Disables the sending of the INITIAL-CONTACT message in the IKEv1 protocol after the node creates a new Phase1 SA, caused either by Dead Peer Detection or by a rekey.

no

Disables this command, which re-enables the sending of the INITIAL-CONTACT message.

Configures the rekeying of Phase1 SA when the Internet Security Association and Key Management Protocol (ISAKMP) lifetime expires in Internet Key Exchange (IKE) v1 protocol.

no

Re-enables Phase 1SAs when the ISAKMP lifetime expires.

Configures the ISAKMP IPSec Dead Peer Detection (DPD) message parameters for IKE v1 protocol.

no

Deletes previously configured IPSec DPD Protocol settings.

dpd interval interval

Specifies the time interval (in seconds) at which IPSec DPD Protocol messages are sent. interval is an integer from 10 through 3600.

timeout time

Specifies the amount of time (in seconds) allowed for receiving a response from the peer security gateway prior to re-sending the message. time is an integer from 10 through 3600.

num-retry retries

Specifies the maximum number of times that the system should attempt to reach the peer security gateway prior to considering it unreachable. retries is an integer from 1 through 100.

Configures or creates an ISAKMP policy with the specified priority and enters ISAKMP Configuration Mode for IKE v1 protocol.

no

Removes a previously configured ISAKMP policy for IKE v1 protocol.

priority

Specifies the priority of an ISAKMP policy as an integer from 0 through 100. ISAKMP policies for IKE v1 protocol with lower priority numbers take precedence over policies with higher priorities. "0" is the highest priority. Default: 0

Creates a new, or specifies an existing, IKEv2 security association parameters and enters the IKEv2 Security Association Configuration Mode.

Important

In Release 20, 21.0 and 21.1, HeNBGW is not supported. This command must not be used for HeNBGW in these releases. For more information, contact your Cisco account representative.

default

Sets the IKEv2 IKESA Diffie-Hellman related parameter to its default value.

Default: 14

no

Removes the entered IKEv2 security association parameters.

auth-method-set auth_method_set_name

Configure an IKEv2 IKE Security Association Auth-Method Set. Applicable for IKEv2 subscriber-mode based products, This object encapsulates various Authentication methods.

auth_method_set_name is the context level name to be used for the IKEv2 IKE Security Association Authentication methods Set, which is a string of size 1 to 127.

certificate policy policy_name

certificate : Configures certificate related configuration to be associated to crypto template.

policy : Configures certificate policy to be used for certificate related auth method.

policy_name is the context level name to be used for the IKEv2 Security Association Cert Policy, which is a string of size 1 to 127.

ddos

Configures the IKEv2 DDoS mitigation Parameters.

Configures the source IPv4 or IPv6 address to be blacklisted.

Configures the IKEv2 DDoS mitigation parameters for INIT Floods.

Configures the IKEv2 DDoS mitigation parameters for UDP errors.

dh-group

Configures the IKEv2 IKESA Diffie-Hellman related parameters.

Configures the Diffie-Hellman Group 1, 768-bit MODP Group.

Configures the Diffie-Hellman 14, 2048-bit MODP Group.

Configures the Diffie-Hellman 2, 1024-bit MODP Group.

Configures the Diffie-Hellman 5, 1546-bit MODP Group.

Configures the reuse responders key-pair for DH group(s).

Indicates that more than one of the previous keywords can be entered within a single command.

source-based threshold-upper threshold_upper_value threshold-lower threshold_lower_value poll-timer-duration poll_timer_duration_value:

Configures the IKEv2 DDoS mitigation parameters for INIT Floods applicable at source IP address level.

threshold-upper threshold_upper_value : Configures upper threshold value for INIT floods, after which alarm will be raised. threshold_upper_value must be an integer from 100 to 4294967295. Default: 10000.

threshold-lower threshold_lower_value : Configures lower threshold value for INIT floods, after which alarm will be cleared. threshold_lower_value must be an integer from 50 to 4294967294. Default: 5000.

poll-timer-duration poll_timer_duration_value : Configures IKEv2 DDoS INIT Floods timer duration in seconds. poll_timer_duration_value must be an integer from 30 to 3600. Default: 60 seconds.

system-based threshold-upper threshold_upper_value threshold-lower threshold_lower_value poll-timer-duration poll_timer_duration_value :

Configures the IKEv2 DDoS mitigation parameters for INIT Floods applicable at system level.

threshold-upper threshold_upper_value : Configures the upper threshold value for INIT floods, after which alarm will be raised. threshold_upper_value must be an integer from 1000 to 4294967295. Default: 100000.

threshold-lower threshold_lower_value : Configures the lower threshold value for INIT floods, after which alarm will be cleared. threshold_lower_value must be an integer from 500 to 4294967294. Default: 50000.

poll-timer-duration poll_timer_duration_value : Configures the IKEv2 DDoS INIT floods timer duration in seconds. poll_timer_duration_value must be an integer from 60 to 3600. Default: 60 seconds.

transform-set transform_set_name

Configure an IKEv2 IKE Security Association Transform Set. This object encapsulates various IKEv2 IKE algorithm configurations which are required for establishing and IKEv2 IKE Security Assocation with a remote peer.

transform_set_name is the context level name to be used for the IKEv2 IKE Security Association Transform Set, which is a string of size 1 to 127.

This command enables the creation, configuration or deletion of an IMS authorization service in the current context.

no

Deletes the specified IMS authorization service within the current context.

default

Restores default state of IMS authorization service, disabled for a specific context.

auth_svc_name

Specifies name of the IMS authorization service as a unique alphanumeric string of 1 through 63 characters.

In releases prior to 18, a maximum of 16 authorization services can be configured globally in the system. There is also a system limit for the maximum number of total configured services. In 18 and later releases, up to a maximum of 30 IMS authorization service profiles can be configured within the system.

Important

Service names must be unique across all contexts within the system.

-noconfirm

Executes the command without any additional prompt and confirmation from the user.

Creates the specified IP Multimedia Subsystem (IMS) Sh service name to allow configuration of an Sh service.

no

Removes a previously configured IMS-Sh-service.

name

Specifies the name of the IMS-Sh-service to be configured as an alphanumeric string of 1 through 63 characters.

Important

Service names must be unique across all contexts within a chassis.

Configures a context-level inspector account within the current context.

no

Removes a previously configured inspector account.

user_name

Specifies a name for the context-level inspector account as an alphanumeric string of 1 through 32 characters.

[ encrypted ] password password

Specifies the password to use for the user which is being given context-level inspector privileges within the current context. The encrypted keyword indicates the password specified uses encryption.

password is an alphanumeric string of 1 through 63 characters without encryption, or 1 through 127 characters with encryption.

The encrypted keyword is intended only for use by the system while saving configuration scripts. The system displays the encrypted keyword in the configuration file as a flag that the variable following the password keyword is the encrypted version of the plain text password. Only the encrypted password is saved as part of the configuration file.

[ nopassword ]

This option allows you to create an inspector without an associated password. Enable this option when using ssh public keys (authorized key command in SSH Configuration mode) as a sole means of authentication. When enabled this option prevents someone from using an inspector password to gain access to the user account.

ecs | noecs

Default: noecs

ecs : Permits the specific user to access ACS-specific configuration commands.

noecs : Prevents the specific user to access ACS-specific configuration commands.

expiry-date date_time

Specifies the date and time that this account expires. Enter the date and time in the format YYYY:MM:DD:HH:mm or YYYY:MM:DD:HH:mm:ss.

Where YYYY is the year, MM is the month, DD is the day of the month, HH is the hour, mm is minutes, and ss is seconds.

li-administration

Refer to the Lawful Intercept Configuration Guide for a description of this parameter.

noconsole

Disables user access to a Console line.

Note	The Global Configuration mode local-user allow-aaa-authentication noconsole command takes precedence in a normal (non-Trusted) StarOS build. In this case, all AAA-based users cannot access a Console line.

timeout-absolute abs_seconds

This keyword is obsolete. It has been left in place for backward compatibility. If used a warning is issued and the value entered is rounded to the nearest whole minute.

Specifies the maximum amount of time (in seconds) the context-level inspector may have a session active before the session is forcibly terminated. abs_seconds must be an integer from 0 through 300000000. The value 0 disables the absolute timeout. Default: 0

timeout-min-absolute abs_minutes

Specifies the maximum amount of time (in minutes) the context-level inspector may have a session active before the session is forcibly terminated. abs_minutes must be an integer from 0 through 525600 (365 days). The value 0 disables the absolute timeout. Default: 0

timeout-idle timeout_duration

This keyword is obsolete. It has been left in place for backward compatibility. If used a warning is issued and the value entered is rounded to the nearest whole minute.

Specifies the maximum amount of idle time (in seconds) the context-level inspector may have a session active before the session is terminated. timeout_duration must be an integer from 0 through 300000000. The value 0 disables the idle timeout. Default: 0

timeout-min-idle idle_minutes

Specifies the maximum amount of idle time (in minutes) the context-level inspector may have a session active before the session is terminated. idle_minutes must be an integer from 0 through 525600 (365 days). The value 0 disables the idle timeout. Default: 0

[ max-age days]

Defines the maximum age of a user password before it has to be changed. max-age is the replacement for expiry-date .

[ no-max-age ]

This parameter ensures that password never expires (these are non expiring passwords).

exp-warn-interval days

Impends password expiry warning interval in days. There is no default value at per user level. If any of the value is specified, Context global values are considered.

inspector trexpac111 password pass@1234

In the previous example, there are no values for expiry, grace, and warn are provided. In this case, Global values for both of them will be considered.

[ no-exp-warn-interval ]

Disables impending password expiry warnings .

exp-grace-interval days

Specifies password expiry grace interval in days. Default = 3 days after expiry.

[ no-exp-grace-interval ]

Disables grace period of expired password.

Creates or deletes an interface or specifies an existing interface. By identifying an interface, the mode changes to configure this interface in the current context.

no

Removes the specified interface.

name

Specifies the name of the interface to configure. If name does not refer to an existing interface, the new interface is created if resources allow. name is an alphanumeric string of 1 through 79 characters.

broadcast

Creates an Ethernet broadcast (IP) interface and enters the Ethernet Configuration Mode. Default: Enabled

Important

Refer to the Ethernet Interface Configuration Mode Command chapter for more information.

loopback

Creates an internal IP address that is always UP, is not bound to any physical card/port, and can be reached by any interface configured in the current context. As a loopback interface uses all available physical ports, this type of interface is particularly useful for load-balancing. The interface must be configured for loopback when configuring Interchassis Session Recovery (ICSR). A total of 256 loopback interfaces can be configured. Default: Disabled

This loopback option is not used to setup a diagnostic test port so it should not be confused with the loopback option used in the various card/port configuration modes.

Important

Refer to the Loopback Interface Configuration Mode Command chapter for more information.

point-to-point

Creates a permanent virtual connection (PVC) in the current context and enters the PVC Configuration Mode. Currently, this type of interface is only used with an optical (ATM) line card.

Important

Refer to the PVC Interface Configuration Mode Command chapter for more information.

tunnel

Creates a tunnel interface to support the various tunnel interfaces. Currently only IPv6-over-IPv4 and GRE tunnel interfaces are supported.

Important

Refer to the Tunnel Interface Configuration Mode Commands chapter for more information.

unnumbered

Creates an unnumbered IP interface within the context. An unnumbered interface enables IP processing without assigning an explicit IP address to the interface. In StarOS this type of interface supports an untagged BFD port. The only parameter for this type of interface is a text description.

Important

Refer to the Unnumbered Interface Configuration Mode Commands chapter for more information.

Configures an access group with an Access Control List (ACL) for IP traffic for the current context. The Context-level ACL is applied only to outgoing packets.

no

Indicates the specified ACL rule is to be removed from the group.

name

Specifies the ACL rule to be added/removed from the group.

In Release 8.1 and later, name is an alphanumeric string of 1 through 47 characters.

In Release 8.0, name is an alphanumeric string of 1 through 79 characters.

Important

Up to eight ACLs can be applied to a group provided that the number of rules configured within the ACL(s) does not exceed the 256-rule limit for the context.

in | out

The in and out keywords are deprecated and are only present for backward compatibility. The Context-level ACL are applied only to outgoing packets.

priority_value

Specifies the priority of the access group. 0 is the highest priority. If priority_value is not specified, the priority is set to 0. priority_value must be an integer from 0 through 4294967295. Default: 0

If access groups in the list have the same priority, the last one entered is used first.

Create, configure, or delete an IP Access List in the current context.

default

Sets the context's default access control list to that specified by name .

no

Removes the specified access list.

name

Specifies the access list name.

name is an alphanumeric string of 1 through 47 characters.

If the named access list does not exist, it is created, and the CLI mode changes to the ACL Configuration Mode, wherein the access list can be configured.

If the named access list already exists, the CLI mode changes to the ACL Configuration Mode, wherein the access list can be reconfigured.

Configures the allocation retention priority (ARP) options for the current context.

no

Removes the ARP configuration data for the specified IP address from the configuration.

ip_address

Specifies the IP address for which to configure the ARP options where ip_address is an IP address expressed in IPv4 dotted-decimal notation.

mac_address

Specifies the media-specific access control layer address for the IP address. mac_address must be specified as a an 6-byte hexadecimal number with each byte separated by a colon, for example., "AA:12:bb:34:f5:0E".

vrf vrf_name

Associates a Virtual Routing and Forwarding (VRF) context with this static ARP entry.

vrf_name is name of a preconfigured virtual routing and forwarding (VRF) context configured in Context Configuration Mode via the ip vrf command.

Defines Border Gateway Protocol (BGP) Autonomous System (AS) Path access lists.

no

Remove the specified regular expression from the AS path access list.

list_name

Specifies the name of an AS path list as an alphanumeric string of 1 through 79 characters.

{ deny | permit }

deny : Denies access to AS paths that match the regular expression.

permit : Allows access to AS paths that match the regular expression.

reg_expr

A regular expression to define the AS paths to match. reg_expr is an alphanumeric string of 1 through 254 characters.

Important

The ? (question mark) character is not supported in regular expressions for this command.

Configures filtering via a BGP community list. To filter by a BGP community, you must then match the community in a route-map.

no

Entering no ip community-list with a permit/deny clause deletes the matching community-list entry. Entering no ip community-list without a permit/deny clause deletes all the entries belonging to a community-list.

named named_list

Specifies the name of a community list as an alphanumeric string of 1 through 79 characters.

standard identifier

Specifies the name of a community list as an integer from 1 through 99.

{ deny | permit }

Specifies whether this community will deny or permit access to a specified destination.

{ internet | local-AS | no-advertise | no-export | value AS-community_number

You can enter multiple destinations and AS community numbers separated by spaces.

Enables the proxy DNS functionality and identifies this context as the destination context for all redirected DNS requests.

no

Removes the address in this context as a destination for redirected DNS packets.

ip_address

Specifies an interface in this context used for redirected DNS packets. ip_address must be entered using IPv4 dotted-decimal notation.

Enables or disables domain name lookup via domain name servers for the current context.

no

Disables domain name lookup.

Configures or removes a logical domain name for the current context.

no

Indicates the logical domain name for the current context is to be removed.

name

Specifies the logical domain name to use for domain name server address resolution. name is an alphanumeric string of 1 through 1023 characters formatted to be a valid IP domain name.

Configures route target filtering via a BGP extended community list. To filter by a BGP extended community, you must then match the extended community in a route-map.

no

Entering no ip extcommunity-list with a permit/deny clause deletes the matching extended community-list entry. Entering no ip extcommunity-list without a permit/deny clause deletes all the entries belonging to an extended community-list.

named named_list

Specifies the name of an extended community list as an alphanumeric string of 1 through 79 characters.

standard identifier

Specifies the name of an extended community list as an integer from 1 through 99.

{ deny | permit }

Specifies whether this community will deny or permit access to a specific route target.

rt rt_number

Specifies a Route Target as a string in AS:NN format, where AS = 2-byte AS-community hexadecimal number and NN = 2-byte hexadecimal number (1 to 11 characters). You can enter multiple route targets separated by spaces.

Configures an IP forwarding policy to forward outgoing pool packets whose flow lookup fails to the default-gateway.

no

Disables forwarding to the default gateway.

outbound unused-pool-dest-address default-gateway

Enables forwarding to the default gateway.

Enables and disables local switching of framed route packets.

no

Disables local switching of framed route packets.

framed-route local-switching

Enables local switching of framed route packets. By default, this functionality is disabled.

Configures the packet size above which system will assign unique IP header identification.

default

Restores default value of 576 bytes to IP packet size for fragmentation threshold.

size

Specifies the size of IP packet in bytes above which system will assign unique IP header identification for system generated IP encapsulation headers (such as MIP data tunnel). size is an integer from 0 through 2000. Default: 576

Configures an Internet Group Management Protocol (IGMP) profile and moves to the IGMP Profile Configuration mode.

no

Removes the specified IGMP profile.

name

Specifies the name of an IGMP profile as an alphanumeric string of 1 through 63 characters. If this is not the name of an existing profile, you are prompted to create the new profile.

Configures or removes the static local host logical name to IP address mapping for the current context.

no

Specifies that the static mapping must be removed.

name

Specifies the logical host name (DNS) for the local machine on which the current context resides. name is an alphanumeric string of 1 through 1023 characters formatted to be a valid IP host name.

ip_address

Specifies the IP address for the static mapping. ip_address must be expressed in IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

Modifies the list of domain name servers the current context may use for logical host name resolution.

no

Indicates the name server specified is to be removed from the list of name servers for the current context.

ip_address

Specifies the IP address of a domain name server using IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

secondary_ip_address

Specifies the IP address of a secondary domain name server using either IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

third_ip_address

Specifies the IP address of a third domain name server using either IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation. (VPC only)

Enables creation, configuration or deletion of IP address pools in the current context.

no

Removes the specified IP address pool from the current context's configuration, or disables the specified option(s) for the specified IP pool.

no alert-threshold

This command without any optional keywords disables all alert thresholds.

name

Specifies the logical name of the IP address pool. name must be an alphanumeric string of 1 through 31 characters.

Important

An error message displays if the ip pool name and the group name in the configuration are the same. An error message displays if the ip pool name or group name are already used in the context.

Important

Adding the IP Pool command and the Busyout command of the same IP Pool at the same time creates a race condition. To avoid the issues, run the IP Pool command and Busyout command separately.

ip_address

Specifies the beginning IP address of the IP address pool using IPv4 dotted-decimal.

subnet_mask

Specifies the IP address mask bits to determine the number of IP addresses in the pool. ip_mask must be specified using IPv4 dotted-decimal notation.

1 bits in the ip_mask indicate that bit position in the ip_address must also have a value of 1.

0 bits in the ip_mask indicate that bit position in the ip_address does not need to match – the bit can be either a 0 or a 1.

For example, if the IP address and mask are specified as 172.168.10.0 and 255.255.255.224 , respectively, the pool will contain IP addresses in the range 172.168.10.0 through 172.168.10.31 for a total of 32 addresses.

Note

The valid prefix length for IPv6 pool is 32 to 63. The static and dynamic pools have further restrictions on prefix length. Pool size length <= 24 (for a static pool) => valid prefix length is from 39 to 63. Pool size length <= 20 (for a dynamic pool) => valid prefix length is from 43 to 63 Further, each platform has a restriction on the maximum number of dynamic IPv6 addresses and maximum number of static IPv6 addresses supported per context.

ip_address_mask_combo

Specifies a combined IP address subnet mask bits to indicate what IP addresses the route applies to. ip_address_mask_combo must be specified using CIDR notation where the IP address is specified using IPv4 dotted-decimal notation and the mask bits are a numeric value which is the number of bits in the subnet mask.

range start_ip_address end_ip_address

Specifies the IP addresses for the IP pool as a range of addresses.

start_ip_address specifies the beginning of the range of addresses for the IP pool.

end_ip_address specifies the end of the range of addresses for the IP pool.

The IP address range must be specified using IPv4 dotted-decimal notation.

For example, if start_ip_address is specified as 172.168.10.0 and end_ip_address is specified as 172.168.10.31 the IP pool will contain addresses in the range 172.168.10.0 through 172.168.10.31 for a total of 32 addresses.

private [ priority ]

Address pool may only be used by mobile stations which have requested an IP address from a specified pool. When private pools are part of an IP pool group, they are used in a priority order according to the precedence setting. priority must be an integer from 0 through 10 with 0 being the highest priority. The default value is 0.

public [ priority ]

Address pool is used in priority order for assigning IP addresses to mobile stations which have not requested a specific address pool. priority must be an integer from 0 through 10 with 0 being the highest priority. The default value is 0.

static

Designates local IP address pool to statically assign pooled addresses.

Important

The keyword static must be used for DHCP served IP addresses.

tag { none | pdif-setup-addr }

Default: none

none : default tag for all IP address pools

pdif-setup-addr :pool with this tag should only be used for PDIF calls.

address-hold-timer seconds

When this is enabled, and an active subscriber is disconnected, the IP address is held or considered still in use, and is not returned to the free state until the address-hold-timer expires. This enables subscribers who reconnect within the length of time specified (in seconds) to obtain the same IP address from the IP pool.

seconds is the time in seconds and must be an integer from 0 through 31556926.

Important

For releases prior to 20.0, a change made to the IP pool hold timer takes immediate effect on existing addresses currently on hold. Timeouts are adjusted to align with the new value. For releases after 20.0, the new timeout value will only be applied to addresses which are put on hold in the future. Timeouts for addresses currently in the hold state are not modified. They will timeout using the original timeout value.

Important

Currently, the address-hold-timer only supports IPv4 addresses.

address-quarantine-timer seconds

Specifies the timer value in seconds for an address quarantine timer as an integer from 20 through 86400. This timer cannot be configured with an address-hold-timer in the same pool.

The IP pool address-quarantine-timer is a mechanism to busy out a released IP address for a specified interval. This prevents an IP address from being reused until the quarantine timer expires.

Each IP pool can be configured with a timer value that determines how long a recently released address will be held in quarantine before being freed. When the timer has expired, the address is returned to the list of free addresses, to be allocated again to a new subscriber. Any address that has been released, but for which the address-quarantine-timer has not expired, is still considered to be in use for the purposes of allocation. If a subscriber tries to reconnect while the address-quarantine timer is armed, even though it is the same subscriber ID, the subscriber does not get the same address.

advertise-if-used

Advertises to the peer routes only if addresses are being used in pool.

alert-threshold { group-available | pool-free | pool-hold | pool-release | pool-used | pool-usable | pool-usable-final } low_thresh [ clear high_thresh ]

Default: All thresholds are disabled.

Configures IP address pool-level utilization thresholds. These thresholds take precedence over context-level IP pool thresholds.

group-available : Set an alert based on the available percentage of IP addresses for the entire IP pool group.

pool-free : Set an alert based on the percentage of IP addresses that are unassigned in this IP pool.

pool-hold : Set an alert based on the percentage of IP addresses from this IP pool that are on hold.

pool-release : Set an alert based on the percentage of IP addresses from this IP pool that are in the release state.

pool-used : This command sets an alert based on the percentage of IP addresses that have been assigned from this IP pool.

pool-usable: This command sets IP pool usable pre threshold state as either free or release.

pool-usable-final: Thiss command sets the IP pool usable final threshold state as either free or release.

Important

Refer to the threshold available-ip-pool-group and threshold monitoring commands in this chapter for additional information on IP pool utilization thresholding.

low_thresh : The IP pool utilization percentage that must be met or exceeded within the polling interval to generate an alert or alarm. It can be configured as an integer between 0 and 100.

clear high_thresh : The IP pool utilization percentage that maintains a previously generated alarm condition. If the utilization percentage rises above the high threshold within the polling interval, a clear alarm is generated. It may be configured as an integer between 0 and 100.

Important

This value is ignored for the Alert model. In addition, if this value is not configured for the Alarm model, the system assumes it is identical to the low threshold.

group-name group_name

Assigns one or more preconfigured IP pools to the IP pool group. group_name is case sensitive and must be an alphanumeric string of 1 through 31 characters. One or more IP pool groups are assigned to a context and one IP pool group consists one or more IP pool(s).

IP pool group name is used in place of an IP pool name. When specifying a desired pool group in a configuration the IP pool with the highest precedence is used first. When that IP pool's addresses are exhausted the pool with the next highest precedence is used.

include-nw-bcast

Allows pools to include the classful network and broadcast addresses that are usually excluded when a pool crosses the classful network boundaries.

To remove the include-nw-bcast option from the ip pool, use the no ip pool test include-nw-bcast command.

napt-users-per-ip-address users_per_ip [ alert-threshold { { pool-free | pool-hold | pool-release | pool-used } low_thresh [ clear high_thresh ] } + ] [ max-chunks-per-user max_chunks_per_user [ nat-binding-timer nat_binding_timer port-chunk-hold-timer port_chunk-hold_timeout ] [ nat-pkt-drop-threshold high_thresh [ clear low_thresh ] ] [ nexthop-forwarding-address ip_address ] [ on-demand ] [ port-chunk-size port_chunk_size [ min-port-chunk-per-user chunks ] ] [ port-chunk-threshold port_chunk_threshold ] [ send-nat-binding-update ] +

Important

In UMTS deployments this keyword is available in 9.0 and later releases. In CDMA deployments this keyword is available in 8.3 and later releases.

Important

In UMTS deployments, on upgrading from Release 8.1 to Release 9.0, and in CDMA deployments, on upgrading from Release 8.1 to 8.3, all NAT realms configured in Release 8.1 using the nat-realm keyword must be reconfigured using either the nat-one-to-one (for one-to-one NAT realms) or the napt-users-per-ip-address (for many-to-one NAT realms) keywords.

Configures many-to-one NAT realms.

Important

Thresholds configured using the alert-threshold keyword are specific to the pool that they are configured in. Thresholds configured using the threshold ip-pool-* commands in the Context Configuration Mode apply to all IP pools in that context, and override the threshold configurations set within individual pools.

Important

The high_thresh value is ignored for the Alert model. In addition, if this value is not configured for the Alarm model, the system assumes it is identical to the low threshold.

Important

The nexthop-forwarding-address support for NAT IP pools is functional only in later releases of Release 9.0 and in 10.0 and later releases.

Important

The minimum port chunk per user is only applicable to NAPT single-ip. min-port-chunk-per-user and port-chunk-threshold are mutually exclusive.

• on-demand : Specifies allocating IP when matching data traffic begins.

• port-chunk-size size : Specifies NAT port chunk size (number of NAT ports per chunk) for many-to-one NAT pool.

  In 18 and earlier releases: size must be an integer from 32 through 32256 (in multiples of 32).

  In 19 and later releases: size must be an integer from 8 through 32256 (in multiples of 8).

Important

The port-chunk-size configuration is only available for many-to-one NAT pools.

Important

The port-chunk-size must be a minimum of 64 with systems configured as an A-BG or P-CSCF.

Important

The port-chunk-threshold configuration is only available for many-to-one NAT pools.

Important

send-nat-binding-update is supported for both one-to-one and many-to-one realms.

nat priority

Designates the IP address pool as a Network Address Translation (NAT) address pool.

priority specifies the priority of the NAT pool. 0 is the highest priority. If priority is not specified, the priority is set to 0.

Must be a value from 0 (default) to 10.

Important

This functionality is currently supported for use with systems configured as an A-BG or P-CSCF.

nat-one-to-one [ alert-threshold { { pool-free | pool-hold | pool-release | pool-used } low_thresh [ clear high_thresh ] } + ] [ nat-binding-timer nat_binding_timer ] [ nat-pkt-drop-threshold high_thresh [ clear low_thresh ] ] [ nexthop-forwarding-address ip_address ] [ on-demand ] [ send-nat-binding-update ] +

Important

In UMTS deployments this keyword is available in Release 9.0 and later releases. In CDMA deployments this keyword is available in Release 8.3 and later releases.

Important

In UMTS deployments, on upgrading from Release 8.1 to Release 9.0, and in CDMA deployments, on upgrading from Release 8.1 to Release 8.3, all NAT realms configured in Release 8.1 using the nat-realm keyword must be reconfigured using either the nat-one-to-one (for one-to-one NAT realms) or the napt-users-per-ip-address (for many-to-one NAT realms) keywords.

Configures one-to-one NAT realm.

Important

Thresholds configured using the alert-threshold keyword are specific to the pool in which they are configured. Thresholds configured using the thresholdip-pool * commands in the Context Configuration Mode apply to all IP pools in the context, and override the threshold configurations set within individual pools.

Important

The high_thresh value is ignored for the Alert model. In addition, if this value is not configured for the Alarm model, the system assumes it is identical to the low threshold.

Important

send-nat-binding-update is supported for both one-to-one and many-to-one realms.

The following IP pool configuration keywords can also be used in the one-to-one NAT pool configurations:

nat-realm users-per-nat-ip-address users [ on-demand [ address-hold-timer address_hold_timer ] ]

Important

In UMTS deployments, the nat-realm keyword is only available in Release 8.1.

Important

In Release 8.1, the NAT On-demand feature is not supported.

Important

This functionality is currently supported for use with systems configured as an A-BG or P-CSCF.

Designates the IP address pool as a Network Address Translation (NAT) realm pool.

users-per-nat-ip-address users : specifies the number of users sharing a single NAT IP address as an integer from 1 through 5000.

on-demand : Specifies to allocate IP when matching data traffic begins.

address-hold-timer address_hold_timer : Specifies the address hold timer (in seconds) for this pool as an integer from 0 through 31556926. If set to 0, the address hold timer is disabled.

Important

Currently, the address-hold-timer only supports IPv4 addresses.

nexthop-forwarding-address ip_address

A subscriber that is assigned an IP address from this pool is forwarded to the next hop gateway with the specified IP address. ip_address : Specifies the nexthop forwarding address for this pool. address must be an IPv4 or IPv6 address.

overlap vlan id vlan_id

When a nexthop forwarding address is configured, this keyword can be configured to enable over-lapping IP address pool support and associates the pool with the specified virtual LAN (VLAN). vlan_id is the identification number of a VLAN assigned to a physical port and can be configured to any integer from 1 through 4095.

For more information on configuring VLANs, refer to the System Administration Guide.

Important

This functionality is currently supported for use with systems configured as an HA, or as a PDSN for Simple IP, or as a GGSN. This keyword can only be issued for pools of type private or static and must be associated with a different nexthop forwarding address and VLAN. A maximum of 256 over-lapping pools can be configured per context and a maximum of 256 over-lapping pools can be configured per HA or simple IPPDSN. For GGSNs, the total number of pools is limited by the number of VLANs defined but the maximum number per context is 256. Additional network considerations and configuration outside of the system maybe required.

nw-reachability server server_name

Binds the name of a configured network reachability server to the IP pool and enables network reachability detection for the IP pool. This takes precedence over any network reachability server settings in a subscriber configuration.

server_name : Specifies the name of a network reachable server that has been defined in the current context, expressed as an alphanumeric string of 1 through 16 characters.

Important

Also see the following commands for more information: Refer to the policy nw-reachability-fail command in the HA Configuration Mode to configure the action that should be taken when network reachability fails. Refer to the nw-reachability server command in this chapter to configure network reachability servers. Refer to the nw-reachability-server command in the Subscriber Configuration Mode to bind a network reachability server to a specific subscriber.

respond-icmp-echo ip_address

Pings the first IP address from overlapping IP address pools.

Important

In order for this functionality to work, all of the pools should contain an initial IP address that can be pinged.

resource

Specifies this IP pool as a resource pool. The IP addresses in resource pools may have IP addresses that also exist in other resource pools. IP addresses from a resource pool should not be used for IP connectivity within the system where the pool is defined. These IP addresses should be allocated for sessions which are L3 tunneled through the system (IP-in-IP or GRE). It is possible for resource pools in the same context to have overlapping addresses when the terminating network elements for the L3 tunnels are in different VPNs. Default: Disabled

Also refer to the Subscriber Configuration Mode Commands chapter for a description of the l3-to-l2-tunnel address-policy command.

send-icmp-dest-unreachable

When enabled, this generates an ICMP destination unreachable PDU when the system receives a PDU destined for an unused address within the pool.

Default: Disabled

skip-nat-subscriber-ip-check

When enabled, this is configured to skip private IP address check for non-NAT pools. This can be configured only for non-NAT pools during call-setup if NAT is enabled for the subscriber. If NAT is disabled, this value is not considered.

Default: Disabled (subscriber IP check is done).

explicit-route-advertise

When enabled, the output of show ip pool verbose includes the total number of explicit host routes. Default: Enabled

srp-activate

Activates the IP pool for Interchassis Session Recovery (ICSR).

subscriber-gw-address ip_address

Configures the subscriber gateway address for this pool.

Important

Using this keyword might give a message as "busyout configured". This indicates that one ip address is reserved as subscriber-gw-address and not the entire pool.

suppress-switchover-arp

Suppress corresponding gratuitous ARP generation when a line card or MIO card switchover occurs. Default: Disabled

unicast-gratuitous-arp-address ip_address

Perform a unicast gratuitous ARP to the specified IP address rather than broadcast gratuitous ARP when gratuitous ARP generation is required. Default: Perform broadcast gratuitous ARP.

vrf vrf_name { [ mpls-label input in_label_value | output out_label_value1 [ out_label_value2 ] }

Associates a preconfigured Virtual Routing and Forwarding (VRF) instance with this IP pool and configures MPLS label parameters.

Important

This command must be used with next-hop parameters.

vrf_name is name of a preconfigured virtual routing and forwarding (VRF) context configured in Context Configuration Mode through ip vrf command.

MPLS label values must be an integer from 16 through 1048575.

By default, the pools configured are bound to the default VRF unless specified with a VRF name.

Important

You cannot have overlapping pool addresses using the same VRF. Also you cannot have two pools using different VRFs but the same in-label irrespective of whether or not the pools overlap. The pool must be private or static in-order to be associated with a certain VRF. If the VRF with such a name is not configured, you are prompted to add the VRF before configuring a pool.

policy allow-static-allocation

Configures static address allocation policy for dynamic IP pool. This keyword enables a dynamic IP pool to accept a static address for allocation.

Important

In static allocation scenario, the pool group name is returned by AAA in the attribute SN1-IP-Pool-Name, and the IP address to use will be returned in the Framed-IP-Address attribute.

framed-route-vrf-list vrf_list_name

Configures a vrf-list in order for NVSE VRF authorization.

pool-route ip_address/ip_mask

Configures the IP pool route instead of generating by-default. The address followed by the pool-route keyword can be an IPv4 or IPv6 address with the mask value.

+

Indicates that more than one of the previous keywords can be entered within a single command.

Creates an IP prefix list for filtering routes.

no

Delete the specified prefix-list entry.

name list_name

Specifies a name for the prefix list as an alphanumeric string of 1 through 79 characters.

seq seq_number

Assigns the specified sequence number to the prefix list entry as an integer from 1 through 4294967295.

deny

Specifies prefixes to deny.

permit

Specifies prefixes to permit.

any

Matches any prefix.

network_address / net_mask [ ge ge_value ] [ le le_value ]

Specifies the prefix to match.

network_address / net_mask : the IP address and the length, in bits, of the network mask that defines the prefix. The IP address and mask must be entered in IPv4dotted-decimal notation. When neither ge (greater than or equal to) or le (less than or equal to) are specified an exact match is assumed.

ge ge_value : Specifies the minimum prefix length to match as an integer from 0 through 32. If only the ge value is specified, the range is from the ge value to 32. The ge value must be greater than net_mask and less than the le value.

le le_value : Specifies the maximum prefix length to match as an integer from 0 through 32. If only the le value is specified, the range is from the net_mask to the le value. The le value must be less than or equal to 32.

The following equation describes the conditions that ge and le values must satisfy:

net_mask < ge_value < le_value <= 32

Enables or disables the inclusion of IP prefix list sequence numbers in the configuration file. This option is enabled by default.

no

Disables the listing of IP prefix list sequence numbers in the configuration file.

Adds or removes routing information from the current context's configuration.

no

Indicates the route specified by this options is to be removed from the configuration.

kernel

Allows static route in the kernel routing table options.

ip_address / ip_mask | ip_address/ip_mask

Specifies a destination IP address or group of addresses that will use this route.

ip_address / ip_mask : Specifies a combined IP address subnet mask bits to indicate what IP addresses to which the route applies. ip_address must be entered using IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation. ip_mask / is entered using CIDR notation; the mask bits are a numeric value which is the number of bits in the subnet mask.

ip_address/ip_mask : Specifies an IP address and the networking (subnet) mask pair which is used to identify the set of IP addresses to which the route applies. ip_address must be specified using the standard IPv4 dotted decimal notation. ip_mask must be specified using the standard IPv4 dotted decimal notation as network mask for subnets.

The mask as specified by ip_mask or resulting from ip_address / ip_mask is used to determine the network for packet routing.

0's in the resulting mask indicate the corresponding bit in the IP address is not significant in determining the network for packet routing.

1's in the resulting mask indicate the corresponding bit in the IP address is significant in determining the network.

ip_address/ip_address_mask_combo

Specifies a combined IP address subnet mask bits to indicate what IP addresses the route applies to. ip_address_mask_combo must be specified using CIDR notation where the IP address is specified using IPv4 dotted-decimal notation and the mask bits are a numeric value, which is the number of bits in the subnet mask.

gateway_ip_address | next-hop next_hop_ip_address | point-to-point | tunnel

Specifies which device or network to use when forwarding packets.

gateway_ip_address : Specifies the IP address of the network gateway to which to forward packets. The address must be entered in IPv4 dotted-decimal notation (###.###.###.###).

next-hop next_hop_ip_address : Specifies the next-hop IP address to which packets are to be forwarded. The address must be entered in IPv4 dotted-decimal notation and IPv6 address in colon-separated-hexadecimal notation.

point-to-point : Specifies that the egress port is an ATM point-to-point interface.

tunnel : Sets the static route for this egress interface as tunnel type, such as IPv6-over-IPv4 or GRE.

egress_intrfc_name

Specifies the name of the egress (out-bound) interface name in the current context as an alphanumeric string of 1 through 79 characters. For a blackhole route, the default is “*”, that is, a wildcard interface.

cost cost

Specifies the relative cost of the route. cost must be an integer from 0 through 255 where 255 is the most expensive. Default: 0

cost number

Defines the number of hops to the next gateway. The cost must be an integer from 0 through 255 where 255 is the most expensive. The default is 0.

blackhole

Defines blackhole route to install in the kernel to block or drop packets.

fall-over bfd multihop mhsess_name

Enables fall-over BFD functionality for the specified multihop session. The fall-over bfd option uses BFD to monitor neighbor reachability and liveliness. When enabled it will tear down the session if BFD signals a failure. Specify mhsess_name as an alphanumeric string of 1 through 19 characters.

precedence precedence

Specifies the selection order precedence for this routing information. precedence must be an integer from 1 through 254 where 1 is the highest precedence. Default: 1

vrf vrf_name

Associates a Virtual Routing and Forwarding (VRF) context with this static route configuration.

vrf_name is the name of a preconfigured VRF context configured in Context Configuration Mode via the ip vrf command.

static bfd if_name remote-endpt_ipv4_address

Creates a static IP route that will be associated with Bidirectional Forwarding Detection (BFD). For additional information, see the BFD Configuration Mode Commands chapter.

if_name : Specifies the name of the interface to which the static BFD neighbor is bound as an alphanumeric string of 1 through 79 characters.

remote_endpt_ipv4_address : Specifies the gateway address of the BFD neighbor in IPv4 dotted-decimal notation.

static multihop bfd mhbfd_sess_name local_endpt_ipaddr remote_endpt_ipaddr

Creates a static multihop BFD route with local and remote endpoints.

mhbfd_sess_name : Specifies the multihop BFD session name as an alphanumeric string of 1 through 79 characters.

local_endpt_ipaddress : Specifies the local endpoint address in IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

remote_endpt_ipaddress : Specifies the remote endpoint address in IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

Enables Equal Cost Multiple Path (ECMP) routing support and specifies the maximum number of ECMP paths that can be submitted by a routing protocol in the current context.

default

Resets the command to its default setting of 4.

no

Disables ECMP for the current context.

max_num

The maximum number of ECMP paths that can be submitted by a routing protocol. max_num must be an integer within the following ranges:

• For ASR5000: 1 through 10

• For ASR5500: 1 through 24

• For VPC-DI: 1 through 32 (for Releases prior to 21.4

• For VPC-DI: 1 through 64 (for Release 21.4+

Default: 4

Configures the routing behavior for overlap-pool addresses.

default

Resets the command to its default setting of disabled.

no

Disables the routing behavior for overlap-pool addresses for the current context.

Configures Reverse Route Injection (RRI) egress clear port IPv4 parameters. (VPC-VSM only)

no

Disables the specified RRI egress parameters.

ip_address

Specified in IPv4 dotted-decimal notation.

next-hop nexthop_address

Next hop address specified in IPv4 dotted-decimal notation. The next hop IP address is not required for point-to-point and tunnel interfaces.

interface interface_name

Specifies the name of an existing egress interface as an alphanumeric string of 1 through 79 characters.

vrf vrf_name

Specifies the name of an existing VRF as an alphanumerical string of 1 through 63 characters.

Configures High Availability (HA) IPv4 routing parameters for Reverse Route Injection (RRI). (VPC-VSM only)

no

Disables the specified RRI route.

network-mode { L2 | L3 }

Specifies the RRI route network mode type as Layer 2 (L2) or Layer 3 (L3).

clear_loopback_ip

Specifies the loopback address for clear traffic in IPv4 dotted-decimal notation.

rri-ip virtual_ip_address

Specifies the use of a virtual IP address on both Primary and Secondary for RRI. virtual_ip_address is expressed in IPv4 dotted-decimal notation.

ip_address

Specified in IPv4 dotted-decimal notation.

next-hop nexthop_address

Next hop address specified in IPv4 dotted-decimal notation. The next hop IP address is not required for point-to-point and tunnel interfaces.

interface interface_name

Specifies the name of an existing egress interface as an alphanumeric string of 1 through 79 characters.

vrf vrf_name

Specifies the name of an existing VRF as an alphanumerical string of 1 through 63 characters.

Configures Layer 3 (L3) High Availability (HA) IPv4 routing parameters for Service Route Injection (SRI). (VPC-VSM only)

no

Disables the specified SRI route.

sri-ip network_address

Specifies the IPv4 address associated with the SRI route.

next hop nexthop_address

Next hop address specified in IPv4 dotted-decimal notation. The next hop IP address is not required for point-to-point and tunnel interfaces.

interface interface_name

Specifies the name of an existing egress interface as an alphanumeric string of 1 through 79 characters.

vrf vrf_name

Specifies the name of an existing VRF as an alphanumerical string of 1 through sixty-three characters.

Creates a Virtual Routing and Forwarding (VRF) context instance, assigns a VRF identifier, and configures the VRF parameters for BGP/MPLS VPN, GRE tunnel, and IPSec interface configuration.

Important

IKEv2 ACL VRF is not supported.

no

Disables IP Virtual Routing and Forwarding (VRF) parameters.

vrf_name

Specifies the name of the virtual routing and forwarding interface as an alphanumeric string of 1 through 63 characters.

Creates a VRF list and adds VRFs to the list. The VRFs must have been previously created via the ip vrf command.

no

Deletes a VRF list or delete VRFs from this list. If permit and vrf-name are not specified, the entire list of VRFs is deleted. Otherwise, the specified VRF(s) is deleted from the list.

list_name

Specifies the name of the VRF list as an alphanumerical string of 1 through 63 characters.

vrf_name

Specifies the name of the virtual routing and forwarding interface as an alphanumeric string of 1 through 63 characters.

Enables/disables/manages an intelligent packet monitoring system (IPMS) client service and enters the IPMS Client Configuration Mode within the current context.

no

Deletes a previously configured IPMS client service.

-noconfirm

Executes the command without any additional prompt and confirmation from the user.

Caution

If this keyword option is used with no ipms command, the IPMS client service will be deleted with all active/inactive IPMS sessions without prompting any warning or confirmation.

Create and/or configure an IPNE service.

no

Included as a prefix of the command, no causes the system to disable IPNE service when it has been created with this command and removes the IPNE service definition from the MME's configuration.

ipne_service

Enter 1 to 63 alphanumeric characters to create a unique name for an IPNE service instance.

Configures IKEv2 IPSec specific anti-replay.

no

Disables this option.

replay

Configures IKEv2 IPSec anti-replay.

window-size window_size

Configures anti-replay window size.

window_size is the window size 32, 64 (default), 128, 256, 384, 512 , an integer value between 32..512

Creates a new or specifies an existing IPSec transform set and enters the IPSec Transform Set Configuration Mode for the current context.

no

Removes an existing transform set from the system.

transform-set name

Specifies the name of a new or existing transform set as an alphanumeric string of 1 through 127 characters.

This command allows you to create/modify/delete an IP Services Gateway (IPSG) service in the current context.

no

If previously configured, deletes the specified IPSG service.

ipsg_service_name

Specifies the name of the IPSG service.

ipsg_service_name must be an alphanumeric string of 1 through 63 characters.

Important

Service names must be unique across all contexts within a chassis.

mode { radius-server [ ewag ] | radius-snoop }

Configures the IPSG to perform as either a RADIUS server or as a device to extract user information from RADIUS accounting request messages (snoop). If the optional keyword mode is not entered, the system defaults to radius-server .

-noconfirm

Specifies to execute the command without additional prompt or confirmation.

Configures the IPv6 Access group.

group_name

Specifies the name of the access group as an alphanumeric string of 1 through 79 characters.

priority_value

Specifies the priority of the access group. 0 is the highest priority. If priority_value is not specified the priority is set to 0. priority_value must be an integer from 0 through 4294967295. Default: 0

If access groups in the list have the same priority, the last one entered is used first.

Create, configure, or delete an IPv6 Access List in the current context.

no

Removes the specified access list.

name

Specifies the access list name.

name is an alphanumeric string of 1 through 47 characters.

If the named access list does not exist, it is created, and the CLI mode changes to the ACL Configuration Mode, wherein the access list can be configured.

If the named access list already exists, the CLI mode changes to the ACL Configuration Mode, wherein the access list can be reconfigured.

Configures the domain name server proxy for the context.

no

Removes the predefined IP address for local interface in the destination context.

ip_address

Specifies the IPv4 address of one of the local interface in the destination context to configure the IPv6 DNS proxy where ip_address must be specified using IPv4 dotted-decimal notation.

Adds a static IPv6 neighbor entry into the neighbor discovery table.

no

Removes the specified address.

ipv6_address hardware_address

ipv6_address is the IP address of node to be added to the table.

hardware_address is the associated 48-bit MAC address.

Modifies the current context's IP address pools by adding, updating or deleting a pool. This command also resizes an existing IP pool.

no

Deletes the previously configured IPv6 pool.

name

Specifies the logical name of the IP address pool as an alphanumeric string of 1 through 31 characters.

Important

Adding the IPv6 Pool command and the Busyout command of the same IPv6 Pool at the same time creates a race condition. To avoid the issues, run the IPv6 Pool command and Busyout command separately.

6to4-tunnel local-endpoint ip_address

Specifies the IPv4 address of the local interface to be used for IPv6-to-IPv4 compatible pool address construction.

alert threshold { 6to4 local-endpoint ipv4_address | alert threshold | group-available | group-name name | policy { allow-static-allocation | dup-addr-detection } | pool-free | pool-used | pool-usable | pool-usable-final | prefix | range start_address end_address }

Default: All thresholds are disabled.

Configures IP address pool-level utilization thresholds. These thresholds take precedence over context-level IPv6 pool thresholds.

group name name

IPv6 Pool Group.

The following options are available:

ipv4_address

Specifies the beginning IPv4 address of the IPv4 address pool. ipv4_address must be specified using IPv4 dotted-decimal notation.

default-relay-router router address

Specifies the default relay router for the tunnel.

policy allow-static-allocation

Allows a dynamic pool to accept a static address allocation.

The following options are available:

policy dup-addr-detection

This command is valid for IPv6 shared pools only (Sample syntax: ipv6 pool name prefix ip_address/len shared policy dup-addr-detection ). When this policy is enabled, the IPv6 shared pool allows a prefix to be shared in different call sessions with different interface IDs for an IPv6 address. This allows the tracking of interface IDs per prefix and the detection of duplicate IDs.

With this policy disabled, the IPv6 shared pool will allow a prefix to be shared across different call sessions. The interface ID is not considered for any duplicate address detection. Default: Disabled

The following options are available:

prefix ip_address/len

Specifies the beginning IPv6 address of the IPv6 address pool. ip_address/len must be specified using IPv6 colon-separated-hexadecimal. len is an integer that indicates the number bits of prefix length.

Important

If the prefix ip_address/len specified is less than /40, then a prefix-length prfx_length must be specified. Options are 48, 52, or 58 bits of prefix-length .

Important

On the ASR 5000, routes with IPv6 prefix lengths less than /12 and between the range of /64 and /128 are not supported.

range start_address end_address

Configures an IPv6 address pool to use a range of addresses.

start_address specifies the beginning of the range of addresses for the IPv6 pool. It must be specified using IPv6 colon-separated-hexadecimal notation.

end_address specifies the end of the range of addresses for the IPv6 pool. It must be specified using IPv6 colon-separated-hexadecimal notation.

suppress-switchover-arps

Suppresses gratuitous ARPs when performing a line card switchover.

The following options are available:

prefix-length prfx_length

Specifies a configured length of prefixes. prfx_length can be 48, 52, 56 or 64 bits of prefix (Default = 64). This option supports S-GW/P-GW validation of fixed-length addresses via DHCPv6 (TS 29.274 – 7.2.2 and 8.14).

Important

If the prefix ip_address/len specified is less than /40, then a prefix-length prfx_length must be specified. Options are 48, 52, or 58 bits of prefix-length .

Important

On the ASR 5000, routes with IPv6 prefix lengths less than /12 and between the range of /64 and /128 are not supported.

private priority | public priority | shared priority | static priority

Default: public

private priority : Specifies that the address pool may only be used by mobile stations which have requested an IP address from a specified pool. When private pools are part of an IP pool group, they are used in a priority order according to the precedence setting. priority must be an integer from 0 through 10 with 0 being the highest. The default is 0.

public priority : Specifies that the address pool is used in priority order for assigning IP addresses to mobile stations which have not requested a specific address pool. priority must be an integer from 0 through 10 with 0 being the highest and with a default of 0.

shared priority : Specifies that the address pool that may be used by more than one session at any time. priority must be an integer from 0 through 10 with 0 being the highest and with a default of 0.

static priority : Specifies that the address pool is used for statically assigned mobile stations. Statically assigned mobile stations are those with a fixed IP address at all times. priority must be an integer from 0 through 10 with 0 being the highest and with a default of 0.

group-name name

Groups the IPv6 pools into different groups. The subscribers/domain can be configured with the group-name instead of the prefix-pool names. name is the name of the group by which the IPv6 pool is to be configured expressed as an alphanumeric string of 1 through 79 characters.

vrf vrf-name

Associates the pool with the VRF specified as an alphanumeric string of 1 through 63 characters. By default the configured IPv6 pool will be associated with the global routing domain.

Creates an IPv6 prefix list for filtering routes.

no

Delete the specified prefix-list entry.

name list_name

Specifies a name for the prefix list as an alphanumeric string of 1 through 79 characters.

seq seq_number

Assigns the specified sequence number to the prefix list entry as an integer from 1 through 4294967295.

deny

Specifies prefixes to deny.

permit

Specifies prefixes to permit.

any

Matches any prefix.

network_address / net_mask [ ge ge_value ] [ le le_value ]

Specifies the prefix to match.

network_address / net_mask : the IPv6 address and the length, in bits, of the network mask that defines the prefix. The IP address and mask must be entered in IPv6 colon-separated-hexadecimal notation. When neither ge (greater than or equal to) or le (less than or equal to) are specified an exact match is assumed.

Important

On the ASR 5000, routes with IPv6 prefix lengths less than /12 and between the range of /64 and /128 are not supported.

ge ge_value : Specifies the minimum prefix length to match as an integer from 0 through 128. If only the ge value is specified, the range is from the ge value to 128. The ge value must be greater than net_mask and less than the le value.

le le_value : Specifies the maximum prefix length to match as an integer from 0 through 128. If only the le value is specified, the range is from the net_mask to the le value. The le value must be less than or equal to 128.

The following equation describes the conditions that ge and le values must satisfy:

net_mask < ge_value < le_value <= 128

Enables or disables the inclusion of IPv6 prefix list sequence numbers in the configuration file. This option is enabled by default.

no

Disables the listing of IPv6 prefix list sequence numbers in the configuration file.

Configures a static IPv6 route to the next-hop router.

no

Removes the specified static route.

ipv6_address / prefix_length

Specifies a destination IPv6 address or group of addresses that will use this route.

ipv6_address / prefix_length must be specified using IPv6 colon-separated-hexadecimal with CIDR notation.

Important

On the ASR 5000, routes with IPv6 prefix lengths less than /12 and between the range of /64 and /128 are not supported.

interface name

Specifies the name of the interface on this system associated with the specified route or next-hop address. name must be an existing interface name on the system expressed as an alphanumeric string of 1 through 79 characters.

next-hop ipv6_address

The IPv6 address of the directly connected next hop device in IPv6 colon-separated-hexadecimal notation.

cost cost

Defines the number of hops to the next gateway as an integer from 0 through 255. Default: 0

fall-over bfd multihop mhsess_name

Enables fall-over BFD functionality for the specified multihop session. The fall-over bfd option uses BFD to monitor neighbor reachability and liveliness. When enabled it will tear down the session if BFD signals a failure. Specify mhsess_name as an alphanumeric string of 1 through 19 characters.

precedence precedence

Indicates the administrative preference of the route. A low precedence specifies that this route takes preference over the route with a higher precedence. precedence must be an integer from 1 through 254. Default: 1

vrf vrf_name

Associates a Virtual Routing and Forwarding (VRF) context with this static route configuration.

vrf_name is the name of a preconfigured VRF context configured in Context Configuration Mode via the ip vrf command.

static bfd if_name remote-endpt_ipv6address

Creates a static IP route that will be associated with Bidirectional Forwarding Detection (BFD). For additional information, see the BFD Configuration Mode Commands chapter.

if_name : Specifies the name of the interface to which the static BFD neighbor is bound as an alphanumeric string of 1 through 79 characters.

remote_endpt_ipv6address : Specifies the gateway address of the BFD neighbor in IPv6 colon-separated-hexadecimal notation.

static multihop bfd mhbfd_sess_name local_endpt_ipv6addr remote_endpt_ipv6addr

Creates a static multihop BFD route with local and remote endpoints.

mhbfd_sess_name : Specifies the multihop BFD session name as an alphanumeric string of 1 through 79 characters.

local_endpt_ipv6addr : Specifies the local endpoint address in IPv6 colon-separated-hexadecimal notation.

remote_endpt_ipv6addr : Specifies the remote endpoint address in IPv6 colon-separated-hexadecimal notation.

Configures an IPv6 route access list for filtering routes.

no

Delete the specified prefix-list entry.

name list_name

Specifies a name for the prefix list as an alphanumeric string of 1 through 79 characters.

deny

Specifies prefixes to deny.

permit

Specifies prefixes to permit.

network_address / net_mask [ exact-match ]

Specifies the prefix to match.

network_address / net_mask : the IPv6 address and the length, in bits, of the network mask that defines the prefix. The IP address and mask must be entered in IPv6 colon-separated-hexadecimal notation.

Important

On the ASR 5000, routes with IPv6 prefix lengths less than /12 and between the range of /64 and /128 are not supported.

exact-match le_value : Specifies that only an exact match will initiate access list deny/permit function.

Configures Reverse Route Injection (RRI) egress clear port IPv6 parameters. (VPC-VSM only)

no

Disables the specified RRI egress route.

ipv6_address

Specified in IPv6 colon-separated-hexadecimal notation.

next-hop nexthop_address

Next hop address specified in IPv6 colon-separated-hexadecimal notation. The next hop IP address is not required for point-to-point and tunnel interfaces.

interface interface_name

Specifies the name of an existing egress interface as an alphanumeric string of 1 through 79 characters.

vrf vrf_name

Specifies the name of an existing VRF as an alphanumerical string of 1 through 63 characters.

Configures High Availability (HA) IPv6 routing parameters for Reverse Route Injection (RRI). (VPC-VSM only)

no

Disables the specified RRI route.

network-mode { L2 | L3 }

Specifies the RRI route network mode type as Layer 2 (L2) or Layer 3 (L3).

clear_loopback_ip

Specifies the loopback address for clear traffic in IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

rri-ip virtual_ipv6_address

Specifies the use of a virtual IP address on both Primary and Secondary for RRI. virtual_ipv6_address is expressed in IPv6 colon-separated-hexadecimal notation.

ipv6_address

Specified in IPv6 colon-separated-hexadecimal notation.

next-hop nexthop_address

Next hop address specified in IPv6 colon-separated-hexadecimal notation. The next hop IP address is not required for point-to-point and tunnel interfaces.

interface interface_name

Specifies the name of an existing egress interface as an alphanumeric string of 1 through 79 characters.

vrf vrf_name

Specifies the name of an existing VRF as an alphanumerical string of 1 through 63 characters.

Configures Layer 3 (L3) High Availability (HA) IPv6 routing parameters for Service Route Injection (SRI). (VPC-VSM only)

no

Disables the specified SRI route.

sri-ip network_address

Specifies the IPv6 address associated with the SRI route.

next hop nexthop_address

Next hop address specified in IPv6 colon-separated-hexadecimal notation. The next hop IP address is not required for point-to-point and tunnel interfaces.

interface interface_name

Specifies the name of an existing egress interface as an alphanumeric string of 1 through 79 characters.

vrf vrf_name

Specifies the name of an existing VRF as an alphanumerical string of 1 through 63 characters.

This command is deprecated. Use ikev1 disable-phase1-rekey command to configure the parameters for Phase1 SA rekeying when ISAKMP lifetime expires for IKE v1 protocol.

This command is deprecated. Use ikev1 keepalive dpd command to configure ISAKMP IPSec Dead Peer Detection (DPD) message parameters for IKE v1 protocol.

This command is deprecated. Use ikev1 policy command to create/configure an ISAKMP policy with the specified priority for IKE v1 protocol.

Creates an Iu-PS service instance and enters the Iu-PS Service Configuration Mode. This mode defines the configuration and usage of Iu-PS interfaces between the SGSN and the RNCs in the UMTS radio access network (UTRAN). It defines both the control plane (GTP-C) and the data plane (GTP-U) between these nodes.

no

Remove the configuration for the specified Iu-PS service from the configuration for the current context.

srvc_name

Specifies the IuPS service name as a unique alphanumeric string of 1 through 63 characters.

Important

Service names must be unique across all contexts within a chassis.

Configures a delay when attempting to tunnel to a specific peer which is initially unreachable due to reasons such as a network issue or temporarily having reached its capacity.

default

Rests the command to its default setting of 60.

seconds

Specifies the interval (in seconds) to wait before attempting to tunnel to a specific peer which is initially unreachable as an integer from 5 through 64,000. Default: 60

Enters the LAC Service Configuration Mode, or is used to add or remove a specified L2TP Access Concentrator (LAC) service.

no

Removes the specified lac-service from the current context.

name

Specifies the name of a LAC service to configure, add, or remove as an alphanumeric string of 1 through 63 characters that is case-sensitive.

Important

Service names must be unique across all contexts within a chassis.

Refer to the Lawful Intercept Configuration Guide for a description of this command.

Refer to the Lawful Intercept Configuration Guide for a description of this command.

Use this command to limit the parameter for this context.

default

Sets/Restores default value assigned for specified parameter.

limit

Limits the parameter for this context.

ipsecmgr

To limit ipsecmgr manager settings.

ikev1

Specifies IKEv1 tasks.

max max_value

Specifies maximum ipsecmgr IKEv1 tasks. max_value must be an integer from 1 to 176.

Creates an Local Mobility Anchor (LMA) service or specifies an existing LMA service and enters the LMA Service Configuration Mode for the current context.

no

Removes the specified LMA service from the context.

service_name

Specifies the name of the LMA service. If service_name does not refer to an existing service, the new service is created if resources allow.

service_name is an alphanumeric string of 1 through 63 characters.

Important

Service names must be unique across all contexts within a chassis.

-noconfirm

Executes the command without any additional prompt and confirmation from the user.

Enters the LNS Service Configuration Mode, or is used to add or remove a specified L2TP Network Server (LNS) service.

no

Removes the specified lac-service from the current context.

name

Specifies the name of a LNS service to configure, add or remove as an alphanumeric string of 1 through 63 characters that is case-sensitive.

Important

Service names must be unique across all contexts within a chassis.