 'tftp', 'time', 'who', 'xdmcp'.

dscp dscp (Optional) Enter the DSCP value to match a differentiated services code point value

against the traffic class value in the Traffic Class field of each IPv6 packet header.

The acceptable range is from 0 to 255.

fragments (Optional) Specifies packet fragment filtering.

time-range time-range-

name

(Optional) Specifies the name of the time-period profile associated with the access-

list delineating its activation period.

tcp-flag (Optional) Specifies the TCP flag fields. The specified TCP header bits that can be

used are ‘ack’ (acknowledge), ‘fin’ (finish), ‘psh’ (push), ‘rst’ (reset), ‘syn’

(synchronize), or ‘urg’ (urgent).

icmp-type (Optional) Specifies the ICMP message type. The valid number for the message type

is from 0 to 255.

icmp-code (Optional) Specifies the ICMP message code. The valid number for the message

code is from 0 to 255

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-7 mac access-list

This command is used to create or modify an extended MAC ACL. This command will enter into the extended MAC

access-list configuration mode. Use the no command to remove an extended MAC access-list.

mac access-list extended {[id | name]}

no mac access-list extended {id | name}

Parameters

icmp-message (Optional) Specifies the ICMP message type name or the ICMP message type and

code by name. Names that can be used are 'beyond-scope', 'destination-

unreachable', 'echo-reply', 'echo-request', 'erroneous_header', 'hop-limit', 'multicast-

listener-query', 'multicast-listener-done', 'multicast-listener-report', 'nd-na', 'nd-ns',

'next-header', 'no-admin', 'no-route', 'packet-too-big', 'parameter-option', 'parameter-

problem', 'port-unreachable', 'reassembly-timeout', 'redirect', 'renum-command',

'renum-result', 'renum-seq-number', 'router-advertisement', 'router-renumbering',

'router-solicitation', 'time-exceeded', 'unreachable'.

flow-label flow-label (Optional) Specifies the flow label value used. This value must be between 0 and

1048575.

Default

None.

Command Mode

IPv6 Access-list Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

A sequence number will be assigned automatically if the user did not assign it

manually. Automatic assignment of sequence numbers start from 10, and increases

by 10 for every new entry.

Example

This example shows how to use the IPv6 ACL. The purpose is to deny FTP access

from the host, with the IPv6 address of 19:18:43::12, to any host in the network

120:16:10::/48 and to permit any others.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#ip access-list extended ext_ipv6

DXS-3600-32S(config-ext-nacl)#deny tcp host 19:18:43::12 120:16:10::/48 eq ftp

DXS-3600-32S(config-ext-nacl)#permit any any

DXS-3600-32S(config-ext-nacl)#end

DXS-3600-32S#show access-lists

Extended IPv6 access list ext_ipv6

10 deny tcp host 19:18:43::12 120:16:10::/48 eq ftp

20 permit any any

DXS-3600-32S#

id Specifies the ID number of the extended MAC ACL. This value must be between

6000 and 7999.

name Specifies the name of the extended MAC ACL to be configured. The name can be up

to 32 characters long.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 12

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-8 permit | deny (mac access-list)

Use the permit command to add a permit entry. Use the deny command to add a deny entry. Use the no command to

remove an entry.

[sn] {permit | deny} {source-mac-address mask | host source-mac-address | any} {destination-mac-address mask

| host destination-mac-address | any} [ethernet-type] [cos out [inner in]]

no sn

Parameters

Usage Guideline

Extended MAC ACL only filters the Non-IP packet. The name must be unique among

all (including MAC, IP, IPv6 or Expert) access-lists and the first character of name

must be a letter.

When creating an ACL through the assignment of a name, an ID will be assigned

automatically. The ID assignment rule will start from the maximum ID of 7999 and

decrease by 1 for envery new ACL created.

When creating an ACL through the assignment of an ID, a name will be assigned

automatically. The name assignment rule is ‘ext-mac’ + “-” + ID. If this name conflicts

with the name of an existing ACL, then it will be renamed based on the following rule:

‘ext-mac’ + “-” + ID +”alt”.

Example

This example shows how to create an extended MAC ACL.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#mac access-list extended 6001

DXS-3600-32S(config-mac-nacl)#end

DXS-3600-32S#show access-list

Extended IP access list 3999 ext_ipv6

10 permit ip any any

Extended MAC access list 6001 ext-mac-6001

DXS-3600-32S#

sn (Optional) Specifies the ACE sequence number. This number must be between 1

and 65535.

source-mac-address Specifies the source MAC address.

destination-mac-address Specifies the destination MAC address.

mask Specifies the MAC address mask.

any Means any source or destination MAC address.

ethernet-type (Optional) Specifies the Ethernet type as a pair of hexadecimal numbers and the

mask (from 0x0 to 0xFFFF) or the name of the Ethernet type. Names that can be

used are 'arp', 'aarp', 'appletalk', 'decnet-iv', 'etype-6000', 'etype-8042', 'lat', 'lavc-

sca', 'mop-console', 'mop-dump', 'vines-echo', 'vines-ip', 'xns-idp'.

cos out Specifies the out priority value used. This value must be between 0 and 7.

inner in (Optional) Specifies the inner priority value used. This value must be between 0 and

Default

None.

Command Mode

Extended MAC Access-list Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

A sequence number will be assigned automatically if the user did not assign it

manually. Automatic assignment of sequence numbers will start from 10 and

increase by 10 for every new entry created.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-9 expert access-list

This command is used to create or modify an extended expert ACL. This command will enter into the extended expert

access-list configuration mode. Use the no command to remove an extended expert access-list.

expert access-list extended {[id | name]}

no expert access-list extended {id | name}

Parameters

Example

This example shows how to use the extended MAC ACL. The purpose is to deny a

host, with the MAC address of 0013.0049.8272, to send Ethernet frames of the type

‘apply’.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#mac access-list extended 6001

DXS-3600-32S(config-mac-nacl)#25 deny host 0013.0049.8272 any aarp

DXS-3600-32S(config-mac-nacl)#end

DXS-3600-32S#show access-list

Extended IP access list 3999 ext_ipv6

10 permit ip any any

Extended MAC access list 6001 ext-mac-6001

25 deny host 00-13-00-49-82-72 any aarp

DXS-3600-32S#

id Specifies the ID number of extended expert ACL. This number must be between

8000 and 9999.

name Specifies the name of the extended expert ACL to be configured. The name can be

up to 32 characters long.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

The name must be unique among all (including MAC, IP, IPv6 or Expert) access-lists

and the first character of name must be a letter.

When creating an ACL through the assignment of a name, an ID will be assigned

automatically. The ID assign rule states to start from the maximum ID of 9999 and

decrease 1 for every new ACL created.

When creating an ACL through the assignment of an ID, a name will be assigned

automatically. The name assign rule is ‘ext-expert’ + “-” + ID. If this name conflicts

with the name of an existing ACL, then it will be renamed based on the following rule:

‘ext-expert’ + “-” + ID +”alt”

Example

This example shows how to create an extended expert ACL.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#expert access-list extended exp_acl

DXS-3600-32S(config-exp-nacl)#end

DXS-3600-32S#show access-list

Extended IP access list 3999 ext_ipv6

10 permit ip any any

Extended MAC access list 6001 ext-mac-6001

25 deny host 00-13-00-49-82-72 any aarp

Extended EXPERT access list 9999 exp_acl

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-10 permit | deny (expert access-list)

Use the permit command to add a permit entry. Use the deny command to add a deny entry. Use the no command to

remove an entry.

Extended expert ACL:

[sn] {permit | deny} [ethernet-type] [[cos out [inner in]] | [vlan out [inner in]]] {source source-wildcard | host

source | any} {source-mac-address mask | host source-mac-address | any} {destination destination-wildcard |

host destination | any} {destination-mac-address mask | host destination-mac-address | any} [time-range

time-range-name]

[sn] {permit | deny} protocol [vlan out [inner in]] {source source-wildcard | host source | any} {source-mac-

address mask | host source-mac-address | any} {destination destination-wildcard | host destination | any}

{destination-mac-address mask | host destination-mac-address | any} [precedence precedence] [tos tos]

[fragments] [time-range time-range-name]

Extended expert ACLs of some important protocols:

[sn] {permit | deny} tcp [vlan out [inner in]] {source source-wildcard | host source | any} {source-mac-address

mask | host source-mac-address | any} [operator port]] {destination destination-wildcard | host destination |

any} {destination-mac-address mask | host destination-mac-address | any} [operator port] [precedence

precedence] [tos tos] [fragments] [time-range time-range-name] [tcp-flag]

[sn] {permit | deny} udp [vlan out [inner in]] {source source-wildcard | host source | any} {source-mac-address

mask | host source-mac-address | any} [operator port] {destination destination-wildcard | host destination |

any} {destination-mac-address mask | host destination-mac-address | any} [operator port] [precedence

precedence] [tos tos] [fragments] [time-range time-range-name]

[sn] {permit | deny} icmp [vlan out [inner in]] {source source-wildcard | host source | any} {source-mac-address

mask | host source-mac-address | any} {destination destination-wildcard | host destination | any} {destination-

mac-address mask | host destination-mac-address | any} [icmp-type] [[icmp-type [icmp-code]] | [icmp-

message]] [precedence precedence] [tos tos] [fragments] [time-range time-range-name]

no sn

Parameters

sn (Optional) Specifies the ACE sequence number. This number must be between 1

and 65535.

source Specifies the source IP address.

source-wildcard Applies wildcard bits to the source.

host source Specifies a specific source IP address.

any Means any source or destination IP or MAC address.

destination Specifies the destination IP address.

destination-wildcard Applies wildcard bits to the destination.

host destination Specifies a specific destination IP address.

source-mac-address Specifies the source MAC address.

destination-mac-address Specifies the destination MAC address.

mask Specifies the MAC address mask.

vlan out (Optional) Specifies the outer VID used. This value must be between 1 and 4094.

vlan inner in (Optional) Specifies the inner VID used. This value must be between 1 and 4094.

cos out (Optional) Specifies the outer priority value. This value must be betwee 0 and 7.

cos inner in (Optional) Specifies the inner priority value. This value must be between 0 and 7.

ethernet-type (Optional) Specifies the Ethernet type as a pair of hexadecimal numbers and mask

(from 0x0 to 0xFFFF) or the name of an Ethernet type. Names that can be used are

'arp', 'aarp', 'appletalk', 'decnet-iv', 'etype-6000', 'etype-8042', 'lat', 'lavc-sca', 'mop-

console', 'mop-dump', 'vines-echo', 'vines-ip', 'xns-idp'.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

protocol Specifies the name or number of an IP protocol used. Names that can be used are

'eigrp', 'esp', 'gre', 'igmp', 'ip', 'ipinip', 'ospf', 'pcp', 'pim', 'tcp', 'udp', 'icmp' or an integer

in the range 0 to 255 representing an IP protocol number. This field is used to match

any Internet protocol. There are additional specific parameters for ‘tcp’, ‘udp’, and

‘icmp’. The ‘ip’ means any IP Protocol.

operator (Optional) Specifies the operator used. Possible operators include ‘eq’ (equal), ‘gt’

(greater than), ‘lt’ (less than), ‘neq’ (not equal), and ‘range’ (inclusive range). A range

needs two port numbers, while other operators only need one port number.

port Specifies the Layer 4 port number as a decimal number (from 0 to 65535) or the

name of a L4 port.

TCP port names used:

'bgp', 'chargen', 'daytime', 'discard', 'domain', 'echo', 'rexec', 'finger', 'ftp', 'ftp-data',

'gopher', 'hostname', 'ident', 'irc', 'klogin', 'kshell', 'login', 'lpd', 'nntp', 'snpp',

'pop2', 'pop3', 'smtp', 'sunrpc', 'shell', 'tacacs', 'telnet', 'time', 'uucp', 'whois',

'http'.

UDP port names used:

'biff', 'bootpc', 'bootps', 'discard', 'irc', 'domain', 'echo', 'isakmp', 'mobile-ip',

'nameserver', 'netbios-dgm', 'netbios-ns', 'netbios-ss', 'nat-t', 'ntp', 'snpp', 'rip',

'snmp', 'snmptrap', 'sunrpc', 'syslog', 'tacacs', 'talk', 'tftp', 'time', 'who', 'xdmcp'.

precedence precedence (Optional) Packets can be filtered by their precedence level. This is specified by a

number from 0 to 7 or by name. Names that can be used are routine (0), priority (1),

immediate (2), flash (3), flash-override (4), critical (5), internet (6), network (7).

tos tos (Optional) Packets can be filtered by their type of service level. This is specified by a

number from 0 to 15 or by name. Names that can be used are normal (0), max-

reliability (2), max-throughput (4), min-delay (8), min-monetary-cost (1).

fragments (Optional) Specifies packet fragment filtering.

time-range time-range-

name

(Optional) Specifies the name of the time-period profile associated with the access-

list delineating its activation period.

tcp-flag (Optional) Specifies the TCP flag fields. The specified TCP header bits can be ‘ack’

(acknowledge), ‘fin’ (finish), ‘psh’ (push), ‘rst’ (reset), ‘syn’ (synchronize), or ‘urg’

(urgent).

icmp-type (Optional) Specifies the ICMP message type. The valid number for the message type

is from 0 to 255.

icmp-code (Optional) Specifies the ICMP message code. The valid number for the message

code is from 0 to 255

icmp-message (Optional) Specifies the ICMP message type name or the ICMP message type and

code by name. Names that can be used are 'administratively-prohibited', 'alternate-

address', 'conversion-error', 'host-prohibited', 'net-prohibited', 'echo', 'echo-reply',

'pointer-indicates-error', 'host-isolated', 'host-precedence-violation', 'host-redirect',

'host-tos-redirect', 'host-tos-unreachable', 'host-unknown', 'host-unreachable',

'information-reply', 'information-request', 'mask-reply', 'mask-request', 'mobile-

redirect', 'net-redirect', 'net-tos-redirect', 'net-tos-unreachable', 'net-unreachable',

'net-unknown', 'bad-length', 'option-missing', 'packet-fragment', 'parameter-problem',

'port-unreachable', 'precedence-cutoff', 'protocol-unreachable', 'reassembly-timeout',

'redirect-message', 'router-advertisement', 'router-solicitation', 'source-quench',

'source-route-failed', 'time-exceeded', 'timestamp-reply', 'timestamp-request',

'traceroute', 'ttl-expired', 'unreachable'.

Default

None.

Command Mode

Extended Expert Access-list Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

A sequence number will be assigned automatically if the user did not assign it

manually. The automatic assignment sequence number starts from 10 and increases

by 10 for every new entry.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-11 ip access-list resequence

This command is used to reassign the sequence step and start sequence number of the IP ACL entries. Use the no

command to default configuration.

ip access-list resequence {id | name} start-sn inc-sn

no ip access-list resequence {id | name}

Parameters

Example

This example shows how to use the extended MAC ACL. The purpose is to deny all

the TCP packets with, the source IP address 192.168.4.12 and the source MAC

address 001300498272.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#expert access-list extended exp_acl

DXS-3600-32S(config-exp-nacl)#deny tcp host 192.168.4.12 host 0013.0049.8272 any any

DXS-3600-32S(config-exp-nacl)#end

DXS-3600-32S#show access-list

Extended EXPERT access list 9999 exp_acl

10 deny tcp host 192.168.4.12 host 00-13-00-49-82-72 any any

DXS-3600-32S#

id Specifies the ID number of IP ACL used. This number must be between 1 and 3999.

name Specifies the name of the IP ACL to be configured. The name can be up to 32

characters long.

start-sn Specifies the start sequence number.

inc-sn Specifies the sequence step value.

Default

The start sequence number is 10 and the sequence step is 10.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

Sequence numbers for the entries in an ACL are automatically generated when you

create a new ACE but does not assign it manually. You can use the ip access-list

resequence global configuration command to edit the start sequence number and

sequence step in a IP ACL and change the order to automatically generated ID

ACEs and apply them.

Example

This example shows how to resequence the entries of an ACL.

DXS-3600-32S# show access-lists

Standard IP access list 1999 Std-acl

10 permit 10.20.0.0 0.0.255.255

20 deny any

DXS-3600-32S# configure terminal

DXS-3600-32S(config)# ip access-list resequence Std-acl 20 40

DXS-3600-32S(config)# end

DXS-3600-32S# show access-lists

Standard IP access list 1999 Std-acl

20 permit 10.20.0.0 0.0.255.255

60 deny any

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-12 list-remark text

This command is used to add remarks for the specified ACL. Use the no command to deletes the remarks.

list-remark text

no list-remark

Parameters

3-13 show access-lists

This command is used to display all ACLs or the specified ACL.

show access-list [id | name]

Parameters

text Specifies the remark information. The information can be up to 256 characters.

Default

None.

Command Mode

Access-list Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

None.

Example

This example shows how to add a remark in an ACL.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#ip access-list extended ip-ext-acl

DXS-3600-32S(config-ext-nacl)#list-remark this acl is to filter the host 192.168.4.12

DXS-3600-32S(config-ext-nacl)#end

DXS-3600-32S#show access-list

Extended IP access list 3999 ip-ext-acl

10 deny tcp host 192.168.4.12

this acl is to filter the host 192.168.4.12

DXS-3600-32S#

id Specifies the ID number of the ACL.

name Specifies the name of the IP ACL to be configured. The name can be up to 32

characters long.

Default

None.

Command Mode

EXEC Mode.

Command Default Level

Level: 1

Usage Guideline

Use this command to display a specified ACL. If no ID or name is specified, all the

ACLs will be displayed.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-14 ip access-group

This command is used to apply a specific IP ACL to an interface. Use the no command to cancels the application.

ip access-group {id | name} {in | out}

no ip access-group {id | name} {in | out}

Parameters

Example

This example shows how to display ACLs.

DXS-3600-32S# show access-list sip1

Standard IP access list 1999 sip1

999 deny 2.2.2.2 0.0.255.255

DXS-3600-32S# show access-list 2001

Extended IP access list 2001 ext-ip-2001

10 permit tcp host 1.1.1.1 eq echo any gt 6524 ack fin psh rst syn urg precedence internet

tos 14

DXS-3600-32S# show access-list

Standard IP access list 1 std-ip-1

999 deny 2.2.2.2 0.0.255.255

Standard IP access list 11 std-ip-11

10 permit host 1.1.1.1

Standard IP access list 1999 sip1

999 deny 2.2.2.2 0.0.255.255

Extended IP access list 2000 ext-ip-2000

Extended IP access list 2001 ext-ip-2001

10 permit tcp host 1.1.1.1 eq echo any gt 6524 ack fin psh rst syn urg precedence internet

tos 14

Extended IP access list 2011 ext-ip-2011

10 deny ip 5.5.5.5 0.0.255.255 host 7.7.7.5 fragments precedence internet tos 5

Extended IP access list 2111 ext-ip-2111

10 deny ip 5.5.5.5 0.0.255.255 host 7.7.7.5 precedence critical tos 6

Extended IP access list 3111 ext-ip-3111alt

Extended IP access list 3994 ext-ip-3111

Extended IPv6 access list ipv6-11

10 deny tcp host 1:2::3 eq 655 host 2:3:4:: gt 555 ack fin psh

Extended IPv6 access list ipv6-1

10 deny ipv6 1:2::3/32 host 2:22::

Extended MAC access list 6000 ext-mac-6000

10 deny any any

Extended MAC access list 7999 mac1

10 permit any any

Extended EXPERT access list 8000 ext-expert-8000

10 deny any any host 1.1.1.22 host 00-11-22-33-44-55

Extended EXPERT access list 9999 exp1

10 deny ip host 1.1.1.1 host 00-01-02-03-04-05 any any

DXS-3600-32S#

id Specifies the ID number of IP ACL used. This number must be between 1 and 3999.

name Specifies the name of the IP ACL to be configured. The name can be up to 32

characters long.

in Specifies to filter the incoming packets of the interface.

out Specifies to filter the outgoing packets of the interface.

Default

None.

Command Mode

Interface Configuration Mode.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-15 ipv6 traffic-filter

This command is used to apply a specific IPv6 ACL to an interface. Use the no command to cancels the application.

ipv6 traffic-filter name {in | out}

no Ipv6 traffic-filter name {in | out}

Parameters

Command Default Level

Level: 12

Usage Guideline

Only one IP ACL can be attached to the ingress physical ports or egress physical

ports.

Applying or binding an ACL to an interface will fail if there is any criteria statements

that are not supported. An error message “Do not support fields: …” will be displayed

and all unsupported criteria statements of the ACL type will be listed.

Example

This example shows how to apply an IP ACL to an interface. The purpose is to apply

the ACL ‘ip-ext-acl’ attribute to the tenGigabitEthernet 1/0/5 interface, to filter

incoming packets.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/5

DXS-3600-32S(config-if)#ip access-group ip-ext-acl in

DXS-3600-32S(config-if)#end

DXS-3600-32S#show access-group interface tenGigabitEthernet 1/0/5

Interface tenGigabitEthernet 1/0/5:

ip access-group ip-ext-acl in

DXS-3600-32S#

name Specifies the name of the IPv6 ACL to be configured. The name can be up to 32

characters long.

in Specifies to filter the incoming packets of the interface.

out Specifies to filter the outgoing packets of the interface.

Default

None.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

Only one IPv6 ACL can be attached to an ingress physical port or egress physical

port.

Applying or binding an ACL to an interface will fail if there is any criteria statements

that are not supported. An error message “Do not support fields: …” will be displayed

and all unsupported criteria statements of the ACL type will be listed.

Example

This example shows how to apply an IPv6 ACL to an interface. The purpose is to

apply the ACL ‘ext_ipv6’ attribute to the tenGigabitEthernet 1/0/4 interface, to filter

incoming packets.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/4

DXS-3600-32S(config-if)#ipv6 access-group ext_ipv6 in

DXS-3600-32S(config-if)# end

DXS-3600-32S# show access-group interface tenGigabitEthernet 1/0/4

Interface tenGigabitEthernet 1/0/4:

ipv6 access-group ext_ipv6 in

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-16 mac access-group

This command is used to apply a specific MAC ACL to an interface. Use the no command to cancel the application.

mac access-group {id | name} {in | out}

no mac access-group {id | name} {in | out}

Parameters

3-17 expert access-group

This command is used to apply a specific expert ACL to an interface. Use the no command to cancel the application.

expert access-group {id | name} {in | out}

no expert access-group {id | name} {in | out}

Parameters

id Specifies the ID number of the MAC ACL. This number must be between 6000 and

7999.

name Specifies the name of the MAC ACL to be configured. The name can be up to 32

characters long.

in Specifies to filter the incoming packets of the interface.

out Specifies to filter the outgoing packets of the interface.

Default

None.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

Only one MAC ACL can be attached to an ingress physical port or egress physical

port.

Applying or binding an ACL to an interface will fail if there is any criteria statements

that are not supported. An error message “Do not support fields: …” will be displayed

and all unsupported criteria statements of the ACL type will be listed.

Example

This example shows how to apply a MAC ACL to an interface. The purpose is to

apply the ACL ‘ext_mac’ attribute to the tenGigabitEthernet 1/0/3 interface, to filter

outgoing packets.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface range tenGigabitEthernet 1/0/1-1/0/3

DXS-3600-32S(config-if-range)#mac access-group ext_mac out

DXS-3600-32S(config-if-range)# end

DXS-3600-32S# show access-group interface tenGigabitEthernet 1/0/1-1/0/3

Interface tenGigabitEthernet 1/0/1:

mac access-group ext_mac out

Interface tenGigabitEthernet 1/0/2:

mac access-group ext_mac out

Interface tenGigabitEthernet 1/0/3:

mac access-group ext_mac out

DXS-3600-32S#

id Specifies the ID number of the expert ACL. This number must be between 8000 and

9999.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-18 show access-group

This command is used to display the ACL configuration of the interface.

show access-group [interface interface]

Parameters

name Specifies the name of the expert ACL to be configured. The name can be up to 32

characters long.

in Specifies to filter the incoming packets of the interface.

out Specifies to filter the outgoing packets of the interface.

Default

None.

Command Mode

Interface Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

Only one expert ACL can be attached to an ingress physical port or egress physical

port.

Applying or binding an ACL to an interface will fail if there is any criteria statements

that are not supported. An error message “Do not support fields: …” will be displayed

and all unsupported criteria statements of the ACL type will be listed.

Example

This example shows how to apply an expert ACL to an interface. The purpose is to

apply the ACL ‘exp_acl’ attribute to the tenGigabitEthernet 1/0/2 interface, to filter

incoming packets.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/2

DXS-3600-32S(config-if)#expert access-group exp_acl in

DXS-3600-32S(config-if)#end

DXS-3600-32S#show access-group interface tenGigabitEthernet 1/0/2

Interface tenGigabitEthernet 1/0/2:

expert access-group exp_acl in

DXS-3600-32S#

interface interface Specifies the interface ID used.

Default

None.

Command Mode

EXEC Mode.

Command Default Level

Level: 1

Usage Guideline

Displays the ACL applied to the interface. If no interface is specified, the ACLs

applied to all the interfaces will be displayed.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-19 show ip access-group

This command is used to display the IP ACL configuration of the interface.

show ip access-group [interface interface]

Parameters

3-20 show ipv6 access-group

This command is used to display the IPv6 ACL configuration of the interface.

show ipv6 traffic-filter [interface interface]

Parameters

Example

This example shows how to display the ACL, applied to the interface.

DXS-3600-32S#show access-group

Interface tenGigabitEthernet 1/0/2:

ipv6 access-group ipv6-11 in

ipv6 access-group ipv6-1 out

expert access-group exp1 in

Interface tenGigabitEthernet 1/0/11:

ip access-group 11 in

ip access-group std-ip-1 out

mac access-group 6005 in

mac access-group ext-mac-6000 out

DXS-3600-32S#

interface interface Specifies the interface ID used.

Default

None.

Command Mode

EXEC Mode.

Command Default Level

Level: 1

Usage Guideline

Displays the IP ACL applied to the interface. If no interface is specified, the IP ACLs

applied to all the interfaces will be displayed.

Example

This example shows how to display the IP ACL, applied to the interface.

DXS-3600-32S#show ip access-group

Interface tenGigabitEthernet 1/0/11:

ip access-group 11 in

ip access-group std-ip-1 out

DXS-3600-32S#

interface interface Specifies the interface ID used.

Default

None.

Command Mode

EXEC Mode.

Command Default Level

Level: 1

Usage Guideline

Displays the IPv6 ACL applied to the interface. If no interface is specified, the IPv6

ACLs applied to all the interfaces will be displayed.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-21 show mac access-group

This command is used to display the MAC ACL configuration of the interface.

show mac access-group [interface interface]

Parameters

3-22 show expert access-group

This command is used to display the expert ACL configuration of the interface.

show expert access-group [interface interface]

Parameters

Example

This example shows how to display the IPv6 ACL, applied to the interface.

DXS-3600-32S#show ipv6 traffic-filter

Interface tenGigabitEthernet 1/0/2:

ipv6 access-group ipv6-11 in

ipv6 access-group ipv6-1 out

DXS-3600-32S#

interface interface Specifies the interface ID used.

Default

None.

Command Mode

EXEC Mode.

Command Default Level

Level: 1

Usage Guideline

Displays the MAC ACL applied to the interface. If no interface is specified, the MAC

ACLs applied to all the interfaces will be displayed.

Example

This example shows how to display the MAC ACL, applied to the interface.

DXS-3600-32S#show mac access-group

Interface tenGigabitEthernet 1/0/11:

mac access-group 6005 in

mac access-group ext-mac-6000 out

DXS-3600-32S#

interface interface Specifies the interface ID used.

Default

None.

Command Mode

EXEC Mode.

Command Default Level

Level: 1

Usage Guideline

Displays the expert ACL applied to the interface. If no interface is specified, the

expert ACLs applied to all the interfaces will be displayed.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-23 vlan access-map

This command is used to create a submap. This command will enter into the access-map configuration mode. The no

form of this command deletes the submap.

vlan access-map map_name [map_sn]

no vlan access-map map_name [map_sn]

Parameters

3-24 match ip / mac address

This command is used to associate an IP ACL or MAC ACL with a specific submap. The no form of this command

removes the configuration.

match ip address {acl_name | acl_id}+8

no match ip address {acl_name | acl_id}+8

match mac address {acl_name | acl_id}+8

no match mac address {acl_name | acl_id}+8

Parameters

Example

This example shows how to display the expert ACL, applied to the interface.

DXS-3600-32S#show expert access-group

Interface tenGigabitEthernet 1/0/2:

expert access-group exp1 in

DXS-3600-32S#

map_name Specifies the name of the hostmap to be configured. The name can be up to 32

characters long.

map_sn Specifies the sequence number of the submap.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

A sequence number will be assigned automatically if the user did not assign it

manually. Automatic assignment of the sequence number starts from 10 and

increases by 10 for every new entry.

Example

This example shows how to create a VLAN access map.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#vlan access-map vlan-map 20

DXS-3600-32S(config-access-map)#

acl_name Speicifies the name of the ACL to be configured. The name can be up to 32

characters long.

acl_id Specifies the sequence number of the ACL.

+8 Input parameters can be continuously, but not more than 8 times.

Default

None.

Command Mode

Access-map Configuration Mode.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-25 action

This command is used to set the forwarding, drop, and redirect actions of submaps in the VACL mode. Use the no

command to return to the default configuration.

action forward

no action forward

action drop

no action drop

action redirect {port_id}

no action redirect {port_id}

Parameters

Command Default Level

Level: 12

Usage Guideline

One submap can only be associated with an IP ACL or a MAC ACL. You can not

associate a submap with both an IP ACL and a MAC ACL.

One submap can only be associated with at most 8 ACLs.

One submap can not be associated with an non-existent ACL.

One submap can not be associated with an ACL, which is NULL ACL.

Example

This example shows how to configure matching content in the submap.

DXS-3600-32S(config)# vlan access-map vlan-map 20

DXS-3600-32S(config-access-map)# match ip address 10 20 sp1 30 sp2

DXS-3600-32S(config-access-map)# end

DXS-3600-32S# show vlan access-map

VLAN access-map vlan-map 20

match ip address: 10,20,sp1,30,sp2

action: forward

DXS-3600-32S# configure terminal

DXS-3600-32S(config)# vlan access-map vlan-map 30

DXS-3600-32S(config-access-map)# match mac address 6710 6720 ext_mac 7760

DXS-3600-32S(config-access-map)# end

DXS-3600-32S# show vlan access-map

VLAN access-map vlan-map 20

match ip address: 10,20,sp1,30,sp2

action: forward

VLAN access-map vlan-map 30

match mac address: 6710,6720,ext_mac,7760

action: forward

DXS-3600-32S#

port_id Specifies the redirection port used.

Default

Default action is forward.

Command Mode

Access-map Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

One submap has only one action.

The submap action is applied to all the associated ACLs.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-26 vlan filter

This command is used to apply a hostmap in a VLAN. Use the no command to remove a hostmap from a VLAN.

vlan filter map_name vlan-list vlan_id

no vlan filter map_name vlan-list vlan_id

Parameters

3-27 show vlan access-map

This command is used to display the VLAN access-map configuration of the interface.

show vlan access-map [map_name]

Parameters

Example

This example shows how to configure the action attribute in the submap.

DXS-3600-32S# show vlan access-map

VLAN access-map vlan-map 20

match mac address: 6710,6720,ext_mac,7760,

action: forward

DXS-3600-32S# configure terminal

DXS-3600-32S(config)# vlan access-map vlan-map 20

DXS-3600-32S(config-access-map)# action redirect tenGigabitEthernet 1/0/5

DXS-3600-32S(config-access-map)# end

DXS-3600-32S# show vlan access-map

VLAN access-map vlan-map 20

match mac address: 6710,6720,ext_mac,7760,

action: redirect tenGigabitEthernet 1/0/5

DXS-3600-32S#

map_name Specifies the name of the hostmap.

vlan_id Specifies the VLAN ID used.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 12

Usage Guideline

One VLAN Access Map can be applied to multiple VLANs.

One VLAN can bind with only one VLAN Access Map.

Example

This example shows how to apply the hostmap ‘vlan-map’ to VLAN 5.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#vlan filter vlan-map vlan-list 5

DXS-3600-32S(config)#end

DXS-3600-32S#show vlan filter

VLAN Map vlan-map

Configured on VLANs: 5

DXS-3600-32S#

map_name Specifies the name of the hostmap to be configured. The name can be up to 32

characters long.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

3-28 show vlan filter

This command is used to display the VLAN filter configuration of the interface.

show vlan filter [{access_map map_name | vlan vlan_id}]

Parameters

Default

None.

Command Mode

EXEC Mode.

Command Default Level

Level: 1

Usage Guideline

None.

Example

This example shows how to display the VLAN access map.

DXS-3600-32S#show vlan access-map

VLAN access-map vlan-map 10

match ip access list: 110,220,stp_ip1,30,stp_ip2,

action: forward

VLAN access-map vlan-map 20

match mac access list: 6710,6720,ext_mac,7760,

action: redirect tenGigabitEthernet 1/0/5

DXS-3600-32S#

access_map map_name Specifies the name of the hostmap to be configured. The name can be up to 32

characters long.

vlan vlan_id Specifies the VLAN ID used.

Default

None.

Command Mode

EXEC Mode.

Command Default Level

Level: 1

Usage Guideline

None.

Example

This example shows how to display the VLAN filter.

DXS-3600-32S#show vlan filter

VLAN Map aa

Configured on VLANs: 5-127,221-333

VLAN Map bb

Configured on VLANs: 1111-1222

DXS-3600-32S#show vlan filter vlan 5

VLAN ID 5

Binding VLAN Map aa

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Address Resolution Protocol (ARP) Commands

4-1 arp

This command is used to add a permanent IP address and MAC address mapping to the ARP cache table. Use the

‘no’ command to remove the IP-MAC address mapping.

arp [vrf <string 1-12>] ip-address mac-address

no arp [vrf <string 1-12>] ip-address

Parameters

4-2 arp timeout

This command is used to configure the timeout value for the dynamic ARP mapping record in the ARP cache table.

Use the ‘no’ command to restore it to the default configuration.

arp timeout minutes

no arp timeout

Parameters

vrf Specifies the VRF that the IP reside in. If no VRF name is specified, the global

instance will be used.

ip-address Enter the IP address that corresponds to the MAC address here.

mac-address Enter the 48-bit data link layer address here.

Default

There is no static ARP entry in the ARP cache table.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

This command adds a static ARP mapping entry to the system. If this dynamic ARP

entry already exists, it will be replaced by the static ARP entry.

If the new entry contains a different MAC address from the old one, the new entry will

cover the old one.

Using the ‘no’ command, the user can delete static and dynamic entries however,

local entries cannot be removed.

Users can verify the settings by entering the show ip arp or show arp command.

Example

This example shows how to add a static ARP entry into the ARP cache table.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#arp 33.1.1.33 0050.BA00.0736

DXS-3600-32S(config)#

Example

This example shows how to remove a static ARP entry, with the IP address

33.1.1.33, from the ARP cache table.

DXS-3600-32S(config)#no arp 33.1.1.33

DXS-3600-32S(config)#

minutes Enter the timeout value used here. This value must be between 0 and 65535 min-

utes.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

4-3 clear arp cache

This command is used to remove one or all dynamic ARP entries from the ARP cache table.

clear arp-cache [vrf <string 1-12>] [ip-address] [interface interface-name]

Parameters

Default

The default timeout value is 20 minutes.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 8

Usage Guideline

The ARP timeout setting is only applicable to the IP address and the MAC address

mapping that are learned dynamically. The shorter the timeout, the truer the mapping

table saved in the ARP cache, but the more network bandwidth occupied by the

ARP. Hence the advantages and disadvantages should be weighted. Generally it is

not necessary to configure the ARP timeout too shorter unless there is a special

requirement.

Users can verify the settings by entering the show arp timeout command.

Example

This example shows how to tonfigure the timeout value, for the dynamic ARP

mapping record, to 120 minutes.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#arp timeout 120

DXS-3600-32S(config)#

Example

This example shows how to restore the timeout value, for the dynamic ARP mapping

record, to 20 minutes.

DXS-3600-32S(config)#no arp timeout

DXS-3600-32S(config)#

vrf Specifies the VRF that the IP reside in. If no VRF name is specified, the global

instance will be used.

ip-address (Optional) Enter the IP address of the dynamic ARP entry here.

interface interface-name (Optional) Specifies the interface from which the dynamic ARP entry was learned.

Default

None.

Command Mode

Privileged Mode.

Command Default Level

Level: 8

Usage Guideline

This command can be used to clear the dynamic ARP entries.

Use the show ip arp command to view the current state of the ARP cache table.

Example

This example shows how to remove all dynamic ARP entries.

DXS-3600-32S#clear arp-cache

DXS-3600-32S#

Example

This example shows how to remove a dynamic ARP entry with the IP address

1.1.1.1

DXS-3600-32S#clear arp-cache 1.1.1.1

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

4-4 show arp

This command is used to display the Address Resolution Protocol (ARP) cache table.

show arp [vrf <string 1-12>] [ip-address [net-mask] | mac-address | {static | complete}]

Parameters

Example

This example shows how to remove dynamic ARP entries from the IP interface

vlan1.

DXS-3600-32S#clear arp-cache interface vlan1

DXS-3600-32S#

vrf Specifies the VRF that the IP reside in. If no VRF name is specified, the global

instance will be used.

ip-address (Optional) Enter the ARP entry of the specified IP address here.

net-mask (Optional) Enter the ARP entries of the network segment included within the mask.

mac-address (Optional) Enter the ARP entry of the specified MAC address.

static (Optional) Specifies to display all the static ARP entries.

complete (Optional) Specifies to display all the resolved dynamic ARP entries.

Default

All entries in the ARP cache table will be displayed if no option is specified.

Command Mode

Privileged Mode.

Command Default Level

Level: 3

Usage Guideline

Use this command to display the ARP cache table. Static and complete is mutually

exclusive with each other.

Example

This example shows how to display all the entries in the ARP cache table.

DXS-3600-32S#show arp

ARP timeout is 20 minutes.

Interface IP Address MAC Address Type

------------- --------------- ----------------- ---------------

System 10.0.0.0 FF-FF-FF-FF-FF-FF Local/Broadcast

System 10.90.90.90 00-12-21-12-21-11 Local

System 10.1.1.5 00-12-21-12-21-18 Static

System 10.1.1.8 00-12-21-12-21-48 Static

System 10.1.1.9 00-05-5D-A5-32-3F Dynamic

System 10.255.255.255 FF-FF-FF-FF-FF-FF Local/Broadcast

Total Entries: 6

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Example

This example shows how to display the ARP cache table containing the IP address

of 10.1.1.9.

DXS-3600-32S#show arp 10.1.1.9

ARP timeout is 20 minutes.

Interface IP Address MAC Address Type

------------- --------------- ----------------- ---------------

System 10.1.1.9 00-05-5D-A5-32-3F Dynamic

Total Entries: 1

DXS-3600-32S#

Example

This example shows how to display the ARP cache table containing the netmask

10.1.0.0/255.255.0.0.

DXS-3600-32S#show arp 10.1.0.0 255.255.0.0

ARP timeout is 20 minutes.

Interface IP Address MAC Address Type

------------- --------------- ----------------- ---------------

System 10.1.1.5 00-12-21-12-21-18 Static

System 10.1.1.8 00-12-21-12-21-48 Static

System 10.1.1.9 00-05-5D-A5-32-3F Dynamic

Total Entries: 3

DXS-3600-32S#

Example

This example shows how to display the ARP cache table containing static types for

the netmask 10.1.0.0/255.255.0.0.

DXS-3600-32S#show arp 10.1.0.0 255.255.0.0 static

ARP timeout is 20 minutes.

Interface IP Address MAC Address Type

------------- --------------- ----------------- ---------------

System 10.1.1.5 00-12-21-12-21-18 Static

System 10.1.1.8 00-12-21-12-21-48 Static

Total Entries: 2

DXS-3600-32S#

Example

This example shows how to display the ARP cache table containing the MAC

address 00:05:5D:A5:32:3F.

DXS-3600-32S#show arp 0005.5DA5.323F

ARP timeout is 20 minutes.

Interface IP Address MAC Address Type

------------- --------------- ----------------- ---------------

System 10.1.1.9 00-05-5D-A5-32-3F Dynamic

Total Entries: 1

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

4-5 show arp counter

This command is used to display the number of ARP entries in the ARP cache table.

show arp counter [vrf <string 1-12>]

Parameters

4-6 show arp timeout

This command is used to display the aging time of a dynamic ARP entry on the switch.

Example

This example shows how to display the ARP cache table containing static types.

DXS-3600-32S#show arp static

ARP timeout is 20 minutes.

Interface IP Address MAC Address Type

------------- --------------- ----------------- ---------------

System 10.1.1.5 00-12-21-12-21-18 Static

System 10.1.1.8 00-12-21-12-21-48 Static

Total Entries: 2

DXS-3600-32S#

Example

This example shows how to display the ARP cache table containing all the

completed entries.

DXS-3600-32S#show arp complete

ARP timeout is 20 minutes.

Interface IP Address MAC Address Type

------------- --------------- ----------------- ---------------

System 10.1.1.9 00-05-5D-A5-32-3F Dynamic

Total Entries: 1

DXS-3600-32S#

vrf Specifies the VRF that the IP reside in. If no VRF name is specified, the global

instance will be used.

Default

None.

Command Mode

Privileged Mode.

Command Default Level

Level: 3

Usage Guideline

Use this command to display the number of ARP entries in the ARP cache table.

Example

This example shows how to display the number of ARP entries in the ARP cache

table.

DXS-3600-32S#show arp counter

Total ARP Entry Counter: 3

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

show arp timeout

4-7 show ip arp

This command is used to display the Address Resolution Protocol (ARP) cache table.

show ip arp [vrf <string 1-12>]

Parameters

None.

Default

None.

Command Mode

Privileged Mode.

Command Default Level

Level: 3

Usage Guideline

Use this command to display the aging time of a dynamic ARP entry on the switch.

Example

This example shows how to display the aging time value of a dynamic ARP entry on

the switch.

DXS-3600-32S#show arp timeout

ARP timeout is 20 minutes.

DXS-3600-32S#

vrf Specifies the VRF that the IP reside in. If no VRF name is specified, the global

instance will be used.

Default

None.

Command Mode

Privileged Mode.

Command Default Level

Level: 3

Usage Guideline

Use this command to display the Address Resolution Protocol (ARP) cache table.

Example

This example shows how to display the Address Resolution Protocol (ARP) cache

table.

DXS-3600-32S#show ip arp

ARP timeout is 20 minutes.

Interface IP Address MAC Address Type

------------- --------------- ----------------- ---------------

System 10.0.0.0 FF-FF-FF-FF-FF-FF Local/Broadcast

System 10.90.90.90 00-12-21-12-21-11 Local

System 10.255.255.255 FF-FF-FF-FF-FF-FF Local/Broadcast

Total Entries: 3

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Alternate Store and Forward (ASF) Commands

5-1 enable asf

This command is used to enable the ASF feature.

enable asf

5-2 no asf

This command is used to disable the ASF feature.

no asf

5-3 show asf

This command is to display the current ASF mode.

show asf

Parameters

None.

Default

Alternate store and forward feature is disabled.

Command Mode

Global Configuration Mode

Command Default Level

Level: 15

Usage Guideline

Use this command to enable the alternate store and forward mode.

Example

This example shows how to enable ASF.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#enable asf

DXS-3600-32S(config)#

Parameters

None.

Default

Alternate store and forward feature is disabled.

Command Mode

Global Configuration Mode

Command Default Level

Level: 15

Usage Guideline

Use this command to disable the alternate store and forward mode.

Example

This example shows how to disable ASF.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#no asf

DXS-3600-32S(config)#

Parameters

None.

Default

None.

Command Mode

Privileged Mode.

Command Default Level

Level: 1

Usage Guideline

Use this command to display the current setting of the alternate store and forward

feature.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Example

This example shows how to display the current settings for ASF.

DXS-3600-32S#show asf

Alternate Store and Forward: Disabled

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Authentication, Authorization, and Accounting (AAA)

Commands

6-1 aaa

This command is used to enable the Authentication, Authorization, and Accounting (AAA) security service. The no form

of this command is used to disable the AAA security service.

aaa

no aaa

6-2 aaa authentication login

This command is used to enable AAA login authentication and configure the login authentication method list. The no

form of this command is used to delete the authentication method list.

aaa authentication login {default | list-name} method1 [method2...]

no aaa authentication login {default | list-name}

Parameters

None.

Default

By default, this feature is disabled.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to enable AAA. If AAA is not enabled, none of the AAA

commands can be configured.

Example

This example shows how to enable the AAA security service.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa

DXS-3600-32S(config)#

7 2011-11-14 11:55:14 INFO(6) Authentication Policy is enabled (Module: AAA)

DXS-3600-32S(config)#

default When this parameter is used, the following defined authentication method list is used

as the default method for Login authentication.

list-name Name of the user authentication method list. After the user-defined authentication

method list created, you can use login authentication line configuration command to

apply the login authentication method list to the specified terminal lines.

method Syntax "{local | none | group {radius | tacacs+ | group_name}}".

Up to four methods supported:

local - Use the local user name database for authentication.

none - By pass authentication.

group - Can be followed by radius or tacas+ or a group_name

“group radius” means use all RADIUS servers group

“group tacacs+" means use all TACACS+ server group.

“group group_name" is the specific group created via aaa group server global

configuration command.

Default

None. On the console, login will succeed without any authentication checks if the

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-3 aaa authentication enable

This command is used to enable AAA enable authentication and configure the enable authentication method list. The

no form of this command is used to delete the user authentication method list.

aaa authentication enable default method1 [method2...]

no aaa authentication enable default

Parameters

Usage Guideline

If the AAA login authentication security service is enabled on the device, users must

use AAA for login authentication negotiation. You must use aaa authentication login

to configure a default or optional method list for login authentication.

The next method can be used for authentication only when the current method does

not work.

You need to apply the configured login authentication method to the terminal line

which needs login authentication. Otherwise, the configured login authentication

method is invalid.

Example

This example shows how to define an AAA login authentication method list, named

‘list-1’. In the authentication method list, the RADIUS security server is used first for

authentication. If the RADIUS security server does not respond, the local user

database is used for authentication. After the login authentication method list has

been created, you can use the Login Authentication Line Configuration command to

apply this method list to the console, SSH, or other terminals.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa authentication login list-1 group radius local

DXS-3600-32S(config)#

default When this parameter is used, the following defined authentication method list is used

as the default method for enable authentication.

method Syntax "{enable | none | group {radius | tacacs+ | group_name}}".

Up to four methods supported:

enable - Uses the enable password for authentication.

none - By pass authentication.

group - Can be followed by radius or tacas+ or a group_name

"group radius" means use all RADIUS servers group

"group tacacs+" means use all TACACS+ server group.

"group group_name" is the specific group created via the ‘aaa group server

global’ configuration command.

Default

None. On the console, the enable password is used if it exists. If no password is set,

the process will succeed anyway.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

If the AAA enable authentication service is enabled on the device, users must use

AAA for enable authentication negotiation. You must use aaa authentication enable

to configure a default or optional method list for enable authentication. The next

method can be used for authentication only when the current method does not work.

The enable authentication function automatically takes effect after configuring the

enable authentication method list.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-4 login authentication

This command is used to apply the login authentication method list to the specified terminal lines. The no form of this

command is used to remove the application of login authentication method list.

no login authentication

Parameters

6-5 aaa authorization exec

This command is used to authorize the users logged in the NAS CLI and assign the authority level. The no form of this

command is used to disable the aaa authorization exec function.

aaa authorization exec {default | list-name} method1 [method2...]

no aaa authorization exec {default | list-name}

Example

This example shows how to define an AAA enable authentication method list. In the

authentication method list, the RADIUS security server is used first for

authentication. If the RADIUS security server does not respond, the local user

database is used for authentication.

After enabling the authentication method list defined, AAA security services will

apply authentication to the user by enabling the privilege password.

DXS-3600-32S(config)#aaa

DXS-3600-32S(config)#aaa authentication enable default group radius local

DXS-3600-32S(config)#

default Apply the default Login authentication method list to the terminal line.

list-name Apply the defined Login authentication method list to the terminal line.

Default

Uses the default set with the ‘aaa authentication login’ command.

Command Mode

Line Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

Once the default login authentication method list has been configured, it will be

applied to all the terminals automatically. If non-default login authentication method

list has been applied to the terminal, it will replace the default one. If you attempt to

apply the undefined method list, it will prompt a warning message that the login

authentication in this line is ineffective till it is defined.

Example

This example shows how to define the AAA login authentication method list, named

‘list-1’. In the authentication method list, the local user database is used first for

authentication. After that, this method list is applied to the console. After applying the

authentication by the AAA security servers.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa authentication login list-1 local

DXS-3600-32S(config)#line console

DXS-3600-32S(config-line)#login authentication list-1

DXS-3600-32S(config-line)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Parameters

6-6 aaa authorization console

This command is used to enable authorization function for users who has logged in the console. The no form of this

command is used to disable the authorization function.

aaa authorization console

no aaa authorization console

default When this parameter is used, the following defined method list is used as the default

method for Exec authorization.

list-name Name of the user authorization method list. After the user-defined authorization

method list created, you can use authorization exec line configuration command to

apply the authorization method list to the specified terminal lines.

method Syntax "{local | none | group {radius | tacacs+ | group_name}}".

Up to four methods supported:

local - Use the local user name database for authorization.

none - Do not perform authorization.

group - Can be followed by radius or tacas+ or a group_name

"group radius" means use all RADIUS servers group

"group tacacs+" means use all TACACS+ server group.

"group group_name" is the specific group created via aaa group server global

configuration command.

Default

The default value is disabled.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

It supports authorization of users logged in the NAS CLI and assignment of CLI

authority level (0-15). The aaa authorization exec function is effective on condition

that Login authentication function has been enabled. It can not enter the CLI if it fails

to enable the aaa authorization exec. You must apply the exec authorization method

to the terminal line; otherwise the configured method is ineffective.

Example

This example shows how to use the RADIUS server to authorize EXEC. After the

authorization method list, called ‘list-1’ has been created, you can use the

Authorization EXEC Line Configuration command to apply this method list to the

console, SSH, or other terminals.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa authorization exec list-1 group radius

DXS-3600-32S(config)#

Parameters

None.

Default

The default option is disabled.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

It supports to identify the users logged in from the console and from other terminals,

configure whether to authorize the users logged in from the console or not. If the

command authorization function is disabled on the console, the authorization

method list applied to the console line is ineffective.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-7 authorization exec

This command is used to authorize the users logged in the NAS CLI and assign the authority level. The no form of this

command is used to disable the aaa authorization exec function.

authorization exec {default | list-name}

no authorization exec

Parameters

6-8 aaa accounting exec

This command is used to account users in order to count the manage user activities. The no form of this command is

used to disable the accounting function.

aaa accounting exec {default | list-name} start-stop method1 [method2...]

no aaa accounting exec {default | list-name}

Example

This example shows how to enable the AAA authorization console function. The

authorization method list, applied to the console line, via the Authorization EXEC

Line Configuration command, will take effect.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa authorization console

DXS-3600-32S(config)#

default Specifies to use the default method of Exec authorization.

list-name Specifies to apply a defined method list of Exec authorization.

Default

The default value is disabled.

Command Mode

Line Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

Once the default exec authorization method list has been configured, it is applied to

all terminals automatically. Once the non-default command authorization method list

has been configured, it is applied to the line instead of the default method list. If you

attempt to apply an undefined method list, a warning message will prompt that the

exec authorization in this line is ineffective till the authorization method list is defined.

Example

This example shows how to configure the EXEC authorization method list, with the

name of ‘list-1’, that uses the RADIUS server. If the security server does not

respond, it will not perform authorization. After the configuration, the authorization

command is applied to the console.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa authentication login login-1 group tacacs+ local

DXS-3600-32S(config)#aaa authorization exec list-1 group radius none

DXS-3600-32S(config)#aaa authorization console

DXS-3600-32S(config)#line console

DXS-3600-32S(config-line)#authorization exec list-1

DXS-3600-32S(config-line)#login authentication login-1

DXS-3600-32S(config-line)#exit

DXS-3600-32S(config)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Parameters

6-9 accounting exec

This command is used to apply the exec accounting method list to the specified terminal lines in the line configuration

mode. The no form of this command is used to disable the exec accounting function.

accounting exec {default | list-name}

no accounting exec

Parameters

default When this parameter is used, the following defined method list is used as the default

method for Exec accounting.

list-name Name of the Exec accounting method list. After the user-defined accounting method

list created, you can use accounting exec line configuration command to apply the

accounting method list to the specified terminal lines.

method Syntax "{none | group {radius | group_name}}".

Up to four methods supported:

none - Do not perform accounting.

group - Can be followed by radius or a group_name

"group radius" means use all RADIUS servers group

"group group_name" is the specific group created via aaa group server global

configuration command.

Default

The default option is disabled.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

It enables the exec accounting function after enabling the login authentication.

After enabling the accounting function, it sends the account start information to the

security server when the users log in the NAS CLI, and sends the account stop

information to the security server when the users log out. If it does not send the

account start information to the security server when a user logs in, it does not send

the account stop information to the security server when a user logs out, either.

The configured exec accounting method must be applied to the terminal line that

needs accounting command; otherwise it is ineffective.

Example

This example shows how to perform accounting, of a managed user’s activities,

using RADIUS, and sends the accounting messages at the start and the end time of

access. After the ‘list-1’ accounting method list has been created, you can use the

Accounting EXEC Line Configuration command to apply this method list to the

console, SSH, or to other terminals.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa accounting exec list-1 start-stop group radius

DXS-3600-32S(config)#

default Specifies to use the default method of Exec accounting.

list-name Specifies to use a defined Exec accounting method list.

Default

By default, this feature is disabled.

Command Mode

Line Configuration Mode.

Command Default Level

Level: 15

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-10 ip http authentication aaa

This command is used to specify an AAA authentication method for HTTP server users, use the ip http authentication

aaa command in global configuration mode. To disable a configured authentication method, use the no form of this

command.

ip http authentication aaa {exec-authorization {default | list-name} | login-authentication {default | list-name}}

no ip http authentication aaa {exec-authorization | login-authentication}

Parameters

Usage Guideline

Once the default exec accounting method list has been configured, it is applied to all

terminals automatically. Once the non-default exec accounting method list has been

configured, it is applied to the line instead of the default method list. If you attempt to

apply an undefined method list, a warning message will prompt that the exec

accounting in this line is ineffective till the exec accounting command method list is

defined.

Example

This example shows how to configure the EXEC accounting method list, with the

name of ‘list-1’, that uses the RADIUS server. If the security server does not

response, it will not perform accounting. After the configuration, EXEC accounting is

applied to the console.

After applying the login method list, ‘list-1’, to the console, when a user logs in from

the console, it sends the account start information to the security server when the

user has logged into the NAS’s CLI. It also sends the account stop information to the

security server when a user logs out.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa accounting exec list-1 start-stop group radius

DXS-3600-32S(config)#line console

DXS-3600-32S(config-line)#accounting exec list-1

DXS-3600-32S(config-line)#

exec-authorization Specifies to configure the method list for exec authorization.

default Specifies to configure the default method list.

listname Specifies to configure the name of the method list.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

The ‘ip http authentication aaa’ command specifies the AAA authentication method

to be used for login when a client connects to the HTTP server. The local, RADISU

and TACACS+ methods should be specified using the ‘aaa authentication login’

command.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-11 aaa local authentication attempts

This command is used to configure login attempt times.

aaa local authentication attempts max-attempts

no aaa local authentication attempts

6-12 aaa local authentication lockout-time

This command is used to configure the length of the lockout-time when the login user has attempted for more than the

limited times.

aaa local authentication lockout-time lockout-time

no aaa local authentication lockout-time

Example

This example shows how to specifies that the method, configured for AAA, should be

used for authentication for HTTP server users. The AAA login method is configured

as the “local” username/password authentication method. This example specifies

that the local username database will be used for login authentication and the EXEC

authorization of HTTP sessions.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa authentication login list-1 local

DXS-3600-32S(config)#aaa authorization exec list-1 local

DXS-3600-32S(config)#ip http authentication aaa login-authentication list-1

DXS-3600-32S(config)#ip http authentication aaa exec-authorization list-1

DXS-3600-32S(config)#

Parameters

The range is between 1 and 255.

Default

The default value is 3.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to configure login attempt times.

Example

This example shows how to configure the number of login attempt times to 6.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa local authentication attempts 6

DXS-3600-32S(config)#

Parameters

The range is between 1 and 255.

Default

The default value is 60 seconds.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to configure the length of lockout-time when the login user has

attempted for more than the limited times.

Example

This example shows how to configure the length of the ‘lockout-time’ attribute, to 5

seconds.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa local authentication lockout-time 5

DXS-3600-32S(config)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-13 aaa authentication network

This command is used to enable AAA network access authentication and configure the network access user

authentication method list. The no form of this command is used to delete the network access user authentication

method list.

aaa authentication network default method1 [method2...]

no aaa authentication network default

Parameters

6-14 aaa authorization network

This command is used to authorize the service requests (including protocols like 802.1X) from the users that access

the network. The no form of this command is used to disable the authorization function.

aaa authorization network default method1 [method2...]

no aaa authorization network default

Parameters

default When this parameter is used, the following defined network access user

authentication method list is used as the default method for user authentication.

method Syntax "{local | none | group radius | group_name}".

Up to four methods supported:

local - Specifies to use the local user name database for authentication.

none - Specifies to bypass authentication.

group - Specifies to be followed by radius or a group name.

"group radius" means to use all RADIUS servers group.

“group group_name” means to use a specific RADIUS group, created by means

of the aaa group server radius global configuration command.

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

If the AAA network access security service (such as 802.1X) is enabled on the

device, users must use AAA for network access user authentication negotiation. You

must use the ‘aaa authentication network’ command to configure a default or

optional method list for network access user authentication. The next method can be

used for authentication only when the current method does not work.

Example

This example shows how to define the AAA authentication method list for the

network access security service. In the authentication method list, the RADIUS

security server is first used for authentication. If the RADIUS security server does not

respond, the local user database is used for authentication.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa authentication network default group radius local

DXS-3600-32S(config)#

default When this parameter is used, the following defined method list is used as the default

method for Network authorization.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-15 aaa accounting network

This command is used to account users in order to count the network access fees. The no form of this command is

used to disable the accounting function.

aaa accounting network default start-stop method1 [method2...]

no aaa accounting network default

Parameters

method Syntax "{local | none | group radius | group_name}".

Up to four methods supported:

local - Specifies to use the local user name database for authorization.

none - Specifies not tp perform authorization.

group - Specifies to be followed by radius or a group name.

"group radius" means to use all RADIUS servers group.

“group group_name” means to use a specific RADIUS group, created by means

of the aaa group server radius global configuration command.

Default

By default, this feature is disabled.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

It supports authorization of all the service requests related to the network, such as

802.1X. If authorization is configured, all the authenticated users or interfaces will be

authorized automatically. Three different authorization methods can be specified. If

the access user authenticated method is specified in authorization method list, the

authorization attributes will be applied, otherwise these attributes will be ignored.

Authenticated by method Authorization configure method Accept authorization attributes

group radius group radius Yes

group radius local / none No

local group radius / none No

local local No

none group radius / local / none No

The RADIUS server authorizes authenticated users by returning a series of

attributes. Therefore, RADIUS authorization is based on RADIUS authentication.

RADIUS authorization is performed only when the user passes the RADIUS

authentication.

Example

This example shows how to use the RADIUS server to authorize network services.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa authorization network default group radius

DXS-3600-32S(config)#

network Specifies to perform accounting of the network related service requests, including

dot1x, etc.

start-stop Send accounting messages at both the start time and the end time of access. Users

are allowed to access the network, no matter whether the start accounting message

enables the accounting successfully.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-16 aaa group server

This command is used to configure the AAA server group. The no form of this command is used to delete the server

group.

aaa group server {radius | tacacs+} name

no aaa group server {radius | tacacs+} name

Parameters

6-17 server

This command is used to add a server to the AAA server group. The no form is used to delete a server.

server ip-addr

no server ip-addr

method Syntax "{none | group {radius | group_name}}".

Up to four methods supported:

none - Specifies not tp perform authorization.

group - Specifies to be followed by radius or a group name.

"group radius" means to use all RADIUS servers group.

“group group_name” means to use a specific RADIUS group, created by means

of the aaa group server radius global configuration command.

radius Specifies to use the RADIUS group for accounting.

Default

By default, this feature is disabled.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

It performs accounting of user activities by sending record attributes to the security

server. Use the keyword start-stop to set the user accounting option.

Example

This example shows how to perform the accounting of a network service request,

from users, using RADIUS, and sends accounting messages at the start and the end

time of access.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa accounting network default start-stop group radius

DXS-3600-32S(config)#

name Enter the name of the server group. It cannot be the keywords "radius" and

"tacacs+".

Default

None.

Command Mode

Global Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

This command is used to configure the AAA server group. Currently, the RADIUS

and TACACS+ server groups are supported.

Example

This example shows how to configure an AAA server group named ‘group-1’.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa group server radius group-1

DXS-3600-32S(config-sg-radius)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Parameters

6-18 show aaa

This command is used to display AAA security service global configuration, use the ‘show aaa’ command in EXEC

mode.

show aaa

ip-addr Enter the IP address of the server. The host can be created via radius-server host

or tacacs-server host global configuration command.

Default

By default, no server is configured.

Command Mode

Server Group Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

Add a server to the specified server group. The default value is used if no port is

specified.

Example

This example shows how to add a server IP address to the server group called

‘group-1’.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa group server radius group-1

DXS-3600-32S(config-sg-radius)#server 192.168.4.12

Warning: Server 192.168.4.12 is not defended

DXS-3600-32S(config-sg-radius)#

Parameters

None.

Default

None.

Command Mode

Privileged EXEC Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to show AAA security service global configuration.

Example

This example shows how to display the global configuration of the AAA security

service.

DXS-3600-32S#show aaa

AAA State: Enabled

Console Authorization State: Disabled

Authentication Attempts: 3

Authentication Lockout-Time: 60 second(s)

DXS-3600-32S#

Display Parameters Description

AAA State AAA security service global state.

Console Authorization State Console authorization state for users who has logged in the console.

Authentication attempts Login attempt times.

Authentication lockout-time Lockout-time when the login user has attempted for more than the limited times.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-19 show aaa server group

This command is used to display AAA server group configuration, use the ‘show aaa server group’ command in

EXEC mode.

show aaa server group

6-20 show aaa authentication

This command is used to display the AAA authentication method list. Use the show aaa authentication command in

EXEC mode.

show aaa authentication {login | enable | network}

Parameters

None.

Default

None.

Command Mode

Privileged EXEC Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to show AAA server group configuration.

Example

This example shows how to display the AAA server group configuration.

DXS-3600-32S#show aaa server group

Group Name Type IP Address

----------------------------------------

Authen_R RADIUS 10.10.10.1

10.10.10.2

Author_T TACACS 10.10.10.20

10.10.10.25

Authen_1X RADIUS 10.90.90.100

3 total server group(s)

DXS-3600-32S#

Display Parameters Description

Group Name Name of AAA serve group.

Type Type of Server group, RADIUS or TACACS+.

IP Address RADIUS server IP address.

enable Display the enable authentication method list.

network Display the network authentication method list.

Default

None.

Command Mode

Privileged EXEC Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to show AAA authentication method list.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-21 show aaa authorization

This command is used to display the AAA authorization method list. Use the show aaa authorization command in

EXEC mode.

show aaa authorization {exec | network}

Parameters

Example

This example shows how to display the AAA login authentication method list.

DXS-3600-32S#show aaa authentication login

Method List Priority Method Name

------------------------------------------

default 1 RADIUS

2 Authen_R

3 Local

auth_test 1 RADIUS

2 Authen_R

3 Local

DXS-3600-32S#

Display Parameters Description

Method List Authentication method list name.

Priority Priority of authentication method.

Method Name Name of authentication method.

exec Display the Exec authorization method list.

network Display the Network authorization method list.

Default

None.

Command Mode

Privileged EXEC Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to display the AAA authorization method list.

Example

This example shows how to display the AAA EXEC authorization method list.

DXS-3600-32S#show aaa authorization exec

Method List Priority Method Name

------------------------------------

default 1 RADIUS

2 Author_R

3 Local

author 1 RADIUS

2 Author_R

3 Local

DXS-3600-32S#

Display Parameters Description

Method List Authorization method list name.

Priority Priority of authorization method.

Method Name Name of authorization method.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-22 show aaa accounting

This command is used to display the AAA accounting method list. Use the show aaa accounting command in EXEC

mode.

show aaa accounting {exec | network}

Parameters

6-23 show aaa application

This command is used to display the AAA application information. Use the show aaa application command in EXEC

mode.

show aaa application [{line | http | network}]

Parameters

exec Display the Exec accounting method list.

network Display the Network accounting method list.

Default

None.

Command Mode

Privileged EXEC Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to display the AAA accounting method list.

Example

This example shows how to display the AAA EXEC accounting method list.

DXS-3600-32S#show aaa accounting exec

Method List Priority Method Name

------------------------------------

default 1 RADIUS

acct_ssh 1 Acct_R

DXS-3600-32S#

Display Parameters Description

Method List Accounting method list name.

Priority Priority of accounting method.

Method Name Name of accounting method.

line Display the Line application information.

http Display the HTTP application information.

network Display the Network-Access application information.

If the parameter is not specified, display all applications information.

Default

None.

Command Mode

Privileged EXEC Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to display AAA application information.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Example

This example shows how to display AAA application LINE information.

DXS-3600-32S#show aaa application line

Console:

Enable Method List: default

Authorization Method List: default

Accounting Method List: default

Telnet:

Enable Method List: default

Authorization Method List: author_list_1

Accounting Method List:

SSH:

Enable Method List: default

Authorization Method List: default

Accounting Method List: acct_list_1

DXS-3600-32S#

Example

This example shows how to display all AAA application information.

DXS-3600-32S#show aaa application

Console:

Enable Method List: default

Authorization Method List: default

Accounting Method List: default

Telnet:

Enable Method List: default

Authorization Method List: author_list_1

Accounting Method List:

SSH:

Enable Method List: default

Authorization Method List:

Accounting Method List: acct_list_1

HTTP:

Authorization Method List: author_list_1

Network-Access:

Authentication Method List: default

Authorization Method List: default

Accounting Method List: default

DXS-3600-32S#

Display Parameters Description

Enable Method List Enable authentication method list for enable EXEC privilege.

Authentication Method List Authentication method list for network-access user authentication.

Authorization Method List Authorization method list for EXEC or network-access user.

Accounting Method List Accounting method list for EXEC or network-access user.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

6-24 ip vrf forwarding

This command is used to configure the Virtual Private Network (VPN) routing and forwarding (VRF) reference of an

authentication, authorization, and accounting (AAA) RADIUS or TACACS+ server group. Use this command in the

server-group configuration mode. To enable server groups to use the global (default) routing table, use the no form of

this command.

ip vrf forwarding vrf-name

no ip vrf forwarding

Parameters

vrf-name Specifies the name assigned to a VRF.

Default

No server is configured.

Command Mode

Server Group Configuration Mode.

Command Default Level

Level: 15

Usage Guideline

Use this command to specify a VRF for an AAA RADIUS or TACACS+ server group.

This command enables dial access users to utilize AAA servers in different routing

domains.

Example

The following example shows how to configure the VRF user to reference the

RADIUS server in a different VRF server group:

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#aaa group server radius sg_global

DXS-3600-32S(config-aaa-groug-server)#server-private 172.16.010.0254 timeout 5 retransmit 3

DXS-3600-32S(config-aaa-groug-server)#exit

DXS-3600-32S(config)#

DXS-3600-32S(config)#aaa group server radius sg_water

DXS-3600-32S(config-aaa-group-server)#server-private 10.10.0.01 timeout 5 retransmit 3 key water

DXS-3600-32S(config-aaa-group-server)#ip vrf forwarding water

DXS-3600-32S(config-aaa-group-server)#end

DXS-3600-32S(config)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Border Gateway Protocol (BGP) Commands

7-1 address-family ipv4

This command is used to enter the IPv4 address family mode. Use the no form of this command to delete the

configuration of an address family.

address-family ipv4 [{unicast | vrf VRF-NAME}]

no address-family ipv4 [{unicast | vrf VRF-NAME}]

Parameters

7-2 address-family vpnv4

This command is used to enter the IPv4 VPN address family mode. Use the no form of this command to delete the

configuration of the VPNv4 address family.

address-family vpnv4

no address-family vpnv4

unicast Specifies to enter the IPv4 unicast address family configuration mode.

vrf VRF-NAME Specifies the name of the VRF instance to enter IPv4 VRF address family

configuration mode.

Default

None.

Command Mode

Router Configuration.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command is used to enter the IPv4 address family mode. Different configuration

parameters can be set in different address family modes. The IPv4 VRF address

family mode is used to configure the BGP instance relation to every VRF instance. If

no parameters are specified, it will enter the IPv4 unicast address family mode.

Please note that only eBGP peers are supported in the IPv4 VRF address family.

To exit from the address-family configuration mode, use the exit-address-family

command.

Example

This example shows how to enter the IPv4 unicast address family and activate a

peer session.

DXS-3600-32S# configure terminal

DXS-3600-32S(config)# router bgp 10

DXS-3600-32S(config-router)# address-family ipv4 unicast

DXS-3600-32S(config-router-af)# neighbor 5.5.5.5 activate

DXS-3600-32S(config-router-af)# exit-address-family

DXS-3600-32S(config-router)#

Example

This example shows how to enter the VRF address family and create a BGP peer.

DXS-3600-32S# configure terminal

DXS-3600-32S(config)# router bgp 10

DXS-3600-32S(config-router)# address-family ipv4 vrf VPN-A

DXS-3600-32S(config-router-af)# neighbor 5.5.5.5 remote-as 20

DXS-3600-32S(config-router-af)# exit-address-family

DXS-3600-32S(config-router)#

Parameters

None.

Default

None.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-3 aggregate-address

This command is used to configure BGP aggregate entries. Use the no form of this command to delete the entry.

aggregate-address NETWORK-ADDRESS [summary-only] [as-set]

no aggregate-address NETWORK-ADDRESS

Parameters

Command Mode

Router Configuration.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command is used to enter the IPv4 VPN address family mode. The BGP peers

activated in this mode are used to exchange VPN IPv4 routing information.

Please note that only iBGP peers are supported in this address family now.

To exit from this address-family configuration mode, use the exit-address-family

command.

Example

This example shows how to enter the VPNv4 address family and activate a BGP

peer.

DXS-3600-32S# configure terminal

DXS-3600-32S(config)# router bgp 120

DXS-3600-32S(config-router)# address-family vpnv4

DXS-3600-32S(config-router-af)# neighbor 10.2.2.5 activate

DXS-3600-32S(config-router-af)# neighbor 10.2.2.5 send-community extended

DXS-3600-32S(config-router-af)# exit-address-family

DXS-3600-32S(config-router)#

NETWORK-ADDRESS Specifies the network address and the sub-network mask that BGP will aggregate.

For example, the format of NETWORK-ADDRESS can be 10.9.18.2/8.

summary-only (Optional) Filters all more-specific routes from updates.

as-set (Optional) Generates autonomous system set path information.

Default

None.

Command Mode

Router Configuration.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

Aggregates are used to minimize the size of routing tables. Aggregation combines

the characteristics of several different routes and advertises a single route. The

aggregate-address command creates an aggregate entry in the BGP routing table if

any more-specific BGP routes are available in the specified range. Using the

summary-only parameter advertises the prefix only, suppressing the more-specific

routes to all neighbors.

Use the as-set parameter to reduce the size of path information by listing each AS

number only once, even if it was included in multiple paths that were aggregated.

The as-set parameter is useful when aggregation of information results in

incomplete path information.

You can verify your settings by entering the show ip bgp aggregate command.

Example

This example shows how to propagate the network 172.0.0.0 and suppress a more

specific route called 172.10.0.0

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#aggregate-address 172.0.0.0/8 summary-only

DXS-3600-32S(config-router)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-4 bgp router-id

This command is used to configure a fixed router ID for the local Border Gateway Protocol (BGP) routing process. Use

the no form of this command to remove the fixed router ID from the running configuration file and restore the default

router ID selection.

bgp router-id IP-ADDRESS

no bgp router-id

Parameters

7-5 bgp aggregate-next-hop-check

This command is used to enable the checking of next hop of the BGP aggregated routes. Only the routes with the

same next hop attribute can be aggregated if the BGP aggregate next hop check is enabled. Using the no form of this

command is to disable the bgp aggregate-next-hop-check.

bgp aggregate-next-hop-check

no bgp aggregate-next-hop-check

IP-ADDRESS Configures the router ID in IPv4 address format as the identifier of the local router

running BGP.

Default

The local router ID is selected by the following rules when this command is disabled:

If a loopback interface is configured, the router ID is set to the IP address of the

loopback. If multiple loopback interfaces are configured, the loopback with the

highest IP address is used.

If no loopback interface is configured, the router ID is set to the highest IP address

on a physical interface.

Command Mode

Router Configuration.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

The bgp router-id command is used to configure a fixed router ID for a local BGP

routing process. The address of a loopback interface is preferred to an IP address on

a physical interface because the loopback interface is more effective than a fixed

interface as an identifier because there is no physical link to go down.

You must specify a unique router ID within the network. This command will reset all

active BGP peering sessions. It is recommended to configure a loopback interface,

since the physical interface link may be up/down/removed for some reason.

You can verify your settings by entering the show ip bgp parameters command.

Example

This example shows how to change the router ID to 192.168.1.1

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65100

DXS-3600-32S(config-router)#bgp router-id 192.168.1.1

DXS-3600-32S(config-router)#

Parameters

None.

Default

The default option is disabled.

Command Mode

Router Configuration.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-6 bgp always-compare-med

This command is used to enable the comparison of the Multi Exit Discriminator (MED) for paths from neighbors in

different autonomous systems. Use the no form of this command to disallow the comparison.

bgp always-compare-med

no bgp always-compare-med

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command is used to enable the checking of next hop of the BGP aggregated

routes. Only the routes with the same next hop attribute can be aggregated if the

BGP aggregate next hop check is enabled. Using the no form of this command is to

disable the bgp aggregate-next-hop-check.

You can verify your settings by entering the show ip bgp parameters command.

Example

This example shows how to configure the BGP aggregate-next-hop-checking state.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#bgp aggregate-next-hop-check

DXS-3600-32S(config-router)#

Parameters

None.

Default

The default option is disabled.

Command Mode

Router Configuration.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

The MED, as stated in RFC 1771, is an optional non-transitive attribute that is a four

octet non-negative integer. The value of this attribute may be used by the BGP best

path selection process to discriminate among multiple exit points to a neighboring

autonomous system.

The MED is one of the parameters that are considered when selecting the best path

among many alternative paths. The path with a lower MED is preferred over a path

with a higher MED. During the best-path selection process, MED comparison is done

only among paths from the same autonomous system. The bgp always-compare-

med command is used to change this behavior by enforcing MED comparison

between all paths, regardless of the autonomous system from which the paths are

received.

The bgp deterministic-med command can be configured to enforce deterministic

comparison of the MED value between all paths received from within the same

autonomous system.

You can verify your settings by entering show ip bgp parameters command.

Example

This example shows how to configure the switch to compare the MED from

alternative paths, regardless of the autonomous system from which the paths are

received.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#bgp always-compare-med

DXS-3600-32S(config-router)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-7 bgp bestpath as-path ignore

This command is used to not consider the as-path factor in selection of the best path. Use the no form of this command

to restore default behavior and configure BGP to consider the AS-path during route selection.

bgp bestpath as-path ignore

no bgp bestpath as-path ignore

7-8 bgp bestpath compare-confed-aspath

This command is used to configure a BGP routing process to compare the confederation AS path length of the routes

received. To return the BGP routing process to the default operation, use the no form of this command.

bgp bestpath compare-confed-aspath

no bgp bestpath compare-confed-aspath

Parameters

None.

Default

AS path is considered when the best path selects.

Command Mode

Router Configuration.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

The following are the best path selection rules.

• If the next hop associated with the route is unreachable, then the route is dropped.

• Then route with the largest weight is selected.

• If weight cannot determine, then the largest LOCAL-PREF is used to determine

the preferred route.

• If still cannot determine the preferred route, then the route with the shortest AS-

PATH list is preferred.

• If still cannot determine the preferred route, then lowest origin type is preferred.

• If still cannot determine the preferred route, then the lowest MED is preferred.

• If still cannot determine the preferred route, eBGP is preferred over iBGP paths.

• Prefer the path with the lowest IGP metric to the BGP next hop.

• Determine if multiple paths require installation in the routing table for BGP

Multipath.

• When both paths are external, prefer the path that was received first (the oldest

one).

• Prefer the route that comes from the BGP router with the lowest router ID.

• If the originator or router ID is the same for multiple paths, prefer the path with the

minimum cluster list length.

• Prefer the path that comes from the lowest neighbor address.

You can use the commands, bgp bestpath as-path ignore, bgp bestpath

compare-router-id or bgp default local-preference to customize the path selection

process.

You can verify your settings by entering show ip bgp parameters command.

Example

This example shows how to configure the switch to ignore the AS-PATH for the best

path for the autonomous system 65534.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#bgp bestpath as-path ignore

DXS-3600-32S(config-router)#

Parameters

None.

Default

By default, this option is disabled.

Command Mode

Router Configuration.

Command Default Level

Level: 8. (EI Mode Only Command)

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-9 bgp bestpath compare-routerid

This command is used to compare the router ID for identical eBGP paths. Use the no command to revert to disable this

function.

bgp bestpath compare-routerid

no bgp bestpath compare-routerid

7-10 bgp bestpath med confed

This command is used to configure a BGP routing process to compare the Multi Exit Discriminator (MED) between

paths learned form confederation peers. To disable MED comparison of paths received from confederation peers, use

the no form of this command.

bgp bestpath med confed

no bgp bestpath med confed

Usage Guideline

If enabled, the BGP process will compare the confederation AS path length of the

routes received. The shorter the confederation AS path length, the better the route

is.

You can verify your settings by entering show ip bgp parameters command.

Example

This example shows how to enable the BGP process to compare the AS path that

contains some confederation AS numbers.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#bgp bestpath compare-confed-aspath

DXS-3600-32S(config-router)#

Parameters

None.

Default

BGP receives routes with identical eBGP paths from eBGP peers and selects the

first route received as the best path.

Command Mode

Router Configuration.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

When comparing similar routes from peers the BGP router does not consider router

ID of the routes. By default, it selects the first received route. Use this command to

include router ID in the selection process; similar routes are compared and the route

with lowest router ID is selected. The router-id is the highest IP address on the

router, with preference given to loopback addresses. Router ID can be manually set

by using the bgp router-id command.

You can verify your settings by entering show ip bgp parameters command.

Example

This example shows how to configure to compare the router ID for identical eBGP

paths for the autonomous system 65534.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#bgp bestpath compare-routerid

DXS-3600-32S(config-router)#

Parameters

None.

Default

By default, this option is disabled.

Command Mode

Router Configuration.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-11 bgp bestpath med missing-as-worst

This command is used to configure the BGP routing process to assign a value of infinity to routes that are missing the

Multi Exit Discriminator (MED) attribute (making the path, without an MED value, the least desirable path). To return the

router to the default behavior (assigning a value of 0 to the missing MED), causing this path, as the best path, to be

chosen, use the no form of this command.

bgp bestpath med missing-as-worst

no bgp bestpath med missing-as-worst

7-12 bgp client-to-client reflection

This command is used to enable the local BGP router to be a route reflector. To disable client-to-client route reflection,

use the no form of this command.

bgp client-to-client reflection

no bgp client-to-client reflection

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

If enabled, the BGP process will compare the MED for the routes that are received

from confederation peers. For routes that have an external AS in the path, the

comparison does not occur.

You can verify your settings by entering show ip bgp parameters command.

Example

This example shows how the BGP routing process is configured to compare MED

values for paths learned from confederation peers.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#bgp bestpath med confed

DXS-3600-32S(config-router)#

Parameters

None.

Default

By default, this option is disabled.

Command Mode

Router Configuration Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

If enabled, the BGP process will assign a value of infinity to routes that are missing

the Multi Exit Discriminator (MED) attribute. If disabled, the BGP process will assign

a value of zero to routes that are missing the Multi Exit Discriminator (MED) attribute,

causing this route to be chosen as the best path.

You can verify your settings by entering show ip bgp parameters command.

Example

This example shows how to enable the BGP router process to consider a route with

a missing MED attribute as having a value of infinity, making this path the least

desirable path.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 100

DXS-3600-32S(config-router)#bgp bestpath med missing-as-worst

DXS-3600-32S(config-router)#

Parameters

None.

Default

By default, this option is enabled.

Command Mode

Router Configuration Mode.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-13 bgp cluster-id

This command is used to configure the cluster ID of the route reflector. To remove the cluster ID, use the no form of this

command.

bgp cluster-id CLUSTER-ID

no bgp cluster-id

Parameters

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

By default, the clients of a router reflector are not required to be fully meshed and the

routes from a client are reflected to other clients. However, if the clients are fully

meshed, route reflection is not required. In this case, use the no bgp client-to-client

reflection command to disable client-to-client reflection.

Use the show ip bgp reflection command to verify your settings.

Example

This example shows how to enable the route reflector function of the local router.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 100

DXS-3600-32S(config-router)#bgp client-to-client reflection

DXS-3600-32S(config-router)#

CLUSTER-ID Specifies the cluster ID, in the IPv4 address format, for the router reflector.

Default

By default, this value is the local router’s ID.

Command Mode

Router Configuration Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

When a single route reflector is deployed in a cluster and the cluster ID of the route

reflector is 0.0.0.0, the cluster is identified by the router ID of the route reflector.

Otherwise, the cluster is identified by the cluster ID.

This command is used to assign a cluster ID to a route reflector. Multiple route

reflectors are deployed in a cluster to increase redundancy and to avoid a single

point of failure. When multiple route reflectors are configured in a cluster, they must

be configured with the same cluster ID. This allows all route reflectors, in the cluster,

to recognize updates from the peers in the same cluster and reduces the number of

updates that needs to be stored in BGP routing tables.

This command is only required for the reflector and not for the client.

Use the show ip bgp reflection command to verify your settings.

Example

In the following example, the local router is one of the route reflectors serving the

cluster. It is configured with a cluster ID to identify the cluster.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 100

DXS-3600-32S(config-router)#neighbor 172.18.0.16 route-reflector-client

DXS-3600-32S(config-router)#bgp cluster-id 10.0.0.2

DXS-3600-32S(config-router)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-14 bgp confederation identifier

This command is used to specify the BGP confederation identifier. Use the no form of this command to remove the

confederation identifier.

bgp confederation identifier AS-NUMBER

no bgp confederation identifier

Parameters

7-15 bgp confederation peers

This command is used to add BGP confederation peers. Use the no form of this command to delete the confederation

peers.

bgp confederation peers ASPATH-LIST

no bgp confederation peers ASPATH-LIST

Parameters

AS-NUMBER Specifies the Autonomous System number, used to specify the BGP confederation.

This value must be between 1 and 4294967295. The AS TRANS value is 23456.

Default

None.

Command Mode

Router Configuration Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

A confederation can be used to reduce the internal BGP (iBGP) mesh by dividing a

large single AS into multiple subs-ASs. External peers interact with the

confederation as if it is a single AS.

Each subs-AS is fully meshed within itself and it has connections to other sub-ASs

within the confederation. The next-hop, Multi Exit Discriminator (MED), and local

preference information is preserved throughout the confederation, allowing users to

retain a single Interior Gateway Protocol (IGP) for all the autonomous systems.

Use the show ip bgp confederation command to verify your settings.

Example

This example shows how to create a confederation in which the AS number is 20.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 100

DXS-3600-32S(config-router)#bgp confederation identifier 20

DXS-3600-32S(config-router)#

ASPATH-LIST Specifies one or multiple AS number partitions, separated by a comma. This value

must be between 1 and 4294967295, however, for the AS TRANS, this value must

be 23456. This parameter specifies Autonomous System numbers for BGP peers

that will belong to the confederation.

Default

None.

Command Mode

Router Configuration Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-16 bgp dampening

This command is used to enable BGP route dampening or to change the BGP route dampening parameters. To disable

BGP dampening, use the no form of this command.

bgp dampening [[HALF-LIFE REUSE SUPPRESS MAX-SUPPRESS-TIME UN-REACHABILTY-HALF-TIME] |

[route-map MAP-NAME]]

no bgp dampening [route-map]

Parameters

Usage Guideline

The command is used to configure multiple adjacent Autonomous Systems in a

confederation. The Autonomous Systems, specified in this command, are visible

internally to the confederation. Each Autonomous System is fully meshed within itself

or configures a route reflector.

Use the no bgp confederation peers command to delete all the or part of the AS

numbers, configured earlier.

Use the show ip bgp confederation command to verify your settings.

Example

In the following example, Autonomous Systems 21, 22, 23, 24, and 25 are

configured to belong to a single confederation using the identifier 10.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 100

DXS-3600-32S(config-router)#bgp confederation identifier 10

DXS-3600-32S(config-router)#bgp confederation peers 21,22,23,24,25

DXS-3600-32S(config-router)#

Example

This example shows how to delete part of the AS numbers, configured earlier.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 100

DXS-3600-32S(config-router)#no bgp confederation peers 21,22

DXS-3600-32S(config-router)#

HALF-LIFE Specifies the time, in minutes, after which the penalty of the reachable routes will be

down, by half.

REUSE If the penalty for a flapping route decreases enough to fall below this value, the route

is unsuppressed.

SUPPRESS A route is suppressed when its penalty exceeds this limit.

MAX-SUPPRESS-TIME Specifies the maximum time, in minutes, that a route can be suppressed.

UN-REACHABILITY-HALF-

LIFE

Specifies the time, in minutes, after which the penalty of the unreachable route will

be down, by half.

MAP-NAME Specifies the route map name for configuring the dampening running configuration.

The maximum length is 16 characters.

Default

BGP dampening is disabled by default. The following values are used when this

command is enabled, without configuring any optional arguments:

Half-life:15 minutes.

Reuse: 750.

Suppress: 2000.

Max-suppress-time: 60 minutes.

Un-reachability-half-life: 15 minutes.

Command Mode

Router Configuration Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-17 bgp default ipv4-unicast

This command is used to enable the IPv4 unicast address family as the default address family for BGP peer session

establishment. The no form of this command disables the default IPv4 unicast address family for BGP peer session

establishment.

bgp default ipv4-unicast

no bgp default ipv4-unicast

Usage Guideline

The purpose of this command is to eliminate the dampening of routes and thus to

avoid unstable networks caused by flapping routes.

The following describes the way it is achieved. When a route flaps (from up to down),

it will add a penalty value, of 1000, to the frame. Since the penalty is smaller than the

suppress value, BGP will function normally. It will send a withdraw message (an

update message) to the neighbors. The penalty of the route will decrease as time

elapses.

Here we assume that if it passes 7.5 minutes, then the penalty of the route is 1000-

500*7.5/15=750. If another flap occurs (the route changes from down to up) then the

penalty of the route will be 1750, which is larger than the suppress value, and the

route will be dampened. BGP will not send an update message for this status

change.

When the penalty of the route decreases and becomes smaller than the re-use value

(800), the route will not be dampened and the update message will be sent again.

Lastly, the ‘max-suppress-time’ is the longest time the route may be suppressed. So,

it decides the maximum penalty a route may suffer, regardless of the number of

times that the prefix is dampened. Here is the formula:

Maximum - Penalty = Reuse - Value *

Max-sup press-time / Half-life

You can verify your settings by entering the show ip bgp dampening parameters

command.

Note: If the dampening ability is enabled and there are one or more dampened

routes, the dampened routes will be released to function in the normal state

immediately after we disabled the dampening function.

Example

This example shows how to enable BGP dampening, set the half-life value to 20

minutes, the reuse value to 100, the suppress value to 6000, the maximum suppress

time to 120 minutes, and the un-reachability-half-life value to 20 minutes.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 100

DXS-3600-32S(config-router)#bgp dampening 20 100 6000 120 20

DXS-3600-32S(config-router)#

Example

This example shows how to apply BGP damping to prefixes, filtered by the route-

map called ‘mymap1’.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#ip prefix-list pp1 permit 100.2.0.0/16

DXS-3600-32S(config)#route-map mymap1

DXS-3600-32S(config-route-map)#match ip address prefix-list pp1

DXS-3600-32S(config-route-map)#exit

DXS-3600-32S(config)#router bgp 100

DXS-3600-32S(config-router)#bgp dampening route-map mymap1

DXS-3600-32S(config-router)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-18 bgp default local-preference

This command is used to change the default local preference value. To return the local preference value to the default

setting.

bgp default local-preference NUMBER

no bgp default local-preference

Parameters

None.

Default

None.

Command Mode

Router Configuration.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command is used to enable the automatic establish BGP peer connection and

exchange of IPv4 unicast address family prefixes. If the no bgp default ipv4-

unicast command is executed, the neighbor activate address family configuration

command must be executed in each IPv4 address family session before prefix

exchange will occur. The no bgp default ipv4-unicast command is often executed

in PE routers when exchanging VPN IPv4 routes. You can verify your settings by

entering the show ip bgp parameters command.

Example

This example shows how to disable the default IPv4 unicast address family for BGP

peer session establishment.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)# router bgp 10

DXS-3600-32S(config-router)# no bgp default ipv4-unicast

DXS-3600-32S(config-router)# exit

DXS-3600-32S(config)#

NUMBER Specifies the range of the local reference. This value must be between 0 and

4294967295.

Default

By default, this option is disabled. BGP sets the default local preference value to100.

Command Mode

Router Configuration Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

The local preference attribute is a discretionary attribute that is used to apply the

degree of preference to a route during the BGP best path selection process.

This attribute is exchanged only between iBGP peers and is used to determine the

local policy. The route with the highest local preference is preferred.

You can verify your settings by entering the show ip bgp parameters command.

Example

This example shows how to configure the default value of the local preference to 200

for the autonomous system 65534.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#bgp default local-preference 200

DXS-3600-32S(config-router)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-19 bgp deterministic-med

This command is used to include the Multi Exit Discriminator (MED) value between all paths received from within the

same autonomous system in the process of the best route selection. Use the no command to prevent BGP from

considering the MED attribute in comparing paths.

bgp deterministic-med

no bgp deterministic-med

7-20 bgp enforce-first-as

This command is used to enforce the first AS for eBGP routes. To disable this feature, use the no form of this

command.

bgp enforce-first-as

no bgp enforce-first-as

Parameters

None.

Default

By default, this option is disabled.

Command Mode

Router Configuration Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command is used to enable the comparison of the Multi Exit Discriminator

(MED) for paths from neighbors in different autonomous systems. After this

command is configured, all paths for the same prefix, that are received from different

neighbors, which are in the same autonomous system, will be grouped together and

sorted by the ascending MED value (received-only paths are ignored and not

grouped or sorted).

The best path selection algorithm will then pick the best paths using the existing

rules. The comparison is made on a peer neighbor autonomous system basis and

then the global basis. The grouping and sorting of paths occurs immediately after

this command was entered. For the correct results, all routers in the local

autonomous system must have this command enabled (or disabled).

This command can also be configured to enforce a deterministic comparison of the

MED values between all paths received from within the same autonomous system.

You can verify your settings by entering the show ip bgp parameters command.

Example

This example shows how to configure to switches to enable the compare MED value

for autonomous system 65534,

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#bgp deterministic-med

DXS-3600-32S(config-router)#

Parameters

None.

Default

By default, this option is disabled.

Command Mode

Router Configuration Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command specifies that any updates received from an external neighbor, that

do not have neighbor’s configured in an Autonomous System at the beginning of the

AS-PATH attribute in the received update, must be denied. Enabling this feature

adds to the security of the BGP network by not allowing traffic from unauthorized

systems.

You can verify your settings by entering the show ip bgp parameters command.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-21 bgp fast-external-fallover

This command is used to configure the Border Gateway Protocol (BGP) routing process to immediately reset external

BGP peering sessions if the link used to reach these peers goes down. To disable the BGP fast external fallover option,

use the no form of this command.

bgp fast-external-fallover

no bgp fast-external-fallover

7-22 clear ip bgp

This command is used to reset Border Gateway Protocol (BGP) connections using a hard or soft reconfiguration.

clear ip bgp {all | AS-NUMBER | IP-ADDRESS} [soft [{in [prefix-filter] | out}]]

Parameters

Example

This example shows how to enable the security of the BGP network for the

autonomous system 65534. All incoming updates from eBGP peers are examined to

ensure that the first AS number in the AS-PATH attribute is the local AS number of

the transmitting peer.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#bgp enforce-first-as

DXS-3600-32S(config-router)#

Parameters

None.

Default

By default, this option is enabled.

Command Mode

Router Configuration Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command is used to disable or enable the fast external fallover for BGP peering

sessions with directly connected external peers. The session will immediately reset if

a link goes down. Only directly connected peering sessions are supported.

If the BGP fast external fallover is disabled, the BGP routing process will wait until

the default hold timer expires (3 keepalives) to reset the peering session.

You can verify your settings by entering the show ip bgp parameters command.

Example

In the following example, the BGP fast external fallover feature is disabled. If the link

through which this session is carried flaps, then the connection will not reset.

DXS-3600-32S#configure terminal

DXS-3600-32S(config)#router bgp 65534

DXS-3600-32S(config-router)#no bgp fast-external-fallover

DXS-3600-32S(config-router)#

all (Optional) Specifies the reset of all sessions except those in the VRF address family.

AS-NUMBER Specifies that sessions, with BGP peers, in the specified autonomous system the will

be reset. The range for 2-byte numbers is from 1 to 65535. The range for 4-byte

numbers is from 1 to 4294967295.

IP-ADDRESS Specifies that only the identified BGP neighbor will reset. The value for this argument

is an IPv4 address.

in (Optional) Specifies to initiate an inbound reconfiguration. If neither the in nor the out

keywords are specified, both inbound and outbound sessions will reset.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-23 clear ip bgp vrf

This command is used to reset BGP connections using hard or soft reset for IPv4 VRF address family sessions.

clear ip bgp vrf VRF-NAME {all | IP-ADDRESS | AS-NUMBER} [soft [{in [prefix-filter] | out}]]

prefix-filter (Optional) Specifies to clear the existing outbound route filter (ORF) prefix list to

trigger a new route refresh or soft reconfiguration, which updates the ORF prefix list.

out (Optional) Specifies to initiate inbound or outbound reconfiguration. If neither the in

nor the out keywords are specified, both inbound and outbound sessions will reset.

soft (Optional) Specifies to initiate a soft reset. Does not tear down the session.

Default

None.

Command Mode

Privileged Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command can be used to initiate a hard reset or soft reconfiguration of BGP

neighbor sessions.

If a hard reset is applied to the inbound session, the inbound session will be torn

down and the local inbound routing table and the remote outbound routing table will

be cleared.

If a soft reset is applied to the inbound session, the session will not be rebuilt but the

local inbound routing table will be cleared and needs to be rebuilt.

If a soft reconfiguration inbound is enabled, then the routing table can be rebuilt

based on the stored route update information. If a soft reconfiguration inbound is

disabled, then the local router will send a route refresh request to the neighbor to ask

for the route refresh.

When the inbound session undergoes a soft reset with the prefix filter option, and the

capability of the prefix-list is enabled, in the sending direction, then the local BGP will

send a ‘clear the routing table’ request, and notify the remote neighbor for the prefix

filter.

This is a way to notify the neighbor of the prefix filter whenever a change is made to

the prefix filter.

Example

In the following example, a soft reconfiguration is initiated for the inbound session

with the neighbor 10.100.0.1, and the outbound session is unaffected.

DXS-3600-32S#clear ip bgp 10.100.0.1 soft in

DXS-3600-32S#

Example

In the following example, the route refresh capability is enabled on BGP neighbor

routers. The existing outbound route filter (ORF) prefix list from the peer 172.16.10.2

is cleared, The new route refresh, which updates the ORF prefix list, is triggered.

DXS-3600-32S#clear ip bgp 172.16.10.2 soft in prefix-filter

DXS-3600-32S#

Example

In the following example, a hard reset is initiated for sessions with all routers in the

autonomous system numbered 35700.

DXS-3600-32S#clear ip bgp 35700

DXS-3600-32S#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

Parameters

7-24 clear ip bgp vpnv4

This command is used to reset BGP connections using a soft reset for IPv4 VPN address family sessions.

clear ip bgp vpnv4 unicast {all | IP-ADDRESS } [soft [{in [prefix-filter] | out}]]

Parameters

vrf VRF-NAME Specifies the VRF name.

all Specifies to reset all BGP sessions in the IPv4 VRF address family.

IP-ADDRESS Specifies to only reset the BGP neighbor with the IP address in the VRF address

family.

AS-NUMBER Specifies to only reset the BGP neighbor with the AS number in the VRF address

family.

soft (Optional) Specifies a soft reset. The session is not torn down.

in (Optional) Specifies an inbound reset. If neither the in nor out parameter is

specified, both the inbound and outbound sessions are reset.

prefix-filter (Optional) Clears the existing outbound route filter (ORF) prefix list to trigger a new

route refresh or soft reconfiguration, which updates the ORF prefix list.

out (Optional) Specifies an outbound reset. If neither the in nor out parameters is

specified, both inbound and outbound sessions are reset.

Default

None.

Command Mode

Privileged Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command can be used to initiate a hard reset or soft reset of BGP neighbor

sessions.

If a hard reset is applied to the inbound session, the inbound session will be torn

down and the local inbound routing table and the remote outbound routing table will

be cleared.

If a soft reset is applied to the inbound session, the session will not be rebuilt but the

local inbound routing table will be cleared and needs to be rebuilt.

If a soft reset inbound is enabled, then the routing table can be rebuilt based on the

stored route updates information. If a soft reset inbound is disabled, then the local

router will send the route refresh request to the neighbor to ask for the route refresh.

When the inbound session is soft reset with the prefix filter option, and the capability

orf prefix-list is enabled in the send direction, then the local BGP will send ‘clear the

routing table’, and notify the remote neighbor for the prefix filter.

This command can only take effect for the sessions in VRF address family.

Example

In the following example, a soft reset is initiated for the inbound session for all

neighbors those have been created in the view of vrf and the outbound session is

unaffected.

DXS-3600-32S#clear ip bgp vrf VPN-A all soft in

DXS-3600-32S#

all Specifies to reset all BGP sessions in VPN address family.

IP-ADDRESS Specifies to only reset the BGP neighbor with the IP address.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide

7-25 clear ip bgp dampening

This command is used to clear BGP route dampening information for the IPv4 unicast address family and to restore

suppressed routes.

clear ip bgp dampening [{NETWORK-ADDRESS | IP-ADDRESS}]

Parameters

soft Specifies a soft reset. The session is not torn down.

in (Optional) Specifies an inbound reset. If neither the in nor out parameter is

specified, both inbound and outbound sessions are reset.

prefix-filter (Optional) Clears the existing outbound route filter (ORF) prefix list to trigger a new

route refresh or soft reconfiguration, which updates the ORF prefix list.

out (Optional) Specifies an outbound reset. If neither the in nor out parameter is

specified, both inbound and outbound sessions are reset.

Default

None.

Command Mode

Privileged Mode.

Command Default Level

Level: 8. (EI Mode Only Command)

Usage Guideline

This command can only be used to initiate a soft reset of BGP neighbor sessions for

VPNv4 address family.