To specify the Transitory Messaging Services (TMS) parameter map associated with this TMS class, use the mitigation command in policy-map class configuration mode. To detach the parameter map from the policy map, use the no form of this command.

Note	Effective with Cisco IOS Release 12.4(20)T, the mitigation command is not available in Cisco IOS software.

Syntax Description

Command Default

None.

Command Modes

Policy-map class configuration (config-pmap-c)

Command History

Usage Guidelines

The mitigation command is entered in policy-map class configuration mode to attach a TMS type parameter map to a TMS type class map under a policy map. The same parameter map can be attached to one or more class maps. If there are multiple class maps attached to a policy map, each can be associated with the same parameter map or a different parameter map.

Related Commands

To enable consistency checking of a device's Ternary Content Addressable Memory (TCAM) table by the Multi-Link Switching (MLS) access check list (ACL) lookup engine, use the mls acl tcam consistency enable command in global configuration mode. To return to the default value, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The MLS ACL TCAM consistency checker is disabled after a device reloads.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command to explicitly enable the MLS ACL TCAM consistency checker.

To display the results from the consistency checker, use the show mls acl consistency command.

Related Commands

To set the default action during the ACL TCAM update, use the mls acl tcam default-result command in global configuration mode. To return to the default settings, use the no form of this command.

Syntax Description

Command Default

deny

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

In the transition time between when an existing ACL is removed and a new ACL is applied, a default deny is programmed in the hardware. Once the new ACL has been applied completely in the hardware, the default deny is removed.

Use the mls acl tcam default-result permit command to permit all traffic in the hardware or bridge all traffic to the software during the transition time.

To allow web-based authentication (webauth) and IP Source Guard (IPSG) to function together on the same interface, use the mls acl tcam override dynamic dhcp-snooping command in global configuration mode. To disable this compatibility function, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

This function is disabled by default.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

On the Catalyst 6500 series switch, when both webauth and IPSG are configured on the same access port and DHCP snooping is enabled on the access VLAN, the webauth downloadable ACLs (DACLs) can interfere with the DHCP snooping functionality. To prevent this interference, enter the mls acl tcam override dynamic dhcp-snooping command in global configuration mode. This command causes DHCP snooping entries to be replicated in the DACLs.

Related Commands

To enable sharing of the global default ACLs, use the mls acl tcam share-global command in global configuration mode. To turn off sharing of the global defaults, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

Enabled

Command Modes

Global configuration

Command History

Usage Guidelines

If you power cycle one of the DFCs, we recommend that you reset all the DFCs across the ACLs of the different DFCs.

To enable VACL lookups on software-switched and router-generated packets on the Catalyst 6500 Supervisor Engine 2, use the mls acl vacl apply-selfcommand in global configuration mode. To disable VACL lookups for software packets, use the no form of this command.

Syntax Description

This command has no keywords or arguments.

Command Default

VACL lookup on the egress VLAN for software packets are not enabled on switches with Supervisor Engine 2.

Command Modes

Global configuration

Command History

Usage Guidelines

On the Supervisor Engine 2 based switches running Cisco IOS Release 12.2(18)SXF15 or a later release, you can enable VACL lookups on software-switched and router generated packets for the VLAN filter configured on the egress VLAN by entering the mls acl vacl apply-self command.

On both the Supervisor Engine 720 and Supervisor Engine 32, software-switched packets and router-generated packets are always subjected to VACL lookups on the egress VLAN.

To select the type of ACL merge method to use, use the mls aclmerge algorithmcommand in global configuration mode.

Syntax Description

Command Default

bdd

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 720.

The BDD-based ACL merge uses Boolean functions to condense entries into a single merged list of Ternary Content Addressable Memory (TCAM) entries that can be programmed into the TCAM.

You cannot disable the ODM-based ACL merge on Cisco 7600 series routers that are configured with a Supervisor Engine 720.

The ODM-based ACL merge uses an order-dependent merge algorithm to process entries that can be programmed into the TCAM.

Note	The ODM-based ACL merge supports both security ACLs and ACLs that are used for QoS filtering.

If you change the algorithm method, the change is not retroactive. For example, ACLs that have had the merge applied are not affected. The merge change applies to future merges only.

Use the show fm summary command to see the status of the current merge method.

Related Commands

To enable ACL-specific features for Layer 4, use the mls ip acl port expand comman d in global configuration mode. To disable the ACL-specific Layer 4 features, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

This command has no default settings.

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

To permit traffic through any ACLs that would deny the traffic through other interfaces from the global configuration command mode, use the mls ip inspect command. Use the no form of this command to return to the default settings.

Syntax Description

Command Default

Disabled

Command Modes

Global configuration

Command History

Usage Guidelines

On a Cisco 7600 series routers, when interfaces are configured to deny traffic, the CBAC permits traffic to flow bidirectionally only through the interface that is configured with the ip inspect command.

Related Commands

To enable and set the rate limiters common to unicast and multicast packets in the global configuration command mode, use the mls rate-limit allcommand. Use the no form of this command to disable the rate limiters.

Syntax Description

Command Default

The Layer 2 rate limiters are off by default. If you enable and set the rate limiters, the default packets-in-burst is 10.

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

Rate limiters can rate-limit packets that are punted from the data path in the hardware up to the data path in the software. Rate limiters protect the control path in the software from congestion by dropping the traffic that exceeds the configured rate.

Note	For Cisco 7600 series routers configured with a PFC3A, enabling the Layer 2 rate limiters has a negative impact on the multicast traffic. This negative impact does not apply to Cisco 7600 series routers configured with a PFC3BXL.

Related Commands

To enable and rate limit the control packets in Layer 2, use the mls rate-limit layer2 command in global configuration mode. To disable the rate limiter in the hardware, use the no form of this command.

Syntax Description

Command Default

The Layer 2 rate limiters are off by default. If you enable and set the rate limiters, the default packets-in-burst value is 10 and pps value has no default setting.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

MLS provides high-performance hardware-based Layer 3 switching at Layer 2.

This command is not supported on Catalyst 6500 series switches and Cisco 7600 series routers that are configured with a Supervisor Engine 2.

The unknown keyword is only available on PFC3C line cards. When PFC3C and PFC3B linecards are powered on in the same chassis the chassis will downgrade to the PFC3B linecard and the unknown keyword will be unavailable.

You cannot configure the Layer 2 rate limiters if the global switching mode is set to truncated mode.

The following restrictions are pertinent to the use of the port-security pps keywords and argument:

• The PFC2 does not support the port-security rate limiter.

• The truncated switching mode does not support the port-security rate limiter.

• The lower the value, the more the CPU is protected.

Rate limiters control packets as follows:

• The frames are classified as Layer 2 control frames by the destination MAC address. The destination MAC address used are as follows:

  • 0180.C200.0000 for IEEE BPDU
  • 0100.0CCC.CCCC for CDP
  • 0100.0CCC.CCCD for Per VLAN Spanning Tree (PVST)/Shared Spanning Tree Protocol (SSTP) BPDU

• The software allocates an Local Target Logic (LTL) index for the frames.

• The LTL index is submitted to the forwarding engine for aggregate rate limiting of all the associated frames.

The Layer 2 control packets are as follows:

• General Attribute Registration Protocol (GARP) VLAN Registration Protocol (GVRP)

• BPDUs

• CDP/Dynamic Trunking Protocol (DTP)/Port Aggregation Protocol (PAgP)/UniDirectional Link Detection Protocol (UDLD)/Link Aggregation Control Protocol (LACP) /VTP PDUs

• PVST/SSTP PDUs

If the rate of the traffic exceeds the configured rate limit, the excess packets are dropped at the hardware.

The pdu and l2pt rate limiters use specific hardware rate-limiter numbers only, such as 9 through 12. Enter the show mls rate-limit usage command to display the available rate-limiter numbers. The available numbers are displayed as “Free” in the output field. If all four of those rate limiters are in use by other features, a system message is displayed telling you to turn off a feature to rate limit the control packets in Layer 2.

When a MAC move occurs and a packet is seen on two ports, the packet is redirected to the software. If one of those ports has the violation mode set to restrict or protect, the packet is dropped in software. You can use the port-security rate limiter to throttle the number of such packets redirected to software. This helps in protecting the software from high traffic rates.

Related Commands

To enable and set the Layer 3 security rate limiters for the unicast packets in the global configuration command mode, use the mls rate-limit unicast l3-featurescommand. Use the no form of this command to disable the rate limiters.

Syntax Description

Command Default

The defaults are as follows:

• Enabled at 2000 pps and packets-in-burst is set to 1.

• If the packets-in-burst is not set, 10 is programmed for unicast cases.

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 720.

Related Commands

To enable and set the rate limiters for the IPv4 multicast packets in the global configuration command mode, use the mls rate-limit multicast ipv4command. Use the no form of this command to disable the rate limiters.

Syntax Description

Command Default

The defaults are as follows:

• If the packets-in-burst is not set, a default of 100 is programmed for multicast cases.

• fib-miss --Enabled at 100000 pps and packet-in-burst is set to 100.

• ip-option --Disabled.

• partial --Enabled at 100000 pps and packet-in-burst is set to 100.

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

You cannot configure the IPv4 rate limiters if the global switching mode is set to truncated mode.

The rate limiters can rate limit the packets that are punted from the data path in the hardware up to the data path in the software. The rate limiters protect the control path in the software from congestion and drop the traffic that exceeds the configured rate.

The ip-option keyword is supported in PFC3BXL or PFC3B mode only.

Related Commands

To configure the IPv6 multicast rate limiters, use the mls rate-limit multicast ipv6command in global configuration mode. To disable the rate limiters, use the no form of this command.

Syntax Description

Command Default

If the burst is not set, a default of 100 is programmed for multicast cases.

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

The rate-limiter-nameargument must be a rate limiter that is not currently programmed.

The target-rate-limiterargument must be a rate limiter that is programmed in the hardware and must be the first rate limiterprogrammed for its group.

The table below lists the IPv6 rate limiters and the class of traffic that each rate limiter serves.

You can configure rate limiters for IPv6 multicast traffic using one of the following methods:

• Direct association of the rate limiters for a traffic class--Select a rate and associate the rate with a rate limiter. This example shows how to pick a rate of 1000 pps and 20 packets per burst and associate the rate with the default-drop rate limiter:

Router(config)# mls rate-limit multicast ipv6 default-drop 1000 20

• Static sharing of a rate limiter with another preconfigured rate limiter--When there are not enough adjacency-based rate limiters available, you can share a rate limiter with an already configured rate limiter (target rate limiter). This example shows how to share the route-cntl rate limiter with the default-drop target rate limiter:

Router(config)# mls rate-limit multicast ipv6 route-cntl share default-drop

If the target rate limiter is not configured, a message displays that the target rate limiter must be configured for it to be shared with other rate limiters.

• Dynamic sharing of rate limiters--If you are not sure about which rate limiter to share with, use the share auto keywords to enable dynamic sharing. When you enable dynamic sharing, the system picks a preconfigured rate limiter and shares the given rate limiter with the preconfigured rate limiter. This example shows how to choose dynamic sharing for the route-cntrl rate limiter:

Router(config)# mls rate-limit multicast ipv6 route-cntl share auto

Related Commands

To enable and set the ACL-bridged rate limiters in global configuration command mode, use the mls rate-limit unicast aclcommand. Use the no form of this command to disable the rate limiters.

Syntax Description

Command Default

The defaults are as follows:

• input --Disabled.

• output --Disabled.

• vacl-log --Enabled at 2000 pps and packets-in-burst is set to 1.

• If the packets-in-burst is not set, 10 is programmed for unicast cases.

Command Modes

Global configuration

Command History

Usage Guidelines

The input and output keywords are not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

The rate limiters can rate limit the packets that are punted from the data path in the hardware up to the data path in the software. The rate limiters protect the control path in the software from congestion and drop the traffic that exceeds the configured rate.

When setting the pps, valid values are as follows:

• ACL input and output cases--10 to 1000000 pps

• VACL log cases--10 to 5000 pps

You cannot change the vacl-log packets-in-burstkeyword and argument; it is set to 1 by default.

Some cases (or scenarios) share the same hardware register. These cases are divided into the following two groups:

• Group1:

  • Egress ACL-bridged packets
  • Ingress ACL-bridged packets
• Group 2:

  • RPF failure
  • ICMP unreachable for ACL drop
  • ICMP unreachable for no-route
  • IP errors

All the components of each group use or share the same hardware register. For example, ACL-bridged ingress and egress packets use register A. ICMP-unreachable, no-route, and RPF failure use register B.

In most cases, when you change a component of a group, all the components in the group are overwritten to use the same hardware register as the first component changed. A warning message is printed out each time that an overwriting operation occurs, but only if you enable the service internal mode. The overwriting operation does not occur in these situations:

• The pps value is set to 0 (zero) for a particular case.

• When the i ngress or egress ACL-bridged packet cases are disabled, overwriting does not occur until the cases are enabled again. If either case is disabled, the other is not affected as long as the remaining case is enabled. For example, if you program the ingress ACL-bridged packets with a 100-pps rate, and then you configure the egress ACL-bridged packets with a 200-pps rate, the ingress ACL-bridged packet value is overwritten to 200 pps and both the ingress and the egress ACL-bridged packets have a 200-pps rate.

Related Commands

To enable and set the Cisco Express Forwarding rate limiters in global configuration command mode, use the mls rate-limit unicast cefcommand. Use the no form of this command to disable the rate limiters.

Syntax Description

Command Default

The defaults are as follows:

• receive --Disabled.

• glean --Disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

If you enable the CEF rate limiters, the following behaviors occur (if the behavior that is listed is unacceptable, disable the CEF rate limiters):

• If a packet hits a glean/receive adjacency, the packet may be dropped instead of being sent to the software if there is an output ACL on the input VLAN and the matched entry result is deny.

• If the matched ACL entry result is bridge, the packet is subject to egress ACL bridge rate limiting (if turned ON) instead of glean/receive rate limiting.

• The glean/receive adjacency rate limiting is applied only if the output ACL lookup result is permit or there is no output ACLs on the input VLAN.

Related Commands

To enable and set the rate limiters for the unicast packets in global configuration command mode, use the mls rate-limit unicast ipcommand. Use the no form of this command to disable the rate limiters.

Syntax Description

Command Default

The defaults are as follows:

• If the packets-in-burst is not set, a default of 10 is programmed as the burst for unicast cases.

• errors -- Enabled at 500 pps and packets-in-burst set to 10.

• rpf-failure --Enabled at 500 pps and packets-in-burst set to 10

• icmp unreachable acl-drop -- Enabled at 500 pps and packets-in-burst set to 10

• icmp unreachable no-route -- Enabled at 500 pps and packets-in-burst set to 10

• icmp redirect -- Disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

To provide OAL support for denied packets, enter the mls rate-limit unicast ip icmp unreachable acl-drop 0 command.

OAL and VACL capture are incompatible. Do not configure both features on the switch. With OAL configured, use SPAN to capture traffic.

The rate limiters can rate limit the packets that are punted from the data path in the hardware up to the data path in the software. The rate limiters protect the control path in the software from congestion and drop the traffic that exceeds the configured rate.

Note	When you configure an ICMP rate limiter, and an ICMP redirect occurs, exiting data traffic is dropped while the remaining traffic on the same interface is forwarded.

When setting the pps, the valid values are 0 and from 10 to 1000000. Setting the pps to 0 globally disables the redirection of the packets to the route processor. The 0 value is supported for these rate limiters:

• ICMP unreachable ACL-drop

• ICMP unreachable no-route

• ICMP redirect

• IP rpf failure

Some cases (or scenarios) share the same hardware register. These cases are divided into the following two groups:

• Group1:

  • Egress ACL-bridged packets
  • Ingress ACL-bridged packets
• Group 2:

  • RPF failure
  • ICMP unreachable for ACL drop
  • ICMP unreachable for no-route
  • IP errors

All the components of each group use or share the same hardware register. For example, ACL-bridged ingress and egress packets use register A. ICMP-unreachable, no-route, and RPF failure use register B.

In most cases, when you change a component of a group, all the components in the group are overwritten to use the same hardware register as the first component changed. A warning message is printed out each time that an overwriting operation occurs, but only if you enable the service internal mode. The overwriting operation does not occur in these situations:

• The pps value is set to 0 (zero) for a particular case.

• When the i ngress or egress ACL-bridged packet cases are disabled, overwriting does not occur until the cases are enabled again. If either case is disabled, the other is not affected as long as the remaining case is enabled. For example, if you program the ingress ACL-bridged packets with a 100-pps rate, and then you configure the egress ACL-bridged packets with a 200-pps rate, the ingress ACL-bridged packet value is overwritten to 200 pps and both the ingress and the egress ACL-bridged packets have a 200-pps rate.

Related Commands

To enable and set the VACL-log case rate limiters in the global configuration command mode, use the mls rate-limit unicast vacl-logcommand. Use the no form of this command to disable the rate limiters.

Syntax Description

Command Default

The defaults are as follows:

• Enabled at 2000 pps and packets-in-burst is set to 1.

• If the packets-in-burst is not set, 10 is programmed for unicast cases.

Command Modes

Global configuration

Command History

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 720.

The rate limiters can rate limit the packets that are punted from the data path in the hardware up to the data path in the software. The rate limiters protect the control path in the software from congestion and drop the traffic that exceeds the configured rate.

When setting the pps, valid values are as follows:

• ACL input and output cases--10 to 1000000 pps

• VACL log cases--10 to 5000 pps

Setting the pps to 0 globally disables the redirection of the packets to the route processor.

You cannot change the vacl-log packets-in-burstkeyword and argument; it is set to 1 by default.

Some cases (or scenarios) share the same hardware register. These cases are divided into the following two groups:

• Group1:

  • Egress ACL-bridged packets
  • Ingress ACL-bridged packets
• Group 2:

  • RPF failure
  • ICMP unreachable for ACL drop
  • ICMP unreachable for no-route
  • IP errors

All the components of each group use or share the same hardware register. For example, ACL-bridged ingress and egress packets use register A. ICMP-unreachable, no-route, and RPF failure use register B.

In most cases, when you change a component of a group, all the components in the group are overwritten to use the same hardware register as the first component changed. A warning message is printed out each time that an overwriting operation occurs, but only if you enable the service internal mode. The overwriting operation does not occur in these situations:

• The pps value is set to 0 (zero) for a particular case.

• When the i ngress or egress ACL-bridged packet cases are disabled, overwriting does not occur until the cases are enabled again. If either case is disabled, the other is not affected as long as the remaining case is enabled. For example, if you program the ingress ACL-bridged packets with a 100-pps rate, and then you configure the egress ACL-bridged packets with a 200-pps rate, the ingress ACL-bridged packet value is overwritten to 200 pps and both the ingress and the egress ACL-bridged packets have a 200-pps rate.

Related Commands

To change the mode for a transform set, use the mode command in crypto transform configuration mode. To reset the mode to the default value of tunnel mode, use the no form of this command.

Syntax Description

Command Default

Tunnel mode

Command Modes

Crypto transform configuration

Command History

Usage Guidelines

Note	Security threats, as well as the cryptographic technologies to help protect against them, are constantly changing. For more information about the latest Cisco cryptographic recommendations, see the Next Generation Encryption (NGE) white paper.

Use this command to change the mode specified for the transform. This setting is only used when the traffic to be protected has the same IP addresses as the IPSec peers (this traffic can be encapsulated either in tunnel or transport mode). This setting is ignored for all other traffic (all other traffic is encapsulated in tunnel mode).

If the traffic to be protected has the same IP address as the IP Security peers and transport mode is specified, during negotiation the router will request transport mode but will accept either transport or tunnel mode. If tunnel mode is specified, the router will request tunnel mode and will accept only tunnel mode.

After you define a transform set, you are put into the crypto transform configuration mode. While in this mode you can change the mode to either tunnel or transport. This change applies only to the transform set just defined.

If you do not change the mode when you first define the transform set, but later decide you want to change the mode for the transform set, you must re-enter the transform set (specifying the transform name and all its transforms) and then change the mode.

If you use this command to change the mode, the change will only affect the negotiation of subsequent IPSec security associations via crypto map entries which specify this transform set. (If you want the new settings to take effect sooner, you can clear all or part of the security association database. See the clear crypto sa command for more details.

Tunnel Mode

With tunnel mode, the entire original IP packet is protected (encrypted, authenticated, or both) and is encapsulated by the IPSec headers and trailers (an Encapsulation Security Protocol header and trailer, an Authentication Header, or both). Then a new IP header is prefixed to the packet, specifying the IPSec endpoints as the source and destination.

Tunnel mode can be used with any IP traffic. Tunnel mode must be used if IPSec is protecting traffic from hosts behind the IPSec peers. For example, tunnel mode is used with Virtual Private Networks (VPNs) where hosts on one protected network send packets to hosts on a different protected network via a pair of IPSec peers. With VPNs, the IPSec peers “tunnel” the protected traffic between the peers while the hosts on their protected networks are the session endpoints.

Transport Mode

With transport mode, only the payload (data) of the original IP packet is protected (encrypted, authenticated, or both). The payload is encapsulated by the IPSec headers and trailers (an ESP header and trailer, an AH header, or both). The original IP headers remain intact and are not protected by IPSec.

Use transport mode only when the IP traffic to be protected has IPSec peers as both the source and destination. For example, you could use transport mode to protect router management traffic. Specifying transport mode allows the router to negotiate with the remote peer whether to use transport or tunnel mode.

Related Commands

To place the public key infrastructure (PKI) server into Registration Authority (RA) certificate server mode, use the mode racommand in certificate server configuration mode. To remove the PKI server from RA certificate mode, use the no form of this command.

Syntax Description

Command Default

The PKI server is not placed into RA certificate server mode.

Command Modes

Certificate server configuration (cs-server)

Command History

Usage Guidelines

You must configure the crypto pki server command with the name of the certificate server in order to enter certificate server configuration mode and configure this command.

When this command is configured, ensure that the crypto pki trustpoint command has also been configured and that the enrollment URL is pointed to a Cisco IOS issuing certification authority (CA). If the mode ra command is not configured and the certificate server is enabled for the first time, a self-signed CA certificate will be generated and the certificate server will operate as a root CA.

The Cisco IOS certificate server can act as an RA for a Cisco IOS CA or another third party CA. The transparent keyword is used if a third-party CA is used.

When the transparent keyword is used, the original PKCS#10 enrollment message is not re-signed and is forwarded unchanged. This enrollment message makes the IOS RA certificate server work with CA servers like the Microsoft CA server.

Related Commands

To enable the secure mode in the Lightweight Directory Access Protocol (LDAP) server, use the mode securecommand in LDAP server configuration mode. To disable the secure mode in LDAP server, use the no form of this command.

Syntax Description

Command Default

The secure mode is disabled.

Command Modes

LDAP server configuration (config-ldap-server)

Command History

Usage Guidelines

Use the mode secure command to establish a TLS connection with the LDAP server. This command will help to secure all the transactions.

Related Commands

To place the public key infrastructure (PKI) server into sub-certificate server mode, use the mode sub-cscommand in certificate server mode. To remove the PKI server from sub-certificate mode, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

The PKI server is not placed into sub-certificate server mode.

Command Modes

Certificate server configuration (cs-server)

Command History

Usage Guidelines

You must configure the crypto pki server command with the name of the certificate server in order to enter certificate server configuration mode and configure this command.

When this command is configured, ensure that the crypto pki trustpoint command has also been configured and that the enrollment URL is pointed to a Cisco IOS root certification authority (CA). If the mode sub-cs command is not configured and the certificate server is enabled for the first time, a self-signed CA certification is generated and the certificate server will operate as a root CA.

Note	The no mode sub-cs command has no effect if the server has been configured already. For example, if you want to make the subordinate CA a root CA, you must delete the server and re-create it.

Related Commands

To monitor and control Dynamic Multipoint VPN (DMVPN) traces, use the monitor event-trace dmvpn command in privileged EXEC or global configuration mode.

Syntax Description

Command Default

DMVPN event tracing is disabled.

Command Modes

Privileged EXEC (#)
Global configuration (config)

Command History

Usage Guidelines

You can use the monitor event-trace dmvpncommand to configure the DMVPN Event Tracing feature. The DMVPN Event Tracing feature provides a trace facility for troubleshooting Cisco IOS DMVPN. This feature enables you to monitor DMVPN events, errors, and exceptions. During runtime, the event trace mechanism logs trace information in a buffer space. A display mechanism extracts and decodes the debug data.

Note	You can configure the DMVPN Event Tracing feature in privileged EXEC mode or global configuration mode based on the desired parameters.

Related Commands

To configure event tracing for the Group Domain of Interpretation (GDOI) software subsystem component, use the monitor event-trace gdoi command in global configuration mode.

Syntax Description

Command Default

GDOI event tracing is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the monitor event-trace gdoi command to enable or disable event tracing for GDOI and to configure event trace parameters for the Cisco IOS software GDOI subsystem component.

Note	Event tracing is intended for use as a software diagnostic tool and should be configured only under the direction of a Technical Assistance Center (TAC) representative.

Additionally, default settings do not appear in the configuration file. If the subsystem software enables event tracing by default, the monitor event-trace component enable command will not appear in the configuration file of the networking device; however, disabling event tracing that has been enabled by default by the subsystem will create a command entry in the configuration file.

Note	The amount of data collected from the trace depends on the trace message size configured using the monitor event-trace gdoi command for each instance of a trace.

To determine whether event tracing is enabled by default for the subsystem, use the show monitor event-trace gdoi command to display trace messages.

To specify the trace call stack at tracepoints, you must first clear the trace buffer.

Related Commands

To configure event tracing for the Group Domain of Interpretation (GDOI) software subsystem component, use the monitor event-trace gdoi command in privileged exec mode.

Syntax Description

Command Default

GDOI event tracing is disabled.

Command Modes

Privileged EXEC (#)

Command History

Usage Guidelines

Use the monitor event-trace gdoi command to enable or disable event tracing for GDOI and to configure event trace parameters for the Cisco IOS software GDOI subsystem component.

Note	Event tracing is intended for use as a software diagnostic tool and should be configured only under the direction of a Technical Assistance Center (TAC) representative.

Additionally, default settings do not appear in the configuration file. If the subsystem software enables event tracing by default, the monitor event-trace component enable command will not appear in the configuration file of the networking device; however, disabling event tracing that has been enabled by default by the subsystem will create a command entry in the configuration file.

To determine whether event tracing is enabled by default for the subsystem, use the show monitor event-trace gdoi command to display trace messages.

Related Commands

To monitor Selective Packet Discard (SPD) state transition events, use the monitor event-trace ipv6 spd command in privileged EXEC mode. To disable this function, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

This command is disabled.

Command Modes

Privileged EXEC (#)

Command History

Usage Guidelines

Use the monitor event-trace ipv6 spd command to check SPD state transition events.

To adjust the maximum packet size or maximum transmission unit (MTU) size, use the mtu command in interface configuration mode, connect configuration mode, or xconnect subinterface configuration mode. To restore the MTU value to its original default value, use the no form of this command.

Syntax Description

Command Default

The table below lists default MTU values according to media type.

Command Modes

Interface configuration (config-if)
Connect configuration (xconnect-conn-config)
xconnect subinterface configuration (config-if-xconn)

Command History

Usage Guidelines

Each interface has a default maximum packet size or MTU size. This number generally defaults to the largest size possible for that interface type. On serial interfaces, the MTU size varies but cannot be set to a value less than 64 bytes.

Note	The connect configuration mode is used only for Frame Relay Layer 2 interworking.

Changing the MTU Size

Changing the MTU size is not supported on a loopback interface.

Changing the MTU size on a Cisco 7500 series router results in the recarving of buffers and resetting of all interfaces. The following message is displayed: RSP-3-Restart:cbus complex .

You can configure native Gigabit Ethernet ports on the Cisco 7200 series router to a maximum MTU size of 9216 bytes. The MTU values range from 1500 to 9216 bytes. The MTU values can be configured to any range that is supported by the corresponding main interface.

MTU Size for an IPSec Configuration

In an IPSec configuration, such as in a crypto environment, an MTU value that is less than 256 bytes is not accepted. If you configure an MTU value less than 256 bytes, then the MTU value is automatically overwritten and given a value of 256 bytes.

Protocol-Specific Versions of the mtu Command

Changing the MTU value with the mtu interface configuration command can affect values for the protocol-specific versions of the command (the ip mtu command, for example). If the value specified with the ip mtu interface configuration command is the same as the value specified with the mtu interface configuration command, and you change the value for the mtu interface configuration command, the ip mtu value automatically matches the new mtu interface configuration command value. However, changing the values for the ip mtu configuration commands has no effect on the value for the mtu interface configuration command.

ATM and LANE Interfaces

ATM interfaces are not bound by what is configured on the major interface. By default, the MTU on a subinterface is equal to the default MTU (4490 bytes). A client is configured with the range supported by the corresponding main interface. The MTU can be changed on subinterfaces, but it may result in recarving of buffers to accommodate the new maximum MTU on the interface.

VRF-Aware Service Infrastructure Interfaces

The mtu command does not support the VRF-Aware Service Infrastructure (VASI) type interface.

Cisco 7600 Valid MTU Values

On the Cisco 7600 platform, the following valid values are applicable:

• For the SVI ports: from 64 to 9216 bytes
• For the GE-WAN+ ports: from 1500 to 9170 bytes
• For all other ports: from 1500 to 9216 bytes

You can receive jumbo frames on access subinterfaces also. The MTU values can be configured to any range that is supported by the corresponding main interface. If you enable the jumbo frames, the default is 64 bytes for the SVI ports and 9216 bytes for all other ports. The jumbo frames are disabled by default.

Cisco uBR10012 Universal Broadband Router

While configuring the interface MTU size on a Gigabit Ethernet SPA on a Cisco uBR10012 router, consider the following guidelines:

• The default interface MTU size accommodates a 1500-byte packet, plus 22 additional bytes to cover the following overhead:
  • Layer 2 header--14 bytes
  • Dot1Q header--4 bytes
  • CRC--4 bytes
• If you are using MPLS, be sure that the mpls mtu command is configured with a value less than or equal to the interface MTU.
• If you are using MPLS labels, you should increase the default interface MTU size to accommodate the number of MPLS labels. Each MPLS label adds 4 bytes of overhead to a packet.

Note	For the Gigabit Ethernet SPAs on the Cisco uBR10012 router, the default MTU size is 1500 bytes. When the interface is being used as a Layer 2 port, the maximum configurable MTU is 9000 bytes.

Related Commands

To configure the redundancy group with a name, use the namecommand in redundancy application group configuration mode. To remove the name of a redundancy group, use the no form of this command.

Syntax Description

Command Default

The redundancy group is not configured with a name.

Command Modes

Redundancy application group configuration (config-red-app-grp)

Command History

Related Commands

To change the name of a lawful intercept view, use the namecommand in view configuration mode. To return to the default lawful intercept view name, which is “li-view,” use the no form of this command.

Syntax Description

Command Default

A lawful intercept view is called “li-view.”

Command Modes

View configuration (config-view)

Command History

Usage Guidelines

Only a system administrator or a level 15 privilege user can change the name of a lawful intercept view.

Related Commands

To specify which peer’s RSA public key you will manually configure and enter public key configuration mode, use the named-key command in public key chain configuration mode. This command should be used only when the router has a single interface that processes IP Security (IPSec).

Syntax Description

Command Default

If neither the encryption nor the signature keyword is used, general-purpose keys will be specified.

Command Modes

Public key chain configuration.

Command History

Usage Guidelines

Use this command or the addressed-key command to specify which IPSec peer’s RSA public key you will manually configure next.

Follow this command with the key-string command to specify the key.

If you use the named-key command, you also need to use the address public key configuration command to specify the IP address of the peer.

If the IPSec remote peer generated general purpose RSA keys, do not use the encryption or signature keyword.

If the IPSec remote peer generated special usage keys, you must manually specify both keys: perform this command and the key-string command twice and use the encryption and signature keywords in turn.

Related Commands

To add an access point or router to the list of devices that use the local authentication server, use the nascommand in local RADIUS server configuration mode. To remove the identity of the network access server (NAS) that is configured on the local RADIUS server, use the no form of this command.

Syntax Description

Command Default

No default behavior or values

Command Modes

Local RADIUS server configuration

Command History

Related Commands

To enable authentication, authorization, and accounting (AAA) authentication for NetWare Asynchronous Services Interface (NASI) clients connecting to a router, use the nasi authentication command in line configuration mode. To return to the default, as specified by the aaa authentication nasi command, use the no form of the command.

Syntax Description

Command Default

Uses the default set with the aaa authentication nasi command.

Command Modes

Line configuration

Command History

Usage Guidelines

This command is a per-line command used with AAA authentication that specifies the name of a list of authentication methods to try at login. If no list is specified, the default list is used, even if it is not specified in the command line. (You create defaults and lists with the aaa authentication nasi command.) Entering the no form of this command has the same effect as entering the command with the default argument.

Caution

If you use a list-name value that was not configured with the aaa authentication nasicommand, you will disable login on this line.

Before issuing this command, create a list of authentication processes by using the aaa authentication nasi global configuration command.

Related Commands

To configure Network Address Translation (NAT) keepalive for Internet Key Exchange Version 2 (IKEv2), use the natcommand in IKEv2 profile configuration mode. To delete NAT keepalive configuration, use the no form of this command.

Syntax Description

Command Default

NAT keepalive is disabled.

Command Modes

IKEv2 profile configuration (config-ikev2-profile)

Command History

Usage Guidelines

Use this command to configure NAT keepalive. NAT keepalive configuration specified in an IKEv2 profile overrides the global configuration. NAT keepalive prevents the NAT translation entries from deletion in the absence of any traffic when there is NAT between IKE peers.

Related Commands

To enter the webvpn NBNS list configuration mode to configure a NetBIOS Name Service (NBNS) server list for Common Internet File System (CIFS) name resolution, use the nbns-list command in webvpn context configuration mode. To remove the NBNS server list from the SSL VPN context configuration, use the no form of this command.

Syntax Description

Command Default

Webvpn NBNS list configuration mode is not entered, and a NBNS server list cannot be configured.

Command Modes

Webvpn context configuration

Command History

Usage Guidelines

The NBNS server list is used to configure a list of Windows Internet Name Service (WINS) to resolve Microsoft file-directory shares. Entering the nbns-listcommand places the router in webvpn NBNS list configuration mode. You can specify up to three NetBIOS name servers. A single server is configured as the master browser if multiple servers are specified in the server list.

Note	NBNS and CIFS resolution is supported only on Microsoft Windows 2000 or Linux Samba servers.

Related Commands

To attach a NetBIOS name service (NBNS) server list to a policy group configuration, use the nbns-listcommand in webvpn group policy configuration mode. To remove the NBNS server list from the policy group configuration, use the no form of this command.

Syntax Description

Command Default

An NBNS server list is not attached to a policy group configuration.

Command Modes

Webvpn group policy configuration

Command History

Usage Guidelines

The configuration of this command applies to only clientless mode configuration.

Related Commands

To add a server to a NetBIOS name service (NBNS) server list, use the nbns-server command in webvpn NBNS list configuration mode. To remove the server entry from the NBNS server list, use the no form of this command.

Syntax Description

Command Default

The following default values are used if this command is not configured or if the no form is entered:

timeout 2 retries 2

Command Modes

Webvpn NBNS list configuration

Command History

Usage Guidelines

The server specified with the ip-addressargument can be a primary domain controller (PDC) in a Microsoft network. A Windows Internet Naming Service (WINS) server cannot and should not be specified. When multiple NBNS servers are specified, a single server is configured as master browser.

Related Commands

To specify the subnet mask to be used by the client for local connectivity, use the netmask command in ISAKMP group configuration mode or IKEv2 group configuration mode. To disable the mask, use the no form of this command.

Syntax Description

Command Default

Default mask is used.

Command Modes

ISAKMP group configuration (config-isakmp-group)
IKEv2 client group configuration (config-ikev2-client-config-group)

Command History

Usage Guidelines

Use this command to specify the subnet mask for the IP address assigned to the client.

To disable hardware crypto engine failover to the software crypto engine, use the no crypto engine software ipseccommand in global configuration mode. To reenable failover, use the crypto engine software ipsecform of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

Failover is enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

Use this command for those situations in which the amount of IP Security (IPSec) traffic is more than can be handled (because of bandwidth) by the software routines on the CPU.

Related Commands

To ignore extended authentication (Xauth) during an Internet Key Exchange (IKE) Phase 1 negotiation, use the no crypto xauth command in global configuration mode. To consider Xauth proposals, use the crypto xauth command.

Syntax Description

Command Default

No default behaviors or values

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The no version of this command was introduced to support Unity clients that do not require Xauth when using Internet Security Association and Key Management Protocol (ISAKMP) profiles.

Note	This command does not support loopback interfaces.

To turn off Context-based Access Control (CBAC) completely at a firewall, use the no ip inspect command in global configuration mode.

Syntax Description

This command has no arguments or keywords.

Command Default

No default behavior or values.

Command Modes

Global configuration

Command History

Usage Guidelines

Turn off CBAC with the no ip inspect global configuration command.

Note	The no ip inspect command removes all CBAC configuration entries and resets all CBAC global timeouts and thresholds to the defaults. All existing sessions are deleted and their associated access lists are removed.

To instruct the router not to load the built-in signatures if it cannot find the specified signature definition files (SDFs), use the no ip ips sdf builtincommand in global configuration mode.

Syntax Description

This command has no arguments or keywords.

Command Default

If the router fails to load the SDF, the router will load the default, built-in signatures.

Command Modes

Global configuration

Command History

Usage Guidelines

Caution

If the no ip ips sdf builtin command is issued and the router running Intrusion Prevention System (IPS) fails to load the SDF, you will receive an error message stating that IPS is completely disabled.

Related Commands

To identify that the security server is using a vendor-proprietary implementation of RADIUS, use the non-standard command in RADIUS server configuration mode. To delete the specified vendor-proprietary RADIUS host, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

Nonstandard RADIUS attributes are not supported.

Command Modes

RADIUS server configuration (config-radius-server)

Command History

Usage Guidelines

Use the non-standard command to identify that the RADIUS server is using a vendor-proprietary implementation of RADIUS. Although an IETF draft standard for RADIUS specifies a method for communicating information between the network access server and the RADIUS server, some vendors have extended the RADIUS attribute set in a unique way. This command enables the Cisco IOS software to support the most common vendor-proprietary RADIUS attributes. Vendor-proprietary attributes will not be supported unless you use the non-standard command in RADIUS server configuration mode.

For a list of supported vendor-specific RADIUS attributes, refer to the appendix “RADIUS Attributes” in the Cisco IOS Security Configuration Guide.

Related Commands

To define object groups that you can use to optimize your configuration, use the object-group global configuration mode command. To remove object groups from the configuration use the no form of this command .

Syntax Description

Command Default

This command has no default settings.

Command Modes

The following table shows the modes in which you can enter the command:

Command History

Usage Guidelines

This command supports IPv4 and IPv6 addresses.

Objects such as hosts, protocols, or services can be grouped, and then you can issue a single command using the group name to apply to every item in the group.

When you define a group with the object-group command and then use any security appliance command, the command applies to every item in that group. This feature can significantly reduce your configuration size.

Once you define an object group, you must use the object-group keyword before the group name in all applicable security appliance commands as follows:

Router# show running-config object-group group-name

where group-name is the name of the group.

This example shows the use of an object group once it is defined:

Router(config)# access-list access_list_name permit tcp any object-group group-name

In addition, you can group access list command arguments:

You can group commands hierarchically; an object group can be a member of another object group.

To use object groups, you must do the following:

• Use the object-group keyword before the object group name in all commands as follows:

Router(config)# access-list acl permit tcp object-group remotes object-group locals object-group eng-svc

where remotes and locals are sample object group names.

• The object group must be nonempty.

• You cannot remove or empty an object group if it is being used in a command.

Use the exit, quit, or any valid config-mode commands such as access-list to close an object-group mode and exit the object-group main command.

The show running-config object-group command displays all defined object groups by their grp-id when the show running-config object-group group-id command is entered, and by their group type when you enter the show running-config object-group group-type command. When you enter the show running-config object-group command without an argument, all defined object groups are shown.

Use the clear configure object-group command to remove a group of previously defined object-group commands. Without an argument, the clear configure object-group command lets you to remove all defined object groups that are not being used in a command. Use of the group-type argument removes all defined object groups that are not being used in a command for that group type only.

You can use all other security appliance commands in an object-group mode, including the show running-config and clear configure commands

Commands within the object-group mode appear indented when displayed or saved by the show running-config object-group, write, or config commands.

Commands within the object-group mode have the same command privilege level as the main command.

When you use more than one object group in an access-list command, the elements of all object groups that are used in the command are linked, starting with the elements of the first group with the elements of the second group, then the elements of the first and second groups together with the elements of the third group, and so on.

The starting position of the description text is the character right immediately following the white space (a blank or a tab) following the description keyword.

When you enter the object-group ip address command, the prompt changes to Router(config-ipaddr-ogroup)# and allows you to create or modify a PBACL protocol port object group.

The following IP address object-group configuration commands are available:

• A.B.C.D --Specifies the network address of the object-group members.

• end --Exits from configuration mode.

• exit --Exits from IP object-group configuration mode.

• host address or host name--Specifies the host address or name of the object-group member.

• no --Negates or sets the default values of a command.

Use the no form of the command to delete the object group with the specified name.

When you enter the object-group ip port command, the prompt changes to Router(config-port-ogroup)# and allows you to define the object group name and enter port object-group configuration mode. The following port object-group configuration commands are available:

• end --Exits from configuration mode.

• eq number--Matches only packets on a given port number; valid values are from 0 to 65535.

• exit --Exits from the IP object-group configuration mode.

• gt number--Matches only packets on a given port number; valid values are from 0 to 65535.

• lt number--Matches only packets with a lower port number; valid values are from 0 to 65535.

• neq number--Matches only packets with a lower port number; valid values are from 0 to 65535.

• no --Negates or sets default values of a command.

• range number number--Matches only packets in the range of port numbers; valid values are from 0 to 65535.

Use the no form of the command to delete the object group with the specified name.

Related Commands

To define network object groups for use in object group-based access control lists (ACLs) and enter network group configuration mode, use the object-group network command in global configuration mode. To remove network object groups from the configuration, use the no form of this command.

Syntax Description

Command Default

No network object groups are created.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

A network object group is a group of any of the following objects: hostnames, host IP addresses, subnets, ranges of IP addresses, or existing network object groups. A network object group is an ordered list and can be used in an ACL or in other commands. You can use a single command using the group name to apply to every object in the group.

This command supports only IPv4 addresses.

Note	In Cisco IOS XE releases, the any and range commands are not supported.

Commands within network group mode have the same command privileges as the main command. Commands within network group mode appear indented when saved or displayed using the write memory or show running-config commands.

The type of child object group must match the type of the parent (for example, if you create a network object group, the child object group that you specify must be another network object group). The object-group network command supports unlimited number of nested object groups; however, we recommend that you configure a maximum of only two levels.

You can duplicate objects in an object group when the duplication is because these objects are part of group objects. For example, if object 1 is in both group A and group B, you can define a group C that includes both A and B. However, you cannot include a group object that causes the group hierarchy to become circular (for example, you cannot include group A in group B and then also include group B in group A).

When you use the network-address/nn command to create a subnet object, for example 209.165.201.0 /27, the 27 most significant bits are allocated for the network prefix number, and the remaining 5 bits are reserved for the host address. If the same subnet object is created using the network-address network-mask command, the command appears as 209.165.201.31 255.255.255.224. Here, the subnet mask is 255.255.255.224. The default subnet mask is 255.255.255.255.

Using a subnet mask of 0.0.0.0 includes any address in the range from 0.0.0.0 to 255.255.255.255 in the subnet object and using 0.0.0.0 gives the subnet object the same range as the range specified by the any command. Using a range from 0.0.0.0 to 255.255.255.255 specifies that any IP address can be used as a host IP address and this configuration is similar to configuring the any command, which specifies that any IP address can be used.

If the same IP address is used for host-address1 and host-address2, the effect is the same as using the host command; the identical IP address becomes the single host IP address for the object group.

Use the no form of the command to delete the object group. You cannot delete an object group that is used within an ACL or a Class-Based Policy Language (CPL) policy.

Related Commands

To create an object group to identify traffic coming from a specific user or endpoint, use the object-group security command in global configuration mode. To remove the object group, use the no form of this command.

Syntax Description

Command Default

No object group is defined.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Creating an object group enters object-group identity configuration mode, where a security group can be specified for the object group with a Security Group Tag (SGT) ID. The SGT ID is used by a Security Group Access (SGA) zone-based firewall to apply an enforcement policy by filtering on this SGT ID. The object-group security command is used in the class map configuration of the SGA zone-based firewall.

Note	A policy map must also be configured for the SGA zone-based firewall.