Page 1: Table Of Contents
Release Note Software Version 2.8.1 For AT-8800, Rapier i, AT-8700XL, AT-8600, AT-9900, x900-48FE, AT-8900 and AT-9800 Series Switches and AR400 and AR700 Series Routers Introduction ...4 Upgrading to Software Version 2.8.1 ...5 Overview of New Features ...6 System Enhancements ... 9 Command Line Interface (CLI) Enhancements ...
Page 2 IP Route Preference Options ... 66 IPv4 Filter Expansion ... 67 Enhancements to Display of UDP Connections over IPv4 ... 68 Waiting for a Response to an ARP Request ... 68 Adding Static ARP Entries with Multicast MAC Addresses ... 69 Enhanced Static ARP Entry Filtering on Ports within a Trunk Group ...
Page 3 Software Version 2.8.1 Command Reference Updates ... 173 SNMP MIBs ... 186 SHDSL Line MIB ... 186 Logging SNMP operation ... 187 Traps on OSPF state changes ... 188 Trap on VRRP topology changes ... 189 Traps on MSTP state and topology changes ... 189 Restart Log ...
Page 4: Introduction
These sections describe how to configure each new feature. Caution: Information in this document is subject to change without notice and does not represent a commitment on the part of Allied Telesis Inc. While every effort has been made to ensure that the information contained within this document and the features and changes described are accurate, Allied Telesis Inc.
Page 5: Backwards Compatibility Issue When Upgrading
Upgrading to Software Version 2.8.1 Software Version 2.8.1 is available as a flash release that can be downloaded directly from the Software/Documentation area of the Allied Telesis website: www.alliedtelesis.com/support/software Software versions must be licenced and require a password to activate. To obtain a licence and password, contact your authorised Allied Telesis distributor or reseller.
Page 6: Overview Of New Features
Overview of New Features Overview of New Features The following table lists the new features and enhancements by product series. For supported models, see System: Clearing System Parameters System: Extended Monitoring of CPU Utilisation CLI: Command Line Interface (CLI) Enhancements File System: File System Enhancement Switching:...
Page 7 Software Version 2.8.1 IPv6: IPv6 Tunnel Expansion L2TP: Decoding Debug Output and Setting a Time Limit for Debugging L2TP: Resetting General L2TP Counters L2TP: Handling PPP Link Negotiation Failures OSPF: OSPF Interface Password OSPF: NSSA Translator Role OSPF: Redistributing External Routes BGP: BGP Backoff Lower Threshold BGP:...
Page 8 Overview of New Features SNMP MIBs: Traps on OSPF state changes SNMP MIBs: Trap on VRRP topology changes SNMP MIBs: Traps on MSTP state and topology changes SNMP MIBs: Restart Log SNMP MIBs: Trap on Login Failures SNMP MIBs: VLAN-based port state changes SNMP MIBs: Trap on Memory Levels CDP:...
Page 9: System Enhancements
Software Version 2.8.1 System Enhancements This Software Version includes the following enhancements to system commands: ■ Clearing System Parameters ■ Extended Monitoring of CPU Utilisation This section describes the enhancements. The new and modified commands to implement them are described in Clearing System Parameters The option none has been added to the following commands: set system name...
Page 10 System Enhancements To capture data when the CPU is experiencing a specific amount of instantaneous usage, set the start and start percentages with the command: activate cpu extended start=1..100 [stop=1..100] When a start percentage is set, the router or switch automatically disables extended monitoring once it has 500 data entries.
Page 11: Command Reference Updates
Software Version 2.8.1 Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, the new parameters, options, and fields are shown in bold. activate cpu extended Syntax ACTivate CPU EXTended STARt=1..100 [STOp=1..100] Description...
Page 12: Set System Contact
System Enhancements reset cpu utilisation Syntax RESET CPU UTIlisation Description This command, which resets all CPU utilisation percentages, has been modified to include resetting any start and stop percentages set with the activate cpu extended command. It also removes any data captured during extended utilisation monitoring, and clears this output from the show cpu command.
Page 13: Show Cpu
Software Version 2.8.1 show cpu Syntax SHow CPU [EXTended] Description The new extended parameter in this command displays information about extended CPU utilisation data. Figure 1: Example output from the show cpu extended command CPU Utilisation ( as a percentage ) ---------------------------------------- Maximum since router restarted ...
Page 14 System Enhancements Table 1: New parameters in output of the show cpu=extended command Parameter State Current Time Current Install Start percent Stop percent msSM Timestamp Util Caller Return 1, Return 2, Return 3 Example To display the extended CPU utilisation data, use the command: sh cpu ext Meaning Whether extended CPU utilisation is enabled.
Page 15: Command Line Interface (Cli) Enhancements
Software Version 2.8.1 Command Line Interface (CLI) Enhancements The CLI has been enhanced in the following ways: ■ More flexibility in Separating Parameters and Values ■ Additional Shortcuts when Editing ■ New command Please note that it replaces the Ctrl-C shortcut. ■...
Page 16 Command Line Interface (CLI) Enhancements Command Part Description Keyword Action Parameter Value Option Placeholder Default Command Changes The following table summarises the new command. Command set command assignmentoperator A generic term for a predefined sequence of characters that the CLI treats as a single unit.
Page 17: Additional Shortcuts When Editing
Software Version 2.8.1 Additional Shortcuts when Editing You can now move the cursor to the beginning or end of lines by using single keys on the keyboard. To move the cursor to the... beginning of the command line end of the command line Command Changes The following table summarises the changes new and modified commands.
Page 18: Command Reference Updates
Command Line Interface (CLI) Enhancements Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, new parameters, options and fields are shown in bold. create config Syntax CREate CONfig=filename [SET] Description...
Page 19 Software Version 2.8.1 set command assignmentoperator Syntax SET COMmand {ASSignmentoperator=[Equals|SPaceorequals]} Description This new command sets the assignment operator of the command parser thereby defining the format of the command syntax for the CLI. Parameter ASSignmentoperator The following commands have the same effect. Note that the first one is clearer because of the = sign.
Page 20: Show Command History
Command Line Interface (CLI) Enhancements show command history Syntax SHow COMmand History Description This new command replaces the Ctrl-C keyboard shortcut, and displays past commands for you to select one from the list (Figure 1). Figure 2: Example output from the show command history command Enter command number>...
Page 21: File System Enhancement
Software Version 2.8.1 File System Enhancement This Software Version gives you 4 new commands for working with files. Command Changes The following table summarises the new commands: Command add file create file reset file permanentredirect show file permanentredirect Command Reference Updates This section describes each new command.
Page 22: Create File
File System Enhancement Parameter (cont.) PERManentredirect Permanently directs output to the designated text file until the reset LIMIT Examples To add output one time only from the show trace command to a file called trace.txt command, use the command: add fi=trace.txt To permanently add output from the show debug command to a file called debug2.txt command, use the command: add fi=debug2.txt...
Page 23 Software Version 2.8.1 Parameter LIMIT Example To permanently direct all debug output from the BGP module to a file named bgp.txt, use the command: cre fi=bgp.txt com="enable bgp debug=all" perm reset file permanentredirect Syntax RESET FIle[=filename] PERManentredirect Description This new command closes one or all text files so that they no longer receive input from commands or scripts.
Page 24 File System Enhancement Figure 3: Example output from the show file permanentredirect command Instance --------------------------------------------------- Figure 4: Example output from the show file=filename permanentredirect command File... bgp.txt TTY Instance... 17 Current Size... 12345 Limit... 204800 Input(s)... COMMAND="enable bgp debug=all" Table 2: Parameters in output of the show file permanentredirect command Parameter TTY Instance Current Size...
Page 25: Switching Enhancements
Software Version 2.8.1 Switching Enhancements This Software Version includes the following enhancements to switching: ■ Ordering Hardware Filters in 48-Port Switches ■ Limiting Rapid MAC Movement ■ Route Update Queue Length ■ Removing a Description from a Switch Port ■ Securing a Single VLAN through Switch Filters ■...
Page 26: Changing Modes
Switching Enhancements When to Use Use the port-specific psf mode when you want non port-specific filters to Port-Specific Mode override the port-specific filters for certain circumstances. In the following example: ■ the first (port-specific) filter stops all traffic from ingressing port 2 ■...
Page 27: Disabling A Port
Software Version 2.8.1 Limiting Rapid MAC Movement This Software Version introduces the ability to limit rapid MAC movement. MAC address thrashing occurs when MAC addresses move rapidly between one or more ports or trunks. For example, certain MAC addresses are learnt on one port, then very shortly afterwards are learnt on another port, then learnt on the original port again, and so on.
Page 28: Port Types
Switching Enhancements To view details about disabled ports for VLANs, use one of the commands: show vlan[={vlan-name|1..4094|all}] show vlan[=all] Re-enabling a port When a port is disabled, either completely or for a specific VLAN, it remains disabled until it is manually re-enabled in any of the following ways: ■...
Page 29: Route Update Queue Length
Software Version 2.8.1 Route Update Queue Length When hardware learning delay is enabled (the default), the switch learns new routes in software, then places them into a queue for adding to its hardware routing table. Defaults have been set for the maximum number of entries in the queue, and depend on the amount of memory installed on the switch, as shown in the following table: Memory Size (Mbytes)
Page 30: Removing A Description From A Switch Port
Switching Enhancements Removing a Description from a Switch Port You can now return the description of a switch port to its original blank value by entering the following command: set switch port=port-number description= and providing no value for the description parameter. Command Changes The following table summarises the modified command: Command...
Page 31 Software Version 2.8.1 Default behaviour (vlansecure enabled) port 15 port 16 vlan2 vlan1 Configuring vlansecure To turn off the default behaviour, so that the filter prevents access to only the current VLAN when you move the host, use the new command: disable switch filter vlansecure To return to the standard filter behaviour, use the new command: enable switch filter vlansecure...
Page 32: Change Of Debug Command Syntax
Switching Enhancements Change of Debug Command Syntax This Software Version includes a change in syntax for the enable switch debug and disable switch debug commands. To enable or disable debugging on the switch chip operations, you now use the dev option. Previously, this type of debugging was enabled or disabled using the m6 parameter.
Page 33: Command Reference Updates
Software Version 2.8.1 Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, new parameters, options and fields are shown in bold. create switch trunk Syntax CREate SWItch TRunk=trunk [POrt=port-list] [SPeed={10M|100M|1000M|10G}] [THRASHAction={LEarndisable|LINKDown|NONE|POrtdisable|V...
Page 34 Switching Enhancements disable switch debug Syntax DISable SWItch DEBug={ARL|DEV|DMA|PHY|ALL} Description The m6 parameter is now replaced by the dev parameter in this command. Debug Option disable switch filter vlansecure Syntax DISable SWItch FILter VLANSecure Description This new command modifies Layer 2 switch filtering by disabling vlansecure mode.
Page 35 Software Version 2.8.1 Example To disable the default vlan on port 1, use the command: dis swi po=1 vlan=1 enable switch debug Syntax ENAble SWItch DEBug={ARL|DEV|DMA|PHY|ALL} [OUTPUT=CONSOLE] [TIMEOUT={1..4000000000|NONE}] Description The m6 parameter is now replaced by the dev parameter in this command. Debug Option enable switch filter vlansecure Syntax...
Page 36 Switching Enhancements The vlan parameter specifies the VLAN or VLANs for which ports are enabled. Specified ports must be a member of the VLAN. If no value or all is specified, the specified ports are enabled for all VLANs to which they belong. Note that when a disabled VLAN is re-enabled on a port, the port automatically has ingress filtering disabled, as long as there are no other VLANs disabled on the port, and as long as ingress filtering was not previously...
Page 37 Software Version 2.8.1 If none is specified, the trunk is not automatically re-enabled, but individual ports can be re-enabled by using the enable switch port command for thrashaction=portdisable or linkdisable, and the enable switch port vlan command for thrashaction=vlandisable. The default is 1 second. set switch hwfilter mode Syntax SET SWItch HWFilter MODe={PSF|NPSF}...
Page 38: Set Switch Port
Switching Enhancements Example To make the queue as long as possible on a switch with 256Mbytes of memory, use the command: set swi hwr=4000000 set switch port SET SWItch POrt={ [BCLimit={NONE|limit] [DESCription=[description]] [EGResslimit={bandwidth|DEFault}] [IGMPACtion={DENY|REPlace}] [IGMPFIlter={NONE|filter-id}] [IGMPMAxgroup={NONE|1..65535}] [INFILTering={OFF|ON}] [INTRusionaction={DISAble|DIScard|TRap}] [LEARn={NONE|0|1..256] [MIRRor={BOTH|NONE|RX|TX}] [MODe={AUTOnegotiate|MASTer|SLAve}] [POLarity={MDI|MDIX}] [RELearn={OFF|ON}] [SPeed={AUTOnegotiate|10MAUTo|10MHALf|10MFUll|10MHAUto|...
Page 39: Set Switch Trunk
Software Version 2.8.1 thrashtimeout=none, and thrashaction is then changed to learndisable, then the router or switch automatically changes the thrashtimeout to 1 second. If none is specified, the port is not automatically re-enabled, but can be re-enabled by using the enable switch port command for thrashaction=portdisable or linkdisable, and the enable switch port vlan command for thrashaction=vlandisable.
Page 40: Show Lacp
Switching Enhancements ■ portdisable or linkdown to disable all ports in the thrashing trunk until either the period specified by the thrashtimeout parameter has elapsed, or until the ports or subset of ports in the trunk are re-enabled by the enable switch port command.
Page 41: Show Switch
Software Version 2.8.1 Table 4: New parameters in output of the show lacp command Parameter Address learn thrash action Address learn thrash timeout show switch Syntax SHow SWItch Description This command now shows information about the hardware route update queue Figure 5: New parameters in output of the show switch command when hardware learning delay is disabled Switch Configuration...
Page 42: Release Note
Switching Enhancements Figure 6: New parameters in output of the show switch command when hardware learning delay is enabled Switch Configuration ----------------------------------------------------------- Switch Address ... 00-00-cd-12-78-03 Learning ... ON Ageing Timer ... ON IP route: Learn delay ... 4 ms queue size ...
Page 43 Software Version 2.8.1 Table 5: New parameters in the output of the show switch command Parameter Learn delay Queue size Queue limit Percent in use High water mark Queue maximum Queue default Updating hardware (status) The number of entries that the software has queued for show switch debug Syntax SHow SWItch DEBug...
Page 44 Switching Enhancements show switch filter Syntax SHow SWItch FILter [POrt={port-list|ALL}] [ACtion={FORward|DIScard}] [DESTaddress=macadd] [ENTry=entry-list] [VLAN={vlan-name|1..4094}] Description This command displays information about Layer 2 switch filters. Figure 8: Example output from the show switch filter command Switch Filters --------------------------------------------------------------------------- VlanSecure ... ENABLED Entry VLAN ---------------------------------------------------------------------------...
Page 45: Show Switch Port
Software Version 2.8.1 Table 8: Modified parameters in output of the show switch hwfilter command Parameter Mode show switch port Syntax SHow SWItch POrt[={ Description This command displays general information about all ports or a specific one. Figure 10: Example output from the show switch port command for port-based VLANs Switch Port Information ------------------------------------------------------------ Port ...
Page 46: Port
Switching Enhancements Table 9: New parameters in output of the show switch port command (cont.) Parameter Address learn thrash status Address learn thrash action Address learn thrash timeout VLAN Status Trap Meaning The thrashing protection status of the port. If the thrash action is set to vlandisable, the status is shown for each VLAN that the port is a member of, with each VLAN listed on a separate line.
Page 47: Pppoe Access Concentrator
Software Version 2.8.1 PPPoE Access Concentrator This release introduces the ability for the PPPoE Access Concentrator and a PPPoE Client to be active simultaneously. You can now specify the interface to which the PPPoE Access Concentrator should attach. Command Changes The following table summarises the modified commands: Command add ppp acservice...
Page 48 PPPoE Access Concentrator delete ppp acservice Syntax DELete PPP ACservice=service-name [ACINTerface={NONE|interface}] where: ■ interface is an interface name formed by concatenating an interface type and an interface instance (e.g. eth0). Valid interface types are ETH and VLAN. Description This command deletes a PPP over Ethernet Access Concentrator service from the router or switch.
Page 49 Software Version 2.8.1 ■ If the acinterface parameter is omitted, the service is mapped to its corresponding interface (if one exists). If multiple interfaces exist for the service, you are asked to specify an acinterface. The default for this parameter is none. The acinterface parameter supercedes the now deprecated vlan parameter in this command.
Page 50: Command Reference Updates
MSTP Enhancement MSTP Enhancement Two new commands have been added to simplify MSTP operation. Command Changes The following table summarises the new commands: Command disable mstp port enable mstp port Command Reference Updates This section describes each new command. disable mstp port Syntax DISable MSTP POrt={port-list|ALL} where:...
Page 51: Stp Enhancement
Software Version 2.8.1 STP Enhancement You can now display the RSTP states for one or more ports by using the existing command: show stp port={port-list|all} rstpstate The information for each port now starts with the port number. This makes the output more readable.
Page 52: Making Asynchronous Ports Respond More Quickly
Asynchronous Port Enhancement Asynchronous Port Enhancement This section describes the enhancement. The modified commands to implement it are described in Making Asynchronous Ports Respond More Quickly When an asynchronous port is in ten mode, it bundles together the characters that it receives within a certain time period, instead of passing them one at a time to a higher protocol layer for processing.
Page 53: Command Reference Updates
Software Version 2.8.1 Command Reference Updates This section describes the changed portions of modified commands and output screens. For modified commands and output, the new parameters, options, and fields are shown in bold. set asyn Syntax SET ASYn[=asyn-number] [ATtention={Break control char|^[|None}] [CDcontrol={Connect|Ignore|Online}] [DAtabits={5|6|7|8}] [DEFaultservice={ON|OFf|YES|NO|True|False}]...
Page 54 Asynchronous Port Enhancement Figure 13: Example output from the show asyn=port-number command ASYN 0 : 0003896346 seconds ASYN information Name ... Asyn 0 Status ... enabled Mode ... Ten Data rate ... 9600 Parity ... none Data bits ... 8 Stop bits ...
Page 55: Internet Group Management Protocol (Igmp) Enhancements
IGMP Proxy on x900 Series Switches IGMP proxy was previously released on the following products: ■ AR400 Series routers ■ AR700 Series routers ■ AT-8600 Series switches ■ AT-8700XL Series switches ■ AT-8800 Series switches ■ Rapier Series switches This software version adds support for IGMP proxy on the following x900 Series switches: ■...
Page 56 Internet Group Management Protocol (IGMP) Enhancements interface. The following table summarises how the IGMP proxy agent processes each IGMP message type. When this message... Is received on this interface... Then the IGMP proxy agent... Report downstream upstream Leave downstream upstream Group-specific query downstream upstream...
Page 57: Igmp Filtering Extended To All Igmp Message Types
Software Version 2.8.1 To enable IGMP on the router or switch, use the command: enable ip igmp To enable IGMP on a specific interface, use the command: enable ip igmp interface=interface You can configure the IGMP proxy agent to monitor the reception of IGMP general query messages on an interface, and to generate a log message and an SNMP trap if an IGMP general query message is not received on the interface within a specified time interval.
Page 58 Internet Group Management Protocol (IGMP) Enhancements Finally, apply the filter to a switch port, using the command: set switch port={port-list|all} igmpfilter=filter-id You can apply an IGMP filter to more than one switch port, but a single switch port can have only one IGMP filter assigned to it. To delete or modify an entry in a filter, use the commands: delete igmp filter=filter-id entry=1..65535 set igmp filter=filter-id entry=1..65535...
Page 59: Monitoring Reception Of Igmp General Query Messages
Software Version 2.8.1 Monitoring reception of IGMP general query messages You can configure the IGMP proxy agent to monitor the reception of IGMP general query messages on an interface. If an IGMP general query message is not received on the interface within a specified time interval, IGMP generates an igmpGeneralQueryNotReceivedEvent SNMP trap ({ enterprises(1) alliedTelesyn(207) mibObject(8) brouterMib(4) atRouter(4) traps(2) igmpTraps(1) 1 }) containing the ifName object for the interface, and the...
Page 60: Command Reference Updates
Internet Group Management Protocol (IGMP) Enhancements Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, the new parameters, options, and fields are shown in bold. add igmp filter Syntax ADD IGMP FILter=filter-id GROupaddress={ipadd|ipadd-ipadd}...
Page 61 Software Version 2.8.1 add ip interface Syntax ADD IP INTerface=interface IPaddress={ipadd|DHCP} [ADVertise={YES|NO}] [BROadcast={0|1}] [DIRectedbroadcast={False|NO|OFF|ON|True|YES}] [FILter={0..999|NONE}] [FRAgment={NO|OFF|ON|YES}] [GRAtuitousarp={ON|OFF}] [GRE={0..100|NONE}] [IGMPProxy={OFF|UPstream|DOWNstream}] [INVersearp={ON|OFF}] [MASK=ipadd] [METric=1..16] [MULticast={BOTH|NO|OFF|ON|RECeive|SENd|YES}] [OSPFmetric=1..65534] [POLicyfilter={0..999|NONE}] [PREferencelevel={-2147483648..2147483647|NOTDEFAULT}] [PRIorityfilter={0..999|NONE}] [[PROxyarp={False|NO|OFF|ON|True|YES|STrict|DEFRoute}] [RIPMetric=1..16] [SAMode={Block|Passthrough}] [VJC={False|NO|OFF|ON|True|YES}] [VLANPRiority={0..7|None}] [VLantag={1..4094|None}] where: ■ interface is an interface name formed by concatenating a Layer 2 interface type, an interface instance, and optionally a hyphen followed by a logical interface number from 0 to 15.
Page 62 Internet Group Management Protocol (IGMP) Enhancements The groupaddress parameter specifies an IP multicast group address or a range of IP multicast group addresses to match. Set groupaddress to: ■ 0.0.0.0 to filter IGMP general query messages ■ a multicast address or a range of multicast addresses to filter IGMP group-specific query messages, report messages, and leave messages.
Page 63: Set Ip Interface
Software Version 2.8.1 Example To set the maximum time period allowed between successive IGMP general query messages on interface vlan2 to 120 seconds, use the command: set ip igmp int=vlan2 query=120 set ip interface Syntax SET IP INTerface=interface [ADVertise={YES|NO}] [PREferencelevel={-2147483648..2147483647|NOTDEFAULT}] [BROadcast={0|1}] [DIRectedbroadcast={False|NO|OFF|ON|True|YES}] [FILter={0..999|NONE}] [FRAgment={NO|OFF|ON|YES}]...
Page 64: Show Igmp Filter
Internet Group Management Protocol (IGMP) Enhancements show igmp filter Syntax SHow IGMP FILter[=filter-id] where: ■ filter-id is a decimal number from 1 to 99. Description The output of this command includes new fields. Figure 14: Example output from the show igmp filter command IGMP Filters ------------------------------------------------------------------------------- Entry...
Page 65: Show Ip Igmp
Software Version 2.8.1 show ip igmp Syntax SHow IP IGMP [INTerface=interface] [DEStination=ipadd] where: ■ interface is an interface name formed by concatenating a Layer 2 interface type, an interface instance, and optionally a hyphen followed by a logical interface number from 0 to 15. If a logical interface is not specified, 0 is assumed.
Page 66: Expanded Number Of Eth Interfaces Per Physical Interface
Internet Protocol (IP) Enhancements Internet Protocol (IP) Enhancements This Software Version includes the following enhancements to IP: ■ Expanded number of Eth interfaces per physical interface ■ Expanded IP Troubleshooting ■ IP Route Preference Options ■ IPv4 Filter Expansion ■ Enhancements to Display of UDP Connections over IPv4 ■...
Page 67: Ipv4 Filter Expansion
Software Version 2.8.1 This allows you to set the route preference for all protocol types at once. Command Changes The following table summarises the modified command: Command set ip route preference IPv4 Filter Expansion This Software Version increases the amount of IP filters you can create, and allows you to assign a filter type to any IP filter.
Page 68: Enhancements To Display Of Udp Connections Over Ipv4
Internet Protocol (IP) Enhancements You can display IP filters with their filter number and filter type using the command: show ip filter[=0..999] Command Changes The following table summarises the modified commands: Command add ip filter set ip filter show ip filter Enhancements to Display of UDP Connections over IPv4 In this Software Version, the display of information about UDP connections has...
Page 69: Adding Static Arp Entries With Multicast Mac Addresses
Software Version 2.8.1 Command Changes The following table summarises the new and modified commands: Command set ip arpwaittimeout show ip Adding Static ARP Entries with Multicast MAC Addresses This Software Version allows you to add ARP entries with multicast MAC addresses and allows the router or switch to accept packets with unicast IP addresses and multicast MAC addresses.
Page 70: Enhanced Static Arp Entry Filtering On Ports Within A Trunk Group
Internet Protocol (IP) Enhancements For an example of how to use ARP entries with multicast MAC addresses, see Guideline to Windows 2003 Network Load Balancing Clustering with Allied Telesyn Switches. This is available from the Resource Center on your Documentation and Tools CD-ROM, or from: www.alliedtelesis.co.uk/en-gb/solutions/techdocs.asp?area=howto Command Changes...
Page 71: Command Reference Updates
Software Version 2.8.1 Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, the new parameters, options, and fields are shown in bold. add ip filter Syntax Traffic filter: ADD IP FILter=0..999 ACtion={INCLude|EXCLude} SOurce=ipadd...
Page 72 Internet Protocol (IP) Enhancements Description This command adds a pattern to an IP traffic filter, policy filter, routing filter, or priority filter. You now specify the type of filter by using the type parameter. Parameter FILter TYPE disable ip macdisparity Syntax DISable IP MACdisparity Description...
Page 73 Software Version 2.8.1 enable ip macdisparity Syntax ENAble IP MACdisparity Description This new command allows you to add static ARP entries with multicast MAC addresses, and allows packets with conflicting IP and MAC addresses to pass through the router or switch. Normally these packets are discarded as being invalid by the router or switch.
Page 74 Internet Protocol (IP) Enhancements destination is unknown. You may need to increase the timeout period if you are communicating with devices that are slow to respond. The default is 1 second. Example To set the router or switch to wait 2 seconds after you ping a device before declaring that the device is unreachable, use the command: set ip arpw=2 set ip filter...
Page 75 Software Version 2.8.1 show ip Syntax SHow IP Figure 16: Modified example output from the show ip command IP Module Configuration ------------------------------------------------------------ Module Status ... ENABLED IP Packet Forwarding ... ENABLED IP Echo Reply ... ENABLED Debugging ... DISABLED IP Fragment Offset Filtering ... ENABLED Default Name Servers Name Server ...
Page 76: Troubleshooting
Internet Protocol (IP) Enhancements Table 15: Modified parameters on output of the show ip command. Arp wait timeout show ip cache Syntax SHow IP CAChe Description This new command displays information about the IP address cache when troubleshooting. Figure 18: Example output from the show ip cache command IP Address Cache ------------------------------------------------------------------ Entries ...
Page 77: Show Ip Counter
Software Version 2.8.1 Table 16: Parameters in output of the new show ip cache command (cont.) Parameter Type Count show ip counter Syntax SHow IP COUnter[={ALL|ARP|CAChe|ICmp|INterface|IP|MUlticast|ROu tes|SNmp|UDp}] Description This command displays all or selected parts of the IP MIB. You can now specify cache as an option for the counter parameter.
Page 78: Show Ip Filter
Internet Protocol (IP) Enhancements show ip filter Syntax SHow IP FILter[= 0..999] Figure 20: New parameters in example output from the show ip filter command IP Filters -------------------------------------------------------------------------------- No. Filter Type Ent. Source Port Source Address Dest. Port Dest. Address Pattern Type Act/Pol/Pri --------------------------------------------------------------------------------...
Page 79 Software Version 2.8.1 Table 19: New and changed parameters in the output of the show ip udp command Parameter Meaning Local Address Process Software Version 2.8.1 C613-10477-00 REV B The IP address of the last interface that was used to transport UDP packets from the router or switch, for a given process.
Page 80: Display Of Udp Connections Over Ipv6
IPv6 Enhancements IPv6 Enhancements This Software Version includes the following enhancements to IPv6 functionality: ■ Display of UDP Connections over IPv6 ■ IPv6 Tunnel Expansion This section describes the enhancements. The new command to implement them are described in Display of UDP Connections over IPv6 This Software Version enables you to display the state of all active UDP over IPv6 sessions, by using the following new command: show ipv6 udp...
Page 81: Command Reference Updates
Software Version 2.8.1 Command Reference Updates This section describes the new command. show ipv6 udp Syntax SHow IPV6 UDP Description This new command displays the state of current UDP sessions over IPv6. Figure 22: Example output of the new show ipv6 udp command Local port Local address --------------------------------------------------------------------------...
Page 82: Decoding Debug Output And Setting A Time Limit For Debugging
L2TP Enhancements L2TP Enhancements This Software Version includes the following enhancements to Layer 2 Tunnelling Protocol: ■ Decoding Debug Output and Setting a Time Limit for Debugging ■ Resetting General L2TP Counters ■ Handling PPP Link Negotiation Failures This section describes the enhancements. The new and modified commands to implement them are described in Decoding Debug Output and Setting a Time Limit for Debugging...
Page 83: Handling Ppp Link Negotiation Failures
Software Version 2.8.1 Command Changes The following table summarises the modified commands: Command disable l2tp debug enable l2tp debug show l2tp tunnel show l2tp tunnel call Resetting General L2TP Counters This Software Version has the new command reset l2tp counter, which allows you to reset the general counters for L2TP.
Page 84: Command Reference Updates
L2TP Enhancements Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, new parameters, options and fields are shown in bold. add l2tp ip Syntax ADD L2TP IP=ipadd[-ipadd] PPPTemplate=0..31 [NUMber={OFF|ON|STARTup}] [PRE13={OFF|ON}] [PROXYAuth={OFF|ON}] [TOSreflect={OFF|ON|False|True|NO|YES}]...
Page 85 Software Version 2.8.1 enable l2tp debug Syntax ENAble L2TP DEBug={ALL|DECode|PKT|STAte} [CALL[=1..65535]|TUNnel[=1..65535]] [TIMEOut=1..300] Parameter DEBug TIMEOut Figure 23: Example output from the enable l2tp debug=decode command 18:07:20 L2TP DECODE: Rx [TID:0 CID:0 from 192.168.1.1:1701] Header: Attribute Value Pairs (AVPs): 18:07:20 L2TP DECODE: Tx [TID:1618 CID:3612 to 192.168.1.1:1701] Header: Payload: Software Version 2.8.1...
Page 86 L2TP Enhancements Table 21: Parameters in the output of the enable l2tp debug=decode command Parameter timestamp L2TP DECODE Header Attribute Value Pairs (AVPs) Payload reset l2tp counter Syntax RESET L2TP COUnter Description This new command resets the general L2TP counters, which are displayed using the show l2tp counter command.
Page 87: Show L2Tp Tunnel
Software Version 2.8.1 show l2tp ip Syntax SHow L2TP IP Figure 24: Example output from the show l2tp ip command L2TP IP Range Information ------------------------------------------------------------ IP Range ... 192.168.1.2 ------------------------------------------------------------ Table 22: Parameters in the output of the show l2tp ip command Parameter Proxy Authentication show l2tp tunnel...
Page 88 L2TP Enhancements show l2tp tunnel call Syntax SHow L2TP TUNnel CALL[=1..65535] Figure 26: New option in example output from the show l2tp tunnel call command for a specific call Table 24: Parameters in the output of the show l2tp tunnel call command for a specific call Parameter Debug...
Page 89: Open Shortest Path First Enhancements
Software Version 2.8.1 Open Shortest Path First Enhancements Software Version 2.8.1 includes the following enhancements to OSPF: ■ OSPF Interface Password ■ NSSA Translator Role ■ Redistributing External Routes This section describes the enhancements. The modified commands to implement them are described in OSPF Interface Password The option none has been added to the password parameter for the following commands:...
Page 90 Open Shortest Path First Enhancements When the NSSA border router is acting as a translator it sets the Nt bit in router LSAs it originates into the NSSA. An elected translator loses its translator role when another NSSA border router with a higher router identifier is elected as translator or an NSSA router configured to always translate gains border router status.
Page 91: Redistributing External Routes
Software Version 2.8.1 Redistributing External Routes OSPF static route redistribution has been enhanced to support additional route sources. OSPF can now import and redistribute BGP, RIP, non-OSPF interface, and statically configured routes. It can also optionally assign any of the following settings to all routes it imports: ■...
Page 92 Open Shortest Path First Enhancements When you change this set ospf parameter... From... staticexport asexternal Similarly, adding or deleting a route redistribution definition changes the setting of the corresponding bgpimport, rip, or staticexport parameter, as summarised in the following table. When you do this...
Page 93 Software Version 2.8.1 interface route redistribution definition to the OSPF configuration, using the command: add ospf redistribute protocol=interface [other-options...] Use a routemap to control which interface routes are imported. Command Changes The following table summarises the modified commands: Command add ospf redistribute delete ospf redistribute disable ospf debug enable ospf debug...
Page 94: Command Reference Updates
Open Shortest Path First Enhancements Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, the new parameters, options, and fields are shown in bold. add ospf area Syntax ADD OSPF AREa={BAckbone|area-number} [AUthentication={NONE|PASSword|MD5}]...
Page 95 Software Version 2.8.1 add ospf interface Syntax ADD OSPF INTerface=interface AREa={BAckbone|area-number} [AUthentication={AREadefault|NONE|PASSword|MD5}] [BOOST1=0..1023] [DEadinterval=2..2147483647] [DEMand={ON|OFF|YES|NO|True|False}] [HEllointerval=1..65535] [NETwork={BROadcast|NON-broadcast}] [PASSIve={ON|OFF|YES|NO|True|False}] [PASSword={NONE|password}] [POLLInterval=1..2147483647] [PRIOrity=0..255] [RXmtinterval=1..3600] [TRansitdelay=1..3600] [VIrtuallink=router-id] Description The password parameter specifies the password used for authentication. A password is required if the authentication scheme for the area has been set to password by using the add ospf area or the set ospf area commands.
Page 96 Open Shortest Path First Enhancements Adding a BGP, RIP, or static route redistribution definition will change the setting of the bgpimport, rip, and staticexport parameters of the command on page parameter of the route redistribution definition. delete ospf redistribute Syntax DELete OSPF REDistribute PROTocol={BGP|INTerface|RIP|STAtic} Description...
Page 97 Software Version 2.8.1 debugging is set with the detail parameter, but the output always contains the direction of the packet, the type of packet, the version of OSPF, the packet’s source and destination, the router ID, area, length, checksum and authentication type.
Page 98 Open Shortest Path First Enhancements set ospf area Syntax SET OSPF AREa={BAckbone|area-number} [AUthentication={NONE|PASSword|MD5}] [NSSAStability=1..3600] [NSSATranslator={CANdidate|ALWays}] [STUBArea={ON|OFF|YES|NO|NSSA|True|False}] [STUBMetric=0..16777215] [SUMmary={SENd|NONE|OFF|NO|FALSE}] where area-number is a four-byte OSPF area number in dotted decimal notation Description The new nssatranslator parameter sets the NSSA translator role when the router or switch is acting as an NSSA border router.
Page 99 Software Version 2.8.1 set ospf redistribute Syntax SET OSPF REDistribute PROTocol={BGP|INTerface|RIP|STAtic} [LIMit=1..4000] [METric={0..16777214|ORiginal}] [ROUTEMap={routemap|NONE}] [SUBNET={ON|OFF|YES|NO|True|False}] [TAG={1..65535|ORiginal}] [TYpe={1|2|ORiginal}] where routemap is the name of an IP route map Description The modified protocol parameter specifies the type of route to redistribute. Specify bgp or rip to redistribute routes derived from BGP or RIP, respectively. Specify interface to redistribute non-OSPF interface routes.
Page 100: Show Ospf Area
Open Shortest Path First Enhancements show ospf area Syntax SHow OSPF AREa[={BAckbone|area-number}] [{FULl|SUMmary}] where area-number is a 4-byte OSPF area number in dotted decimal notation Description The output of this command includes new fields. Figure 27: Example output from the show ospf area command for a specific area Area 0.0.0.1: Table 25: New parameters in output of the show ospf area command for a specific area Parameter...
Page 101 Software Version 2.8.1 show ospf redistribute Syntax SHow OSPF REDistribute Description The output of this command includes new and modified fields. Figure 28: Example output from the show ospf redistribute command OSPF Redistribute Protocol Metric RouteMap -------------------------------------------------------------------------------- Static Interface Original rmi Table 26: New and modified parameters in the output of the show ospf redistribute command Parameter...
Page 102: Bgp Backoff Lower Threshold
BGP Enhancements BGP Enhancements In Software Release 2.8.1, the following enhancements have been added to Border Gateway Protocol functionality: ■ BGP Backoff Lower Threshold ■ BGP Peer and Peer Template Enhancements ■ Displaying Routes Learned from a Specific BGP Peer This section describes the enhancements.
Page 103: Bgp Peer And Peer Template Enhancements
Software Version 2.8.1 Enable and Disable Backoff BGP backoff can now be enabled or disabled using the commands enable bgp backoff and disable bgp backoff. BGP backoff is disabled by default, however it automatically enables the first time a peer is added. Command Changes The following table summarises the new and modified commands: Command...
Page 104: Displaying Routes Learned From A Specific Bgp Peer
BGP Enhancements Command Changes The following table summarises the modified commands: Command add bgp peer add bgp peertemplate set bgp peer set bgp peertemplate Displaying Routes Learned from a Specific BGP Peer This enhancement enables you to display: ■ the number of routes learned from a specific peer ■...
Page 105: Command Reference Updates
Software Version 2.8.1 Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, the new parameters, options, and fields are shown in bold. add bgp peer Syntax ADD BGP PEer=ipadd REMoteas=1 [AUthentication={MD5|NONE}] [CLIEnt={NO|YES}]...
Page 106 BGP Enhancements add bgp peertemplate Syntax ADD BGP PEERTemplate=1..30 [CLIEnt={NO|YES}] [CONnectretry={DEFault|0..4294967295}] [DESCription={NONE|description}] [HOLdtime={DEFault|0|3..65535}] [INFilter={NONE|prefixlist-name}] [INPathfilter={NONE|1..99}] [INRoutemap={NONE|routemap}] [KEEpalive={DEFault|1..21845}] [LOCal={NONE|1..15}] [MAXPREFIX={OFF|1..4294967295}] [MAXPREFIXAction={Terminate|Warning}] [MINAsoriginated={DEFault|0..3600}] [MINRouteadvert={DEFault|0..3600}] [NEXthopself={NO|YES}] [OUTFilter={NONE|prefixlist-name}] [OUTPathfilter={NONE|1..99}] [OUTRoutemap={NONE|routemap}] [PRIVateasfilter={NO|YES}] [SENdcommunity={NO|YES}] Parameter DESCription INRoutemap OUTRoutemap disable bgp backoff Syntax DISable BGP BACkoff Description This new command stops BGP backoff.
Page 107 Software Version 2.8.1 enable bgp backoff Syntax ENAble BGP BACkoff Description This new command allows BGP backoff. BGP backoff delays BGP processing when the system memory utilisation is high. BGP backoff is disabled by default, however it automatically enables the first time a peer is added.
Page 108 BGP Enhancements set bgp peer Syntax SET BGP PEer=ipadd [AUthentication={MD5|NONE}] [CLIEnt={NO|YES}] [CONnectretry={DEFault|0 [DEFaultoriginate={NO|YES}] [DESCription={NONE|description}] [EHOps={DEFault|1 [HOLdtime={DEFault|0|3 [INFilter={NONE|prefixlist-name}] [INPathfilter={NONE|1 [INRoutemap={NONE|routemap}] [KEEpalive={DEFault|1 [MAXPREFIX={OFF|1 [MAXPREFIXAction={Terminate|Warning}] [MINAsoriginated={DEFault|0 [MINRouteadvert={DEFault|0 [NEXthopself={NO|YES}] [OUTFilter={NONE|prefixlist-name}] [OUTPathfilter={NONE|1 [OUTRoutemap={NONE|routemap}] [PASSword=password] [PRIVateasfilter={NO|YES}] [REMoteas=1 [SENdcommunity={NO|YES}] SET BGP PEer=ipadd [POLICYTemplate=1..30] [AUthentication={MD5|NONE}] [DEFaultoriginate={NO|YES}] [DESCription={NONE|description}] [EHOps={DEFault|1 [PASSword=password] [REMoteas=1 Parameter DESCription...
Page 109 Software Version 2.8.1 set bgp peertemplate Syntax SET BGP PEERTemplate=1..30 [CLIEnt={NO|YES}] [CONnectretry={DEFault|0..4294967295}] [DESCription={NONE|description}] [HOLdtime={DEFault|0|3..65535}] [INFilter={NONE|prefixlist-name}] [INPathfilter={NONE|1..99}] [INRoutemap={NONE|routemap}] [KEEpalive={DEFault|1..21845}] [LOCal={NONE|1..15}] [MAXPREFIX={OFF|1..4294967295}] [MAXPREFIXAction={Terminate|Warning}] [MINAsoriginated={DEFault|0..3600}] [MINRouteadvert={DEFault|0..3600}] [NEXthopself={NO|YES}] [OUTFilter={NONE|prefixlist-name}] [OUTPathfilter={NONE|1..99}] [OUTRoutemap={NONE|routemap}] [PRIVateasfilter={NO|YES}] [SENdcommunity={NO|YES}] Parameter DESCription INRoutemap OUTRoutemap Software Version 2.8.1 C613-10477-00 REV B Description A description for the peers that use the template, which has no effect on their operation.
Page 110 BGP Enhancements show bgp backoff Syntax SHow BGP BACkoff Figure 29: Example output of the modified show bgp backoff command BGP Backoff Stats: Stat ---------------------------------- state total hist backOffs total backOffs total backOff Limit consecutive backOffs consecutive backOffs limit base Timeout Timeout multiplier Timeout step Timeout length (sec)
Page 111 Software Version 2.8.1 show bgp peer Syntax SHow BGP PEer[=ipadd] Description When you specify a peer, the output of this command includes a new field. Figure 30: Example output of the show bgp peer command for a specific peer Peer ... 192.168.10.1 Description ...
Page 112: Mld And Mld Snooping Enhancements
MLD and MLD Snooping Enhancements MLD and MLD Snooping Enhancements This Software Version includes the following enhancements to MLD and MLD Snooping, in accordance with RFC 3810, Multicast Listener Discovery Version 2 (MLDv2) for IPv6: ■ MLD Packet Formats ■ ICMP type for MLDv2 Reports ■...
Page 113: Change Of Maximum Query Response Interval For Mld
Software Version 2.8.1 MLD Snooping Group Membership Display The command show mldsnooping no longer displays the port members of the All Routers group in the list of ports for groups other than the All Routers group. This change makes the output of this command more like output from the command show igmpsnooping.
Page 114: Command Reference Updates
The new v2draftcompat parameter determines the ICMP type of MLDv2 reports. If you specify yes, the interface can process MLDv2 reports that have an ICMP type of 255. This is compatible with early Allied Telesis implementations of MLD. If you specify no, the interface can only process MLD Report messages that have an ICMP type of 143, as specified by RFC 3810.
Page 115: Show Mldsnooping
Software Version 2.8.1 show ipv6 mld Syntax SHow IPV6 MLD INTerface=interface Description The output of this command includes a new field. Figure 31: Example output from the show ipv6 mld command MLD Protocol -------------------------------------------------------------------------------- Status ... ENABLED Robustness ... 2 Query Interval ...
Page 116 MLD and MLD Snooping Enhancements Figure 32: Previous example output from the show mldsnooping command Interface: vlan300 (vlan300) ------------------------------------------------------------------------------ Multicast Address ... All Routers Ports ... 9 Multicast Address ... ff01:1:0::0101 Ports ... 1, 2, 9 Figure 33: New example output from the show mldsnooping command Interface: vlan300 (vlan300) ------------------------------------------------------------------------------ Multicast Address ...
Page 117: Extension To Range Of Classifier Fields For X900 Switches
Software Version 2.8.1 Extension to Range of Classifier fields for x900 Switches This Software Version introduces the ability to match on more fields of an IPv4 packet. A number of new parameters have been added to Classifier commands to allow this. Command Changes The following table summarises the modified commands: Command...
Page 118: Create Classifier
Extension to Range of Classifier fields for x900 Switches create classifier Syntax CREate CLASSifier=rule-id [other-options] [MACSMask=macadd][MACDMask=macadd] [TCPFlags={{Urg|Ack|Rst|Syn|Fin}[,...]|ANY}] [ICmptype={Any|ECHORply|Unreachable|Quench|Redirect| ECHO|ADvertisement|Solicitation|TImeexceed|Parameter| TSTAMP|TSTAMPRply|INFOREQ|INFOREP|ADDRREQ|ADDRREP| NAMEREq|NAMERPly|icmp-type}] [ICMPCode={Any|FIlter|FRAGMent|FRAGReassm|HOSTComm| HOSTIsolated|HOSTPrec|HOSTREdirect|HOSTRTos|HOSTTos| HOSTUNKnown|HOSTUNReach|NETComm|NETREdirect|NETRTos| NETTos|NETUNKnown|NETUNReach|NOptr|POrtunreach| PREcedent|PROtunreach|PTrproblem|Sourceroute|Ttl| icmp-code}] [IGmptype={ANY|QUery|V1Report|DVmrp|PIMv1|CTRace| V2Report|V2Leave|MCTRACEResponse|MCTRACE|V3Report| MRAdvert|MRSolicit|MRTermination|igmp-type}] [EIPBYTE01=byteoffset,bytevalue[,bytemask]] [EIPBYTE02=byteoffset,bytevalue[,bytemask]] [EIPBYTE03=byteoffset,bytevalue[,bytemask]] [EIPBYTE04=byteoffset,bytevalue[,bytemask]] [EIPBYTE05=byteoffset,bytevalue[,bytemask]] [EIPBYTE06=byteoffset,bytevalue[,bytemask]] [EIPBYTE07=byteoffset,bytevalue[,bytemask]] [EIPBYTE08=byteoffset,bytevalue[,bytemask]] [EIPBYTE09=byteoffset,bytevalue[,bytemask]] [EIPBYTE10=byteoffset,bytevalue[,bytemask]] [EIPBYTE11=byteoffset,bytevalue[,bytemask]] [EIPBYTE12=byteoffset,bytevalue[,bytemask]] [EIPBYTE13=byteoffset,bytevalue[,bytemask]]...
Page 119 Software Version 2.8.1 The tcpflags parameter specifies the TCP flags of an IPv4 or IPv6 packet, one or more of urg, ack, rst, syn and fin. If any is specified, TCP flags are ignored. The default is any. The icmptype parameter specifies the ICMP type of an IPv4 packet. This can be one of the list of available options, or a decimal value in the range 0 to 255.
Page 120 Extension to Range of Classifier fields for x900 Switches set classifier Syntax SET CLASSifier=rule-id [other-options] [MACSMask=macadd][MACDMask=macadd] [TCPFlags={{Urg|Ack|Rst|Syn|Fin}[,...]|ANY}] [ICmptype={Any|ECHORply|Unreachable|Quench|Redirect| ECHO|ADvertisement|Solicitation|TImeexceed|Parameter| TSTAMP|TSTAMPRply|INFOREQ|INFOREP|ADDRREQ|ADDRREP| NAMEREq|NAMERPly|icmp-type}] [ICMPCode={Any|FIlter|FRAGMent|FRAGReassm|HOSTComm| HOSTIsolated|HOSTPrec|HOSTREdirect|HOSTRTos|HOSTTos| HOSTUNKnown|HOSTUNReach|NETComm|NETREdirect|NETRTos| NETTos|NETUNKnown|NETUNReach|NOptr|POrtunreach| PREcedent|PROtunreach|PTrproblem|Sourceroute|Ttl| icmp-code}] [IGmptype={ANY|QUery|V1Report|DVmrp|PIMv1|CTRace| V2Report|V2Leave|MCTRACEResponse|MCTRACE|V3Report| MRAdvert|MRSolicit|MRTermination|igmp-type}] [EIPBYTE01=byteoffset,bytevalue[,bytemask]] [EIPBYTE02=byteoffset,bytevalue[,bytemask]] [EIPBYTE03=byteoffset,bytevalue[,bytemask]] [EIPBYTE04=byteoffset,bytevalue[,bytemask]] [EIPBYTE05=byteoffset,bytevalue[,bytemask]] [EIPBYTE06=byteoffset,bytevalue[,bytemask]] [EIPBYTE07=byteoffset,bytevalue[,bytemask]] [EIPBYTE08=byteoffset,bytevalue[,bytemask]] [EIPBYTE09=byteoffset,bytevalue[,bytemask]] [EIPBYTE10=byteoffset,bytevalue[,bytemask]] [EIPBYTE11=byteoffset,bytevalue[,bytemask]] [EIPBYTE12=byteoffset,bytevalue[,bytemask]] [EIPBYTE13=byteoffset,bytevalue[,bytemask]]...
Page 121: Show Classifier
Software Version 2.8.1 show classifier Syntax SHow CLASSifier=rule-id [other-options] [MACSMask=macadd][MACDMask=macadd] [TCPFlags={{Urg|Ack|Rst|Syn|Fin}[,...]|ANY}] [ICmptype={Any|ECHORply|Unreachable|Quench|Redirect| ECHO|ADvertisement|Solicitation|TImeexceed|Parameter| TSTAMP|TSTAMPRply|INFOREQ|INFOREP|ADDRREQ|ADDRREP| NAMEREq|NAMERPly|icmp-type}] [ICMPCode={Any|FIlter|FRAGMent|FRAGReassm|HOSTComm| HOSTIsolated|HOSTPrec|HOSTREdirect|HOSTRTos|HOSTTos| HOSTUNKnown|HOSTUNReach|NETComm|NETREdirect|NETRTos| NETTos|NETUNKnown|NETUNReach|NOptr|POrtunreach| PREcedent|PROtunreach|PTrproblem|Sourceroute|Ttl| icmp-code}] [IGmptype={ANY|QUery|V1Report|DVmrp|PIMv1|CTRace| V2Report|V2Leave|MCTRACEResponse|MCTRACE|V3Report| MRAdvert|MRSolicit|MRTermination|igmp-type}] [EIPBYTE01=byteoffset,bytevalue[,bytemask]] [EIPBYTE02=byteoffset,bytevalue[,bytemask]] [EIPBYTE03=byteoffset,bytevalue[,bytemask]] [EIPBYTE04=byteoffset,bytevalue[,bytemask]] [EIPBYTE05=byteoffset,bytevalue[,bytemask]] [EIPBYTE06=byteoffset,bytevalue[,bytemask]] [EIPBYTE07=byteoffset,bytevalue[,bytemask]] [EIPBYTE08=byteoffset,bytevalue[,bytemask]] [EIPBYTE09=byteoffset,bytevalue[,bytemask]] [EIPBYTE10=byteoffset,bytevalue[,bytemask]] [EIPBYTE11=byteoffset,bytevalue[,bytemask]] [EIPBYTE12=byteoffset,bytevalue[,bytemask]] [EIPBYTE13=byteoffset,bytevalue[,bytemask]] [EIPBYTE14=byteoffset,bytevalue[,bytemask]] [EIPBYTE15=byteoffset,bytevalue[,bytemask]] [EIPBYTE16=byteoffset,bytevalue[,bytemask]] where: ■...
Page 122 Extension to Range of Classifier fields for x900 Switches Figure 34: Example output from the show classifier command (TCP/IP data flow) Classifier Rules ------------------------------------------------------------ Rule ... 1 ------------------------------------------------------------ Figure 35: Example output from the show classifier command (ICMP data flow) Classifier Rules ------------------------------------------------------------ Rule ...
Page 123 Software Version 2.8.1 Figure 37: Example output from the show classifier command (Layer 3 byte data) Classifier Rules ------------------------------------------------------------ Rule ... 2222 ------------------------------------------------------------ Figure 38: Example output from the show classifier command (MAC address) Classifier Rules ------------------------------------------------------------ Rule ... 2222 ------------------------------------------------------------ Table 30: New parameters in output of the show classifier command Parameter...
Page 124 Extension to Range of Classifier fields for x900 Switches Table 30: New parameters in output of the show classifier command (cont.) Parameter IGMP Type TCP Flags Layer 3 Byte 01 to Layer 3 Byte Meaning The IGMP message type to match against the IGMP type field in an IGMP packet header.
Page 125: Qos Enhancements
Software Version 2.8.1 QoS Enhancements This Software Version includes the following enhancements to Quality of Service: ■ Port Groups ■ Storm protection This section describes the enhancements. The new and modified commands to implement them are described in Port Groups This enhancement introduces eight new commands and modifies two existing show commands for the AT-8948, x900-48, and AT-9900 switches.
Page 126: Storm Protection
QoS Enhancements To enable QoS counters, use the command: set switch enhancedmode=qoscounters To reset traffic class counters for a port group, use the command: reset qos portgroup counters To display information about port groups, use the commands: show qos portgroup show qos portgroup counters show qos port Command Changes...
Page 127 Software Version 2.8.1 The following table explains the basic concepts involved with storm protection. Concept Window Rate Action Timeout Command Changes The following table summarises the modified commands: Command create qos policy set qos policy show qos policy create qos trafficclass set qos trafficclass show qos trafficclass Software Version 2.8.1...
Page 128: Command Reference Updates
QoS Enhancements Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, the new parameters, options, and fields are shown in bold. add qos portgroup port Syntax ADD QOS PORTGroup=group-list POrt=port-list Description...
Page 129 Software Version 2.8.1 Parameter DTCSTORMStatus DTCSTORMWindow DTCSTORMRate DTCSTORMAction DTCSTORMTimeout Example The following command enables storm protection as follows: ■ creates QoS Policy 1 with a description of stormprotection ■ enables storm protection on the policy ■ checks traffic every 200 milliseconds ■...
Page 130 QoS Enhancements create qos portgroup Syntax CREate QOS PORTGroup=group-list [POrt=port-list] [DESCription=description] Description This new command creates a port group so that a policy can be attached to it. A switch instance refers to a single switch chip; port groups cannot span multiple switch instances Parameter PORTgroup...
Page 131 Software Version 2.8.1 Parameter (cont.) STORMRate STORMAction STORMTimeout Example The following command enables storm protection as follows: ■ creates QoS traffic class 1 with a description of stormprotection ■ enables storm protection on the traffic class ■ checks traffic every 200 milliseconds ■...
Page 132 QoS Enhancements delete qos portgroup port Syntax DELete QOS PORTGroup=group-id POrt={port-list|ALL} Description This new command deletes specific ports from a port group, or all ports belonging to a port group. Parameter PORTgroup POrt Example To delete all ports from the port group 1, use the command: del qos portg=1 po=all destroy qos portgroup Syntax...
Page 133 Software Version 2.8.1 reset qos portgroup counters Syntax RESET QOS PORTGroup=group-list COUnters TRafficlass[={trafficclass-list|DEFault|ALL}] Description This new command resets traffic class counters for a port group. Use the set switch enhancedmode command in the Switching chapter to set counters Parameter PORTgroup TRafficclass Example To reset all traffic classes configured on port groups 1, 2, 3, 4, use the command:...
Page 134 QoS Enhancements Parameter DTCSTORMStatus DTCSTORMWindow DTCSTORMRate DTCSTORMAction DTCSTORMTimeout set qos portgroup Syntax SET QOS PORTGroup=group-list [POLIcy={policy-list|NONE}] [DESCription=description] Description This new command attaches a policy to a port group, or removes the current policy Parameter PORTgroup Description Whether storm protection is enabled for the default traffic class. Default: disabled Time between the polling of traffic class counters that checks whether storm protection should be activated.
Page 135 Software Version 2.8.1 Parameter (cont.) Description (cont.) POLIcy DESCription Example To assign policy 2 to port group 1, and name the port group “uplink”, use the command: set qos portg=1 poli=2 desc=uplink set qos trafficclass Syntax set qos trafficclass=trafficclass-list [stormstatus={enable|disable}] [stormwindow={windowsize|none}][stormrate={rate|none}] [stormaction={linkdown|portdisable|vlandisable}] [stormtimeout={timeoutlength|none}]...
Page 136 QoS Enhancements Parameter (cont.) STORMAction STORMTimeout Table 31: Parameters in output of the show qos trafficclass=18 command Parameter Status Action Rate Window Timeout show qos policy Syntax SHow QOS POLIcy[={id|ALL}] This command displays information about QoS policies and now includes information about port groups assigned to them.
Page 137: Show Qos Port
Software Version 2.8.1 Figure 39: Example output of the modified show qos policy command Identifier ... 1 Description ... all ports TCs Assigned ... 5,7,22,31-33 Port(s) Assigned to ... 1-24 Port Group(s) Assigned to ... 1(1-12) Trunk(s) Assigned to ... None Default Traffic Class: Table 32: New parameters in output of the show qos policy command Parameter...
Page 138 QoS Enhancements Example output from the show qos port=1 command QOS Port Configuration Port ... 1 Port Group ... 1 Trunk Group ... None Policy Assigned ... 1(all ports) Default Queue ... 2 Force Default Queue ... No Red Curve ... 2 New parameters in output of the show qos port=1 command Parameter Port Group...
Page 139 Software Version 2.8.1 Table 33: Parameters in output of the show qos portgroup command Parameter ID/Identifier Description Policy Assigned/Policy Assigned to Ports Example To display all configured port groups, use the command: sh qos portg=all show qos portgroup counters Syntax SHow QOS PORTGroup[={group-list|ALL}] COUnters TRafficclass[={trafficclass-list|DEFault|ALL}] Description...
Page 140 QoS Enhancements Figure 42: Example output from the show qos portgroup counters trafficclass command QOS Counter Information Port Group 1: Port Group 2: Policy: 1 Traffic Class 1: Aggregate Bytes ... BwConformanceClass1 bytes ... BwConformanceClass2 bytes ... BwConformanceClass3 bytes ... Dropped bytes ...
Page 141 Software Version 2.8.1 Table 34: Parameters in output of the show qos portgroup counters trafficclass command Parameter Port Group Policy Traffic Class Aggregate Bytes BwConformanceClass1 bytes BwConformanceClass2 bytes BwConformanceClass3 bytes Dropped bytes Example To display all configured port groups, use the command: sh qos portg=all show qos trafficclass Syntax...
Page 142: Configuring Secure Copy
Secure Copy (SCP) Secure Copy (SCP) This Software Version includes the additional method of Secure Copy (SCP) to load files to and from the router or switch. This section describes the enhancement in: ■ Configuring Secure Copy ■ Loading using Secure Copy ■...
Page 143: Configuring Users
Software Version 2.8.1 Configuring Users To copy files using SCP, you must be configured as a SSH user. Use the command: add ssh user=username {password=password|keyid=id} Further details on configuring and managing SSH users can be found in the Secure Shell chapter of the Software Reference. SSH users must use either password authentication, or RSA public/private key authentication.
Page 144: Loading Using Secure Copy
Secure Copy (SCP) Debugging Secure Information which may be useful for troubleshooting SSH and SCP Shell and Secure connections is now available using the SSH debugging function. By default this is disabled. To enable debugging, use the command: Copy enable ssh debug[={ssh|scp|all}] To disable debugging, use the command: disable ssh debug[={ssh|scp|all}] Command Changes...
Page 145: Uploading Using Secure Copy
Software Version 2.8.1 To load a file onto the router or switch, use the command: load method=scp [delay=delay] [destfile=destfilename] Examples In this example, the SCP server has an IP address of 192.168.1.2, with the username “john”, and the password “secret” set on it. To download the file /atr-281/86s-281.rez from the server, use this command on the router or switch: load method=scp username=john password=secret...
Page 146 Secure Copy (SCP) To upload a file from the router or switch, use the command: upload method=scp [file=filename] [destfile=destfilename] Examples In this example, the SCP server has an IP address of 192.168.1.2, with the username “john”, and the password “secret” set on it. To upload the file voip.cfg to the server, use this command on the router or switch: upload method=scp server=192.168.1.2 username=john If desired, set the loader with defaults to make the process of uploading files...
Page 147: Command Reference Updates
Software Version 2.8.1 Command Reference Updates This section describes each new command and the changed portions of modified commands and output screens. For modified commands and output, it shows the new parameters, options, and fields in bold. delete ssh session syntax DELete SSH SEssion={session-id|ALL} Description...
Page 148: Enable Ssh Server
Secure Copy (SCP) enable ssh debug Syntax ENAble SSH DEBug={SSH|SCP|ALL} Description This new command enables the SSH server debugging facility. If ssh is specified, debugging is turned on for Secure Shell. If scp is specified, debugging is turned on for Secure Copy. If all is specified, debugging for both SSH and SCP is turned on.
Page 149 Software Version 2.8.1 load Syntax LOAd [METhod=SCP] [DELay=delay] [DESTFile=destfilename] [DEStination={CFlash|FLash|NVs}] [{FIle|SRCFile}=filename] [{KEYid=key-id|PASSword=password}] [SErver={hostname|ipadd|ipv6add}] [USERName=username] Description The new method=scp option allows you to download a file using Secure Copy. Parameter METhod KEYid PASSword Example In this example, the router or switch is downloading the file abc.cfg from a SCP server with the IP address 172.16.8.5.
Page 150 Secure Copy (SCP) set loader Syntax SET LOAder [ASYn={port|DEFault}] [ATTribute={CErt|CRl|CAcert|DEFault}] [BASeobject={dist-name|DEFault}] [DElay={delay|DEFault}] [DESTFile=destfilename] [DEStination={BOOTblock|CFLASH|FLash|NVs}] [HTTPproxy={hostname|ipadd|DEFault}] [METhod={HTTP|LDAP|SCP|TFtp|WEB|WWW|ZModem|NONE| DEFault}] [{KEYid=key-id|PASSword=password|DEFault}] [PROxyport={1..65535|DEFault}] [SRCFile|FIle=filename] [SErver={hostname|ipadd|ipv6add|DEFault}] [SERVPort={1..65535|DEFault}] [USERName=username] Description This command sets defaults for the load and upload commands. All values that can be specified with the load and upload commands can be specified as defaults with the set loader command.
Page 151: Set Ssh Client
Software Version 2.8.1 set ssh client Syntax SET SSH CLIent [IDLEtimeout=0..4294967295] [LOGintimeout=1..600] [PREservemtime={ENAbled|DISabled}] Description This new command modifies the configuration of the Secure Shell client. When the router or switch is in security mode, this command requires a user with Security Officer privilege.
Page 152: Set Ssh Server
Secure Copy (SCP) set ssh server Syntax SET SSH SERver [HOSTKey=key-id] [SERVERKey=key-id] [EXPirytime=0..168] [IDLEtimeout=0..4294967295] [LOGintimeout=1..600] [MAXSessions=0..6] [SCP={ENAbled|DISabled}] Description This command modifies the configuration of the Secure Shell server. The new scp parameter allows you to enable or disable Secure Copy service. Parameter show loader Syntax...
Page 153: Show Ssh
Software Version 2.8.1 show ssh Syntax SHow SSH Description This command displays the current configuration of the Secure Shell client and server. Figure 46: Example output from the show ssh command Secure Shell Server Configuration ------------------------------------------------------- Version... 1.5 SSH Server... Enabled SCP Service...
Page 154 Secure Copy (SCP) show ssh counter Syntax SHow SSH COUnter[={ALL|SSH|SCP}] Description This command displays client and server counters for Secure Shell and Secure Copy. If all is specified, both the SSH and the SCP client and server counters are displayed. If ssh is specified, the SSH counters display without the SCP counters.
Page 155 Software Version 2.8.1 Table 37: Modified parameters in output of the show ssh counter={scp|all} command Parameter writeFileFailed Example To display the SCP counters only, use the command: sh ssh cou=scp show ssh session Syntax SHow SSH SEssion[={ALL|SSH|SCP}] Description This command displays the status of Secure Shell and Secure Copy sessions currently active on the router or switch, including both outbound sessions to another host and inbound sessions into the router or switch.
Page 156 Secure Copy (SCP) Table 38: Modified parameters in output of the show ssh session=ssh command Parameter Secure Shell Session Type Table 39: Example output from the show ssh session=scp command SCP Sessions: --------------------------------------------------------- Table 40: Modified parameters in output of the show ssh session=scp command Parameter Type Operation...
Page 157 Software Version 2.8.1 upload Syntax UPLoad [METhod=SCP] [DESTFile=destfilename] [FIle=filename] [{KEYid=key-id|PASSword=password}] [SErver={hostname|ipadd|ipv6add}] [USERName=username] Description The new scp parameter allows you to upload a file using Secure Copy. Parameter METhod KEYid PASSword USERName Example To upload the file debug.txt to a SCP server with the IP address 172.16.8.5, use the command: upl met=scp fi=debug.txt destf=/tmp/debug.txt se=172.16.8.5 Software Version 2.8.1...
Page 158: Command Reference Updates
SSL Counter Enhancement SSL Counter Enhancement New counters have been added to the show ssl counters command. Command Changes The following table summarises the modified command: Command show ssl counters Command Reference Updates This section describes the changed portions of the modified command and output screens.
Page 159 Software Version 2.8.1 Figure 50: Example output from the show ssl counters command Server: serverStart ... 2 inClientHello ... 0 inSSLv2ClientHello ... 2 inCert ... 0 inClientKeyExchange ... 1 inCertVerify ... 0 inFinished ... 1 resumeRequest ... 0 cacheMiss ... 0 noCipherMatch ...
Page 160: Disabling Sip Alg Call Id Translation
Firewall Enhancements Firewall Enhancements This Software Version includes the following enhancements to the Firewall: ■ Firewall Licencing ■ Disabling SIP ALG Call ID Translation ■ Displaying SIP ALG Session Details ■ Firewall Policy Rules Expansion ■ Displaying a Subset of Policy Rules This section describes the enhancements.
Page 161: Displaying Sip Alg Session Details
Software Version 2.8.1 Command Changes The following table summarises the new and modified commands: Command set firewall sipalg Displaying SIP ALG Session Details This Software Version allows you to display configuration details for the SIP ALG, and details about the SIP sessions that are using the SIP ALG on the router or switch.
Page 162: Displaying A Subset Of Policy Rules
Firewall Enhancements Displaying a Subset of Policy Rules This Software Version allows you to display only a specific rule, or a subset of rules, when displaying details about firewall policies. Use the new rule parameter in the command: show firewall policy[=policy-name] [counter] Command Changes The following table summarises the new and modified commands: Command...
Page 163: Show Firewall Policy
Software Version 2.8.1 show firewall SHow FIREwall Description This command displays a summary of all security policies that have been created and the interfaces assigned to each policy. Figure 51: Example output from the show firewall command Firewall Configuration Status ... enabled Enabled Notify Options ...
Page 164 Firewall Enhancements show firewall sipalg Syntax SHow FIREwall SIPAlg [IP=ipadd[-ipadd]]| [CALLId=call-id]]|[SUMmary] Description This command displays summary or detailed information for active SIP sessions using the SIP ALG on the router or switch Table 43 on page Parameter CALLId SUMmary Figure 52: Example output from the show firewall sipalg command SIP ALG Configuration Status ...
Page 165 Software Version 2.8.1 Table 43: Parameters in output of the show firewall sipalg command Parameter SIP ALG Configuration Status CALL-ID translation Active SIP Sessions CALL-ID TO tag FROM FROM tag Direction Audio Session RTCP Remote IP Software Version 2.8.1 C613-10477-00 REV B Meaning The current SIP ALG settings on the router or switch.
Page 166 Firewall Enhancements Table 43: Parameters in output of the show firewall sipalg command (cont.) Parameter Gbl IP Gbl Remote IP Start time Seconds to deletion Figure 53: Example output from the show firewall sipalg summary command SIP ALG Configuration Status ... Enabled Call-ID translation ...
Page 167 Software Version 2.8.1 Table 44: Parameters in output of the show firewall sipalg summary command (cont.) Parameter Direction From Examples To display any SIP sessions using the SIP ALG within the IP range 192.168.1.2 to 192.168.1.8, use the command: show fire sipa ip=192.168.1.2-192.168.1.8 show firewall sipalg counter Syntax SHow FIREwall SIPAlg COUnter...
Page 168 Firewall Enhancements Table 45: Parameters in output of the show firewall sipalg counter command (cont.) Parameter SIP messages ignored since start up or reset Example To display counters for the SIP ALG’s activity on the router or switch, use the command: show fire sipa cou Meaning...
Page 169: Responding To Ipsec Packets From An Unknown Tunnel
Software Version 2.8.1 Enhancements to IPsec/VPN This Software Version includes enhancements in the following IPsec functions: ■ Responding to IPsec Packets from an Unknown Tunnel ■ Modifying the Message Retransmission Delay ■ Retrying ISAKMP Phase 1 and 2 Negotiations ■ VPN Tunnel Licencing This section describes the enhancements.
Page 170: Modifying The Message Retransmission Delay
Enhancements to IPsec/VPN This feature provides an alternative to using heartbeat exchanges. Heartbeat exchanges are more robust under denial of service attacks, and may be able to detect the problem before any network traffic is lost; however heartbeat exchanges may be incompatible with some third party equipment. Command Changes The following table summarises the modified commands: Command...
Page 171: Retrying Isakmp Phase 1 And 2 Negotiations
Software Version 2.8.1 Further retransmission have a progressively larger delay. The gap between the second and third retransmissions is 16 seconds, the gap between the third and fourth retransmissions is 24 seconds, the next gap is 32 seconds, then 40, 48 and 56 seconds after each retransmission attempt. After the eighth retransmission, the exchange times out.
Page 172: Vpn Tunnel Licencing
Enhancements to IPsec/VPN ISAKMP will not reattempt XAUTH authentication failures (phase 1.5). XAUTH failures indicate that either the router or switch and its peer have different authentication details, or a third party is attempting to connect to the router or switch. This needs to be investigated manually. Command Changes The following table summarises the modified commands: Command...
Page 173: Command Reference Updates
Software Version 2.8.1 Command Reference Updates This section describes the changed portions of modified commands and output screens. For modified commands and output, the new parameters, options, and fields are shown in bold. create ipsec policy Syntax CREate IPSec POLicy=name INTerface=interface ACtion={DEny|IPsec|PErmit} [IPVersion={4|6}] [BUNDlespecification=bundlespecification-id] [DFBit={SEt|COpy|CLear}] [GROup={0|1|2}]...
Page 174 Enhancements to IPsec/VPN create isakmp policy Syntax CREate ISAkmp POLICY=name PEer={ipv4add|ipv6add|ANy} [AUTHType={PREshared|RSAEncr|RSASig}] [DELETedelay=0..30] [DHExponentlength=160..1023] [ENCalg={3DES2key|3DESInner|3DESOuter|DES|AES128|AES192 |AES256}] [EXPIRYKbytes=1..1000] [EXPIRYSeconds=600..31449600] [GROup={0|1|2}] [HAShalg={SHa|MD5}] [HEARtbeatmode={Both|None|Receive|Send}] [HYBRIDxauth={ON|OFf|TRue|FAlse}] [IPVersion={4|6}] [KEY=0..65535] [LOCALID={ipv4add|ipv6add|domainname| user-domainname|dist-name}] [LOCALRsakey=0..65535] [MODe={MAIn|AGGressive}] [MSGBACkoff={INCREMental|NONE}] [MSGREtrylimit=0..1024] [MSGTImeout=1..86400] [NATTraversal={ON|OFf|TRue|FAlse}] [PHASE2xchglimit={NOne|1..1024}] [POLICYFilename=filename] [PREnegotiate={ON|OFf|TRue|FAlse}] [REMOTEId={ipv4add|ipv6add|domainname|user-domainname| dist-name}] [RETRYIKEattempts={0..16|CONTinuous}] [SENDDeletes={ON|OFf|TRue|FAlse}] [SENDNotify={ON|OFf|TRue|FAlse}] [SENDIdalways={ON|OFf|TRue|FAlse}] [SETCommitbit={ON|OFf|TRue|FAlse}] [SRCInterface=interface] [XAUth={CLient|SErver|NONE}]...
Page 175 Software Version 2.8.1 Parameter RETRYIKEattempts Software Version 2.8.1 C613-10477-00 REV B Description The number of consecutive attempts ISAKMP makes to establish a connection. This parameter should only be used for permanent VPNs. If an ISAKMP exchange fails, then ISAKMP will attempt the key exchange again.
Page 176 Enhancements to IPsec/VPN set ipsec policy Syntax SET IPSec POLIcy=name [ACtion={DEny|IPSec|PErmit}] [BUNDlespecification=bundlespecification-id] [DFBit={SEt|COpy|CLear}] [GROup={0|1|2}] [ICmptype={list|NDall}] [IPROUtetemplate=template-name] [IPVersion={4|6}] [ISAkmppolicy=isakmp-policy-name] [LADdress={ANy|ipv4add[-ipv4add]| ipv6add[/prefix-length]|ipv6add-ipv6add}] [LMAsk=ipv4add] [LNAme={ANy|system-name}] [LPort={ANy|OPaque|port}] [PEERaddress={ipv4add|ipv6add|ANy|DYNAMIC}] [PKTDebuglength=1..1500] [POSition=1..100] [RADdress={ANy|ipv4add[-ipv4add] |ipv6add[/prefix-length]|ipv6add-ipv6add}] [RESPondbadspi={True|False}] [RMASK=ipv4add] [RNAme={ANy|system-name}] [RPort={ANy|port|OPaque}] [SASElectorfrompkt={ALL|LADdress|LPort|NONE|RADdress| RPort|TRAnsportprotocol}] [SRCInterface=interface] [TRAnsportprotocol={ANy|EGp|ESp|GRe|ICmp|OPaque|OSpf| RSvp|TCp|UDp|protocol}] [UDPHeartbeat={True|False}] [UDPPort=port] [UDPTunnel={True|False}] [USEPFSKey={True|False}] Parameter RESPondbadspi...
Page 177 Software Version 2.8.1 set isakmp policy Syntax SET ISAkmp POLicy=name [PEer={ipv4add|ipv6add|ANy}] [AUTHType={PREshared|RSAEncr|RSASig}] [DELETedelay=10] [DHExponentlength=160..1023] [ENCalg={3DES2key|3DESInner|3DESOuter|DES|AES128| AES192|AES256}] [EXPIRYKbytes=1..1000] [EXPIRYSeconds=600..31449600] [GROup={0|1|2}] [HAShalg={SHa|MD5}] [HEARtbeatmode={Both|None|Receive|Send}] [HYBRIDxauth={ON|OFf|TRue|FAlse}] [IPVersion={4|6}] [KEY=0..65535] [LOCALID={ipv4add|ipv6add|domainname| user-domainname|dist-name}] [LOCALRsakey=0..65535] [MODe={MAIn|AGGressive}] [MSGBACkoff={INCREMental|NONE}] [MSGREtrylimit=0..1024] [MSGTImeout=1..86400] [NATTraversal={ON|OFf|TRue|FAlse}] [PHASE2xchglimit={NOne|1..1024}] [POLICYFilename=filename] [PREnegotiate={ON|OFf|TRue|FAlse}] [REMOTEId={ipv4add|ipv6add|domainname|user-domainname| dist-name}] [RETRYIKEattempts={0..16|CONTinuous}] [SENDDeletes={ON|OFf|TRue|FAlse}] [SENDIdalways={ON|OFf|TRue|FAlse}] [SENDNotify={ON|OFf|TRue|FAlse}] [SETCommitbit={ON|OFf|TRue|FAlse}] [SRCInterface=interface] [XAUth={CLient|SErver|NOne}]...
Page 178: Show Ipsec
Enhancements to IPsec/VPN Parameter RETRYIKEattempts show ipsec SHow IPSec Figure 55: Example output from the show ipsec command IPSEC Module Configuration Table 46: New parameters in output of the show ipsec command Parameter VPNs Maximum Current Peak Description The number of consecutive attempts ISAKMP makes to establish a connection.
Page 179: Show Ipsec Policy
Software Version 2.8.1 show ipsec policy Syntax SHow IPSec POLIcy[=name] Figure 56: Example output from the show ipsec policy command for a specific policy. IPsec Policy Information Name ... my_vpn Interface ... PPP0 Source Interface ... PPP0 Position ... 1 Action ...
Page 180 Enhancements to IPsec/VPN show ipsec policy counter Syntax SHow IPSec POLIcy[=name] COUnter Figure 57: Modified output for the show ipsec policy counter command. Inbound Packet Processing Counters: Table 48: Modified parameters from the show ipsec policy counter command Parameter inBadSpiResponse inDeny inCompUncompressed inBundleStateBad...
Page 181 Software Version 2.8.1 show isakmp counters Syntax SHow ISAkmp COUnters[={AGGressive|GENeral|HEArtbeat|INFo| IPSec|MAIn|NETwork|QUIck|SAD|SPD|TRAnsaction|XDB}] Figure 58: Example output from the show isakmp counter=general command ISAKMP General Counters Software Version 2.8.1 C613-10477-00 REV B acquire acquireNoPolicy acquireEquivFound acqPh1XcgStartFailed acquireQueued acquirePrenegNoPolicy badSpiRequests badSpiInAggrMode msgInitPh1p5StartFail doneGood doneSendConNoSa msgTx txEncryptNoExchange...
Page 182 Enhancements to IPsec/VPN Table 49: Modified parameters in output of the show isakmp counter=general command Parameter badSpiRequests badSpiFromKnownPeer badSpiInAggrMode badSpiSendNotifyUnset retryIkeAttemptsPh1 retryIkeAttemptsPh2 Figure 59: Example output from the show isakmp counter=spd command ISAKMP Policy Counters Table 50: Modified parameters in output of the show isakmp counter=spd command Parameter usePolIkeRetryGood UsePolIkeRetryFailed...
Page 183 Software Version 2.8.1 show isakmp exchange Syntax SHow ISAkmp EXChange[=exchange-id] Figure 60: Modified Example output from the show isakmp exchange command for a specific exchange in Main mode ISAKMP Exchange Table 51: Modified parameters in output of the show isakmp exchange command for a specific exchange Parameter Message Back-off...
Page 184 Enhancements to IPsec/VPN show isakmp policy Syntax SHow ISAkmp POLicy[=name] Figure 61: Modified example output from the show isakmp policy command for a specific policy. SA Specification Table 52: Modified parameters in output of the show isakmp policy command for specific policy Parameter Message Back-off...
Page 185 Software Version 2.8.1 show isakmp sa Syntax SHow ISAkmp SA[=sa-id] Figure 62: Modified example output from the show isakmp sa command for a specific Security Association. SA Id ... 1 Table 53: Modified parameters in output of the show isakmp sa command for a specific Security Association Parameter Message Back-off...
Page 186: Shdsl Line Mib
SNMP MIBs SNMP MIBs This Software Version includes the following enhancements to SNMP MIBs: ■ SHDSL Line MIB ■ Logging SNMP operation ■ Traps on OSPF state changes ■ Trap on VRRP topology changes ■ Traps on MSTP state and topology changes ■...
Page 187: Logging Snmp Operation
Software Version 2.8.1 ■ The Segment Endpoint 1-Day Interval Status/Performance Group contains objects that describe the historic status and performance of segment endpoints in 1-day intervals. ■ The Maintenance Group contains objects for performing maintenance operations such as loopbacks for SHDSL lines. ■...
Page 188: Traps On Ospf State Changes
SNMP MIBs The SNMP agent now generates the following log message when there is insufficient system memory to send a trap message: Message Severity Module Log Type Log Subtype Recommended Action To view the log, use the command: show log Traps on OSPF state changes RFC 1850, OSPF Version 2 Management Information Base, defines a portion of the Management Information Base (MIB) for managing Version 2 of the Open...
Page 189: Traps On Mstp State And Topology Changes
Software Version 2.8.1 • • • ■ The ospfVirtNbrStateChange trap ({ ospfTraps 3 }) is generated when a virtual OSPF neighbour changes state, and contains the following objects: • • • • Trap on VRRP topology changes RFC 2787, Definitions of Managed Objects for the Virtual Router Redundancy Protocol, defines a portion of the Management Information Base (MIB) for managing the Virtual Router Redundancy Protocol (VRRP).
Page 190: Vlan-Based Port State Changes
• • Restart Log The sysinfo Group of the Allied Telesis Enterprise MIB has the object identifier prefix sysinfo ({ enterprises(1) alliedTelesyn(207) mibObject(8) brouterMib(4) atRouter(4) 3 }), and contains objects that describe generic system information. This software version defines the following new object in the sysinfo Group: ■...
Page 191: Trap On Memory Levels
• • • Trap on Memory Levels The memory Group of the Allied Telesis Enterprise MIB has the object identifier prefix memory ({ enterprises(1) alliedTelesyn(207) mibObject(8) brouterMib(4) atRouter(4) sysinfo(3) 7 }), and contains objects that describe system memory. This software version defines the following new trap in the memory Group: ■...
Page 192: Command Reference Updates
SNMP MIBs Command Reference Updates This section describes the changed portions of the modified command and output screen. For modified commands and output, the new parameters, options, and fields are shown in bold. show buffer Syntax SHow BUFfer [SCAn[=address [QUEuepointers]]] where address is the memory address of a section of router or switch code expressed in hexadecimal Description...
Page 193: Command Reference Updates
Software Version 2.8.1 CDP over WAN Interfaces This Software Version expands the existing Cisco Discovery Protocol functionality to include PPP interfaces. Command Changes The following table summarises the new and modified commands: Command disable lldp cdp interface disable lldp cdp ppptemplate enable lldp cdp debug enable lldp cdp interface enable lldp cdp ppptemplate...
Page 194 CDP over WAN Interfaces disable lldp cdp interface Syntax DISable LLDP CDP INTerface=interface where interface is the interface on which to disable CDP, one of: ■ ethn An Eth port, where n is the Eth port instance (for example, eth0) ■...
Page 195 Software Version 2.8.1 enabled on a particular device, no other debugging mode can be enabled on any other device simultaneously. CDP debugging is disabled by default. Parameter DEBug enable lldp cdp interface Syntax ENAble LLDP CDP INTerface=interface where interface is the interface on which to enable CDP, one of: ■...
Page 196 CDP over WAN Interfaces show lldp cdp Syntax SHow LLDP CDP Description This command displays general information about the current CDP set up. Figure 64: Example output from the show lldp cdp command CDP general information --------------------------------------------- Enabled ... Yes Number of CDP neighbours ...
Page 197: Permanent Assignments On Ar400 Series Routers
Software Version 2.8.1 Permanent Assignments on AR400 Series Routers This Software Version adds support for permanent assignments on AR400 Series routers. Permanent assignments provide a method for creating permanent links between terminal ports on routers. For information and command syntax, see the "Permanent Assignments" chapter of the Software Reference for Software Version 2.7.6 or 2.8.1 Software Version 2.8.1 C613-10477-00 REV B...
Page 199 Chapter 1 Ethernet Protection Switching Ring (EPSR) Introduction to Ethernet Protection Switching Ring (EPSR) ... 1-2 Fault Detection and Recovery ... 1-4 Configuring EPSR ... 1-7 Command Reference ... 1-15 Ring Components and Operation ... 1-2 Fault Recovery Procedure ... 1-5 Restoring Normal Operation ...
Page 200: Introduction To Ethernet Protection Switching Ring (Epsr)
Introduction to Ethernet Protection Switching Ring (EPSR) Ethernet Protection Switching Ring (EPSR) is a protection system employed to prevent loops within Ethernet ring based topologies. EPSR offers a rapid detection and recovery time (in the order of 50 ms, depending on configuration) if a link or node fails.
Page 201 Ethernet Protection Switching Ring (EPSR) The EPSR control VLAN, and its associated data VLANs, form a Ring Domain. Although a physical ring can have more than one domain, each domain must operate as a separate logical group of VLANs and must have its own master node.
Page 202: Fault Detection And Recovery
Fault Detection and Recovery EPSR uses two methods to detect and recover from outages in either a node or a link within the ring. These methods are: Master node polling fault detection ■ Transit node unsolicited fault detection ■ Master Node Polling Fault Detection The master node issues healthcheck messages from its primary port as a means of checking the condition of the EPSR network ring.
Page 203: Fault Recovery Procedure
Ethernet Protection Switching Ring (EPSR) Fault Recovery Procedure When the master node detects an outage somewhere in the ring, using either of the detection methods previously described, it will: declare the ring to be in a “failed” state ■ unblock its secondary port to enable the data VLAN traffic to pass between ■...
Page 204: Restoring Normal Operation
Restoring Normal Operation Transit Nodes Once a fault in the ring or node has been rectified, the transit nodes that span the (previously) faulty link section will detect that link connectivity has returned. They will then move their appropriate ring port state, from “Links-Down”...
Page 205: Configuring Epsr
Ethernet Protection Switching Ring (EPSR) Configuring EPSR EPSR can be configured in many ways ranging from the simple example shown below, through to complex rings with extended lobes running either EPSR or spanning tree protocols. Single Domain, Single Ring Network This example shows a very simple single ring, single domain configuration with no connecting lobes.
Page 206 Figure 1-4 network. Figure 1-4: Example script for a 4 node ring network # EPSR configuration for a simple 4 node ring network # For the Master Node # Set the Acceptable Frame Types parameter to admit only VLAN tagged frames on # ports 1 and 2.
Page 207: Single Ring, Dual Domain Network
Ethernet Protection Switching Ring (EPSR) Single Ring, Dual Domain Network This example shows a slightly more complex EPSR configuration where two EPSR domains share the same physical ring. This configuration enables two sets of users to run totally separate layer two networks. Better load distribution around the ring can be achieved by configuring different nodes to be the master for each ring.
Page 208 Figure 1-6: Example script for a Single Ring, Two Domain Network - Node 1 # Node 1 (Master node for Ring_A - Transit Node for Ring_B) # Set the Acceptable Frame Types parameter to admit only VLAN tagged frames. # For Ring_A set switch port=1 acc=vlan set switch port=2 acc=vlan # For Ring_B...
Page 209 Ethernet Protection Switching Ring (EPSR) Figure 1-7: Example script for a Single Ring, Two Domain Network - Nodes 2 and 4 # Node 2 and Node 4 (Transit node for Ring_A - Transit Node for Ring_B) # Set the Acceptable Frame Types parameter to admit only VLAN tagged frames. # For Ring_A set switch port=1 acc=vlan set switch port=2 acc=vlan...
Page 210 Figure 1-8: Example script for a Single Ring, Two Domain Network - Node 3 # Node 3 (Transit node for Ring_A - Master Node for Ring_B) # Set the Acceptable Frame Types parameter to admit only VLAN tagged frames. # For Ring_B set switch port=3 acc=vlan set switch port=4 acc=vlan # For Ring_A...
Page 211: Epsr And Spanning Tree Operation
Ethernet Protection Switching Ring (EPSR) EPSR and Spanning Tree Operation EPSR and the Spanning Tree protocols (STP) each address the issue of data loop prevention, although their method of doing so is quite different. For information on STP, see the Spanning Tree Chapter of your switch’s Software Refernce.
Page 212 Figure 1-10: Example script for a combined EPSR STP network - Master Node 1 # EPSR configuration with spanning tree lobe # For the Master Node (Node 1) # Set the Acceptable Frame Types parameter to admit only VLAN tagged frames on # ports 1 and 2.
Page 213: Command Reference
Ethernet Protection Switching Ring (EPSR) Figure 1-12: Example script for a combined EPSR STP network - Transit Nodes 2 and 4 # For Transit Nodes 2 and 4 # Set the Acceptable Frame Types parameter to admit only VLAN tagged frames on # ports 1 and 2.
Page 214: Add Epsr Datavlan
add epsr datavlan add epsr datavlan Syntax ADD EPSR=epsr-name DATAvlan={vlan-name|1..4094} Description This command adds a data VLAN to the selected EPSR instance, in order to provide protection against network loops in that VLAN. The following configuration rules apply when adding an EPSR data VLAN: The maximum number of data VLANs that can be added to an EPSR ■...
Page 215: Create Epsr
Ethernet Protection Switching Ring (EPSR) create epsr Syntax CREate EPSR=epsr-name MODE=MASTer CONtrolvlan={vlan-name| 1..4094} PRImaryport=port [HEllotime=time] [FAilovertime=time2] [RIngflaptime=0..65535] [TRap={ENAbled|DIsabled}] CREate EPSR=epsr-name MODE=TRANsit CONtrolvlan={vlan-name| 1..4078} [TRap={ENAbled|DIsabled}] Description This command creates an EPSR instance. Note that ingress filtering is automatically applied to a port when the port is added as an EPSR. The port’s ingress setting is then unchangeable unless it is deleted from EPSR by destroying the last EPSR instance that includes that particular port.
Page 216 create epsr Parameter CONtrolvlan PRImaryport HEllotime FAilovertime RIngflaptime TRap Examples To create an EPSR instance called blue, with this switch acting as the master node, vlan2 as the control VLAN, and port 1 as the primary port, use the command: cre epsr=blue mode=mast con=vlan2 pri=1 Related Commands add snmp targetaddr (SNMPv3)
Page 217: Delete Epsr Datavlan
Ethernet Protection Switching Ring (EPSR) delete epsr datavlan Syntax DELete EPSR=epsr-name DATAvlan={vlan-name|1..4094|ALL} Description This command removes a data VLAN from the named EPSR instance. Warning Deleting a VLAN that is still configured to a ring can cause loops and subsequent broadcast storms within the network. To avoid creating loops, take one or more of these steps before running this command: disable the ports, using the disable switch port command.
Page 218: Destroy Epsr
destroy epsr destroy epsr Syntax DESTroy EPSR={epsr-name|ALL} Description This command destroys the specified EPSR instance, or all EPSR instances. Before running this command you must first disable the appropriate EPSR instances by using the their associated data VLANs. To avoid creating loops, take one or more of these steps before running this command: disable the ports, using the disable switch port command.
Page 219: Disable Epsr
Ethernet Protection Switching Ring (EPSR) disable epsr Syntax DISable EPSR={epsr-name|ALL} Description This command disables the EPSR protocol for either the specified EPSR instance, or all EPSR instances. Warning Disabling a VLAN that is still configured to a ring can cause loops and subsequent broadcast storms within the network.
Page 220: Disable Epsr Debug
disable epsr debug disable epsr debug Syntax DISable EPSR={epsr-name|ALL} DEBug={INFo|MSG|PKT|STAte| ALL} Description This command disables debugging for either the selected EPSR instance, or all EPSR instances. Table 1-1: Parameters for the disable epsr debug command Parameter EPSR Debug Examples To disable all debugging modes on the EPSR instance called blue, use the command: dis epsr=blue deb=all Related Commands...
Page 221: Enable Epsr
Ethernet Protection Switching Ring (EPSR) enable epsr Syntax ENAble EPSR={epsr-name|ALL} Description This command enables the operation of the EPSR protocol on the specified EPSR instance, or all EPSR instances. Parameter EPSR Examples To enable the EPSR instance called blue, use the command: ena epsr=blue Related Commands create epsr...
Page 222: Enable Epsr Debug
enable epsr debug enable epsr debug Syntax ENAble EPSR={epsr-name|ALL} DEBug={INFo|MSG|PKT|STAte|ALL} [OUTput=CONsole] [TIMEOut={1..4000000000|NONE}] Description This command enables debugging for either the selected EPSR instance, or all EPSR instances. Parameter EPSR DEbug OUTput TIMEOut Examples To enable all debugging modes on the EPSR instance called blue, use the command: ena epsr=blue deb=all Related Commands...
Page 223: Purge Epsr
Ethernet Protection Switching Ring (EPSR) purge epsr Syntax PURge EPSR Description This command destroys all EPSR instances, returning the EPSR module to its status when it is first powered on. Warning If the data VLANs of any EPSR instances are still configured in a ring formation, purging EPSR could cause a loop in the network.
Page 224: Set Epsr
set epsr set epsr Syntax SET EPSR={epsr-name|ALL} [HEllotime=time] [FAilovertime=time2] [RIngflaptime=0..65535] [TRAP={ENAbled|DIsabled}] Description This command sets the parameters used by the EPSR protocol for the specified EPSR instance or all EPSR instances. Parameter EPSR HEllotime FAilovertime RIngflaptime TRap Examples To set the Ringflap time for the EPSR instance called blue to 2, use the command: set epsr=blue ri=2 Related Commands...
Page 225: Set Epsr Port
Ethernet Protection Switching Ring (EPSR) create snmp community (SNMPv1 & v2) create epsr show epsr set epsr port Syntax SET EPSR=epsr-name POrt=port TYpe={PRIMary|SECOndary} Description This command sets or changes primary and secondary port designations for a selected EPSR instance. Setting one port to primary will automatically cause the other port to change to secondary;...
Page 226: Show Epsr
show epsr show epsr Syntax SHOW EPSR[={epsr-name|ALL}] Description This command displays information about the specified EPSR instance, or all EPSR instances on the switch Parameter EPSR Figure 1-13: Example output from the show epsr command EPSR Information -------------------------------------------- Name ... blue Mode ...
Page 227 Ethernet Protection Switching Ring (EPSR) Table 1-2: Parameters displayed in the output of the show epsr command Parameter Name Mode Status State Control VLAN Data VLAN(s) Primary Port Primary Port Status Secondary Port Secondary Port Status Hello Time Failover Time Ring Flap Time Trap First Port...
Page 228 show epsr Table 1-2: Parameters displayed in the output of the show epsr command (cont.) Parameter First Port Status First Port Direction Second Port Second Port Status Second Port Direction Master Node Examples To show the current settings of the EPSR instance called blue, use the command show epsr=blue Related Commands add epsr datavlan...
Page 229: Show Epsr Counter
Ethernet Protection Switching Ring (EPSR) show epsr counter Syntax SHOW EPSR[={epsr-name|ALL}] COUnter Description This command displays the counter information about the specified EPSR instance, or all EPSR instances Parameter EPSR COUnter Figure 1-14: Example output from the show epsr counter command EPSR Counters --------------------------------------------------------------------------- Name blue...
Page 230 show epsr counter Table 1-3: Parameters displayed in output of the show epsr counter command (cont.) Parameter Link Down Invalid EPSR Packets Transmit Total EPSR Packets Health Ring Up Ring Down Link Down Examples To show the counters of the EPSR instance called blue, use the command: show epsr=blue cou Related Commands show epsr...
Page 231: Show Epsr Debug
Ethernet Protection Switching Ring (EPSR) show epsr debug Syntax SHOW EPSR[={epsr-name|ALL}] DEBug Description This command show the debugging modes enabled on each EPSR instance, or all EPSR instances Parameter EPSR DEBug Figure 1-15: Example output from the show epsr debug command EPSR Name Enabled Debug Modes --------------------------------------------------------------------------------...

This manual is also suitable for:

At-8800 At-9800 At-9900 At-8700xl At-8900 X900-48fe ... Show all

Allied Telesis AT-8600 Release Note

Release Note Software Version 2.8.

Software Version 2.8.1

For AT-8800, Rapier I, AT-8700XL, AT-8600

AT-9900, X900-48FE, AT-8900 and AT-9800 Series

Switches

And AR400 and AR700 Series Routers

Show Switch Port

VLAN Status Trap

Address Learn Thrash Action

Ethernet Protection Switching Ring (Epsr)

Quick Links

Chapters

Troubleshooting

Need help?

Questions and answers

Subscribe to Our Youtube Channel

Related Manuals for Allied Telesis AT-8600

Summary of Contents for Allied Telesis AT-8600

This manual is also suitable for:

Table of Contents