Hp 7000 Dl Router Series Command Reference Guide SROS Line Interface

2015-01-05

: Hp Hp-7000-Dl-Router-Series-Command-Reference-Guide-155462 hp-7000-dl-router-series-command-reference-guide-155462 hp pdf

Open the PDF directly: View PDF .
Page Count: 941 [warning: Documents this large are best viewed by clicking the View PDF Link!]

CLI Introduction
Command Descriptions
Index

SROS Command Line Interface

Reference Guide

Software Version J.02.01 or Greater

April 2005

61195880L1-35B

The information contained herein is subject to change without

notice.

This document contains proprietary information, which is protected by

or translated into another language without the prior written consent of

Hewlett-Packard.

Publication Number

5991-2114

January 2005

Applicable Products

Microsoft and Windows are U.S. registered trademarks of Microsoft

Corporation. CompactFlash is a U.S. registered trademark of the

CompactFlash Association. AOL Instant Messenger (AIM) is a U.S.

registered trademark of American Online, Inc. Quake is a U.S.

registered trademark of id Software, Inc. ICQ is a U.S. registered

trademark of ICQ, Inc. pcAnywhere is a U.S. trademark of Synamtec

Corporation.

Disclaimer

HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF

ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING,

BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF

MERCHANTABILITY AND FITNESS FOR A PARTICULAR

PURPOSE. Hewlett-Packard shall not be liable for errors contained

herein or for incidental or consequential damages in connection with

the furnishing, performance, or use of this material.

The only warranties for HP products and services are set forth in the

express warranty statements accompanying such products and services.

Nothing herein should be construed as constituting an additional

warranty. HP shall not be liable for technical or editorial errors or

omissions contained herein.

Hewlett-Packard assumes no responsibility for the use or reliability of

its software on equipment that is not furnished by Hewlett-Packard.

Warranty

See the Customer Support/Warranty booklet included with the product.

A copy of the specific warranty terms applicable to your Hewlett-

Packard products and replacement parts can be obtained from your HP

Sales and Service Office or authorized dealer.

ProCurve Secure Router 7102dl (J8752A)

ProCurve Secure Router 7203dl (J8753A)

SROS Command Line Interface Reference Guide

Table of Contents

Basic Mode Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Enable Mode Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Global Configuration Mode Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200

DHCP Pool Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355

IKE Policy Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373

IKE Policy Attributes Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386

IKE Client Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392

Crypto Map IKE Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396

Crypto Map Manual Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405

Radius Group Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 416

CA Profile Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418

Certificate Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429

Ethernet Interface Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433

DDS Interface Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 486

Serial Interface Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 494

T1 Interface Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504

DSX-1 Interface Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 520

E1 Interface Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 530

G.703 Interface Configuration Command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545

Modem Interface Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552

BRI Interface Configuration Command set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 556

Frame Relay Interface Config Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567

Frame Relay Sub-Interface Config Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587

ATM Interface Config Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 644

ATM Sub-Interface Config Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647

ADSL Interface Config Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701

BGP Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705

BGP Neighbor Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711

PPP Interface Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 715

Tunnel Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 778

HDLC Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 811

Loopback Interface Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 847

Line (Console) Interface Config Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876

Line (Telnet) Interface Config Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 887

Router (RIP) Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894

Router (OSPF) Configuration Command Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 903

Quality of Service (QoS) Map Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 917

Common Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 922

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 936

Command Reference Guide CLI Introduction

REFERENCE GUIDE INTRODUCTION

This manual provides information about the commands that are available with all of the ProCurve Secure

routers.

If you are new to the Operating System’s Command Line Interface (CLI), take a few moments to review

the information provided in the section which follows (CLI Introduction).

If you are already familiar with the CLI and you need information on a specific command or group of

commands, proceed to Command Descriptions on page 9 of this guide.

CLI INTRODUCTION

This portion of the Command Reference Guide is designed to introduce you to the basic concepts and

strategies associated with using the Operating System’s Command Line Interface (CLI).

Accessing the CLI from your PC

All products using the are initially accessed by connecting a VT100 terminal (or terminal emulator) to the

CONSOLE port located on the rear panel of the unit using a standard DB-9 (male) to DB-9 (female) serial

cable. Configure the VT100 terminal or terminal emulation software to the following settings:

• 9600 baud

• 8 data bits

• No parity

• 1 stop bit

• No flow control

Understanding Command Security Levels

The has two command security levels — Basic and Enable. Both levels support a specific set of

commands. For example, all interface configuration commands are accessible only through the Enable

security level. The following table contains a brief description of each level.

Note For more details on connecting to your unit, refer to the Quick Configuration Guides and

Quick Start Guides located on the Secure Router OS Documentation CD provided with

your unit.

Level Access by... Prompt With this level you can...

Basic beginning an SROS session.

>• display system information

• perform traceroute and ping

functions

• open a Telnet session

Command Reference Guide Understanding Configuration Modes

Understanding Configuration Modes

The Secure Router OS has four configuration modes to organize the configuration commands – Global,

Line, Router, and Interface. Each configuration mode supports a set of commands specific to the

configurable parameters for the mode. For example, all Frame Relay configuration commands are

accessible only through the Interface Configuration Mode (for the virtual Frame Relay interface). The

following table contains a brief description of each level.

Enable entering

enable

while in the

Basic command security level

as follows:

enable

#• manage the startup and running

configurations

• use the debug commands

• enter any of the configuration modes

Note To prevent unauthorized users from accessing the configuration functions of your product,

immediately install an Enable-level password. Refer to the Quick Configuration Guides

and Quick Start Guides located on the Secure Router OS Documentation CD provided

with your unit for more information on configuring a password.

Mode Access by... Sample Prompt With this mode you

can...

Global entering

config

while at the Enable

command security level prompt.

For example:

>enable

config term

(config)#

• set the system’s

Enable-level

password(s)

• configure the

system global IP

parameters

• configure the SNMP

parameters

• enter any of the

other configuration

modes

Line specifying a line (console or Telnet)

while at the Global Configuration Mode

prompt.

For example:

>enable

#config term

(config)#

line console 0

(config-con0)#

• configure the

console terminal

settings (datarate,

etc.)

• create Telnet logins

and specify their

parameters (login

password, etc.)

Level Access by... Prompt With this level you can...

Command Reference Guide Using CLI Shortcuts

Using CLI Shortcuts

The provides several shortcuts which help you configure your Secure Router OS product more easily. See

the following table for descriptions.

Router entering

router rip

router

router ospf

while at the Global

Configuration Mode prompt.

For example:

>enable

#config term

(config)#

router rip

(config-rip)#

• configure RIP or

OSPF parameters

• suppress route

updates

• redistribute

information from

outside routing

sources (protocols)

Interface specifying an interface (T1, Ethernet,

Frame Relay, ppp, etc.) while in the

Global Configuration Mode.

For example:

>enable

#config term

(config)#

int eth 0/1

(config-eth 0/1)#

(The above prompt is for the

Ethernet

LAN

interface located

on the rear panel of the unit.)

•configure

parameters for the

available LAN and

WAN interfaces

Shortcut Description

Up arrow key To re-display a previously entered command, use the up arrow key. Continuing to press

the up arrow key cycles through all commands entered starting with the most recent

command.

Tab key Pressing the <Tab> key after entering a partial (but unique) command will complete the

command, display it on the command prompt line, and wait for further input.

? The CLI contains help to guide you through the configuration process. Using the question

mark, do any of the following:

• Display a list of all subcommands in the current mode. For example:

(config-t1 1/1)#

coding ?

ami - Alternate Mark Inversion

b8zs - Bipolar Eight Zero Substitution

• Display a list of available commands beginning with certain letter(s). For example:

(config)#

ip d?

default-gateway dhcp-server domain-lookup domain-name

domain-proxy

• Obtain syntax help for a specific command by entering the command, a space, and

then a question mark (?). The CLI displays the range of values and a brief

description of the next parameter expected for that particular command. For

example:

(config-eth 0/1)#

mtu ?

<64-1500> - MTU (bytes)

Mode Access by... Sample Prompt With this mode you

can...

Command Reference Guide Performing Common CLI Functions

Performing Common CLI Functions

The following table contains descriptions of common CLI commands.

<Ctrl> + A Jump to the beginning of the displayed command line. This shortcut is helpful when using

the

form of commands (when available). For example, pressing <Ctrl + A> at the

following prompt will place the cursor directly after the

(config-eth 0/1)#

ip address 192.33.55.6

<Ctrl> + E Jump to the end of the displayed command line. For example, pressing <Ctrl + E> at the

following prompt will place the cursor directly after the

(config-eth 0/1)#

ip address 192.33.55.6

<Ctrl> + U Clears the current displayed command line. The following provides an example of the <Ctrl

+ U> feature:

(config-eth 0/1)#

ip address 192.33.55.6

(Press <Ctrl + U> here)

(config-eth 0/1)#

auto finish You need only enter enough letters to identify a command as unique. For example,

entering

int t1 1/1

at the Global configuration prompt provides you access to the

configuration parameters for the specified T1 interface. Entering

interface t1 1/1

would work as well, but is not necessary.

Command Description

The

command provides a way to execute commands in

other command sets without taking the time to exit the

current and enter the desired one. The following example

shows the

command used to view the Frame Relay

interface configuration while currently in the T1 interface

command set:

(config)#

interface t1 1/1

(config-t1 1/1)#

do show interfaces fr 7

To undo an issued command or to disable a feature, enter

before the command.

For example:

no shutdown t1 1/1

copy running-config startup-config

When you are ready to save the changes made to the

configuration, enter this command. This copies your

changes to the unit’s nonvolatile random access memory

(NVRAM). Once the save is complete, the changes are

retained even if the unit is shut down or suffers a power

outage.

show running config

Displays the current configuration.

Shortcut Description

Command Reference Guide Understanding CLI Error Messages

Understanding CLI Error Messages

The following table lists and defines some of the more common error messages given in the CLI

debug

Use the

debug

command to troubleshoot problems you

may be experiencing on your network. These commands

provide additional information to help you better interpret

possible problems. For information on specific debug

commands, refer to the section

Enable Mode Command

Set

on page 20.

undebug all

To turn off any active debug commands, enter this

command.

Caution The overhead associated with the debug command takes up a large portion of your

product’s resources and at times can halt other processes. It is best to only use the debug

command during times when the network resources are in low demand (non-peak hours,

weekends, etc.).

Message Helpful Hints

%Ambiguous command

%Unrecognized Command

The command may not be valid in the current command mode, or you may

not have entered enough correct characters for the command to be

recognized. Try using the “?” command to determine your error. See

Using

CLI Shortcuts

on page 6 for more information.

%Invalid or incomplete

command

The command may not be valid in the current command mode, or you may

not have entered all of the pertinent information required to make the

command valid. Try using the “?” command to determine your error. See

Using CLI Shortcuts

on page 6 for more information.

%Invalid input

detected at “^" marker

The error in command entry is located where the caret (^) mark appears.

Enter a question mark at the prompt. The system will display a list of

applicable commands or will give syntax information for the entry.

Command Description

Command Reference Guide Command Descriptions

COMMAND DESCRIPTIONS

This portion of the guide provides a detailed listing of all available commands for the CLI (organized by

command set). Each command listing contains pertinent information including the default value, a

description of all sub-command parameters, functional notes for using the command, and a brief

technology review. To search for a particular command alphabetically, use the Index. To search for

information on a group of commands within a particular command set, use the linked references given

below:

Basic Mode Command Set on page 10

Enable Mode Command Set on page 20

Global Configuration Mode Command Set on page 200

DHCP Pool Command Set on page 355

IKE Policy Command Set on page 373

IKE Policy Attributes Command Set on page 386

IKE Client Command Set on page 392

Crypto Map IKE Command Set on page 396

Crypto Map Manual Command Set on page 405

Radius Group Command Set on page 416

CA Profile Configuration Command Set on page 418

Certificate Configuration Command Set on page 429

Ethernet Interface Configuration Command Set on page 433

DDS Interface Configuration Command Set on page 486

Serial Interface Configuration Command Set on page 494

T1 Interface Configuration Command Set on page 504

DSX-1 Interface Configuration Command Set on page 520

E1 Interface Configuration Command Set on page 530

G.703 Interface Configuration Command set on page 545

Modem Interface Configuration Command Set on page 552

BRI Interface Configuration Command set on page 556

Frame Relay Interface Config Command Set on page 567

Frame Relay Sub-Interface Config Command Set on page 587

ATM Interface Config Command Set on page 644

ATM Sub-Interface Config Command Set on page 647

ADSL Interface Config Command Set on page 701

BGP Configuration Command Set on page 705

BGP Neighbor Configuration Command Set on page 711

PPP Interface Configuration Command Set on page 715

Tunnel Configuration Command Set on page 778

HDLC Command Set on page 811

Loopback Interface Configuration Command Set on page 847

Line (Console) Interface Config Command Set on page 876

Line (Telnet) Interface Config Command Set on page 887

Router (RIP) Configuration Command Set on page 894

Router (OSPF) Configuration Command Set on page 903

Common Commands on page 922

SROS Command Line Interface Reference Guide Basic Mode Command Set

BASIC MODE COMMAND SET

To activate the Basic Mode, simply log in to the unit. After connecting the unit to a VT100 terminal (or

terminal emulator) and activating a terminal session, the following prompt displays:

Router>

The following command is common to multiple command sets and is covered in a centralized section of

this guide. For more information, refer to the section listed below:

exit on page 930

All other commands for this command set are described in this section in alphabetical order.

enable on page 11

logout on page 12

ping <address> on page 13

show clock on page 15

show snmp on page 16

show version on page 17

telnet <address> on page 18

traceroute <address> on page 19

SROS Command Line Interface Reference Guide Basic Mode Command Set

enable

Use the enable command (at the Basic Command Mode prompt) to enter the Enable Command Mode. Use

the disable command to exit the Enable Command Mode. See the section enable on page 11 for more

information.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

> Basic Command Mode

Functional Notes

The Enable Command Mode provides access to operating and configuration parameters and should be

password protected to prevent unauthorized use. Use the

enable password

command (found in the Global

Configuration) to specify an Enable Command Mode password. If the password is set, access to the Enable

Commands (and all other “privileged” commands) is only granted when the correct password is entered.

Usage Examples

The following example enters the Enable Command Mode and defines an Enable Command Mode password:

enable

configure terminal

(config)#

enable password password

At the next login, the following sequence must occur:

enable

Password:

******

SROS Command Line Interface Reference Guide Basic Mode Command Set

logout

Use the logout command to terminate the current session and return to the login screen.

Syntax Description

No subcommands.

Default Values

No defaults necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following example shows the logout command being executed in the Basic Mode:

logout

Session now available

Press RETURN to get started.

SROS Command Line Interface Reference Guide Basic Mode Command Set

ping <address>

Use the ping command (at the Basic Command Mode prompt) to verify IP network connectivity.

Syntax Description

<address> Optional.

Specifies the IP address of the system to ping. Entering the

ping

command

with no specified address prompts the user with parameters for a more detailed

ping

configuration. See

Functional Notes

(below) for more information.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Functional Notes

The

ping

command helps diagnose basic IP network connectivity using the Packet InterNet Groper program to

repeatedly bounce Internet Control Message Protocol (ICMP) Echo_Request packets off a system (using a

specified IP address). The Secure Router OS allows executing a standard

ping

request to a specified IP

address or provides a set of prompts to configure a more specific

ping

configuration.

The following is a list of output messages from the

ping

command:

Success

Destination Host Unreachable

Invalid Host Address

TTL Expired in Transit

Unknown Host

Request Timed Out

The following is a list of available extended

ping

fields with descriptions:

Target IP address:

Specifies the IP address of the system to ping.

Repeat Count:

Number of ping packets to send to the system (valid range: 1 to 1000000).

Datagram Size:

SROS Command Line Interface Reference Guide Basic Mode Command Set

Size (in bytes) of the ping packet (valid range: 1 to 1448).

Timeout in Seconds:

If a ping response is not received within the timeout period, the ping is considered unsuccessful (valid range: 1

to 5 seconds).

Extended Commands:

Specifies whether additional commands are desired for more ping configuration parameters.

Source Address (or interface):

Specifies the IP address to use as the source address in the ECHO_REQ packets.

Data Pattern:

Specify an alphanumerical string to use (the ASCII equivalent) as the data pattern in the ECHO_REQ packets.

Sweep Range of Sizes:

Varies the sizes of the ECHO_REQ packets transmitted.

Sweep Min Size:

Specifies the minimum size of the ECHO_REQ packet (valid range: 0 to 1448).

Sweep Max Size:

Specifies the maximum size of the ECHO_REQ packet (valid range: Sweep Min Size to 1448).

Sweep Interval:

Specifies the interval used to determine packet size when performing the sweep (valid range: 1 to 1448).

Verbose Output:

Specifies an extended results output.

Usage Examples

The following is an example of a successful

ping

command:

ping

Target IP address:

192.168.0.30

Repeat count[1-1000000]:

Datagram Size [1-1000000]:

100

Timeout in seconds [1-5]:

Extended Commands? [y or n]:

Type CTRL+C to abort.

Legend: '!' = Success '?' = Unknown host '$' = Invalid host address

'*' = Request timed out '-' = Destination host unreachable

'x' = TTL expired in transit

Pinging 192.168.0.30 with 100 bytes of data:

!!!!!

Success rate is 100 percent (5/5) round-trip min/avg/max = 19/20.8/25 ms

SROS Command Line Interface Reference Guide Basic Mode Command Set

show clock

Use the show clock command to display the system time and date entered using the clock set command.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following example displays the current time and data from the system clock:

show clock

23:35:07 UTC Tue Aug 20 2002

SROS Command Line Interface Reference Guide Basic Mode Command Set

show snmp

Use the show snmp command to display the system Simple Network Management Protocol (SNMP)

parameters and current status of SNMP communications.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following is an example output using the

show snmp

command for a system with SNMP disabled and the

default Chassis and Contact parameters:

show snmp

Chassis: Chassis ID

Contact: Customer Service

0 Rx SNMP packets

0 Bad community names

0 Bad community uses

0 Bad versions

0 Silent drops

0 Proxy drops

0 ASN parse errors

SROS Command Line Interface Reference Guide Basic Mode Command Set

show version

Use the show version command to display the current Secure Router OS version information.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following is a sample

show version

output:

show version

ProCurve Secure Router 7203dl

SROS Version: J02.01.01

Checksum: 5509EBDC, built on: Mon Mar 21 14:48:04 2005

Boot ROM version J02.01.01

Checksum: 9C0F, built on: Mon Mar 21 14:48:24 2005

Platform: ProCurve Secure Router 7203dl

Serial number US449TS029

Flash: 33554432 bytes DRAM: 268435455 bytes

System uptime is 0 days, 21 hours, 27 minutes, 0 seconds

Current system image file is "CFLASH:/J02_01_01.biz"

Boot system image file is "CFLASH:/J02_01_01.biz"

Primary system configuration file is "startup-config"

System booted up using configuration file: "startup-config"

SROS Command Line Interface Reference Guide Basic Mode Command Set

telnet <address>

Use the telnet command to open a Telnet session (through the Secure Router OS) to another system on the

network.

Syntax Description

<address> Specifies the IP address of the remote system.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following example opens a Telnet session with a remote system (10.200.4.15):

telnet 10.200.4.15

User Access Login

Password:

SROS Command Line Interface Reference Guide Basic Mode Command Set

traceroute <address>

Use the traceroute command to display the IP routes a packet takes to reach the specified destination.

Syntax Description

<address> Specifies the IP address of the remote system to trace the routes to

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following example performs a traceroute on the IP address 192.168.0.1:

traceroute 192.168.0.1

Type CTRL+C to abort.

Tracing route to 192.168.0.1 over a maximum of 30 hops

1 22ms 20ms 20ms 192.168.0.65

2 23ms 20ms 20ms 192.168.0.1

SROS Command Line Interface Reference Guide Enable Mode Command Set

ENABLE MODE COMMAND SET

To activate the Enable Mode, enter the enable command at the Basic Mode prompt. (If an enable password

has been configured, a password prompt will display.) For example:

Router>enable

Password: XXXXXXX

Router#

The following commands are common to multiple command sets and are covered in a centralized section

of this guide. For more information, refer to the section listed below:

bind <#> <from interface> <slot/port> <tdm-group#> <to interface> <slot/port> on page 924

description on page 927

exit on page 930

ping <address> on page 931

show running-config on page 933

All other commands for this command set are described in this section in alphabetical order.

clear commands begin on page 22

clock auto-correct-dst on page 48

clock set <time> <day> <month> <year> on page 50

clock timezone <text> on page 51

configure on page 53

copy <source> <destination> on page 54

copy console <filename> on page 55

copy flash <destination> on page 56

copy <filename> interface <interface> <slot/port> on page 57

copy tftp <destination> on page 58

copy xmodem <destination> on page 59

debug commands begin on page 60

dir on page 98

disable on page 99

erase [<filename> | startup-config] on page 100

events on page 101

logout on page 102

reload [cancel | in <delay>] on page 103

show commands begin on page 104

telnet <address> on page 194

SROS Command Line Interface Reference Guide Enable Mode Command Set

terminal length <text> on page 195

traceroute <address> on page 196

undebug all on page 197

wall <message> on page 198

write [erase | memory | network | terminal] on page 199

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear access-list <listname>

Use the clear access-list command to clear all counters associated with all access lists (or a specified

access list).

Syntax Description

<listname> Optional. Specifies the name (label) of an access list

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example clears all counters for the access list labeled MatchAll:

>enable

#clear access-list MatchAll

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear arp-cache

Use the clear arp-cache command to remove all dynamic entries from the Address Resolution Protocol

(ARP) cache table.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example removes all dynamic entries from the ARP cache:

>enable

#clear arp-cache

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear arp-entry <address>

Use the clear arp-entry command to remove a single entry from the Address Resolution Protocol (ARP)

cache.

Syntax Description

<address> Specifies the IP address of the entry to remove

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example removes the entry for 10.200.4.56 from the ARP cache:

>enable

#clear arp-entry 10.200.4.56

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear bridge <group#>

Use the clear bridge command to clear all counters associated with bridging (or for a specified

bridge-group).

Syntax Description

<group#> Optional.

Specifies a single bridge group (1-255).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example clears all counters for bridge group 17:

>enable

#clear bridge 17

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear buffers max-used

Use the clear buffers max-used command to clear the maximum-used statistics for buffers displayed in

the show memory heap command.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

>enable

#clear buffers max-used

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear counters <interface>

Use the clear counters command to clear all interface counters (or the counters for a specified interface).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example clears all counters associated with the Ethernet 0/1 interface:

>enable

#clear counters ethernet 0/1

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear crypto ike sa <policy priority>

Use the clear crypto ike sa command to clear existing IKE security associations (SAs), including active

ones.

Syntax Description

<policy priority> Optional.

Clear out all existing IKE SAs associated with the designated policy priority.

This number is assigned using the

crypto ike policy

command.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example clears the entire database of IKE SAs (including the active associations):

>enable

#clear crypto ike sa

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear crypto ipsec sa

Use the clear crypto ipsec sa command to clear existing IPSec security associations (SAs), including

active ones.

Variations of this command include the following:

clear crypto ipsec sa

clear crypto ipsec sa entry <ip address> ah <SPI>

clear crypto ipsec sa entry <ip address> esp <SPI>

clear crypto ipsec sa map <map name>

clear crypto ipsec sa peer <ip address>

Syntax Description

entry

Clear only the SAs related to a certain destination IP address.

<SPI>

Clear only a portion of the SAs by specifying the AH (authentication header)

protocol and a security parameter index (SPI). You can determine the correct SPI

value using the show crypto ipsec sa command.

esp

<SPI>

Clear only a portion of the SAs by specifying the ESP (encapsulating security

payload) protocol and a security parameter index (SPI). You can determine the

correct SPI value using the show crypto ipsec sa command.

map

Clear only the SAs associated with the crypto map name given.

peer

Clear only the SAs associated with the far-end peer IP address given.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear dump-core

The clear dump-core command clears diagnostic information appended to the output of the show version

command. This information results from an unexpected unit reboot.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example clears the entire database of IKE SAs (including the active associations):

>enable

#clear dump-core

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear event-history

Use the clear event-history command to clear all messages logged to the local event-history.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example clears all local event-history messages:

>enable

#clear event-history

Warning Messages cleared from the local event-history (using the clear event-history command)

are no longer accessible.

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear ip bgp [* | <as-number> | <ip address>] [in | out | soft]

Use the clear ip bgp command to clear BGP neighbors as specified.

Syntax Description

*Clears all BGP neighbors.

<as-number> Clears all BGP neighbors with the specified AS number. Range is 1 to 65,535.

<ip address> Clears the BGP neighbor with the specified IP address.

in Causes a “soft” reset inbound with a neighbor, reprocessing routes advertised by

that neighbor.

out Causes a “soft” reset outbound with a neighbor, re-sending advertised routes to

that neighbor.

soft Causes a “soft” reset both inbound and outbound.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

The clear ip bgp command must be issued to re-initialize the BGP process between the peers matching

the given arguments. Most neighbor changes, including changes to prefix-list filters, do not take effect until

the clear command is issued. A hard reset clears the TCP connection with the specified peers which

results in clearing the table. This method of clearing is disruptive and causes peer routers to record a route

flap for each route.

The out version of this command provides a soft reset out to occur by causing all routes to be re-sent to

the specified peer(s). TCP connections are not torn down so this method is less disruptive. Output

filters/policies are re-applied before sending the update.

The in version of this command provides a soft reset in to occur by allowing the router to receive an

updated table from a peer without tearing down the TCP connection. This method is less disruptive and

does not count as a route flap. Currently all of the peer's routes are stored permanently, even if they are

filtered by a prefix list. The command causes the peer's routes to be reprocessed with any new

parameters.

Usage Examples

The following example causes a hard reset with peers with an AS number of 101:

#clear ip bgp 101

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear ip igmp group [<group-address> | <interface>]

Use the clear ip igmp group command to clear entries from the Internet Group Management Protocol

(IGMP) tables. If no address or interface is specified, all non-static IGMP groups are cleared with this

command.

Syntax Description

<group-address> Optional.

Specifies the multicast IP address of the multicast group.

<interface> Optional.

Designates the clearing of parameters for a specific interface (in the format

type slot/port

). For example: eth 0/1.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example shows output for the show igmp groups command before and after a

clear ip igmp group command is issued. This example clears the IGMP entry that was registered

dynamically by a host. Interfaces that are statically joined are not cleared:

#show ip igmp groups

IGMP Connected Group Membership

Group Address

Interface

Uptime

Expires

Last Reporter

172.0.1.50

Loopback100

01:22:59

00:02:46

172.23.23.1

172.1.1.1

Ethernet0/1

00:00:14

00:02:45

1.1.1.2

172.1.1.1

Loopback100

01:22:59

SROS Command Line Interface Reference Guide Enable Mode Command Set

00:02:46

172.23.23.1

#clear ip igmp group

#show ip igmp groups

IGMP Connected Group Membership

Group Address

Interface

Uptime

Expires

Last Reporter

This version of the command clears all dynamic groups that have the specified output interface (Ethernet

0/1):

#clear ip igmp group ethernet 0/1

This version of the command clears the specified group on all interfaces where it is dynamically registered:

#clear ip igmp group 172.1.1.1

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear ip policy-sessions

Use the clear ip policy-sessions command to clear policy class sessions. You may clear all the sessions or

a specific session. Refer to the show ip policy-sessions for a current session listing. The following lists the

complete syntax for the clear ip policy-sessions commands:

clear ip policy-sessions

clear ip policy-sessions <classname> [ahp | esp | gre | icmp | tcp | udp | <protocol>] <source ip>

clear ip policy-sessions <classname> [ahp | esp | gre | icmp | tcp | udp | <protocol>] <source ip>

<source port><dest ip><dest port> [destination | source] <nat ip><nat port>

Syntax Description

<classname> Alphanumeric descriptor for identifying the configured access policy (access

policy descriptors are not case-sensitive).

<protocol> A specific protocol (valid range: 0-255).

<source ip> Specifies the source IP address (format is A.B.C.D).

<source port> Specifies the source port (in hexadecimal format for ahp, esp, and gre; decimal for

all other protocols).

<dest ip> Specifies the destination IP address (format is A.B.C.D).

<dest port> Specifies the destination port (in hex format for ahp, esp, and gre; decimal for all

other protocols).

[destination | source] For NAT sessions, this specifies whether to select a NAT source or NAT

destination session.

<nat ip> For NAT sessions, this specifies the NAT IP address (format is A.B.C.D).

<nat port> For NAT sessions, this specifies the NAT port (in hex format for ahp, esp, and gre;

decimal for all other protocols).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

The second half of this command, beginning with the source IP address may be copied and pasted from a

row in the show ip policy-sessions table for easier use.

SROS Command Line Interface Reference Guide Enable Mode Command Set

Usage Examples

The following example clears the Telnet association (TCP port 23) for policy class "pclass1" with source IP

address 192.22.71.50 and destination 192.22.71.130:

>enable

#clear ip policy-sessions pclass1 tcp 192.22.71.50 23 192.22.71.130 23

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear ip policy-stats <classname> entry <policy class #>

Use the clear ip policy-stats command to clear statistical counters for policy classes

Syntax Description

<classname> Optional.

Specifies the policy class to clear. If no policy class is specified, statistics

are cleared for all policies.

entry Optional. Use this optional keyword to clear statistics of a specific policy class

entry

<policy class #> Optional. Specifies the policy class entry number.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example clears statistical counters for all policy classes:

>enable

#clear ip policy-stats

The following example clears statistical counters for the policy class MatchALL:

>enable

#clear ip policy-stats MatchALL

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear ip prefix-list <listname>

Use the clear ip prefix-list command to clear the IP prefix list hit count shown in the show ip prefix-list

detail output.

Syntax Description

<listname> Specifies of the IP prefix list to clear.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example clears the hit count statistics for prefix list test:

>enable

#clear ip prefix-list test

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear ip route

Use the clear ip route command to remove all learned routes from the IP route table. Static and connected

routes are not cleared by this command.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example removes all learned routes from the route table:

>enable

#clear ip route *

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear lldp counters

Use the clear lldp counters command to reset all LLDP packet counters to 0 on all interfaces.

Syntax Description

No subcommands.

Default Values

There are no default settings for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example resets all LLDP counters:

>enable

#clear lldp counters

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear lldp counters interface <interface>

Use the clear lldp counters interface command to reset all LLDP packet counters to 0 for a specified

interface.

Syntax Description

<interface> Clears the information for the specified interface. Type clear lldp counters

interface ? for a complete list of applicable interfaces.

Default Values

No default values are necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example resets the counters on a PPP interface:

>enable

#clear lldp counters interface ppp 1

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear lldp neighbors

Use the clear lldp neighbors command to remove all neighbors from this unit’s database. As new LLDP

packets are received, the database will contain information about neighbors included in those frames.

Syntax Description

No subcommands.

Default Values

There are no default settings for this command.

Command Modes

# Enable Command Mode

Functional Notes

This command generates output indicating the names of any neighbors deleted from the database and the

name of the interface on which the neighbor was learned.

Usage Examples

The following example clears LLDP neighbor Switch_1 from the Ethernet interface 0/1:

>enable

#clear lldp neighbors

LLDP: Deleted neighbor “Switch_1” on interface eth 0/1

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear pppoe <interface id>

Use the clear pppoe command to terminate the current PPPoE client session and cause the Secure Router

OS to try and re-establish the session.

Syntax Description

<interface id> PPP interface number.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example ends the current PPPoE client session for ppp 1:

>enable

#clear pppoe 1

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear process cpu max

Use the clear process cpu max command to clear the maximum CPU usage statistic which is visible in the

show process cpu command.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example resets the CPU maximum usage statistics:

>enable

#clear process cpu max

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear qos map

Use the clear qos map command to clear the statistics for all defined QoS maps or to view detailed

information for maps meeting user-configured specifications.

Variations of this command include the following:

clear qos map <map name>

clear qos map <map name> <sequence number>

clear qos map <interface>

Syntax Description

<map name> Enter the name of a defined QoS map.

<sequence number> Enter one of the map’s defined sequence numbers.

<interface> Specify an interface to clear QoS map statistics for just that interface (e.g.,

frame-relay, ppp).

Default Values

No default value necessary for this command.

Command Modes

# Enable mode

Usage Examples

clears statistics for all defined QoS map:

#clear qos map

clears statistics for all entries in the “priority” QoS map:

#clear qos map priority

clears statistics in entry “10” of the “priority” QoS map:

#clear qos map priority 10

clears QoS statistics for a specified interface:

#clear qos map interface frame-relay 1

Note The clear counters command clears ALL interface statistics (including QoS map interface

statistics).

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear spanning-tree counters [interface <interface>]

The clear spanning-tree counters command clears the following counts: BPDU transmit, BPDU receive,

and number of transitions to forwarding state.

Syntax Description

interface <interface> Optional.

Specifies a single interface. Enter

clear spanning-tree counters ?

for a

complete list of interfaces.

Default Values

No default value necessary for this command.

Command Modes

# Enable mode

Usage Examples

The following example clears the spanning tree counters for Ethernet 0/1:

>enable

#clear spanning-tree counters interface eth 0/1

SROS Command Line Interface Reference Guide Enable Mode Command Set

clear spanning-tree detected-protocols [interface ethernet

<interface id>]

Use the clear spanning-tree detected-protocols command to restart the protocol migration process.

Syntax Description

interface Optional.

Choose the

ethernet

interface.

<interface id> Optional.

Enter a valid interface ID (e.g.,

0/1

for Ethernet 0/1).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

The ProCurve Secure Router has the ability to operate using the rapid spanning-tree protocol or the legacy

802.1D version of spanning-tree. When a BPDU (bridge protocol data unit) of the legacy version is

detected on an interface, the ProCurve Secure Router automatically regresses to using the 802.1D

spanning-tree protocol for that interface. Issue the clear spanning-tree detected-protocols command to

return to rapid spanning-tree operation.

Usage Examples

The following example re-initiates the protocol migration process on eth 0/2:

>enable

#clear spanning-tree detected-protocols interface ethernet 0/2

The following example re-initiates the protocol migration process on all interfaces:

>enable

#clear spanning-tree detected-protocols

SROS Command Line Interface Reference Guide Enable Mode Command Set

clock auto-correct-dst

The clock auto-correct-dst command allows the automatic one-hour correction for Daylight Saving Time

(DST). Use the clock no-auto-correct-dst command to disable this feature.

Syntax Description

No subcommands.

Default Values

By default this command is enabled.

Command Modes

# Enable mode

Usage Examples

The following example allows for automatic DST correction:

>enable

#clock auto-correct-DST

SROS Command Line Interface Reference Guide Enable Mode Command Set

clock no-auto-correct-dst

The clock no-auto-correct-dst command allows you to override the automatic one-hour correction for

Daylight Saving Time (DST).

Syntax Description

No subcommands.

Default Values

No default value is necessary for this command.

Command Modes

# Enable mode

Functional Notes

Many time zones include an automatic one-hour correction for daylight saving time at the appropriate time.

You may override it at your location using this command.

Usage Examples

The following example overrides the one-hour offset for DST:

>enable

#clock no-auto-correct-DST

SROS Command Line Interface Reference Guide Enable Mode Command Set

clock set <time> <day> <month> <year>

Use the clock set command to configure the system software clock. For the command to be valid, all fields

must be entered. See the Usage Example below for an example.

Syntax Description

<time> Sets the time of the system software clock in the format HH:MM:SS

(hours:minutes:seconds).

<day> Sets the current day of the month (valid range: 1 to 31).

<month> Sets the current month (valid range: January to December). You need only enter

enough characters to make the entry unique. This entry is not case-sensitive.

<year> Sets the current year (valid range: 2000 to 2100).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example sets the system software clock for 3:42 pm, August 22 2004:

>enable

#clock set 03:42:00 22 Au 2004

SROS Command Line Interface Reference Guide Enable Mode Command Set

clock timezone <text>

The clock timezone command sets the unit’s internal clock to the timezone of your choice. This setting is

based on the difference in time (in hours) between Greenwich Mean Time (GMT) or Central Standard

Time (CST) and the timezone for which you are setting up the unit. Use the no form of this command to

disable this feature.

Syntax Description

<text> Specifies the difference in time (in hours) between Greenwich Mean Time (GMT)

or Central Standard Time (CST) and the timezone for which you are setting up the

unit.

Default Values

No default value is necessary for this command.

Command Modes

# Enable mode

SROS Command Line Interface Reference Guide Enable Mode Command Set

Functional Notes

The following list shows sample cities and their timezone codes.

Usage Examples

The following example sets the timezone for Santiago, Chile.

>enable

#clock timezone -4-Santiago

clock timezone +1-Amsterdam

clock timezone +1-Belgrade

clock timezone +1-Brussels

clock timezone +1-Sarajevo

clock timezone +1-West-Africa

clock timezone +10-Brisbane

clock timezone +10-Canberra

clock timezone +10-Guam

clock timezone +10-Hobart

clock timezone +10-Vladivostok

clock timezone +11

clock timezone +12-Auckland

clock timezone +12-Fiji

clock timezone +13

clock timezone +2-Athens

clock timezone +2-Bucharest

clock timezone +2-Cairo

clock timezone +2-Harare

clock timezone +2-Helsinki

clock timezone +2-Jerusalem

clock timezone +3-Baghdad

clock timezone +3-Kuwait

clock timezone +3-Moscow

clock timezone +3-Nairobi

clock timezone +3:30

clock timezone +4-Abu-Dhabi

clock timezone +4-Baku

clock timezone +4:30

clock timezone +5-Ekaterinburg

clock timezone +5-Islamabad

clock timezone +5:30

clock timezone +5:45

clock timezone +6-Almaty

clock timezone +6-Astana

clock timezone +6-Sri-Jay

clock timezone +6:30

clock timezone +7-Bangkok

clock timezone +7-Kranoyarsk

clock timezone +8-Bejing

clock timezone +8-Irkutsk

clock timezone +8-Kuala-Lumpur

clock timezone +8-Perth

clock timezone +8-Taipei

clock timezone +9-Osaka

clock timezone +9-Seoul

clock timezone +9-Yakutsk

clock timezone +9:30-Adelaide

clock timezone +9:30-Darwin

clock timezone -1-Azores

clock timezone -1-Cape-Verde

clock timezone -10

clock timezone -11

clock timezone -12

clock timezone -2

clock timezone -3-Brasilia

clock timezone -3-Buenos-Aires

clock timezone -3-Greenland

clock timezone -3:30

clock timezone -4-Atlantic-Time

clock timezone -4-Caracus

SROS Command Line Interface Reference Guide Enable Mode Command Set

configure

Use the configure command to enter the Global Configuration Mode or to configure the system from

memory. See Global Configuration Mode Command Set on page 200 for more information.

Syntax Description

terminal Enter the Global Configuration Mode.

memory Configure the active system with the commands located in the default

configuration file stored in NVRAM.

network Configure the system from a TFTP network host.

overwrite-network Overwrite NVRAM memory from a TFTP network host.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example enters the Global Configuration Mode from the Enable Command Mode:

>enable

#configure terminal

(config)#

SROS Command Line Interface Reference Guide Enable Mode Command Set

copy <source> <destination>

Use the copy command to copy any file from a specified source to a specified destination.

Syntax Description

<source> Specifies the current location of the file.

Valid sources include: running-config (current running configuration file),

startup-config (configuration file located in NVRAM), or a filename (located in

FLASH memory).

<destination> Specifies the destination of the copied file.

Valid destinations include: running-config (current running configuration file),

startup-config (configuration file located in NVRAM), or a filename (located in

FLASH memory).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following provides various sample copy commands:

>enable

Creates a copy of the file myfile.biz (located in FLASH memory) and names it newfile.biz:

#copy myfile.biz newfile.biz

Creates a backup copy of the startup configuration file (and places in FLASH memory):

#copy startup-config backup.bak

Copies the current running-configuration file to the startup configuration file located in NVRAM:

#copy running-config startup-config

SROS Command Line Interface Reference Guide Enable Mode Command Set

copy console <filename>

Use the copy console command to copy the console’s input to a text file. To end copying to the text file,

type <Ctrl+D>. The file will be saved in the SROS root directory.

Syntax Description

<filename> Specify destination file for console input.

Default Values

No default is necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

The copy console command works much like a line editor. Prior to pressing <Enter>, changes can be

made to the text on the line. Changes can be made using <Delete> and <Backspace> keys. The text can

be traversed using the arrow keys, <Ctrl+A> (to go to the beginning of a line), and <Ctrl+E> (to go to the

end of a line). To end copying to the text file, type <Ctrl+D>. The file will be saved in the Secure Router OS

root directory. Use the dir command to see a list of files in the root directory.

Usage Examples

The following example copies the console input into the file config, located in the Secure Router OS root

directory:

>enable

#copy console config

SROS Command Line Interface Reference Guide Enable Mode Command Set

copy flash <destination>

Use the copy flash command to copy a file located in flash memory to a specified destination.

Syntax Description

<destination> Specifies the destination of the copied file. Valid destinations include tftp and

xmodem.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example copies the contents of the unit’s flash memory to a TFTP server:

>enable

#copy flash tftp

SROS Command Line Interface Reference Guide Enable Mode Command Set

copy <filename> interface <interface> <slot/port>

Use the copy interface command to copy a file to a specified interface.

Syntax Description

<filename> Specify file name of source file.

<interface> Specify interface to be upgraded.

<slot/port> Specify slot and port number of interface

Default Values

No default is necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example upgrades the ADSL interface with the firmware file configfile:

>enable

#copy configfile interface adsl 0/1

SROS Command Line Interface Reference Guide Enable Mode Command Set

copy tftp <destination>

Use the copy tftp command to copy a file located on a network Trivial File Transfer Protocol (TFTP)

server to a specified destination.

Syntax Description

<destination> Specifies the destination of the file copied from the TFTP server.

Valid destinations include: flash (FLASH memory), startup-config (the

configuration file stored in NVRAM), or running-config (the current running

configuration file).

After entering copy tftp and specifying a destination, the Secure Router OS

prompts for the following information:

Address of remote host: IP address of the TFTP server.

Source filename: Name of the file to copy from the TFTP server.

Destination filename: Specifies the filename to use when storing the copied file to FLASH memory.

(Valid only for the copy tftp flash command.)

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example copies myfile.biz from the TFTP server (10.200.2.4) to flash memory and labels it

newfile.biz:

#copy tftp flash

Address of remote host?10.200.2.4

Source filename myfile.biz

Destination filename newfile.biz

Initiating TFTP transfer...

Received 45647 bytes.

Transfer Complete!

SROS Command Line Interface Reference Guide Enable Mode Command Set

copy xmodem <destination>

Use the copy xmodem command to copy a file (using the XMODEM protocol) to a specified destination.

XMODEM capability is provided in terminal emulation software such as HyperTerminal™.

Syntax Description

<destination> Specifies the destination of the copied file.

Valid destinations include: flash (FLASH memory), startup-config (the

configuration file stored in NVRAM), or running-config (the current running

configuration file).

After entering copy xmodem and specifying a destination, the Secure Router OS

prompts for the following information:

Destination filename: Specifies the filename to use when storing the copied file to FLASH memory.

(Valid only for the copy flash command.)

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example copies a .biz file to flash memory and labels it newfile.biz:

#copy xmodem flash

Destination filename newfile.biz

Begin the Xmodem transfer now...

Press CTRL+X twice to cancel

CCCCCC

The Secure Router OS is now ready to accept the file on the CONSOLE port (using the XMODEM

protocol). The next step in the process may differ depending on the type of terminal emulation software

you are using. For HyperTerminal, you will now select Transfer > Send File and browse to the file you

wish to copy. Once the transfer is complete, information similar to the following is displayed:

Received 231424 bytes.

Transfer complete.

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug aaa

Use the debug aaa command to activate debug messages associated with authentication from the AAA

subsystem. Debug messages are displayed (real-time) on the terminal (or Telnet) screen. Use the no form

of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the SROS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug aaa events include connection notices, login attempts, and session tracking.

Usage Examples

The following is sample output for this command:

>enable

#debug aaa

AAA: New Session on portal 'TELNET 0 (172.22.12.60:4867)'.

AAA: No list mapped to 'TELNET 0'. Using 'default'.

AAA: Attempting authentication (username/password).

AAA: RADIUS authentication failed.

AAA: Authentication failed.

AAA: Closing Session on portal 'TELNET 0 (172.22.12.60:4867)'.

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug access-list <listname>

Use the debug access-list command to activate debug messages (for a specified list) associated with access

list operation. Debug messages are displayed (real-time) on the terminal (or Telnet) screen. Use the no

form of this command to disable the debug messages.

Syntax Description

<listname> Specifies a configured access list

Default Values

By default, all debug messages in the SROS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug access-list command provides debug messages to aid in troubleshooting access list issues.

Usage Examples

The following example activates debug messages for the access list labeled MatchAll:

>enable

#debug access-list MatchAll

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug atm events

Use the debug atm events command to display events on all ATM ports and all virtual circuits. Debug

messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this command to

disable debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates ATM event messages:

>enable

#debug atm events

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug atm oam <vcd> loopback [end-to-end | segment] <LLID>

Use the debug atm oam command to display Operation, Administration, and Maintenance (OAM) packets

for a ATM virtual circuit descriptor (VCD). Debug messages are displayed (real-time) to the terminal (or

Telnet) screen. Use the no form of this command to disable debug messages.

Variations of this command include the following:

debug atm oam <vcd>

debug atm oam <vcd> loopback [end-to-end | segment]

debug atm oam <vcd> loopback [end-to-end | segment] <LLID>

Syntax Description

<vcd> Shows OAM packets for a specific VCD.

loopback Configures an OAM loopback.

end-to-end Configures an end-to-end OAM loopback.

segment Configures a segment loopback.

<LLID> Specifies 16 byte OAM loopback location ID (LLID).

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates ATM OAM debug messages for VCD 1:

>enable

#debug atm oam 1

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug atm packet [interface atm | vc] < ATM port | VPI/VCI> vcd <vcd

number>

Use the debug atm packet command to activate debug messages associated with packets on ATM ports

and virtual circuits. Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the

no form of this command to disable the debug messages.

Variations of this command include the following:

debug atm packet .

debug atm packet [interface atm | vc] <port id>

debug atm packet interface atm <port id> vcd <port>

Syntax Description

interface atm Shows packets on a specific ATM port and on all virtual circuits.

vc Shows packets on a specific virtual circuit.

<ATM port> Specifies ATM port number.

<VPI/VCI> Specifies virtual path identifier and virtual channel identifier (VPI/VCI).

vcd Shows packets on specific virtual circuit descriptors (VCD).

<vcd number> Specifies a VCD port number.

Default Values

By default, all debug messages in the SROS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates debug ATM packet debug messages on ATM port 1:

>enable

#debug atm packet interface atm 1

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug bridge

Use the debug bridge command to display messages associated with bridge events. Debug messages are

displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this command to disable debug

messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates bridge debug messages:

#debug bridge

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug crypto [ike | ike negotiation | ike client authentication |

ike client configuration | ipsec | pki]

Use the debug crypto command to activate debug messages associated with IKE and IPSec functions.

Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this

command to disable the debug messages.

Syntax Description

ike Displays all IKE debug messages.

ike negotiation Displays only IKE key management debug messages (e.g., handshaking).

ike client authenticationDisplays IKE client authentication messages as they occur.

ike client configurationDisplays mode-config exchanges as they take place over the IKE SA. It is

enabled independently from the ike negotiation debug described previously.

ipsec Displays all IPSec debug messages.

pki Displays all PKI (public key infrastructure) debug messages.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates the IPSec debug messages:

>enable

#debug crypto ipsec

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug backup

Use the debug backup command to activate debug messages associated with backup operation. Debug

messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this command to

disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug backup command activates debug messages to aid in the troubleshooting of backup links.

Usage Examples

The following example activates debug messages for backup operation:

>enable

#debug backup

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug dialup-interfaces

Use the debug dialup-interfaces command to generate debug messages used to aid in troubleshooting

problems with all dialup interfaces such as the modem or the BRI cards. Use the no version of this

command to disable it.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

When enabled, these messages provide status information on incoming calls, dialing and answering

progress, etc. These messages also give information on why certain calls are dropped or rejected. It is

beneficial to use this command when troubleshooting backup (in addition to the debug backup

command).

Usage Examples

The following example activates the debug messages for dialup interfaces:

>enable

#debug dialup-interfaces

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug dynamic-dns [verbose]

Use the debug dynamic-dns command to display debug messages associated with dynamic DNS. Debug

messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this command to

disable the debug messages.

Syntax Description

verbose Turns on verbose messaging.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates dynamic DNS debug messages:

>enable

#debug dynamic-dns verbose

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug firewall

Use the debug firewall command to activate debug messages associated with the Secure Router OS

firewall operation. Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no

form of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug firewall command activates debug messages to provide real-time information about the

Secure Router OS stateful inspection firewall operation.

Usage Examples

The following example activates the debug messages for the Secure Router OS stateful inspection

firewall:

>enable

#debug firewall

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug frame-relay [events | llc2 | lmi]

Use the debug frame-relay command to activate debug messages associated with the Frame Relay

operation. Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of

this command to disable the debug messages.

Syntax Description

events Activates debug messages for generic Frame Relay events (such as Frame Relay

interface state)

llc2 Activates debug messages for the logical link control layer

lmi Activates debug messages for the local management interface (such as DLCI

status signaling state, etc.)

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug frame-relay command activates debug messages to aid in the troubleshooting of Frame Relay

links.

Usage Examples

The following example activates all possible debug messages associated with Frame Relay operation:

>enable

#debug frame-relay events

#debug frame-relay llc2

#debug frame-relay lmi

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug frame-relay multilink <interface>

Use the debug frame-relay multilink command to activate debug messages associated with Frame Relay

multilink operation. Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the

no form of this command to disable the debug messages.

Syntax Description

<interface> Optional. Activates debug messages for the specified interface. Type debug

frame-relay multilink ? for a complete list of applicable interfaces.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates debug messages associated with multilink operation for all Frame Relay

interfaces:

>enable

#debug frame-relay multilnk

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug hdlc [errors | verbose]

Use the debug hdlc command to activate debug messages associated with the HDLC interface. Debug

messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this command to

disable the debug messages.

Syntax Description

errors Enables protocol error and statistic messages.

verbose Enables detailed debug messages.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates detailed debug messages associated with the HDLC interface:

>enable

#debug hdlc verbose

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug interface < interface >

Use the debug interface command to activate debug messages associated with the specified interface.

Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this

command to disable the debug messages.

Syntax Description

< interface > Activates debug messages for the specified interface. Type debug interface ? for

a complete list of applicable interfaces.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug interface command activates debug messages to aid in the troubleshooting of physical

interfaces.

Usage Examples

The following example activates all possible debug messages associated with the Ethernet port:

>enable

#debug interface ethernet

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug interface adsl events

Use the debug interface adsl events command to activate debug messages associated with ADSL events.

Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this

command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates debug messages for ADSL events:

>enable

#debug interface adsl events

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip bgp [events | in | out | keepalives | updates]

Use the debug ip bgp command to activate debug messages associated with IP BGP. Debug messages are

displayed (real time) on the terminal (or Telnet) screen. Use the no form of this command to disable the

debug messages.

Syntax Description

events Displays significant BGP events such as a neighbor state change.

in/out Displays the same information as debug ip bgp, but limits messages to the

specified direction (in or out).

keepalives Displays BGP keepalive packets.

updates Displays BGP updates for all neighbors.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

If no arguments are given, the debug ip bgp command displays general BGP events such as

sent/received message summaries, route processing actions, and results. Keepalive packets are not

debugged with this command.

Usage Examples

The following example enables debug messages on general outbound BGP messages and events:

#debug ip bgp out

#07:42:39: BGP OUT 10.15.240.1[2]: Transmitting msg, type=UPDATE (2), len=142

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip dhcp-client

Use the debug ip dhcp-client command to activate debug messages associated with DHCP client

operation in the Secure Router OS. Debug messages are displayed (real-time) to the terminal (or Telnet)

screen. Use the no form of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug ip dhcp-client command activates debug messages to provide information on DHCP client

activity in the Secure Router OS. The Secure Router OS DHCP client capability allows interfaces to

dynamically obtain an IP address from a network DHCP server.

Usage Examples

The following example activates debug messages associated with DHCP client activity:

>enable

#debug ip dhcp-client

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip dhcp-server

Use the debug ip dhcp-server command to activate debug messages associated with DHCP server

operation in the Secure Router OS. Debug messages are displayed (real-time) to the terminal (or Telnet)

screen. Use the no form of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug ip dhcp-server command activates debug messages to provide information on DHCP server

activity in the Secure Router OS. The Secure Router OS DHCP server capability allows the Secure Router

OS to dynamically assign IP addresses to hosts on the network.

Usage Examples

The following example activates debug messages associated with DHCP server activity:

>enable

#debug ip dhcp-server

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip dns-client

Use the debug ip dns-client command to activate debug messages associated with DNS (domain naming

system) client operation in the Secure Router OS. Debug messages are displayed (real-time) to the terminal

(or Telnet) screen. Use the no form of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug ip dns-client command activates debug messages to provide information on DNS client

activity in the Secure Router OS. The IP DNS capability allows for DNS-based host translation

(name-to-address).

Usage Examples

The following example activates debug messages associated with DNS client activity:

>enable

#debug ip dns-client

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip dns-proxy

Use the debug ip dns-proxy command to activate debug messages associated with DNS (domain naming

system) proxy operation in the Secure Router OS. Debug messages are displayed (real-time) to the

terminal (or Telnet) screen. Use the no form of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug ip dns-proxy command activates debug messages to provide information on DNS proxy

activity in the Secure Router OS. The IP DNS capability allows for DNS-based host translation

(name-to-address).

Usage Examples

The following example activates debug messages associated with DNS proxy activity:

>enable

#debug ip dns-proxy

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip icmp [send | recv]

Use the debug ip icmp command to show all ICMP messages as they come into the router or are

originated by the router. If an optional keyword (send or recv) is not used, all results are displayed. Use the

no form of this command to disable the debug messages.

Syntax Description

send

Optional keyword which allows you to only display ICMP messages sent by the router.

recv

Optional keyword which allows you to only display ICMP messages received by the

router.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates the debug ip icmp send and receive messages for the Secure Router

OS:

>enable

#debug ip icmp

ICMP SEND: From (0.0.0.0) to (172.22.14.229) Type=8 Code=0 Length=72 Details:echo request

ICMP RECV: From (172.22.14.229) to (10.100.23.19) Type=0 Code=0 Length=72 Details:echo reply

ICMP SEND: From (0.0.0.0) to (172.22.14.229) Type=8 Code=0 Length=72 Details:echo request

ICMP RECV: From (172.22.14.229) to (10.100.23.19) Type=0 Code=0 Length=72 Details:echo reply

ICMP RECV: From (172.22.255.200) to (10.100.23.19) Type=11 Code=0 Length=36 Details:TTL equals 0

during transit

ICMP RECV: From (172.22.14.229) to (10.100.23.19) Type=3 Code=3 Length=36 Details:port

unreachable

ICMP RECV: From (172.22.14.229) to (10.100.23.19) Type=3 Code=3 Length=36 Details:port

unreachable

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip igmp <group-address>

Use the debug ip igmp command to enable debug messages for IGMP transactions (including helper

activity).

Syntax Description

<group-address> Optional.

IP address of a multicast group.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example enables IGMP debug messages for the specified multicast group:

>enable

#debug ip igmp 224.1.1.1

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip ospf

Use the debug ip ospf command to activate debug messages associated with OSPF routing operations.

Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this

command to disable the debug messages.

Syntax Description

adj Display OSPF adjacency events

database-timer Display OSPF database timer

events Display OSPF events

flood Display OSPF flooding

hello Display OSPF hello events

lsa-generation Display OSPF link state advertisement generation

packet Display OSPF packets

retransmission Display OSPF retransmission events

spf Display OSPF shortest-path-first calculations

tree Display OSPF database tree

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip rip [events]

Use the debug ip rip command to activate debug messages associated with Routing Information Protocol

(RIP) operation in the Secure Router OS. Debug messages are displayed (real-time) to the terminal (or

Telnet) screen. Use the no form of this command to disable the debug messages.

Syntax Description

events Optional.

Use this optional keyword to display only RIP protocol events.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

The debug ip rip command activates debug messages to provide information on Routing Information

Protocol (RIP) activity in the Secure Router OS. RIP allows hosts and routers on a network to exchange

information about routes.

Usage Examples

The following example activates debug messages associated with RIP activity:

>enable

#debug ip rip

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip tcp events

Use the debug ip tcp events command to activate debug messages associated with significant TCP events

such as state changes, retransmissions, session aborts, etc., in the Secure Router OS. Debug messages are

displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this command to disable the

debug messages.

Syntax Description

No default value necessary for this command.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

In the debug ip tcp events information, TCB stands for TCP task control block. The numbers which

sometimes appear next to TCB (e.g., TCB5 in the following example) represent the TCP session number.

This allows you to differentiate debug messages for multiple TCP sessions.

Usage Examples

The following is sample output for this command:

>enable

#debug ip tcp events

2003.02.17 07:40:56 IP.TCP EVENTS TCP: Allocating block 5

2003.02.17 07:40:56 IP.TCP EVENTS TCB5: state change: FREE->SYNRCVD

2003.02.17 07:40:56 IP.TCP EVENTS TCB5: new connection from 172.22.75.246:3473 to

10.200.2.201:23

2003.02.17 07:40:56 IP.TCP EVENTS TCB5: state change: SYNRCVD->ESTABLISHED

[172.22.75.246:3473]

2003.02.17 07:41:06 IP.TCP EVENTS TCB5: Connection aborted -- error = RESET

2003.02.17 07:41:06 IP.TCP EVENTS TCB5: De-allocating tcb

Note These debug events are logged for packets that are sent or received from the router.

Forwarded TCP packets are not included.

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip tcp md5

Use the debug ip tcp md5 command to activate debug messages that detail the results of each incoming

TCP packet’s MD5 authentication with an internal route in the Secure Router OS. Debug messages are

displayed (real time) to the terminal (or Telnet) screen. Use the no form of this command to disable debug

messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

Debug messages will only be generated for TCP ports that have MD5 authentication enabled.

Usage Examples

The following example activates the display of these debug messages:

#debug ip tcp md5

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ip udp

Use the debug ip udp command to activate debug messages associated with UDP send and receive events

in the Secure Router OS. Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use

the no form of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

In the debug ip udp information, the message no listener means that there is no service listening on this

UDP port (i.e., the data is discarded).

Usage Examples

The following is sample output for this command:

>enable

#debug ip udp

2003.02.17 07:38:48 IP.UDP RX: src=10.200.3.236:138, dst=10.200.255.255:138, 229 bytes, no listener

2003.02.17 07:38:48 IP.UDP RX: src=10.200.2.7:138, dst=10.200.255.255:138, 227 bytes, no listener

2003.02.17 07:38:48 IP.UDP RX: src=10.200.201.240:138, dst=10.200.255.255:138, 215 bytes, no

listener

Note These debug events are logged for packets that are sent or received from the router.

Forwarded UDP packets are not included.

Caution The overhead associated with this command takes up a large portion of your router’s

resources and at times can halt other router processes. It is best to only use the command

during times when the network resources are in low demand (non-peak hours, weekends,

etc.).

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug isdn events

Use the debug isdn events command to activate debug messages associated with ISDN events in the

Secure Router OS. Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no

form of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Mode

Functional Notes

The debug ip rip command activates debug messages to provide information on Routing Information

Protocol (RIP) activity in the Secure Router OS. RIP allows hosts and routers on a network to exchange

information about routes.

Usage Examples

The following example activates debug messages associated with ISDN activity:

>enable

#debug isdn events

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug lldp [rx | tx] verbose

Use the debug lldp command to display debug output for all LLDP receive and transmit packets.

Syntax Description

rx Shows information about received packets.

tx Shows information about transmitted packets.

verbose Shows detailed debugging information.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates all possible debug messages associated with LLDP operation:

#debug lldp rx

#debug lldp tx

#debug lldp verbose

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug port-auth [general | packet [both | rx | tx] | supp-sm]

Use the debug port-auth command to generate debug messages used to aid in troubleshooting problems

during the port authentication process. Use the no version of this command to disable the messages.

Syntax Description

general Optional. Displays configuration changes to the port authentication system.

packet Optional. Displays information for packet exchange in transmit-only, receive-only

or both directions.

both Optional. Displays packet exchange information in both receive and transmit

directions.

rx Optional. Displays packet exchange information in the receive-only direction.

tx Optional. Displays packet exchange information in the transmit-only direction.

supp-sm Optional. Displays information pertaining to the supplicant state machine.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates port authentication debug information on received packets:

>enable

#debug port-auth packet rx

Received EAPOL Start for session 1 on interface eth 0/2

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug ppp [authentication | errors | negotiation | verbose]

Use the debug ppp command to activate debug messages associated with point-to-point protocol (PPP)

operation in the Secure Router OS. Debug messages are displayed (real-time) to the terminal (or Telnet)

screen. Use the no form of this command to disable the debug messages.

Syntax Description

authentication Activates debug messages pertaining to PPP authentication (CHAP, PAP, EAP,

etc.).

errors Activates debug messages that indicate a PPP error was detected (mismatch in

negotiation authentication, etc.).

negotiation Activates debug messages associated with PPP negotiation.

verbose Activates detailed debug messages for PPP operation.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

The debug ppp command activates debug messages to provide information on PPP activity in the system.

PPP debug messages can be used to aid in troubleshooting PPP links.

Usage Examples

The following example activates debug messages associated with PPP authentication activity:

>enable

#debug ppp authentication

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug pppoe client

Use the debug pppoe client command to activate debug messages associated with point-to-point protocol

over Ethernet (PPPoE) operation in the Secure Router OS. Debug messages are displayed (real-time) to

the terminal (or Telnet) screen. Use the no form of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Mode

Functional Notes

The debug ip rip command activates debug messages to provide information on Routing Information

Protocol (RIP) activity in the Secure Router OS. RIP allows hosts and routers on a network to exchange

information about routes.

Usage Examples

The following example activates debug messages associated with PPPoE activity:

>enable

#debug pppoe client

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug radius

Use the debug radius command to enable debug messages from the RADIUS subsystem. Debug messages

are displayed (real-time) to the terminal (or Telnet) screen. Use the no form of this command to disable the

debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug radius messages show the communication process with the remote RADIUS servers.

Usage Examples

The following is an example output for the debug radius command:

>enable

#debug radius

RADIUS AUTHENTICATION: Sending packet to 172.22.48.1 (1645).

RADIUS AUTHENTICATION: Received response from 172.22.48.1.

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug sntp

Use the debug sntp command to enable debug messages associated with the Simple Network Time

Protocol (SNTP). All SNTP Packet Exchanges and time decisions are displayed with these debugging

events enabled. Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no

form of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Functional Notes

The debug sntp command activates debug messages to aid in troubleshooting SNTP protocol issues.

Usage Examples

The following is an example output for the debug sntp command:

>enable

#debug sntp

#config term

(config)#sntp server timeserver.localdomain

2002.12.11 15:06:37 SNTP.CLIENT sent Version 1 SNTP time request to 63.97.45.57

2002.12.11 15:06:37 SNTP.CLIENT received SNTP reply packet from 63.97.45.57

2002.12.11 15:06:37 SNTP.CLIENT setting time to 12-11-2002 15:06:02 UTC

2002.12.11 15:06:37 SNTP.CLIENT waiting for 86400 seconds for the next poll interval

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug spanning-tree [config | events | general | root]

Use the debug spanning-tree command to enable the display of spanning-tree debug messages.

Syntax Description

config Enables the display of spanning-tree debug messages when configuration

changes occur.

events Enables the display of debug messages when spanning-tree protocol events

occur.

general Enables the display of general spanning-tree debug messages.

root Enables the display of debug messages related to the spanning-tree root.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example enables the display of general spanning-tree debug messages:

>enable

#debug spanning-tree general

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug spanning-tree bpdu [receive | transmit | all]

Use the debug spanning-tree bpdu command to display BPDU (bridge protocol data unit) debug

messages. When enabled, a debug message is displayed for each BPDU packet that is transmitted or

received by the unit.

Syntax Description

receive Displays debug messages for BPDU packets received by the unit.

transmit Displays debug messages for BPDU packets transmitted by the unit.

all Displays debug messages for BPDU packets that are transmitted and received by

the unit.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example displays debug messages for BPDU packets that are transmitted and received by

the unit:

>enable

#debug spanning-tree bpdu all

SROS Command Line Interface Reference Guide Enable Mode Command Set

debug system

Use the debug system command to enable debug messages associated with system events (i.e., login,

logouts, etc.). Debug messages are displayed (real-time) to the terminal (or Telnet) screen. Use the no form

of this command to disable the debug messages.

Syntax Description

No subcommands.

Default Values

By default, all debug messages in the Secure Router OS are disabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example activates debug messages associated with system information:

>enable

#debug system

SROS Command Line Interface Reference Guide Enable Mode Command Set

dir

Use the dir command to display a directory list of files on the system.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is sample output from the dir command:

>enable

#dir

4206603 HP7203A-08-00-23b-HP1-E.biz

3818 startup-config

3850 startup-config.bak

284007 HP7203B-boot-08-01-01-HP.biz

4234845 HP7203A-08-01-01-HP-E.biz

284238 HP7203B-boot-08-01-02-HPatp.biz

4038590 HP7203A-08-01-02-HPatp-E.biz

285416 J01_01_02-boot.biz

4039977 J01_01_02.biz

4043024 J01_01_03.biz

2649600 ericcode.biz

2896 EUT2bindcfg.txt

24208408 bytes used, 4915176 available, 29123584 total

SROS Command Line Interface Reference Guide Enable Mode Command Set

disable

Use the disable command to exit the Enable Command Mode and enter the Basic Command Mode.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example exits the Enable Command Mode and enters the Basic Command Mode:

#disable

SROS Command Line Interface Reference Guide Enable Mode Command Set

erase [<filename> | startup-config]

Use the erase command to erase the specified file.

Syntax Description

Specifies the name of the file (located in FLASH memory) to erase.

startup-config Erases the startup configuration file stored in NVRAM.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example erases the startup configuration file stored in NVRAM:

>enable

#erase startup-config

If a new startup-configuration file is not specified before power-cycling the unit, the Secure Router OS will

initialize using a default configuration.

SROS Command Line Interface Reference Guide Enable Mode Command Set

events

Use the events command to enable event reporting to the current CLI session. Use the no form of this

command to disable all event reporting to the current CLI session.

Syntax Description

No subcommands.

Default Values

By default, this command is enabled.

Command Modes

# Enable Command Mode

Usage Examples

The following example enables event reporting:

>enable

#events

SROS Command Line Interface Reference Guide Enable Mode Command Set

logout

Use the logout command to terminate the current session and return to the login screen.

Syntax Description

No subcommands.

Default Values

No defaults necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following example shows the logout command being executed in Enable Mode:

#logout

Session now available

Press RETURN to get started.

SROS Command Line Interface Reference Guide Enable Mode Command Set

reload [cancel | in <delay>]

Use the reload command to preform a manual reload of the Secure Router OS.

Syntax Description

cancel Optional.

Use the cancel keyword to deactivate a pending

reload

command.

in Optional.

Use the in keyword to specify a delay period the

Secure Router OS

will

wait before

reloading.

<delay> Specifies the delay period in minutes (mmm) or hours and minutes (hh:mm).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example reloads the Secure Router OS software in 3 hours and 27 minutes:

>enable

#reload in 03:27

The following example reloads the Secure Router OS software in 15 minutes:

>enable

#reload in 15

The following example terminates a pending reload command:

>enable

#reload cancel

Caution Performing a reload disrupts data traffic.

SROS Command Line Interface Reference Guide Enable Mode Command Set

show access-lists <listname>

Use the show access-lists command to display all configured access lists in the system (or a specific list).

Syntax Description

<listname> Optional.

Specify a particular access list to display.

Default Values

No default value necessary for this command.

Command Modes

# Enable Mode

Functional Notes

The show access-lists command displays all configured access-lists in the system. All entries in the access

list are displayed, and a counter indicating the number of packets matching the entry is listed.

Usage Examples

The following is a sample output from the show access-lists command:

>enable

#show access-lists

Standard access list MatchAll

permit host 10.3.50.6 (0 matches)

permit 10.200.5.0 wildcard bits 0.0.0.255 (0 matches)

extended access list UnTrusted

deny icmp 10.5.60.0 wildcard bits 0.0.0.255 any source-quench (0 matches)

deny tcp any (0 matches)

SROS Command Line Interface Reference Guide Enable Mode Command Set

show arp

Use the show arp command to display the Address Resolution Protocol (ARP) table.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output of the

show arp

command:

>enable

show arp

ADDRESS TTL (min) MAC ADDRESS INTERFACE

10.15.225.162 16 00:12:79:11:69:11 eth 0/1

SROS Command Line Interface Reference Guide Enable Mode Command Set

show atm [pvc | traffic] interface atm <interface>

Use the show atm command to display information specific to the ATM interface.

Variations of this command include the following:

show atm pvc

show atm [pvc | traffic] interfaces atm <interface>

Syntax Description

pvc Shows ATM PVC information.

traffic Shows ATM traffic information.

<sub-interface number> For ATM PVC information, enter the sub-interface (x.x) number.

<atm port interface> For ATM port traffic information, enter the port ATM number 1-1023.

<atm vcl interface> For ATM VCL traffic information, enter the ATM VCL number 1-1023.1-65536.

Default Values

No default is necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is sample output from this command:

>enable

#show atm pvc interface atm 1.1

Encap Peak Avg/Min Burst

Name VPI VCI Type SC Kbps Kbps Cells Status

atm 1.1 0 200 SNAP N/A 0 0 0 Active

SROS Command Line Interface Reference Guide Enable Mode Command Set

show bridge [ethernet | frame-relay | ppp | vlan] <slot/port> <bridge

group #>

Use the show bridge command to display a list of all configured bridge groups (including individual

members of each group). Enter an interface or a bridge number to display the corresponding list.

Syntax Description

ethernet <slot/port> Optional.

Display all bridge groups associated with the Ethernet interface.

frame-relay <slot/port> Optional.

Display all bridge groups associated with the Frame Relay virtual

interface.

ppp <slot/port> Optional.

Display all bridge groups associated with the PPP virtual interface.

vlan <slot/port> Optional. Displays all bridge groups associated with the VLAN interface.

<bridgegroup#>

Display a specific bridge group

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the

show bridge

command:

>enable

show bridge

Total of 300 station blocks 295 free

Address Action Interface Age Rx Count Tx Count

00:04:51:57:4D:5A

00:04:5A:57:4F:2A

00:10:A4:B3:A2:72

00:A0:C8:00:8F:98

00:E0:81:10:FF:CE

forward

eth 0/1

fr 1.17

7133392

402365

412367

1502106

7042770

311642

231

1486963

SROS Command Line Interface Reference Guide Enable Mode Command Set

show buffers

Use the show buffers command to display the statistics for the buffer pools on the network server.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following is a sample output from the show buffers command:

#show buffers

Buffer handles: 119 of 2000 used.

Pool Size Total Used Available Max. Used

0 1800 1894 119 1775 122

1 2048 64 0 64 0

2 4096 32 0 32 0

3 8192 4 0 4 0

4 16384 2 0 2 0

5 32768 2 0 2 0

6 65536 2 0 2 0

SROS Command Line Interface Reference Guide Enable Mode Command Set

show buffers users

Use the show buffers users command to display a list of the top users of packet buffers. Typically, this

command will only be used as a debug tool.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample from the show buffers users command:

>enable

#show buffers users

Number of users: 7

Rank User Count

1 0x0052f4f8 59

2 0x0051a4fc 32

3 0x00528564 8

4 0x0053c1c8 7

5 fixedsize 5

6 0x001d8298 2

7 0x0010d970 1

8 0x00000000 0

9 0x00000000 0

10 0x00000000 0

11 0x00000000 0

12 0x00000000 0

13 0x00000000 0

14 0x00000000 0

15 0x00000000 0

SROS Command Line Interface Reference Guide Enable Mode Command Set

show cflash

Use the show cflash command to display a list of all files currently stored in CompactFlash® memory.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample show flash output:

>enable

#show cflash

(dir) 0 SystemDefaultPrompts

(dir) 0 VoiceMail

(dir) 0 UserPrompts

4043024 J01_01_03.BIZ

285188 J01_01_03-boot.biz

2649600 J01_01_02.biz

3154 startup-config

3714 test

3130 EUT4bindcfg.txt

2896 EUT2bindcfg.txt

2828 EUT1bindcfg.txt

2994 EUT3bindcfg.txt

7026688 bytes used, 120893440 available, 127920128 total

SROS Command Line Interface Reference Guide Enable Mode Command Set

show clock [detail]

Use the show clock command to display the system time and date entered using the clock set command.

See clock set <time> <day> <month> <year> on page 50 for more information.

Syntax Description

detail Optional.

Use this optional keyword to display more detailed clock information,

including the time source.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following example displays the current time and data from the system clock:

>show clock

23:35:07 UTC Tue Aug 20 2002

SROS Command Line Interface Reference Guide Enable Mode Command Set

show configuration

Use the show configuration command to display a text printout of the startup configuration file stored in

NVRAM.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output of the show configuration command:

>enable

#show configuration

no enable password

ip subnet-zero

ip classless

ip routing

event-history on

no logging forwarding

logging forwarding priority-level info

no logging email

ip policy-timeout tcp all-ports 600

ip policy-timeout udp all-ports 60

ip policy-timeout icmp 60

interface eth 0/1

speed auto

no ip address

SROS Command Line Interface Reference Guide Enable Mode Command Set

shutdown

interface dds 1/1

shutdown

interface bri 1/2

shutdown

ip access-list standard Outbound

permit host 10.3.50.6

permit 10.200.5.0 0.0.0.255

ip access-list extended UnTrusted

deny icmp 10.5.60.0 0.0.0.255 any source-quench

deny tcp any any

no ip snmp agent

line con 0

no login

line telnet 0

line telnet 1

line telnet 2

line telnet 3

line telnet 4

SROS Command Line Interface Reference Guide Enable Mode Command Set

show connections

Use the show connections command to display information (including TDM group assignments) for all

active connections.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is sample output from the show connections command:

>enable

#show connections

Displaying all connections....

Conn ID

From

ppp 1

e1 1/1, tdm-group 1

SROS Command Line Interface Reference Guide Enable Mode Command Set

show crypto ca [certificates | crls | profiles]

Use the show crypto ca command to display information regarding certificates and profiles.

Syntax Description

certificates Displays information on all certificates.

crls Displays a summary of all certificate revocation lists (CRLs) for each CA.

profiles Displays information on all configured CA profiles.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample from the show crypto ca certificates command:

>enable

#show crypto ca certificates

CA Certificate

Status: Available

Certificate Serial Number: 012d

Subject Name: /C=FI/O=SSH Communications Security/OU=Web test/CN=Test CA 1

Issuer: /C=FI/O=SSH Communications Security/OU=Web test/CN=Test CA 1

CRL Dist. Pt: /C=FI/O=SSH Communications Security/OU=Web test/CN=Test CA 1

Start date is Jan 9 16:25:15 2003 GMT

End date is Dec 31 23:59:59 2003 GMT

Key Usage:

Non-Repudiation

Key Encipherment

Data Encipherment

CRL Signature

Encipherment Only

SROS Command Line Interface Reference Guide Enable Mode Command Set

show crypto ike

Use the show crypto ike command to display information regarding the IKE configuration.

Variations of this command include the following:

show crypto ike client configuration pool

show crypto ike client configuration pool <poolname>

show crypto ike policy

show crypto ike policy <policy priority>

show crypto ike remote-id <remote-id>

show crypto ike sa

Syntax Description

client configuration Displays the list of all configured IKE client configuration pools.

pool

<poolname> Displays detailed information regarding the specified IKE client configuration pool.

policy Displays information on all IKE policies. Indicates if client configuration is enabled

for the IKE policies and displays the pool names.

< policy priority>

Displays detailed information on the specified IKE policy. This number is assigned

using the crypto ike policy command. See crypto ike on page 223 for more

information.

remote-id

<remote-id>

Displays information on all IKE information regarding the remote-id. The remote-id

value is specified using the crypto ike remote-id command (see crypto ike

remote-id on page 227).

sa Displays the configuration of active IKE security associations.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

SROS Command Line Interface Reference Guide Enable Mode Command Set

Usage Examples

The following is a sample from the show crypto ike policy command:

>enable

#show crypto ike policy

Crypto IKE Policy 100

Main mode

Using System Local ID Address

Peers:

63.105.15.129

initiate main

respond anymode

Attributes:

Encryption: 3DES

Hash: SHA

Authentication: Pre-share

Group: 1

Lifetime: 900 seconds

SROS Command Line Interface Reference Guide Enable Mode Command Set

show crypto ipsec

Use the show crypto ipsec command to display information regarding the IPSec configuration.

Variations of this command include the following:

show crypto ipsec sa

show crypto ipsec sa address <ip address>

show crypto ipsec sa map <mapname>

show crypto ipsec transform-set

show crypto ipsec transform-set <transform-set name>

Syntax Description

sa Displays all IPSec security associations.

address

Displays all IPSec security associations associated with the designated peer IP

address.

map

Displays all IPSec security associations associated with the designated crypto

map name.

transform-set Displays all defined transform-sets.

<transform-set name>

Displays information for a specific transform-set.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

SROS Command Line Interface Reference Guide Enable Mode Command Set

show crypto map

Use the show crypto map command to display information regarding crypto map settings.

Variations of this command include the following:

show crypto map

show crypto map interface ethernet <slot/port>

show crypto map interface frame-relay <port number>

show crypto map interface loopback <port number>

show crypto map interface ppp <port number>

show crypto map interface vlan <vlan number>

show crypto map <map name>

show crypto map <map name> <map number>

Syntax Description

interface Displays the map settings for the specified interface. Valid interfaces include:

Ethernet, frame-relay, Frame Relay sublinks, loopback, PPP, or VLAN.

<slot/port> For Ethernet interfaces, designate the slot and port number.

<port number> For Frame Relay, loopback, and PPP ports, enter the port number (range is

1-1024). For Frame-Relay sublinks, the syntax is <port#.sublink#> (range for

sublinks is 1-1007).

<map name> Enter a specific crypto map name.

<map number> Enter a specific crypto map number.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

SROS Command Line Interface Reference Guide Enable Mode Command Set

show debugging

Use the show debugging command to display a list of all activated debug message categories.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show debugging command:

>enable

#show debugging

debug access-list MatchAll

debug firewall

debug ip rip

debug frame-relay events

debug frame-relay llc2

debug frame-relay lmi

SROS Command Line Interface Reference Guide Enable Mode Command Set

show backup interfaces

Use the show backup interfaces command to display all configured backup interfaces and the associated

parameters for each.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example enters the Enable Command Mode and uses the show command to display backup

interface information:

>enable

#show backup interfaces

Backup interfaces...

fr 1.16 backup interface:

Backup state: idle

Backup protocol: PPP

Call mode: originate

Auto-backup: enabled

Auto-restore: enabled

Priority: 50

Backup delay: 10 seconds

Restore delay: 10 seconds

Connect timeout: 60 seconds

Redial retries: unlimited

Redial delay: 10 seconds

Backup enabled all day on the following days:

Sunday Monday Tuesday Wednesday Thursday Friday Saturday

Backup phone number list:

Number Call Type min/max DS0s Backup I/F

5551212 analog 1/1 ppp 2

SROS Command Line Interface Reference Guide Enable Mode Command Set

show dialin interfaces

Use the show dialin interfaces command to display information regarding remote console dialin.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is sample output from the show dialin interfaces command:

>enable

#show dialin interfaces

Dialin interfaces...

modem 1/3 dialin interface:

Connection Status: Connected

Caller id info : name-John Smith number-5551212 time-14:23:10 2/17/2003

SROS Command Line Interface Reference Guide Enable Mode Command Set

show dynamic-dns

Use the show dynamic-dns command to show information related to the dynamic DNS configuration.

Syntax Description

No subcommands.

Default Values

No default is necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is sample output from this command:

#show dynamic-dns

eth 0/1:

Hostname: host

Is Updated: no

Last Registered IP: 10.15.221.33

Last Update Time: 00:00:00 UTC Thu Jan 01 1970

SROS Command Line Interface Reference Guide Enable Mode Command Set

show event-history

Use the show event-history command to display all entries in the current local event-history log.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The event history provides useful information regarding the status of the system and individual port states.

Use the event history as a troubleshooting tool when identifying system issues. The following is a sample

event history log.

>enable

#show event-history

Using 526 bytes

2002.07.12 15:34:01 T1.t1 1/1 Yellow

2002.07.12 15:34:01 INTERFACE_STATUS.t1 1/1 changed state to down.

2002.07.12 15:34:02 T1.t1 1/1 No Alarms

2002.07.12 15:34:02 INTERFACE_STATUS.t1 1/1 changed state to up.

2002.07.12 15:34:03 INTERFACE_STATUS.eth 0/1 changed state to up.

2002.07.12 15:34:10 OPERATING_SYSTEM Warm Start

2002.07.12 15:34:12 PPP.NEGOTIATION LCP up

2002.07.12 15:34:12 PPP.NEGOTIATION IPCP up

SROS Command Line Interface Reference Guide Enable Mode Command Set

show flash

Use the show flash command to display a list of all files currently stored in FLASH memory.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample show flash output:

>enable

#show flash

Files:

245669 010100boot.biz

1141553 new.biz

821 startup-config

1638 startup-config.old

1175679 020016.biz

821 startup-config.bak

2572304 bytes used 4129776 available 6702080 total

SROS Command Line Interface Reference Guide Enable Mode Command Set

show frame-relay

Use the show frame-relay command to display configuration and status parameters for configured virtual

Frame Relay interfaces.

Variations of this command include the following:

show frame-relay lmi

show frame-relay pvc

show frame-relay pvc interface frame-relay <interface>

Syntax Description

lmi Displays LMI (Link Management Interface) statistics for each virtual Frame Relay

interface

pvc Displays PVC (Permanent Virtual Circuit) configuration and statistics for all virtual

Frame Relay interfaces (or a specified interface)

frame-relay Optional keyword used to display Frame Relay PVC statistics for a specific Frame

Relay interface.

<interface> Specifies the virtual Frame Relay interface (for example fr 1)

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following are sample outputs from various

show frame-relay

commands:

>enable

show frame-relay lmi

LMI statistics for interface FR 1 LMI TYPE = ANSI

Num Status Enq. Sent 79 Num Status Msgs Rcvd 71

Num Update Status Rcvd 12 Num Status Timeouts 5

show frame-relay pvc

Frame Relay Virtual Circuit Statistics for interface FR 1

SROS Command Line Interface Reference Guide Enable Mode Command Set

Active Inactive Deleted Static

local 2 0 0 2

DLCI = 16 DLCI USAGE = LOCAL PVC STATUS = ACTIVE INTERFACE = FR 1.16

MTU: 1500

input pkts: 355 output pkts: 529 in bytes: 23013

out bytes: 115399 dropped pkts: 13 in FECN pkts: 0

in BECN pkts: 0 in DE pkts: 0 out DE pkts: 0

pvc create time: 00:00:00:12 last time pvc status changed: 00:00:13:18

DLCI = 20 DLCI USAGE = LOCAL PVC STATUS = ACTIVE INTERFACE = FR 1.20

MTU: 1500

input pkts: 0 output pkts: 44 in bytes: 0

out bytes: 22384 dropped pkts: 11 in FECN pkts: 0

in BECN pkts: 0 in DE pkts: 0 out DE pkts: 0

pvc create time: 00:00:01:25 last time pvc status changed: 00:00:13:18

Usage Examples

SROS Command Line Interface Reference Guide Enable Mode Command Set

show frame-relay fragment [frame-relay <port.sublink>]

Use the show frame-relay fragment command to display FRF.12 statistics for Frame Relay sublinks

enabling FRF.12 fragmentation.

Syntax Description

frame-relay

<port.sublink> Displays detailed FRF.12 statistics for the specified frame-relay sublink (if

FRF.12 is enabled on that sublink).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following are sample outputs from various

show frame-relay fragment

commands:

>enable

show frame-relay fragment

interface dlci frag_size rx_frag tx_frag dropped_frag

fr 1.1 17 100 46 48 0

fr 1.2 18 200 42 21 0

SROS Command Line Interface Reference Guide Enable Mode Command Set

>enable

#show frame-relay fragment frame-relay 1.1

DLCI = 17 FRAGMENT SIZE = 100

rx frag. pkts 46 tx frag. pkts 48

rx frag. bytes 4598 tx frag. bytes 4724

rx non-frag. pkts 18 tx non-frag. pkts 28

rx non-frag. bytes 1228 tx non-frag. bytes 1960

rx assembled pkts 23 tx pre-fragment pkts 34

rx assembled bytes 5478 tx pre-fragment bytes 6324

dropped reassembling pkts 0 dropped fragmenting pkts 0

rx out-of-sequence fragments 0

rx unexpected beginning fragment 0

Usage Examples

SROS Command Line Interface Reference Guide Enable Mode Command Set

show frame-relay multilink <interface> detailed

Use the show frame-relay multilink command to display information associated with the Frame Relay

multilink interface.

Syntax Description

<interface> Optional. Specifies the display of information for a specific interface. Enter the

show frame-relay multilink ? command for a complete list of interfaces.

detailed Optional. Use this optional keyword to display more detailed information.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from this command:

>enable

#show frame-relay multilink

Bundle: frame-relay 1 is DOWN; class A bundle

Near-end BID: MFR1; Far-end BID: unknown

SROS Command Line Interface Reference Guide Enable Mode Command Set

show hosts

Use the show hosts command to display information such as the domain name, name lookup service, a list

of name server hosts, and the cached list of host names and addresses on the network to which you can

connect.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Mode

Functional Notes

The list below describes the fields contained in the host table:

• Flags: Indicate whether the entry is permanent (P) or temporary (T) and if the entry is OK or expired

(EXP).

• Age: Indicates how old the entry is.

• Type: Shows the protocol type.

• Address: Displays the IP address for the entry.

Usage Examples

The following is sample output from the show hosts command:

>enable

#show hosts

Name/address lookup uses domain name service

DNS Proxy is disabled

Default domain is not set

Name servers are 1.1.1.1 2.2.2.2

Flags Age Type Address

Example1 (P OK) - - IP 1.1.1.1

Example2 (P OK) - - IP 2.2.2.2

SROS Command Line Interface Reference Guide Enable Mode Command Set

show interfaces <interface>

Use the show interfaces command to display configuration parameters and current statistics for all

interfaces (or a specified interface).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following are samples from various show interfaces commands:

>enable

#show interfaces t1 1/1

t1 1/1 is UP

Syntax Description

<interface> Optional.

Specific interface to display. Type

show interfaces ?

for a complete

list of valid interfaces.

performance-statistics Optional.

Displays the current 15-minute interval, the current 24-hour totals, and

all 96 stored intervals.

performance-statistics

total-24-hour

Optional.

Displays the current 24-hour totals and the past seven 24-hour

intervals.

performance-statistics

<x-y>

Shows the current 15-minute interval, the current 24-hour totals, and all intervals

from x through y. This command is basically the same thing as the

performance-statistics

command with the added function of allowing you to

specify a particular interval (or range of intervals) to display rather than displaying

all 96.

Note: If you wish to display the 24th interval, enter (for example)

show interface

shdsl 1/1 performance-statistics 24-24

. Entering

show interface shdsl 1/1

performance-statistics 24

results in displaying the 24-hour statistics. Any

number other than 24 (between 1 and 96) results in the correct display of the

selected interval (e.g.,

show interface shdsl 1/1 performance-statistics 4

shows the 4th interval).

switchport

Summary of the Layer 2 information for Ethernet connections.

version Optional.

Displays current version information (e.g., model and list number,

software version, etc.) for the SHDSL interface.

SROS Command Line Interface Reference Guide Enable Mode Command Set

T1 coding is B8ZS framing is ESF

Clock source is line FDL type is ANSI

Line build-out is 0dB

No remote loopbacks No network loopbacks

DS0 Status: 123456789012345678901234

NNNNNNNNNNNNNNNNNNNNNNNN

Line Status: -- No Alarms --

Current Performance Statistics:

0 Errored Seconds 0 Bursty Errored Seconds

0 Severely Errored Seconds 0 Severely Errored Frame Seconds

0 Unavailable Seconds 0 Path Code Violations

0 Line Code Violations 0 Controlled Slip Seconds

0 Line Errored Seconds 0 Degraded Minutes

#show interfaces modem 1/2

modem 1/2 is UP

Line status: on-hook

Caller ID will be used to route incoming calls

0 packets input 0 bytes 0 no buffer

0 runts 0 giants 0 throttles

0 input errors 0 CRC 0 frame

0 abort 0 ignored 0 overruns

0 packets output 0 bytes 0 underruns

0 input clock glitches 0 output clock glitches

0 carrier lost 0 cts lost

#show interfaces eth 0/1

Ip address is 10.200.1.50

Netmask is 255.255.0.0

MTU is 1500

Fastcaching is Enabled

RIP Authentication is Disabled

RIP Tx uses global version value

RIP Rx uses global version value

#show interfaces dds 1/1

dds 1/1 is UP line protocol is UP

Encapsulation FRAME-RELAY (fr 1)

Loop rate is set to 56000 actual rate is 56000

Clock source is line

Data scrambling is disabled

No Loopbacks

75 packets input 6108 bytes 0 no buffer

SROS Command Line Interface Reference Guide Enable Mode Command Set

0 runts 0 giants 0 throttles

0 input errors 0 CRC 0 frame

0 abort 0 ignored 0 overruns

81 packets output 11496 bytes 0 underruns

0 input clock glitches 0 output clock glitches

0 carrier lost 0 cts lost

#show interfaces fr 1

TDM group 10 line protocol is UP

Encapsulation FRAME-RELAY (fr 1)

463 packets input 25488 bytes 0 no buffer

0 runts 0 giants 0 throttles

0 input errors 0 CRC 0 frame

0 abort 0 ignored 0 overruns

864 packets output 239993 bytes 0 underruns

0 input clock glitches 0 output clock glitches

0 carrier lost 0 cts lost

Line Status: -- No Alarms --

Current Performance Statistics:

0 Errored Seconds 0 Bursty Errored Seconds

0 Severely Errored Seconds 0 Severely Errored Frame Seconds

0 Unavailable Seconds 0 Path Code Violations

0 Line Code Violations 0 Controlled Slip Seconds

0 Line Errored Seconds 0 Degraded Minutes

#show interfaces fr 1.100*

fr 1.100 is Active

Ip address is 63.97.45.57, mask is 255.255.255.248

Interface-dlci is 100

MTU is 1500 bytes, BW is 96000 Kbit (limited)

Average utilization is 53%

*Note: If the user has configured a Bc and Be value on the virtual circuit, the bandwidth (BW) displayed is

the sum of those values (Bc + Be). If not, the value for BW is the speed of the interface. The

Average utilization displayed is the average utilization of the displayed bandwidth. If the bandwidth

number is the Bc + Be value, the (limited) text appears (as shown above).

SROS Command Line Interface Reference Guide Enable Mode Command Set

show interfaces adsl <slot/port> information [atuc | atur |

bit-allocation]

Use the show interfaces adsl command to display information related to the ADSL port.

Syntax Description

<slot/port> Enter interface slot and port number.

atuc Show ADSL interface remote information.

atur Show ADSL local information.

bit-allocation Show ADSL DMT bit-allocation table.

Default Values

No default is necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example shows sample output for this command:

#show interfaces adsl 0/1 information

adsl 0/1 line information

adsl 0/1 Local Line Information

Vendor Id: 4144544E

Serial Number: EngBetaREVC01D

Firmware Version:

ADSL Capabilities G.DMT, G.LITE, ADSL2, ADSL2+

adsl 0/1 Remote Line Information

Vendor Id: 54535443

Serial Number: 00000000

Firmware Version: 1

ADSL Capabilities G.DMT, G.LITE, ADSL2, ADSL2+

SROS Command Line Interface Reference Guide Enable Mode Command Set

show interfaces shdsl

Use the show interfaces shdsl command to display configuration parameters and current statistics for the

SHDSL interfaces (or a specified interface).

Variations of this command include the following:

show interfaces shdsl <slot/port>

show interfaces shdsl <slot/port> performance-statistics

show interfaces shdsl <slot/port> performance-statistics total-24-hour

show interfaces shdsl <slot/port> performance-statistics <x-y>

show interfaces shdsl <slot/port> version

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Syntax Description

performance statistics Optional.

Displays the current 15-minute interval, the current 24-hour totals, and

all 96 stored intervals.

performance-statistics

total-24-hour

Optional.

Displays the current 24-hour totals and the past seven 24-hour

intervals.

performance-statistics

<x-y>

Shows the current 15-minute interval, the current 24-hour totals, and all intervals

from x through y. This command is basically the same thing as the

performance-statistics

command with the added function of allowing you to

specify a particular interval (or range of intervals) to display rather than displaying

all 96.

Note: If you wish to display the 24th interval, enter

show interface shdsl 1/1

performance-statistics 24-24

. Entering

show interface shdsl 1/1

performance-statistics 24

results in displaying the 24-hour statistics. Any

number other than 24 (between 1 and 96) results in the correct display of the

selected interval (e.g.,

show interface shdsl 1/1 performance-statistics 4

shows the 4th interval).

version Optional.

Displays current version information (e.g., model and list number,

software version, etc.) for the SHDSL interface.

SROS Command Line Interface Reference Guide Enable Mode Command Set

Functional Notes

The following is a list of output messages from the

show interfaces shdsl

command:

Equipment Type Shows whether the unit is operating in CPE (NT) mode or CO (LT) mode.

Line Rate Shows the current line rate. The line rate is the data rate + 8 kbps.

Therefore, a rate of 2056 kbps implies an actual data rate of 2048 kbps.

Alarms Shows the current alarm conditions. Possible alarms are:

•LOS

• LOSW - Loss of synchronization word (related to frame sync)

• loop attenuation (loop attenuation margin threshold has been

reached or exceeded; this threshold is user selectable and disabled

by default)

• SNR margin (SNR margin threshold has been reached or

exceeded; this threshold is also user programmable)

• CRC

• segment defect

• segment anomaly

Loop Status Shows additional information about the loop status as well as the

Embedded Operations Channel (EOC). Possible messages are:

• SHDSL training complete (marginal signal quality). Establishing

EOC...

• SHDSL training complete (marginal signal quality). EOC is up.

• SHDSL training complete. EOC is down.

• SHDSL training complete. EOC is up.

• SHDSL training in progress.

Loopback State Shows the state of local and remote loopbacks. Possible local loopback

messages are:

• Local dual-sided loopback

• Local customer transparent loopback

• Local customer non-transparent loopback

• Local transparent network loopback

• Local non-transparent network loopback

• No local loopbacks

Possible remote loopback messages are:

• Remote dual-sided loopback

• Remote customer transparent loopback

• Remote customer non-transparent loopback

• Remote transparent network loopback

• Remote non-transparent network loopback

• No remote loopbacks

SNR margin Shows the current, minimum, and maximum Signal-to-Noise Ratio of the

line. These may be cleared using the

clear counters shdsl <slot/port>

command.

SROS Command Line Interface Reference Guide Enable Mode Command Set

Usage Examples

The following is sample output from the show interfaces shdsl command:

>enable

#show interfaces shdsl 1/1

shdsl 1/1 is UP, line protocol is DOWN

Encapsulation FRAME-RELAY IETF (fr 1)

Equipment type is cpe

Line rate is 2056kbps

No alarms.

SHDSL training complete. EOC is up.

No local loopbacks, No remote loopbacks

SNR margin is 18dB currently, 15dB minimum, 30dB maximum

Loop attenuation is 1dB currently, 1dB minimum, 1dB maximum

Current 15-minute performance statistics (115 seconds elapsed):

0 code violations, 0 loss of sync word seconds

0 errored seconds, 0 severely errored seconds

0 unavailable seconds

Packet Statistics:

0 packets input, 0 bytes, 0 no buffer

0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame

0 abort, 0 ignored, 0 overruns

32 packets output, 0 bytes, 0 underruns

0 input clock glitches, 0 output clock glitches

0 carrier lost, 0 cts lost

Loop Attenuation Shows the current, minimum, and maximum loop attenuation of the line.

These may be cleared using the

clear counters shdsl <slot/port>

command.

Performance Stats Shows current interval line statistics. These statistics may be cleared

through the use of the

clear counters shdsl <slot/port>

command, but

the number of elapsed seconds will continue running and accumulating

time.

Functional Notes

SROS Command Line Interface Reference Guide Enable Mode Command Set

Technology Review

A network loopback loops data toward the network (away from the unit). A customer loopback loops data

toward the router. The router does not instigate customer-side loopbacks, only network loopbacks (remote

or local). The reason for this is that the customer interface is internal to the router. There is little use for

looping back router data on itself.

A transparent loopback is one in which the unit loops back one side (i.e., network) and also allows the

same incoming data to be passed through to the customer side. A non-transparent loopback is one which

loops back one side of the interface (network) but sends idle codes to the other side (customer). The

Secure Router OS defaults to non-transparent loopbacks. The reason for this is that sending test patterns

into the IP stack could cause unpredictable behavior. However, it is still possible for the network to send a

transparent loopback request. Such requests will be accepted.

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip access-lists <listname>

Use the show ip access-lists command to display all configured IP access lists in the system.

Syntax Description

<listname> Optional.

Specify a particular access list to display.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

The show ip access-lists command displays all configured IP access-lists in the system. All entries in the

access list are displayed, and a counter indicating the number of packets matching the entry is listed.

Usage Examples

The following is a sample output from the show ip access-lists command:

>enable

#show ip access-lists

Standard IP access list MatchAll

permit host 10.3.50.6 (0 matches)

permit 10.200.5.0 wildcard bits 0.0.0.255 (0 matches)

Extended IP access list UnTrusted

deny icmp 10.5.60.0 wildcard bits 0.0.0.255 any source-quench (0 matches)

deny tcp any any (0 matches)

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip arp

Use the show ip arp command to display the Address Resolution Protocol (ARP) table.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output of the

show ip arp

command:

>enable

show ip arp

ADDRESS TTL (min) MAC ADDRESS INTERFACE

10.15.225.162.14 14 00:12:79:11:69:11 eth 0/1

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip bgp

Use the show ip bgp command to display a summary of the BGP table.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

Entries that are not filtered by prefix lists are marked with an asterisk (*) to show they are valid. Entries

that are deemed the best path to advertised route are marked with a caret (>).

Usage Examples

The following shows sample output of the command:

#show ip bgp

BGP local router ID is 10.0.0.1, local AS is 101.

Status codes: * valid, > best, i - internal

Origin codes: i - IGP, e - EGP, ? - incomplete

Network NextHop Metric Path

*> 1.0.0.0/8 10.15.43.17 1 100 i

*> 2.0.0.0/9 10.15.43.17 1 100 i

*> 2.128.0.0/10 10.15.43.17 1 100 i

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip bgp <network ip> [</length> | <network-mask>]

Use the show ip bgp <network ip> command to display details about the specified route, including the

advertising router IP address, router ID, and the list of neighbors to which this route is being advertised.

Syntax Description

<network ip> Shows only routes for the specified network.

</length> Optional. Shows only routes for the specified network matching the prefix length

(e.g., /24).

<network-mask> Optional. Shows only routes for the specified network matching the network mask

(e.g. 255.255.255.0).

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example shows detailed output of this command:

#show ip bgp 10.15.240.0/28

BGP routing table entry for 10.15.240.0/28

Paths: (1 available, best #1)

Advertised to peers:

1.1.5.10

100 1

10.15.43.17 from 10.15.43.17 (8.1.1.1)

Origin IGP, metric 2, valid, external, best

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip bgp neighbors <ip address>

Use the show ip bgp neighbors command to display information for the specified neighbor. Variations of

this command include the following:

show ip bgp neighbors

show ip bgp neighbors <ip address>

show ip bgp neighbors <ip address> [advertised-routes | received-routes | routes]

Syntax Description

<ip address> Displays information for the specified neighbor. If no IP address is entered,

information for all neighbors is displayed.

advertised-routes Displays all routes being advertised to the specified neighbor. Command output

is the same as for show ip bgp except filtered to only the BGP routes being

advertised to the specified neighbor.

received-routes Displays all routes (accepted and rejected) advertised by the specified neighbor.

Routes may be rejected by inbound filters such as prefix list filters.

routes Displays all accepted received routes advertised by the specified neighbor.

Routes displayed have passed inbound filtering. This command output is the

same as show ip bgp except the output is filtered to those learned from the

specified neighbor.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

Entries that are not filtered by prefix lists are marked with an asterisk (*) to show they are valid. Entries

that are deemed the best path to advertised route are marked with a caret (>).

SROS Command Line Interface Reference Guide Enable Mode Command Set

Usage Examples

The following are output variations of the show ip bgp neighbors command:

#show ip bgp neighbors

BGP neighbor is 10.15.43.17, remote AS 100, external link

Configured hold time is 180, keepalive interval is 60 seconds

Default minimum time between advertisement runs is 30 seconds

Connections established 6; dropped 5

Last reset: Interface went down

Connection ID: 15

BGP version 4, remote router ID 8.1.1.1

BGP state is Established, for 01:55:05

Negotiated hold time is 180, keepalive interval is 60 seconds

Message statistics:

InQ depth is 0, OutQ depth is 0

Local host: 10.15.43.18, Local port: 179

Foreign host: 10.15.43.17, foreign port: 1048

Flags: passive open

show ip bgp neighbors 10.15.43.34 advertised-routes

BGP local router ID is 10.0.0.1, local AS is 101.

Status codes: * valid, > best, i - internal

Origin codes: i - IGP, e - EGP, ? - incomplete

Network NextHop Metric Path

*> 1.0.0.0/8 10.15.43.17 1 100 i

*> 2.0.0.0/9 10.15.43.17 1 100 i

#show ip bgp neighbors 10.15.43.17 received-routes

BGP local router ID is 10.0.0.1, local AS is 101.

Status codes: * valid, > best, i - internal

Origin codes: i - IGP, e - EGP, ? - incomplete

Network NextHop Metric Path

Sent Rcvd

Opens: 1 1

Notifications: 0 0

Updates: 0 8

Keepalives: 116 116

Unknown: 0 0

Total: 117 125

SROS Command Line Interface Reference Guide Enable Mode Command Set

*> 1.0.0.0/8 10.15.43.17 1 100 i

*> 2.0.0.0/9 10.15.43.17 1 100 i

#show ip bgp neighbors 10.15.43.17 routes

BGP local router ID is 10.0.0.1, local AS is 101.

Status codes: * valid, > best, i - internal

Origin codes: i - IGP, e - EGP, ? - incomplete

Network NextHop Metric Path

*> 1.0.0.0/8 10.15.43.17 1 100 i

*> 2.0.0.0/9 10.15.43.17 1 100

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip dhcp-client lease <interface>

Use the show ip dhcp-client lease command to display all Dynamic Host Client Protocol (DHCP) lease

information for interfaces that have dynamically assigned IP addresses.

Syntax Description

<interface> Optional.

Displays the information for the specified interface. Type

show ip

dhcp-client lease ?

for a complete list of applicable interfaces.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show dhcp-client lease command:

>enable

#show dhcp-client lease

Interface: ethernet 0/1

Temp IP address: 10.100.23.64 Mask: 0.0.0.0

DHCP Lease server: 10.100.23.207 State: Bound (3)

Lease: 120 seconds

Temp default gateway address: 0.0.0.0

Client-ID: N/A

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip dhcp-server binding <client ip address>

Use the show ip dhcp-server binding command to display the Dynamic Host Client Protocol (DHCP)

server client table with associated information.

Syntax Description

<client ip address> Optional.

Specify a particular client IP address.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show ip dhcp-server binding command:

>enable

#show ip dhcp-server binding

IP Address Client Id Lease Expiration Client Name

10.100.23.64 01:00:a0:c8:00:8f:b3 Aug 15 2002 11:02 AM Router

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip igmp groups <group-address>

Use the show ip igmp groups command to display the multicast groups that have been registered by

directly connected receivers using IGMP. If no group-address is specified, all groups are shown with this

command.

Syntax Description

<group-address> Optional.

IP address of a multicast group.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is sample output from this command:

>enable

#show ip igmp groups

IGMP Connected Group Membership

Group Address Interface Uptime Expires Last Reporter

172.0.1.50 Loopback100 00:42:57 00:02:50 172.23.23.1

172.1.1.1 Ethernet0/1 00:05:26 00:02:51 1.1.1.2

172.1.1.1 Loopback100 00:42:57 00:02:51 172.23.23.1

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip igmp interface <interface>

Use the show ip igmp interface command to display multicast-related information per-interface. If no

interface is specified, this command shows information for all interfaces.

Syntax Description

<interface> Optional.

Designates the display of information for a specific interface (in the format

type slot/port

). Enter the

show ip igmp interface ?

command

for a complete list of

interfaces.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is sample output from this command:

>enable

#show ip igmp interface

eth 0/1 is UP

Ip Address is 10.22.120.47, netmask is 255.255.255.0

IGMP is enabled on interface

Current IGMP version is 2

IGMP query interval is 60 seconds

IGMP querier timeout is 120 seconds

IGMP max query response time is 10 seconds

Last member query count is 2

Last member query response interval is 1000 ms

IGMP activity: 548 joins, 0 leaves

IGMP querying router is 0.0.0.0

IGMP helper address is disabled

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip interfaces [<interface> | brief]

Use the show ip interfaces command to display the status information for all IP interfaces (or a specific

interface).

Syntax Description

<interface> Optional.

Enter a specific interface to view its status information. If no interface is

entered, status information for all interfaces is displayed. Type

show ip interfaces ?

for a complete list of applicable interfaces.

brief Use this optional keyword to display an abbreviated version of interface statistics

for all IP interfaces.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output of the show ip interfaces command:

>enable

#show ip interfaces

eth 0/1 is UP, line protocol is UP

Ip address is 10.10.10.1

Netmask is 255.255.255.0

MTU is 1500

Fastcaching is Enabled

RIP Authentication is Disabled

RIP Tx uses global version value

RIP Rx uses global version value

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip mroute [<group-address> | <interface>] [summary]

Use the show ip mroute command to display IP multicasting routing table information.

Syntax Description

<group-address> Optional.

IP address of a multicast group.

<interface> Optional.

Designates the display of parameters for a specific interface (in the format

type slot/port

). For example: eth 0/1.

summary Optional.

Displays a single-line summary for each entry in the IP multicast routing

table.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is sample output from this command:

>enable

#show ip mroute

IP Multicast Routing Table

Timers: Uptime/Expires

(*, 239.2.170.3), 01:03:19/00:00:00

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list:

fr 1.20, Forward, 01:03:19/00:01:48

(*, 224.1.1.1), 00:00:01/00:02:58, RP 0.0.0.0, flags: DCL

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list: <-- because lo 100 ifc is joined

Loopback100, Forward/Dense, 00:00:01/00:00:00

(*, 17.0.1.50), 00:00:01/00:02:58, RP 0.0.0.0, flags: DCL

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list:

Loopback100, Forward/Dense, 00:00:01/00:00:00

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip ospf

Use the show ip ospf command to display general information regarding OSPF processes.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show ip ospf command:

>enable

#show ip ospf

Summary of OSPF Process with ID: 192.2.72.101

Supports only single Type Of Service routes (TOS 0)

SPF delay timer: 5 seconds, Hold time between SPFs: 10 seconds

LSA interval: 240 seconds

Number of external LSAs: 0, Checksum Sum: 0x0

Number of areas: 0, normal: 0, stub: 0, NSSA: 0

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip ospf database

Use the show ip ospf database command to display information from the OSPF database regarding a

specific router. There are several variations of this command which you can use to obtain information

about different OSPF link state advertisements. The variations are shown below:

show ip ospf

<area-id>

database

show ip ospf

<area-id>

database adv-router

show ip ospf

<area-id>

database database-summary

show ip ospf

<area-id>

database external

<link-state-id>

show ip ospf

<area-id>

database external

<link-state-id>

adv-router

show ip ospf

<area-id>

database network

<link-state-id>

show ip ospf

<area-id>

database network

<link-state-id>

adv-router

show ip ospf

<area-id>

database router

<link-state-id>

show ip ospf

<area-id>

database router

<link-state-id>

adv-router

show ip ospf

<area-id>

database summary

<link-state-id>

show ip ospf

<area-id>

database summary

<link-state-id>

adv-router

Syntax Description

<area id> Optional.

Area ID number associated with the OSPF address range. This range is

defined in the network router configuration command used to define the particular

area. See

network <ip address> <wildcard> area <area id> on page 910

for

more information.

This ID number identifies the portion of the internet environment that is

being described by the advertisement. The value needed in this field is tied to the

advertisement’s LS type.

<ip address> Enter in the form <A.B.C.D>.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

SROS Command Line Interface Reference Guide Enable Mode Command Set

Functional Notes

The link-state-id differs depending on whether the link state advertisement in question describes a network

or a router.

If describing a network, this ID is one of the following:

• The network’s IP address. This is true for type 3 summary link advertisements and in autonomous

system external link advertisements.

• An address obtained from the link state ID. If the network link advertisement’s link state ID is masked

with the network’s subnet mask, this will yield the network’s IP address.

If describing a router, this ID is always the router’s OSPF router ID.

Usage Examples

>enable

#show ip ospf database

OSPF router with ID: 0.0.0.0

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip ospf interface <interface type> <interface number>

Use the show ip ospf interface command to display OSPF information for a specific interface.

Syntax Description

<interface type> Optional.

Enter the interface type. Type

show ip ospf interface ?

for a complete list

of applicable interfaces.

<interface number> Optional.

Enter the interface number.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

>enable

#show ip ospf interface ppp 1

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip ospf neighbor <interface type> <interface number> <neighbor id>

[detail]

Use the show ip ospf neighbor command to display OSPF neighbor information for a specific interface.

Syntax Description

<interface type> Optional.

Enter the interface type (i.e.,

eth, ppp,

etc.).

<interface number> Optional.

Enter the interface number.

<neighbor id> Optional.

Enter a specific neighbor’s router ID.

detail Optional.

Enter this keyword to display details on all neighbors.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

>enable

#show ip ospf neighbor

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip ospf summary-address

Use the show ip ospf summary-address command to display a list of all summary address redistribution

information for the system.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

>enable

#show ip ospf summary-address

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip policy-class <policyname>

Use the show ip policy-class command to display a list of currently configured access policies. See ip

policy-class <policyname> max-sessions <number> on page 293 for information on configuring access

policies.

Syntax Description

<policyname> Optional.

Enter a specific policy class name to display information for a single policy.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show ip policy-class command:

>enable

#show ip policy-class

ip policy-class max-sessions 0

Policy-class "Trusted":

0 current sessions (6000 max)

Entry 1 - allow list MatchAll

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip policy-sessions <policyname>

Use the show ip policy-sessions command to display a list of current policy class associations. See ip

policy-class <policyname> max-sessions <number> on page 293 for information on configuring access

policies.

Syntax Description

<policyname> Optional.

Enter a specific policy class name to display information for a single policy.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

>enable

#show ip policy-sessions

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip policy-stats <policyname>

Use the show ip policy-stats command to display a list of current policy class statistics. See ip policy-class

<policyname> max-sessions <number> on page 293 for information on configuring access policies.

Syntax Description

<policyname> Optional.

Enter a specific policy class name to display information for a single policy.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

>enable

#show ip policy-stats

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip prefix-list [detail | summary] <listname>

Use the show ip prefix-list command to display BGP prefix list information.

Syntax Description

detail Shows a listing of the prefix list rules and their hit counts.

summary Shows information about the entire prefix list.

<listname> Specifies to display information for a particular prefix list.

Default Values

No default values are necessary for this command.

Command Modes

# Enable Mode

Functional Notes

If the show ip prefix-list command is issued with no arguments, a listing of the prefix-list rules but no hit

count statistics is displayed.

Usage Examples

The following example displays information about the prefix list test.

#show ip prefix-list test

ip prefix-list test: 4 entries

seq 5 permit 0.0.0.0/0 ge 8 le 8

seq 10 deny 0.0.0.0/0 ge 9 le 9

seq 15 permit 0.0.0.0/0 ge 10 le 10

seq 20 deny 0.0.0.0/0 ge 11

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip protocols

Use the show ip protocols command to display IP routing protocol parameters and statistics.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show ip protocols command:

>enable

#show ip protocols

Sending updates every 30 seconds, next due in 8 seconds

Invalid after 180 seconds, hold down time is 120 seconds

Redistributing: rip

Default version control: send version 2, receive version 2

Interface Send Ver. Rec Ver.

eth 0/1 2 2

ppp 1 2 2

Routing for networks:

1.1.1.0/24

SROS Command Line Interface Reference Guide Enable Mode Command Set

<subnet>]

Use the show ip route command to display the contents of the IP route table.

Syntax Description

connected Optional.

Displays only the IP routes for directly connected networks.

ospf Optional. Displays only the IP routes associated with OSPF.

rip Optional. Displays only the IP routes that were dynamically learned through RIP.

static Optional. Displays only the IP routes that were statically entered.

table Optional. Displays a condensed version of the IP route table.

bgp Optional.

Displays only the IP routes associated with BGP.

<ip address><subnet> Displays only the IP routes to destinations within the given address and subnet.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show ip route command:

>enable

#show ip route rip

Codes: C - connected S - static R - RIP O - OSPF IA - OSPF inter area

N1 - OSPF NSSA external type 1 N2 - OSPF NSSA external type 2

E1 - OSPF external type 1 E2 - OSPF external type 2

Gateway of last resort is 10.200.254.254 to network 0.0.0.0

The following example shows how to display IP routes learned via BGP. The values in brackets after a

BGP route entry represent the entry's administrative distance and metric:

#show ip route bgp

Codes: C - connected, S - static, R - RIP, O - OSPF, B - BGP

IA - OSPF inter area, N1 - OSPF NSSA external type 1

N2 - OSPF NSSA external type 2, E1 - OSPF external type 1

E2 - OSPF external type 2

SROS Command Line Interface Reference Guide Enable Mode Command Set

Gateway of last resort is 10.15.43.17 to network 0.0.0.0

B 1.0.0.0/8 [30/0] via 10.15.43.17, fr 1.17

B 2.0.0.0/9 [30/0] via 10.15.43.17, fr 1.17

B 2.128.0.0/10 [30/0] via 10.15.43.17, fr 1.17

B 2.192.0.0/11 [30/0] via 10.15.43.17, fr 1.17

B 2.224.0.0/12 [30/0] via 10.15.43.17, fr 1.17

B 2.240.0.0/13 [30/0] via 10.15.43.17, fr 1.17

B 2.248.0.0/14 [30/0] via 10.15.43.17, fr 1.17

SROS Command Line Interface Reference Guide Enable Mode Command Set

show ip traffic

Use the show ip traffic command to display all IP traffic statistics.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

>enable

#show ip traffic

IP statistics:

Routing discards: 0

Rcvd: 15873 total, 7617 delivered

0 header errors, 0 address errors

0 unknown protocol, 0 discards

0 checksum errors, 0 bad hop counts

Sent: 8281 generated, 4459 forwarded

0 no routes, 0 discards

Frags: 0 reassemble required, 0 reassembled, 0 couldn't reassemble

0 created, 0 fragmented, 0 couldn't fragment

UDP statistics:

Rcvd: 3822 total, 0 checksum errors, 0 no port

Sent: 3822 total

TCP statistics:

Retrans Timeout Algorithm: 0

Min retrans timeout (ms): 0

Max retrans timeout (ms): 0

Max TCP Connections: 0

0 active opens, 64 passive opens, 0 failed attempts

5 establish resets, 1 establish current

3795 segments received, 4459 segments sent, 26 segments retransmitted

SROS Command Line Interface Reference Guide Enable Mode Command Set

show lldp

Use the show lldp command to display LLDP timer configuration.

Syntax Description

No subcommands.

Default Values

No default values are necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example shows a sample LLDP timer configuration:

#show lldp

Global LLDP information:

Sending LLDP packets every 30 seconds

Sending TTL of 120 seconds

SROS Command Line Interface Reference Guide Enable Mode Command Set

show lldp device <system name>

Use the show lldp device command to display specific neighbor information about a given neighbor.

Syntax Description

<system name> Specifies the system name of the neighbor to display.

Default Values

No default values are necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

If there is more than one neighbor with the same system name, all neighbors with that system name will be

displayed.

Usage Examples

The following example shows specific information about a neighbor for the system name Router:

#show lldp device Router

Chassis ID: 00:12:79:02:DD:2A (MAC Address)

System Name: Router

Device Port: eth 0/1 (Locally Assigned)

Holdtime: 30

Platform: 3305

Software: Version: 08.00.22.sw1.D, Date: Mon Nov 01 10:28:55 2004

Capabilities: Bridge, Router

Enabled Capabilities: Router

Local Port: eth 0/2

Management Addresses:

Address Type: IP version 4, Address: 10.23.10.10

Interface Type: Interface Index, Interface Id: 2

SROS Command Line Interface Reference Guide Enable Mode Command Set

show lldp interface <interface>

Use the show lldp interface command to display LLDP configuration and statistics for interfaces on this

device.

Syntax Description

<interface> Displays the information for the specified interface. Type show lldp interface ?

for a complete list of applicable interfaces.

Default Values

No default values are necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example shows LLDP configuration and statistics for the Ethernet 0/1 interface:

#show lldp interface ethernet 0/1

eth 0/1 (TX/RX)

0 packets input

0 input errors

0 TLV errors, 0 TLVs Discarded

0 packets discarded

8799 packets output

0 neighbor ageouts

SROS Command Line Interface Reference Guide Enable Mode Command Set

show lldp neighbors interface <interface> detail

Use the show lldp neighbors interface command to display information about neighbors of this device

learned about via LLDP.

Syntax Description

<interface> Displays the information for the specified interface. Type show lldp neighbors

interface ? for a complete list of applicable interfaces.

detail Shows detailed information about all neighbors to this device.

<type> Displays a summary of all neighbors learned about through interfaces of the

specified type.

<interface-ID> Shows a summary of all neighbors learned about through the specified interface.

<type> detail Shows detailed information about all neighbors learned about through interfaces

of the specified type.

<interface-ID> detail Shows detailed information about all neighbors learned about through the

specified interface.

<type> <interface-ID> Shows detailed information about all neighbors learned about through the

detail specified interface.

Default Values

No default values necessary for this command.

Command Modes

# Enable Command Mode

SROS Command Line Interface Reference Guide Enable Mode Command Set

Usage Examples

The following example shows detailed information about a device’s neighbors:

#show lldp neighbors interface eth 0/2 detail

Chassis ID: 00:A0:C8:02:DD:2A (MAC Address)

System Name: Router

Device Port: eth 0/1 (Locally Assigned)

Holdtime: 38

Platform: 3305

Software: Version: 08.00.22.sw1.D, Date: Mon Nov 01 10:28:55 2004

Capabilities: Bridge, Router

Enabled Capabilities: Router

Local Port: eth 0/2

Management Addresses:

Address Type: IP version 4, Address: 10.23.10.10

Interface Type: Interface Index, Interface Id: 2

SROS Command Line Interface Reference Guide Enable Mode Command Set

show lldp neighbors statistics

Use the show lldp neighbors statistics command to display statistics about LLDP neighbor table actions.

Syntax Description

No subcommands.

Default Values

There are no default values necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

This command shows information about the changes in this device’s neighbor table. The information

displayed indicates the last time a neighbor was added to or removed from the table as well as the number

of times neighbors were inserted into or deleted from the table.

Usage Examples

The following example shows sample output for this command:

#show lldp neighbors statistics

System Last Change Time - Shows the time at which the most recent change occurred in the neighbor

table.

Inserts - Shows the number of times neighbors have been added to the table.

Deletes - Shows how many times neighbors have been deleted from the table because an interface was

shut down.

Drops - Shows how many times the insertion of a new neighbor into the table failed because the table was

full.

Age outs - Shows how many times neighbors have been removed from the table because no new updates

were received from that neighbor before its time-to-live timer expired.

System Last Change Time Inserts Deletes Drops Age outs

10-15-2004 14:24:56 55 3 1 1

SROS Command Line Interface Reference Guide Enable Mode Command Set

show memory [heap]

Use the show memory heap command to display statistics regarding memory including memory

allocation and buffer use statistics. Shows how memory is in use (broken down by memory size) and how

much memory is free.

Syntax Description

heap Shows how much memory is in use (broken down by memory block size) and how

much memory is free.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show memory heap command:

>enable

show memory heap

Memory Heap:

HeapFree: 2935792

HeapSize: 8522736

Block Managers:

Mgr Size Used Free Max-Used

00580 58

1 16 1263 10 1273

2 48 1225 2 1227

3 112 432 2 434

4 240 140 3 143

5 496 72 2 74

6 1008 76 1 26

7 2032 25 1 26

8 4080 2 1 3

9 8176 31 1 32

10 16368 8 0 8

11 32752 5 1 6

SROS Command Line Interface Reference Guide Enable Mode Command Set

12 65520 3 0 30

13 131056 0 0 0

SROS Command Line Interface Reference Guide Enable Mode Command Set

show output-startup

Use the show output-startup command to display startup configuration output line-by-line. This output

can be copied into a text file and then used as a configuration editing tool.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show output-startup command:

>enable

#show output-startup

#hostname "UNIT_2"

UNIT_2#no enable password

UNIT_2#!

UNIT_2#ip subnet-zero

UNIT_2#ip classless

UNIT_2#ip routing

UNIT_2#!

UNIT_2#event-history on

UNIT_2#no logging forwarding

UNIT_2#logging forwarding priority-level info

UNIT_2#no logging email

etc....

SROS Command Line Interface Reference Guide Enable Mode Command Set

show port-auth supplicant [interface <interface id> | summary]

Use the show port-auth command to display supplicant information pertaining to port authentication. The

supplicant is the port that will receive services from the port authenticator.

Syntax Description

interface <interface id> Optional. Shows port authorization supplicant information related to a specific

interface. Type show port-auth supplicant interface ? for a complete list of

applicable interfaces.

summary Optional. Shows only basic information about each applicable interface.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example displays supplicant information for Ethernet interface 0/2:

>enable

#show port-auth supplicant interface eth 0/2

Interface: eth 0/2

Local Supplicant mode is enabled

Username: User1

Password: securePass

Authorization Status: yes

Supp State Machine: CONNECTED

SROS Command Line Interface Reference Guide Enable Mode Command Set

show pppoe

Use the show pppoe command to display all pppoe settings and associated parameters.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example enters the Enable Command Mode and uses the show command to display pppoe

information:

>enable

#show pppoe

ppp 1

Outgoing Interface: eth 0/1

Outgoing Interface MAC Address: 00:A0:C8:00:85:20

Access-Concentrator Name Requested: FIRST VALID

Access-Concentrator Name Received: 13021109813703-LRVLGSROS20W_IFITL

Access-Concentrator MAC Address: 00:10:67:00:1D:B8

Session Id: 64508

Service Name Requested: ANY

Service Name Available:

PPPoE Client State: Bound (3)

Redial retries: unlimited

Redial delay: 10 seconds

Backup enabled all day on the following days:

Sunday Monday Tuesday Wednesday Thursday Friday Saturday

Backup phone number list:

Number Call Type min/max DS0s Backup I/F

5551212 analog 1/1 ppp 2

SROS Command Line Interface Reference Guide Enable Mode Command Set

show processes cpu

Use the show processes cpu command to display information regarding any processes that are currently

active.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show processes cpu command:

>enable

#show processes cpu

processes cpu

System load: 7.07% Min: 0.00% Max 85.89%

Context switch load: 0.21%

Task Task Invoked Exec Time Runtime Load %

Id Name PRI STAT (count) (usec) (usec) (1sec)

0 Idle 0 W 129689 1971 927923 92.79

1 FrontPanel 249 W 9658 165 3202 0.32

3 Stack Usage 11 W 485 305 325 0.03

4 Q Test 1 10 W 50 4 0 0.00

5 Q Test 2 11 W 50 6 0 0.00

10 Clock 20 W 1443 24 55 0.01

11 PacketRouting 250 W 31656 10 3871 0.39

12 Thread Pool 50 W 161 159 0 0.00

13 IKE 10 W 2 341 0 0.00

14 RouteTableTick 50 W 49 874 874 0.09

....etc.

SROS Command Line Interface Reference Guide Enable Mode Command Set

show qos map

The show qos map command outputs information about the QoS map. This information differs based on

how a particular map entry is defined.

Variations of this command include the following:

show qos map

show qos map interface <interface ID>

show qos map <map name>

show qos map <map name> <sequence number>

Syntax Description

<map name> Enter the name of a defined QoS map.

<sequence number> Enter one of the map’s defined sequence numbers.

<interface> Specify an interface to display QoS map information for just that interface (e.g.,

frame-relay, ppp, or atm). Enter the show qos map interface ? command for a

complete list of interfaces.

Default Values

No defaults necessary for this command.

Command Modes

# Enable Mode

Usage Example

#show qos map

qos map priority

map entry 10

match IP packets with a precedence value of 6

priority bandwidth: 400 (kilobits/sec) burst: default

packets matched by map: 125520

map entry 20

match ACL icmp

packets matched by map: 99

map entry 30

match RTP packets on even destination ports between 16000 and 17000

packets matched by map: 0

map entry 50

match ACL tcp

SROS Command Line Interface Reference Guide Enable Mode Command Set

packets matched by map: 4326

map entry 60

match IP packets with a dscp value of 2

set dscp value to 6

packets matched by map: 0

map entry 70

match NetBEUI frames being bridged by the router

priority bandwidth: 150 (kilobits/sec) burst: default

packets matched by map: 0

qos map tcp_map

map entry 10

match ACL tcp

priority bandwidth: 10 (kilobits/sec) burst: default

set precedence value to 5

packets matched by map: 0

map entry 20

match IP packets with a precedence value of 3

priority bandwidth: 50 (kilobits/sec) burst: default

packets matched by map: 0

The following example shows the “priority” qos map and all entries in that map:

#show qos map priority

qos map priority

map entry 10

match IP packets with a precedence value of 6

priority bandwidth: 400 (kilobits/sec) burst: default

packets matched by map: 125520

map entry 20

match ACL icmp

packets matched by map: 99

map entry 30

match RTP packets on even destination ports between 16000 and 17000

packets matched by map: 0

map entry 50

match ACL tcp

packets matched by map: 4326

map entry 60

match IP packets with a dscp value of 2

set dscp value to 6

packets matched by map: 0

map entry 70

match NetBEUI frames being bridged by the router

SROS Command Line Interface Reference Guide Enable Mode Command Set

priority bandwidth: 150 (kilobits/sec) burst: default

packets matched by map: 0

The following example shows a particular qos map entry (in this case map entry 10):

#show qos map priority 10

qos map priority

map entry 10

match IP packets with a precedence value of 6

priority bandwidth: 400 (kilobits/sec) burst: default

packets matched by map: 125520

The following examples show qos map interface stats associated with the map defined for an interface:

#show qos map interface frame-relay 1

fr 1

qos-policy out: priority

map entry 10

match IP packets with a precedence value of 6

budget 145/10000 bytes (current/max)

priority bandwidth: 400 (kilobits/sec)

packets matched on interface: 27289

packets dropped: 98231

map entry 20

not configured for rate limiting

map entry 30

not configured for rate limiting

map entry 50

not configured for rate limiting

map entry 60

not configured for rate limiting

map entry 70

match NetBEUI frames being bridged by the router

budget 3750/3750 bytes (current/max)

priority bandwidth: 150 (kilobits/sec)

packets matched on interface: 0

packets dropped: 0

SROS Command Line Interface Reference Guide Enable Mode Command Set

show queue [atm <interface id> | frame-relay <interface id> | ppp

<interface id>]

Use the show queue command to display conversation information associated with an interface queue.

This command shows summary and per-conversation information.

Syntax Description

<interface id> Specifies the numerical virtual Frame Relay interface or PPP identifying label.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the show queue command:

>enable

#show queue fr 1

Queueing method: weighted fair

Output queue: 18/25/200/64/1027 (size/highest/max total/threshold/drops)

Conversations 2/4/256 (active/max active/max total)

(depth/weight/highest/discards) 12/256/33/0

Conversation 10, linktype: ip, length: 67

source: 10.100.23.11, destination: 10.200.2.125, id: 0x0000, ttl: 47,

TOS: 0 prot: 17 (udp), source port 99, destination port 99

(depth/weight/highest/discards) 6/256/25/0

Conversation 23, linktype: ip, length: 258

source: 10.100.23.11, destination: 10.200.2.125, id: 0x0000, ttl: 47,

TOS: 0 prot: 6 (tcp), source port 16, destination port 16

SROS Command Line Interface Reference Guide Enable Mode Command Set

show queuing [fair]

Use the show queuing command to display information associated with configured queuing methods.

Syntax Description

fair

Optional keyword used to display only information on the weighted fair queuing

configuration.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output from the

show queuing

command:

>enable

show queuing

Interface Discard threshold Conversation subqueues

fr 1

fr 2

ppp 1

256

SROS Command Line Interface Reference Guide Enable Mode Command Set

show radius statistics

Use the show radius statistics command to display various statistics from the RADIUS subsystem. These

statistics include number of packets sent, number of invalid responses, number of timeouts, average packet

delay, and maximum packet delay. Statistics are shown for both authentication and accounting packets.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

show running-config interface tunnel <id> verbose

Usage Examples

The following is an example output using the

show radius statistics

command:

show radius statistics

Number of packets sent:

Number of invalid responses:

Number of timeouts:

Average delay:

Maximum delay:

Auth.

2 ms

3 ms

Acct.

0 ms

SROS Command Line Interface Reference Guide Enable Mode Command Set

show snmp

Use the show snmp command to display the system Simple Network Management Protocol (SNMP)

parameters and current status of SNMP communications.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following is an example output using the show snmp command for a system with SNMP disabled and

the default Chassis and Contact parameters:

> show snmp

Chassis: Chassis ID

Contact: Customer Service

0 Rx SNMP packets

0 Bad community names

0 Bad community uses

0 Bad versions

0 Silent drops

0 Proxy drops

0 ASN parse errors

SROS Command Line Interface Reference Guide Enable Mode Command Set

show sntp

Use the show sntp command to display the system Simple Network Time Protocol (SNTP) parameters and

current status of SNTP communications.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

> show sntp

SROS Command Line Interface Reference Guide Enable Mode Command Set

show spanning-tree <bridgegroup#>

Use the show spanning-tree command to display the status of the spanning-tree protocol.

Syntax Description

<bridgegroup#> Optional.

Display spanning-tree for a specific bridge group.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is an example output using the

show spanning-tree

command:

>enable

#show spanning-tree

Spanning Tree enabled protocol ieee

Root ID Priority 32768

Address 00:a0:c8:00:88:41

We are the root of the spanning tree

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Bridge ID Priority 32768

Address 00:a0:c8:00:88:41

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300

Interface

-------------------

Role

-------------------

Sts

-------------------

Cost

-----------

Prio.Nbr

-------------

Type

---------------

eth 0/2 Desg FWD 19 128.2 P2p

SROS Command Line Interface Reference Guide Enable Mode Command Set

show startup-config

Use the show startup-config command to display a text printout of the startup configuration file stored in

NVRAM.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample output of the

show startup-config

command:

>enable

#show startup-config

no enable password

ip subnet-zero

ip classless

ip routing

event-history on

no logging forwarding

logging forwarding priority-level info

no logging email

ip policy-timeout tcp all-ports 600

ip policy-timeout udp all-ports 60

ip policy-timeout icmp 60

interface eth 0/1

speed auto

no ip address

SROS Command Line Interface Reference Guide Enable Mode Command Set

shutdown

interface dds 1/1

shutdown

interface bri 1/2

shutdown

ip access-list standard MatchAll

permit host 10.3.50.6

permit 10.200.5.0 0.0.0.255

ip access-list extended UnTrusted

deny icmp 10.5.60.0 0.0.0.255 any source-quench

deny tcp any any

no ip snmp agent

SROS Command Line Interface Reference Guide Enable Mode Command Set

show startup-config checksum

Use the show startup-config checksum command to display the MD5 checksum of the unit’s startup

configuration.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Functional Notes

This command is used in conjunction with the show running-config checksum command to determine

whether the configuration has changed since the last time it was saved.

Usage Examples

The following example displays the MD5 checksum of the unit’s startup configuration:

#show startup-config checksum

10404D5DAB3FE35E307B6A79AC6AC8C0

#show running-config checksum

10404D5DAB3FE35E307B6A79AC6AC8C0

SROS Command Line Interface Reference Guide Enable Mode Command Set

show tcp info <control block>

Use the show tcp info command to display TCP control block information in the Secure Router OS. This

information is for troubleshooting and debug purposes only. For more detailed information, you can

optionally specify a particular TCP control block. When a particular TCP control block is specified, the

system provides additional information regarding crypto map settings that the show tcp info command

does not display.

Syntax Description

<control block> Optional.

Specify a particular TCP control block for more detailed information. The

valid range is

from 0 to 31.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample from the

show tcp info

command:

>enable

show tcp info

TCP TCB Entries

STATE

FREE

LISTEN

FREE

LSTAT

FREE

OSTAT

FREE

TYPE

SRVR

CONN

SRVR

FLAGS

RPORT

LPORT

5761

SWIN

SRT

INTERFAC

NONE

31 FREE FREE FREE SRVR 0 0 0 0 0 NONE

SROS Command Line Interface Reference Guide Enable Mode Command Set

show users

Use the show users command to display the name (if any) and state of users authenticated by the system.

Displayed information includes:

• Connection location (for remote connections this includes TCP information)

• Username of authenticated user

• Current state of the login (in process or logged in)

• Current enabled state

• Time the user has been idle on the connection

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following is a sample of show users output:

>enable

#show users

- CONSOLE 0 'user' logged in and enabled

Idle for 00:00:00

- TELNET 0 (172.22.12.60:3998) 'password-only' logged in (not enabled)

Idle for 00:00:14

- FTP (172.22.12.60:3999) 'user' logged in (not enabled)

Idle for 00:00:03

SROS Command Line Interface Reference Guide Enable Mode Command Set

show version

Use the show version command to display the current Secure Router OS version information.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following is a sample show version output:

>enable

#show version

ProCurve Secure Router 7203dl

SROS Version: 08.01.04.HP.E

Checksum: 4F8DCF96, built on: Tue Dec 21 08:32:18 2004

Boot ROM version 08.01.04.HP

Checksum: B133, built on: Tue Dec 21 08:32:25 2004

Platform: ProCurve Secure Router 7203dl

Serial number UNKNOWN

Flash: 33554432 bytes DRAM: 268435455 bytes

System uptime is 0 days, 0 hours, 22 minutes, 42 seconds

Current system image file is "HP7203A-08-01-04-HP-E.biz"

Primary boot system image file is "HP7203A-08-01-04-HP-E.biz"

Backup boot system image file is "NONVOL:/J01_01_03.biz"

Primary system configuration file is "startup-config"

Backup system configuration file is "CFLASH:/startup-config"

SROS Command Line Interface Reference Guide Enable Mode Command Set

telnet <address>

Use the telnet command to open a Telnet session (through the Secure Router OS) to another system on the

network.

Syntax Description

<address> Specifies the IP address of the remote system.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following example opens a Telnet session with a remote system (10.200.4.15):

>enable

#telnet 10.200.4.15

User Access Login

Password:

SROS Command Line Interface Reference Guide Enable Mode Command Set

terminal length <text>

The terminal length command sets the number of rows (lines) for a terminal session. Use the no form of

this command to disable this feature. This command is only valid for the current session and returns to the

default (24 rows) when the session closes.

Syntax Description

No subcommands.

Default Values

The default setting for this command is 24 rows.

Command Modes

# Enable Mode

Usage Examples

The following example sets the number of rows to 30.

>enable

#terminal length 30

SROS Command Line Interface Reference Guide Enable Mode Command Set

traceroute <address>

Use the traceroute command to display the IP routes a packet takes to reach the specified destination.

Syntax Description

<address> Optional.

Specifies the IP address of the remote system to trace the routes to.

Default Values

No default value necessary for this command.

Command Modes

> or # Basic or Enable Command Mode

Usage Examples

The following is a sample traceroute output:

>enable

#traceroute 192.168.0.1

Type CTRL+C to abort.

Tracing route to 192.168.0.1 over a maximum of 30 hops

1 22ms 20ms 20ms 192.168.0.65

2 23ms 20ms 20ms 192.168.0.1

SROS Command Line Interface Reference Guide Enable Mode Command Set

undebug all

Use the undebug all command to disable all activated debug messages.

Syntax Description

No subcommands.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example disabled all activated debug messages:

>enable

#undebug all

SROS Command Line Interface Reference Guide Enable Mode Command Set

wall <message>

Use the wall command to send messages to all users currently logged in to the Secure Router OS unit.

Syntax Description

No subcommands.

Default Values

No defaults necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example sends the message “Reboot in 5 minutes if no objections” to the CLI screen of

everyone currently connected:

>enable

#wall Reboot in 5 minutes if no objections

SROS Command Line Interface Reference Guide Enable Mode Command Set

write [erase | memory | network | terminal]

Use the write command to save the running configuration to the unit’s NVRAM or a TFTP server. Also

use the write command to clear NVRAM or to display the running configuration on the terminal screen.

Entering the write command with no other arguments copies your configuration changes to the unit’s

nonvolatile random access memory (NVRAM). Once the save is complete, the changes are retained even if

the unit is shut down or suffers a power outage.

Syntax Description

erase Optional. Erase the configuration files saved to the unit’s nonvolatile access

memory (NVRAM).

memory Optional. Save the current configuration to NVRAM. See copy <source>

<destination> on page 54 for more information.

network Optional. Save the current configuration to the network TFTP server. See copy

tftp <destination> on page 58 for more information.

terminal Optional. Display the current configuration on the terminal screen.

Default Values

No default value necessary for this command.

Command Modes

# Enable Command Mode

Usage Examples

The following example saves the current configuration to the unit’s NVRAM:

>enable

#write memory

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

GLOBAL CONFIGURATION MODE COMMAND SET

To activate the Global Configuration Mode, enter the configuration command at the Enable security mode

prompt. For example:

Router>

enable

Router#

configure terminal

Router(config)#

The following commands are common to multiple command sets and are covered in a centralized section

of this guide. For more information, refer to the sections listed below:

exit on page 930

bind <#> <from interface> <slot/port> <tdm-group#> <to interface> <slot/port> on page 924

description on page 927

do on page 928

end on page 929

exit on page 930

ping <address> on page 931

show running-config on page 933

All other commands for this command set are described in this section in alphabetical order.

aaa commands begin on page 202

banner [exec | login | motd] <character> <message> <character> on page 210

bridge commands begin on page 211boot config [cflash | flash] <filename> [cflash | flash] <backup

file> on page 212

boot system [cflash | flash] <filename> [cflash | flash] [no-backup | <backup filename>] on page 213

enable password [md5] <password> on page 234

event-history on on page 235

event-history priority [error | fatal | info | notice | warning] on page 236

ftp authentication <listname> on page 238

hostname <name> on page 239

interface commands begin on page 240

ip access-list extended <listname> on page 250

line [console | telnet] <line-number> <ending number> on page 308

lldp [minimum-transmit-interval l reinitialization-delay l transmit-interval l ttl-multiplier] <numeric

value> on page 310

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

logging commands begin on page 312

qos commands begin on page 326

radius-server on page 328

radius-server host on page 330

router ospf on page 331

router rip on page 332

snmp-server commands begin on page 334

sntp server <address or hostname> version <1-3> on page 345

username <username> password <password> on page 354

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

aaa authentication [banner | fail-message | password-prompt |

username-prompt]

Use the aaa authentication command to control various features of the AAA subsystem authentication

process. For more detailed information on AAA functionality, refer to the Technology Review section of

the command aaa on on page 206.

Syntax Description

banner

Sets the banner shown before user authentication is attempted. The banner can

be multiple lines.

fail-message Sets the message shown if user authentication fails. The message can be multiple

lines.

password-prompt Sets the prompt for the user's password. The prompt is a single line. Enclose the

string in quotation marks.

username-prompt Sets the prompt for the user's name. The prompt is a single line. Enclose the

string in quotation marks.

Default Values

banner User Access Verification

fail-message Authentication Failed

password-prompt Password:

username-prompt Username:

Command Modes

(config)# Global Configuration Mode

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

aaa authentication enable default [none | line | enable | groupname]

Use the aaa authentication enable default command to create (or change) the list of methods used for

privileged mode access authentication. For more detailed information on AAA functionality, refer to the

Technology Review section of the command aaa on on page 206.

Syntax Description

none Access automatically granted.

line Use the line password.

enable Use the enable password.

groupname Use the group of remote servers. The group name radius uses all defined

RADIUS servers.

Default Values

If there is no default list configured, the default behavior is to use the enable password for the unit. If there

is no password configured, consoles are allowed in (prevents a lock-out).

Command Modes

(config)# Global Configuration Mode

Functional Notes

A user is authenticated by trying the list of methods from first to last until a method succeeds or fails. If a

method is unable to complete, the next method is tried. The group falls through if the servers in the remote

group could not be found.

Note that enable access is a password-only process. The local user database cannot be used and the

username given to any remote RADIUS server is $enab15$. The only list name allowed is default.

Usage Examples

(config)#aaa authentication enable default line

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

aaa authentication login <listname> [none | line | enable | local | group]

Use the aaa authentication login to create (or change) a list of methods for user authentication. For more

detailed information on AAA functionality, refer to the Technology Review section of the command aaa

on on page 206.

Syntax Description

<listname

Enter the name of the list.

none Access automatically granted.

line Use the line password (Telnet 0-4 or console 0-1).

enable Use the enable password.

local Use the local user database.

group Use a group of remote RADIUS servers.

Default Values

The login list named default is the default list used to authenticate users when no other list is assigned to

the line.

Command Modes

(config)# Global Configuration Mode

Functional Notes

A user is authenticated by trying the list of methods from first to last until a method succeeds or fails. If a

method is unable to complete, the next method is tried. The local user database falls through to the next

method if the username does not appear in the database. The group falls through if the servers in the

remote group could not be found. See the command radius-server on page 328 for information on defining

RADIUS server groups.

Usage Examples

(config)#aaa authentication login myList local group myGroup line

(config)#aaa authentication login default local

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

aaa group server radius <listname>

Use the aaa group server radius command to group pre-defined RADIUS servers into named lists. For

more detailed information on AAA functionality, refer to the Technology Review section of the command

aaa on on page 206.

Syntax Description

<listname

Enter the name of the list.

Default Values

No default value necessary for this command.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Use the radius-server command to specify RADIUS servers before adding them to a group. This

command enters a for adding individual servers to the named group. See Radius Group Command Set on

page 416 for more information.

The default group cannot be changed and includes all RADIUS servers in the order they were specified by

the radius-server commands.

Usage Examples

The following example creates the named list myServers and enters the Radius Group:

(config)#aaa group server radius myServers

(config-sg-radius)#

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

aaa on

Use the aaa on command to activate the AAA subsystem. Use the no form of this command to deactivate

AAA.

Syntax Description

No subcommands.

Default Values

By default, AAA is not activated.

Command Modes

(config)# Global Configuration Mode

Functional Notes

By default, the AAA subsystem is turned off and authentication follows the line technique (local, line, etc.).

Once activated, the AAA lists override the methods specified in the line command.

Usage Examples

The following example activates the AAA subsystem:

(config)#aaa on

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Technology Review (Continued)

AAA stands for authentication, authorization, and accounting. The Secure Router OS AAA subsystem currently

supports authentication. Authentication is the means by which a user is granted access to the device (router).

For instance, a username/password is authenticated before the user can use the CLI. VPN clients can also

verify username/password before getting access through the device.

There are several methods that can be used to authenticate a user:

NONE Instant access

LINE-PASSWORD Use the line password (telnet 0-4 or console 0-1)

ENABLE-PASSWORD Use the enable password

LOCAL-USERS

Use the local user database

GROUP <groupname>

Use a group of remote RADIUS servers

The AAA system allows the user to create a named list of these methods to try in order (in case one fails, it falls

to the next one). This named list is then attached to a portal (telnet 0-4 or console 0-1). When a user telnets in or

accesses the terminal, the AAA system uses the methods from the named list to authenticate the user.

The AAA system must be turned on to be active. By default it is off. Use the

aaa on

command to activate the

AAA system.

If a portal is not explicitly assigned a named list, the name

default

is automatically assigned to it. The user can

customize the

default

list just like any other list. If no

default

list is configured, the following default behavior

applies (defaults are based on portal):

• Instant access (NONE) is assigned to the CONSOLE using the default list (when the list has not been

configured).

• The local user database is used for TELNETS using the default list (when the list has not been

configured).

• No access is granted for FTP access using the default list (when the list has not been configured).

Methods fail (and therefore cause the system to proceed to the next configured method) under circumstances

such as the following:

• LINE and ENABLE passwords fall through if there is no LINE or ENABLE password configured.

• LOCAL USERS fall through if the given user is not in the database.

• RADIUS servers fall through if the given server(s) cannot be contacted on the network.

Example

For a default list defined with the order [LINE, ENABLE, LOCAL, and GROUP

mygroup

], the following

statements are true:

• If there is no LINE password, the list falls through to the ENABLE password.

• If there is no ENABLE password, the AAA system prompts the user for a username and password for

the local user database.

• If the given user is not in the local list, the username and password are handed to the remote servers

defined in mygroup.

• A failure at any point (password not matching) denies access.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

If the AAA process falls through the list completely, system behavior is based on portal:

• CONSOLE access is granted if the process falls completely through (this prevents a lock-out condition).

• TELNET and FTP are denied access.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

aaa processes <threads>

Use the aaa processes command to set the number of threads available to the AAA subsystem. Use the no

form of this command to return to the default setting. For more detailed information on AAA functionality,

refer to the Technology Review section of the command aaa on on page 206.

Syntax Description

<threads> Enter the number of threads available to the AAA subsystem. Range: 1-64.

Default Values

By default, this is set to 1 process.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Increasing this number may speed up simultaneous authentication at the cost of system resources (e.g.,

memory).

Usage Examples

The following example specifies five available threads for the AAA subsystem:

(config)#aaa processes 5

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

banner [exec | login | motd] <character> <message> <character>

Use the banner command to specify messages to be displayed in certain situations. Use the no form of this

command to delete a previously configured banner.

Syntax Description

exec

This command creates a message to be displayed when any exec-level process

takes place.

password login prompts.

motd This message creates a message-of-the-day (MOTD) banner.

<character> Banner text delimiter character. Press Enter after the delimiter to begin input of

banner text.

<message> Enter the text message you wish to display. End with the character that you chose

as your delimiter.

Default Values

By default, no banners are configured.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Banners appear in the following order (if configured):

• MOTD banner appears at initial connection.

• Login banner follows the MOTD banner.

• Exec banner appears after successful log in.

Usage Examples

The following example configures the system to display a message of the day:

(config)#banner motd *The system will be shut down today from 7PM to 11PM*

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

bridge <group#> protocol ieee

The bridge protocol ieee command configures a bridge group for the IEEE Spanning Tree Protocol. Use

the no form of this command (with the appropriate arguments) to delete this setting.

Syntax Description

<group#> Bridge group number (1 to 255) specified using the bridge command

ieee IEEE 802.1 Ethernet spanning-tree protocol

Default Values

By default, all configured bridge interfaces implement ieee spanning-tree protocol.

Command Modes

(config)# Global Configuration Mode

Usage Examples

The following example deletes the bridge protocol setting for bridge-group 17:

(config)#no bridge 17 protocol ieee

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

boot config [cflash | flash] <filename> [cflash | flash] <backup file>

Use the boot config command to modify system boot parameters.

Syntax Description

cflash Specifies primary/backup configuration file located in CompactFlash memory.

flash Specifies primary/backup configuration file located in flash memory.

<filename> Specifies the filename of the configuration file (filenames are case-sensitive).

<backup filename> Specifies a name for the backup configuration file.

Default Values

No default is necessary for this command.

Command Modes

(config)# Global Configuration Mode

Usage Examples

The following example specifies the file myconfig, located in flash memory, as the system boot file:

(config)#boot config flash myconfig

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

boot system [cflash | flash] <filename> [cflash | flash] [no-backup |

<backup filename>]

Use the boot config command to specify the system image loaded at startup.

Syntax Description

cflash Specifies primary/backup file located in CompactFlash memory.

flash Specifies primary/backup file located in flash memory.

<filename> Specifies the filename of the image (filenames are case-sensitive) - image files

should have a .biz extension.

no-backup Specifies that no backup image is to be saved to the system.

<backup filename> Specifies a name for the backup image.

Default Values

No default is necessary for this command.

Command Modes

(config)# Global Configuration Mode

Usage Examples

The following example specifies the file myimage.biz, stored in flash memory, as the startup image:

(config)#boot system flash myimage.biz

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto ca authenticate <name>

Use the crypto ca authenticate command to initiate CA authentication procedures.

Syntax Description

<name>

Alphanumeric string up to 32 characters used to specify a CA profile.

Default Values

No defaults necessary for this command.

Command Modes

(config)# Global Configuration Mode

Functional Notes

The type of authentication procedure is based on the enrollment command and its settings. See

enrollment terminal on page 422 and enrollment url <url> on page 423 for more information. When

enrollment is set to terminal, the CA authentication process is done manually, as shown in the example

which follows (see Usage Examples for this command).

Usage Examples

The following example initiates the CA authentication process:

(config)#crypto ca authenticate testCAprofile

Enter the base 64 encoded CA certificate. End with two consecutive

carriage returns or the word "quit" on a line by itself:

-----BEGIN X509 CERTIFICATE-----

MIIDEDCCAs6gAwIBAgICAXIwCwYHKoZIzjgEAwUAMFoxCzAJBgNVBAYTAkZJMSQw

IgYDVQQKExtTU0ggQ29tbXVuaWNhdGlvbnMgU2VjdXJpdHkxETAPBgNVBAsTCFdl

YiB0ZXN0MRIwEAYDVQQDEwlUZXN0IENBIDQwHhcNMDMwMTA5MTYyNTE1WhcNMDMx

MjMxMjM1OTU5WjBaMQswCQYDVQQGEwJGSTEkMCIGA1UEChMbU1NIIENvbW11bmlj

YXRpb25zIFNlY3VyaXR5MREwDwYDVQQLEwhXZWIgdGVzdDESMBAGA1UEAxMJVGVz

dCBDQSA0MIIBtzCCASsGByqGSM44BAEwggEeAoGBAPTo+NdCWh87hOSnuZ7dUL07

twjZZwY3beLHnDsERhfN8XoOZZcffulKc/lqTrYiu7M5yPJsXQ3u8dbCb6RWFU0A

T5Nd7/4cNn/hCmhbeb6xqsNZUsOcTZJxvClq8thkNo+gXg5bw0fiElgxZ/lEbFWL

UzeO8KgM4izkq0CrGtaFAhUA2+ja4RgbbgTgJk+qTXAxicG/8JMCgYBZvcPMO2/Y

Zc2sXYyrBPtv6k2ZGGYqXAUZ98/txm37JwQGafygePJ/64oeisVeDcLf2FTjveex

W5saydjSK00jXjreRZcJFEDmfRhUtWR8K8tm8mEnB3eg9n09lkWibIjihHn7n5MF

tBBAdbRHyctsr3DyofnieTt3DY78MDsNbgOBhQACgYEA6EKDS2IxrdMsogHfVvob

PkDSv2FjOsP5Tomc/tf9jvvuf6+vj9XTw+uAg1BU9/TyjGzAtnRrCvOUkTYoVxRY

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

vdDOi3GR2RcyNVdGrhYXWY1I5XuB5+NWij8VUQOgfXsJgbEMvPemECeYwQ4ASdhD

vw0E8NI2AEkJXsCAvYfXWzujIzAhMAsGA1UdDwQEAwIBhjASBgNVHRMBAf8ECDAG

AQH/AgEyMAsGByqGSM44BAMFAAMvADAsAhRa0ao0FbRQeWCc2oC24OZ1YZi8egIU

IZhxKAclhXksZHvOj+yIld5x0ec=

-----END X509 CERTIFICATE-----

quit

Hash: 4e904504dc4e5b95e08129430e2a0b97ceef0ad1394f905b42df2dfb8f751be0244a711bb0

6eddaa2f07dd640c187f14c16fa0bed28e038b28b6741a880539d6ed06a68b7e324bfdde6f3d0b17

83d94e58fd4943f5988a7a0f27f6b6b932dc0410378247160752853858dbe7a1951245cfb14b109e

ffc430e177623720de56f4

* Do you accept this certificate? [y]

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto ca certificate chain <name>

Use the crypto ca certificate chain command to enter the Certificate Configuration for the specified CA.

See Certificate Configuration Command Set on page 429 for more information.

Syntax Description

<name>

Alphanumeric string (up to 32 characters) used to specify a CA profile.

Default Values

No defaults necessary for this command.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Typically used only in the running-config and startup-config to restore certificates.

Usage Examples

The following example enters the Certificate Configuration for the CA profile MyProfile:

(config)#crypto ca certificate chain MyProfile

(config-cert-chain)#

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto ca enroll <name>

Use the crypto ca enroll command to begin CA enrollment procedures.

Syntax Description

<name>

Alphanumeric string (up to 32 characters) used to specify a CA profile.

Default Values

No defaults necessary for this command.

Command Modes

(config)# Global Configuration Mode

Functional Notes

The type of enrollment procedure is based on the enrollment command and its settings. See enrollment

terminal on page 422 and enrollment url <url> on page 423 for more information. This command initiates

a dialog that is used to fill in the parameters that make up an enrollment request to be forwarded to a

certificate authority. Note that some of the parameters (such as IP address) may be filled in using the

values supplied in the crypto ca profile (in which case, the enrollment dialog will not prompt for those

parameters). Once all required parameters are defined using the dialog, this command assembles them

into an enrollment request to be sent to a certificate authority (including the generation of public and

private keys). See crypto ca profile for more information.

If enrollment is set to terminal, you may view the request on the terminal screen.

If enrollment is set to url, the request is sent automatically to the certificate authority using the URL

specified by the enrollment url command.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Usage Examples

The following example shows a typical enrollment dialog:

(config)#crypto ca enroll MyProfile

**** Press CTRL+C to exit enrollment request dialog. ****

* Enter signature algorithm (RSA or DSS) [rsa]:rsa

* Enter the modulus length to use [512]:1024

* Enter the subject name as an X.500 (LDAP) DN:CN=Router,C=US,L=Huntsville,S=AL

--The subject name in the certificate will be CN=CN=Router,C=US,L=Huntsville,S=AL.

* Include an IP address in the subject name [n]:y

* Enter IP address or name of interface to use:10.200.1.45

* Include fully qualified domain name [n]:y

* Enter the fully qualified domain name to use:FullyQualifiedDomainName

* Include an email address [n]:y

* Enter the email address to use:myemail@email.com

Generating request (including keys)....

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto ca import <name> certificate

Use the crypto ca import certificate command to import a certificate manually via the console terminal

Syntax Description

<name>

Alphanumeric string (up to 32 characters) used to specify a CA profile.

Default Values

No defaults necessary for this command.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Puts CLI in mode where the certificate can be entered manually. Enter quit and a carriage return (or simply

enter two consecutive carriage returns) to exit this mode. Abort this mode by pressing Ctrl-C. This

command only applies if the enrollment command is set to terminal. See enrollment terminal on page

422.

Usage Examples

The following example imports a certificate via the console terminal:

(config)#crypto ca import MyProfile certificate

Enter the PM-encoded certificate. End with two consecutive

carriage returns or the word "quit" on a line by itself:

-----BEGIN CERTIFICATE-----

MIIDWTCCAwOgAwIBAgIKFLCsOgAAAAAAtjANBgkqhkiG9w0BAQUFADBjMQswCQYD

VQQGEwJVUzEQMA4GA1UECBMHQUxBQkFNQTETMBEGA1UEBxMKSHVudHN2aWxsZTEa

MBgGA1UEChMRQWR0cmFuVGVjaFN1cHBvcnQxETAPBgNVBAMTCHRzcm91dGVyMB4X

DTAzMDYyNTE0MTM1NVoXDTAzMTIwNjE0NDkxM1owJDEPMA0GA1UEChMGYWR0cmFu

MREwDwYDVQQDEwhNeVJvdXRlcjBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQClUKqs

fbTalej5m9gk2DMsbC9df3TilBz+7nRx3ZzGw75AQsqEMYeBY5aWi62W59jmxGSE

WX+E8EwBVbZ6JKk5AgMBAAGjggHWMIIB0jAXBgNVHREEEDAOhwQKCgoKggZNeUZx

ZG4wHQYDVR0OBBYEFJAvBRIjx1PROnkZ4v0D89yB1eErMIGcBgNVHSMEgZQwgZGA

FHGwIRAr11495MgrLNPiLzjvrb4JoWekZTBjMQswCQYDVQQGEwJVUzEQMA4GA1UE

CBMHQUxBQkFNQTETMBEGA1UEBxMKSHVudHN2aWxsZTEaMBgGA1UEChMRQWR0cmFu

VGVjaFN1cHBvcnQxETAPBgNVBAMTCHRzcm91dGVyghAZql7OwISgsUhfaSeGh0Ot

MGkGA1UdHwRiMGAwLaAroCmGJ2h0dHA6Ly90c3JvdXRlci9DZXJ0RW5yb2xsL3Rz

cm91dGVyLmNybDAvoC2gK4YpZmlsZTovL1xcdHNyb3V0ZXJcQ2VydEVucm9sbFx0

c3JvdXRlci5jcmwwgY0GCCsGAQUFBwEBBIGAMH4wPAYIKwYBBQUHMAKGMGh0dHA6

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Ly90c3JvdXRlci9DZXJ0RW5yb2xsL3Rzcm91dGVyX3Rzcm91dGVyLmNydDA+Bggr

BgEFBQcwAoYyZmlsZTovL1xcdHNyb3V0ZXJcQ2VydEVucm9sbFx0c3JvdXRlcl90

c3JvdXRlci5jcnQwDQYJKoZIhvcNAQEFBQADQQBSGD4JbGJGk53qvyy0xXVoMQvy

U8xNjUdvWqjgFOI+2m8ZYJcfhnt11rbP2f3Wm9TpjLe1WuBNxmpNjC9A2ab0

-----END CERTIFICATE-----

Success!

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto ca import <name> crl

Use the crypto ca import crl command to import a CRL manually via the console terminal.

Syntax Description

<name>

Alphanumeric string (up to 32 characters) used to specify a CA profile.

Default Values

No defaults necessary for this command.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Puts CLI in a mode where the CRL can be entered manually. Enter quit and a carriage return (or simply

enter two consecutive carriage returns) to exit this mode. This command only applies if the enrollment

command is set to terminal. See enrollment terminal on page 422.

Usage Examples

The following allows you to manually paste in the CA’s CRL:

(config)#crypto ca import MyProfile crl

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto ca profile <name>

Use the crypto ca profile command to define a CA and to enter the CA Profile Configuration. See CA

Profile Configuration Command Set on page 418 for more information.

Syntax Description

<name>

Alphanumeric string (up to 32 characters) used to create a CA profile.’

Default Values

No defaults necessary for this command.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Use this to specify the type of enrollment, as well as enrollment request parameters. See the Functional

Notes of the command crypto ca enroll <name> on page 217 for more information.

Usage Examples

The following example creates the CA profile called MyProfile and enters the CA Profile Configuration for

that certificate authority:

(config)#crypto ca profile MyProfile

Configuring New CA Profile MyProfile.

(ca-profile)#

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto ike

Use the crypto ike command to define the system-level local ID for IKE negotiations and to enter the IKE

Client or IKE Policy command sets.

Variations of this command include the following:

crypto ike client configuration pool <poolname>

crypto ike local-id address

crypto ike policy <policy priority>

Syntax Description

client configuration Creates a local pool named the

of your choice and enters the IKE

pool

Client. Clients that connect via an IKE policy that specifies this pool-name will be

assigned values from this pool. See the section for more information.

local-id address Sets the local ID during IKE negotiation to be the IP address of the interface from

which the traffic exits. This setting can be overridden on a per-policy basis using

the local-id command in the IKE Policy (see local-id [address | asn1-dn | fqdn |

user-fqdn] <ipaddress or name> on page 380 for more information).

policy

Creates an IKE policy with the

of your choice and enters the IKE

Policy. See IKE Policy Command Set on page 373 for more information.

Default Values

There are no default settings for this command.

Command Modes

(config)# Global Configuration Mode

Usage Examples

The following example creates an IKE policy with a policy priority setting of 1 and enters the IKE Policy for

that policy:

(config)#crypto ike policy 1

(config-ike)#

Technology Review

The following example configures an Secure Router OS product for VPN using IKE aggressive mode with

pre-shared keys. The Secure Router OS product can be set to initiate IKE negotiation in main mode or

aggressive mode. The product can be set to respond to IKE negotiation in main mode, aggressive mode,

or any mode. In this example, the device is configured to initiate in aggressive mode and to respond to any

mode.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

This example assumes that the Secure Router OS product has been configured with a WAN IP Address of

63.97.45.57 on interface ppp 1 and a LAN IP Address of 10.10.10.254 on interface ethernet 0/1. The Peer

Private IP Subnet is 10.10.20.0.

For more detailed information on VPN configuration, refer to the

VPN

Configuration Guide located on the

Secure Router OS Documentation CD provided with your unit.

Step 1:

Enter the Global configuration mode (i.e., config terminal mode).

>enable

#configure terminal

Step 2:

Enable VPN support using the ip crypto command. This command allows crypto maps to be applied to

interfaces, and enables the IKE server to listen for IKE negotiation sessions on UDP port 500.

(config)#ip crypto

Step 3:

Set the local ID. During IKE negotiation, local-ids are exchanged between the local device and the peer

device. In the Secure Router OS, the default setting for all local-ids is configured by the crypto ike

local-id command. The default setting is for all local-ids to be the IPv4 address of the interface over which

the IKE negotiation is occurring. In the future, a unique system-wide Hostname or Fully Qualified Domain

Name could be used for all IKE negotiation.

(config)#crypto ike local-id address

Step 4:

Create IKE policy. In order to use IKE negotiation, an IKE policy must be created. Within the system, a list

of IKE policies is maintained. Each IKE policy is given a priority number in the system. That priority

number defines the position of that IKE policy within the system list. When IKE negotiation is needed, the

system searches through the list, starting with the policy with priority of 1, looking for a match to the peer IP

address.

An individual IKE policy can override the system local-id setting by having the local-id command specified

in the IKE policy definition. This command in the IKE policy is used to specify the type of local-id and the

local-id data. The type can be of IPv4 address, Fully Qualified Domain Name, or User-Specified Fully

Qualified Domain Name.

An IKE policy may specify one or more peer IP addresses that will be allowed to connect to this system. To

specify multiple unique peer IP addresses, the peer A.B.C.D command is used multiple times within a

single IKE policy. To specify that all possible peers can use a default IKE policy, the peer any command is

given instead of the peer A.B.C.D command inside of the IKE policy. The policy with the peer any

command specified will match to any peer IP address (and therefore should be given the highest numerical

priority number). This will make the policy the last one to be compared against during IKE negotiation.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

(config)#crypto ike policy 10

(config-ike)#no local-id

(config-ike)#peer 63.105.15.129

(config-ike)#initiate aggressive

(config-ike)#respond anymode

(config-ike)#attribute 10

(config-ike-attribute)#encryption 3des

(config-ike-attribute)#hash sha

(config-ike-attribute)#authentication pre-share

(config-ike-attribute)#group 1

(config-ike-attribute)#lifetime 86400

Step 5:

Define the remote-id settings. The crypto ike remote-id command is used to define the remote-id for a

peer connecting to the system, specify the preshared-key associated with the specific remote-id, and

(optionally) determine that the peer matching this remote-id should not use mode config (by using the

no-mode-config keyword). See crypto ike remote-id on page 227 for more information.

(config)#crypto ike remote-id address 63.105.15.129 preshared-key

mysecret123

Step 6:

Define the transform-set. A transform-set defines the encryption and/or authentication algorithms to be

used to secure the data transmitted over the VPN tunnel. Multiple transform-sets may be defined in a

system. Once a transform-set is defined, many different crypto maps within the system can reference it. In

this example, a transform-set named highly_secure has been created. This transform-set defines ESP

with Authentication implemented using 3DES encryption and SHA1 authentication.

(config)#crypto ipsec transform-set highly_secure esp-3des esp-sha-hmac

(cfg-crypto-trans)#mode tunnel

Step 7:

Define an ip-access list. An Extended Access Control List is used to specify which traffic needs to be sent

securely over the VPN tunnel. The entries in the list are defined with respect to the local system. The

source IP address will be the source of the traffic to be encrypted. The destination IP address will be the

receiver of the data on the other side of the VPN tunnel.

(config)#ip access-list extended corporate_traffic

(config-ext-nacl)#permit ip 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255 log

deny ip any any

Step 8:

Create crypto map. A Crypto Map is used to define a set of encryption schemes to be used for a given

interface. A crypto map entry has a unique index within the crypto map set. The crypto map entry will

specify whether IKE is used to generate encryption keys or if manually specified keys will be used. The

crypto map entry will also specify who will be terminating the VPN tunnel, as well as which transform-set or

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

sets will be used to encrypt and/or authenticate the traffic on that VPN tunnel. It also specifies the lifetime

of all created IPSec Security Associations.

(config)#crypto map corporate_vpn 1 ipsec-ike

(config-crypto-map)#match address corporate_traffic

(config-crypto-map)#set peer 63.105.15.129

(config-crypto-map)#set transform-set highly_secure

(config-crypto-map)#set security-association lifetime kilobytes 8000

(config-crypto-map)#set security-association lifetime seconds 28800

(config-crypto-map)#no set pfs

Step 9:

Configure public interface. This process includes configuring the IP address for the interface and applying

the appropriate crypto map to the interface. Crypto maps are applied to the interface on which encrypted

traffic will be transmitted.

(config)#interface ppp 1

(config-ppp 1)#ip address 63.97.45.57 255.255.255.248

(config-ppp 1)#crypto map corporate_vpn

(config-ppp 1)#no shutdown

Step 10:

Configure private interface to allow all traffic destined for the VPN tunnel to be routed to the appropriate

gateway.

(config)#interface ethernet 0/1

(config-eth 0/1)#ip address 10.10.10.254 255.255.255.0

(config-eth 0/1)#no shutdown

(config-eth 0/1)#exit

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto ike remote-id

Use the crypto ike remote-id command to specify the remote ID and to associate a pre-shared key with

the remote ID.

Syntax Description

address

Specifies a remote ID of IPv4 type.

any Wildcard that allows any remote ID (type and value).

asn1-dn

<name>

Specifies an Abstract Syntax Notation Distinguished Name as the

remote ID (enter this value in LDAP format).

fqdn

<fqdn>

Specifies a fully qualified domain name as the remote ID.

user-fqdn

<fqdn>

Specifies a user fully qualified domain name or email address as

the remote ID.

preshared-key

Associates a pre-shared key with this remote ID.

no-mode-config Optional keyword used to specify that the peer matching this

remote ID should not use mode config.

no-xauth Optional keyword used to specify that the peer matching this

remote ID should not use xauth.

nat-t [v1 l v2] [allow l force I disable] Optional keyword that denotes whether peers matching this

remote ID should allow, disable, or force NAT traversal versions 1

and 2.

Default Values

There are no default settings for this command.

Command Modes

(config)# Global Configuration Mode

Note For VPN configuration example scripts, refer to the technical support note VPN

Configuration Guide located on the ProCurve SROS Documentation CD provided with

your unit.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Functional Notes

The fqdn and user-fqdn <WORD> line can include wildcard characters. The wildcard characters are "*”

for a 0 or more character match and "?" for a single character match. Currently, the "?" cannot be set up

using the CLI, but it can be transferred to the unit via the startup-config.

Example for user-fqdn:

john*@domain.com

will match:

johndoe@domain.com

johnjohn@myemail.com

john@myemail.com

Example for fqdn:

*.domain.com

will match:

www.domain.com

ftp.domain.com

one.www.domain.com

The address remote ID can be in the form of a single host address or in the form of an IP address

wildcard.

Example for address type:

crypto ike remote id address 10.10.10.0 0.0.0.255

will match:

10.10.10.1

10.10.10.2

and all IP addresses in the form of 10.10.10.X (where X is 0-255)

The asn1-dn <WORD> line can include wildcard characters. The wildcard characters are "*" for a 0 or

more character match and "?" for a single character match. Currently, the "?" cannot be set up using the

CLI, but it can be transferred to the unit via the startup-config.

Example for typical asn1-dn format with no wildcards:

crypto ike remote-id asn1-dn "CN=MyRouter, C=US, S=CA, L=Roseville, O-HP, OU=TechSupport"

(matches only remote ID strings with all fields exactly the same)

Example for typical asn1-dn format with wildcards used to match a string within a field:

crypto ike remote-id asn1-dn "CN=*, C=*, S=*, L=*, O=*, OU=*"

(matches any asn1-dn remote ID string from a peer)

Example for typical asn1-dn format with wildcards used to match a portion of the remote ID:

crypto ike remote-id asn1-dn "CN=*, C=US, S=CA, L=Roseville, O=HP, OU=*"

(matches any remote ID string with the same values for the C, S, L, and O fields, and any values in the CN and

OU fields)

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Example for typical asn1-dn format with wildcards used to match a portion of a field:

crypto ike remote-id asn1-dn "CN=My*, C=US, S=CA, L=Roseville, O=HP, OU=TechSupport"

(matches remote ID strings with all fields exactly the same, but with any CN field beginning with "My")

Usage Examples

The following example assigns a remote ID of 63.97.45.57 and associates the pre-shared key mysecret

with the remote ID:

(config)#crypto ike remote-id address 63.97.45.57 preshared-key mysecret

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto ipsec transform-set <setname> <parameters>

Use the crypto ipsec transform-set command to define the transform configuration for securing data

(e.g., esp-3des, esp-sha-hmac, etc.). The transform-set is then assigned to a crypto map using the map’s

set transform-set command. See set transform-set <setname1 - setname6> on page 404.

Syntax Description

<setname> Assign a name to the transform-set you are about to define.

<parameters> Assign a combination of up to three security algorithms. This field is a valid

combination of the following:

• ah-md5-hmac, ah-sha-hmac

• esp-des, esp-3des, esp-aes-128-cbc, esp-aes-192-cbc, esp-aes-256-cbc,

esp-null

• esp-md5-hmac, esp-sha-hmac

Default Values

There are no default settings for this command.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Crypto map entries do not directly contain the transform configuration for securing data. Instead, the crypto

map is associated with transform sets which contain specific security algorithms.

If no transform-set is configured for a crypto map, the entry is incomplete and will have no effect on the

system.

Note For VPN configuration example scripts, refer to the technical support note VPN

Configuration Guide located on the ProCurve SROS Documentation CD provided with

your unit.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Usage Examples

The following example first creates a transform-set (Set1) consisting of two security algorithms (up to three

may be defined), and then assigns the transform-set to a crypto map (Map1):

(config)#crypto ipsec transform-set Set1 esp-3des esp-sha-hmac

(cfg-crypto-trans)#exit

(config)#crypto map Map1 1 ipsec-ike

(config-crypto-map)#set transform-set Set1

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

crypto map

Use the crypto map command to define crypto map names and numbers and to enter the associated (either

Crypto Map IKE or Crypto Map Manual).

Variations of this command include the following:

crypto map <mapname> <mapindex> ipsec-ike

crypto map <mapname> <mapindex> ipsec-manual

Syntax Description

<mapname> Name the crypto map. You can assign the same name to multiple crypto maps, as

long as the map index numbers are unique.

<mapindex> Assign a crypto map sequence number.

ipsec-ike Enter the Crypto Map IKE (see Crypto Map IKE Command Set on page 396). This

supports IPSec entries that will use IKE to negotiate keys.

ipsec-manual Enter the Crypto Map Manual (see Crypto Map IKE Command Set on page 396).

This supports manually configured IPSec entries.

Default Values

There are no default settings for this command.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Crypto map entries do not directly contain the transform configuration for securing data. Instead, the crypto

map is associated with transform sets which contain specific security algorithms (see crypto ipsec

transform-set <setname> <parameters> on page 230).

Crypto map entries do not directly contain the selectors used to determine which data to secure. Instead,

the crypto map entry refers to an access control list. An access control list is assigned to the crypto map

using the match address command (see ike-policy <policy number> on page 398).

If no transform-set or access-list is configured for a crypto map, the entry is incomplete and will have no

effect on the system.

Note For VPN configuration example scripts, refer to the technical support note VPN

Configuration Guide located on the ProCurve SROS Documentation CD provided with

your unit.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

When you apply a crypto map to an interface (using the crypto map command within the interface’s), you

are applying all crypto maps with the given map name. This allows you to apply multiple crypto maps if you

have created maps which share the same name but have different map index numbers.

Usage Examples

The following example creates a new IPSec IKE crypto map called testMap with a map index of 10:

(config)#crypto map testMap 10 ipsec-ike

(config-crypto-map)#

Technology Review

A crypto map entry is a single policy that describes how certain traffic is to be secured. There are two

types of crypto map entries: ipsec-manual and ipsec-ike. Each entry is given an index, which is used to sort

the ordered list. When a non-secured packet arrives on an interface, the crypto map set associated with

that interface is processed in order. If a crypto map entry matches the non-secured traffic, the traffic is

discarded.

When a packet is to be transmitted on an interface, the crypto map set associated with that interface is

processed in order. The first crypto map entry that matches the packet will be used to secure the packet.

If a suitable SA (security association) exists, that is used for transmission. Otherwise, IKE is used to

establish an SA with the peer. If no SA exists, and the crypto map entry is “respond only”, the packet is

discarded.

When a secured packet arrives on an interface, its SPI (security parameter index) is used to look up an SA.

If an SA does not exist, or if the packet fails any of the security checks (bad authentication, traffic does not

match SA selectors, etc.), it is discarded. If all checks pass, the packet is forwarded normally.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

enable password [md5] <password>

Use the enable password command to define a password (with optional encryption) for accessing the

Enable Mode. Use the no enable password command to remove a configured password.

Syntax Description

md5 Optional. Specifies Message Digest 5 (md5) as the encryption protocol to use

when displaying the enable password during show commands. If the md5

keyword is not used, encryption is not used when displaying the enable password

during show commands

<password> String (up to 30 characters in length) to use as the Enable Security Mode

password.

Default Values

By default, there is no configured enable password.

Command Modes

# Enable Security Mode required

Usage Examples

To provide extra security, the Secure Router OS can encrypt the enable password when displaying the

current configuration. For example, the following is a show configuration printout (password portion) with

an unencrypted enable password (PASSWORD):

enable password PASSWORD

Alternately, the following is a show configuration printout (password portion) with an enable password of

password using md5 encryption:

enable password md5 encrypted 5aa5fbae7d01a90e79fb57705ce74676

Note To prevent unauthorized users from accessing the configuration functions of your device,

immediately install an Enable-level password.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

event-history on

Use the event-history on command to enable event logging for the Secure Router OS system. Event log

messages will not be recorded unless this command has been issued (regardless of the event-history

priority configured). The event log may be displayed using the show event-history command. Use the no

form of this command to disable the event log.

Syntax Description

No subcommands.

Default Values

By default, the Secure Router OS event logging capabilities are disabled.

Command Modes

(config)# Global Configuration Mode required

Functional Notes

The event history provides useful information regarding the status of the system and individual port states.

Use the event history as a troubleshooting tool when identifying system issues. The following is a sample

event history log.

#show event-history

Using 526 bytes

2002.07.12 15:34:01 T1.t1 1/1 Yellow

2002.07.12 15:34:01 INTERFACE_STATUS.t1 1/1 changed state to down.

2002.07.12 15:34:02 T1.t1 1/1 No Alarms

2002.07.12 15:34:02 INTERFACE_STATUS.t1 1/1 changed state to up.

2002.07.12 15:34:03 INTERFACE_STATUS.eth 0/1 changed state to up.

2002.07.12 15:34:10 OPERATING_SYSTEM Warm Start

2002.07.12 15:34:12 PPP.NEGOTIATION LCP up

2002.07.12 15:34:12 PPP.NEGOTIATION IPCP up

Usage Examples

The following example enables the Secure Router OS event logging feature:

(config)#event-history on

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

event-history priority [error | fatal | info | notice | warning]

Use the event-history priority command to set the threshold for events stored in the event history. All

events with the specified priority or higher will be kept for viewing in the local event log. The event log

may be displayed using the show event-history command. Use the no form of this command to keep

specified priorities from being logged.

Syntax Description

Sets the minimum priority threshold for logging messages to the event history. The following priorities are

available (ranking from lowest to highest):

Info

When selected, all events are logged.

Notice

When selected, events with

notice

warning

error

, and

fatal

priorities are logged.

Warning

When selected, events with

warning

error

, and

fatal

priorities are logged.

Error

When selected, events with

error

and

fatal

priorities are logged.

Fatal

When selected, only events with a

fatal

priority are logged.

Default Values

By default, no event messages are logged to the event history.

Command Modes

(config)# Global Configuration Mode required

Functional Notes

The event history provides useful information regarding the status of the system and individual port states.

Use the event history as a troubleshooting tool when identifying system issues. The following is a sample

event history log.

#show event-history

Using 526 bytes

2002.07.12 15:34:01 T1.t1 1/1 Yellow

2002.07.12 15:34:01 INTERFACE_STATUS.t1 1/1 changed state to down.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

2002.07.12 15:34:02 T1.t1 1/1 No Alarms

2002.07.12 15:34:02 INTERFACE_STATUS.t1 1/1 changed state to up.

2002.07.12 15:34:03 INTERFACE_STATUS.eth 0/1 changed state to up.

2002.07.12 15:34:10 OPERATING_SYSTEM Warm Start

2002.07.12 15:34:12 PPP.NEGOTIATION LCP up

2002.07.12 15:34:12 PPP.NEGOTIATION IPCP up

Usage Examples

The following example logs all events to the event history:

(config)#event-history priority info

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

ftp authentication <listname>

Use the ftp authentication command to attach AAA login authentication lists to the FTP server (see aaa

authentication login <listname> [none | line | enable | local | group] on page 204 for more information).

This list is only used if the AAA subsystem has been activated with the aaa on command.

Syntax Description

<listname> Specifies the named list created with the aaa authentication login command.

Enter default to use the AAA default login list.

Default Values

There is no default configuration for the list. If AAA is turned on but no ftp authentication list has been

assigned, FTP denies all login attempts.

Command Modes

(config)# Global Configuration Mode required

Usage Examples

The following example attaches the authentication list, MyList, to the FTP server:

(config)#ftp authentication MyList

The following example specifies that the Secure Router OS use the default AAA login list for FTP

authentication:

(config)#ftp authentication default

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

hostname <name>

Creates a name used to identify the unit. This alphanumeric string should be used as a unique description

for the unit. This string will be displayed in all prompts.

Syntax Description

<name> Alphanumeric string up to 32 characters used to identify the unit

Default Values

<name> Router

Command Modes

(config)# Global Configuration Mode required

Usage Examples

The following example creates a hostname for the Secure Router OS device of ATL_RTR to identify the

system as the Atlanta router:

(config)#hostname ATL_RTR

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

interface <port-type> <slot/port>

Activates the Interface Configuration Mode for the listed physical interface.

Syntax Description

<port-type> Identifies the physical port type of the installed Interface Module, Backup Module

or Ethernet port. Type interface ? for a complete list of valid interfaces.

<slot/port> Specifies an interface based on its physical location (slot and port). For example,

if you have a T1/DSX-1 installed in Slot 1 of an

Secure Router OS

product:

•The WAN-T1 port would be specified in the CLI as t1 1/1.

•The DSX-1 port would be specified as t1 1/2.

• If (for example) a backup module is also installed, then the DBU port would be

specified as bri 1/3.

• If you are specifying a port that is built into the base unit (e.g., the Ethernet

port), the slot number is 0. For example, the Ethernet (LAN) port would be

specified as ethernet 0/1.

Default Values

No default values required for this command.

Command Modes

(config)# Global Configuration Mode required

Usage Examples

The following example enters the serial interface for a serial module installed in slot 1:

(config)#interface serial 1/1

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

interface frame-relay <label> point-to-point

Use the interface frame-relay command to create a virtual Frame Relay interface (or sublink, if specified)

that is identified using the entered number label. In addition, entering this command activates the Frame

Relay interface. The point-to-point keyword (optional) can be used to identify the Frame Relay endpoint

as a point-to-point link (versus multipoint). Use the no form of this command to delete a configured virtual

Frame Relay interface.

To specify a virtual Frame Relay sub-interface, the following syntax applies:

interface frame-relay <label>.<sublink label>

Syntax Description

<label> Specifies the numerical virtual Frame Relay interface identifying label (valid

range: 1 to 1024)

<sublink label> Numerical label for the virtual sublink (valid range: 1-255)

point-to-point Optional. Identifies the Frame Relay interface as a point-to-point link (versus

multilink)

By default, all created Frame Relay interfaces are point-to-point.

Default Values

By default, there are no configured virtual Frame Relay interfaces or sublinks.

Command Modes

(config)# Global Configuration Mode required

Functional Notes

Creating an endpoint that uses a layer 2 protocol (such as Frame Relay) is generally a four-step process:

Step 1:

Create the Frame Relay virtual endpoint (using the interface frame-relay command) and set the signaling

method (using the frame-relay lmi-type command). Also included in the Frame Relay virtual endpoint are

all the applicable Frame Relay timers, logging thresholds, encapsulation types, etc. Generally, most Frame

Relay virtual interface parameters should be left at their default state. For example, the following creates a

Frame Relay interface labeled 7 and sets the signaling method to ansi.

(config)#interface frame-relay 7

(config-fr 7)#frame-relay lmi-type ansi

Step 2:

Create the sub-interface and configure the PVC parameters. Using the sub-interface, apply access policies

to the interface, create bridging interfaces, configure backup, assign an IP address, and set the PVC

data-link control identifier (DLCI). For example, the following creates a Frame Relay sub-interface labeled

22, sets the DLCI to 30, and assigns an IP address of 193.44.69.1/30 to the interface.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

(config-fr 7)#interface fr 7.22

(config-fr 7.22)#frame-relay interface-dlci 30

(config-fr 7.22)#ip address 193.44.69.1 255.255.255.252

Step 3: (VALID ONLY FOR T1 INTERFACES)

Specify the group of DS0s used for signaling on the T1 interface by creating a tdm-group. Group any

number of aggregate DS0s together to create a data pipe for layer 2 signaling. Also use the tdm-group

command to specify the per-DS0 signaling rate on the interface. For example, the following creates a

tdm-group labeled 9 containing 20 DS0s (each DS0 having a data rate of 56 kbps).

(config)#interface t1 1/1

(config-t1 1/1)#tdm-group 9 timeslots 1-20 speed 56

(config-t1 1/1)#exit

Step 4:

Make the association between the layer 2 endpoint and the physical interface using the bind command.

Supported layer 2 protocols include Frame Relay and point-to-point protocol (PPP). For example, the

following creates a bind (labeled 5) to make an association between the Frame Relay virtual interface (fr 7)

and the tdm-group configured on interface t1 1/1 (tdm-group 9).

(config)#bind 5 t1 1/1 9 fr 7

Usage Examples

The following example creates a Frame Relay virtual interface (labeled 1) and enters the Frame Relay

Interface Configuration Mode:

(config)#interface fr 1

(config-fr 1)#

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

interface hdlc <label>

Use the interface hdlc command to create a virtual high level data link control interface that is identified

using the entered number label. In addition, entering this command activates the HDLC interface. Use the

no form of this command to delete a configured virtual HDLC interface.

Syntax Description

<label> Specifies the numerical virtual HDLC interface identifying label (valid range:

1 to 1024)

Default Values

By default, there are no configured HDLC interfaces.

Command Modes

(config)# Global Configuration Mode required

Functional Notes

Creating an endpoint that uses a layer 2 protocol (such as HDLC) is generally a four-step process:

Step 1:

Create the HDLC virtual endpoint (using the interface hdlc) command and enter the HDLC configuration

commands.

(config)#interface hdlc 7

(config-hdlc 7)#

Step 2:

Configure the interface parameters to apply access policies to the interface, create bridging interfaces,

configure backup, and assign an IP address. For example, the following assigns an IP address of

193.44.69.1/30 to the interface.

(config-hdlc 7)#ip address 193.44.69.1 255.255.255.252

Step 3: (VALID ONLY FOR T1 INTERFACES)

Specify the group of DS0s used for signaling on the T1 interface by creating a tdm-group. Group any

number of aggregate DS0s together to create a data pipe for layer 2 signaling. Also use the tdm-group

command to specify the per-DS0 signaling rate on the interface. For example, the following creates a

tdm-group labeled 9 containing 20 DS0s (each DS0 having a data rate of 56 kbps).

(config)#interface t1 1/1

(config-t1 1/1)#tdm-group 9 timeslots 1-20 speed 56

(config-t1 1/1)#exit

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Step 4:

Make the association between the layer 2 endpoint and the physical interface using the bind command.

Supported layer 2 protocols include Frame Relay, point-to-point protocol (PPP), and HDLC. For example,

the following creates a bind (labeled 5) to make an association between the HDLC virtual interface (hdlc 7)

and the tdm-group configured on interface t1 1/1 (tdm-group 9).

(config)#bind 5 t1 1/1 9 hdlc 7

Usage Examples

The following example creates a HDLC virtual interface (labeled 1) and enters the HDLC Interface

Configuration Mode:

(config)#interface hdlc 1

(config-hdlc 1)#

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

interface loopback <label>

Use the interface loopback command to create a virtual interface that can be assigned layer 3 and higher

properties and is always up unless the router is shut down. Use the no form of this command to delete a

configured loopback interface.

Syntax Description

<label> Specifies the numerical virtual loopback interface identifying label (valid range:

1 to 1024)

Default Values

By default, there are no configured loopback interfaces.

Command Modes

(config)# Global Configuration Mode required

Usage Examples

The following example creates a loopback virtual interface (labeled 1) and enters the Loopback Interface

Configuration Mode:

(config)#interface loopback 1

(config-loop 1)#

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

interface ppp <label>

Use the interface ppp command to create a virtual point-to-point protocol (PPP) interface that is identified

using the entered number label. In addition, entering this command activates the PPP interface. Use the no

form of this command to delete a configured virtual PPP interface.

Syntax Description

<label> Specifies the numerical virtual PPP interface identifying label (valid range:

1 to 1024)

Default Values

By default, there are no configured PPP interfaces.

Command Modes

(config)# Global Configuration Mode required

Functional Notes

Creating an endpoint that uses a layer 2 protocol (such as PPP) is generally a four-step process:

Step 1:

Create the PPP virtual endpoint (using the interface ppp) command and enter the PPP.

(config)#interface ppp 7

(config-ppp 7)#

Step 2:

Configure the interface parameters to apply access policies to the interface, create bridging interfaces,

configure backup, and assign an IP address. For example, the following assigns an IP address of

193.44.69.1/30 to the interface.

(config-ppp 7)#ip address 193.44.69.1 255.255.255.252

Step 3: (VALID ONLY FOR T1 INTERFACES)

Specify the group of DS0s used for signaling on the T1 interface by creating a tdm-group. Group any

number of aggregate DS0s together to create a data pipe for layer 2 signaling. Also use the tdm-group

command to specify the per-DS0 signaling rate on the interface. For example, the following creates a

tdm-group labeled 9 containing 20 DS0s (each DS0 having a data rate of 56 kbps).

(config)#interface t1 1/1

(config-t1 1/1)#tdm-group 9 timeslots 1-20 speed 56

(config-t1 1/1)#exit

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Step 4:

Make the association between the layer 2 endpoint and the physical interface using the bind command.

Supported layer 2 protocols include Frame Relay and point-to-point protocol (PPP). For example, the

following creates a bind (labeled 5) to make an association between the PPP virtual interface (ppp 7) and

the tdm-group configured on interface t1 1/1 (tdm-group 9).

(config)#bind 5 t1 1/1 9 ppp 7

Usage Examples

The following example creates a PPP virtual interface (labeled 1) and enters the PPP Interface

Configuration Mode:

(config)#interface ppp 1

(config-ppp 1)#

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

interface tunnel <id>

Use the interface tunnel command to create a virtual tunnel interface and enters the Tunnel Configuration

command set. See Tunnel Configuration Command Set on page 778 for details. Use the no form of this

command to delete a configured virtual tunnel interface.

Syntax Description

<id> Specifies the numerical tunnel interface identifying label (valid range: 1 to 1024).

Default Values

By default, there are no configured tunnel interfaces.

Command Modes

(config)# Global Configuration Mode

Functional Notes

A tunnel may become operational only under the following conditions:

1. The tunnel must have an IP address defined.

2. A valid source address or interface must be configured.

3. A valid destination address must be configured.

4. The physical interface used as the source for the tunnel must be operational.

5. The tunnel can not be in a recursive routing loop.

6. If keepalives are enabled, keepalive processing must be successful. See keepalive <period> <retries>

on page 803 for details.

Technology Review

A tunnel interface enables standard point-to-point encapsulation between two links. Each endpoint must

have a unique tunnel configured. Tunneling allows an arbitrary payload protocol to be encapsulated within

a delivery protocol to provide point-to-point communications. The tunnel alone does not provide encryption

or any other means of high security. The tunnel interface is not a physical interface, so traffic will be routed

to the tunnel by the routing engine for encapsulation or decapsulation and typically forwarded out a

physical interface. A common tunnel implementation is the use of a GRE tunnel to transport IP multicast

traffic, such as that used by routing protocols across a link that only has IP unicast connectivity (such as

IPSec).

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Usage Examples

The following example creates a tunnel interface (labeled 1) and enters the Tunnel Configuration mode:

(config)#interface tunnel 1

(config-tunnel 1)#

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

ip access-list extended <listname>

Use the ip access-list extended command to create an empty access list and enter the extended access-list.

Use the no form of this command to delete an access list and all the entries contained in it.

The following lists the complete syntax for the ip access-list extended commands:

Example:

Syntax Description

Alphanumeric descriptor for identifying the configured access list (all access list

descriptors are case-sensitive)

Specifies the data protocol such as ip, icmp, tcp, udp, or a specific protocol

(0-255)

Specifies the source IP address used for packet matching

IP addresses can be expressed in one of three ways:

1. Using the keyword

any

to match any IP address. For example, entering

deny

any

will effectively shut down the interface that uses the access list because all

traffic will match the

any

keyword.

2. Using the

host

<A.B.C.D> to specify a single host address. For example,

entering

permit 196.173.22.253

will allow all traffic from the host with an IP

address of 196.173.22.253.

3. Using the <A.B.C.D> <wildcard> format to match all IP addresses in a “range”.

Wildcard masks work in reverse logic from subnet mask. Specifying a one in the

wildcard mask equates to a “don’t care”. For example, entering

deny 192.168.0.0

0.0.0.255

will deny all traffic from the 192.168.0.0/24 network.

Example:

[permit | deny icmp [any | host <A.B.C.D> | <A.B.C.D> <W.W.W.W>]

[any | host <A.B.C.D> | <A.B.C.D> <W.W.W.W>] <icmp-type>* <icmp-code>* <icmp-message>*

* = optional

Source IP Address

Destination IP Address

<source port>* [any | host <A.B.C.D> | <A.B.C.D> <W.W.W.W>] <destination port>*

Source IP Address

Destination IP Address

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

<source port> Optional.

The source port is used only when <protocol> is

tcp

udp

The following keywords and port numbers are supported for the

<source port> field:

any

Match any destination port

eq <port number>

Match only packets on a given port number

gt <port number>

Match only packets with a port number higher than the one listed

host <port number>

Match a single destination host

lt <port number>

Match only packets with a port number lower than the one listed

neq <port number>

Match only packets that do not contain the specified port number

range <port number>

Match only packets that contain a port number specified in the listed range

The <port number> may be specified using the following syntax: <0-65535>.

Specifies the port number used by TCP or UDP to pass information to upper

layers. All ports below 1024 are considered well-known ports and are controlled

by the Internet Assigned Numbers Authority (IANA). All ports above 1024 are

dynamically assigned ports that include registered ports for vendor-specific

applications

The Secure Router OS provides a condensed list of port numbers that may be

entered using a text name

The following is the list of UDP port numbers that may be identified using the text

name (in

bold

biff

(Port 512)

ntp

(Port 123)

bootpc

(Port 68)

pim-auto-rp

(496)

bootps

(Port 67)

rip

(Port 520)

discard

(Port 9)

snmp

(Port 161)

dnsix

(Port 195)

snmptrap

(Port 162)

domain

(Port 53)

sunrpc

(Port 111)

echo

(Port 7)

syslog

(Port 514)

isakmp

(Port 500)

tacacs

(Port 49)

mobile-ip

(Port 434)

talk

(Port 517)

nameserver

(Port 42)

tftp

(Port 69)

Syntax Description (Continued)

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

netbios-dgm

(Port 138)

time

(Port 37)

netbios-ns

(Port 137)

who

(Port 513)

netbios-ss

(Port 139)

xdmcp

(Port 177)

The following is the list of TCP port numbers that may be identified using the text

name (in

bold

bgp

(Port 179)

lpd

(Port 515)

chargen

(Port 19)

nntp

(Port 119)

cmd

(Port 514)

pim-auto-rp

(Port 496)

daytime

(Port 13)

pop2

(Port 109)

discard

(Port 9)

pop3

(Port 110)

domain

(Port 53)

smtp

(Port 25)

echo

(Port 7)

sunrpc

(Port 111)

exec

(Port 512)

syslog

(Port 514)

finger

(Port 79)

tacacs

(Port 49)

ftp

(Port 21)

talk

(Port 517)

gopher

(Port 70)

tftp

(Port 69)

hostname

(Port 101)

telnet

(Port 23)

ident

(Port 113)

time

(Port 37)

irc

(Port 194)

uucp

(Port 540)

klogin

(Port 543)

whois

(Port 43)

kshell

(Port 544)

www

(Port 80)

(Port 513)

Specifies the destination IP address used for packet matching

IP addresses can be expressed in one of three ways:

1. Using the keyword

any

to match any IP address. For example, entering

deny

any

will effectively shut down the interface that uses the access list because all

traffic will match the

any

keyword.

2. Using the

host

<A.B.C.D> to specify a single host address. For example,

entering

permit 196.173.22.253

will allow all traffic from the host with an IP

address of 196.173.22.253.

3. Using the <A.B.C.D> <wildcard> format to match all IP addresses in a “range”.

Wildcard masks work in reverse logic from subnet mask. Specifying a one in the

wildcard mask equates to a “don’t care”. For example, entering

deny 192.168.0.0

0.0.0.255

will deny all traffic from the 192.168.0.0/24 network.

Syntax Description (Continued)

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Default Values

By default, all

Secure Router OS

security features are disabled and there are no configured access lists.

Command Modes

(config)# Global Configuration Mode

<destination port> Optional.

Only valid when <protocol>

tcp

udp

(See previously listed

<source port> for more details)

<icmp-type> Optional.

Filter packets using ICMP defined (and numbered) messages carried

in IP datagrams (used to send error and control information). Valid range is 0 to

255.

<icmp-code> Optional.

ICMP packets that are filtered using the ICMP message type (using the

<icmp-type> keyword) may also be filtered using the ICMP message code (valid

range: 0 to 255).

An <icmp-type> must be specified when entering an <icmp-code>.

<icmp-message> Optional.

Filter packets using ICMP descriptive message rather than the

corresponding type and code associations.

Syntax Description (Continued)

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Functional Notes

Access control lists (ACLs) are used as packet selectors by other Secure Router OS systems; by

themselves they do nothing. ACLs are composed of an ordered list of entries with an implicit deny all at

the end of each list. An ACL entry contains two parts: an action (permit or deny) and a packet pattern. A

permit ACL is used to allow packets (meeting the specified pattern) to enter the router system. A deny ACL

advances the Secure Router OS to the next access policy entry. The Secure Router OS provides two types

of ACLs: standard and extended. Standard ACLs allow source IP address packet patterns only. Extended

ACLs may specify patterns using most fields in the IP header and the TCP or UDP header.

ACLs are performed in order from the top of the list down. Generally, the most specific entries should be at

the top and the most general at the bottom.

The following commands are contained in the access-list extended:

remark

Use the remark command to associate a descriptive tag (up to 80 alphanumeric characters encased in

quotation marks) to the access-list. Enter a functional description for the list such as “This list blocks all

outbound web traffic”.

log

Using the log keyword logs a message (if debug access-list is enabled for this access list) when the access

list finds a packet match.

Usage Examples

The following example creates an access list AllowIKE to allow all IKE (UDP Port 500) packets from the

190.72.22.55.0/24 network:

(config)#ip access-list extended AllowIKE

(config-ext-nacl)#permit udp 190.72.22.55.0 0.0.0.255 eq 500 any eq 500

For more details, refer to the ProCurve SROS Documentation CD for technical support notes regarding

access-list configuration.

Technology Review

Creating access policies and lists to regulate traffic through the routed network is a four-step process:

Step 1:

Enable the security features of the

Secure Router OS

using the ip firewall command.

Step 2:

Create an access control list (using the ip access-list command) to permit or deny specified traffic.

Standard access lists provide pattern matching for source IP addresses only. (Use extended access lists

for more flexible pattern matching.) IP addresses can be expressed in one of three ways:

1. Using the keyword any to match any IP address. For example, entering deny any will effectively shut

down the interface that uses the access list because all traffic will match the any keyword.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

2. Using the host <A.B.C.D> to specify a single host address. For example, entering permit

196.173.22.253 will allow all traffic from the host with an IP address of 196.173.22.253.

3. Using the <A.B.C.D> <wildcard> format to match all IP addresses in a “range”. Wildcard masks work in

reverse logic from subnet mask. Specifying a one in the wildcard mask equates to a “don’t care”. For

example, entering deny 192.168.0.0 0.0.0.255 will deny all traffic from the 192.168.0.0/24 network.

Step 3:

Create an access control policy (using the ip policy-class command) that uses a configured access list.

Secure Router OS

access policies are used to allow, discard, or manipulate (using NAT) data for each

physical interface. Each ACP consists of a selector (access list) and an action (allow, discard, NAT). When

packets are received on an interface, the configured ACPs are applied to determine whether the data will

be processed or discarded. Possible actions performed by the access policy are as follows:

allow list <access list names>

All packets passed by the access list(s) entered will be allowed to enter the router system.

discard list <access list names>

All packets passed by the access list(s) entered will be dropped from the router system.

allow list <access list names> policy <access policy name>

All packets passed by the access list(s) entered and destined for the interface using the access policy

listed will be permitted to enter the router system. This allows for configurations to permit packets to a

single interface and not the entire system.

discard list <access list names> policy <access policy name>

All packets passed by the access list(s) entered and destined for the interface using the access policy

listed will be blocked from the router system. This allows for configurations to deny packets on a specified

interface.

nat source list <access list names> address <IP address> overload

All packets passed by the access list(s) entered will be modified to replace the source IP address with the

entered IP address. The overload keyword allows multiple source IP addresses to be replaced with the

single IP address entered. This hides private IP addresses from outside the local network.

nat source list <access list names> interface <interface> overload

All packets passed by the access list(s) entered will be modified to replace the source IP address with the

primary IP address of the listed interface. The overload keyword allows multiple source IP addresses to

be replaced with the single IP address of the specified interface. This hides private IP addresses from

outside the local network.

nat destination list <access list names> address <IP address>

All packets passed by the access list(s) entered will be modified to replace the destination IP address with

the entered IP address. The overload keyword is not an option when performing NAT on the destination IP

address; each private address must have a unique public address. This hides private IP addresses from

outside the local network.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Step 4:

Apply the created access control policy to an interface. To assign an access policy to an interface, enter

the interface configuration mode for the desired interface and enter access policy <policy name>. The

following example assigns access policy MatchAll to the Ethernet 0/1 interface:

(config)#interface ethernet 0/1

(config-eth 0/1)#access-policy MatchAll

Caution Before applying an access control policy to an interface, verify your Telnet connection will

not be affected by the policy. If a policy is applied to the interface you are connecting

through and it does not allow Telnet traffic, your connection will be lost.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

ip access-list standard <listname>

Use the ip access-list standard command to create an empty access list and enter the standard access-list.

Use the no form of this command to delete an access list and all the entries contained in it.

The following lists the complete syntax for the ip access-list standard commands:

ip access-list standard <listname> [permit or deny] any [permit or deny] host <ip address> [permit

or deny] <ip address> <wildcard>

Default Values

By default, all

Secure Router OS

security features are disabled and there are no configured access lists.

Command Modes

(config)# Global Configuration Mode

Functional Notes

Access control lists are used as packet selectors by access policies (ACPs); by themselves they do

nothing. ACLs are composed of an ordered list of entries with an implicit deny all at the end of each list. An

ACL entry contains two parts: an action (permit or deny) and a packet pattern. A permit ACL is used to

allow packets (meeting the specified pattern) to enter the router system. A deny ACL advances the Secure

Router OS to the next access policy entry. The Secure Router OS provides two types of ACLs: standard

and extended. Standard ACLs allow source IP address packet patterns only. Extended ACLs may specify

patterns using most fields in the IP header and the TCP or UDP header.

Syntax Description

Alphanumeric descriptor for identifying the configured access list (all access list

descriptors are case-sensitive).

Permit or deny entry to the routing system for specified packets.

Specifies the source IP address used for packet matching.

IP addresses can be expressed in one of three ways:

1. Using the keyword

any

to match any IP address. For example, entering

deny

any

will effectively shut down the interface that uses the access list because all

traffic will match the

any

keyword.

2. Using the

host

<A.B.C.D> to specify a single host address. For example,

entering

permit 196.173.22.253

will allow all traffic from the host with an IP

address of 196.173.22.253.

3. Using the <A.B.C.D> <wildcard> format to match all IP addresses in a “range”.

Wildcard masks work in reverse logic from subnet mask. Specifying a one in

the wildcard mask equates to a “don’t care”. For example, entering

deny

192.168.0.0 0.0.0.255

will deny all traffic from the 192.168.0.0/24 network.

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

ACLs are performed in order from the top of the list down. Generally the most specific entries should be at

the top and the most general at the bottom.

The following commands are contained in the access-list standard:

remark

Use the remark command to associate a descriptive tag (up to 80 alphanumeric characters encased in

quotation marks) to the access-list. Enter a functional description for the list such as “This list blocks all

outbound web traffic”.

log

use the log keyword to log a message (if debug access-list is enabled for this access list) when the access

list finds a packet match.

permit or deny any

Use the any keyword to match any IP address received by the access list. For example, the following

allows all packets through the configured access list:

(config)#ip access-list standard MatchAll

(config-std-nacl)#permit any

permit or deny host <ip address>

Use the host <A.B.C.D> keyword to specify a single host address. For example, the following allows all

traffic from the host with an IP address of 196.173.22.253.

(config)#ip access-list standard MatchHost

(config-std-nacl)#permit 196.173.22.253

permit or deny <ip address> <wildcard>

Use the <A.B.C.D> <wildcard> format to match all IP addresses in a “range”. Wildcard masks work in

reverse logic from subnet mask. Specifying a one in the wildcard mask equates to a “don’t care”. For

example, the following denies all traffic from the 192.168.0.0/24 network:

(config)#ip access-list standard MatchNetwork

(config-std-nacl)#deny 192.168.0.0 0.0.0.255

SROS Command Line Interface Reference Guide Global Configuration Mode Command Set

Usage Examples

The following example creates an access list UnTrusted to deny all packets from the 190.72.22.248/30

network:

(config)#ip access-list standard UnTrusted

(config-std-nacl)#deny 190.72.22.248 0.0.0.3

For more details, refer to the ProCurve SROS Documentation CD for technical support notes regarding

access-list configuration.

Technology Review

Creating access policies and lists to regulate traffic through the routed network is a four-step process:

Step 1:

Enable the security features of the

Secure Router OS

using the ip firewall command.

Step 2:

Create an access list to permit or deny specified traffic. Standard access lists provide pattern matching for

source IP addresses only. (Use extended access lists for more flexible pattern matching.) IP addresses

can be expressed in one of three ways:

1. Using the keyword any to match any IP address. For example, entering deny any will effectively shut

down the interface that uses the access list because all traffic will match the any keyword.

2. Using the host <A.B.C.D> to specify a single host address. For example, entering permit

196.173.22.253 will allow all traffic from the host with an IP address of 196.173.22.253.

3. Using the <A.B.C.D> <wildcard> format to match all IP addresses in a “range”. Wildcard masks work in

reverse logic from subnet mask. Specifying a one in the wildcard mask equates to a “don’t care”. For

example, entering deny 192.168.0.0 0.0.0.255 will deny all traffic from the 192.168.0.0/24 network.

Step 3:

Create an access policy that uses a configured access list.

Secure Router OS

access policies are used to

allow, discard, or manipulate (using NAT) data for each physical interface. Each ACP consists of a selector

(access list) and an action (allow, discard, NAT). When packets are received on an interface, the

configured ACPs are applied to determine whether the data will be processed or discarded. Possible

actions performed by the access policy are as follows:

allow list <access list names>

All packets passed by the access list(s) entered will be allowed to enter the router system.

discard list <access list names>

All packets passed by the access list(s) entered will be dropped from the router system.

allow list <access list names> policy <access policy name>

All packets passed by the access list(s) entered and destined for the interface using the access policy

listed will be permitted to enter the router system. This allows for configurations to permit packets to a

single interface and not the entire system.