Cisco IOS Cisco XR Difference Guide
Cisco IOS Cisco XR Difference Guide
This module discusses converting a Cisco IOS configuration to a Cisco IOS XR configuration. It is not
a complete guide to converting every command or configuration from Cisco IOS to Cisco IOS XR, but
covers only the features most commonly used. There may be features in Cisco IOS that you are
interested in that do not appear in this document.
The configurations presented here use Cisco IOS XR 3.2 as a reference.
This document is not an introduction to Cisco IOS XR, nor is it an introduction to any of the features
you can configure in Cisco IOS. It assumes that you are familiar with the differences in operating
infrastructure between Cisco IOS and Cisco IOS XR, and that you know how the protocols work.
Contents
General Differences Between Cisco IOS and Cisco IOS XR, page 2
Cisco IOS Configurations That Do Not Exist in Cisco IOS XR, page 2
Cisco IOS Configurations That Are the Same in Cisco IOS XR, page 5
Cisco IOS Configurations That Are Similar in Cisco IOS XR, page 5
Basic Interface Configuration, page 7
IPv4 Unicast Routing and Forwarding, page 8
Multiprotocol Label Switching (MPLS), page 23
Quality of Service (QoS), page 26
IPv6, page 28
Other Cisco IOS XR Issues, page 29
Translating Cisco IOS Route Maps to Cisco IOS XR Routing Policy Language, page 34
Table 2 List of Cisco IOS Configurations That Do Not Exist in Cisco IOS XR
Table 2 List of Cisco IOS Configurations That Do Not Exist in Cisco IOS XR (continued)
Table 3 List of Cisco IOS Configurations That Are the Same in Cisco IOS XR
Table 4 List of Cisco IOS Configurations That Are Similar in Cisco IOS XR
Table 4 List of Cisco IOS Configurations That Are Similar in Cisco IOS XR (continued)
Table 5 Basic Interface Configuration for Cisco IOS Versus Cisco IOS XR
The cHDLC Commands on Cisco IOS XR Software module of the Cisco IOS XR Interface and
Hardware Component Command Reference
The PPP Commands on Cisco IOS XR Software module of the Cisco IOS XR Interface and
Hardware Component Command Reference
Note The other interface type supported in Cisco IOS XR is the Gigabit Ethernet (GigE) interface. The GigE
interface does not have a controller submode and, therefore, configuration of GigE is similar to
configuration of GigE in Cisco IOS.
Table 6 Differences in CEF for Cisco IOS and Cisco IOS XR Configurations
The Cisco IOS consistency checker has many more options than the Cisco IOS XR consistency checker,
and the default for both Cisco IOS and Cisco IOS XR is that the consistency checker is disabled.
For further information on CEF configuration , see the following configuration guide and command
reference modules:
The Implementing CEF on Cisco IOS XR Software module of the
Cisco IOS XR IP Addresses and Services Configuration Guide
The Cisco Express Forwarding Commands on Cisco IOS XR Software module of the Cisco IOS XR
IP Addresses and Services Command Reference
General IP Routing
A major difference between Cisco IOS and Cisco IOS XR is that in Cisco IOS you enable a protocol on
an interface by some combination of configuration in the Interior Gateway Protocol (IGP)and on the
physical interface. An example of the first method is an Open Shortest Path First (OSPF) network
statement, while an example of the second method is an Intermediate System-to-Intermediate System
(IS-IS) ip router isis command, or any change in the cost of an interface. In Cisco IOS XR, all
protocol-specific configuration goes under the global protocol configuration submode and not on the
physical interface configuration. This means that there are no OSPF or IS-IS commands on a physical
interface; they are all put under the interface submode of the routing protocol configuration. See the
examples in Intermediate System-to-Intermediate System (IS-IS) and Open Shortest Path First
(OSPF) for more detail.
A useful feature for all routing protocols in Cisco IOS XR is the global router-id command. In
Cisco IOS, it is recommended that you hard-code a router-id to a loopback (by convention, Loopback0)
for every protocol. In Cisco IOS XR, you can use the global command router-id interface. Thus, all
the following Cisco IOS commands are replaced by a single Cisco IOS XR command:
Table 7 Examples of Cisco IOS Commands Replaced by the Cisco IOS XR router-id Command
router isis
mpls traffic-eng router-id Loopback0
You can override the global router-id command in Cisco IOS XR by further configuring a router-id
command within a given protocol. However, configuring different router IDs per protocol makes
management more complicated and provides no gain, so we do not recommend this practice.
For more information about the router-id command, see the following configuration guide and
command reference modules:
The Implementing Network Stack IPv4 and IPv6 on Cisco IOS XR Software module of the
Cisco IOS XR IP Addresses and Services Configuration Guide
The Network Stack IPv4 and IPv6 Commands on Cisco IOS XR Software module of the
Cisco IOS XR IP Addresses and Services Command Reference
The Implementing Label Distribution Protocol on Cisco IOS XR Software module of the
Cisco IOS XR Multiprotocol Label Switching Configuration Guide
The Implementing Optical User Network Interface on Cisco IOS XR Software module of the
Cisco IOS XR Multiprotocol Label Switching Configuration Guide
The MPLS Label Distribution Commands on Cisco IOS XR Software module of the Cisco IOS XR
Multiprotocol Label Switching Command Reference
The Implementing Optical User Network Interface on Cisco IOS XR Software module of the
Cisco IOS XR Multiprotocol Label Switching Configuration Guide
The MPLS Optical User Network Interface Commands on Cisco IOS XR Software module of the
Cisco IOS XR Multiprotocol Label Switching Command Reference
The Implementing OSPF on Cisco IOS XR Software module of the Cisco IOS XR Routing
Configuration Guide
The OSPF Commands on Cisco IOS XR Software module of the Cisco IOS XR Routing Command
Reference
The OSPFv3 Commands on Cisco IOS XR Software module of the Cisco IOS XR Routing Command
Reference
Table 8 Configuration Comparison for IPv4 in Cisco IOS and Cisco IOS XR
The largest change between Cisco IOS and Cisco IOS XR is that in Cisco IOS XR you need to explicitly
enable the ipv4 address family, whereas in Cisco IOS it is implicitly on. Most or all of the IS-IS options
in Cisco IOS also exist in Cisco IOS XR. Another difference is that there are very few CLNS commands
in Cisco IOS XR; most of the show clns options in Cisco IOS are under the show isis command in
Cisco IOS XR.
Redistribution for IS-IS is very similar; the only difference is that instead of a route-map (as in
Cisco IOS), you specify a policy. Thus, redistribution into Cisco IOS XR is an attach point for an RPL
policy:
Table 9 IS-IS Redistribution Differences Between Cisco IOS and Cisco IOS XR
All of the standard options are available in both Cisco IOS and Cisco IOS XR.
Table 10 shows the output produced by issuing the help command (?) while in the proper configuration
submode for the redistribute connected command on systems running Cisco IOS and Cisco IOS XR
software:
Table 10 Comparison of the redistribute connected command on Cisco IOS and Cisco IOS XR
IS-IS configurations for multitopology are slightly different, as well; see the sections on Multiprotocol
Label Switching (MPLS) and IPv6 for details.
For further information on IS-IS configuration , see the following configuration guide and command
reference modules:
The Implementing IS-IS on Cisco IOS XR Software module of the Cisco IOS XR Routing
Configuration Guide
The IS-IS Commands on Cisco IOS XR Software module of the Cisco IOS XR Routing Command
Reference
Note that the network statement in Cisco IOS has been replaced by enabling the interface under the area
keyword inside OSPF. Also, OSPF does not need an address-family ipv4 unicast command like BGP
or IS-IS. This is because router ospf implies support for unicast IPv4. Cisco does not support MOSPF,
and unicast IPv6 has its own routing protocol, consisting of the router ospfv3 family of commands.
Table 12 Redistribution Configurations for OSPF in Cisco IOS and Cisco IOS XR
You no longer need the subnets keyword in Cisco IOS XR, and you declare an RPL policy rather than
a route map.
If you want to redistribute only classful routes into OSPF in Cisco IOS XR, you can use the redistribute
command with the classful keyword. The use of policies rather than route maps is covered in the
Border Gateway Protocol (BGP) section and also in the existing Cisco IOS XR documentation on
RPL. The mainpiece of information to get from this discussion is that redistribution into OSPF on
Cisco IOS XR is a policy attach point.
For further information on OSPF configuration, see the following configuration guide and command
reference modules:
The Implementing OSPF on Cisco IOS XR Software module of the Cisco IOS XR Routing
Configuration Guide
The OSPF Commands on Cisco IOS XR Software module of the Cisco IOS XR Routing Command
Reference
The OSPFv3 Commands on Cisco IOS XR Software module of the Cisco IOS XR Routing Command
Reference
The Routing Policy Language Commands on Cisco IOS XR Software module of the Cisco IOS XR
Routing Command Reference
BGP configuration is complex enough that it is worth going over several sample configurations.
First, let us start with a simple IBGP peering between a Cisco IOS router and a Cisco IOS XR router.
For these examples, the Cisco IOS router has an IP address of 192.168.1.5, while the Cisco IOS XR
router has an IP address of 192.168.1.8.
Table 13 Basic BGP Configuration Between a Cisco IOS Router and a Cisco IOS XR Router
Cisco IOS (Router ID: 192.168.1.5) Cisco IOS XR (Router ID: 192.168.1.8)
router bgp 3402 router bgp 3402
no synchronization neighbor 192.168.1.5
bgp log-neighbor-changes remote-as 3402
neighbor 192.168.1.8 remote-as 3402 update-source Loopback0
neighbor 192.168.1.8 update-source !
Loopback0 !
no auto-summary
Address-Family Parameters
There are two fundamental building blocks to basic BGP neighbor configuration in Cisco IOS XR:
address-family groups (referred to in a configuration as an af-group) and session groups (referred to in
a configuration as a session-group). For more discussion of session groups see the Session Parameters
section on page 16 of this document.
You configure properties of different address families using the af-group keyword. The following
address-family groups are supported for Cisco IOS XR Release 3.2:
IPv4 unicast
IPv4 multicast
IPv6 unicast
IPv6 multicast
Note A given address family is only supported with a neighbor whose address is from that address family. For
instance, IPv4 neighbors support IPv4 unicast and multicast address families, and IPv6 neighbors
support IPv6 unicast and multicast address families. However, you cannot exchange IPv6 routing
information with an IPv4 neighbor and vice versa.
Inside an af-group, you configure properties specific to the exchange of information for a specific
address family.
Table 14 shows a more complex example of an IBGP peering between a Cisco IOS router (Router ID
192.168.1.5) and a Cisco IOS XR router (Router ID 192.168.1.8):
You can see from the example that Cisco IOS XR allows you to put address-family specific
configuration in an af-group and apply that af-group to a specific neighbor using the af-group
command, thus avoiding the need for a series of lines beginning with neighbor 192.168.1.5.
Session Parameters
Session-groups are conceptually very similar to af-groups, except that they allow you to configure
properties of a BGP session itself rather than configure properties of a specific address family.
In this example, a password was added between the neighbors; in Cisco IOS XR, this is in the
session-group, because it is a property of the session rather than a property of the address-family. Also,
rather than using the Cisco IOS keyword syntax password 0 or password 7, Cisco IOS XR uses the
keyword syntax password clear or password encrypted.
BGP Neighbors
The next major configuration task is Cisco IOS XRs equivalent of Cisco IOS peer-groups.
Cisco IOS XR calls them neighbor-groups rather than peer-groups, but the function is the same. In
recent versions of Cisco IOS, the concept of dynamic update-groups was added to separate policy
grouping from neighbor grouping. Cisco IOS XR does this as well, so there is no restriction on what
policies can be shared across which update-groups.
The following configuration examples illustrate the difference in peer-groups under Cisco IOS and
neighbor-groups under Cisco IOS XR.
Table 16 BGP Configuration Using Peer Groups in Cisco IOS and Neighbor Groups in Cisco IOS XR
Although the Cisco IOS XR configuration is longer, as the number of peers grows, the abstractions
Cisco IOS XR offers will make configurations shorter and more manageable.
Another issue to look at is routing policy. Routing policy is applied in Cisco IOS XR through Route
Policy Language (RPL) and is a powerful replacement for Cisco IOS route maps. The terminology
translation table for RPL vs. route-maps is:
Table 17 Translation Table Between Cisco IOS Route Maps and Cisco IOS XR RPL
As you can see where Cisco IOS uses lists, Cisco IOS XR uses sets. A set, in the mathematical sense,
is an unordered grouping of items, which makes more sense than an ordered list for many applications.
One major change between Cisco IOS and Cisco IOS XR is that in Cisco IOS XR there must be a policy
applied (both inbound and outbound) between EBGP neighbors for routes to be exchanged. Below is a
basic configuration between the same two routers as before, but note that the autonomous system (AS)
numbers are now different:
Table 18 EGBP Configurations in Cisco IOS and Cisco IOS XR with No Policies
Cisco IOS (Router ID: 192.168.1.5) Cisco IOS XR (Router ID: 192.168.1.8)
router bgp 5 router bgp 8
no synchronization neighbor 192.168.1.5
bgp log-neighbor-changes remote-as 5
neighbor 192.168.1.8 remote-as 8 ebgp-multihop 255
neighbor 192.168.1.8 ebgp-multihop 255 update-source Loopback0
neighbor 192.168.1.8 update-source !
Loopback0 !
no auto-summary
!
With the above configuration, no routes are sent from or received by the Cisco IOS XR router; when the
configuration is committed, Cisco IOS XR displays the following messsage
%BGP-4-NBR_NOPOLICY : No inbound IPv4 Unicast policy is configured for eBGP neighbor
192.168.1.5. No IPv4 Unicast prefixes will be accepted from the neighbor until inbound
policy is configured.
%BGP-4-NBR_NOPOLICY : No outbound IPv4 Unicast policy is configured for eBGP neighbor
192.168.1.5. No IPv4 Unicast prefixes will be sent to the neighbor until outbound policy
is configured.
A warning also shows when using the show bgp summary command if you do not have a policy
configured.
Table 19 EBGP Configuration in Cisco IOS and Cisco IOS XR with Inbound and Outbound Policies
Combining the EBGP policy configuration with the af-group and session-group configuration from the
IBGP example, the final configurations are:
Table 20 Final Configuration for EBGP for Cisco IOS and Cisco IOS XR
If you look closely at the Cisco IOS XR configuration, you see that the EBGP AS (remote-as 5) is
embedded in the session group. Although you can do this if you want, it is not necessary. If you do this,
you end up having to create a session group per external AS, or not use session groups.
Policies can be cascaded, so that session groups and address family groups can inherit from each other,
and settings in session groups can be overridden. Following are two other ways to accomplish the same
configuration on Cisco IOS XR while making the configuration more flexible.
Alternate examples for creating BGP policies on Cisco IOS XR:
Remove the remote-as command from the neighbor group and put it in the neighbor directly:
session-group example
password 7 00021C09
ebgp-multihop 255
update-source Loopback0
!
neighbor-group ebgp-peers
use session-group example
address-family ipv4 unicast
use af-group test
!
!
neighbor 192.168.1.5
remote-as 5
use neighbor-group ebgp-peers
!
!
The second example hints at the real power you can get with inheritance.
log
receive-buffer-size
redistribute-internal
router-id
scan-time
send-buffer-size
socket
timers bgp keepalive holdtime
update-delay
write-limit
For further information on BGP configuration, see the following configuration guide and command
reference modules:
The Implementing BGP on Cisco IOS XR Software module of the Cisco IOS XR Routing
Configuration Guide
The Implementing Routing Policy on Cisco IOS XR Software module of the Cisco IOS XR Routing
Configuration Guide
The BGP Commands on Cisco IOS XR Software module of the Cisco IOS XR Routing Command
Reference
The Routing Policy Language Commands on Cisco IOS XR Software module of the Cisco IOS XR
Routing Command Reference
Multicast
There are two things to configure for multicast: multicast forwarding, and multicast routing.
It is difficult to seperate out exactly where Cisco IOS configures multicast forwarding versus routing,
since multicast forwarding is not enabled on a Cisco IOS interface until you enable a multicast routing
protocol. Also, enabling multicast-routing on a specific interface in Cisco IOS XR enables Protocol
Independent Multicast (PIM) on that interface, despite the fact that there is a separate PIM configuration
submode.
IOS XR does not support PIM dense mode, although enough of dense mode is supported to enable
auto-RP; forwarding of multicast groups not related to auto-RP is not supported.
Multicast is consistent with the IOS XR model of configuring everything under a protocol submode
rather than on an interface. The following examples illustrate enabling basic multicast (multicast
forwarding and PIM with AutoRP):
If you want to change any PIM parameters in IOS XR, you change them under the (config-mcast-ipv4)
submode, not under router pim. For example, if you want to explicitly specify an RP address rather than
letting AutoRP discover it, the configuration is:
Table 22 Changing PIM Parameters in Multicast Configurations on Cisco IOS and Cisco IOS XR
The basic idea in IOS XR is this: enabling multicast-routing turns on AutoRP (so by definition PIM
sparse-dense) and also multicast forwarding on any interface you specify. Additionally, the all keyword
allows you to turn on multicast on all interfaces in the router and then selectively disable some of them.
If you want to modify your PIM configuration, most of the changes you make are under router pim;
configurations such as administratively scoped boundaries, which have nothing to do with PIM but are
instead forwarding-related, are configured under the (config-mcast-ipv4)submode.
Table 23 Minor DIfferences in MPLS usage for Cisco IOS and Cisco IOS XR Configurations
Most of the Cisco IOS LDP capabilities are in Cisco IOS XR as well. One notable exception is the ability
to configure an LDP targeted session. You can accept targeted hellos in Cisco IOS XR using the
command sequence:
mpls ldp
discovery targeted-hello accept
but there is no equivalent to the Cisco IOS command mpls ldp neighbor neighbor targeted.
Other configurations, such as authentication, timer tuning, and graceful restart are similar in both
systems. Note that Cisco IOS XR only supports DU mode, so there are no DoD commands.
For further information on LDP configuration, see the following configuration guide and command
reference modules:
The Implementing MPLS Label Distribution Protocol on Cisco IOS XR Software module of the
Cisco IOS XR Multiprotocol Label Switching Configuration Guide
The MPLS Label Distribution Protocol Commands on Cisco IOS XR Software module of the
Cisco IOS XR Multiprotocol Label Switching Command Reference
Note that in Cisco IOS XR there are four submodes below the global configuration modetunnel
interface, mpls traffic-eng, IGP, and rsvpwhile in Cisco IOS there are threetunnel interface, physical
interface, and IGP.
An IS-IS configuration for TE in Cisco IOS XR is similar to one in Cisco IOS; Cisco IOS XR supports
the full range of narrow, transition, and wide metrics that Cisco IOS supports, and the TE configuration
is under the IPv4 address family:
router isis lab
address-family ipv4 unicast
mpls traffic-eng level 2
!
!
For further information on TE configuration, see the following configuration guide and command
reference modules:
The Implementing MPLS Traffic Engineering on Cisco IOS XR Software module of the
Cisco IOS XR Multiprotocol Label Switching Configuration Guide
The MPLS Traffic Engineering Commands on Cisco IOS XR Software module of the Cisco IOS XR
Multiprotocol Label Switching Command Reference
Table 26 Matching Options for QoS in Cisco IOS and Cisco IOS XR Configurations
You have a few more class-map options in Cisco IOS than Cisco IOS XR, but the core matching
optionsdscp, mpls, qos-group,and discard-classare there. Cisco IOS XR has no support for
atm-clp or fr-de, but that is because there is no support for ATM or FR encapsulation in Cisco IOS XR.
The actions you can take in a policy map are almost identical as well.
One issue to note in MQC is that in Cisco IOS some measures of bandwidth are in bits per second, some
are in bytes per second, and some are in kilobits per second. The three keywords in a policy-map that
refer to bandwidth on a Cisco 12000 Series router in 12.0(28)S are:
bandwidth rate_in_kilobits_per_second
police rate_in_bits_per_second bc_bytes be_bytes
shape average cir_bits_per_second bc_bits be_bits
In Cisco IOS XR, everything is in kilobits per second:
bandwidth kilobits_per_second
police cir kilobits_per_second bc_kilobits be_kilobits
shape average cir_kilobits_per_second burst_in_kilobits
To convert from bytes to kilobits, multiply by .008. Thus, 64,000 bytes is 512 kilobits.
Other parts of QoS that exist in Cisco IOS are Selective Packet Discard (SPD) and receive ACLs.
Cisco IOS XR also has Local Packet Transport Service( LPTS) that has a lot of built-in Denial of Service
(DoS)-mitigation components which makes SPD and receive ACLs somewhat unnecessary. At this time,
LPTS is not configurable (although it is monitorable), so it is not covered here.
For further information on QoS configuration, see the following configuration guide and command
reference:
Cisco IOS XR Modular Quality of Service Configuration Guide
Cisco IOS XR Modular Quality of Service Command Reference
IPv6
IPv6 configuration is very similar to IPv4.
One thing to note is that Cisco IOS XR uses multi-topology routing rather than a single topology with
all prefixes as leaf nodes, so you need to enable multi-topology under the address family in Cisco IOS.
In general, IPv6 show commands are the same as IPv4 show commands; many of the show ip
commands in Cisco IOS are now show ipv4 commands in Cisco IOS XR, and most of those
commands have a show ipv6 equivalent.
There are three routing protocols in Cisco IOS XR that support IPv6:
BGP using IPv6 unicast or multicast address-family
OSPFv3
IS-IS using IPv6 unicast address-family
The IS-IS configuration was show in the above. A BGP configuration looks just like previously
demonstrated BGP configurations, except using the IPv6 address-family. And OSPF, rather than having
separate address families in a single routing protocol, has its own new routing protocol, OSPFv3. An
OSPFv3 configuration looks just like an IPv4 OSPF (also known as OSPFv2) configuration.
Access Lists
Cisco IOS has standard and extended, as well as named and numbered ACLs. Cisco IOS XR does away
with named versus numbered ACLs, although you can use a set of numbers as an ASCII name string.
Standard and extended ACL configurations are shown below in Table 30 . For Cisco IOS, named and
numbered ACLs are shown; for Cisco IOS XR, the corresponding configuration is shown. Note that
Cisco IOS XR does not have a concept of named or numbered ACLs, and also note that there is no such
thing as a standard or extended ACL; for the equivalent of the standard Cisco IOS ACL, configure a
Cisco IOS XR ACL with only the source IP address specified.
Cisco IOS XR supports the full set of keyword equivalents that Cisco IOS does, like host and the port
range syntax.
Table 30 Comparison of Access-lists between Cisco IOS and Cisco IOS XR Configurations
Cisco IOS XR also allows you to resequence an ACL, so that if you have left yourself no space to add
new lines, you can create that space. The first example shows the results of using the show ipv4
access-lists command:
RP/0/RP/CPU0:router# show ipv4 access-lists test
ipv4 access-list test
10 permit ip 11.0.0.0 0.0.0.255 any
11 permit ip 12.0.0.0 0.0.0.255 any
Using the resequence command followed by the same show command results in the following output:
RP/0/RP/CPU0:router(config)# resequence ipv4 access-list test
RP/0/RP/CPU0:router# show ipv4 access-lists test
There are options to the resequence command that let you control the starting number and the step value
as well.
minimum, you want to configure a root-system user; this is the most powerful user in Cisco IOS XR
terminology, and is essentially the same as a fully enabled user in Cisco IOS. The configuration for a
root-system user in Cisco IOS XR is:
username lab
password 7 1042081B
group root-system
!
This creates a user called lab with a password of lab, and this user has the power to do anything on the
router. Configuring a user with less than complete privileges is easy, as there are a few taskgroups you
can use instead of root-system:
cisco-support
netadmin
operator
root-lr
root-system
sysadmin
In addition, you can define your own taskgroups (sets of things a user is allowed to do) and usergroups
(collections of taskgroups) and attach them to a username. Doing this is beyond the scope of this
document, although investigation of taskgroups and the Cisco IOS XR authentication model is highly
recommended.
Hot Standby Router Protocol (HSRP) and Virtual Router Redundancy Protocol
(VRRP)
HSRP andVRRP configurations are similar in Cisco IOS and in Cisco IOS XR.
Table 32 HSRP and VRRP Configurations in Cisco IOS and Cisco IOS XR
The primary difference here is, of course, that you configure interface properties not on the interface
directly, but under the interface submode of the protocol either router hsrp or router vrrp.
Line Configurations
The line {console|aux|vty} configurations are very similar between Cisco IOS and Cisco IOS XR.
Most networks have the console and vtys configured; the aux port is not very useful in either Cisco IOS
or Cisco IOS-XR. A simple translation of Cisco IOS to Cisco IOS XR is
Note that in Cisco IOS XR you must configure the global command telnet ipv4 server enable for the
router to allow telnet.
Secure Shell (SSH) support is very similar. The crypto key zerioze and crypto key generate commands
are in EXEC mode in Cisco IOS XR, whereas in Cisco IOS they were in config mode.
Table 34 Secure Shell (with no telnet) Configurations in Cisco IOS and Cisco IOS XR
For SSH support, you need to have crypto support, just as in Cisco IOS. This is generally accomplished
by installing the k9sec package.
In Cisco IOS XR, no matter whether you have enabled the telnet server, the ssh server, or both, show
line vty vty will show both transports allowed:
RP/0/0/CPU0:router# show line vty 0
This is a little confusing, as the notion of a transport being allowed in Cisco IOS means that you can use
that transport to connect to the router; in Cisco IOS XR, you need to enable both the server and the
transport, and the transport is enabled by default. To be certain of control access into the router, enable
and disable the server.
In the following example, a route map is translated to the policy language while retaining the redundant
operations:
60 permit 192.168.8.0/21
70 permit 192.168.32.0/21
ip prefix-list 102
10 permit 10.48.0.0/16 le 32
20 permit 10.48.0.5/19 le 32
30 permit 172.16.10.0/24
40 permit 172.16.1.0/24
50 permit 172.16.3.0/24
60 permit 192.168.8.0/21
70 permit 192.168.32.0/21
ip community-list 1
10 permit 10:11
ip community-list 2
10 permit 10:12
ip community-list 3
10 permit 10:13
ip community-list 4
10 permit 10:14
A Simple Translation
A simple translation of this route map configuration to the policy language would retain the redundant
operations, as shown in the following example:
prefix-set ps101
10.48.0.0/16 le 32
172.48.0.0/19 le 32
172.10.10.0/24
172.11.1.0/24
192.168.3.0/24
192.168.8.0/21
192.168.32.0/21
end-set
prefix-set ps102
10.48.0.0/16 le 32
10.48.0.5/19 le 32
172.16.10.0/24
172.16.1.0/24
172.16.3.0/24
192.168.8.0/21
192.168.32.0/21
end-set
community-set cs1
10:11
end-set
community-set cs2
10:12
end-set
community-set cs3
10:13
end-set
community-set cs4
10:14
end-set
route-policy sample1-translation-1a
if destination in ps101 and community matches-any cs1 then
set med 11
set community 12:34 additive
elseif destination in ps101 and community matches-any cs2 then
set med 12
set community 12:34 additive
elseif destination in ps101 and community matches-any cs3 then
set med 13
route-policy sample2-translation-1a
if destination in ps102 and community matches-any cs1 then
set med 11
set community (12:35) additive
elseif destination in ps102 and community matches-any cs2 then
set med 12
set community (12:35) additive
elseif destination in ps102 and community matches-any cs3 then
set med 13
set community (12:35) additive
elseif destination in ps102 and community matches-any cs4 then
set med 14
set community (12:35) additive
elseif destination in ps102
set med 100
set community (12:35) additive
endif
end-policy
prefix-set ps102
10.48.0.0/16 le 32
10.48.0.5/19 le 32
172.16.10.0/24
172.16.1.0/24
172.16.3.0/24
192.168.8.0/21
192.168.32.0/21
end-set
community-set cs1
10:11
end-set
community-set cs2
10:12
end-set
community-set cs3
10:13
end-set
community-set cs4
10:14
end-set
route-policy sample1-translation-1b
if destination in ps101 then
set community (12:34) additive
if community matches-any cs1 then
set med 11
elseif community matches-any cs2 then
set med 12
elseif community matches-any cs3 then
set med 13
elseif community matches-any cs4 then
set med 14
else
set med 100
endif
endif
end-policy
route-policy sample2-translation-1b
if destination in ps102 then
set community (12:35) additive
if community matches-any cs1 then
set med 11
elseif community matches-any cs2 then
set med 12
elseif community matches-any cs3 then
set med 13
elseif community matches-any cs4 then
set med 14
else
set med 100
endif
endif
end-policy
prefix-set ps102
10.48.0.0/16 le 32
10.48.0.5/19 le 32
172.16.10.0/24
172.16.1.0/24
172.16.3.0/24
192.168.8.0/21
192.168.32.0/21
end-set
route-policy sample1-translation-1c
if destination in ps101 then
set community (12:34) additive
if community matches-any (10:11) then
set med 11
elseif community matches-any (10:12) then
set med 12
elseif community matches-any (10:13) then
set med 13
elseif community matches-any (10:14) then
set med 14
else
set med 100
endif
end-policy
route-policy sample2-translation-1c
if destination in ps102 then
set community (12:35) additive
if community matches-any (10:11) then
set med 11
elseif community matches-any (10:12) then
set med 12
elseif community matches-any (10:13) then
set med 13
elseif community matches-any (10:14) then
set med 14
else
set med 100
endif
end-policy
prefix-set ps102
10.48.0.0/16 le 32
10.48.0.5/19 le 32
172.16.10.0/24
172.16.1.0/24
172.16.3.0/24
192.168.8.0/21
192.168.32.0/21
end-set
route-policy sample-translation-common(tag)
set community (12:$tag) additive
if community matches-any (10:11) then
set med 11
elseif community matches-any (10:12) then
set med 12
elseif community matches-any (10:13) then
set med 13
elseif community matches-any (10:14) then
set med 14
else
set med 100
endif
end-policy
route-policy sample1-translation-1d
if destination in ps101 then
apply sample-translation-common (34)
pass
endif
end-policy
route-policy sample2-translation-1d
if destination in ps102 then
apply sample-translation-common (35)
pass
endif
end-policy