gsparams

Specifies the alias for this GigaSMART group.

Specifies the TCP load balancing options as follows:

Specifies GigaSMART CPU utilization options as follows:

This command sets the rising threshold on the GigaSMART engine port(s), as a percentage from 20 to 99.

A CPU utilization alarm can be sent when the rising threshold is exceeded. Alarms are reported to all configured SNMP trap destinations and recorded in the log file.

For example:

(config) # gsparams gsgroup gg1 cpu utilization type total rising 95

Refer to the “GigaSMART CPU Utilization Statistics” section in the GigaVUE Fabric Management Guide for details.

Specifies whether duplicate packets are to be counted or dropped by GigaSMART as follows:

For example:

(config) # gsparams gsgroup gs2port1 dedup-action count

Refer to the GigaSMART De-duplication section in the GigaVUE Fabric Management Guide for details.

Configures the time interval within which an identical packet will be considered a duplicate. The greater the interval over which traffic can be checked for duplicates, the higher the accuracy of the de-duplication detection and subsequent elimination. The default is 50000µs.

For example, if two of the same packets are seen in the specified time interval, the packets will be detected as duplicates. If one packet is seen in the time interval and another packet is seen in a later time interval, the packets will not be detected as duplicates.

Retransmissions are not counted as duplicates.

For example:

(config) # gsparams gsgroup gs2port1 dedup-timer 55000

Refer to the “GigaSMART De-duplication” section in the GigaVUE Fabric Management Guide.

Fine-tunes how duplicates are detected. You can configure the packet fields that are used to detect duplicates.

Different network implementations can change certain packet header fields (for example, the TCP sequence number). If you want to be able to detect duplicates without requiring that these fields match (ToS field, TCP sequence number, VLAN ID), you can disable the corresponding option. The options are as follows:

Include means the field will be included when GigaSMART compares packets.

Ignore means the field will be ignored when GigaSMART compares packets.

For example:

(config) # gsparams gsgroup gs2port1 dedup-tcp-seq ignore

Refer to the “GigaSMART De-duplication” section in the GigaVUE Fabric Management Guide for details.

Specifies the elephant flow options as follows:

Note:  It is recommended to change the interval value as 0 after collecting the required parameters.

Specifies the engine watchdog timer. In rare scenarios, a packet processing core in the CPU of a GigaSMART engine can enter a deadlocked state. The engine watchdog timer detects the issue and reloads the GigaSMART engine after a specified number of seconds.

If a core is in a deadlocked state, all packets are dropped.

This parameter specifies the engine watchdog timer as follows:

For example, to change the engine watchdog timer from the default, specify a value within the range of values:

(config) # gsparams gsgroup gsg1 eng-watchdog-timer 100

For example, to disable the engine watchdog timer:

(config) # gsparams gsgroup gsg1 eng-watchdog-timer disable

Specifies the ERSPAN Type III timestamp trailer format for tunnel decapsulation as follows:

For example:

(config) # gsparams gsgroup gsg_erspan erspan3-timestamp format gs

Refer to the “GigaSMART ERSPAN Tunnel Decapsulation” section in the GigaVUE Fabric Management Guide.

Specifies parameters for flow masking to improve GigaSMART packet processing for traffic containing MPLS, L2GRE, or VNTag headers as follows:

Masking bytes are limited to 112 bytes from the beginning of the packet. The offset plus length cannot be greater than 112.

Examples:

(config) # gsparams gsgroup gg1 flow-mask enable default

(config) # gsparams gsgroup gg1 flow-mask enable offset 38 length 8

(config) # gsparams gsgroup gg1 flow-mask disable

Refer to the “GigaSMART MPLS Traffic Performance Enhancement” section in the GigaVUE Fabric Management Guide for details.

Specifies FlowVUE sampling parameters as follows:

For example:

(config) # gsparams gsgroup gsg1 flow-sampling-type device-ip-in-gtp

Use gsparams to configure these values and show gsparams command to verify these parameters. Refer to the “GigaSMART FlowVUE” section in the GigaVUE Fabric Management Guide for details and examples on FlowVUE.

Disconnects a 5G session if it is inactive for the specified timeout value.

The timeout can be configured as an integer from 1 to 6000 , with an incremental value of 10 minutes. The default value is 48 (480 minutes).

Specifies the maximum timeout for a session entry in the session table. This is a global session timeout for the specified GigaSMART group.

The values are from 5 to 600 seconds. The default is 5 seconds.

For example:

(config) # gsparams gsgroup gsg1 generic-session-timeout 30

Currently, this timeout only applies to tunnel load balancing for L2GRE tunnel encapsulation. Refer to the “Load Balancing across Tunnel Endpoints” section in the GigaVUE Fabric Management Guide.

Enables or disables sampling of GTP control plane (GTP-c) traffic as follows:

For example:

(config) # gsparams gsgroup gg1 gtp-control-sample disable

Refer to the “GTP Flow Sampling” section in the GigaVUE Fabric Management Guide.

Enables or disables sampling of GTP random sample as follows:

Specifies the rotation interval for random sampling. The minimum value is 12 hours and the maximum value of the interval is 48 hours.

Initiates the disconnection of a GTP session if it is inactive for the specified timeout value. The timeout can be configured as an integer from 1 to 6000, in increments of 10 minutes. The default is 48, which is 480 minutes, which is 8 hours.

For example:

(config) # gsparams gsgroup gg1 gtp-flow timeout 60

Specifies GTP persistence options for recovering sessions from a restart as follows:

Examples:

(config) # gsparams gsgroup gsg4 gtp-persistence enable

(config) # gsparams gsgroup gsg4 gtp-persistence inteval 15

Specifies the alias of the GTP forward list file to associate with a GigaSMART group (add) or to disassociate from a GigaSMART group (delete).

For example:

(config) # gsparams gsgroup gg1 gtpwhitelist add wlf1

(config) # gsparams gsgroup gg1 gtp-whitelist delete

You can also add multiple alias of the GTP forward list file to associate with a GigaSMART group (add).

For example:

(config) # gsparams gsgroup gg1 gtp-whitelist add wlf1

(config), add w2f2

(config), add w2f2

(config)# add w3f3

(config)

Configures an SSL Hardware Security Module (HSM) group as follows:

Examples:

(config) # gsparams gsgroup gg1 hsm-group add hsm-set

(config) # gsparams gsgroup gg1 hsm-group delete

Specifies IP fragmentation options as follows:

A session entry is created when a new head fragment packet is received. When subsequent fragment packets arrive, the information in this session will be used to forward the fragmented packets to the same destination as the head fragment packet.

For example:

(config) # gsparams gsgroup gsg1 ip-frag frag-timeout 30

Specifies load balancing options as follows:

For example:

(config) # gsparams gsgroup gsgrp1 lb replicate-gtp-c enable

Specifies NetFlow monitor options as follows:

For example:

(config) # gsparams gsgroup gsg netflow-monitor add mon1

(config) # gsparams gsgroup gsg netflow-monitor delete

Specifies the role for both 5G and LTE traffic as follows:

• 5G—specifies the control session limit for 5G traffic. The default session limit is 5000, the maximum session limit for GigaVUE‑HC3 is 12000, and GigaVUE-HD is 6000.
• LTE—specifies the control role for 3G, LTE traffic. The default session limit is 5000, the maximum session limit for GigaVUE‑HC3 is 12000, and GigaVUE-HD is 5000.

• standalone—
• 5G—specifies the user session limit for 5G traffic. The default session limit is 5000, the maximum session limit for GigaVUE‑HC3 is 12000, and GigaVUE-HD is 5000.
• LTE—specifies the user session limit for 3G, LTE traffic. The default session limit is 5000, the maximum session limit for GigaVUE‑HC3 is 12000, and GigaVUE-HD is 5000.

For example:

(config) # gsparams gsgroup <alias> cpn 3gpp-node-role control 5G

Allocates application resources for buffering on Application Session Filtering (ASF). This parameter allocates the number of session entries, in millions, as follows:

The configured application resources will only be available after the GigaSMART line card or module is rebooted. Refer to the “Displaying GigaSMART Application Resource Usage” section in the GigaVUE Fabric Management Guide.

The resources for buffer ASF on the GigaVUE-HB1 can only be configured to 2 million sessions.

Examples:

(config) # gsparams gsgroup gsgrp1 resource buffer-asf 3

(config) # gsparams gsgroup gsgrp1 resource buffer-asf disable

Configure the resources for buffer ASF before configuring apps asf parameters. Refer to apps asf.

Specifies an overload threshold for CPU resources for GigaSMART operations as follows:

The default is 90.

Examples:

(config) # gsparams gsgroup gsg1 resource cpu overload-threshold 70

(config) # gsparams gsgroup gsg1 resource cpu overload-threshold disable

Specifies an overload threshold for packet buffer resources for GigaSMART operations as follows:

Examples:

(config) # gsparams gsgroup gsg1 resource packet-buffer overload-threshold 60

(config) # gsparams gsgroup gsg1 resource packet-buffer overload-threshold disable

Configures the inline SSL to share resources with other GigaSMART operations as follows:

Examples:

(config) # gsparams gsgroup gsg1 inline-ssl standalone disable

(config) # gsparams gsgroup gsg1 inline-ssl standalone enable

The following notification is displayed when the configuration is changed after resource allocation.#Changes take effect after card or system reboot

Configures resources for the HSM SSL buffer as follows:

Examples:

(config) # gsparams gsgroup gsg1 resource hsm-ssl buffer 2

(config) # gsparams gsgroup gsg1 resource hsm-ssl buffer disable

Configures resources for the HSM SSL packet buffer as follows:

Packets are buffered while waiting for the session key.

For example:

(config) # gsparams gsgroup gsg1 resource hsm-ssl packet-buffer 600

Specifies the RTP port or ports for SIP/RTP. You must specify a port or a range of ports, from 1 to 65535.

Examples:

(config) # gsparams gsgroup gsg1 rtp-port range 2000

(config) # gsparams gsgroup gsg1 rtp-port range 20000..40000

Add or Delete Transport Agent Profile. To configure the sffp profile, refer to sffp profile.

Configures SIP-NAT feature as follows:

Specifies the SIP port list for SIP/RTP. You must specify one or more TCP/UDP ports, from 1 to 65535. Use a comma to separate multiple ports.

Examples:

(config) # gsparams gsgroup gsg1 sip-portlist 5060

(config) # gsparams gsgroup gsg1 sip-portlist 5060,5070,5090

Specifies the SIP session timer for SIP/RTP. This is a SIP session inactivity timer, used to clean up inactive sessions. The range of values is from 30 to 300 seconds. The default is 30 seconds.

For example:

(config) # gsparams gsgroup gsg1 sip-session timeout 48

Specifies the SIP TCP idle timer for SIP/RTP. The range of values is from 20 to 600 seconds. The default is 20 seconds.

For example:

(config) # gsparams gsgroup gsg1 sip-tcp-idle-timeout 30

Adds or deletes a SIP forward list file for SIP/RTP as follows:

Examples:

(config) # gsparams gsgroup gsg1 sip-whitelist add whitelist1

(config) # gsparams gsgroup gsg1 sip-whitelist delete

Specifies Passive SSL decryption failover options as follows:

An Passive SSL decryption failure occurs when encrypted traffic cannot be decrypted, for example, when an incoming flow exceeds the maximum supported bandwidth.

For example:

(config) # gsparams gsgroup grp ssl-decrypt decrypt-fail-action pass-tool

Specifies Secure Sockets Layer (SSL) decryption options as follows:

Disable can be used as debugging aid for traffic to bypass the Passive SSL decryption application.

For example:

(config) # gsparams gsgroup grp ssl-decrypt enable

Enables or disables the dynamic object for the HSM PKCS12 file as follows:

For example:

(config) # gsparams gsgroup grp ssl-decrypt hsm-pkcs11 dynamic-object disable

Enables or disables load sharing for the HSM PKCS12 file as follows:

For example:

(config) # gsparams gsgroup grp ssl-decrypt hsm-pkcs11 load-sharing disable

Configures the HSM timeout in milliseconds. The HSM timeout specifies a period of time for the communication between the HSM and GigaSMART.

The values are from 2 to 5000ms. The default is 1000ms.

For example:

(config) # gsparams gsgroup grp ssl-decrypt hsm-timeout 3600

Configures the following timeouts used when resuming an Passive SSL decryption session:

For example:

(config) # gsparams gsgroup grp ssl-decrypt key-cache-timeout 3600

These timeouts relate to how the SSL server stores the SSL key material and later, how the client resumes a session using the stored key material. The timeouts refer to the two different ways the session can be resumed: using a session key cache or using a TLS ticket cache.

Specifies Passive SSL decryption and HSM key mappings as follows:

Examples:

(config) # gsparams gsgroup grp ssl-decrypt key-map add service service1 key key1

(config) # gsparams gsgroup grp ssl-decrypt key-map delete service service1

The maximum number of key/service mappings is 2000 on GigaVUE HD Series. The maximum number of key/service mappings is 1000 on GigaVUE-HB1.

First create an SSL key alias, then a service alias, and then use key-map to tie them together. Refer to apps ssl for the commands to create keys, and services, including the default service.

A service can be mapped to different keys on different GigaSMART groups.

Specifies how to handle non-SSL traffic as follows:

Use this parameter when Passive SSL decryption sessions have both SSL and non-SSL packets after the SSL 3-way handshake.

For sessions that have SSL and non-SSL traffic, for example SMTP with StartTLS, this parameter provides an option to pass the non-SSL traffic in addition to the decrypted traffic.

For example:

(config) # gsparams gsgroup grp ssl-decrypt non-ssl-traffic drop

Specifies Passive SSL decryption timeout options as follows:

For example:

(config) # gsparams gsgroup grp ssl-decrypt session-timeout 90

show gsparams

show gsparams alias gsg1