|
|
To control the number of login attempts that can be made on a line set up for TACACS verification, use the tacacs-server attempts global configuration command. To remove this feature and restore the default, use the no form of this command.
tacacs-server attempts count| count | Integer that sets the number of attempts. |
Three attempts
Global configuration
Refer to the LightStream 1010 ATM Switch User Guide for more information about the tacacs-server attempts global configuration command.
The following example changes the login attempt to just one try.
Switch# tacacs-server attempts 1
To send only a username to a specified TACACS server when a direct request is issued, use the tacacs-server directed-request global configuration command. To disable the direct-request feature, use the no form of this command.
tacacs-server directed-requestThis command has no keyword or arguments.
Disabled
Global configuration
This command sends only the portion of the username before the "@" symbol to the host specified after the "@" symbol. With the directed-request feature enabled, you can direct a request to any of the configured servers, and only the username is sent to the specified server.
Disabling tacacs-server directed-request causes the entire string, both before and after the "@" symbol, to be sent to the default TACACS server. When the directed-request feature is disabled, the switch queries the list of servers, starting with the first one in the list, sending the entire string, and accepting the first response that it gets from the server. The tacacs-server directed-request command is useful when you want to develop your own TACACS server software that parses the whole string and makes decisions based on the output.
When tacacs-server directed-request is enabled, only configured TACACS servers can be specified by the user after the "@" symbol. If the host name specified by the user does not match the IP address of a TACACS server configured by the administrator, the user input is rejected.
Use the no form of this command to disable the ability of the user to choose between configured TACACS servers and to cause the entire string to be passed to the default server.
The following example disables directed-request so that the entire user input is passed to the default TACACS server.
Switch(config)# no tacacs-server directed-request
To enable IP DNS alias lookup for TACACS+, use the tacacs dns-alias-lookup global configuration command. To disable this feature, use the no form of this command.
tacacs dns-alias-lookupThis command has no keywords or arguments.
Disabled
Global Configuration
This command enables IP Domain Name System alias lookup for TACACS servers.
To enable extended TACACS mode, use the tacacs-server extended global configuration command. To disable the mode, use the no form of this command.
tacacs-server extendedThis command has no arguments or keywords.
Disabled
Global configuration
Refer to the LightStream 1010 ATM Switch User Guide for more information about the tacacs-server extended global configuration command.
The following example enables extended TACACS mode.
Switch(config)# tacacs-server extended
To specify a TACACS host, use the tacacs-server host global configuration command. You can use multiple tacacs-server host commands to specify multiple hosts. The software searches for the hosts in the order you specify them. To delete the specified name or address, use the no form of this command.
tacacs-server host name| name | Name or IP address of the host. |
No TACACS host is specified.
Global configuration
Refer to the LightStream 1010 ATM Switch Configuration Guide for more information about the tacacs-server host global configuration command.
The following example specifies a TACACS host named SCACAT.
Switch(config)# tacacs-server host SCACAT
aaa authentication ppp
login
slip
To set the authentication/encryption key used for all TACACS+ communications between the access server and the TACACS+ daemon, use the tacacs-server key global configuration command. To disable the key, use the no form of the command.
tacacs-server key key| key | Key used to set authentication and encryption. This key must match the key used on the TACACS+ daemon. |
Disabled
Global configuration
After enabling AAA with the aaa new-model command, you must set the authentication and encryption key using the tacacs-server key command.
The key entered must match the key used on the TACACS+ daemon. All leading spaces are ignored; spaces within and at the end of the key are not. If you use spaces in your key, do not enclose the key in quotation marks unless the quotation marks themselves are part of the key.
The following example shows how to set the authentication and encryption key to "dare to go".
Switch(config)# tacacs-server key dare to go
aaa new-model
tacacs-server host
To cause the network server to request the privileged password as verification or to force successful login without further input from the user, use the tacacs-server last-resort global configuration command. To restore the system to the default behavior, use the no form of this command.
tacacs-server last-resort {password | succeed}| password | Allows the user to access the EXEC command mode by entering the password set by the enable command. |
| succeed | Allows the user to access the EXEC command mode without further question. |
If, when running the TACACS server, the TACACS server does not respond, the default action is to deny the request.
Global configuration
Use the tacacs-server last-resort command to be sure that login can occur; for example, a systems administrator must log in to troubleshoot TACACS servers that might be down.
Refer to the LightStream 1010 ATM Switch User Guide for more information about the tacacs-server last-resort global configuration command.
The following example forces successful login.
Switch(config)# tacacs-server last-resort succeed
To specify that the first TACACS request to a TACACS server be made without password verification, use the tacacs-server optional-passwords global configuration command. To restore the default, use the no form of this command.
tacacs-server optional-passwordsThis command has no arguments or keywords.
Disabled
Global configuration
When the user enters the login name, the login request is transmitted with the name and a zero-length password. If accepted, the login procedure completes. If the TACACS server refuses this request, the server software prompts for a password and tries again when the user supplies a password. The TACACS server must support authentication for users without passwords to make use of this feature. This feature supports all TACACS requests--login, SLIP, enable, and so on.
Refer to the LightStream 1010 ATM Switch Configuration Guide for more information about the tacacs-server optional-passwords global configuration command.
The following example configures the first login to not require TACACS verification.
Switch(config)# tacacs-server optional-passwords
To specify the number of times the switch software searches the list of TACACS server hosts before giving up, use the tacacs-server retransmit global configuration command. The switch software tries all servers, allowing each one to timeout before increasing the retransmit count. To restore the default, use the no form of this command.
tacacs-server retransmit retries| retries | Integer that specifies the retransmit count. |
Two retries
Global configuration
Refer to the LightStream 1010 ATM Switch Configuration Guide for more information about the tacacs-server retransmit global configuration command.
The following example specifies a retransmit counter value of 5.
Switch(config)# tacacs-server retransmit 5
To set the interval that the server waits for a server host to reply, use the tacacs-server timeout global configuration command. To restore the default, use the no form of this command.
tacacs-server timeout seconds| seconds | Integer that specifies the timeout interval in seconds. |
5 seconds
Global configuration
Refer to the LightStream 1010 ATM Switch Configuration Guide for more information about the tacacs-server timeout global configuration command.
The following example changes the interval timer to 10 seconds.
Switch(config)# tacacs-server timeout 10
| optimistic | Tag binding is returned immediately and packets are discarded until the downstream setup is complete. |
| conservative | Waits until the tag VC is set up downstream before returning a tag binding. |
Conservative
Global configuration
The following example sets the mode for handling binding requests to optimistic on TC ATM interfaces.
Switch#configure terminalSwitch(config)#tag-switching atm allocation-mode optimistic
To configure the VPI/VCI to be used for the initial link to the tag switching peer, use the tag-switching atm control-vc interface configuration command. This control VC is used to establish the TDP session and carry non-IP traffic. To set the control VPI/VCI to the default, use the no form of this command.
tag-switching atm control-vc vpi vci| vpi | Virtual path identifier, in the range of 0 to 255. |
| vci | Virtual channel identifier, in the range of 1 to 65535. |
0/32
Interface configuration
On a VP tunnel, the default VPI is the tunnel number and the default VCI is 32.
The following example shows how to select VPI 1 and VCI 34 as the control VC.
Switch(config)#interface atm 4/0/1Switch(config-if)# tag-switching ip Switch(config-if)#tag-switching atm control-vc 1 34
To control whether VC-merge (multipoint-to-point VCs) is supported for unicast tag VCs, use the tag-switching atm vc-merge global configuration command. To disable this feature, use the no form of this command.
tag-switching atm vc-mergeThis command has no keywords or arguments.
Enabled.
Global configuration
Since the default mode is to enable VC merge, it is not necessary to issue the tag-switching atm vc-merge command. However to disable VC merge, you must enter the no form of the command.
Switch(config)# no tag-switching atm vc-merge
show tag-switching atm-tdp bindings
show tag-switching atm-tdp capability
| vpi | Low end of the VPI range (1 to 255). |
| - vpi | High end of the VPI range (1 to 255). |
1 - 1
Interface configuration
The value will be negotiated with its peer.
You cannot enter a VPI range on a VP tunnel; the VPI is the PVP number of the tunnel.
If the TDP neighbor is a router, the VPI range cannot be larger than 2; for example, from 5 to 6 (a range of 2), not 5 to 7 (a range of 3).
The following example shows you how to select a VPI range from 5 to 6.
Switch(config)#interface atm 4/0/1Switch(config-if)#tag-switching ipSwitch(config-if)#tag-switching atm vpi 5 - 6
To allow tag switching of IPv4 packets, use the tag-switching ip global configuration command. To disable IP tag switching across all interfaces, use the no form of this command.
tag-switching ipThis command has no keywords or arguments.
Enabled
Global configuration
Dynamic tag switching (that is, the distribution of tags based on routing protocols) is allowed by this optional command, but is not actually enabled until the interface-level tag-switching ip command is issued on at least one interface. The no form of this command stops the distribution of dynamic tags and the sending of outgoing tagged packets on all interfaces. The sending of tagged packets on TSP tunnels is not affected by this command.
For TC ATM, the no form of this command prevents tag VCs beginning at, terminating at, or passing through the platform.
The following example shows how to enable the distribution of dynamic tags on all interfaces.
Switch#configure terminalSwitch(config)#tag-switching ip
To enable tag switching of IPv4 packets on an interface, use the tag-switching ip interface configuration command. To disable IP tag switching on an interface, use the no form of this command.
tag-switching ipThis command has no keywords or arguments.
Disabled
Interface configuration
The first time this command is issued on any interface, dynamic tag switching is enabled on the entire switch. TDP Hellos are issued on this interface. When an outgoing tag for a destination routed out through this interface is received, packets sent to that destination are tagged as outgoing.
The no form of this command causes packets routed out through this interface to be sent as untagged, and outgoing TDP Hellos are no longer sent.
When the no form is issued on the only interface for which tag switching is enabled, dynamic tag switching is disabled on the entire switch.
For TC ATM, the no form of this command prevents tag VCs beginning at, terminating at, or passing through the this interface.
In the following example, tag switching is enabled on ATM interface 1/1/0.
Switch(config)#interface atm 1/1/0Switch(config-if)#tag-switching ip
tag-switching atm allocation-mode
tag-switching ip (global)
To configure the interval between transmission of TDP discovery Hello messages and the hold time for a TDP transport connection, use the tag-switching tdp discovery global configuration command. To set the interval and hold time to their defaults, use the no form of this command.
tag-switching tdp discovery {hello | directed-hello} {holdtime | interval} seconds| hello | Intervals and hold times for directly connected neighbors. |
| directed-hello | Intervals and hold times for neighbors that are not directly connected; for example, TDP sessions that run over a TSP tunnel. |
| holdtime | Interval for which a connection stays up if no Hello messages are received. The default is 15 seconds. |
| interval | Period between sending Hello messages. The default is 5 seconds. |
| seconds | Hold time or interval, in the range of 1 to 2147483647. |
See the syntax descriptions.
Global configuration
In the following example, the interval for which a connection stays up if no Hello packets are received is set to 5 seconds.
Switch#configure terminalSwitch(config)#tag-switching tdp discovery hello holdtime 5
show tag-switching interfaces
show tag-switching atm-tdp summary
show tag-switching tdp parameters
To configure the hold time for a TDP session, use the tag-switching tdp holdtime global configuration command. To set the hold time to the default, use the no form of this command.
tag-switching tdp holdtime seconds| seconds | The time, in seconds, that a TDP session is maintained in the absence of TDP messages from the session peer (1 to 2147483647). |
15 seconds
Global configuration
When a TDP session is initiated, the hold time is negotiated to the lower of the values configured at the two ends.
This command configures the hold time determined by this tag switch.
The following example configures the hold time of TDP sessions to 30 seconds.
Switch#configure terminalSwitch(config)#tag-switching tdp holdtime 30
show tag-switching tdp parameters
To enable support for TSP tunnel negotiation, use the tag-switching tsp-tunnels global configuration command or interface configuration command. To disable support for TSP tunnel negotiation, use the no form of this command.
tag-switching tsp-tunnelsThis command has no keywords or arguments.
Disabled
Global configuration
Interface configuration
Enabling TSP tunnel negotiation using the tag-switching tsp-tunnels command in the interface configuration mode has no effect unless command is also issued in the global configuration mode.
The following example shows how to enable TSP tunnel negotiation globally, then enable it at the interface.
Switch(config)#tag-switching tsp-tunnelsSwitch(config)#interface atm 1/1/1Switch(config-if)#tag-switching tsp-tunnels
show tag-switching tsp-tunnels
To log on to a host that supports Telnet, use the telnet EXEC command.
telnet hostname [keyword] [port]| hostname | A host name or an IP address. |
| keyword | One of the options listed in Table 20-1. |
| port | A decimal TCP port number; the default is the Telnet router port (decimal 23) on the host. |
| Option | Description |
|---|---|
| /debug | Enables Telnet debugging mode. |
| /line | Enables Telnet line mode. In this mode, the Cisco IOS software sends no data to the host until you press Return. You can edit the line using the standard Cisco IOS software command-editing characters. The /line keyword is only on the local switch. |
| /noecho /route path | Specifies loose source routing. The path argument is a list of host names or IP addresses that specify network nodes and ends with the final destination. |
| /source-interface
/stream | Turns on stream processing, which enables a raw TCP stream with no Telnet control sequences. A stream connection does not process Telnet options and can be appropriate for connections to ports running UUCP and other non-Telnet protocols. |
| port-number | Port number. |
| chargen | Character generator. |
| cmd rcmd | Remote commands. |
| daytime | Daytime. |
| discard | Discard. |
| domain | Domain Name Service. |
| echo | Echo. |
| exec | EXEC. |
| finger | Finger. |
| ftp | File Transfer Protocol. |
| ftp-data | FTP data connections (used infrequently). |
| gopher | Gopher. |
| hostname | NIC host name server. |
| ident | Ident Protocol. |
| irc | Internet Relay Chat. |
| klogin | Kerberos login. |
| kshell | Kerberos shell. |
| login | Login (rlogin). |
| lpd | Printer service. |
| nntp | Network News Transport Protocol. |
| pim-auto-rp | Protocol Independent Multicast Route Processor. |
| pop2 | Post Office Protocol v2. |
| pop3 | Post Office Protocol v3. |
| port | Destination LAT port name. |
| smtp | Simple Mail Transport Protocol. |
| syslog | Syslog. |
| tacacs | Specify TACACS security. |
| talk | Talk. |
| telnet | Telnet. |
| time | Time. |
| uucp | Unix-to-Unix copy program. |
| whois | Nickname. |
| www | World Wide Web (HTTP). |
This command has no default setting.
EXEC
With the Cisco IOS implementation of TCP/IP, you are not required to enter the connect or telnet commands to establish a Telnet connection. You can just enter the learned host name after you meet the following conditions:
To display a list of the available hosts, use the show hosts command. To display the status of all TCP connections, use the show tcp command.
The Cisco IOS software assigns a logical name to each connection, and several commands use these names to identify connections. The logical name is the same as the host name, unless that name is already in use, or you change the connection name with the name-connection EXEC command. If the name is already in use, the Cisco IOS software assigns a null name to the connection.
The Telnet software supports special Telnet commands in the form of Telnet sequences that map generic terminal control functions to operating system-specific functions. To issue a special Telnet command, enter the escape sequence and then a command character. The default escape sequence is Ctrl-^ (press and hold the Control and Shift keys and the 6 key). You can enter the command character as you hold down Ctrl or with Ctrl released; you can use either uppercase or lowercase letters. Table 20-2 lists the special Telnet escape sequences.
| Task | Escape Sequence1 |
|---|---|
| Break | Ctrl-^ b |
| Interrupt Process (IP) | Ctrl-^ c |
| Erase Character (EC) | Ctrl-^ h |
| Abort Output (AO) | Ctrl-^ o |
| Are You There? (AYT) | Ctrl-^ t |
| Erase Line (EL) | Ctrl-^ u |
At any time during an active Telnet session, you can list the Telnet commands by pressing the escape sequence keys followed by a question mark at the system prompt:
Ctrl-^ ?
A sample of this list follows. In this sample output, the first caret (^) symbol represents the Control key, while the second caret represents Shift-6 on your keyboard.
Switch> ^^?
[Special telnet escape help]
^^B sends telnet BREAK
^^C sends telnet IP
^^H sends telnet EC
^^O sends telnet AO
^^T sends telnet AYT
^^U sends telnet EL
You can switch back and forth between several open sessions. To open a subsequent session, first suspend the current connection by pressing the escape sequence (Ctrl-Shift-6 then x [Ctrl^x]) to return to the system command prompt. Then open a new connection with the telnet command.
To terminate an active Telnet session, issue any of the following commands at the prompt of the device to which you are connecting:
The following example switches packets from the source system host1 to kl.sri.com, then to 10.1.0.11, and finally back to host1:
Switch> telnet host1 /switch:kl.sri.com 10.1.0.11 host1
The following terminal commands are documented under the following parameter names:
| Command | Description |
|---|---|
| data-character-bits | Size of characters being handled. |
| databits | Set the number of data bits per character. |
| downward-compatible-config | Put the line in download mode. |
| editing | Enable command-line editing. |
| escape-character | Change the current line's escape character. |
| exec-character-bits | Size of characters to the command exec. |
| flowcontrol | Set the flow control. |
| full-help | Provide help to an unprivileged user. |
| help | Description of the interactive help system. |
| history | Enable and control the command history function. |
| ip | IP options. |
| length | Set the number of lines on a screen. |
| monitor | Copy debug output to the current terminal line. |
| no | Negate a command or set its defaults. |
| notify | Inform users of output from concurrent sessions. |
| padding | Set the padding for a specified output character. |
| parity | Set the terminal parity. |
| rxspeed | Set the receive speed. |
| special-character-bits | Size of the escape (and other special) characters. |
| speed | Set the transmit and receive speeds. |
| start-character | Define the start character. |
| stop-character | Define the stop character. |
| stopbits | Set async line stop bits. |
| terminal-type | Set the terminal type. |
| transport | Define transport protocols for the line. |
| txspeed | Set the transmit speeds. |
| width | Set the width of the display terminal. |
To specify the type of terminal connected to a line, use the terminal-type line configuration command. The command records the type of terminal connected to the line. To remove any information about the type of terminal and reset the line to the default terminal emulation, use the no form of this command.
terminal-type terminal-name| terminal-name | Terminal name and type. |
VT100
Line configuration
The argument terminal-name provides a record of the terminal type and allows terminal negotiation of display management by hosts that provide that type of service.
The following example defines the terminal on the console as a type VT220.
Switch(config)#line consoleSwitch(config-line)#terminal-type VT220
terminal terminal-type
To test the system interfaces on the modular switch, use the test EXEC command.
testThis command has no arguments or keywords.
EXEC
The test EXEC command is intended for the factory checkout of network interfaces. It is not intended for diagnosing problems with an operational switch. The test output does not report correct results if the switch is attached to an active network. For each network interface that has an IP address that can be tested in loopback (MCI and ciscoBus Ethernet and all serial interfaces), the test command sends a series of ICMP echoes. Error counters are examined to determine the operational status of the interface.
The following example illustrates how to begin the interface test.
Switch# test
To specify that the switch or Flash device operates as a TFTP server, use the tftp-server global configuration commands. To remove a previously defined filename, use the no form of this command with the appropriate filename.
tftp-server flash [device:] filename1 [alias filename2] [rom alias filename2] [atm-accounting| flash | Specifies TFTP service of a file in Flash memory. |
| device: | Specifies TFTP service of a file on a Flash memory device. The colon (:) is required. Valid devices are as follows:
· bootflash: This device is the internal Flash memory. · slot0: This device is the first PCMCIA slot on the ASP card. · slot1: This device is the second PCMCIA slot on the ASP card. |
| filename1 | Name of a file in Flash or in ROM that the TFTP server uses in answering TFTP Read Requests. |
| alias | Specifies an alternate name for the file that the TFTP server uses in answering TFTP Read Requests. |
| filename2 | Alternate name of the file that the TFTP server uses in answering TFTP Read Requests. A client of the TFTP server can use this alternate name in its Read Requests. |
| atm-accounting | Specifies the name of the file the TFTP server uses in answering TFTP Read Requests. |
| filename3 | Alternate name of the file that the TFTP server uses in answering TFTP Read Requests. A client of the TFTP server can use this alternate name in its Read Requests. |
Disabled
Global configuration
You can specify multiple filenames by repeating the tftp-server command. The system sends a copy of the system image contained in ROM or one of the system images contained in Flash memory to any client that issues a TFTP Read Request with this filename.
If the specified filename1 or filename2 exists in Flash memory, a copy of the Flash image is sent. On systems that contain a complete image in ROM, the system sends the ROM image if the specified filename1 or filename2 is not found in Flash memory.
Images that run from ROM cannot be loaded over the network. Therefore, you should not use TFTP to offer the ROMs on these images.
The system sends a copy of the file contained on one of the Flash memory devices to any client that issues a TFTP Read Request with its filename.
In the following example, the system uses TFTP to send a copy of the version-11.1 file located in Flash memory in response to a TFTP Read Request for that file. The requesting host is checked against access list 22.
Switch(config)# tftp-server flash version-11.1 22
In the following example, the system uses TFTP to send a copy of the version-11.1.4 file in response to a TFTP Read Request for that file. The file is located on the Flash memory card inserted in slot 0 of the ASP card.
Switch(config)# tftp-server flash slot0:version-11.1.4
To configure the PNNI timers, use the timer PNNI node configuration command. To return to the default values, use the no form of this command.
timer [ack delay tenths-of-seconds] [called-integrity seconds]| ack-delay | Specifies the waiting period before sending an accumulated PTSE acknowledgment packet. The default is 1 second. |
| called-integrity | Specifies the value used to initialize the SVCC integrity timer at the node that accepts an LGN-to-LGN SVCC RCC originated by a neighbor node. The default is 50 seconds. |
| calling-integrity | Specifies the value used to initialize the SVC integrity timer at the node that initiates an LGN-to-LGN SVCC RCC. The SVC integrity timer determines how long this node will wait for an SVCC-based RCC to reach the two-way inside state before releasing it. The default is 35 seconds. |
| hello-holddown | Specifies the hold-down period for event-triggered Hellos. This is mainly used for Hello packets between outside neighbors. The default is 1 second. |
| hello-interval | Specifies the frequency, in seconds, at which Hello packets are transmitted. The default is 15 seconds. |
| hrz-link-inactivity | Specifies the length of time that this node will continue to advertise a horizontal link for which it has not received and processed an LGN horizontal link extension information group piggybacked onto an SVCC-RCC Hello packet. The default is 120 seconds. |
| inactivity-factor | Specifies the dead-interval time (the period after which a neighbor is declared down if no Hello is received) as a factor of the Hello interval. The default is 5 seconds. |
| retransmit-interval | Specifies the waiting period before retransmitting a PTSE, PTSE request, or database summary packet. The default is 5 seconds. |
See the syntax descriptions.
PNNI node configuration
Decreasing the hello-interval allows PNNI to detect neighbor nodes that have stopped functioning more quickly. The inactivity-factor is used as a multiplier of the hello-interval in received Hello packets to determine the dead interval, the time after which the neighbor node is declared down if no Hello packets are received. The inactivity-factor can be increased on unreliable interfaces to avoid false alarms.
Decreasing the retransmit-interval causes retransmission to increase when a PNNI packet gets lost. However, this increases the risk of unnecessarily retransmitting PNNI packets that are delayed but actually reaches the neighbor. Increasing ack-delay causes more PTSEs to be acknowledged in one ack packet. Lowering hello-holddown allows another Hello packet to be sent shortly after one was sent. To avoid an overload in switch processing, you should adjust these parameters carefully.
For more information, refer to the LightStream 1010 ATM Switch Software Configuration Guide.
The following script shows how to change the hello-interval to 5 seconds.
Switch#configure terminalSwitch(config)#atm router pnniSwitch(config-atm-router)#node 1Switch(config-pnni-node)#timer hello-interval 5
To trace the IP routes the packets actually take when traveling from the switch to their destination, use the traceroute EXEC command.
traceroute [protocol] [destination]| protocol | Protocol that can be used is ip. |
| destination | Destination address or host name on the command line. The default parameters for the appropriate protocol are assumed, and the tracing action begins. |
The protocol argument is based on the switch's examination of the format of the destination argument. For example, if the switch finds a destination in IP format, the protocol defaults to ip.
EXEC
The traceroute command works by taking advantage of the error messages generated by switches when a datagram exceeds its TTL value.
The traceroute command starts by sending probe datagrams with a TTL value of 1. This causes the first switch to discard the probe datagram and send back an error message. The traceroute command sends several probes at each TTL level and displays the round-trip time for each.
The traceroute command sends out one probe at a time. Each outgoing packet may result in one or two error messages. A "time exceeded" error message indicates that an intermediate switch detected and discarded the probe. A "destination unreachable" error message indicates that the destination node received and discarded the probe because it could not deliver the packet. If the timer goes off before a response comes in, traceroute prints an asterisk (*).
The traceroute command terminates when the destination responds, when the maximum TTL is exceeded, or when the user interrupts the trace with the escape sequence. By default, to invoke the escape sequence, enter ^ X.
Due to bugs in the IP implementation of various hosts and switches, the IP trace command may behave in unexpected ways.
Not all destinations respond correctly to a probe message by sending back an "ICMP port unreachable" message. A long sequence of TTL levels with only asterisks, terminating only when the maximum TTL is reached, may indicate this problem.
There is a known problem with the way some hosts handle an "ICMP TTL exceeded" message. Some hosts generate an ICMP message, but they reuse the TTL of the incoming packet. Since this is zero, the ICMP packets do not make it back. When you trace the path to such a host, you may see a set of TTL values with asterisks (*). Eventually the TTL gets high enough that the "ICMP" message can get back. For example, if the host is 6 hops away, traceroute times out on responses 6 through 11.
The following display shows sample IP traceroute output when a destination host name is specified.
Switch# traceroute ip ABA.NYC.mil
Type escape sequence to abort.
Tracing the route to ABA.NYC.mil (26.0.0.73)
1 DEBRIS.CISCO.COM (131.108.1.6) 1000 msec 8 msec 4 msec
2 BARRNET-GW.CISCO.COM (131.108.16.2) 8 msec 8 msec 8 msec
3 EXTERNAL-A-GATEWAY.STANFORD.EDU (192.42.110.225) 8 msec 4 msec 4 msec
4 BB2.SU.BARRNET.NET (131.119.254.6) 8 msec 8 msec 8 msec
5 SU.ARC.BARRNET.NET (131.119.3.8) 12 msec 12 msec 8 msec
6 MOFFETT-FLD-MB.in.MIL (192.52.195.1) 216 msec 120 msec 132 msec
7 ABA.NYC.mil (26.0.0.73) 412 msec 628 msec 664 msec
Table 20-3 describes the fields shown in the display.
| Field | Description |
|---|---|
| 1 | Indicates the sequence number of the switch in the path to the host. |
| DEBRIS.CISCO.COM | Host name of this switch. |
| 131.108.1.61 | IP address of this switch. |
| 1000 msec 8 msec 4 msec | Round-trip time for each of the three probes that are sent. |
Table 20-4 describes the characters that can appear in traceroute output.
| Char | Description |
|---|---|
| nn msec | For each node, the round-trip time in milliseconds for the specified number of probes. |
| * | The probe timed out. |
| ? | Unknown packet type. |
| Q | Source quench. |
| P | Protocol unreachable. |
| N | Network unreachable. |
| U | Port unreachable. |
| H | Host unreachable. |
To indicate to the network that this node does not allow calls to transit through, use the transit-restricted PNNI node configuration command. To allow calls to transit through the node, use the no form of this command.
transit-restrictedThis command has no keywords or arguments.
Enabled
PNNI node configuration
This command enables the network administrator to prevent connections from transiting nodes that only originate or terminate connections, for example, low-end edge switches that do not have the capacity to support transit calls.
For more information, refer to the LightStream 1010 ATM Switch Software Configuration Guide.
The following script shows how to access the transit-restricted PNNI node configuration command.
Switch#configure terminalSwitch(config)#atm router pnniSwitch(config-atm-router)#node 1Switch(config-pnni-node)#transit-restricted
To specify the transport protocol to use for incoming and outgoing connections and to specify the preferred protocol, use the transport line configuration command.
transport {input | output | preferred} {all | none | telnet}| input | Defines which protocols to use when connecting to the terminal server. |
| output | Defines which protocols to use for outgoing connections. |
| preferred | Defines the preferred protocol to use if none is specified when the connection is initiated. |
| all | Allows all protocols. |
| telnet | Selects the TCP/IP Telnet protocol. It allows a user at one site to establish a TCP connection to a login server at another site. |
| none | Prevents any protocol selection on the line. The system normally assumes that any unrecognized command is a host name. If the protocol is set to none, the system no longer makes that assumption. The connection is not attempted if the command is not recognized. |
Telnet
Line configuration
Specify transport preferred none to prevent errant connection attempts.
The following example sets the preferred protocol to Telnet on virtual terminal line 1.
Switch(config)#line vty 1Switch(config-line)#transport preferred telnet
terminal transport preferred
transport
To set the terminal transmit baud rate (to terminal), use the txspeed line configuration command. To disable this feature, use the no form of this command.
txspeed bps| bps | Baud rate in bits per second (bps); see the "Usage Guidelines" for settings. |
9600 bps
Line configuration
Set the speed to match the baud rate of the device you have connected to the port. Some baud rates available on devices connected to the port might not be supported on the switch. The switch indicates if the speed you select is not supported. The following is a list of available line speeds, shown in bits per second:
75, 110, 134, 150, 300, 600, 1200, 2000, 2400, 4800, 1800, 9600, 19200, 38400
The following example sets the auxiliary line transmit speed to 2400 bps.
Switch(config)#line aux 0Switch(config-line)#txspeed 2400
|
|