Cisco IOS IPv6 Command Reference

Cisco IOS IPv6 Command Reference

aaa accounting

To enable authentication, authorization, and accounting (AAA) accounting of requested services for billing or security purposes when you use RADIUS or TACACS+, use the aaa accounting command in global configuration mode or template configuration mode. To disable AAA accounting, use the no form of this command.

aaa accounting {auth-proxy | system | network | exec | connection | commands level | dot1x} {default | list-name | guarantee-first} [vrf vrf-name] {start-stop | stop-only | none} [broadcast] {radius | group group-name}

no aaa accounting {auth-proxy | system | network | exec | connection | commands level | dot1x} {default | list-name | guarantee-first} [vrf vrf-name] {start-stop | stop-only | none} [broadcast] {radius | group group-name}

Syntax Description

Defaults

AAA accounting is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

General Information

Use the aaa accounting command to enable accounting and to create named method lists that define specific accounting methods on a per-line or per-interface basis.

Table 1 contains descriptions of keywords for AAA accounting methods.

In Table 1, the group radius and group tacacs+ methods refer to a set of previously defined RADIUS or TACACS+ servers. Use the radius-server host and tacacs-server host commands to configure the host servers. Use the aaa group server radius and aaa group server tacacs+ commands to create a named group of servers.

Cisco IOS software supports the following two methods of accounting:

•RADIUS—The network access server reports user activity to the RADIUS security server in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server.

•TACACS+—The network access server reports user activity to the TACACS+ security server in the form of accounting records. Each accounting record contains accounting AV pairs and is stored on the security server.

Method lists for accounting define the way accounting will be performed. Named accounting method lists enable you to designate a particular security protocol to be used on specific lines or interfaces for particular types of accounting services. Create a list by entering values for the list-name argument where list-name is any character string used to name this list (excluding the names of methods, such as RADIUS or TACACS+) and method list keywords to identify the methods to be tried in sequence as given.

If the aaa accounting command for a particular accounting type is issued without a named method list specified, the default method list is automatically applied to all interfaces or lines (where this accounting type applies) except those that have a named method list explicitly defined. (A defined method list overrides the default method list.) If no default method list is defined, then no accounting takes place.

Note System accounting does not use named accounting lists; you can define the default list only for system accounting.

For minimal accounting, include the stop-only keyword to send a "stop" accounting record for all cases including authentication failures. For more accounting, you can include the start-stop keyword, so that RADIUS or TACACS+ sends a "start" accounting notice at the beginning of the requested process and a "stop" accounting notice at the end of the process. Accounting is stored only on the RADIUS or TACACS+ server. The none keyword disables accounting services for the specified line or interface.

To specify an accounting configuration for a particular VRF, specify a default system accounting method list, and use the vrf keyword and vrf-name argument. System accounting does not have knowledge of VRF unless VRF is specified.

When AAA accounting is activated, the network access server monitors either RADIUS accounting attributes or TACACS+ AV pairs pertinent to the connection, depending on the security method you have implemented. The network access server reports these attributes as accounting records, which are then stored in an accounting log on the security server. For a list of supported RADIUS accounting attributes, see the appendix "RADIUS Attributes" in the Cisco IOS Security Configuration Guide. For a list of supported TACACS+ accounting AV pairs, see the appendix "TACACS+ Attribute-Value Pairs" in the Cisco IOS Security Configuration Guide.

Note This command cannot be used with TACACS or extended TACACS.

Cisco Service Selection Gateway Broadcast Accounting

To configure Cisco Service Selection Gateway (SSG) broadcast accounting, use ssg_broadcast_accounting for the list-name argument. For more information about configuring SSG, see the chapter "Configuring Accounting for SSG" in the Cisco IOS Service Selection Gateway Configuration Guide, Release 12.4.

Layer 2 LAN Switch Port

You must configure the RADIUS server to perform accounting tasks, such as logging start, stop, and interim-update messages and time stamps. To turn on these functions, enable logging of "Update/Watchdog packets from this AAA client" in your RADIUS server Network Configuration tab. Next, enable "CVS RADIUS Accounting" in your RADIUS server System Configuration tab.

You must enable AAA before you can enter the aaa accounting command. To enable AAA and 802.1X (port-based authentication), use the following global configuration mode commands:

•aaa new-model

•aaa authentication dot1x default group radius

•dot1x system-auth-control

Use the show radius statistics command to display the number of RADIUS messages that do not receive the accounting response message.

Use the aaa accounting system default start-stop group radius command to send "start" and "stop" accounting records after the router reboots. The "start" record is generated while the router is booted and the stop record is generated while the router is reloaded.

The router generates a "start" record to reach the AAA server. If the AAA server is not reachable, the router retries sending the packet four times. The retry mechanism is based on the exponential backoff algorithm. If there is no response from the AAA server, the request will be dropped.

Establishing a Session with a Router if the AAA Server Is Unreachable

The aaa accounting system guarantee-first command guarantees system accounting as the first record, which is the default condition. In some situations, users may be prevented from starting a session on the console or terminal connection until after the system reloads, which can take more than three minutes.

To establish a console or telnet session with the router if the AAA server is unreachable when the router reloads, use the no aaa accounting system guarantee-first start-stop radius command.

Note Entering the no aaa accounting system guarantee-first command is not the only condition by which the console or telnet session can be started. For example, if the privileged EXEC session is being authenticated by TACACS and the TACACS server is not reachable, then the session cannot start.

Examples

The following example shows how to define a default command accounting method list, where accounting services are provided by a TACACS+ security server, set for privilege level 15 commands with a stop-only restriction:

aaa accounting commands 15 default stop-only group tacacs+

The following example shows how to defines a default auth-proxy accounting method list, where accounting services are provided by a TACACS+ security server with a start-stop restriction. The aaa accounting command activates authentication proxy accounting.

aaa new-model

aaa authentication login default group tacacs+

aaa authorization auth-proxy default group tacacs+

aaa accounting auth-proxy default start-stop group tacacs+

The following example shows how to define a default system accounting method list, where accounting services are provided by RADIUS security server "server1" with a start-stop restriction. The aaa accounting command specifies accounting for vrf "vrf1."

aaa accounting system default vrf vrf1 start-stop group server1

The following example shows how to define a default IEEE 802.1x accounting method list, where accounting services are provided by a RADIUS server. The aaa accounting command activates IEEE 802.1x accounting.

aaa new model

aaa authentication dot1x default group radius

aaa authorization dot1x default group radius

aaa accounting dot1x default start-stop group radius

The following example shows how to enable network accounting and send tunnel and tunnel-link accounting records to the RADIUS server. (Tunnel-Reject and Tunnel-Link-Reject accounting records are automatically sent if either start or stop records are configured.)

aaa accounting network tunnel start-stop group radius

aaa accounting network session start-stop group radius

The following example shows how to enable IEEE 802.1x accounting:

aaa accounting dot1x default start-stop group radius

aaa accounting system default start-stop group radius

Related Commands

aaa accounting multicast default

To enable authentication, authorization, and accounting (AAA) accounting of IPv6 multicast services for billing or security purposes when you use RADIUS, use the aaa accounting multicast default command in global configuration mode. To disable AAA accounting for IPv6 multicast services, use the no form of this command.

aaa accounting multicast default [start-stop | stop-only] [broadcast] [method1] [method2] [method3] [method4]

no aaa accounting multicast default [start-stop | stop-only] [broadcast] [method1] [method2] [method3] [method4]

Syntax Description

Command Default

AAA accounting for multicast is not enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

Note Including information about IPv6 addresses in accounting and authorization records transmitted between the router and the RADIUS or TACACS+ server is supported. However, there is no support for using IPv6 to communicate with that server. The server must have an IPv4 address.

Use the aaa accounting multicast default command to enable AAA accounting for multicast. The network access server reports user activity to the RADIUS security server in the form of accounting records. Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server.

Method lists for accounting define the way accounting will be performed. Named accounting method lists enable you to designate a particular security protocol to be used on specific lines or interfaces for particular types of accounting services. When using the aaa accounting multicast default command, you have the option of choosing one or all four existing named access lists, each of which specifies a RADIUS host or server group.

If the aaa accounting multicast default command for a particular accounting type is issued without a named method list specified, the default method list is automatically applied to all interfaces or lines (where this accounting type applies) except those that have a named method list explicitly defined. (A defined method list overrides the default method list.) If no default method list is defined, then no accounting takes place.

For minimal accounting, include the stop-only keyword to send a "stop" record accounting notice at the end of the requested user process. For more accounting, you can include the start-stop keyword, so that RADIUS sends a "start" accounting notice at the beginning of the requested process and a "stop" accounting notice at the end of the process. Accounting is stored only on the RADIUS.

When AAA accounting is activated, the network access server monitors RADIUS accounting attributes pertinent to the connection. The network access server reports these attributes as accounting records, which are then stored in an accounting log on the security server. For a list of supported RADIUS accounting attributes, refer to the appendix "RADIUS Attributes" in the Cisco IOS Security Configuration Guide.

Examples

The following example enables AAA accounting of IPv6 multicast services for billing or security purposes when RADIUS is used:

Router(config)# aaa accounting multicast default 

Related Commands

aaa accounting send counters ipv6

To send IPv6 counters in the stop record to the accounting server, use the aaa accounting send counters ipv6 command in global configuration mode. To stop sending IPv6 counters, use the no form of this command.

aaa accounting send counters ipv6

no aaa accounting send counters ipv6

Syntax Description

This command has no arguments or keywords.

Defaults

IPv6 counters in the stop records are not sent to the accounting server.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The aaa accounting send counters ipv6 command sends IPv6 counters in the stop record to the accounting server.

Examples

The following example shows how enable the router to send IPv6 counters in the stop record to the accounting server:

Router(config)# aaa accounting send counters ipv6

aaa accounting send stop-record always

To send a stop record whether or not a start record was sent, use the aaa accounting send stop-record always command in global configuration mode. To disable sending a stop record, use the no form of this command.

aaa accounting send stop-record always

no aaa accounting send stop-record always

Syntax Description

This command has no arguments or keywords.

Command Default

A stop record is not sent.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

When the aaa accounting send stop-record always command is enabled, accounting stop records are sent, even if their corresponding accounting starts were not sent out previously. This command enables stop records to be sent whether local authentication, or other authentication, is configured.

When a session is terminated on a Network Control Protocol (NCP) timeout, a stop record needs to be sent, even if a start record was not sent.

Examples

The following example shows how to enable stop records to be sent always when an NCP timeout occurs, whether or not a start record was sent:

Router(config)# aaa accounting send stop-record always

aaa authentication ppp

To specify one or more authentication, authorization, and accounting (AAA) methods for use on serial interfaces that are running PPP, use the aaa authentication ppp command in global configuration mode. To disable authentication, use the no form of this command.

aaa authentication ppp {default | list-name} method1 [method2...]

no aaa authentication ppp {default | list-name} method1 [method2...]

Syntax Description

Command Default

AAA authentication methods on serial interfaces running PPP are not enabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

If the default list is not set, only the local user database is checked. This has the same effect as that created by the following command:

aaa authentication ppp default local

The lists that you create with the aaa authentication ppp command are used with the ppp authentication command. These lists contain up to four authentication methods that are used when a user tries to log in to the serial interface.

Create a list by entering the aaa authentication ppp list-name method command, where list-name is any character string used to name this list MIS-access. The method argument identifies the list of methods that the authentication algorithm tries in the given sequence. You can enter up to four methods. Method keywords are described in Table 2.

The additional methods of authentication are used only if the previous method returns an error, not if it fails. Specify none as the final method in the command line to have authentication succeed even if all methods return an error.

If authentication is not specifically set for a function, the default is none and no authentication is performed. Use the more system:running-config command to display currently configured lists of authentication methods.

Note In Table 2, the group radius, group tacacs+, and group group-name methods refer to a set of previously defined RADIUS or TACACS+ servers. Use the radius-server host and tacacs+-server host commands to configure the host servers. Use the aaa group server radius and aaa group server tacacs+ commands to create a named group of servers.

Cisco 10000 Series Router

The Cisco 10000 series router supports a maximum of 2,000 AAA method lists. If you configure more than 2,000 AAA method lists, traceback messages appear on the console.

Examples

The following example shows how to create a AAA authentication list called MIS-access for serial lines that use PPP. This authentication first tries to contact a TACACS+ server. If this action returns an error, the user is allowed access with no authentication.

aaa authentication ppp MIS-access group tacacs+ none

Related Commands

aaa authorization

To set the parameters that restrict user access to a network, use the aaa authorization command in global configuration mode. To remove the parameters, use the no form of this command.

aaa authorization {auth-proxy | cache | commands level | config-commands | configuration | console | exec | ipmobile | multicast | network | policy-if | prepaid | radius-proxy | reverse-access | subscriber-service | template} {default | list-name} [method1 [method2...]]

no aaa authorization {auth-proxy | cache | commands level | config-commands | configuration | console | exec | ipmobile | multicast | network | policy-if | prepaid | radius-proxy | reverse-access | subscriber-service | template} {default | list-name} [method1 [method2...]]

Syntax Description

Command Default

Authorization is disabled for all actions (equivalent to the method keyword none).

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the aaa authorization command to enable authorization and to create named methods lists, which define authorization methods that can be used when a user accesses the specified function. Method lists for authorization define the ways in which authorization will be performed and the sequence in which these methods will be performed. A method list is a named list that describes the authorization methods (such as RADIUS or TACACS+) that must be used in sequence. Method lists enable you to designate one or more security protocols to be used for authorization, thus ensuring a backup system in case the initial method fails. Cisco IOS software uses the first method listed to authorize users for specific network services; if that method fails to respond, the Cisco IOS software selects the next method listed in the method list. This process continues until there is successful communication with a listed authorization method, or until all the defined methods are exhausted.

Note The Cisco IOS software attempts authorization with the next listed method only when there is no response from the previous method. If authorization fails at any point in this cycle—meaning that the security server or the local username database responds by denying the user services—the authorization process stops and no other authorization methods are attempted.

If the aaa authorization command for a particular authorization type is issued without a specified named method list, the default method list is automatically applied to all interfaces or lines (where this authorization type applies) except those that have a named method list explicitly defined. (A defined method list overrides the default method list.) If no default method list is defined, then no authorization takes place. The default authorization method list must be used to perform outbound authorization, such as authorizing the download of IP pools from the RADIUS server.

Use the aaa authorization command to create a list by entering the values for the list-name and the method arguments, where list-name is any character string used to name this list (excluding all method names) and method identifies the list of authorization methods tried in the given sequence.

Note In Table 3, the group group-name, group ldap, group radius, and group tacacs+ methods refer to a set of previously defined RADIUS or TACACS+ servers. Use the radius-server host and tacacs-server host commands to configure the host servers. Use the aaa group server radius, aaa group server ldap, and aaa group server tacacs+ commands to create a named group of servers.

Table 3 describes the method keywords.

Cisco IOS software supports the following methods for authorization:

•Cache Server Groups—The router consults its cache server groups to authorize specific rights for users.

•If-Authenticated—The user is allowed to access the requested function provided the user has been authenticated successfully.

•Local—The router or access server consults its local database, as defined by the username command, to authorize specific rights for users. Only a limited set of functions can be controlled through the local database.

•None—The network access server does not request authorization information; authorization is not performed over this line or interface.

•RADIUS—The network access server requests authorization information from the RADIUS security server group. RADIUS authorization defines specific rights for users by associating attributes, which are stored in a database on the RADIUS server, with the appropriate user.

•TACACS+—The network access server exchanges authorization information with the TACACS+ security daemon. TACACS+ authorization defines specific rights for users by associating attribute-value (AV) pairs, which are stored in a database on the TACACS+ security server, with the appropriate user.

Method lists are specific to the type of authorization being requested. AAA supports five different types of authorization:

•Commands—Applies to the EXEC mode commands a user issues. Command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level.

•EXEC—Applies to the attributes associated with a user EXEC terminal session.

•Network—Applies to network connections. The network connections can include a PPP, SLIP, or ARA connection.

Note You must configure the aaa authorization config-commands command to authorize global configuration commands, including EXEC commands prepended by the do command.

•Reverse Access—Applies to reverse Telnet sessions.

•Configuration—Applies to the configuration downloaded from the AAA server.

When you create a named method list, you are defining a particular list of authorization methods for the indicated authorization type.

Once defined, the method lists must be applied to specific lines or interfaces before any of the defined methods are performed.

The authorization command causes a request packet containing a series of AV pairs to be sent to the RADIUS or TACACS daemon as part of the authorization process. The daemon can do one of the following:

•Accept the request as is.

•Make changes to the request.

•Refuse the request and authorization.

For a list of supported RADIUS attributes, see the module RADIUS Attributes. For a list of supported TACACS+ AV pairs, see the module TACACS+ Attribute-Value Pairs.

Note Five commands are associated with privilege level 0: disable, enable, exit, help, and logout. If you configure AAA authorization for a privilege level greater than 0, these five commands will not be included in the privilege level command set.

Examples

The following example shows how to define the network authorization method list named mygroup, which specifies that RADIUS authorization will be used on serial lines using PPP. If the RADIUS server fails to respond, local network authorization will be performed.

aaa authorization network mygroup group radius local 

Related Commands

aaa authorization configuration default

To download static route configuration information from the authorization, authentication, and accounting (AAA) server using TACACS+ or RADIUS, use the aaa authorization configuration default command in global configuration mode. To remove static route configuration information, use the no form of this command.

aaa authorization configuration default {radius | tacacs+}

no aaa authorization configuration default

Syntax Description

Defaults

No configuration authorization is defined.

Command Modes

Global configuration

Command History

Examples

The following example downloads static route information using a TACACS+ server:

aaa authorization configuration default tacacs+

Related Commands

aaa authorization multicast default

To enable authentication, authorization, and accounting (AAA) authorization and set parameters that restrict user access to an IPv6 multicast network, use the aaa authorization multicast default command in global configuration mode. To disable authorization for a function, use the no form of this command.

aaa authorization multicast default [method]

no aaa authorization multicast default [method]

Syntax Description

Command Default

Authorization is disabled for all actions.

Command Modes

Global configuration

Command History

Usage Guidelines

Note Including information about IPv6 addresses in accounting and authorization records transmitted between the router and the RADIUS or TACACS+ server is supported. However, there is no support for using IPv6 to communicate with that server. The server must have an IPv4 address.

Use the aaa authorization multicast default command to enable authorization. Method lists for authorization define the ways authorization will be performed and the sequence in which these methods will be performed. A method list is a named list describing the authorization methods to be used, in sequence. Method lists enable you to designate one or more security protocols to be used for authorization, thus ensuring a backup system in case the initial method fails. Cisco IOS IPv6 software uses the first method listed to authorize users for specific network services; if that method fails to respond, the Cisco IOS IPv6 software selects the next method listed in the method list. This process continues until there is successful communication with a listed authorization method, or all methods defined are exhausted.

Note The Cisco IOS IPv6 software attempts authorization with the next listed method only when there is no response from the previous method. If authorization fails at any point in this cycle—meaning that the security server or local username database responds by denying the user services—the authorization process stops, and no other authorization methods are attempted.

If the aaa authorization multicast default command for a particular authorization type is issued without a named method list specified, the default method list is automatically applied to all lines or interfaces (where this authorization type applies) except those that have a named method list explicitly defined. (A defined method list overrides the default method list.) If no default method list is defined, then no authorization takes place.

Note In Table 3, the group radius and group group-name methods refer to a set of previously defined RADIUS servers. Use the radius-server host command to configure the host servers. Use the aaa group server radius command to create a named group of servers.

Method keywords are described in Table 3.

Cisco IOS IPv6 software supports the following methods for authorization:

•RADIUS—The network access server requests authorization information from the RADIUS security server group. RADIUS authorization defines specific rights for users by associating attributes, which are stored in a database on the RADIUS server, with the appropriate user.

•If-Authenticated—The user is allowed to access the requested function provided the user has been authenticated successfully.

•None—The network access server does not request authorization information; authorization is not performed over this line or interface.

•Local—The router or access server consults its local database, as defined by the username command, to authorize specific rights for users. Only a limited set of functions can be controlled via the local database.

Method lists are specific to the type of authorization being requested. AAA supports the following different types of authorization:

•Network—Applies to network connections. This can include a PPP, Serial Line Internet Protocol (SLIP), or AppleTalk Remote Access (ARA) connection.

•EXEC—Applies to the attributes associated with a user EXEC terminal session.

•Commands—Applies to the EXEC mode commands and user issues. Command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level.

•Reverse Access—Applies to reverse Telnet sessions.

•Configuration—Applies to the configuration downloaded from the AAA server.

The authorization command causes a request packet containing a series of AV pairs to be sent to the RADIUS daemon as part of the authorization process. The daemon can do one of the following:

•Accept the request as is.

•Make changes to the request.

•Refuse the request and refuse authorization.

For a list of supported RADIUS attributes, refer to the appendix "RADIUS Attributes" in the Cisco IOS Security Configuration Guide.

Examples

The following example enables AAA authorization and sets default parameters that restrict user access to an IPv6 multicast network:

Router(config)# aaa authorization multicast default

Related Commands

aaa group server radius

To group different RADIUS server hosts into distinct lists and distinct methods, enter the aaa group server radius command in global configuration mode. To remove a group server from the configuration list, enter the no form of this command.

aaa group server radius group-name

no aaa group server radius group-name

Syntax Description

Defaults

No default behavior or values.

Command Modes

Global configuration

Command History

Usage Guidelines

The authentication, authorization, and accounting (AAA) server-group feature introduces a way to group existing server hosts. The feature enables you to select a subset of the configured server hosts and use them for a particular service.

A group server is a list of server hosts of a particular type. Currently supported server host types are RADIUS server hosts and TACACS+ server hosts. A group server is used in conjunction with a global server host list. The group server lists the IP addresses of the selected server hosts.

Table 5 lists words that cannot be used as the group-name argument.

Examples

The following example shows the configuration of an AAA group server named radgroup1 that comprises three member servers:

aaa group server radius radgroup1 

 server 10.1.1.1 auth-port 1700 acct-port 1701

 server 10.2.2.2 auth-port 1702 acct-port 1703

 server 10.3.3.3 auth-port 1705 acct-port 1706

Note If auth-port and acct-port are not specified, the default value of auth-port is 1645 and the default value of acct-port is 1646.

Related Commands

aaa group server tacacs+

To group different TACACS+ server hosts into distinct lists and distinct methods, use the aaa group server tacacs+ command in global configuration mode. To remove a server group from the configuration list, use the no form of this command.

aaa group server tacacs+ group-name

no aaa group server tacacs+ group-name

Syntax Description

Defaults

No default behavior or values.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The Authentication, Authorization, and Accounting (AAA) Server-Group feature introduces a way to group existing server hosts. The feature enables you to select a subset of the configured server hosts and use them for a particular service.

A server group is a list of server hosts of a particular type. Currently supported server host types are RADIUS server hosts and TACACS+ server hosts. A server group is used in conjunction with a global server host list. The server group lists the IP addresses of the selected server hosts.

Table 5 lists the keywords that cannot be used for the group-name argument value.

Examples

The following example shows the configuration of an AAA server group named tacgroup1 that comprises three member servers:

aaa group server tacacs+ tacgroup1

server 10.1.1.1 

server 10.2.2.2 

server 10.3.3.3 

Related Commands

aaa new-model

To enable the authentication, authorization, and accounting (AAA) access control model, issue the aaa new-model command in global configuration mode. To disable the AAA access control model, use the no form of this command.

aaa new-model

no aaa new-model

Syntax Description

This command has no arguments or keywords.

Command Default

AAA is not enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

This command enables the AAA access control system.

Examples

The following example initializes AAA:

aaa new-model

Related Commands

accept-lifetime

To set the time period during which the authentication key on a key chain is received as valid, use the accept-lifetime command in key chain key configuration mode. To revert to the default value, use the no form of this command.

accept-lifetime start-time {infinite | end-time | duration seconds}

no accept-lifetime [start-time {infinite | end-time | duration seconds}]

Syntax Description

Command Default

The authentication key on a key chain is received as valid forever (the starting time is January 1, 1993, and the ending time is infinite).

Command Modes

Key chain key configuration (config-keychain-key)

Command History

Usage Guidelines

Only DRP Agent, Enhanced Interior Gateway Routing Protocol (EIGRP), and Routing Information Protocol (RIP) Version 2 use key chains.

Specify a start-time value and one of the following values: infinite, end-time, or duration seconds.

We recommend running Network Time Protocol (NTP) or some other time synchronization method if you assign a lifetime to a key.

If the last key expires, authentication will continue and an error message will be generated. To disable authentication, you must manually delete the last valid key.

Examples

The following example configures a key chain named chain1. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and will be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and will be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# interface ethernet 0

Router(config-if)# ip rip authentication key-chain chain1

Router(config-if)# ip rip authentication mode md5

!

Router(config)# router rip

Router(config-router)# network 172.19.0.0

Router(config-router)# version 2

!

Router(config)# key chain chain1

Router(config-keychain)# key 1

Router(config-keychain-key)# key-string key1

Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200

Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600

Router(config-keychain-key)# exit

Router(config-keychain)# key 2

Router(config-keychain)# key-string key2

Router(config-keychain)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200

Router(config-keychain)# send-lifetime 15:00:00 Jan 25 1996 duration 3600

The following example configures a key chain named chain1 for EIGRP address-family. The key named key1 will be accepted from 1:30 p.m. to 3:30 p.m. and be sent from 2:00 p.m. to 3:00 p.m. The key named key2 will be accepted from 2:30 p.m. to 4:30 p.m. and be sent from 3:00 p.m. to 4:00 p.m. The overlap allows for migration of keys or a discrepancy in the set time of the router. There is a 30-minute leeway on each side to handle time differences.

Router(config)# router eigrp virtual-name

Router(config-router)# address-family ipv4 autonomous-system 4453

Router(config-router-af)# network 10.0.0.0

Router(config-router-af)# af-interface ethernet0/0

Router(config-router-af-interface)# authentication key-chain trees

Router(config-router-af-interface)# authentication mode md5

Router(config-router-af-interface)# exit

Router(config-router-af)# exit

Router(config-router)# exit

Router(config)# key chain chain1

Router(config-keychain)# key 1

Router(config-keychain-key)# key-string key1

Router(config-keychain-key)# accept-lifetime 13:30:00 Jan 25 1996 duration 7200

Router(config-keychain-key)# send-lifetime 14:00:00 Jan 25 1996 duration 3600

Router(config-keychain-key)# exit

Router(config-keychain)# key 2

Router(config-keychain-key)# key-string key2

Router(config-keychain-key)# accept-lifetime 14:30:00 Jan 25 1996 duration 7200

Router(config-keychain-key)# send-lifetime 15:00:00 Jan 25 1996 duration 3600

Related Commands

access-group mode

To specify the override modes (for example, VLAN ACL [VACL] overrides Port ACL [PACL]) and the nonoverride modes (for example, merge or strict mode) for an access group, use the access-group mode command in interface configuration mode. To return to preferred port mode, use the no form of this command.

access-group mode {prefer {port | vlan} | merge}

no access-group mode {prefer {port | vlan} | merge}

Syntax Description

Command Default

The default is merge mode.

Command Modes

Interface configuration (config-if)

Command History

Usage Guidelines

On the Layer 2 interface, prefer port, prefer VLAN, and merge modes are supported. A Layer 2 interface can have one IP ACL applied in either direction (one inbound and one outbound).

In Cisco IOS Release 12.2(33)SXI4, prefer port and merge modes are supported on the Layer 2 interface. A Layer 2 interface can have one IPv6 ACL applied in the ingress, or inbound, direction only.

Examples

This example shows how to configure an interface to use prefer port mode:

Router(config-if)# access-group mode prefer port

This example shows how to configure an interface to use merge mode:

Router(config-if)# access-group mode merge

Related Commands

address (IKEv2 keyring)

To specify an IPv4 or IPv6 address or the range of the peer in an Internet Key Exchange Version 2 (IKEv2) keyring, use the address command in IKEv2 keyring peer configuration mode. To remove the IP address, use the no form of this command.

address {ipv4-address [mask] | ipv6-address prefix}

no address

Syntax Description

Command Default

The IP address is not specified.

Command Modes

IKEv2 keyring peer configuration (config-ikev2-keyring-peer)

Command History

Usage Guidelines

Use this command to specify the peer's IP address, which is the IKE endpoint address and independent of the identity address.

Examples

The following examples show how to specify the preshared key of an IP Security (IPsec) peer:

Router(config)# crypto ikev2 keyring keyring1

Router(config-ikev2-keyring)# peer peer1

Router(config-ikev2-keyring-peer)# address 10.0.0.1 255.255.255.0

Router(config)# crypto ikev2 keyring keyring2

Router(config-ikev2-keyring)# peer peer2

Router(config-ikev2-keyring-peer)# address 2001:DB8:0:ABCD::1/2

Related Commands

address (Mobile IPv6)

To specify the home address of the IPv6 mobile node, use the address command in home-agent configuration mode or IPv6 mobile router host configuration mode. To remove a host configuration, use the no form of this command.

address {ipv6-address | autoconfig}

no address

Syntax Description

Command Default

No home address is specified for the mobile router.

Command Modes

Home-agent configuration (config-ha)
IPv6 mobile router host configuration

Command History

Usage Guidelines

The address command in IPv6 home-agent configuration mode specifies the home address of the mobile node. The ipv6-address argument can be used to configure a specific IPv6 address, or the autoconfig keyword can be used to allow any IPv6 address as the home address of the IPv6 mobile node.

Do not configure two separate groups with the same IPv6 address. For example, host group group1 and host group group2 cannot both have the same home address of baba::1.

When the address command is configured with a specific IPv6 address, the nai command, which configures the network address identifier (NAI), cannot be configured using the @realm argument. For example, the following nai command configuration would not be valid because the address command is configured with the specific address baba::1:

host group engineering

  nai  @cisco.com

  address baba::1

Examples

In the following example, the user enters home agent configuration mode, creates a host group named group1, and configures any IPv6 address to be used for the mobile node:

Router(config)# ipv6 mobile home-agent

Router(config-ha)# host group group1

Router(config-ha)# address autoconfig

Related Commands

address ipv6 (TACACS+)

To configure the IPv6 address of the TACACS+ server, use the address ipv6 command in TACACS+ server configuration mode. To remove the IPv6 address, use the no form of this command.

address ipv6 ipv6-address

no address ipv6 ipv6-address

Syntax Description

Command Default

No TACACS+ server is configured.

Command Modes

TACACS+ server configuration (config-server-tacacs)

Command History

Usage Guidelines

Use the address ipv6 (TACACS+) command after you have enabled the TACACS+ server using the tacacs server command.

Examples

The following example shows how to specify the IPv6 address on a TACACS+ server named server1:

Router (config)# tacacs server server1

Router(config-server-tacacs)# address ipv6 2001:0DB8:3333:4::5

Related Commands

address-family (EIGRP)

To enter address-family configuration mode to configure an Enhanced Interior Gateway Routing Protocol (EIGRP) routing instance, use the address-family (EIGRP) command in router configuration mode. To remove the address-family from the EIGRP configuration, use the no form of this command.

EIGRP Autonomous-System Configuration

address-family ipv4 [unicast] vrf vrf-name [autonomous-system autonomous-system-number]

no address-family ipv4 [unicast] vrf vrf-name [autonomous-system autonomous-system-number]

EIGRP Named IPv4 Configuration

address-family ipv4 [multicast] [unicast] [vrf vrf-name] autonomous-system autonomous-system-number

no address-family ipv4 [multicast] [unicast] [vrf vrf-name] autonomous-system autonomous-system-number

EIGRP Named IPv6 Configuration

address-family ipv6 [unicast] [vrf vrf-name] autonomous-system autonomous-system-number

no address-family ipv6 [unicast] [vrf vrf-name] autonomous-system autonomous-system-number

Syntax Description

Command Default

No EIGRP process is running.

Command Modes

Router configuration (config-router)

Command History

Usage Guidelines

The address-family (EIGRP) command is used to configure IPv4 or IPv6 address-family sessions under EIGRP. To leave address-family configuration mode without removing the address family configuration, use the exit-address-family command.

EIGRP Autonomous-System Configuration

Use the router eigrp number command to configure an EIGRP autonomous-system (AS) configuration.

In this configuration, EIGRP VPNs can be configured only under IPv4 address-family configuration mode. A virtual routing and forwarding instance (VRF) and route distinguisher must be defined before the address family session can be created.

It is recommended that you configure an autonomous-system number when the address-family is configured, either by entering the address-family command or the autonomous-system command.

EIGRP Named Configuration

Use the router eigrp virtual-name command to configure an EIGRP named configuration.

In this configuration, EIGRP VPNs can be configured in IPv4 and IPv6 named configurations. A virtual routing and forwarding instance (VRF) and a route distinguisher may or may not be used to create the address-family.

If a VRF is not used in creating the address-family, the EIGRP VPN instance assumes the default route distinguisher and will communicate with the default route distinguisher of other routers in the same network.

EIGRP VPNs can be configured under EIGRP named configurations. A virtual routing and forwarding instance (VRF) and route distinguisher must be defined before the address-family session can be created.

A single EIGRP routing process can support multiple VRFs. The number of VRFs that can be configured is limited only by available system resources on the router, which is determined by the number of VRFs, running processes, and available memory. However, only a single VRF can be supported by each VPN, and redistribution between different VRFs is not supported.

MPLS VPN support between PE and CE routers is configured only on PE routers that provide VPN services over the service provider backbone. The customer site does not require any changes to equipment or configurations to support the EIGRP VPN. A metric must be configured for routes to be advertised to the CE router. The metric can be configured using the redistribute (IP) command or configured with the default-metric (EIGRP) command.

Examples

The following example configures an IPv4 address-family session for the VRF named RED in Cisco IOS releases prior to Cisco IOS Release 15.0(1)M, 12.2(33)SRE, 12.2(33)XNE and Cisco IOS XE Release 2.5:

Router(config)# ip vrf RED 

Router(config-vrf)# rd 1:1 

Router(config-vrf)# exit 

Router(config)# router eigrp 1 

Router(config-router)# address-family ipv4 vrf RED

Router(config-router-af)# autonomous-system 101 

Router(config-router-af)# network 172.16.0.0 

Router(config-router-af)# default-metric 10000 100 255 1 1500 

Router(config-router-af)# exit-address-family 

The following examples configure a single VRF named VRF-RED in Cisco IOS Release 15.0(1)M, 12.2(33)SRE, 12.2(33)XNE and Cisco IOS XE Release 2.5 and later releases:

Router(config)# ip vrf VRF-RED 

Router(config-vrf)# rd 1:1 

Router(config-vrf)# exit 

Router(config)# router eigrp virtual-name

Router(config-router)# address-family ipv4 vrf VRF-RED autonomous-system 1

Router(config-router-af)# network 10.0.0.0 0.0.0.255

Router(config-router-af)# topology base

Router(config-router-topology)# default-metric 10000 100 255 1 1500 

Router(config-router-topology)# exit-af-topology

Router(config-router-af)# exit-address-family

The following example configures a non-VRF address-family in Cisco IOS Release 15.0(1)M, 12.2(33)SRE, 12.2(33)XNE and Cisco IOS XE Release 2.5, and later releases:

Router(config)# router eigrp virtual-name

Router(config-router)# address-family ipv4 autonomous-system 3

Router(config-router-af)# network 10.0.0.0 0.0.0.255

Router(config-router-af)# topology base

Router(config-router-af-topology)# default-metric 10000 100 255 1 1500 

Router(config-router-af- topology)# exit-af-topology

Router(config-router-af)# exit-address-family

Related Commands

address-family ipv4 (BGP)

To enter address family or router scope address family configuration mode to configure a routing session using standard IP Version 4 (IPv4) address prefixes, use the address-family ipv4 command in router configuration or router scope configuration mode. To exit address family configuration mode and remove the IPv4 address family configuration from the running configuration, use the no form of this command.

Syntax Available Under Router Configuration Mode

address-family ipv4 [mdt | multicast | tunnel | unicast [vrf vrf-name] | vrf vrf-name]

no address-family ipv4 [mdt | multicast | tunnel | unicast [vrf vrf-name] | vrf vrf-name]

Syntax Available Under Router Scope Configuration Mode

address-family ipv4 [mdt | multicast | unicast]

no address-family ipv4 [mdt | multicast | unicast]

Syntax Description

Command Default

IPv4 address prefixes are not enabled.

Command Modes

Router configuration (config-router)
Router scope configuration (config-router-scope)

Command History

Usage Guidelines

The address-family ipv4 command replaces the match nlri and set nlri commands. The address-family ipv4 command places the router in address family configuration mode (prompt: config-router-af), from which you can configure routing sessions that use standard IPv4 address prefixes. To leave address family configuration mode and return to router configuration mode, type exit.

Note Routing information for address family IPv4 is advertised by default for each BGP routing session configured with the neighbor remote-as command unless you enter the no bgp default ipv4-unicast command before configuring the neighbor remote-as command.

The tunnel keyword is used to enable the tunnel subaddress family identifier (SAFI) under the IPv4 address family identifier. This SAFI is used to advertise the tunnel endpoints and the SAFI-specific attributes (which contain the tunnel type and tunnel capabilities). Redistribution of tunnel endpoints into the BGP IPv4 tunnel SAFI table occurs automatically when the tunnel address family is configured. However, peers need to be activated under the tunnel address family before the sessions can exchange tunnel information.

The mdt keyword is used to enable the MDT SAFI under the IPv4 address family identifier. This SAFI is used to advertise tunnel endpoints for inter-AS multicast VPN peering sessions.

If you specify address-family ipv4 multicast, you will then specify the network network-number [mask network-mask] command. The network command advertises (injects) the specified network number and mask into the multicast BGP database. This route must exist in the forwarding table installed by an IGP (that is, by eigrp, ospf, rip, igrp, static, or is-is), but not bgp.

In Cisco IOS Release 12.2(33)SRB and later releases, the ability to use address family configuration under the router scope configuration mode was introduced. The scope hierarchy can be defined for BGP routing sessions and is required to support Multi-Topology Routing (MTR). To enter the router scope configuration mode, use the scope command, which can apply globally or for a specific VRF. When using the scope for a specific VRF, only the unicast keyword is available.

Examples

The following example places the router in address family configuration mode for the IPv4 address family:

Router(config)# router bgp 50000

Router(config-router)# address-family ipv4

Router(config-router-af)#

Multicast Example

The following example places the router in address family configuration mode and specifies only multicast address prefixes for the IPv4 address family:

Router(config)# router bgp 50000

Router(config-router)# address-family ipv4 multicast

Router(config-router-af)#

Unicast Example

The following example places the router in address family configuration mode and specifies unicast address prefixes for the IPv4 address family:

Router(config)# router bgp 50000

Router(config-router)# address-family ipv4 unicast

Router(config-router-af)#

VRF Example

The following example places the router in address family configuration mode and specifies cisco as the name of the VRF instance to associate with subsequent IPv4 address family configuration mode commands:

Router(config)# router bgp 50000

Router(config-router)# address-family ipv4 vrf cisco

Router(config-router-af)#

Note Use this form of the command, which specifies a VRF, only to configure routing exchanges between provider edge (PE) and customer edge (CE) devices.

Tunnel Example

The following example places the router in tunnel address family configuration mode:

Router(config)# router bgp 100

Router(config-router)# address-family ipv4 tunnel

Router(config-router-af)#

MDT Example

The following example shows how to configure a router to support an IPv4 MDT address-family session:

Router(config)# router bgp 45000

Router(config-router)# address-family ipv4 mdt

Router(config-router-af)#

Router Scope Configuration Mode Example

The following example shows how to configure the IPv4 address family under router scope configuration mode. In this example, the scope hierarchy is enabled globally. The router enters router scope address family configuration mode, and only multicast address prefixes for the IPv4 address family are specified:

Router(config)# router bgp 50000

Router(config-router)# scope global

Router(config-router-scope)# address-family ipv4 multicast

Router(config-router-scope-af)#

Related Commands

address-family ipv6

To enter address family configuration mode for configuring routing sessions such as Border Gateway Protocol (BGP) that use standard IPv6 address prefixes, use the address-family ipv6 command in router configuration mode. To disable address family configuration mode, use the no form of this command.

address-family ipv6 [vrf vrf-name] [unicast | multicast | vpnv6]

no address-family ipv6 [vrf vrf-name] [unicast | multicast | vpnv6]

Syntax Description

Command Default

IPv6 address prefixes are not enabled. Unicast address prefixes are the default when IPv6 address prefixes are configured.

Note Routing information for address family IPv4 is advertised by default for each BGP routing session configured with the neighbor remote-as command unless you configure the no bgp default ipv4-unicast command before configuring the neighbor remote-as command.

Command Modes

Router configuration

Command History

Usage Guidelines

The address-family ipv6 command places the router in address family configuration mode (prompt: config-router-af), from which you can configure routing sessions that use standard IPv6 address prefixes.

Within address family configuration mode, use the question mark (?) online help function to display supported commands. The BGP commands supported in address family configuration mode configure the same functionality as the BGP commands supported in router configuration mode; however, the BGP commands in router configuration mode configure functionality only for the IPv4 unicast address prefix. To configure BGP commands and functionality for other address family prefixes (for example, the IPv4 multicast or IPv6 unicast address prefixes), you must enter address family configuration mode for those address prefixes using the address-family ipv4 command or the address-family ipv6 command.

Use the multicast keyword to specify an administrative distance for multicast BGP routes to be used in reverse path forwarding (RPF) lookups.

Examples

The following example places the router in address family configuration mode and specifies unicast address prefixes for the IPv6 address family:

Router(config)# router bgp 100

Router(config-router)# address-family ipv6 unicast

The following example places the router in address family configuration mode and specifies multicast address prefixes for the IPv6 address family:

Router(config)# router bgp 100

Router(config-router)# address-family ipv6 multicast

Related Commands

address-family ipv6 (IS-IS)

To enter address family configuration mode for configuring Intermediate System-to-Intermediate System (IS-IS) routing sessions that use standard IPv6 address prefixes, use the address-family ipv6 command in router configuration mode. To reset all IPv6-specific global configuration values to their default values, use the no form of this command.

address-family ipv6 [unicast]

no address-family ipv6 [unicast]

Syntax Description

Command Default

IPv6 address prefixes are not enabled. Unicast address prefixes are the default when IPv6 address prefixes are configured.

Command Modes

Router configuration

Command History

Usage Guidelines

The address-family ipv6 command places the router in address family configuration mode (prompt: config-router-af), from which you can configure IPv6-specific settings. To leave address family configuration mode and return to router configuration mode, enter the exit-address-family command.

Within address family configuration mode, use the question mark (?) online help function to display supported commands. Many of the IS-IS commands supported in address family configuration mode are identical in syntax to IS-IS commands supported in router configuration mode. Note that commands issued in address family configuration mode apply to IPv6 only, while the matching commands in router configuration mode are IPv4-specific.

Examples

The following example places the router in address family configuration mode for IS-IS and specifies unicast address prefixes for the IPv6 address family:

Router(config)# router isis area01

Router(config-router)# address-family ipv6 unicast

address-family ipv4 (OSPFv3)

To enter IPv4 address family configuration mode for Open Shortest Path First version 3 (OSPFv3), use the address-family ipv4 command in OSPFv3 router configuration mode.

address-family ipv4 unicast

Syntax Description

Command Default

Command Modes

OSPFv3 router configuration mode (config-router)

Command History

Usage Guidelines

Use the address-family ipv4 command to configure the IPv4 address family in the OSPFv3 process. Only one address family can be configured per instance. Several IPv4 address family-specific commands are available once you have enabled the address-family ipv4 command and entered IPv4 address family configuration mode.

Examples

The following example enters IPv4 address family configuration mode for OSPFv3:

Router(config-router)#address-family ipv4 unicast 

Router(config-router-af)#

Related Commands

address-family ipv6 (OSPFv3)

To enter IPv6 address family configuration mode for Open Shortest Path First version 3 (OSPFv3), use the address-family ipv6 command in OSPFv3 router configuration mode.

address-family ipv6 unicast

Syntax Description

Command Default

Command Modes

OSPFv3 router configuration mode (config-router)

Command History

Usage Guidelines

Use the address-family ipv6 command to configure the IPv6 address family in the OSPFv3 process. Only one address family can be configured per instance. Several IPv6 address family-specific commands are available once you have enabled the address-family ipv6 command and entered IPv6 address family configuration mode.

Examples

The following example enters IPv6 address family configuration mode for OSPFv3:

Router(config-router)# address-family ipv6 unicast 

Router(config-router-af)#

Related Commands

address-family vpnv6

To place the router in address family configuration mode for configuring routing sessions, such as Border Gateway Protocol (BGP), that use standard VPNv6 address prefixes, use the address-family vpnv6 command in router BGP configuration mode. To disable address family configuration mode, use the no form of this command.

address-family vpnv6 [unicast]

no address-family vpnv6 [unicast]

Syntax Description

Command Default

VPN Version 6 address prefixes are not enabled. Unicast address prefixes are the default when VPN Version 6 address prefixes are configured.

Command Modes

Router BGP configuration

Command History

Usage Guidelines

The address-family vpnv6 command places the router in address family configuration mode, from which you can configure routing sessions that use VPN Version 6 address prefixes. An address family must be configured for each VPN routing/forwarding (VRF) on a provider edge (PE) router. Furthermore, a separate address family must be configured for carrying VPN-IPv6 routes between PE routers.

Examples

The following example places the router in address family configuration mode for the VPN Version 6 address family:

Router(config)# router bgp 100

Router(config-router)# address-family vpnv6

Related Commands

address prefix

To specify an address prefix for address assignment, use the address prefix command in interface configuration mode. To remove the address prefix, use the no form of this command.

address prefix ipv6-prefix [lifetime {valid-lifetime preferred-lifetime | infinite}]

no address prefix

Syntax Description

Command Default

No IPv6 address prefix is assigned.

Command Modes

DHCP pool configuration (config-dhcpv6)

Command History

Usage Guidelines

You can use the address prefix command to configure one or several address prefixes in an IPv6 DHCP pool configuration. Each time the IPv6 DHCP address pool is used, an address will be allocated from each of the address prefixes associated with the IPv6 DHCP pool.

Examples

The following example shows how to configure a pool called engineering with an IPv6 address prefix:

Router(config)# ipv6 dhcp pool engineering

Router(config-dhcpv6)# address prefix 2001:1000::0/64 lifetime infinite

Related Commands

adjacency-check

To allow Intermediate System-to-Intermediate System (IS-IS) IPv6 or IPv4 protocol-support consistency checks performed on hello packets, use the adjacency-check command in address family configuration or router configuration mode. To disable consistency checks on hello packets, use the no form of this command.

adjacency-check

no adjacency-check

Syntax Description

This command has no arguments or keywords.

Command Default

The feature is enabled.

Command Modes

Address family configuration
Router configuration

Command History

Usage Guidelines

IS-IS performs consistency checks on hello packets and will form an adjacency only with a neighboring router that supports the same set of protocols. A router running IS-IS for both IPv4 and IPv6 will not form an adjacency with a router running IS-IS for IPv4 only.

Use the no adjacency-check command in address-family configuration mode to suppress the consistency checks for IPv6 IS-IS and allow an IPv4 IS-IS router to form an adjacency with a router running IPv4 IS-IS and IPv6. IS-IS will never form an adjacency between a router running IPv4 IS-IS only and a router running IPv6 only.

Use the no adjacency-check command in router configuration mode to suppress the IPv4 subnet consistency check and allow IS-IS to form an adjacency with other routers regardless of whether or not they have an IPv4 subnet in common. By default, IS-IS makes checks in hello packets for IPv4 address subnet matching with a neighbor. In multitopology mode, the IPv4 subnet consistency check is automatically suppressed.

Tip Use the debug isis adjacency packets command in privileged EXEC mode to check for adjacency errors. Error messages in the output may indicate where routers are failing to establish adjacencies.

Examples

In the following example, the network administrator wants to introduce IPv6 into an existing IPv4 IS-IS network. To ensure that the checking of hello packet checks from adjacent neighbors is disabled until all the neighbor routers are configured to use IPv6, the network administrator enters the no adjacency-check command.

Router(config)# router isis

Router(config-router)# address-family ipv6

Router(config-router-af)# no adjacency-check

In IPv4, the following example shows that the network administrator wants to introduce IPv6 into an existing IPv4 IS-IS network. To ensure that the checking of hello packet checks from adjacent neighbors is disabled until all the neighbor routers are configured to use IPv6, the network administrator enters the no adjacency-check command.

Router(config)# router isis

Router(config-router-af)# no adjacency-check

aggregate-address

To create an aggregate entry in a Border Gateway Protocol (BGP) database, use the aggregate-address command in address family or router configuration mode. To disable this function, use the no form of this command.

aggregate-address address mask [as-set] [as-confed-set] [summary-only] [suppress-map map-name] [advertise-map map-name] [attribute-map map-name]

no aggregate-address address mask [as-set] [as-confed-set] [summary-only] [suppress-map map-name] [advertise-map map-name] [attribute-map map-name]

Syntax Description

Command Default

The atomic aggregate attribute is set automatically when an aggregate route is created with this command unless the as-set keyword is specified.

Command Modes

Address family configuration (config-router-af)
Router configuration (config-router)

Command History

Usage Guidelines

You can implement aggregate routing in BGP and Multiprotocol BGP (mBGP) either by redistributing an aggregate route into BGP or mBGP, or by using the conditional aggregate routing feature.

Using the aggregate-address command with no keywords will create an aggregate entry in the BGP or mBGP routing table if any more-specific BGP or mBGP routes are available that fall within the specified range. (A longer prefix that matches the aggregate must exist in the Routing Information Base (RIB).) The aggregate route will be advertised as coming from your autonomous system and will have the atomic aggregate attribute set to show that information might be missing. (By default, the atomic aggregate attribute is set unless you specify the as-set keyword.)

Using the as-set keyword creates an aggregate entry using the same rules that the command follows without this keyword, but the path advertised for this route will be an AS_SET consisting of all elements contained in all paths that are being summarized. Do not use this form of the aggregate-address command when aggregating many paths, because this route must be continually withdrawn and updated as autonomous system path reachability information for the summarized routes changes.

Using the as-confed-set keyword creates an aggregate entry using the same rules that the command follows without this keyword. This keyword performs the same function as the as-set keyword, except that it generates autonomous confed set path information.

Using the summary-only keyword not only creates the aggregate route (for example, 192.*.*.*) but also suppresses advertisements of more-specific routes to all neighbors. If you want to suppress only advertisements to certain neighbors, you may use the neighbor distribute-list command, with caution. If a more-specific route leaks out, all BGP or mBGP routers will prefer that route over the less-specific aggregate you are generating (using longest-match routing).

Using the suppress-map keyword creates the aggregate route but suppresses advertisement of specified routes. You can use the match clauses of route maps to selectively suppress some more-specific routes of the aggregate and leave others unsuppressed. IP access lists and autonomous system path access lists match clauses are supported.

Using the advertise-map keyword selects specific routes that will be used to build different components of the aggregate route, such as AS_SET or community. This form of the aggregate-address command is useful when the components of an aggregate are in separate autonomous systems and you want to create an aggregate with AS_SET, and advertise it back to some of the same autonomous systems. You must remember to omit the specific autonomous system numbers from the AS_SET to prevent the aggregate from being dropped by the BGP loop detection mechanism at the receiving router. IP access lists and autonomous system path access lists match clauses are supported.

Using the attribute-map keyword allows attributes of the aggregate route to be changed. This form of the aggregate-address command is useful when one of the routes forming the AS_SET is configured with an attribute such as the community no-export attribute, which would prevent the aggregate route from being exported. An attribute map route map can be created to change the aggregate attributes.

Examples

AS-Set Example

In the following example, an aggregate BGP address is created in router configuration mode. The path advertised for this route will be an AS_SET consisting of all elements contained in all paths that are being summarized.

Router(config)# router bgp 50000 

Router(config-router)# aggregate-address 10.0.0.0 255.0.0.0 as-set 

Summary-Only Example

In the following example, an aggregate BGP address is created in address family configuration mode and applied to the multicast database under the IP Version 4 address family. Because the summary-only keyword is configured, more-specific routes are filtered from updates.

Router(config)# router bgp 50000 

Router(config-router)# address-family ipv4 multicast 

Router(config-router-af)# aggregate-address 10.0.0.0 255.0.0.0 summary-only 

Conditional Aggregation Example

In the following example, a route map called MAP-ONE is created to match on an AS-path access list. The path advertised for this route will be an AS_SET consisting of elements contained in paths that are matched in the route map.

Router(config)# ip as-path access-list 1 deny ^1234_ 

Router(config)# ip as-path access-list 1 permit .* 

Router(config)# ! 

Router(config)# route-map MAP-ONE 

Router(config-route-map)# match ip as-path 1 

Router(config-route-map)# exit 

Router(config)# router bgp 50000 

Router(config-router)# address-family ipv4 

Router(config-router-af)# aggregate-address 10.0.0.0 255.0.0.0 as-set advertise-map 
MAP-ONE 

Router(config-router-af)# end 

Related Commands

allow-connections

To allow connections between specific types of endpoints in a VoIP network, use the allow-connections command in voice service configuration mode. To refuse specific types of connections, use the no form of this command.

allow-connections from-type to to-type

no allow-connections from-type to to-type

Syntax Description

Command Default

Cisco IOS Release 12.3(4)T, Cisco IOS Release 12.3, and Earlier Releases

H.323-to-H.323 connections are enabled by default and cannot be changed, and POTS-to-any and any-to-POTS connections are disabled.

Cisco IOS Release 12.3(7)T and Later Releases

H.323-to-H.323 connections are disabled by default and can be changed, and POTS-to-any and any-to-POTS connections are enabled.

H.323-to-SIP Connections

H.323-to-SIP and SIP-to-H.323 connections are disabled by default, and POTS-to-any and any-to-POTS connections are enabled.

SIP-to-SIP Connections

SIP-to-SIP connections are disabled by default, and POTS-to-any and any-to-POTS connections are enabled.

Command Modes

Voice-service configuration (config-voi-serv)

Command History

Usage Guidelines

Cisco IOS Release 12.3(4)T, Cisco IOS Release 12.3, and Earlier Releases

This command is used to allow connections between specific types of endpoints in a Cisco multiservice IP-to-IP gateway. The command is enabled by default and cannot be changed. Connections to or from POTS endpoints are not allowed. Only H.323-to-H.323 connections are allowed.

Cisco IOS Release 12.3(7)T and Later Releases

This command is used with Cisco Unified Communications Manager Express 3.1 or later systems and with the Cisco Multiservice IP-to-IP Gateway feature. In Cisco Unified Communications Manager Express, the allow-connections command enables the VoIP-to-VoIP connections used for hairpin call routing or routing to an H.450 tandem gateway.

Examples

The following example specifies that connections between H.323 and SIP endpoints are allowed:

Router(config-voi-serv)# allow-connections h323 to sip

The following example specifies that connections between H.323 endpoints are allowed:

Router(config-voi-serv)# allow-connections h323 to h323

The following example specifies that connections between SIP endpoints are allowed:

Router(config-voi-serv)# allow-connections sip to sip

Related Commands

anat

To enable Alternative Network Address Types (ANAT) on a Session Initiation Protocol (SIP) trunk, use the anat command in voice service SIP configuration mode or dial peer configuration mode. To disable ANAT on SIP trunks, use the no form of this command.

anat

no anat

Syntax Description

This command has no arguments or keywords.

Command Default

ANAT is enabled on SIP trunks.

Command Modes

Voice service voip-sip configuration (conf-serv-sip)
Dial peer configuration (config-dial-peer)

Command History

Usage Guidelines

Both the Cisco IOS SIP gateway and the Cisco Unified Border Element are required to support Session Description Protocol (SDP) ANAT semantics for SIP IPv6 sessions. SDP ANAT semantics are intended to address scenarios that involve different network address families (for example, different IP versions). Media lines grouped using ANAT semantics provide alternative network addresses of different families for a single logical media stream. The entity creating a session description with an ANAT group must be ready to receive or send media over any of the grouped "m" lines.

By default, ANAT is enabled on SIP trunks. However, if the SIP gateway is configured in IPv4-only or IPv6-only mode, the gateway will not use ANAT semantics in its SDP offer.

Examples

The following example enables ANAT on a SIP trunk:

Router(conf-serv-sip)# anat

area (IPv6 address family configuration)

To configure Open Shortest Path First version 3 (OSPFv3) area parameters, use the area command in IPv6 address family configuration mode or IPv4 address family configuration mode. To remove this configuration, use the no form of this command.

area area-ID range ipv6-prefix/prefix-length

Syntax Description

Command Default

This command is disabled by default.

Command Modes

IPv6 address family configuration (config-router-af)

Command History

Usage Guidelines

Use the area command in IPv6 or IPv4 address family configuration mode to configure OSPFv3 area parameters for an IPv6 or an IPv4 process.

Examples

The following example summarizes routes on the border router with the 2001:DB8:0:0::0/128 address:

Router(config-router)# address-family ipv6 unicast 

Router(config-router-af)# area 1 range 2001:DB8:0:0::0/128

Related Commands

area (OSPFv3 router configuration)

To configure the Open Shortest Path First version 3 (OSPFv3) area, use the area command in OSPFv3 router configuration mode. To remove this configuration, use the no form of this command.

area area-ID [default-cost | nssa | stub]

Syntax Description

Command Default

This command is not enabled by default.

Command Modes

OSPFv3 router configuration mode (config-router)

Command History

Usage Guidelines

Use the area command in OSPFv3 router configuration mode to configure OSPFv3 parameters for an IPv4 OSPFv3 process.

Examples

The following example configures OSPFv3 area 1:

Router(config-router)# area 1

Related Commands

area authentication (IPv6)

To enable authentication for an Open Shortest Path First (OSPF) area, use the area authentication command in router configuration mode. To remove an authentication specification of an area or a specified area from the configuration, use the no form of this command.

area area-id authentication ipsec spi spi {md5 | sha1} [key-encryption-type] key

no area area-id authentication ipsec spi spi

Syntax Description

Command Default

Key encryption type 0: key is not encrypted.

Command Modes

Router configuration

Command History

Usage Guidelines

Ensure that the same policy (the SPI and the key) is configured on all of the interfaces on the link. SPI values may be automatically used by other client applications, such as tunnels.

The policy database is common to all client applications on a box. This means that two IPSec clients, such as OSPF and a tunnel, cannot use the same SPI. Additionally, an SPI can only be used in one policy.

Beginning with Cisco IOS Release 12.4(4)T, the sha-1 keyword can be used to choose SHA-1 authentication instead of entering the md5 keyword to use MD5 authentication. The SHA-1 algorithm is considered to be somewhat more secure than the MD5 algorithm, and requires a 40 hex digit (20-byte) key rather than the 32 hex digit (16-byte) key that is required for MD5 authentication.

Examples

The following example enables authentication for the OSPF area 1:

area 1 authentication ipsec spi 678 md5 1234567890ABCDEF1234567890ABCDEF

The following example enables SHA-1 authentication for the OSPF area 0:

area 0 authentication ipsec spi 1000 sha1 1234567890123456789012345678901234567890

area encryption

To enable encryption for an Open Shortest Path First (OSPF) area, use the area encryption command in router configuration mode. To remove an encryption specification of an area or a specified area from the configuration, use the no form of this command.

area area-id encryption ipsec spi spi esp encryption-algorithm [[key-encryption-type] key] authentication-algorithm [key-encryption-type] key

no area area-id encryption ipsec spi spi

Syntax Description

Command Default

Authentication and encryption are not enabled.

Command Modes

Router configuration

Command History

Usage Guidelines

When the area encryption command is enabled, both authentication and encryption are enabled. However, when you use an encryption command such as area encryption, you may not also use an authentication command (such as area authentication or area virtual-link authentication) at the same time.

In IPv6, security is implemented using two IPv6 extension headers—the authentication header (AH) and ESP header. AH is used to provide connectionless integrity and data origin authentication for IPv6 datagrams, whereas ESP is used to provide confidentiality, connectionless integrity, data origin authentication, an antireplay service, and limited traffic flow confidentiality.

In OSPF for IPv6, authentication fields have been removed from OSPF packet headers. OSPF for IPv6 relies on the IPv6 extension headers, AH and ESP, to ensure integrity, authentication, and confidentiality of routing exchanges.

Examples

The following example provides ESP with no encryption and enables MD5 authentication on OSPF area 1:

Router(config-rtr)# area 1 encryption ipsec spi 500 esp null md5 
1aaa2bbb3ccc4ddd5eee6fff7aaa8bbb

Related Commands

area range

To consolidate and summarize routes at an area boundary, use the area range command in router configuration mode. To disable this function, use the no form of this command.

area area-id range ipv6-prefix /prefix-length [advertise | not-advertise] [cost cost]