|
|
Use the information in this chapter to understand the types of interfaces supported on our communication servers. Our communication servers support two types of interfaces: physical and virtual interfaces.The virtual interfaces our communication servers support include subinterfaces and IP tunnels.
For hardware technical descriptions and information about installing the communication server interfaces, refer to the hardware installation and maintenance publication for your particular product. For command descriptions and usage information, refer to the Access and Communication Servers Command Reference publication.
You can perform the tasks in the following sections to configure and maintain the interfaces supported on your communication servers. The first section introduces material that you might need to know in advance of the other tasks.
See "Interface Description Examples" at the end of this chapter for interface configuration examples.
The following sections describe the interfaces and encapsulations supported by our communication servers.
Support for the synchronous serial interface is supplied on the following serial network interface cards or systems:
The MCI and SCI cards can query the appliques to determine their types for use in reports displayed by the EXEC show commands. However, they do so only at system startup, so the appliques must be attached when the system is started. Use the show interfaces and show controllers mci EXEC commands to display the serial port numbers. These commands provide a report for each interface supported by the communication server.
By default, synchronous serial lines use the High-level Data Link Control (HDLC) serial encapsulation method, which provides the synchronous framing and error detection functions of HDLC without windowing or retransmission. The synchronous serial interfaces support the following serial encapsulation methods:
Encapsulation methods are set according to the type of protocol or application you configure on your communication server. HDLC is described later in this chapter in the section "Reenable HDLC Serial Encapsulation." PPP is described later in this chapter in the section "Configure the Point-to-Point Protocol." The remaining methods are described in their respective chapters describing the protocols or applications. Serial encapsulation methods are also discussed in the Access and Communication Servers Command Reference publication, under the encapsulation command.
The synchronous serial interface supports point-to-point compression. Our software implements a predictor compressor (the RAND algorithm). Compression of LAPB data is supported for LAPB.
Access and communication server platforms provide a number of methods to connect serial devices, including RJ-11, RJ-45, and 50-pin Telco connectors. The 500-CS supports RJ-45 connectors only. The ASM-CS supports Telco and RJ-11 connectors. The 2500 access server supports RJ-45 connectors on "octopus" cable adapters that attach to high-density D-type connectors on the rear panel of the 2500.
There are two asynchronous serial encapsulation methods:
Refer to the chapter "Configuring SLIP and PPP" later in this publication, for more information about these encapsulation methods.
Support for the Ethernet interface is supplied on one of the following Ethernet network interface cards or systems:
Use the show interfaces and show controllers mci EXEC commands to display the Ethernet port numbers. These commands provide a report for each interface supported by the communication server.
Currently, there are three common Ethernet encapsulation methods:
The encapsulation method you use depends upon the type of Ethernet media connected to the communication server and the routing application you configure. Further detail is provided in the sections "Select the Ethernet Encapsulation" later in this chapter. See also the chapters describing the protocols or applications.
Support for the Token Ring interface is supplied on The 4/16-Mbps Token Ring cards, which interconnect network servers to IEEE 802.5 and IBM-compatible Token Ring media at speeds of 4 or 16 Mbps. These include the 4/16-Mbps cards or CSC-R16M, CSC-1R, and CSC-2R (dual Token Ring card).
Use the show interfaces and show controllers token EXEC commands to display the Token Ring numbers. These commands provide a report for each ring supported by the communication server.
The Token Ring interface by default uses the SNAP encapsulation format defined in RFC 1042. It is not necessary to define an encapsulation method for this interface.
Begin interface configuration in global configuration mode. To configure an interface, follow these steps:
Step 1 Enter the configure EXEC command at the privileged EXEC prompt to enter global configuration mode.
Step 2 Once in the global configuration mode, start configuring the interface by entering the interface command. Identify the interface type followed by the number of the connector or interface card. These numbers are assigned at the factory at the time of installation or when added to a system and can be displayed with the show interfaces EXEC command. A report is provided for each interface the communication server supports, as seen in the following partial sample display:
Serial 0 is administratively down, line protocol is down
Hardware is MCI Serial
MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec, rely 255/255, load 1/255
Encapsulation HDLC, loopback not set, keepalive set (10 sec)
Use the show hardware EXEC command to see a list of the system software and hardware.
For example, to begin configuring interface Serial 0, you would add the following line to the configuration file:
interface serial 0
Step 3 Follow each interface command with the interface configuration commands your particular interface requires. These command define the protocols and applications that will run on this interface. The commands are collected and applied to the interface command until you enter another interface command, a command that is not an interface configuration command, or you type the Ctrl-Z sequence to get out of configuration mode and return to privileged EXEC mode.
Step 4 Once an interface is configured, you can check its status by entering the EXEC show commands described after the task tables that follow.
The following sections show how to begin to configure each interface type as a separate task. Follow this command with the routing or bridging interface configuration commands for your particular protocol or application, as described in subsequent chapters.
See the section "Interface Configuration Examples" at the end of this chapter.
To specify an asynchronous interface, perform the following task in global configuration mode.
| Task | Command |
|---|---|
Specify an asynchronous interface. | interface async unit |
For more information on asynchronous interfaces, refer to the chapter "Configuring SLIP and PPP" later in this publication. To use SLIP or PPP to make a connection, see the Cisco Access Connection Guide.
To specify a dialer rotary group leader, perform the following task in global configuration mode:
| Task | Command |
|---|---|
Begin dialer rotary group interface configuration. | interface dialer interface-number |
To configure an Ethernet interface, perform the following task in global configuration mode
| Task | Command |
|---|---|
Begin Ethernet interface configuration. | interface ethernet interface-number |
You can specify a software-only interface called a loopback interface that emulates an interface that is always up. A loopback interface is a virtual interface that allows BGP and RSRB sessions to stay up even if the outbound interface is down, and is supported on all platforms.
You can use the loopback interface as the termination address for BGP sessions, for RSRB connections, or for establishing a Telnet session from the communication server's console to its auxiliary port when all other interfaces are down. In applications where other communication servers will attempt to reach this loopback interface, you should configure a routing protocol to distribute the subnet assigned to the loopback address.
Packets routed to the loopback interface are rerouted back to the box and processed locally. IP packets routed out the loopback interface but not destined to the loopback interface are dropped. This means the loopback interface also serves as the Null 0 interface.
To configure a loopback interface, perform the following task in global configuration mode:
| Task | Command |
|---|---|
Begin loopback interface configuration. | interface loopback interface-number |
See also the section "Run Interface Loopback Diagnostics" later in this chapter.
The communication server supports a "null" interface. This pseudo-interface functions similarly to the null devices available on most operating systems. This interface is always up and can never forward or receive traffic; encapsulation always fails. The only interface configuration command that you can specify for the null interface is no ip redirects.
The null interface provides an alternative method of filtering traffic. The overhead involved with using access lists can be avoided by directing undesired network traffic to the null interface.
To specify the null interface, perform the following task in global configuration mode:
| Task | Command |
|---|---|
Begin null interface configuration. | interface null 0 |
Specify null 0 (or null0) as the interface name and unit. The null interface can be used in any command that has an interface type as an argument. The following example configures a null interface for IP route 127.0.0.0:
ip route 127.0.0.0 255.0.0.0 null 0
To configure a synchronous serial interface, perform the following task in global configuration mode:
| Task | Command |
|---|---|
Begin synchronous serial interface configuration. | interface serial interface-number |
For synchronous serial features, see the section "Configure Synchronous Serial Features" later in this chapter.
To configure a Token Ring interface, perform the following task in global configuration mode:
| Task | Command |
|---|---|
Begin Token Ring interface configuration. | interface tokenring interface-number |
You can configure point-to-point software compression on serial interfaces that use PPP encapsulation. Compression reduces the size of a PPP frame via lossless data compression. The compression algorithm used is a predictor algorithm (the RAND algorithm), which uses a compression dictionary to predict what the next character in the frame will be.
For HDLC encapsulations, you can specify a Stacker compression algorithm by using the stac keyword. PPP encapsulations support both predictor and Stacker compression algorithms.
Compression is performed in software and might significantly affect system performance. We recommend that you disable compression if CPU load exceeds 65%. To display the CPU load, use the show process cpu EXEC command.
If the majority of your traffic is already compressed files, it is recommended that you not use compression.
To configure compression over PPP, perform the following tasks in interface configuration mode:
| Task | Command |
|---|---|
Step 1. Enable encapsulation of a single protocol on the serial line. | |
Step 2. Enable compression. |
You can add a description about an interface to help you remember what is attached to it. This entry is meant solely as a comment to help identify what the interface is being used for. The description will appear in the output of the following commands: show configuration, write terminal, and show interfaces.
To add the description, complete the following task in interface configuration mode:
| Task | Command |
|---|---|
Add a description for an interface. |
For examples of adding a description, see the section "Interface Configuration Examples" at the end of this chapter.
Tunneling provides a way to encapsulate arbitrary packets inside of a transport protocol. This feature is implemented as a virtual interface to provide a simple interface for configuration. The tunnel interface is not tied to specific "passenger" or "transport" protocols, but rather, it is an architecture that is designed to provide the services necessary to implement any standard point-to-point encapsulation scheme.
Tunneling has three primary components:
Figure 6-1 illustrates IP tunneling terminology and concepts.
To understand the process of tunneling, consider connecting two AppleTalk networks with a non-AppleTalk backbone, such as IP. The relatively high bandwidth consumed by the broadcasting of Routing Table Maintenance Protocol (RTMP) data packets can severely hamper the backbone's network performance. This problem can be solved by tunneling AppleTalk through a foreign protocol, such as IP. Tunneling encapsulates an AppleTalk packet inside the foreign protocol packet, which is then sent across the backbone to a destination communication server. The destination communication server then de-encapsulates the AppleTalk packet and, if necessary, routes the packet to a normal AppleTalk network. Because the encapsulated AppleTalk packet is sent in a directed manner to a remote IP address, bandwidth usage is greatly reduced. Furthermore, the encapsulated packet benefits from any features normally enjoyed by IP packets, including default routes and load balancing.
There are several situations where encapsulating traffic in another protocol is useful:
The following are considerations and precautions to observe when configuring tunneling:
%TUN-RECURDOWN Interface Tunnel 0
temporarily disabled due to recursive routing
If you want to configure IP tunneling, you must perform the tasks in the following sections:
The tasks in the following tunnel configuration sections are optional:
For examples using these commands, see the section "IP Tunneling Examples" at the end of this chapter.
To configure tunneling, you must configure the tunnel interface by performing the following task in global configuration mode:
| Task | Command |
|---|---|
Configure the tunnel interface. | interface tunnel interface-number |
You must specify the tunnel interface's source address by performing the following task in interface configuration mode:
| Task | Command |
|---|---|
Configure the tunnel source. | tunnel source {ip-address | interface-type interface-number} |
You must specify the tunnel interface's destination by performing the following task in interface configuration mode:
| Task | Command |
|---|---|
Configure the tunnel destination. | tunnel destination {hostname | ip-address} |
| Task | Command |
|---|---|
Configure the tunnel mode. | tunnel mode {aurp | cayman | dvmrp | eon | gre ip | nos} |
If you are tunneling AppleTalk, you must use either AppleTalk Update Routing Protocol (AURP), Cayman or GRE tunneling mode. Cayman tunneling is designed by Cayman Systems, and enables communication servers to interoperate with Cayman GatorBoxes. You can have our communication servers at either end of the tunnel, or you can have a GatorBox at one end and our communication server at the other end. Use Distance Vector Multicast Routing Protocol (DVMRP) mode when a communication server connects to a mrouted communication server to run DVMRP over a tunnel. It is required to configure Protocol-Independent Multicast (PIM) and an IP address on a DVMRP tunnel.
 | Caution Do not configure a Cayman tunnel with an AppleTalk network address. |
| Task | Command |
|---|---|
Step 1. Enable tunneling on the interface. | |
Step 2. Assign a cable range to an interface. | appletalk cable-range start-end [network.node]1 |
Step 3. Set a zone name for the connected AppleTalk network. | appletalk zone zone-name2 |
Step 4. Specify the interface out which the encapsulated packets will be sent, or specify the communication server's IP address. | |
Step 5. Specify the IP address of the communication server at the far end of the tunnel. | |
Step 6. Enable GRE tunneling. |
| 1This command is documented in the "AppleTalk Commands" chapter of the Router Products Command Reference publication. 2This command is documented in the "AppleTalk Commands" chapter of the Router Products Command Reference publication. |
Some passenger protocols rely on media checksums to provide data integrity. By default, the tunnel does not guarantee packet integrity. By enabling end-to-end checksums, the communication servers will drop corrupted packets. To enable such checksums on a tunnel interface, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Configure end-to-end checksumming. |
You can optionally enable an ID key for a tunnel interface. This key must be set to the same value on the tunnel endpoints. Tunnel ID keys can be used as a form of weak security to prevent misconfiguration or injection of packets from a foreign source.
The tunnel ID key is available with GRE only.
To configure a tunnel ID key, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Configure a tunnel identification key. | tunnel key key-number |
You can optionally configure a tunnel interface to drop datagrams that arrive out of order. This is useful when carrying passenger protocols that behave poorly when they receive packets out of order (for example, LLC2-based protocols). This option is available with GRE only.
To use this option, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Configure a tunnel interface to drop out-of-order datagrams. | tunnel sequence-datagrams |
Complete any of the following tasks in EXEC mode to monitor the IP tunnels you have configured:
| Task | Command |
|---|---|
List tunnel interface information. | show interfaces tunnel unit [accounting] |
List the routes that go through the tunnel. | show protocol route1 |
List the route to the tunnel destination. | show ip route2 |
The communication server supports a packet tunneling strategy that provides the host with mobility across the extended internetwork—in effect creating a virtual private network for the mobile user. When a user activates asynchronous host mobility, the communication server on which the remote user dials into becomes a remote point-of-presence (POP) for the user's home network. Once logged in, the user experiences a server environment identical to the one that appears when he or she connects directly to the "home" access server.
Once the network layer connection is made, data packets are tunneled at the physical and/or data link layer instead of at the protocol layer. In this way, raw data bytes from dial-in users are transported directly to the "home" access server, which processes the protocols.
Figure 6-4 illustrates the implementation of asynchronous host mobility on an extended internetwork. A mobile user connects to a communication server on the internetwork and, by activating asynchronous host mobility, is connected to "home" communication server configured with the appropriate username. The user sees an authentication dialog or prompt from the "home" system and can proceed as if he or she were connected directly to that device.
The remote user implements asynchronous host mobility by executing a User EXEC tunnel command. When executed, the command sets up a network layer connection to the destination specified in the command. The communication server accepts the connection, attaches it to a virtual terminal (VTY), and runs a command parser capable of running the normal dial-in services (SLIP or PPP). After the connection is established, data is transferred between the modem and network connection with a minimum of interpretations. When communications are complete, the network connection can be closed and terminated from either end.
Refer to the Cisco Access Connection Guide for information about setting up the network layer connection with the tunnel command.
The optional tasks in the following sections configure features on a synchronous serial interface:
The communication server provides HDLC encapsulation for serial lines by default. This encapsulation method provides the synchronous framing and error detection functions of HDLC without windowing or retransmission. Although it is the default, it can be reenabled as the encapsulation method, if necessary, by performing the following task in interface configuration mode:
| Task | Command |
|---|---|
Reenable HDLC encapsulation. |
You can configure point-to-point software compression on serial interfaces that use HDLC encapsulation. Compression reduces the size of a HDLC frame via lossless data compression. The compression algorithm used is a Stacker (LZS) algorithm.
Compression is performed in software and might significantly affect system performance. We recommend that you disable compression if CPU load exceeds 65%. To display the CPU load, use the show process cpu EXEC command.
If the majority of your traffic is already compressed files, you should not use compression.
To configure compression over HDLC, perform the following tasks in interface configuration mode:
| Task | Command |
|---|---|
Step 1. Enable encapsulation of a single protocol on the serial line. | |
Step 2. Enable compression. |
You can configure point-to-point software compression on serial interfaces that use LAPB or multi-LAPB encapsulation. Compression reduces the size of a LAPB or multi-LAPB frame via lossless data compression. The compression algorithm used is a predictor algorithm (the RAND algorithm), which uses a compression dictionary to predict what the next character in the frame will be.
Compression is performed in software and might significantly affect system performance. We recommend that you disable compression if CPU load exceeds 65%. To display the CPU load, use the show process cpu EXEC command.
Predictor compression is recommended when the bottleneck is the load on the router; Stacker compression is recommended when the bottleneck is line bandwidth. Compression is not recommended if the majority of your traffic is already compressed files. Compression is also not recommended for linespeeds greater than T1; the added processing time will slow performance on such lines.
To configure compression over LAPB, perform the following tasks in interface configuration mode:
| Task | Command |
|---|---|
Step 1. Enable encapsulation of a single protocol on the serial line. | |
Step 2. Enable compression. |
To configure compression over multi-LAPB, perform the following tasks in interface configuration mode:
| Task | Command |
|---|---|
Step 1. Enable encapsulation of multiple protocols on the serial line. | |
Step 2. Enable compression. |
When using compression, the MTU for the serial interface and the LAPB N1 parameter should be adjusted as in the following example, in order to avoid informational diagnostics regarding excessive MTU or N1 sizes:
interface serial 0
encapsulation lapb
compress predictor
mtu 1509
lapb n1 12072
For information about configuring X.25 TCP/IP header compression and X.25 payload compression, see the chapter "Configuring X.25 and LAPB."
It is possible to send back-to-back data packets over serial interfaces faster than some hosts can receive them. You can specify a minimum dead time after transmitting a packet to alleviate this condition. This setting is available for serial interfaces on the MCI and SCI interface cards. Perform one of the following tasks, as appropriate for your system, in interface configuration mode:
| Task | Command |
|---|---|
Set the transmit delay on the MCI and SCI synchronous serial interfaces. |
You can configure pulsing DTR signals on all serial interfaces.When the serial line protocol goes down (for example, because of loss of synchronization) the interface hardware is reset and the DTR signal is held inactive for at least the specified interval. This function is useful for handling encrypting or other similar devices that use the toggling of the DTR signal to resynchronize.To configure DTR signal pulsing, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Configure DTR signal pulsing. | pulse-time seconds |
You can configure the clock rate for appliques (connector hardware) on the serial interface of the MCI and SCI cards to an acceptable bit rate. To do so, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Configure the clock rate on serial interfaces. |
Snapshot routing, which is available on serial lines, is a method of learning remote routes dynamically and then keeping the routes available for a period of time while regular routing updates are not being exchanged. This might be during periods when a remote site has not dialed into the local site or when a remote site has a dedicated connection to the local site but wishes to avoid the overhead of exchanging routing updates. Snapshot routing allows you to avoid configuring static routes when using dial-on-demand routing. It also eliminates the overhead required for sending periodic updates over dedicated serial lines.
When configuring snapshot routing, you choose one router on the interface to be the client router and one or more other routers to be server routers. The client router determines the frequency at which routing information is exchanged between routers.
Routing information is exchanged during an active period. At the end of this period, the router takes a snapshot of the entries in the routing table. These entries remain frozen during a quiet period. At the end of the quiet period, another active period starts during which routing information is again exchanged. See Figure 6-5.
When the router transitions from the quiet period to the active period, the line might not be available for a variety of reasons. For example, the line might be down or busy, or the PVC might be down. If this happens, the router has to wait through another entire quiet period before it can update its routing table entries. This might be a problem if the quiet period is very long, for example, around 12 hours. To avoid having to wait through the quiet period, you can configure a retry period. If the line is not available when the quiet period ends, the router waits for the amount of time specified by the retry period and then transitions to an active period. See Figure 6-6.
Snapshot routing is useful in two command situations:
The following routing protocols support snapshot routing. Note that these are all distance-vector protocols.
To configure snapshot routing, perform the tasks described in the following sections. The tasks in the first two sections are required; those in the remaining section are optional:
To configure snapshot routing on the client router that is connected to a dedicated serial line, perform the following steps starting in global configuration mode:
| Task | Command |
|---|---|
Step 1. Specify a serial interface. | interface serial number |
Step 2. Configure the client router. | snapshot client active-time quiet-time [suppress-statechange-updates] [dialer] |
To configure snapshot routing on the client router connected to an interface configured for DDR, perform the following steps starting in global configuration mode:
| Task | Command |
|---|---|
Step 1. Specify a serial interface. | interface serial number |
Step 2. Configure a dialer rotary group. | dialer rotary-group number |
Step 3. Specify a dialer interface. | interface dialer number |
Step 4. Configure the client router. | snapshot client active-time quiet-time [suppress-statechange-updates] [dialer] |
Step 5. Define a dialer map. | dialer map snapshot next-hop address dial-string |
Repeat Step 5 for each map you want to define.
To configure snapshot routing on the server router that is connected to a dedicated serial line, perform the following steps starting in global configuration mode:
| Task | Command |
|---|---|
Step 1. Specify a serial interface. | interface serial number |
Step 2. Configure the server router. | snapshot server active-time [dialer] |
The active period for the client router and its associated server routers should be the same.
To monitor and maintain snapshot routing, perform one or both of the following tasks in EXEC mode:
| Task | Command |
|---|---|
Terminate the quiet period on the client router within two minutes. | clear snapshot quiet-time interface |
Display information about snapshot routing parameters. | show snapshot interface |
This task applies to Quad Serial NIM interfaces on the Cisco 4000 series and Hitachi-based serial interfaces on the Cisco 2500 series and Cisco 3000 series.
By default, when the serial interface is operating in DTE mode, it monitors the Data Carrier Detect (DCD) signal as the line up/down indicator. By default, the attached DCE device sends the DCD signal. When the DTE interface detects the DCD signal, it changes the state of the interface to up.
In some configurations, such as an SDLC multidrop environment, the DCE device sends the Data Set Ready (DSR) signal instead of the DCD signal, which prevents the interface from coming up. To tell the interface to monitor the DSR signal instead of the DCD signal as the line up/down indicator, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Configure the serial interface to monitor the DSR signal as the line up/down indicator. |
The Dynamic Host Configuration Protocol (DHCP) model consists of the following components:
The DHCP client-proxy feature manages a pool of IP addresses available to PPP or SLIP dial-in clients without a known IP address. This allows a finite number of IP addresses to be reused quickly and efficiently by many clients. Additional benefits include the ability to maintain sessions, such as Telnet, even when a modem line fails. When the client is auto-dialed back into the server, the session can be resumed because the same IP address is reissued to the client by the server.
You can designate all of the communication server's asynchronous interfaces to use DHCP or can turn off DHCP on individual interfaces. Cisco's implementation of DHCP complies with RFC 1541, and is compliant with Extended TACACS.
To enable DHCP on a communication server's asynchronous interfaces, perform the following tasks, starting in global configuration mode:
| Task | Command |
|---|---|
Step 1. Specify that the communication server use the DHCP client-proxy feature on all asynchronous interfaces. | |
Step 2. (Optional) Specify the IP address of at least one and up to ten DHCP servers for the proxy-client (the Cisco access server) to use. DHCP servers provide temporary IP addresses. | ip dhcp-server [ip-address | name] |
Step 3. (Optional) Enter interface configuration mode. | interface async interface-number |
Step 4. (Optional) Turn off DHCP on any asynchronous interfaces on the access server, as needed. |
Ethernet interfaces on the communication server support several encapsulation methods, depending upon the application type code and media type, as follows:
Establish Ethernet encapsulation by selecting one of the Ethernet encapsulation methods, using the appropriate command in interface configuration mode, as follows:
| Task | Command |
|---|---|
Select ARPA Ethernet encapsulation. | |
Select SAP Ethernet encapsulation. | |
Select SNAP Ethernet encapsulation. |
Perform the tasks in this section to configure the Maintenance Operation Protocol (MOP).
You can enable MOP on an interface by performing the following task in interface configuration mode:
| Task | Command |
|---|---|
Enable MOP. |
You can enable an interface to send out periodic MOP system identification messages on an interface by performing the following task in interface configuration mode:
| Task | Command |
|---|---|
Enable MOP message support. |
Perform the tasks in this section to configure Token Ring features.
The Token Ring interface on the CSC-1R and CSC-2R can run at either 4 or 16 Mbps. Token Ring interfaces do not default to any particular ring speed; you must select the speed the first time you use them.
| Caution Configuring a ring speed that is wrong or incompatible with the connected Token Ring causes the ring to beacon, which effectively takes the ring down and makes it nonoperational. |
| Task | Command |
|---|---|
Select the ring speed. | ring-speed speed |
You do not need to select the ring speed for the CSC-R16 Token Ring interface card.
Our Token Ring interfaces support early token release, a method whereby the interface releases the token back onto the ring immediately after transmitting rather than waiting for the frame to return. This feature can help to increase the total bandwidth of the Token Ring. To configure the interface for early token release, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Enable early token release. | early-token-release |
The Point-to-Point Protocol (PPP), described in RFCs 1331 and 1332, is a method of encapsulating network layer protocol information over point-to-point links.
The current implementation of PPP supports option 3, authentication using CHAP or PAP, option 4, Link Quality Monitoring, and option 5, Magic Number configuration options. The software always sends option 5 and will negotiate for options 3 and 4 if so configured. All other options are rejected.
IP and IPX upper-layer protocols are supported.
The software provides PPP as an encapsulation method. It also provides the Challenge Handshake Authentication Protocol (CHAP) and Password Authentication Protocol (PAP) on serial interfaces running PPP encapsulation. The following sections describe the tasks to configure these features.
You can enable the Point-to-Point Protocol on serial lines to encapsulate IP and SLIP datagrams. To do so, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Enable the PPP encapsulation. |
PPP echo requests are used as keepalives to minimize disruptions to the end users of your network. Use the no keepalive command to disable echo requests.
Access control using Challenge Handshake Authentication Protocol (CHAP) or Password Authentication Protocol (PAP) is available on all serial interfaces that use PPP encapsulation. The authentication feature reduces the risk of security violations on your communication server. You can configure either CHAP or PAP for the interface.
When CHAP is enabled is enabled on an interface, the local communication server sends a CHAP packet and the remote device (a PC, workstation, router, or communication server) attempting to connect to the local communication server or router is requested, or "challenged," to respond.
The challenge consists of an ID, a random number, and either the host name of the local communication server or the name of the user on the remote device. This challenge is transmitted to the remote device.
The required response consists of two parts:
When the local communication server receives the challenge response, it verifies the secret by looking up the name given in the response and performing the same encryption operation. The secret passwords must be identical on the remote device and the local communication server or router.
By transmitting this response, the secret is never transmitted, preventing other devices from stealing it and gaining illegal access to the system. Without the proper response, the remote device cannot connect to the local communication server.
CHAP transactions occur only at the time a link is established. The local communication server does not request a password during the rest of the call. (The local communication server can, however, respond to such requests from other devices during a call.)
To use CHAP, you must perform the following tasks:
1. Enable CHAP on the interface.
2. Configure server host name or username authentication.
Perform the following tasks in interface configuration mode:
| Task | Command |
|---|---|
Step 1. Enable CHAP or PAP. | ppp authentication {chap | pap} [if-needed] or |
Step 2. Configure host authentication |
| 1These commands are documented in the "System Management Commands" chapter of the Access and Communication Servers Command Reference publication. |
The optional argument if-needed can only be used with TACACS or XTACACS. The optional keyword list-name can only be used with AAA/TACACS+. CHAP is specified in RFC 1334. It is an additional authentication phase of the PPP Link Control Protocol.
For an example of CHAP, see the section "CHAP with an Encrypted Password Example" at the end of this chapter. CHAP is specified in the IETF RFC 1334 "The PPP Authentication Protocols" by Brian Lloyd of Lloyd and Associates and William A. Simpson of Computer Systems Consulting Services. CHAP is specified as an additional authentication phase of the PPP Link Control Protocol.
Link Quality Monitor (LQM) is available on all serial interfaces running PPP. LQM monitors the link quality and takes the link down when the quality drops below a configured percentage. The percentages are calculated for both the incoming and outgoing directions. The outgoing quality is calculated by comparing the total number of packets and bytes sent with the total number of packets and bytes received by the peer. The incoming quality is calculated by comparing the total number of packets and bytes received with the total number of packets and bytes sent by the peer.
When LQM is enabled, Link Quality Reports (LQRs) are sent every keepalive period. LQRs are sent in place of keepalives. All incoming keepalives are responded to properly. If LQM is not configured, keepalives are sent every keepalive period and all incoming LQRs are responded to with an LQR.
LQR is specified in the IETF RFC-1333, "PPP Link Quality Monitoring" by William A. Simpson of Computer Systems Consulting Services. The latest version is dated May 1992.
To enable LQM on the interface, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Enable LQM on the interface. | ppp quality percentage |
The percentage argument specifies the link quality threshold. That percentage must be maintained, or the link is deemed to be of poor quality and taken down.
Magic Number support is available on all serial interfaces. When using PPP, PPP will always attempt to negotiate for Magic Numbers, which are used to detect looped-back nets. The link might or might not be taken down upon looped-back detection, depending on the use of the down-when-looped command.
The dial backup service provides protection against WAN downtime by allowing you to configure a backup serial line via a circuit-switched connection.
To configure dial backup, associate a secondary serial interface as a backup to a primary serial interface. This feature requires that an external modem or CSU/DSU device attached to a circuit-switched service be connected on the secondary serial interface. The external device must be capable of responding to a DTR signal (DTR active) by automatically dialing a connection to a preconfigured remote site.
The dial backup software keeps the secondary line inactive (DTR inactive) until one of the following conditions is met:
These conditions are defined using the interface configuration commands described later in this section.
When the software detects a lost Carrier Detect signal from the primary line device or finds that the line protocol is down, it activates DTR on the secondary line. At that time, the modem or CSU/DSU device must be set to dial the remote site. When that connection is made, the routing protocol defined for the serial line will continue the job of transmitting traffic over the dialup line.
You also can configure the dial backup feature to activate the secondary line based upon traffic load on the primary line.
The software monitors the traffic load and computes a five-minute moving average. If this average exceeds the value you set for the line, the secondary line is activated, and depending upon how the line is configured, some or all of the traffic will flow onto the secondary dialup line.
Perform the following tasks in interface configuration mode:
See the section "Dial Backup Service Examples" at the end of this chapter for examples of dial backup configuration.
For more information about dial backup, refer to the chapter "Configuring Dial-on-Demand Routing" later in this manual.
When an interface has a backup interface configured, it is often desirable that the backup interface be enabled when the primary interface is either down or in loopback. By default, the backup is only enabled if the primary interface is down. By using the down-when-looped command, the backup interface will also be enabled if the primary interface is in loopback. To achieve this condition, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Configure an interface to tell the system it is down when loopback is detected. | down-when-looped |
If testing an interface with the loopback command, down-when-looped should not be configured, or packets will not be transmitted out the interface that is being tested.
Each interface has a hold-queue limit. This limit is the number of data packets that the interface can store in its hold queue before rejecting new packets. When the interface empties one or more packets from the hold queue, the interface can accept new packets again. You can specify the hold-queue limit of an interface in interface configuration mode as follows:
| Task | Command |
|---|---|
Specify the maximum number of packets allowed in the hold queue. |
Higher-level protocols use bandwidth information to make operating decisions. For example, IGRP uses the minimum path bandwidth to determine a routing metric. The TCP protocol adjusts initial retransmission parameters based on the apparent bandwidth of the outgoing interface. Perform the following task in interface configuration mode to set a bandwidth value for an interface:
| Task | Command |
|---|---|
Set a bandwidth value. |
The bandwidth setting is a routing parameter only; it does not affect the physical interface.
Higher-level protocols might use delay information to make operating decisions. For example, IGRP can use delay information to differentiate between a satellite link and a land link. To set a delay value for an interface, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Set a delay value for interfaces. |
Specifying the delay value sets an informational parameter only; you cannot adjust the actual delay of an interface with this configuration command.
To adjust the frequency of update messages, perform the following the following task in interface configuration mode:
| Task | Command |
|---|---|
Adjust the frequency with which the communication server sends messages to itself (Ethernet and Token Ring) or to the other end (HDLC-serial and PPP-serial links) to ensure that a network interface is alive for a specified interface. | keepalive [seconds] |
When adjusting the keepalive timer for a very low bandwidth serial interface, large packets can delay the smaller keepalive packets long enough to cause the line protocol to go down. You might need to experiment to determine the best value.
You can control the size of the transmit queue available to a specified interface on the MCI and SCI cards. To limit the size, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Limit the size of the transmit queue. |
Each interface has a default maximum packet size or maximum transmission unit (MTU) size. This number generally defaults to 1500 bytes. On serial interfaces, the MTU size varies, but cannot be set smaller than 64 bytes. To adjust the maximum packet size, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Adjust the maximum packet size or MTU size. |
You can perform the tasks in the following sections to monitor and maintain the interfaces:
The software contains commands that you can enter at the EXEC prompt to display information about the interface, including the version of the software and the hardware, the controller status, and statistics about the interfaces. The following table lists some of the interface monitoring tasks. (The full list of show commands can be displayed by entering the show ? command at the EXEC prompt.) These commands are fully described in the Access and Communication Servers Command Reference publication.
Perform the following commands in EXEC mode:
| 1This command is documented in the "System Image, Microcode Image, and Configuration File Load Commands" chapter of the Access and Communication Servers Command Reference publication. |
To clear the interface counters shown with the show interfaces command, enter the following command at the EXEC prompt:
| Task | Command |
|---|---|
Complete the following tasks in EXEC mode to clear and reset interfaces. Under normal circumstances, you do not need to clear the hardware logic on interfaces.
| Task | Command |
|---|---|
Reset the hardware logic on an asynchronous serial line. | |
clear rif-cache |
You can disable an interface. Doing so disables all functions on the specified interface and marks the interface as unavailable on all monitoring command displays. This information is communicated to other network servers through all dynamic routing protocols. The interface will not be mentioned in any routing updates. On serial interfaces, this command causes the DTR signal to be dropped. On Token Ring interfaces, this command causes the interface to deinsert from the ring.
To shut down an interface and then restart the disabled interface, perform the following tasks in interface configuration mode:
| Command | Task |
|---|---|
Shut down an interface. | |
Reenable an interface. | no shutdown |
To check whether an interface is disabled, use the EXEC command show interfaces. An interface that has been shut down is shown as administratively down in the show interfaces command display. See examples in the section "Interface Shutdown Examples" at the end of this chapter.
You can use a loopback test on lines to detect and distinguish equipment malfunctions between line and modem or Channel Service Unit/Digital Service Unit (CSU/DSU) problems on the network server. If correct data transmission is not possible when an interface is in loopback mode, the interface is the source of the problem. The DSU might have similar loopback functions you can use to isolate the problem if the interface loopback test passes. If the device does not support local loopback, this function will have no effect.
You can specify hardware loopback tests on the Ethernet and synchronous serial interfaces, and all Token Ring interfaces (except the CSC-R 4-megabit card) that are attached to CSU/DSUs, and that support the local loopback signal. The CSU/DSU acts as a data communications equipment (DCE) device; the communication server acts as a data terminal equipment (DTE) device. The local loopback test generates a CSU loop—a signal that goes through the CSU/DSU to the line, then back through the CSU/DSU to the communication server. The ping command can also be useful during loopback operation.
The loopback tests are available on the following interfaces:
The following sections describe each test.
The MCI and SCI serial interface cards support the loopback function when a CSU/DSU or equivalent device is attached to the communication server. Perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Enable loopback through a CSU/DSU to configure a CSU loop on the MCI and SCI synchronous serial interfaces. |
The Ethernet interfaces on the MCI and MEC cards support loopback mode. To enable loopback mode on them, perform the following task in interface configuration mode:
| Task | Command |
|---|---|
Enable loopback to verify that the interface receives back every packet it sends. |
The communication server software provides an Ethernet loopback server that supports Digital, Intel, and Xerox systems specified by the "blue book," a joint specification written by Digital, Intel, and Xerox that defines the Ethernet protocol. The loopback server responds to forward data loopback messages sent either to the server's MAC address or to the broadcast address. Currently, the Ethernet loopback server does not respond to the loopback assistance multicast address.
Use the Ethernet loopback server to test communications between your internetworking products and Digital systems that do not support the IP ping command, such as DECnet-only VMS systems.
To originate a loop test on your VMS system with a Cisco server, use the Digital Network Control Program (NCP) command Loop Circuit. For more information about the Loop Circuit command, consult the DECnet VAX documentation. Cisco network servers support all options that can be specified by the VMS hosts.
You can place all of the Token Ring interface cards except the 4-MB CSC-R card into loopback mode by performing the following task in interface configuration mode:
| Task | Command |
|---|---|
Enable loopback to verify that the Token Ring interface receives back every packet it sends. |
Use the configuration examples in the following sections to understand some aspects of interface configuration:
The following example illustrates how to begin interface configuration. It assigns Point-to-Point (PPP) encapsulation to serial interface 0.
interface serial 0
encapsulation ppp
The following example assumes that users are restricted to certain servers designated as asynchronous servers, but that normal terminal users can access anything on the local network:
! access list for normal connections
access-list 1 permit 131.108.0.0 0.0.255.255
!
access-list 2 permit 131.108.42.55
access-list 2 permit 131.108.111.1
access-list 2 permit 131.108.55.99
!
interface async 1
async dynamic address
ip access-group 1 out
ip access-group 2 in
In the following example, a line that is in asynchronous mode is using PPP encapsulation (see
Figure 6-7). The IP address of the PC is ntpc (assuming that the name ntpc is in the DNS so that it can be resolved to a real IP address). The person typing this command is on a PC running a terminal emulator program.
Router> ppp ntpc@server1 /routing /compressed
The following example shows how to make a connection when a permanent address is assigned and dynamic addressing is not allowed. An authentication request is sent to the TACACS server, and if it is approved, the line is placed in SLIP mode and the IP address is displayed.
cs> slip
Entering SLIP mode.
Your IP address is 192.31.7.28, MTU is 1500 bytes
The following example illustrates the prompts displayed and the response required when dynamic addressing is used to assign the SLIP address:
cs> slip
IP address or hostname? 192.31.6.15
Password:
Entering SLIP mode
Your IP address is 192.31.6.15, MTU is 1500 bytes
The following example illustrates the implementation of header compression on the interface with the IP address 128.66.2.1:
cs> slip /compressed 128.66.2.1
Password:
Entering SLIP mode.
Interface IP address is 128.66.2.1, MTU is 1500 bytes.
Header compression is On.
In the following example, header compression is configured as passive, so the status of header compression is assigned by the user-level slip or ppp command:
cs> slip 1.0.0.1@check
Password:
Entering SLIP mode.
Interface IP address is 1.0.0.1, MTU is 1500 bytes
Header compression will match your system.
The following example illustrates how to add a description about an interface that will appear in configuration files and monitoring command displays:
interface ethernet 0
description First Ethernet in network 1
ip address 101.13.15.78 255.255.255.0
The following example turns off Ethernet interface 0:
interface ethernet 0
shutdown
The following example turns the interface back on:
interface ethernet 0
no shutdown
The following example illustrates how to shut down a Token Ring interface:
interface tokenring 0
shutdown
Figure 6-8 shows a configuration that will route a private IP network and a Novell network across a Public Service Provider. The configurations for communication servers A and B follow Figure 6-8.
interface ethernet 0
description boston office
ip address 10.1.1.1 255.255.255.0
novell network 1e
interface serial 0
description connection to NEARnet
ip address 192.13.2.1 255.255.255.0
interface tunnel 0
tunnel source serial 0
tunnel destination 131.108.5.2
ip address 10.1.2.1 255.255.255.0
novell network 1f
interface ethernet 0
description menlo park office
ip address 10.1.3.1 255.255.255.0
novell network 31
interface serial 4
description connection to BARRnet
ip address 131.108.5.2 255.255.255.0
interface tunnel 0
tunnel source serial 4
tunnel destination 192.13.2.1
ip address 10.1.2.2 255.255.255.0
novell network 1f
The following configuration examples enable CHAP on serial interface 0 of three communication servers.
hostname yyy
interface serial 0
encapsulation ppp
ppp authentication chap
username xxx password secretxy
username zzz password secretzy
hostname xxx
interface serial 0
encapsulation ppp
ppp authentication chap
username yyy password secretxy
username zzz password secretxz
hostname zzz
interface serial 0
encapsulation ppp
ppp authentication chap
username xxx password secretxz
username yyy password secretzy
When you look at the configuration file, the passwords will be encrypted and the display will look similar to the following:
hostname xxx
interface serial 0
encapsulation ppp
ppp authentication chap
username yyy password 7 121F0A18
username zzz password 7 1329A055
The dial backup service examples show configurations for the following conditions:
The following example configures serial 1 as a secondary line that activates only when the primary line (serial 0) goes down. The secondary line will not be activated due to load of the primary.
interface serial 0
backup interface serial 1
backup delay 30 60
The secondary line is configured to activate 30 seconds after the primary line goes down and to remain on for 60 seconds after the primary line is reactivated.
The following example configures the secondary line (serial 1) to be activated only when the load of the primary line reaches a certain threshold:
interface serial 0
backup interface serial 1
backup load 75 5
In this case, the secondary line will not be activated when the primary goes down. The secondary line will be activated when the load on the primary line is greater than 75 percent of the primary's bandwidth. The secondary line will then be brought down when the aggregate load between the primary and secondary lines fits within 5 percent of the primary bandwidth.
This example configures the secondary line to activate once the traffic threshold on the primary line exceeds 25 percent:
interface serial 0
backup interface serial 1
backup load 25 5
backup delay 10 60
Once the aggregate load of the primary and the secondary lines return to within 5 percent of the primary bandwidth, the secondary line is deactivated. The secondary line waits 10 seconds after the primary goes down before activating, and remains active for 60 seconds after the primary returns and becomes active again.
The following global configuration example enables DHCP proxy-client status on all asynchronous interfaces on the communication server:
ip address-pool dhcp-proxy-client
The following global configuration example illustrates how to specify which DHCP servers are used on your network. You can specify up to four severs using IP addresses or names. If you do not specify servers, the default is to use the IP limited broadcast address of 255.255.255.255 for transactions with any and all discovered DHCP servers.
ip dhcp-server jones smith wesson
The following interface configuration example illustrates how to disable DHCP proxy-client functionality on asynchronous interface 1:
async interface
interface 1
peer default ip address pool
The following example configures snapshot routing on a DDR interface on the client router. In this configuration, a single client router can call multiple server routers. The absence of the suppress-statechange-updates keyword means that routing updates will be exchanged each time the line protocol goes from "down" to "up" or from "dialer spoofing" to "fully up." The dialer keyword allows the client router to dial the server router in the absence of regular traffic if the active period time expires.
interface serial 0
dialer rotary-group 3
!
interface dialer 3
dialer in-band
snapshot client 5 360 dialer
snapshot retry-interval 5
dialer map snapshot 2 4155556734
dialer map snapshot 3 7075558990
The following commands configure the server router:
interface serial 2
snapsnot server 5 dialer
Posted: Mon Oct 21 11:47:12 PDT 2002
All contents are Copyright © 1992--2002 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.