auth-nocache
This command disables the password caching of the OPENVPN client user.
The use of a negative form (no) of the command activates caching the password of the OPENVPN client user.
Syntax
[no] auth-nocache
Parameters
None.
Default value
Caching is allowed.
Required privilege level
15
Command mode
CONFIG-OPENVPN
Example
esr(config)# auth-nocache
authentication algorithm
This command sets the authentication algorithm, which is used for authentication when connecting to the OPENVPN server.
The use of a negative form (no) of the command removes the authentication algorithm.
Syntax
authentication algorithm <ALGORITHM>
no authentication algorithm
Parameters
<ALGORITHM> – authentication algorithm, may take values: md4, rsa-md4, md5, rsa-md5, mdc2, rsa-mdc2, sha, sha1, rsa-sha, rsa-sha1, rsa-sha1-2, dsa, dsa-sha, dsa-sha1, dsa-sha1-old, ripemd160, rsa-ripemd160, ecdsa-with-sha1, sha-224, rsa-sha-224, sha-256, rsa-sha-256, sha-384, rsa-sha-384, sha-512, rsa-sha-512, whirlpool.
Default value
Unspecified.
Required privilege level
15
Command mode
CONFIG-OPENVPN
Example
esr(config-openvpn)# authentication algorithm md5
authentication method
The command specifies authentication method which will be used when establishing a remote connection by PPPoE, PPTP and L2TP clients.
The use of a negative form (no) of the command removes a specified authentication method.
Syntax
authentication method <METHOD>
no authentication method <METHOD>
Parameters
<METHOD> – authentication method, possible values: chap, mschap, mschap-v2, eap, pap.
Default value
chap
Required privilege level
10
Command mode
CONFIG-PPPOE
CONFIG-PPTP
CONFIG-L2TP
Example
esr(config-pppoe)# authentication method mschap-v2
certificate
This command specifies the necessary certificates for connecting to the OPENVPN server.
The use of a negative form (no) of the command removes certificate name from the configuration.
Syntax
certificate <CERTIFICATE-TYPE> <NAME>
no certificate <CERTIFICATE-TYPE>
Parameters
<CERTIFICATE-TYPE> – certificate or key type, may take the following values:
- ca – certificate authority certificate;
- client-crt – client certificate;
- client-key – client key;
- crl – Certificate Revocation List;
- dh – Diffie-Hellman key;
- ta – HMAC key.
<NAME> – certificate or key name, set by the string of up to 31 characters.
Default value
None
Required privilege level
15
Command mode
CONFIG-OPENVPN
Example
esr(config-openvpn)# certificate ca KEY
clear ip nhrp
This command clears NHRP records from the router.
Syntax
clear ip nhrp [ {dynamic|static|incomplete|nhs} ] [ {nbma-address <ADDR>|tunnel gre <ID>|tunnel-address <ADDR>} ] [ vrf <VRF> ]
Parameters
<ID> – tunnel identifier;
<ADDR> – IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255];
<VRF> – VRF instance name, set by the string of up to 31 characters. When this parameter is specified, the NHRP records specified in this VRF will be deleted;
dynamic – clear dynamically acquired information;
incomplete – clear blank entries;
nbma-address – clear entries regarding a specific NBMA address;
nhs – clear entries regarding a specific NHS;
static – clear statically set records;
tunnel – clear entries regarding a specific tunnel;
tunnel-address – clear entries regarding a specific tunnel;
vrf – clear records in a specific VRF.
Required privilege level
10
Command mode
ROOT
Example
esr# clear ip nhrp vrf vrf_test tunnel gre 9 static
clear tunnels counters
The command performs the reset of specified tunnel/tunnel group counters.
Syntax
clear tunnels counters [ <TUN> ]
Parameters
<TUN> – the name of the tunnel is specified as described in section Types and naming order of router tunnels;
You can specify several tunnels separated by commas ',' or you can specify the range of ports with '-'. If tunnel indexes are not specified, then the counters of all tunnels of a specified group will be cleared.
Required privilege level
10
Command mode
ROOT
Example
esr# clear tunnels counters gre 25
compression
This command enables the mechanism of transmitted data compression between clients and the OPENVPN server.
The use of a negative form (no) of the command disables the mechanism of transmitted data compression.
Syntax
[no] compression
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
10
Command mode
CONFIG-OPENVPN
Example
esr(config-openvpn)# compression
description
The command is used to change a description of configured tunnel.
The use of a negative form (no) of the command removes a specified description.
Syntax
description <DESCRIPTION>
no description
Parameters
<DESCRIPTION> – tunnel description, set by the string of up to 255 characters.
Required privilege level
10
Command mode
CONFIG-IP4IP4
CONFIG-SUBTUNNEL
CONFIG-GRE
CONFIG-L2TP
CONFIG-L2TPV3
CONFIG-VTI
CONFIG-LT
CONFIG-PPTP
CONFIG-PPPOE
CONFIG-OPENVPN
Example
esr(config-gre)# description "tunnel to branch"
dscp
The command sets the DSCP code value for the use in IP headers of encapsulate packets.
The use of a negative form (no) of the command sets the default DSCP value.
Syntax
dscp <DSCP>
no dscp
Parameters
<DSCP> – DSCP code value, takes values in the range of [0..63].
Default value
Inherited from encapsulated packet.
Required privilege level
10
Command mode
CONFIG-IP4IP4
CONFIG-GRE
Example
esr(config-ip4ip4)# dscp 40
enable
The command enables a tunnel.
The use of a negative form (no) of the command disables the tunnel.
Syntax
[no] enable
Parameters
The command does not contain parameters.
Default value
Tunnel is disabled.
Required privilege level
10
Command mode
CONFIG-IP4IP4
CONFIG-GRE
CONFIG-SUBTUNNEL
CONFIG-L2TP
CONFIG-L2TPV3
CONFIG-VTI
CONFIG-LT
CONFIG-PPTP
CONFIG-PPPOE
CONFIG-OPENVPN
Example
esr(config-gre)# enable
encryption algorithm
This command selects the encryption algorithm used when data transmission.
The use of a negative form (no) of the command disables the encryption.
Syntax
encryption algorithm <ALGORITHM>
no encryption algorithm
Parameters
<ALGORITHM> – encryption protocol identifier, takes the following values: des, blowfish128, aes128, des-ede, aes192, 3des, desx, aes256.
Default value
Encryption disabled.
Required privilege level
15
Command mode
CONFIG-OPENVPN
Example
esr(config-openvpn)# encryption algorithm aes128
history statistics
The command enables maintenance of a current tunnel usage statistics.
The use of a negative (no) form of the command disable maintenance of a current tunnel usage statistics.
Syntax
[no] history statistics
Parameters
None.
Required privilege level
10
Command mode
CONFIG-GRE
CONFIG-SOFTGRE
CONFIG-SUBTUNNEL
CONFIG-IP4IP4
CONFIG-L2TPV3
CONFIG-LT
CONFIG-VTI
CONFIG-PPTP
CONFIG-PPPOE
CONFIG-OPENVPN
Example
esr:esr(config-ip4ip4)# history statistics
ignore-default-route
The command enables the mode in which a default route received from the server is not set in the routing table.
The use of a negative form (no) of the command sets the default value.
Syntax
[no] ignore-default-route
Parameters
The command does not contain parameters.
Default value
A default route received from the server is set in the routing table.
Required privilege level
10
Command mode
CONFIG-L2TP
CONFIG-PPTP
CONFIG-PPPOE
Example
esr(config-pptp)# ignore-default-route
interface
The command specifies the interface for PPPoE connection establishing.
The use of a negative form (no) of the command removes a specified interface.
Syntax
interface <IF>
no interface
Parameters
<IF> – an interface or a group of interfaces is specified in the form described in Section Types and naming order of router interfaces.
Required privilege level
10
Command mode
CONFIG-PPPOE
Example
esr(config-pppoe)# interface gigabitethernet 1/0/5.100
ip nhrp authentication
The command enables authentication for NHRP protocol. All participants in the NHRP process must have the same password.
The use of a negative form (no) of the command disables the authentication.
Syntax
ip nhrp authentication <WORD>
[no] ip nhrp authentication
Parameters
<WORD> – unencrypted password, set by the string of [1..8] characters, may include [0-9a-fA-F] characters.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# ip nhrp authentication pass
ip nhrp enable
This command enables NHRP in the router tunnel.
The use of a negative form (no) of the command disables the NHRP protocol on the router.
Syntax
[no] ip nhrp enable
Parameters
The command does not contain parameters.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# ip nhrp enable
ip nhrp holding-time
This command sets the time during which a client record will exist on the NHRP server. This command also sets the frequency of client sending requests for registration to the NHRP server; it is equal to 1/3 of NHRP holding time.
The use of a negative form (no) of the command sets the default value.
Syntax
ip nhrp holding-time <TIME>
[no] ip nhrp holding-time
Parameters
<TIME> – the time in seconds during which a record about this client will exist on the server takes the values [1..65535].
Default value
7200 seconds
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# ip nhrp holding-time
ip nhrp ipsec
This command specifies the use of the previously created IPsec-VPN on the mGRE tunnel.
The use of a negative form (no) of the command disables the use of IPsec-VPN with the mGRE tunnel.
Syntax
ip nhrp ipsec <WORD> { static | dynamic }
no ip nhrp ipsec <WORD> { static | dynamic }
Parameters
<WORD> – VPN name, set by the string of up to 31 characters.
static – static connection, used to communicate with the NHRP server, set on the client, unlimited in time;
dynamic – dynamically established connection, configured to communicate with the NHRP client.
Required privilege level
15
Command mode
CONFIG-GRE
Example
esr(config-gre)# ip nhrp ipsec VPN static
ip nhrp map
This command sets the match between 'internal' tunnel address and the 'external' NBMA address.
The use of a negative form (no) of the command removes the match.
Syntax
[no] ip nhrp map <ADDR-IN> <ADDR-OUT>
Parameters
<ADDR-IN> –tunnel interface IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255].
<ADDR-OUT> – external interface IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255].
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# ip nhrp map 192.168.1.2 67.86.141.231
ip nhrp multicast
This command defines the destination of multicast traffic.
The use of a negative form (no) of the command removes the destination.
Syntax
[no] ip nhrp multicast { dynamic | nhs | <ADDR> }
Parameters
dynamic — sends traffic to all peers with which there is a connection;
nhs — sends to all static configured NHRP servers;
<ADDR> – sends to specifically configured IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255].
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# ip nhrp multicast nhs
ip nhrp nhs
This command is used to set the 'logical (tunnel)' address of the NHRP server.
The use of a negative form (no) of the command removes the entry about server.
Syntax
ip nhrp nhs <ADDR/LEN> [ no-registration ]
no ip nhrp nhs <ADDR/LEN>
Parameters
<ADDR/LEN> – address, defined as AAA.BBB.CCC.DDD/EE where each part AAA-DDD takes values of [0..255] and EE takes values of [1..32];
no-registration — do not register on the NHRP server.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# ip nhrp nhs 192.168.1.2
ip nhrp redirect
This command enables the mode in which the NHRP server can send NHRP Traffic Indication messages.
The use of a negative form (no) of the command disables the mode.
Syntax
[no] ip nhrp redirect
Parameters
The command does not contain parameters.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# ip nhrp redirect
ip nhrp shortcut
This command enables a mode that allows the use of the shortest routes for communication with other clients.
The use of a negative form (no) of the command disables the mode.
Syntax
[no] ip nhrp shortcut
Parameters
The command does not contain parameters.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# ip nhrp shortcut
ipsec authentication method
This command selects the key authentication method for the IKE connection. Message authentication by key is used when an IKE connection is established. The key is set by the 'ipsec authentication pre-shared-key' command (see section ipsec authentication pre-shared-key).
The use of a negative form (no) of the command sets the default value.
Syntax
ipsec authentication method pre-shared-key
no ipsec authentication method
Parameters
pre-shared-key – authentication method using pre-received encryption keys.
Required privilege level
10
Command mode
CONFIG-L2TP
Example
esr(config-l2tp-server)# ipsec authentication method psk
ipsec authentication pre-shared-key
This command specifies a shared secret authentication key that should be the same for both parties of the tunnel.
The use of a negative form (no) of the command removes a set key.
Syntax
ipsec authentication pre-shared-key { ascii-text { <TEXT> | encrypted <ENCRYPTED-TEXT> }| hexadecimal {<HEX> | encrypted <ENCRYPTED-HEX> } }
no ipsec authentication pre-shared-key
Parameters
<TEXT> – string [1..64] ASCII characters.
<HEX> – number, [1..32] bytes size, set by the string of [2..128] characters in hexadecimal format (0xYYYY ...) or (YYYY ...).
<ENCRYPTED-TEXT> – encrypted password, [1..32] bytes size, set by the string of [2..128] characters.
<ENCRYPTED-TEXT> – encrypted number, [2..64] bytes size, set by the string of [2..256] characters.
Default value
none
Required privilege level
10
Command mode
CONFIG-L2TP
Example
esr(config-l2tp-server)# ipsec authentication pre-shared-key ascii-text password
keepalive dhcp dependent-interface
The command enables the mechanism of IP addresses iterative query using DHCP on the specified interfaces when the GRE tunnel is disconnected via keepalive. You can specify up to 8 interfaces for each GRE tunnel.
The use of a negative form (no) of the command disables the mechanism of IP addresses iterative query using DHCP.
Syntax
keepalive dhcp dependent-interface <IF>
no keepalive dst-address
Parameters
<IF> – an interface, specified in the form described in Section Types and naming order of router interfaces.
Default value
None
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# keepalive dhcp dependent-interface gi 1/0/1
keepalive dhcp link-timeout
The command specifies the time interval between GRE tunnel disabling and IP address iterative query on the interface/interfaces specified by the keepalive dhcp dependent-interface command (see Section keepalive dhcp dependent-interface)
The use of a negative form (no) of the command sets the default value.
Syntax
keepalive dhcp link-timeout <SEC>
no keepalive dhcp link-timeout
Parameters
<SEC> – interval between GRE tunnel disabling and IP address iterative query on the interface/interfaces specified by the keepalive dhcp dependent-interface command, takes the value of [1..32767] seconds.
Default value
10 seconds
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# keepalive dhcp link-timeout 90
keepalive dst-address
The command configures IP address to send keepalive packets for checking tunnel capability. If a specified IP address is not available, the tunnel switches the operational status to DOWN. The parameter has a value only with keepalive mechanism enabled (see Section keepalive enable).
The use of a negative form (no) of the command disables the checking.
Syntax
keepalive dst-address <ADDR>
no keepalive dst-address
Parameters
<ADDR> – IP address to check GRE tunnel capability.
Default value
None
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# keepalive dst-address 192.168.1.57
keepalive enable
The command enables the checking of remote tunnel gateway availability. If a remote tunnel gateway is not available, the tunnel switches the operational status to DOWN.
The use of a negative form (no) of the command disables the checking.
Syntax
[no] keepalive enable
Parameters
The command does not contain parameters.
Default value.
The checking is disabled.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# keepalive enable
keepalive retries
The command defines the number of attempts to check the remote tunnel gateway availability. Upon reaching the specified number of failed attempts, the tunnel will be considered inactive.
The use of a negative form (no) of the command sets the default value.
Syntax
keepalive retries <VALUE>
no keepalive retries
Parameters
<VALUE> – number of attempts, takes values in the range of [1..255].
Default value
6
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# keepalive retries 8
keepalive timeout
The command controls the period of sending keepalive packets to opposing party.
The use of a negative form (no) of the command sets the default value.
Syntax
keepalive timeout <TIME>
no keepalive timeout
Parameters
<TIME> – time in seconds, takes values of [1..32767].
Default value
10
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# keepalive timeout 18
keepalive timeout ipsec
This command sets the time that is allowed to restore the IPsec VPN connection, after which the router will reboot. This functionality only works when the router is in OTT mode. The operating mode of the OTT is enabled when the device is manufactured.
The use of a negative form (no) of the command reduces the value to the default – 180.
Syntax
keepalive timeout ipsec <TIME>
no keepalive timeout ipsec
Parameters
<TIME> – time in seconds, takes values of [30..32767].
Default value
180
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# keepalive timeout ipsec 1000
key
The command enables key transmission in GRE tunnel header (according to RFC 2890) and sets the key value. The key can be used to identify traffic streams in GRE tunnel.
The use of a negative form (no) of the command disables key transmission.
Syntax
key <KEY>
no key
Parameters
<KEY> – KEY value, takes values in the range of [1..2000000].
Default value
Key is not transmitted.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# key 40
load-average
The command specifies the time interval during which the statistics on tunnel load is averaged.
The use of a negative form (no) of the command sets the default value.
Syntax
load-average <TIME>
no load-average
Parameters
<TIME> – interval in seconds, takes values of [5..150].
Default value
5
Required privilege level
10
Command mode
CONFIG-GRE
CONFIG-IP4IP4
CONFIG-LT
CONFIG-SUBTUNNEL
CONFIG-L2TPv3
CONFIG-VTI
CONFIG-L2TP
CONFIG-PPTP
CONFIG-PPPOE
CONFIG-OPENVPN
Example
esr(config-gre)# load-average
local address
The command sets IP address of a local tunnel gateway.
The use of a negative form (no) of the command removes local gateway IP address.
Syntax
local address <ADDR>
no local address
Parameters
<ADDR> – IP address of a local gateway.
Required privilege level
10
Command mode
CONFIG-IP4IP4
CONFIG-GRE
CONFIG-L2TPV3
CONFIG-VTI
Example
esr(config-ip4ip4)# local address 192.168.1.1
local address xauth
This command sets the use of the address issued by mode config when using the previously configured IPsec VPN in the XAUTH client mode.
The use of a negative form (no) of the command removes the configuration.
Syntax
local address xauth <NAME>
no local address
Parameters
<NAME> – name of the created before IPsec VPN, set by the string of up to 31 characters.
Default value
Not specified.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-)# local address xauth IPsecVPN
local checksum
The command enables the calculation of the checksum and entry it to the GRE header of the packets to be sent.
The use of a negative form (no) of the command disables the calculation and sending of the checksum.
Syntax
[no] local checksum
Parameters
The command does not contain parameters.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# local checksum
local cookie
The command defines cookie value to check the conformance of data being transmitted and session.
The use of a negative form (no) of the command removes a local cookie.
Syntax
local cookie <COOKIE>
no local cookie
Parameters
<COOKIE> – COOKIE value, the parameter takes values of 8 or 16 characters in hexadecimal form.
Required privilege level
10
Command mode
CONFIG-L2TPV3
Example
esr(config-l2tpv3)# local cookie 8FB51B8FB
local interface
The command sets the use of IP address assigned to the interface as a GRE tunnel local gateway.
The use of a negative form (no) of the command stops the use of IP address assigned to the interface as a local gateway.
Syntax
local interface <IF>
no local interface
Parameters
<IF> – interface type and identifier specified in the form described in Section Types and naming order of router interfaces.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# local interface gigabitethernet 1/0/1
local port
The command defines local UDP port if UDP was selected as encapsulation method.
The use of a negative form (no) of the command removes a local UDP port number.
Syntax
local port <UDP>
no local port
Parameters
<UDP> – UDP port number in the range of [1..65535].
Required privilege level
10
Command mode
CONFIG-L2TPV3
Example
esr(config-l2tpv3)# local port 1501
local session-id
Set local session identifier.
The use of a negative form (no) of the command removes a local session identifier.
Syntax
local session-id <SESSION-ID>
no local session-id
Parameters
<SESSION-ID> – session identifier, takes values in the range of [1..200000].
Required privilege level
10
Command mode
CONFIG-L2TPV3
Example
esr(config-l2tpv3)# local session-id 200
mode
The command specifies the encapsulation mode for GRE tunnel.
The use of a negative form (no) of the command sets the default encapsulation.
Syntax
mode <MODE>
Parameters
<MODE> – GRE tunnel encapsulation mode:
- ip – encapsulation of IP packets in GRE;
- ethernet – encapsulation of Ethernet frames in GRE.
Default value
ip
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# mode ethernet
mtu
The command specifies MTU (Maximum Transmission Unit) size for tunnels
The use of a negative form (no) of the command sets the default MTU value.
Syntax
mtu <MTU>
no mtu
Parameters
<MTU> – MTU value, takes values in the range of:
- ESR-10/12V/12VF/14VF – [1280..9600];
- ESR-20/21 – [552..9500];
- ESR-100/200/1000/1200/1500/1510/1700 – [552..10000].
Default value
1500
Required privilege level
10
Command mode
CONFIG-IP4IP4
CONFIG-GRE
CONFIG-SUBTUNNEL
CONFIG-L2TP
CONFIG-L2TPV3
CONFIG-VTI
CONFIG-LT
CONFIG-PPTP
CONFIG-PPPOE
CONFIG-OPENVPN
Example
esr(config-l2tpv3)# mtu 1400
multipoint
This command puts the tunnel in multipoint mode. In this mode, it is possible to establish several connections from one tunnel interface.
The use of a negative form (no) of the command puts it into normal point-to-point mode.
Syntax
[no] multipoint
Parameters
The command does not contain parameters.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# multipoint
password
This command sets the user password for the OPENVPN server.
The use of a negative form (no) of the command removes a user’s password.
Syntax
password { <CLEAR-TEXT> | encrypted <ENCRYPTED-TEXT> }
no password
Parameters
<CLEAR-TEXT> – unencrypted password, set by the string of [8..32] characters, may include [0-9a-fA-F] characters;
<ENCRYPTED-TEXT> – unencrypted password, set by the string of [8..32] characters.
The password are kept in encrypted form independently of format used when entering the command.
Required privilege level
15
Command mode
CONFIG-OPENVPN
Example
esr(config-openvpn)# password 01234567
peer lt
The command specifies a remote party (in another VRF) of a logical tunnel.
The use of a negative form (no) of the command removes a bind of tunnel remote party.
Syntax
[no] peer lt <ID>
Parameters
<ID> – logical tunnel remote party identifier.
Required privilege level
10
Command mode
CONFIG-LT
Example
esr(config-lt)# peer lt 2
ppp failure-count
This command sets the number of failed data-link tests before breaking the session.
The use of a negative form (no) of the command sets the default value.
Syntax
ppp failure-count <NUM>
no ppp failure-count
Parameters
<NUM> – the number of failed data-link tests, specified in the range [1..100].
Default value
10
Required privilege level
10
Command mode
CONFIG-L2TP
CONFIG-PPPOE
CONFIG-PPTP
Example
esr(config-l2tp)# ppp failure-count 20
ppp timeout keepalive
The command specifies the time interval in seconds after which the router sends a keepalive message.
The use of a negative form (no) of the command sets the default value.
Syntax
ppp timeout keepalive <TIME >
no ppp timeout keepalive
Parameters
<TIME> – time in seconds, takes values of [1..32767].
Default value
10
Required privilege level
10
Command mode
CONFIG-L2TP
CONFIG-PPPOE
CONFIG-PPTP
Example
esr(config-l2tp)# ppp timeout keepalive 5000
protocol
Select encapsulation method for L2TPv3 tunnel.
Syntax
protocol <TYPE>
no protocol
Parameters
<TYPE> – encapsulation type, possible values:
- IP encapsulation in IP packet;
- Udp encapsulation in UDP datagrams.
Required privilege level
15
Command mode
CONFIG-L2TPV3
Example
esr(config-l2tpv3)# protocol ip
protocol
Select encapsulation method for OPENVPN tunnel.
Syntax
protocol <TYPE>
no protocol
Parameters
<TYPE> – encapsulation type, possible values:
- TCP – encapsulation in TCP segments;
- UDP – encapsulation in UDP datagrams.
Default value
TCP
Required privilege level
15
Command mode
CONFIG-OPENVPN
Example
esr(config-openvpn)# protocol tcp
remote address
The command sets IP address of a remote tunnel gateway.
The use of a negative form (no) of the command removes remote gateway IP address.
Syntax
remote address <ADDR>
no remote address
Parameters
<ADDR> – IP address of a remote gateway.
Required privilege level
10
Command mode
CONFIG-IP4IP4
CONFIG-GRE
CONFIG-L2TP
CONFIG-L2TPV3
CONFIG-VTI
CONFIG-PPTP
CONFIG-OPENVPN
Example
esr(config-ip4ip4)# remote address 192.168.1.2
remote address xauth
This command sets the use of the management-ip or data-ip address issued by mode config when using the previously configured IPsec VPN in the XAUTH client mode. Requires appropriate settings on the IPsec-VPN server.
The use of a negative form (no) of the command removes the configuration.
Syntax
remote address xauth <NAME> {management-ip|data-ip}
no remote address
Parameters
<NAME> – name of the created before IPsec VPN, set by the string of up to 31 characters;
management-ip – address obtained by mode config when installing IPsec VPN in the XAUTH client mode. Requires an ELTEX_MANAGEMENT_IP (28683) in the router IPsec-VPN server settings.
data-ip – address obtained by mode config when installing IPsec VPN in the XAUTH client mode. Requires an ELTEX_DATA_IP (28684) in the router IPsec-VPN server settings.
Default value
Not specified.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# remote address xauth IPsecVPN
remote checksum
The command enables verification of the presence and consistency of checksum values in the headers of GRE packets being received.
The use of a negative form (no) of the command disables the checksum verification..
Syntax
[no] remote checksum
Parameters
The command does not contain parameters.
Default value
The checksum verification is disabled by default.
Required privilege level
10
Command mode
CONFIG-GRE
Example
esr(config-gre)# remote checksum
remote cookie
The command defines cookie value to check the conformance of data being transmitted and session.
The use of a negative form (no) of the command removes a deleted cookie.
Syntax
remote cookie <COOKIE>
no remote cookie
Parameters
<COOKIE> – COOKIE value, the parameter takes values of 8 or 16 characters in hexadecimal form.
Required privilege level
10
Command mode
CONFIG-L2TPV3
Example
esr(config-l2tpv3)# remote cookie 8FB51B8FB
remote port
The command defines remote UDP port if UDP was selected as encapsulation method.
The use of a negative form (no) of the command removes a specified UDP port number.
Syntax
remote port <UDP>
no remote port
Parameters
<UDP> – UDP port number in the range of [1..65535].
Required privilege level
10
Command mode
CONFIG-L2TPV3
Example
esr(config-l2tpv3)# remote port 65000
remote port
This command defines the remote TCP/UDP port for the OPENVPN client to work.
The use of a negative form (no) of the command sets the default value.
Syntax
remote port <PORT>
no remote port
Parameters
<PORT> – UDP port number in the range of [1..65535].
Default value
1194
Required privilege level
10
Command mode
CONFIG-OPENVPN
Example
esr(config-openvpn)# remote port 65000
remote session-id
The command sets remote session identifier.
The use of a negative form (no) of the command removes a remote session identifier.
Syntax
remote session-id <SESSION-ID>
no remote session-id
Parameters
<SESSION-ID> – session identifier, takes values in the range of [1..200000].
Required privilege level
10
Command mode
CONFIG-L2TPV3
Example
esr(config-l2tpv3)# remote session-id 2
route-metric
This command assigns the metric of routes received by the client from the OPENVPN server.
The use of a negative form (no) of the command sets the default value.
Syntax
route-metric <METRIC>
no route-metric
Parameters
<METRIC> – route metric, takes values of [0..255].
Default value
0
Required privilege level
15
Command mode
CONFIG-OPENVPN
Example
esr(config)# route-metric 100
route-nopull
This command disables the use of routes transmitted by the OPENVPN server.
The use of a negative form (no) of the command sets the default value.
Syntax
[no] route-nopull
Parameters
None.
Default value
Route ignore is disabled.
Required privilege level
15
Command mode
CONFIG-OPENVPN
Example
esr(config)# route-nopull
snmp init-trap
The command enables sending snmp-trap about tunnel enabling/disabling.
The use of a negative form (no) of the command disables sending snmp-trap about tunnel enabling/disabling.
Syntax
[no] snmp init-trap
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG-GRE
CONFIG-SUBTUNNEL
Example
esr(config-gre)# snmp init-trap
show ip nhrp
This command is used to view NHRP records.
Syntax
show ip nhrp [ {dynamic|static|incomplete|nhs} ] [ {nbma-address <ADDR>|tunnel gre <ID>|tunnel-address <ADDR>} ] [ vrf <VRF> ]
Parameters
<ID> – tunnel identifier;
<ADDR> – IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255];
<VRF> – VRF instance name, set by the string of up to 31 characters. When this parameter is specified, the NHRP records specified in this VRF will be deleted;
dynamic – show information acquired dynamically;
incomplete – show blank entries;
nbma-address – show entries with a specific NBMA address;
nhs – show entries of a specific NHS;
static – show statically set records;
tunnel – show entries of a specific tunnel;
tunnel-address – show entries with a specific tunnel address;
vrf – show records in a specific VRF.
Required privilege level
10
Command mode
ROOT
Example
esr# hub-12# sh ip nhrp
Tunnel address NBMA address Interface Peer type Expire Created Flags
---------------- ---------------- --------- --------------- --------- --------- ---------
12.1.1.3 192.168.3.4 gre 1 dynamic 0:04:38 00:23:18 lower-up,
up
12.1.1.9 192.168.9.4 gre 1 dynamic 0:04:45 00:23:49 lower-up,
up
12.1.1.99 120.12.120.12 gre 1 dynamic 0:01:14 00:24:11 lower-up,
up
show tunnels configuration
The command displays tunnel configuration.
Syntax
show tunnels configuration [ <TUN> ]
Parameters
<TUN> – the name of the tunnel is specified as described in section Types and naming order of router tunnels;
Required privilege level
1
Command mode
ROOT
Example
esr# show tunnels configuration gre 25 State: enabled Description: Local address: 14.0.0.2 Remote address: 14.0.0.1 Calculates checksums for outgoing GRE packets: no Requires that all input GRE packets were checksum: no key: - TTL: Inherit DSCP: 0 MTU: 1500 Security zone: remote
show tunnels counters
The command displays tunnel counters.
Syntax
show tunnels counters [ <TUN> ]
Parameters
<TUN> – the name of the tunnel is specified as described in section Types and naming order of router tunnels;
You may specify several tunnels. If tunnel indexes are not specified, then the counters of all tunnels of a specified group will be displayed. If a certain tunnel is specified, the detailed information on this tunnel will be displayed.
Required privilege level
1
Command mode
ROOT
Example
esr# show tunnels counters l2tpv3 1 Tunnel 'l2tpv3 1' counters: Packets received: 0 Bytes received: 0 Dropped on receive: 0 Receive errors: 0 Multicasts received: 0 Receive length errors: 0 Receive buffer overflow errors: 0 Receive CRC errors: 0 Receive frame errors: 0 Receive FIFO errors: 0 Receive missed errors: 0 Receive compressed: 0 Packets transmitted: 658 Bytes transmitted: 56588 Dropped on transmit: 0 Transmit errors: 0 Transmit aborted errors: 0 Transmit carrier errors: 0 Transmit FIFO errors: 0 Transmit heartbeat errors: 0 Transmit window errors: 0 Transmit comressed: 0 Collisions: 0
show tunnels history
The command is used to view tunnel usage statistics.
Syntax
show tunnels history [ <TUN> ] [<timer {TIMER}>]
Parameters
<TUN> – the name of the tunnel is specified as described in section Types and naming order of router tunnels.
<TIMER > – timer optional key. Has the following parameters:
- hours displays history in the last 72 hours;
- minutes displays history in the last 60 hours;
- seconds displays history in the last 60 seconds;
- When timer is missing, 3 tables containing tunnel usage history are displayed.
Required privilege level
5
Command mode
ROOT
Example
esr# show tunnel history gre 1 timer minutes gre 1 Last 60 minutes: Timer Recv utilization, Kbit/s Sent utilization, Kbit/s Recv errors Sent errors Output drops ------ ------------------------- ------------------------- ------------ ------------ -------------- 0-1 240 16 0 0 0 1-2 961 64 0 0 0 2-3 962 64 0 0 0 3-4 962 64 0 0 0 4-5 960 64 0 0 0 5-6 961 64 0 0 0 6-7 719 64 0 0 0 7-8 960 64 0 0 0 8-9 800 65 0 0 0 9-10 962 64 0 0 0 10-11 865 64 0 0 0 11-12 962 64 0 0 0 12-13 817 65 0 0 0 13-14 962 65 0 0 0 14-15 961 65 0 0 0 15-16 880 60 0 0 0 16-17 960 63 0 0 0 17-18 0 0 0 0 0 18-19 0 0 0 0 0 19-20 0 0 0 0 0 20-21 0 0 0 0 0 21-22 0 0 0 0 0
show tunnels status
The command is used to display system interfaces status.
Syntax
show tunnels status [ <TUN> ]
Parameters
<TUN> – the name of the tunnel is specified as described in section Types and naming order of router tunnels;
You may specify several tunnels in command. If tunnel indexes are not specified, then the statuses of all tunnels of a specified group will be displayed. If a certain tunnel is specified, the detailed information on this tunnel will be displayed.
Required privilege level
1
Command mode
ROOT
Example
esr# show tunnels status Tunnel Admin state MTU Local IP Remote IP Uptime ------ ---------- ----- ------------ ----------- --------------- ip4ip4 4 Up 1500 115.0.0.100 115.0.0.30 1 minute and 4 seconds
show tunnels utilization
The command displays the average load in tunnels over the specified period.
Syntax
show tunnels utilization [ <TUN> ]
Parameters
<TUN> – the name of the tunnel is specified as described in section Types and naming order of router tunnels;
You can specify several tunnels separated by commas ',' or you can specify the range of interfaces with '-'. If tunnel indexes are not specified, then the counters of all tunnels of a specified group will be cleared.
Required privilege level
10
Command mode
ROOT
Example
esr# show tunnels utilization gre 2
Tunnel Period, s Sent, Recv, Frames Sent Frames Recv
Kbit/s Kbit/s
--------- ----------- ----------- ----------- ----------- -----------
gre 2 15 0 0 0 0
ttl
The command specifies the TTL lifetime for tunnel packets.
The use of a negative form (no) of the command sets the default TTL value.
Syntax
ttl <TTL>
no ttl
Parameters
<TTL> – TTL value, takes values in the range of [1..255].
Default value
Inherited from encapsulated packet.
Required privilege level
10
Command mode
CONFIG-IP4IP4
CONFIG-GRE
Example
esr(config-ip4ip4)# ttl 10
tunnel
The command allows you to switch to the tunnel configuration mode.
The use of a negative form (no) of the command removes the tunnel.
Syntax
[no] tunnel <TUN>
Parameters
<TUN> – the name of the tunnel is specified as described in section Types and naming order of router tunnels;
Required privilege level
10
Command mode
CONFIG
Example 1
Switch to tunnel l2tp 1/10/1 configuration mode:
esr(config)# tunnel l2tp 10 esr(config-l2tp)#
Example 2
Switch to tunnel l2tpv3 1/10/1 configuration mode:
esr(config)# tunnel l2tpv3 10 esr(config-l2tpv3)#
Example 3
Switch to tunnel ip4ip4 1/200/1 configuration mode:
esr(config)# tunnel ip4ip4 200 esr(config-ip4ip4)#
Example 4
Switch to tunnel gre 25 configuration mode:
esr(config)# tunnel gre 25 esr(config-gre)#
Example 5
Switch to tunnel vti 125 configuration mode:
esr(config)# tunnel vti 125 esr(config-vti)#
Example 6
Switch to tunnel pptp 10 configuration mode:
esr(config)# tunnel pptp 10 esr(config-pptp)#
Example 7
Switch to tunnel pppoe 8 configuration mode:
esr(config)# tunnel pppoe 8 esr(config-pppoe)#
tunnel
The command specifies the encapsulation mode for OPENVPN client.
The use of a negative form (no) of the command sets the default encapsulation.
Syntax
tunnel <MODE>
Parameters
<MODE> – OPENVPN client encapsulation mode:
- ip – encapsulation of IP packets in OPENVPN;
- ethernet – encapsulation of Ethernet frames in OPENVPN.
Default value
ip
Required privilege level
10
Command mode
CONFIG-OPENVPN
Example
esr(config-openvpn)# mode ethernet
username
The command specifies the user and password to connect to L2TP, PPPoE or PPTP server.
The use of a negative form (no) of the command removes a specified user.
Syntax
username <NAME> password ascii-text { <CLEAR-TEXT> | encrypted <ENCRYPTED-TEXT> }
no username <NAME>
Parameters
<NAME> – user name, set by the string of up to 31 characters;
<CLEAR-TEXT> – password, set by the string of 1 to 64 characters;
<ENCRYPTED-TEXT> – encrypted password, set by the string of [2..128] characters.
Required privilege level
15
Command mode
CONFIG-L2TP
CONFIG-PPPOE
CONFIG-PPTP
Example
esr(config-pptp)# username fedor password ascii-text password
username
This command sets the user to connect to the OPENVPN server.
The use of a negative form (no) of the command removes a specified user.
Syntax
username <NAME>
no username <NAME>
Parameters
<NAME> – user name, set by the string of up to 31 characters.
Required privilege level
15
Command mode
CONFIG-OPENVPN
Example
esr(config-openvpn)# username fedor