FiberstoreOS. VPN Command Line Reference

Size: px

Start display at page:

Download "FiberstoreOS. VPN Command Line Reference"

Debra Mills
5 years ago
Views:

1 FiberstoreOS VPN Command Line Reference

2 Contents 1 VRF Commands ip vrf show ip vrf ip vrf forwarding ip route vrf arp vrf show ip arp vrf clear ip arp vrf ping vrf traceroute vrf telnet vrf rd route-target import map export map router-id description interface Tunnel mode gre tunnel source tunnel destination tunnel enable tunnel gre key tunnel dscp keepalive show interface tunnel show resource tunnel show tunnel keepalive statistics clear tunnel keepalive statistics Clear tunnel statistics... 22

3 1 VRF Commands 1.1 ip vrf To configure a VPN routing and forwarding (VRF) routing table, use the ip vrf command in global configuration mode. To remove a VRF routing table, use the no form of this command. ip vrf VRF-NAME no ip vrf VRF-NAME VRF-NAME VPN Routing/Forwarding instance name Global Configuration 1.2 show ip vrf Switch(config)# ip vrf ComA Switch(config-vrf)# route-target both 100:2 Switch(config-vrf)# route-target import 200:1 ip vrf forwarding To show the set of defined VRFs and assocaited interfaces, use the show ip vrf command in Privileged EXEC mode. show ip vrf (bgp (brief detail) interfaces ospf rip VRF-NAME) bgp interfaces Border Gateway Protocol (BGP) Show VPN Routing/Forwarding interface information 1

4 ospf rip VRF-NAME brief detail Open Shortest Path First (OSPF) Routing Information Protocol (RIP) VPN Routing/Forwarding instance name Brief VPN Routing/Forwarding instance information Detailed VPN Routing/Forwarding instance information Privileged EXEC Switch# show ip vrf 1.3 ip vrf forwarding To associate a VPN routing and forwarding (VRF) instance with an Layer3 interface, use the ip vrf forwarding command in interface configuration mode. To disassociate a VRF, use the no form of this command. ip vrf forwarding VRF-NAME no ip vrf forwarding VRF-NAME VRF-NAME VPN Routing/Forwarding instance name Interface configuration Executing this command on an interface removes the IP address on this interface, The IP address should be reconfigured. Switch# configure terminal Switch(config)# ip vrf ComA Switch(config-vrf)# exit 2

5 Switch(config)# interface eth-0-1 Switch(config-if)# no switchport Switch(config-if)# ip vrf forwarding ComA ip vrf ip route vrf 1.4 ip route vrf To establish static routes for a VPN routing and forwarding (VRF) instance, use the ip route vrf command in global configuration mode. To disable static routes, use the no form of this command. ip route vrf VRF-NAME DST_NET NH_ADDR no ip route vrf VRF-NAME DST_NET NH_ADDR VRF-NAME DST_NET NH_ADDR VPN Routing/Forwarding instance name Destination IP subnet, the format can be target IP address with masklen(a.b.c.d/m) or target IP addres with netmask (A.B.C.D A.B.C.D) Next-hop IP address, the format should be A.B.C.D Global Configuration Switch(config)# ip route vrf VPN-NAME / show ip route vrf 1.5 arp vrf To add a permanent entry in the Address Resolution Protocol (ARP) cache for VRF, use the arp vrf command in global configuration mode. To remove an entry from VRF ARP cache, enter the no form of this command. arp vrf VRF_NAME A.B.C.D MAC no arp vrf VRF_NAME A.B.C.D 3

6 VRF-NAME A.B.C.D MAC VPN Routing/Forwarding instance name IP address of the ARP entry Hardware address of the ARP entry in HHHH.HHHH.HHHH format Global Configuration 1.6 show ip arp vrf Switch# configure terminal Switch(config)# arp vrf vpn show ip arp vrf VRF-NAME clear ip arp vrf VRF-NAME A.B.C.D Use this command to show arp entry in VRF instance. show ip arp vrf VRF-NAME VRF-NAME VPN Routing/Forwarding instance name Privileged EXEC This example shows how to display all arp entry in the arp table of the VRF. Swith# show ip arp vrf ComA Protocol Address Age (min) Hardware Addr Interface Internet

7 arp vrf 1.7 clear ip arp vrf Use this command to refresh a specific dynamic ARP entry from ARP cache for the VRF. clear ip arp vrf VRF-NAME A.B.C.D VRF-NAME A.B.C.D VPN Routing/Forwarding instance name Dynamic learned ARP entry IP address 1.8 ping vrf Privileged EXEC This example shows how to refresh a dynamic arp entry in VRF. Switch(config)# clear ip arp vrf ComA arp vrf Use this command to ping address in VRF. ping vrf VRF-NAME WORD VRF-NAME WORD VPN Routing/Forwarding instance name Ping destination address or hostname Privileged EXEC 5

8 Switch# ping vrf vpn PING ( ) 56(84) bytes of data. 64 bytes from : icmp_seq=0 ttl=64 time=0.114 ms 64 bytes from : icmp_seq=1 ttl=64 time=0.087 ms 64 bytes from : icmp_seq=2 ttl=64 time=0.087 ms 64 bytes from : icmp_seq=3 ttl=64 time=0.097 ms 64 bytes from : icmp_seq=4 ttl=64 time=0.133 ms ping statistics packets transmitted, 5 received, 0% packet loss, time 4041ms rtt min/avg/max/mdev = 0.087/0.103/0.133/0.020 ms, pipe traceroute vrf Use this command to trace route in VRF. traceroute vrf VRF-NAME WORD VRF-NAME WORD VPN Routing/Forwarding instance name Trace route destination address or hostname Privileged EXEC Switch# traceroute vrf vpn traceroute to ( ), 30 hops max, 38 byte packets ( ) ms ms ms 1.10 telnet vrf Use this command to telnet in VRF. telnet vrf VRF-NAME WORD VRF-NAME VPN Routing/Forwarding instance name 6

9 WORD The destination address or hostname for telnet Privileged EXEC Switch# telnet vrf vpn Trying Connected to Escape character is '^]'. Fedora Core release 4 (Stentz) Kernel on an i686 login: root Password: 1.11 rd Use this command to set route distinguisher. rd RD-VALUE RD-VALUE Route distinguisher value. ASN:nn or IP-address:nn VRF Mode Switch(config-vrf)# rd :1 7

10 1.12 route-target Use this command to set route target. route-target ( both export import) RT-VALUE both export import RT-VALUE Import and export Export Import Route-target value. ASN:nn or IP-address:nn VRF Mode Switch(config-vrf)# route-target import 100: import map Use this command to set import map. import map WORD WORD Pointer to route-map entries VRF Mode Switch(config-vrf)# import map 100 8

11 export map 1.14 export map Use this command to set export map. export map WORD WORD Pointer to route-map entries VRF Mode Switch(config-vrf)# export map 100 import map 1.15 router-id Use this command to set router-id. router-id A.B.C.D A.B.C.D Router identifier in IP address format VRF Mode Switch(config-vrf)# router-id

12 show ip vrf 1.16 description Use this command to specific VRF description. description LINE LINE Characters describing this VRF, the name length should be no more than 40 VRF Mode Switch(config-vrf)# description VrfName1 show ip vrf 10

13 2 GRE TUNNEL Commands 2.1 interface Using this command to create a new tunnel interface. Use the no form of this command to destroy the tunnel interface. interface tunnel tunneled no interface tunnel tunneled tunnelid tunnel id,range is 0~1023 Global Configuration It just creates an interface structure, and then the gre tunnel interface can not be used before it is configured the mode. This example shows how to create a tunnel interface. Switch# configure terminal Switch(config)# interface tunnel 1 11

14 show interface tunnel 2.2 Tunnel mode gre This cammad is used for specifying the IPv4 transition tunnel protocol of gre, and the no form of this command can unset the tunnel protocol. tunnel mode gre no tunnel mode gre The tunnel mode is gre, that is generic routing encapsulation. Now, it supports IPv4 gre tunnel, the playload packet should be IPv4 packet. Interface Configuration When configure the tunnel mode with gre, and then it is required configure tunnel source and tunnel destination manually. This example shows how to create a 6to4 Tunnel Switch# configure terminal S witch(config)# interface tunnel 1 Switch(config-if)# tunnel mode gre tunnel source 12

15 tunnel destination 2.3 tunnel source This command is used to specify the tunnel source. Use the no form of this command to unset the tunnel source. tunnel source (A.B.C.D IFNAME) no tunnel source A.B.C.D IFNAME specify a tunnel source in the IPv4 address format specify a tunnel source in the IFNAME format, the IFNAME should be layer3 interface, like routed port, vlan interface, loopback.. Interface Configuration Every tunnel must have a tunnel source. If users specify the IFNAME format, system will choose the primary address as tunnel source This example shows how to set the tunnel source. Switch# configure terminal Switch(config)# interface tunnel 1 Switch(config-if)# tunnel source

16 2.4 tunnel destination Use this command to specify a tunnel destination address in an IPv4 portion. Use the no parameter to un-specify the address. tunnel destination A.B.C.D no tunnel destination A.B.C.D Specify the tunnel destination IPv4 address Interface Configuration this example shows how to set the tunnel destination. Switch# configure terminal Switch(config)# interface tunnel 1 Switch(config-if)# tunnel destination tunnel source 14

17 2.5 tunnel enable Use this command to enable tunnel decapsulation for interfaces. Use the form of this command to restore the default configuration. tunnel (enable disable) Interface Configuration by default, tunnel decapsulation is disabled on all interfaces. This example shows how to enable tunnel decapsulation on interface eth-0-1. Switch# configure terminal Switch(config)# interface eth-0-1 Switch(config-if)# tunnel enable Interface 2.6 tunnel gre key Use this command to set the key of gre tunnel. Use the form of this command to unset the key of gre tunnel. 15

18 tunnel gre key key_value no tunnel gre key key_value < > Interface Configuration. Gre key is taken advantage of certification of packet and provides the security of gre tunnel. Only the gre tunnel packet with the matched key. Gre key can support 32bits, but can not support to set 0. This example shows how to set gre key. Switch# configure terminal Switch(config)# interface tunnel 1 Switch(config-if)# tunnel gre key 666 no tunnel gre key 2.7 tunnel dscp Use this command to specify a value of Differentiated Services Code Point (DSCP) in the tunnel IPv4 encapsulation header. Use the no parameter to inheriting the underlying physical interface value by default. 16

19 tunnel dscp DSCP no tunnel dscp DSCP The outer IPv4 header DSCP value, range is 0~63 Interface Configuration By default, the DSCP value is inherited from original IPv6 packet.. This example shows how to set the outer IPv4 header DSCP value as 40. Switch# configure terminal Switch(config)# interface tunnel 1 Switch(config-if)# tunnel dscp 40 interface 2.8 keepalive Use this command to enable function of keepalive, it is used for checking whether gre tunnel peers is up or reachable. keepalive period_value retry_value 17

20 no keepalive period_value Interval period < > Retry_value timeout and retry <1-255> Interface Configuration period_value: 10s. retry_value:3 Only when the gre tunnel is in the state of up or keepalive down, then the keepalive packets can be sent out through the network port. This example shows how to set the outer IPv4 header DSCP value as 40. Switch# configure terminal Switch(config)# interface tunnel 1 Switch(config-if)# keepalive 10 5 no keepalive 2.9 show interface tunnel Use this command to display the tunnel information. show interface tunnel tunnelid 18

21 tunnelid The id range should be 0~1023 Privileged EXEC. This example displays the tunnel information. Switch# show interface tunnel1 Interface tunnel1 Interface current state: UP Hardware is Tunnel Index 8193, Metric 1, Encapsulation TUNNEL VRF binding: not bound Internet primary address: /24 pointopoint Tunnel protocol/transport GRE/IP, Status Valid Tunnel source (eth-0-10), destination Tunnel DSCP inherit, Tunnel TTL 255 Tunnel GRE key enable: 100 Tunnel GRE keepalive disable 0 packets input, 0 bytes 0 packets output, 0 bytes show resource tunnel 2.10 show resource tunnel Use this command to display the tunnel peers resource information. 19

22 show resource tunnel Privileged EXEC. This example displays the tunnel peers resource information. Switch# show resource tunnel Tunnel Resource Used Capability ============================================================= Peers 3 8 interface 2.11 show tunnel keepalive statistics Use this command to display the statistics of gre tunnel keepalive. show tunnel keepalive statistics ( interface tunnel id) Privileged EXEC 20

23 . This example displays the statistics of gre tunnel keepalive. Switch# show tunnel keepalive statistics Name Status Keepalive Out_ka_pkt In_ka_pkt TunnelUp TunnelDown tunnel1 Up Enable tunnel2 Up Disable Clear tunnel keepalive statistics 2.12 clear tunnel keepalive statistics Use this command to clear the statistics of gre tunnel keepalive. clear tunnel keepalive statistics (all interface tunnel id) Privileged EXEC. 21

24 This example clears the statistics of gre tunnel keepalive. Switch# clear tunnel keepalive statistics all show tunnel keepalive statistics 2.13 Clear tunnel statistics Use this command to clear the statistics of tunnel include input and output. clear tunnel statistics (all interface tunnel id) Privileged EXEC. This example clears the statistics of tunnel include input and output. Switch# clear tunnel statistics all show interface tunnel id 22

FSOS VPN Command Line Reference

FSOS VPN Command Line Reference Contents 1 VRF Commands...3 1.1 ip vrf...3 1.2 show ip vrf... 4 1.3 ip vrf forwarding... 5 1.4 ip route vrf...6 1.5 arp vrf...7 1.6 show ip arp vrf... 9 1.7 clear ip arp