Cisco Systems 4500 manual

Americas Headquarters Cisco Systems, In c. 170 West Tasman Drive San Jose, CA 951 34-1706 USA http://www.ci sco.com Tel: 408 526-4000 800 553-NETS (638 7) Fax: 408 527-0883 Catal yst 450 0 S eries S witc h Cisco IOS S of tw are Conf iguration Guide Re le ase 15.0( 2) SG Customer Order Number: DOC-OL23818=1 Customer Order Number: O L-23818-01[...]

THE SPECIFICATION S AND INFORMAT ION RE GARDIN G TH E PRODU CTS IN THIS MANU AL A RE SUBJ ECT T O CHAN GE W ITHOUT N OTICE. ALL STATEMENTS , INFORMATION, AND RECOMMENDATI ONS IN THI S MANUAL ARE BE LIEVED TO BE A CCURATE BUT ARE PRESENTED WI THOUT WARRANTY OF ANY KIND, EX PRESS OR IMPLIED. USER S MUST TAKE FULL RESPONSI BILITY FOR THEIR APPLICAT IO[...]

i Software Configuration Guid e—Release 15.0(2)SG OL-23818-01 CONTENTS Preface li Audience li Organization li Conventi ons liv Related Documentation lv Hardware Documents lv Software Documentation lvi Cisco IOS Document ation lv ii Commands in Task Ta bles lvii Notices lvii OpenSSL/Open SSL Project lvii License Issues lvii Obtaining Documentation[...]

Contents ii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Resilient Ethernet Protocol 1-7 SmartPort Macros 1-7 Spanning Tree Proto c ol 1-8 Stateful Switchover 1-8 SVI Autostate 1-9 User-Based Rate Limiting 1-9 Unidirectional Ethernet 1-9 Unidirectional Link Detection 1-9 VLANs 1-10 Virtual Switch System Client 1-10 Y.1731 (AIS and [...]

Contents iii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Embedded Event Manager 1-20 Ethernet Management Port 1-21 FAT File Management System on Superviso r Engine 6-E and 6L-E 1-21 Forced 10/100 Autonegotiation 1-21 Intelligent Power Management 1-21 MAC Address Notification 1-21 MAC Notify MIB 1-21 NetFlow-lite 1-22 Secure Shell [...]

Contents iv Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Performing Com mand-Line Proce ssing 2-3 Performing History Substitution 2-4 About Cisco IOS Command Modes 2-4 Getting a List of Commands and Syntax 2-5 Virtual Console for Standby Supervisor Engine 2-6 ROMMON Command-Lin e Interface 2-7 Archiving Crashfiles Information 2-8 D[...]

Contents v Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Setting the Privilege Leve l for a Command 3-23 Changing the Default Priv ilege Level for Lines 3-23 Logging In t o a Pri v ile ge Level 3-24 Exiting a Privilege Level 3-24 Displaying the Password, Access Lev el, and Privilege Level Configuration 3-24 Recovering a Lost Enable [...]

Contents vi Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Understanding DNS 4-15 Default DNS Configuration 4-16 Setting Up DNS 4-16 Displaying the DNS Configuration 4-17 Creating a Banner 4-17 Default Banner Configuration 4-18 Configuring a Message-o f-the-Day Login Banner 4-18 Configuring a Login Banner 4-19 Managing the MAC Addres[...]

Contents vii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Performing an ISSU Upgrade: 2 Metho ds 5-11 Changeversion Proce ss 5-12 Changeversion: Quick Option 5-12 Scheduled Changevers ion: “in” and “at” Options 5-12 Changeversion Deployme nt Scenario 5-13 Aborting an In-Progress Chan geversion Procedure 5-13 Guidelines for [...]

Contents viii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Deploying 10-Gigabit Etherne t and Gigabit Ethernet SFP Ports on Sup ervisor Engine V-10GE 6-12 Deploying 10-Gigabit Ethernet or Gigabit Ethernet Po rts on Superviso r Engine 6-E, Supervisor Engine 6L-E and WS-X4606-X2-E 6-13 Port Numbering TwinGig Convertors 6-13 Limitatio[...]

Contents ix Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Checking Interfaces Status 7-2 Displaying MAC Addresses 7-3 Checking Cable Status Using Time Domain Reflectometer 7-3 Overview 7-3 Running the TD R Test 7-4 TDR Guidelines 7-5 Using Telnet 7-5 Changing the Log out Timer 7-6 Monitoring Us er Sess io ns 7-6 Using Ping 7-7 Under[...]

Contents x Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Manipulating Bootflash on the Redund ant Su pervisor Engine 8-15 CHAPTER 9 Configuring Cisco NSF with SSO Supervisor Engin e Redundancy 9-1 About NSF with SSO Supervisor Engine Redundanc y 9-1 About Cisco IOS NSF-Aware and NSF-Capable Support 9-2 NSF with SSO Supervisor Engine[...]

Contents xi Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Power Management Modes for the Catalyst 450 0 Switch 10-8 Selecting a Power Manageme nt Mode 10-8 Power Management Limitations in Catalyst 4500 Series Switches 10-9 Available Power for Catalyst 4500 Series Switches Power Su pplies 10-13 Special Considerations fo r the 4200 W [...]

Contents xii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Network Assistant-Related Parameters and Their Defaults 12-3 Network Assistant CLI Commands 12-3 Configuring Your Switch for Network Assistant 12-4 (Minimum) Required Configuration 12-4 (Additional) Configuration Require d to Use Community 12-5 (Additional) Configuration Req[...]

Contents xiii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Understanding the VTP Domain 13-8 Understanding VTP Mode s 13-9 Understanding VTP Adv ertisements 13-9 Understanding VTP Version s 13-9 Understanding VTP P runing 13-11 VTP Configuration Guidelines and Re strictions 13-12 VTP Default Config uration 13-13 Configuring VTP 13-[...]

Contents xiv Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Troubleshooting IP Unnumbered Interface 14-7 Related Documents 14-8 CHAPTER 15 Configuring Layer 2 Ethernet Interfaces 15-1 About Layer 2 Ethernet Switching 15-1 Layer 2 Ethernet Switching 15-2 Switching Frames Between Se gments 15-2 Building the MAC Addre ss Table 15-2 VLAN[...]

Contents xv Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 cisco-global 16-4 cisco-desktop 16-4 cisco-phone 16-5 cisco-router 16-5 cisco-switch 16-5 SmartPort Macro Configuration Guidelines 16-6 Creating SmartPort Macros 16-8 Applying SmartPort Macros 16-9 cisco-global 16-10 cisco-desktop 16-11 cisco-phone 16-11 cisco-switch 16-12 ci[...]

Contents xvi Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Configuring STP Port Priority 18-13 Configuring STP Port Cost 18-15 Configuring the Bridge Priority of a VLAN 18-17 Configuring the Hello Time 18-17 Configuring the Maximum Aging Time for a VLAN 18-1 8 Configuring the Forward-Delay Time for a VLAN 18-1 9 Disabling Spanning T[...]

Contents xvii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Flex Links Failover Ac tions 19-3 MAC Address-Table Move Update 19-4 Configuring Flex Links 19-5 Default Configuration 19-5 Configuration Guidelines 19-6 Configuring Flex Links 19-6 Configuring VLAN Load Balancing on Flex Links 19-8 Configuring MAC Address-Table Move Update[...]

Contents xviii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Enabling EtherChannel Guard (Optio nal) 21-6 About PortFast 21-7 Enabling PortFast 21-7 About BPDU Guard 21-8 Enabling BPDU Guard 21-9 About PortFast BPDU Filter in g 21-9 Enabling PortFast BPDU Filtering 21-10 About UplinkFast 21-11 Enabling Uplink Fast 21-12 About Backbo[...]

Contents xix Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Understanding L ink-State T racking 22-18 Configuring Link-State Tracking 22-21 Default Link-State Tracking Configuration 22-21 Link-State Tracking Configuration Guidelines 22-21 Configuring Link-State Tracking 22-21 Displaying Link-State Tracking Status 22-22 CHAPTER 23 Con[...]

Contents xx Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Configuring IGMP Profiles 23-21 Applying IGMP Profiles 23-22 Setting the Maximum Number of IGMP Groups 23-23 Displayin g IGMP Filt ering Conf iguration 23-24 CHAPTER 24 Configuring IPv6 MLD Snooping 24-1 About MLD Snooping 24-1 MLD Messages 24-2 MLD Queries 24-3 Multicast Cli[...]

Contents xxi Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Configuring VLAN Mapping 25-11 One-to-One Mapping 25-11 Traditional Q-in-Q on a Trunk Po rt 25 -12 Selective Q-in-Q on a Trunk Port 25-12 About Layer 2 Protocol Tunneling 25-13 Configuring Layer 2 Protocol Tunne ling 25-15 Default Layer 2 Protocol Tunneling Configuration 25-[...]

Contents xxii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 UDLD Topology 28-2 Fast UDLD Topology 28-2 Operation Modes 28-3 Default States for UDLD 28-3 Default UDLD Configuration 28-4 Configuring UDLD on the Switch 28-4 Fast UDLD Guidelines and Restrictions 28-4 Enabling UDLD Globally 28-5 Enabling UDLD on Individual Interfaces 28-[...]

Contents xxiii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Monitoring and Maintaining EIGRP 30-19 EIGRP Configuration Examples 30-19 Route Summarization Example 30-19 Route Authentication Exa mple 30-20 Stub Routing Exam ple 30-20 CHAPTER 31 Configuring Cisco Ex press Forwarding 31-1 About CEF 31-1 CEF Features 31-1 Forwarding Inf[...]

Contents xxiv Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Unicast RPF with BOOTP and DHCP 32-8 Restrictions 32-8 Limitation 32-8 Related Features an d Tech nologies 32-8 Prerequisites to Configuring Unicast RPF 32-9 Unicast RPF Configuration Tasks 32-9 Configuring Unicast RPF 32-9 Verifying Unicast RPF 32-10 Monitoring and Maintai[...]

Contents xxv Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Load Splitti ng of IP Multic ast Traffic 33-22 Monitoring and Maintaining IP Multicast Routing 33-23 Displaying System and Network Statistics 33-23 Displaying the Multicast Routing Table 33-23 Displaying IP MFIB 33-26 Displaying Bidirectional PIM Information 33-27 Displaying[...]

Contents xxvi Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Deny ACE 35-9 CHAPTER 36 Configuring VRF-lite 36-1 About VRF-lite 36-2 Default VRF-lite Configuration 36-3 VRF-lite Configuration Guidelines 36-4 Configuring VRFs 36-5 Configuring VRF-Aware Services 36-6 Configuring the User Interface for ARP 36-6 Configuring the User Inter[...]

Contents xxvii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Mapping Tables 37-14 Queueing and Scheduling 37-14 Active Queue Management 37-14 Sharing Link Bandwidth Among Tran smit Queues 37-15 Strict Priority / Low Latency Queueing 37-15 Traffic Shaping 37-16 Packet Modification 37-16 Per-Port Per-VLAN QoS 37-16 QoS and Software Pr[...]

Contents xxviii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Configuring the CoS-to-DSCP Map 37-53 Configuring the Policed-DSCP Map 37-54 Configuring the DSCP-to-CoS Map 37-55 Configuring Auto-QoS on Superviso r Engines II-Plus, II+ 10GE, IV , V, V-10GE, 4924, 4948, and 4948-10GE 37-56 Generated Auto-QoS Configuration 37-57 Effects[...]

Contents xxix Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Transmit Queue Statistics 37-85 Policy Associations 37-85 Software QoS 37-87 Configuring CoS Mutation 37-88 Configuring System Queue Limit 37-89 Configuring Auto-QoS on Supervisor En gine 6-E, Supervisor Engine 6L-E , Catalyst 490 0M, and Catalyst 4948E 37-90 CHAPTER 38 Con[...]

Contents xxx Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Configuring a Layer 2 Interface as a PVLAN Host Port 39-18 Configuring a Layer 2 Interface as an Isolate d PVLAN Trunk Port 39-19 Configuring a Layer 2 Interface as a Promiscuous PVLAN Trunk Port 39-21 Permitting Routing of Secondary VL AN Ingres s Traffic 39-23 Configuring [...]

Contents xxxi Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Using 802.1X with Authentication Failed VLAN Assignme nt 40-17 Usage Guidelines for Using Authentication Failed VLAN Ass ignment 40-18 Using 802.1X with Port Security 40-19 Using 802.1X Authenticatio n with ACL Assignments and Redirect URLs 40-20 Cisco Secure ACS and AV Pai[...]

Contents xxxii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Cisco ACS Configuration fo r VLAN Assignment 40-72 Enabling Fallback Authentication 40-73 Enabling Periodic Reauthentication 40-78 Enabling Multiple Hosts 40-80 Changing th e Quie t Period 40-81 Changing the Switch-to -Client Retransmission Time 40-82 Setting the Switch-to[...]

Contents xxxiii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Displaying Authen tication Details 40-114 Determining the Authentication Methods Registered with the Auth Manage r 40-114 Displaying the Auth Manager Summary for an Interface 40-114 Displaying the Summary of All Auth Manager Sessio ns on the Switch 40-114 Displaying a Sum[...]

Contents xxxiv Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 LAN Port IP 42-5 Gateway IP 42-5 ACLs 42-5 Context-Based Access Control 42-5 802.1X Authentication 42-5 EtherChannel 42-5 Switchover 42-5 Configuring Web-Based Authentication 42-6 Default Web-Based Authentication Configuration 42-6 Web-Based Authentication Configuration Gu[...]

Contents xxxv Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Example 7: Setting a Rate Limit for Bad Packets 43-13 Example 8: Clearing Dynamic Secure MAC Addresses 43-14 Configuring Port Security on PVLAN Ports 43-14 Configuring Port Security on an Isolated Private VL AN Host Port 43-14 Example of Port Security on an Isolated Private[...]

Contents xxxvi Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 About Control Plane Policing 44-2 General Guidelines for Control Plane Policing 44 -3 Default Configuration 44-4 Configuring CoPP for Control Plane Traffic 44-4 Configuring CoPP for Data Plane and Ma nagement Plane Traffic 44-6 Control Plane Policing Configuration Guidelin[...]

Contents xxxvii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 CHAPTER 45 Configuring DHCP Snooping , IP Source Guard, and IPSG for Static Hosts 45-1 About DHCP Snooping 45-1 Trusted and Untrusted Sources 45-2 About the DHCP Sno oping Database Agent 45-2 Option 82 Data Insertion 45-4 Configuring DHCP Snooping 45-6 Default Configurati[...]

Contents xxxviii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Dynamic ACLs 47-5 VLAN Maps 47-5 Hardware and Software ACL Support 47-6 TCAM Programming and ACLs for Supervisor Engine II-Plus, Supervisor Engine IV, Supervisor Engin e V, and Supe rvisor Engine V-10GE 47-7 TCAM Programming Algorithms 47-8 Changing th e Prog ramming Alg[...]

Contents xxxix Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Removing the Requirement for a Port ACL 47 -36 Configuration Restrictions 47-37 Debugging Considerations 47-37 Webauth Fallback 47-37 Configuring IPv4, IPv6, and MAC ACLs on a Layer 2 Interface 47-38 Using PACL with Access-Group Mode 47-39 Configuring Access-group Mode on [...]

Contents xl Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Configuring Port Blocking 49-1 Blocking Flooded Traffic on an Interface 49-2 Resuming Normal Fo rwarding on a Port 49-3 CHAPTER 50 Configuring Storm Control 50-1 About Storm Control 50-1 Hardware-Based Storm Control Implementation 50-2 Software-Based Storm Control Imple menta[...]

Contents xli Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Ingress Packets 51-12 Access List Filtering 51-13 ACL Configuration Guidelines 51-13 Configuring Access List Filtering 51-14 Packet Type Filtering 51-15 Configuration Example 51-16 Configuring RSPAN 51-16 RSPAN Configuration Guidelines 51-16 Creating an RSPAN Session 51-17 C[...]

Contents xlii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Information about Data Collected by OBFL 53-2 OBFL Data Overview 53-2 Temperature 53-3 Operational Uptime 53-4 Interrupts 53-7 Message Logging 53-8 Default Settings for OBFL 53-9 Enabling OBFL 53-9 Configuration Examples fo r OBFL 53-10 Enabling OBFL Message Logging: Exam p[...]

Contents xliii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Monitor-level Restrictions 55-2 Configuring NetFlow Packet Sampling 55-2 Configuring Information about the External Co llecto r 55-3 Example 55-3 Usage Guidelines 55-4 Configuring Sampling Parameters 55-4 Example 55-5 Usage Guidelines 55-5 Activating Sampling on an Interfa[...]

Contents xliv Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 NetFlow Statistics Collection Config uration Example 56-13 NetFlow Configuration Examples 56-14 NetFlow Enabling Scheme Examples 56-14 NetFlow Aggregation Configuration Examples 56-14 Autonomous System Co nfi guration 56-15 Destination Prefix Configuratio n 56-15 Prefix Con[...]

Contents xlv Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Understanding CFM ITU-T Y.1731 Fault Manag emen t 57-27 Y.1731 Termin ology 57-27 Alarm Indication Sig n al s 57-28 Ethernet Remote Defect Indication 57-28 Multicast Ethernet Lo opback 57-29 Configuring Y.1731 Fault Manageme nt 57-29 Default Y.1731 Configuration 57-29 Config[...]

Contents xlvi Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Displaying Y.1731 Information 58-6 CHAPTER 59 Configuring Call Home 59-1 About Call Home 59-2 Obtaining Smart Call Home 59-2 Configuring Call Home 59-3 Configuring Contact Information 59-4 Configuring Destination Profiles 59-5 Copying a Dest in ati on Profile 59-6 Subscribi[...]

Contents xlvii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 IP SLA Configuration Guidelines 60-7 Configuring the IP SLAs Responder 60-8 Analyzing IP Service Levels by Using the UDP Jitter Operation 60-9 Analyzing IP Service Levels by Using the ICMP Echo Operation 60-11 Monitoring IP SLAs Operations 60-13 CHAPTER 61 Configuring RMON[...]

Contents xlviii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Configuration Register 63-3 Changing th e Configurat ion Register Manua lly 63-3 Changing th e Co nfiguration Register Using Prompts 63-4 Console Download 63 -4 Error Reporting 63-5 Debug Commands 63-5 Exiting the ROM Monitor 63-6 CHAPTER 64 Configuring WCCP Version 2 Ser[...]

Contents xlix Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Downloading and Compiling MIBs 65-2 Guidelines for Working with MIBs 65-3 Downloading MIBs 65-3 Compiling MIBs 65-4 Enabling SNMP Support 65-4 Acronyms and Abbreviations A-1 I NDEX[...]

Contents l Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01[...]

li Software Configuration Guid e—Release 15.0(2)SG OL-23818-01 Preface This preface describes who sh ould read this document, ho w it is organized, and its con ventions. The preface also tells you ho w to obtain Cisco documents, as well as ho w to obtain technical assistance . Audience This guide is for e xperienced network ad ministrators who ar[...]

lii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Preface Chapter 9 Conf igu ring Cisco N SF wi th SSO Supervisor Engine Redu ndancy Describes ho w to configure supervisor en gine redundancy using Cisco nonsto p forwarding (NSF) with stateful switchover (SSO). Chapter 10 En vironmental Monitoring and Pow er Management Describes how [...]

liii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Preface Chapter 29 Conf iguring Unidirectio nal Ethernet Describes ho w to configure unidirection al Ethernet . Chapter 30 Conf iguring Layer 3 Interfaces Describes ho w to conf igure interfaces to support Layer 3 features. Chapter 31 Conf iguring Cisco Express Forw arding Describes[...]

liv Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Preface Conventions This document uses the f ollo wing typographical con ventions: Chapter 51 Conf iguring SP AN and RSP AN Describes ho w to conf igure the Switched Port Analyzer (SP AN). Chapter 52 Conf iguring System Message Logging Describes ho w to configure system message loggi[...]

lv Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Preface Notes use the follo wing con ventions: Note Means reader take note . Notes contain helpful suggestions or references to material not co vered in the publication. Cautions use the following con ventions: Caution Means reader be car e ful . In this situation, you might do someth[...]

lvi Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Preface • Catalyst 4500 Series Switc hes Installation Guide http://www .cisco.com/en/ US/docs/switches/lan/cat alyst4500/hardware/installati on/guide/78-14409 -08/4500inst .html • Catalyst 4500 E-seri es Switches Inst allation Guide http://www .cisco.com/en/ US/docs/switches/lan/[...]

lvii Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Preface Cisco IOS Documentation Platform- indep e ndent Cisco IOS do cumentation may al so apply to the Catalyst 45 00 and 4900 switches. These documents are av ailable a t the following URLs: • Cisco IOS conf iguration guides, Release 12.x http://www .cisco.com/en/US/produ cts/ps[...]

lviii Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Preface Redistrib ution and use in source an d binary forms, with or without modif ication, are permi tted pro vided that the follo wing conditions are met: 1. Redistrib u tions of source code must retain th e copyright not ice, this list of conditions and the follo wing disclaimer[...]

lix Software Co nfiguration Guide—Release 15.0(2)SG OL-23818-01 Preface Obtaining Do cumentatio n and Submitting a Service Request Redistrib ution and use in source an d binary forms, with or without modif ication, are permi tted pro vided that the follo wing conditions are met: 1. Redistrib u tions of source code must retain th e copyright notic[...]

lx Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Preface Obtaining Documentation an d Submitting a Se rvice Request[...]

CH A P T E R 1-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 1 Product Overview This chapter pro vides an ove rvie w of Catalyst 45 00 series switches and includes the follo wing major sections: • Layer 2 Software Features, page 1-1 • Layer 3 Software Featur es, page 1-11 • Management Feature s, page 1-18 • Security Feature[...]

1-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 2 Softwar e Features • Link Layer Discovery Protocol, page 1-5 • Link State Tracking, page 1-6 • Location Service, page 1-6 • Multiple Spanning T ree, page 1-6 • Per -VLAN Rapid Spannin g T ree, page 1-6 • Quality of Ser vice, page 1-6 •[...]

1-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 2 Software Features Cisco Discovery Protocol The Cisco Discov ery Protocol (CDP) is a de vice-discov ery protocol that is bo th media- and protocol-indep endent. CDP is a v ailable on all Cisco product s, including routers, switches, bridges, and acces[...]

1-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 2 Softwar e Features Flex Links and MAC Address-Table Move Update Flex Links are a pair of Layer 2 interfaces (switc h ports or port channels) where one interface is configured to act as a backup to the other . The featur e provides an alternative sol[...]

1-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 2 Software Features Jumbo Frames The jumbo frames feature allo ws the switch to forwar d packets as lar ge as 9216 bytes (larger than the IEEE Ethernet MTU), rather than declare those frames “ov e rsize” and discard them. This feature is typically [...]

1-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 2 Softwar e Features Link State Tracking Link-state trac king, also kn own as trunk failover , is a feature that binds th e link state of multiple interfaces. F or example, link-state tracking pro vides redundancy in the netw ork when used with server[...]

1-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 2 Software Features The quality of service (QoS) feature prev ents congestio n by selecting netw ork traf fic and prior itizing it according to its relati ve importance. Implement ing QoS in your netwo rk makes network perf ormance more predictable and[...]

1-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 2 Softwar e Features For info rmation on conf iguring SmartPort macros, see Chapter 16, “Configuring SmartPort Macros. ” Spanning Tree Protocol The Spanning T ree Protocol (STP) allows yo u to create f ault-tolerant internetw ork s that ensure an [...]

1-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 2 Software Features SVI Autostate When an SVI has multiple ports on a V LAN, normally the SVI wil l go do wn when all the ports in the VLAN go do wn. Y ou can design your network so that some ports are no t counted in the calculation of SVI “going up[...]

1-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 2 Softwar e Features VLANs A VLAN configures switches and routers according to logical, rather than p hysical, topologies. Using VLANs, you can combine any collectio n of LAN segmen ts wi thin an internetwork into an auto nomous user group , such tha[...]

1-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 3 Software Features ETH-AIS suppresses alarms follo wing detection of defe ct conditi ons at the server ( sub) layer . Due to independent restoration capabiliti es provided within the Spanning Tree Protocol (STP) en vi ronments, ETH-AIS is not expect [...]

1-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 3 Softwar e Features EIGRP Stub Routing The EIGRP stub routi ng feature, a vailable in all ima ges, reduces resource utili zation by mo ving routed traf fic clos er to the end u ser . The IP base image contains o nly EIGRP stub routin g. The IP servi[...]

1-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 3 Software Features http://www .cisco.co m/en/US/docs/ios/ipapp/co nf iguration/guide/ipapp_ hsrp_ps6350_TSD_Products_ Config uration_Guide_Chapter .html SSO Aware HSRP SSO A ware HSRP o ffers cont inuous data packet forw arding during a supervisor en[...]

1-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 3 Softwar e Features EIGRP The Enhanced Interior Ga tew ay Routing Protocol (EIGRP) is a v ersion of IGRP that combines the adv antages of link-state protocols with distance-vector protocols. EIGRP incorporates t he Diff using Update Algorithm (DU AL[...]

1-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 3 Software Features interfaces and their metrics is used in OSPF LSAs. As routers accumulate link-s tate information, they use the shortest path first (SPF) al gorithm to calculate the shortest path to each node. Additional OSPF features include equal[...]

1-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 3 Softwar e Features • ANCP Client —ANCP Mu lticast enables you to con trol multicast traf fic on a Catalyst 4500 switch using either ANCP (rather than IGMP) or direct static conf iguration on the CLI. • Cisco Group Management Protocol (CGMP) s[...]

1-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Layer 3 Software Features NSF with SSO Non-Stop F orwar ding with Stateful Swi tcho ver (NSF/ SSO) of fers conti nuous data pack et forwardi ng in a Layer 3 routing en vironment during supervisor engine switcho ver . During supervisor engine switchov e r , [...]

1-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Management Features For info rmation on conf iguring unidirectional l ink routing, refer to th e chap ter “Conf iguring Unidirectional Link Routing” in the Cisco IP and IP Routing Conf iguration Guide . VRF-lite VPN routing and fo rwarding (VRF- lite) [...]

1-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Management Features • Secure Shell, page 1-22 • Simple Netw ork Management Protocol, page 1-22 • SP AN and RSP AN, page 1-22 • W eb Content Coor dination Protocol, page 1-23 • XML-PI, page 1-23 Cisco Call Home Call Home prov ides e-mail-based an d[...]

1-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Management Features Cisco Network Assistant Cisco Network Assistant manages standal one devices, cl usters of de vices, or fe deratio ns of devices fro m anywhere in y our intranet. Using its graphi cal user interf ace, you can perform multip le conf igura[...]

1-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Management Features Ethernet Management Port The Ethernet management port, also referred to as the F a1 or fastethernet1 port , is a Layer 3 host port to which you can connect a PC. Y ou can use the Ethern et management port instead of the swit ch console p[...]

1-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Management Features NetFlow-lite Note NetFlo w-lite is only supported on Catalyst 4948E Ethernet Switch. The Netflo w-lite feature is based on ingress packet sampl ing at a monitoring point that can be an interface on the switch. By e xporting NetFlow samp[...]

1-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Security Features Remote SP AN (RSP AN) is an extension of SP AN , where source ports and destination ports are distrib uted across multiple switches, allo wing remote monitoring of multipl e switches across the network. The traff ic for each RSP AN session[...]

1-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Security Features • Hardware- Based Control Plane Policing, page 1- 26 • IP Source Guard for Static Hosts, page 1-27 • IP Source Guard, page 1 -27 • Local Authenticati on, RADIUS, and T A CA CS+ Authentication, page 1-27 • Netw ork Admission Cont[...]

1-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Security Features • 802.1X with Inaccessible Authentication Bypass— Applies when the AAA servers are unreachable or nonresponsi ve. In this situation, 802 .1X user au thentication t ypically fa ils with the port closed, and the user is denied access. In[...]

1-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Security Features http://www .cisco.com/en/US/ docs/switches/lan /tr ustsec/conf iguration/guide/trustsec.html Dynamic ARP Inspection Dynamic ARP Inspect ion (D A I) inte rcepts all ARP r equests, replies on untrusted ports, and verifies each intercepted p[...]

1-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Security Features Catalyst 45 00 supervi sor engines . It supports vari ous Layer 2 and Layer 3 co ntrol protocols, such as C D P, E A P O L , S T P, D T P, V T P, I C M P , C G M P, I G MP , DHCP , RIPv2, OSPF , PIM, TELNET , SNMP , HTTP , and packets dest[...]

1-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Security Features N AC Layer 2 IP is an in tegral part of Cisco Netw ork Admission Control. It of fers the first line of defense for infected hosts (PCs and other devices attached to a LAN p ort) attempting to connect to the corporate network. N AC Layer 2[...]

1-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Security Features PPPoE Intermediate Agent PPPoE Intermediate Agent (PPPoE IA) is placed between a subscriber and BRAS to help the service provider BRAS disting uish betw een end ho sts conn ected over Ethernet to an access switch. On the access switch, PPP[...]

1-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 1 Product Overview Security Features Utilities Supported utilit ies include the follo wing: Layer 2 Traceroute Layer 2 traceroute al lows the switch to ident ify the phy sical path that a packet takes from a source de vice to a destination device. Layer 2 traceroute supports[...]

CH A P T E R 2-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 2 Command-Line Interfaces This chapter describes the CLIs y ou use to conf igur e the Catalyst 4500 seri es switch. This chapter includes the follo wing major sections: • Accessing the Switch CLI, page 2-2 • Performing Command-Line Processing, pag e 2-3 • Performing[...]

2-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Accessing the Switch CLI Accessing the Switch CLI The follo wing sections describe how to access the switch CLI: • Accessing the CLI Usin g the EIA/TIA-232 Console Int erface, page 2-2 • Accessing the CLI Thro ugh T elnet, page 2-2 Accessing th[...]

2-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Interfaces Performing Command-Line Processing T o make a T elnet connection to the switch, perform this task: This exampl e shows ho w to open a T elnet session to the switch: unix_host% telnet Switch_1 Trying 172.20.52.40... Connected to 172.20.52.40. Escape ch[...]

2-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Performing History Substitution Performing History Substitution The history b uffer stores the last 20 command lines you entered. Hist ory substitution enabl es you to access these command lines without retypin g them. Ta b l e 2 - 2 lists the hist[...]

2-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Interfaces Getting a List of Commands and Syntax Y ou use a separate mode called ROMMON when the switch cannot boot up properly . For e xample, the switch might enter R OMMON mode if it does not fin d a val id system image when it i s booting, or if it s confi g[...]

2-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Getting a List of Comman ds and Syntax T o list ke ywords or ar guments, enter a question mark in place of a ke yword or ar gument. Include a space before the question mark. This form of hel p is called command syntax help, because it remind s you [...]

2-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Interfaces ROMMON Command-Line In te rface T o log in to the standb y supervisor engine using a virtual console, enter the follo wing command: Switch# session module 2 Connecting to standby virtual console Type "exit" or "quit" to end this se[...]

2-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Archiving Crashf iles Information When you enter R O MMON mode , the prompt changes to rommon 1> . Use the ? command to see the av ailable R OMMON commands. For more information abou t the R O MMON commands, refer to the Cisco IOS Command Refe r[...]

2-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Interfaces Displaying a Crash Dump ========= Context ====================== pc=10999E70 lr=10999E34 msr=02029230 vector=00000600 cr=20004022 ctr=108EC3EC xer=00000000 r0=10999E34 r1=2421F930 r2=0000001E r3=234BBFD8 r4=0000000A r5=00000000 r6=2421F918 r7=00000000[...]

2-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Displaying a Crash Dump 2421FAF0: 00000000 00000000 00000000 00000000 2421FB00: 00000000 00000000 2421FB10 1099BCFC 2421FB10: 00000000 10992CEC FFFFFFFF ========= Popped stack ====================== 2421F730: E8000800 151B1AB0 2421F748 132BBFA8 24[...]

2-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Interfaces Displaying a Crash Dump 151A3B48: 1586D 760 10C7FE38 10C7F17 C 1586FF98 10C7FE38 10C7F17 C 151A3B30: 1586D760 10C84B24 10C7F17C 1586D760 10C7FE38 10C7F17C 151A3B18: 1586FF98 10C84B24 10C7F17C 1586FF98 10C7FE38 10C7F17C 151A3B00: 1586D760 10C84B24 10C[...]

2-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Displaying a Crash Dump Flags: analyze crashblock on_old_queue Status 0x00000000 Orig_ra 0x00000000 Routine 0x00000000 Signal 0 Caller_pc 0x00000000 Callee_pc 0x00000000 Dbg_events 0x00000000 State 0 Totmalloc 153104 Totfree 9040 Totgetbuf 0 Totre[...]

2-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Interfaces Displaying a Crash Dump ---- Level 2 Interrupt stack (0x3F8 bytes used, out of 0x2328 available) ---- intstacks[2]: base 0x156D90B0 stack 0x156DB3D0 routine 0x0 count 0x2 size 0x2328 low 0x2328 desc 0x156C0C78 156DAFE0: 156DAFE8 FFFFFFFF 156DB020 119[...]

2-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Displaying a Crash Dump 156D8FE0: 20526576 69657700 0 0 0 0 0 0 156D9000: 0 0 1ADBEEF 1896AD90 156D9030 0 0 146CF310 156D9020: 146D0000 14620EA0 D 1893E4BC 156D9038 134D23A4 156D9058 12023A6C 156D9040: 0 1B1DDC40 156D9050 40 D 1B1DDC40 156D9080 11[...]

2-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Interfaces Displaying a Crash Dump ---- Level 7 Interrupt stack (0x0 bytes used, out of 0x2328 available) ---- intstacks[7]: base 0x156CE0E8 stack 0x156D0408 routine 0x0 count 0x0 size 0x2328 low 0x2328 desc 0x156BEE74 ---- Level 8 Interrupt stack (base 0x0, si[...]

2-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Displaying a Crash Dump 2421F8D0: 0 0 2421F8E8 10C1FD9C 2421F8F8 0 0 0 2421F8F0: 15868B74 15868B74 2421F910 117CF5C0 2421F968 1586A45C 2421F920 15868B74 2421F910: 2421F918 0 14850000 0 2421F930 10999978 2421F930 0 2421F930: 2421F940 10999E34 2421F[...]

2-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Interfaces Displaying a Crash Dump 234BBAF0: 0 23056294 23054D90 13597D4C 1 0 0 FD0110DF 234BBB10: AB1234CD FFFE0000 0 13D9A594 10027870 234BBB54 234BBAE0 8000000E 234BBB30: 1 0 1 4 0 0 0 0 234BBB50: FD0110DF AB1234CD FFFE0000 0 156CD7F4 119EB018 234BC350 234BB[...]

2-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Displaying a Crash Dump 13794B6C: 546F6F20 6D616E79 206C696E 6B730000 426C6F63 6B206465 76696365 20726571 13794B8C: 75697265 64000000 41726720 6C697374 20746F6F 20626967 0 4E6F2073 13794BAC: 75636820 70726F63 65737300 4E6F7420 6F776E65 72000000 4E[...]

2-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Interfaces Displaying a Crash Dump L2CAPTECC: 0x0 L2ERRDET: 0x0 L2ERRDIS: 0x0 L2ERRATTR: 0x0 L2ERRADDRH: 0x0L2ERRADDRL: 0x0 L2_ERRCTL: 0x0 DDR_CAPTURE_DATA_HI: 0x0 DDR_CAPTURE_DATA_LO: 0x0 DDR_CAPTURE_ECC: 0x0 DDR_ERR_DETECT: 0x0 DDR_ERR_DISABLE: 0x0 DDR_ERR_IN[...]

2-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 2 Command-Line Inter fa ces Displaying a Crash Dump[...]

CH A P T E R 3-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 3 Configuring the Switch for the First Time This chapter describes ho w to initially conf igure a Catalyst 4500 series switch. The information present ed here supplements the administrati on information and procedures in t his publication: Cisco IOS Conf igur ation Fun da[...]

3-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Configuring DHCP-Based Autoconfig uration Configuring DHCP-Based Autoconfiguration These sections describe ho w to conf igure DHCP-based autoconfiguration: • About DHCP- Based Autoconf iguration, page 3- 2 • DHCP Client Reque[...]

3-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Configuring DHCP-Based Autoconfiguration W ith DHCP-based autoconfigurati on, no DHCP client-side conf iguration is needed on your switch because your switch (the DHCP cli ent) is automatically conf igured at startup with IP address[...]

3-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Configuring DHCP-Based Autoconfig uration Configuring the DHCP Server A switch can act as both the DHCP client and the DHCP serv er . By default, the Cisco IOS DHCP serv er and relay agent features are enabled on your switch. Y o[...]

3-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Configuring DHCP-Based Autoconfiguration filename (i f any) and the follo wing fil es: network-confg, cisconet.cfg, hostnam e .confg, or hostname .cfg, where hostname is the current hostname of the switch an d router-confg and cisco[...]

3-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Configuring DHCP-Based Autoconfig uration Figur e 3-2 Relay Device Used in A utoconfiguration Obtaining Configuration Files Depending on the a vailability o f the IP address a nd the conf iguration fil ename in the DHCP reserved [...]

3-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Configuring DHCP-Based Autoconfiguration If the switch cannot read the netw ork-confg, cisconet.cfg, or the hostname f ile, it reads the router -confg fi le. If the switch cannot read the r outer -confg file, it reads the ciscortr .[...]

3-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Configuring the Switch DNS Server Conf iguration The DNS server maps the TFTP serv er name maritsu to IP address 10.0.0.3. TFTP Server Conf iguration (on UNIX) The TFTP server base direct ory is set to /tftpserver/ work/. This di[...]

3-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Configuring the Switch Using Configuration Mode to Configure Your Switch T o conf igure your switch from conf iguration mode, follo w these steps: Step 1 Connect a console terminal t o the console interface o f your supervisor engin[...]

3-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Configuring the Switch <...output truncated...> ! line con 0 transport input none line vty 0 4 exec-timeout 0 0 password lab login transport input lat pad dsipcon mop telnet rlogin udptn nasi ! end Switch# Saving the Runni[...]

3-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Configuring the Switch ! line con 0 exec-timeout 0 0 transport input none line vty 0 4 exec-timeout 0 0 password lab login transport input lat pad dsipcon mop telnet rlogin udptn nasi ! end Switch# Configuring a Default Gateway Not[...]

3-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Configuring the Switch T o conf igure a static route, perform th is task: This example shows ho w to use the ip route command to conf igure a static route to a workstation at IP address 171.10 .5.10 on the sw itch with a subnet [...]

3-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Controlling Access to Privileged EX EC Command s . ip default-gateway 172.20.52.35 ip classless ip route 171.20.5.3 255.255.255.255 Vlan1 no ip http server ! ! x25 host z ! line con 0 transport input none line vty 0 4 exec-timeout [...]

3-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Controlling Access to Pr ivileged EXEC Commands Using the enable password and enable secret Commands T o provide an add itional layer of security , particularly for p asswords that cross th e network or that are stored on a TFTP[...]

3-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Controlling Access to Privileged EX EC Command s For informatio n on ho w to display the password or access le vel conf iguration, see the “Displaying the Password, Access Lev el , and Privilege Le vel Configuration” sectio n o[...]

3-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Controlling Access to Pr ivileged EXEC Commands Figur e 3-4 T ypical T ACA CS+ Networ k Configuration T A CA CS+ administered through the AAA securi ty services can pro vide these services: • Authenticati on—Provides complet[...]

3-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Controlling Access to Privileged EX EC Command s TACACS+ Operation When a user attempts a simple ASCII login b y auth enticating to a switch using T A CA CS+, this process occurs: 1. When the connection is established, the switch c[...]

3-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Controlling Access to Pr ivileged EXEC Commands • Conf iguring T ACA CS+ Authorization for Pri vileged EXEC A ccess and Network Services, page 3-21 • Starting T A CA CS+ Accounting, page 3-21 Default TACACS+ Configuration T [...]

3-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Controlling Access to Privileged EX EC Command s T o remove the specif ied T A CACS+ serv er name or address, use the no tac acs-server host hostname global conf iguration command. T o remov e a server group from th e configur atio[...]

3-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Controlling Access to Pr ivileged EXEC Commands Step 3 aaa authentication login { default | list-name } method1 [ method2... ] Creates a login authenticatio n method list. • T o create a default list that is used when a named [...]

3-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Controlling Access to Privileged EX EC Command s T o disable AAA, use the no aaa new-model global conf iguration command. T o disable AAA authentic ation, use the no aaa authentication login { default | list-name } metho d1 [ metho[...]

3-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Controlling Access to Pr ivileged EXEC Commands T o enable T A CA CS+ accounting for each Cisco IOS pri vilege le vel and for netw ork services, perform this task, be ginning in pri vileged EXEC mode: T o disable accounting, u s[...]

3-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Controlling Access to Privileged EX EC Command s For informatio n on ho w to display the password or access le vel conf iguration, see the “Displaying the Password, Access Lev el , and Privilege Le vel Configuration” sectio n o[...]

3-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Controlling Access to Pr ivileged EXEC Commands Logging In to a Privilege Level T o log in at a speci fied pri vilege le vel, enter this comman d: Exiting a Privilege Level T o exit to a sp ecified privil ege le vel, enter this [...]

3-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Recovering a Lost Enable Pa ssw ord Recovering a Lost Enable Password Note For more information on the configurati on register which is preconf igured in NVRAM, see “Configuring the Software Conf iguration Register” section on [...]

3-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Modifying the Supervisor En gine Startup Configuration Understanding the ROM Monitor The R OM monitor (R OMMON) i s in vok ed at switch bootup, reset, or when a f atal exception occurs. The switch enters R OMMON mo de if the swi[...]

3-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Modifying the Sup erviso r Eng ine Startup Co nfiguration Modifying the Boot Field and Using the boot Command The configuration re gister boot fi eld determines whether the switch loads an op erating system image and, if so, where [...]

3-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Modifying the Supervisor En gine Startup Configuration When the boot f ield is set to eit her 00 or 01 (0-0-0-0 or 0 -0-0-1), the system ignores an y boot instructions in the system co nfigur ation file and the follo wing occurs[...]

3-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Modifying the Sup erviso r Eng ine Startup Co nfiguration Step 2 Enter the conf igure terminal command at the EXEC mode pro mpt (#), as follo w s: Switch# configure terminal Enter configuration commands, one per line. End with CNTL[...]

3-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Modifying the Supervisor En gine Startup Configuration System returned to ROM by reload System image file is "tftp://172.25.60.31/auto/gsg-sw/interim/young/newest_image/ios/dev/cat4500e-entservi ces-mz" Last reload rea[...]

3-31 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Modifying the Sup erviso r Eng ine Startup Co nfiguration Flash Memory Features Flash memory allo ws you to do the follo wing: • Remotely load mult iple system softwar e images through TFTP or RCP transfers (one transfer f or eac[...]

3-32 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Resetting a Switch to F actory Default Settings Image in the Conf iguration File” section in the “Loading and Maintaining System Images and Microcode” chapter of the Config uration Fun damentals Conf igurati on Guide for d[...]

3-33 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 3 Configuri ng the Switch for the First Time Resetting a Switch to Factory D efault Settings When the copying is comp leted, you can reboot the ju st-copied Catalyst 4500 series switch image to the image stored in th e bootflash memory with th e rel o ad command: Switch# relo[...]

3-34 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 3 Config uri ng the Switch fo r the First Time Resetting a Switch to F actory Default Settings[...]

CH A P T E R 4-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 4 Administering the Switch This chapter describes ho w to perform one-time operations t o administer the Catalyst 450 0 Series switch. This chapter also describes how to install and conf igure the Embedd ed CiscoV iew netw ork management system to pro vide a graphical rep[...]

4-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the System Time and Date • Conf iguring NTP , page 4-3 • Conf iguring T ime and Date Manually , page 4-11 System Clock The core of the time service is the system clock, wh ich monitors the date and time. This clock starts when the syst[...]

4-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the System Time and Date Cisco’ s implement ation of NTP does not support st ratum 1 service; it is not possible to connect to a radio or atomic clock. W e recommend that t he time service for your netw ork be deri ved from the public NTP [...]

4-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the System Time and Date • Conf iguring NTP Associations, pa ge 4-6 • Conf iguring NTP Broadcast Service, page 4-7 • Conf iguring NTP Access Restrictions, p age 4-8 • Conf iguring the Source I P Address for NTP Pack ets, page 4-10 [...]

4-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the System Time and Date T o disable NTP authentication, use the no ntp authenticate global conf iguration command. T o remov e an authentication key , us e th e no ntp authentication-key number global conf iguration command. T o disable aut[...]

4-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the System Time and Date Configuring NTP Associations An NTP association can be a peer a ssociation (thi s swit ch ca n e ither synch ron ize to t he o ther device or allo w the other de vice to synchroni ze to it), or it can be a serv er [...]

4-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the System Time and Date Configuring NTP Broadcast Service The communications between devices running NTP (kno w n as associations ) are usually statically confi gured; each de vice is give n the IP addresses of all de vices with which it sh[...]

4-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the System Time and Date T o conf igure the switch to recei ve NTP broadcast pa ck ets from connected peer s, perform this task: T o disable an interface from receiv ing NTP broadcast packets, use the no ntp broadcast cli ent interface con[...]

4-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the System Time and Date Creating an Access Group and Assigning a Ba sic IP Access List T o control access to NTP servic es by using access lists, perform this task: The access group keyw ords are scanned in this or der, fro m least restrict[...]

4-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the System Time and Date T o remove access control to the switch NTP services, use the no ntp access-group { query-only | serv e-only | serve | peer } global con figur ation command. This example sho ws how to conf igure the switch to all[...]

4-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the System Time and Date The specif ied interface is used for the source address for al l packets sent to all destinations. If a source address is to b e used for a sp ecific associatio n, use the source ke ywor d in the ntp peer or ntp ser[...]

4-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the System Time and Date Displaying the Time and Date Configuration T o display the time and date conf iguration, use the show clock [ detail ] pri vileged EXEC command. The system clock keeps an authoritative flag that sho ws whether the[...]

4-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the System Time and Date Configuring Summer Time (Daylight Saving Time) T o conf igu re summer time (d aylig ht sa v ing time) i n areas wher e i t starts and ends on a parti cular day of the week each year, perform this task: The first par[...]

4-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Configuring a System N ame and Prompt If summer time in your area does not f ollo w a recurring pattern (conf igure the e xact date and time of the next summer time e vents), perform this task: The first part of the clock summer -time global confi[...]

4-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Configuring a System Name and Prompt For complete syntax and usage information for t he commands used in this section, see the Cisco IOS Confi gurati on Fundamentals Comm and Refer ence, Release 12.3 and the Cisco IOS IP Command Refer ence, V olume [...]

4-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Configuring a System N ame and Prompt These sections contain this configu ration informatio n: • Default DNS Configuration, page 4-16 • Setting Up DNS, page 4 -16 • Displaying the DNS Conf iguration, page 4-17 Default DNS Configuration T abl[...]

4-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Creating a Banner If you use the switch IP address as its hostname, th e IP address is used and no DNS query occurs. If you confi gure a hostname that contains no periods (.), a period follo wed by the defau lt domain name is appended to th e ho stn[...]

4-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Creating a Banne r Default Banner Configuration The MO TD and login banners are not conf igured. Configuring a Message-of-the-Day Login Banner Y ou can create a single or multiline message banner th at appears on the screen when someone logs in to[...]

4-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the MA C Address Table Configuring a Login Banner Y ou can configure a lo gin ba nner t o be di splayed on all connected terminals. This banner appears after the MO TD banner and before the login prompt. T o conf igure a login banner , perf[...]

4-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the MAC Addr ess Table These sections contain this configu ration informatio n: • Building the Ad dress T able, page 4-20 • MA C Addre sses and VLAN s, page 4-20 • Defa ult MA C Address T able Conf iguration, page 4-21 • Changing [...]

4-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the MA C Address Table When PVLANs are conf igured, address learning depends on the ty pe of MA C address: • Dynamic MA C addresses learned in one VLAN of a PVLAN are replicated in the associated VLANs. For example, a MA C address le arne[...]

4-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the MAC Addr ess Table Removing Dynamic Address Entries T o remov e all dynamic entries, use the cl ear mac address-table dynamic command in EXEC mo de. Y ou can als o remov e a specific MA C address ( clear mac address-table dynamic addr[...]

4-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the MA C Address Table Step 3 snmp-server enable traps mac-notification change Enables the switch to send MA C change traps to the NMS. T o disable the switch from sending MA C change notif ication traps, use the no snmp-server enable traps[...]

4-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the MAC Addr ess Table This example shows ho w to specify 172.69.59 .93 as the network manag ement system, enable th e switch to send MA C change notif ication traps to the ne tw ork management system, enable the MA C change notif ication[...]

4-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the MA C Address Table T o conf igure MA C move not ificat ion, perform this task: This examp le sho ws ho w to specify 172.69.5 9.93 as the netw ork management system, enable the sw itch to send MA C mov e notification traps to the NMS, en[...]

4-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the MAC Addr ess Table Configuring MAC Threshold Notification Traps When you conf igure MA C threshold notif ication, an SNMP notificatio n is generated and sent to the network management system when a MA C address tabl e (MA T) threshold[...]

4-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the MA C Address Table This ex ample sho ws ho w to specify 172.69 .59.93 as the network management system, enable the MA C threshold notif ication feature, enable the switch to send MA C threshold notification t raps to the NMS, set the in[...]

4-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the MAC Addr ess Table T o add a static address, perform this task: This exampl e show s how to add the static address c2f3.22 0a.12f4 to the MA C address table. When a packet is recei ved in VLAN 4 with this MA C address as its destinati[...]

4-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the MA C Address Table • If you add a unicast MA C address as a static addres s an d configure un icast MA C address filtering, the switch either adds the MA C address as a stat ic address or drops pack ets with that MA C address, dependi[...]

4-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the MAC Addr ess Table Disabling MAC Address Learning on a VLAN By default, MA C address learning is en abled on all VLANs on the switch. By controlli ng which VLANs can learn MA C addresses, you can manage the av aila ble MA C address ta[...]

4-31 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the MA C Address Table Usage Guidelines Note These guidelines are advisory only . Contact the Cisco solution p rovider team fo r specific solutio n implementa tions. When disabling MA C address learning on a VLAN, consid er these guidelines[...]

4-32 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the MAC Addr ess Table Figur e 4-2 Disabling MAC A ddress Lear ning: Point-t o -P oint Links Network Load Bala ncers In this topology , you ha ve tw o devices, one acti ve and one standb y . T o perform load balancing, both devices must r[...]

4-33 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the MA C Address Table Layer 2 Firewall or Cache In this topolog y , a rewritten Layer 3 pack et is routed back to a Layer 2 f ire wall (or cache) before exiti ng. When the packet reenters the swit ch from the fire wall, it possesses the sw[...]

4-34 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Managing the MAC Addr ess Table Feature Incompatibility The follo wing features are incompati ble with disabling MA C address learning and do not work properly when the feature is enabled: • 802.1X—The 802.1X class of features does not wo rk w[...]

4-35 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Managing the ARP Table Displaying Address Table Entries Y ou can display the MA C address table by usin g one or more of the p rivil eged EXEC commands described in T able 4-4 . Managing the ARP Table T o communicate with a de vice (ov er Ethernet, [...]

4-36 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Configuring Embedde d CiscoView Supp ort These sections describe the Embedded CiscoV iew suppor t av ailable with Cisco IOS Release 12.1(20)EW and later releases: • Understanding Embedded Ci scoV iew , page 4-36 • Installing an d Config uring [...]

4-37 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Configuring Embedd ed CiscoView Support The follo wing example sho ws how to instal l and configur e Embedded CiscoV iew on your switch: Switch# dir Directory of bootflash:/ Directory of bootflash:/ 1 -rw- 9572396 Dec 30 2002 01:05:01 +00:00 cat4000[...]

4-38 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Configuring Embedde d CiscoView Supp ort Switch# Switch# archive tar /xtract Cat4000IOS.v5-1.tar /cv extracting Cat4000IOS-5.1.sgz (1956591 bytes) extracting Cat4000IOS-5.1_ace.html (7263 bytes) extracting Cat4000IOS-5.1_error.html (410 bytes) ext[...]

4-39 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 4 Administering the Switch Configuring Embedd ed CiscoView Support For more information about web access to the swit ch, refer to the “Using the Cisco W eb Bro w ser” chapter in the Cisco IOS Conf iguration Fundam entals Conf iguration Guide at this URL: http://www .cisco[...]

4-40 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 4 Administerin g the Switch Configuring Embedde d CiscoView Supp ort[...]

CH A P T E R 5-1 Software Configuration Guide—Release 15(02)SG OL-23818-01 5 Configuring the Cisco IOS In-Service Software Upgrade Process Note Starting with Cisco IOS 12.2(3 1)SG A, ISSU is supported on the Catalyst 4500. All line cards are supported. Operating on redundant systems, the I n-Service Software Upgrade (ISS U) process allo ws Cisco [...]

5-2 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Prerequisites to Perfor ming ISSU Prerequisites to Performing ISSU Before performing ISSU, you need to meet these prerequisites: • Image type of the existi ng and target image must match. F or examp le, you ca[...]

5-3 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process About ISSU About ISSU Note Do not make an y hardware changes while p erforming ISSU. Before you perform ISSU, yo u should understand the follo wing concepts: • Stateful Switchover Overvie w , page 5-3 • NSF Ov[...]

5-4 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process About ISSU Figur e 5-1 Cisco NSF with SSO Networ k Deployment: Service Pr ovider N etwor ks Additional le vels of a vailability may b e g ained by depl o ying Cisco NSF with SSO at other points in t he network w[...]

5-5 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process About ISSU Figur e 5-2 Cisco NSF with SSO Networ k Deployment: Ent er prise Netw orks NSF Overview Cisco NSF works with the SSO feature in Cisco IOS so ftware. SSO is a pr erequisi te of Cisco NSF . NSF works with[...]

5-6 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process About ISSU ISSU Process Overview The ISSU process allow s you to perform a Cisco IOS software upgr ade or do wngrade while the system continues to forward packets. (F or an illustration of the command s used dur[...]

5-7 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process About ISSU An ISSU-capable switch consists of two super visor engines (acti ve and standby) and on e or more line cards. Before initiating th e ISSU process, copy the Cisco IOS software into th e f ile systems of [...]

5-8 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process About ISSU After you ha ve copied the Cisco I OS software to both f ile systems, load the new v ersion of Cisco IOS software onto t he standby supervisor eng ine (see Figure 5-5 ). Note W ithout the ISSU feature[...]

5-9 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process About ISSU After a switchov er (NSF or SSO, not RPR), the standb y supervisor engine t akes ov er as the new acti ve supervisor engine (see Figur e 5-6 ). Figur e 5-6 Switch Ov er to Standb y Supervisor Engine Lin[...]

5-10 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process About ISSU The former activ e supervisor engine is loaded with an old Cisco IOS image so that if the ne w activ e supervisor engine e xperiences problems, you can ab ort and conduct a switcho ver to the former [...]

5-11 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process About ISSU Figur e 5-8 Steps Dur ing the ISSU Process Performing an ISSU Upgrade: 2 Methods There are two ways to perform an ISSU upgrade: manu ally , with four commands; or automatically , with one command. The [...]

5-12 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process About ISSU Changeversion Process The issu changev ersion command launches a single-step complete ISSU upgrade c ycle. It performs the logic for all four of the standard commands ( issu loadversion , issu run ve[...]

5-13 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process About ISSU Changeversion Deploy ment Scenario The typical issu changeversion command usage scenario is for experi enced users with a large installed base. These users typicall y validate a new image using a top o[...]

5-14 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process About ISSU ISSU requires additional infor mation to deter mine co mpatibility between softwa re versions. A compatibility matr ix is defi ned, containing info rmation about other images relati ve to the one in [...]

5-15 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process SNMP Support for ISSU SNMP for SSO pro vides a mechanism for synchronizing t he SNMP configurati ons and the MIBs that support SSO from the acti ve supervisor engine to the standby sup[...]

5-16 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process Verifying the ISSU Software Installation During the ISSU process, fiv e vali d states exist: disabled, init, load version, r un version, and system reset. Use the show issu state com[...]

5-17 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process Maintenance Mode = Disabled Manual Swact = enabled Communications = Up client count = 39 client_notification_TMR = 240000 milliseconds keep_alive TMR = 9000 milliseconds keep_alive cou[...]

5-18 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process ISSU State = Init Boot Variable = bootflash:old_image,1; Operating Mode = Stateful Switchover Primary Version = N/A Secondary Version = N/A Current Version = bootflash:old_image Slot[...]

5-19 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process • Ensure the system (both activ e and standby superv isor engines) is in SSO redundancy mode. If the system is in RPR mode rather than SSO mode, yo u can still upgrade the system usi[...]

5-20 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process Slot = 2 RP State = Standby ISSU State = Load Version Boot Variable = bootflash:new_image,12;bootflash:old_image,12 Operating Mode = Stateful Switchover Primary Version = bootflash:o[...]

5-21 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process The follo wing example sho ws the redundancy mode as RPR: Switch# show redundancy states my state = 13 -ACTIVE peer state = 4 -STANDBY COLD Mode = Duplex Unit = Primary Unit ID = 1 Red[...]

5-22 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process A switchover occurs at this point. At the new acti ve supervisor engi ne, after old act i ve supervisor eng ine comes up as the standby engine, do the follo wing: Switch# show issu s[...]

5-23 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process Hardware Mode = Duplex Configured Redundancy Mode = Stateful Switchover Operating Redundancy Mode = Stateful Switchover Maintenance Mode = Disabled Communications = Up Current Processo[...]

5-24 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process This exampl e displays the timer before you stop it. In the follo wing example, the Automatic Rollback T ime information indicates the amount of time remai ning before an automat ic [...]

5-25 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process This example shows how to reset and re load the cur rent standby supervis or engine (slot 1) wi th the new Cisco IOS software v ersion. After entering the commitversion command, the st[...]

5-26 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process Image Version = Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500-ENTSERVICES-M), Version 12.2(31)SGA, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/tech[...]

5-27 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process Perform the follo wing steps at the activ e supervisor engine: This examp le sho ws ho w to initiate an ISSU upgr ade pro cess using the issu ch ange version command on slot number 5, [...]

5-28 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process Slot = 6 RP State = Standby ISSU State = Init Operating Mode = Stateful Switchover Current Image = bootflash:x.bin Pre-ISSU (Original) Image = N/A Post-ISSU (Targeted) Image = N/A Sw[...]

5-29 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process *Feb 25 20:41:03.639: %INSTALLER-7-ISSU_OP_SUCC: iss u changeversion successfully executed 'issu runversion' Note Switchov er occurs. ...... ...... Look at the console of &qu[...]

5-30 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process Current Software state = ACTIVE Uptime in current state = 9 minutes Image Version = Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Ve[...]

5-31 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process Current Software state = ACTIVE Uptime in current state = 9 minutes Image Version = Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Vers[...]

5-32 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process If you abort the process after you enter the issu loadv ersion command, the standb y supervisor engine is reset and reloaded with the orig inal software. If the process is abort ed a[...]

5-33 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process Entering th e issu commitversion comman d at this stage is equal to entering both the issu acceptversion and the issu c om m itversion commands. Use the issu commitversion command if y[...]

5-34 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# issu set rollback-timer 20 % ISSU state should be [ init ] to set the rollback[...]

5-35 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process 2010 1 262171 32 1 COMPATIBLE 2012 1 262180 31 1 COMPATIBLE 2021 1 262170 41 1 COMPATIBLE 2022 1 262152 42 1 COMPATIBLE 2023 1 - - - UNAVAILABLE 2024 1 - - - UNAVAILABLE 2025 1 - - - U[...]

5-36 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process 2059 1 1 262179 30 1 Y 2067 1 1 262153 12 1 Y 2068 1 1 196638 40 1 Y 2070 1 1 262145 21 1 Y 2071 1 1 262178 11 1 Y 2072 1 1 262162 28 1 Y 2073 1 1 262177 33 1 Y 2077 1 1 262165 35 1 [...]

5-37 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Performing the ISSU Process 2084 ISSU IGMP Snooping clientNon-Base 4001 ISSU C4K Chassis client Base 4002 ISSU C4K Port client Base 4003 ISSU C4K Rkios client Base 4004 ISSU C4K HostMan client Base 4005 ISSU C4k [...]

5-38 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Performing the ISSU Process This exampl e show s how to disp lay negotiated i nformation reg arding the compatibility matrix : Switch> enable Switch# show issu comp-matrix negotiated CardType: WS-C4507R-E(18[...]

5-39 Software Configuration Guide—Release 15(02)SG OL-23818-01 Chapter 5 Configuring the Cisco IOS In-Service Software Up grade Process Related Documents This exampl e show s how to disp lay stored information re garding the compatibility matrix : Switch# show issu comp-matrix stored Number of Matrices in Table = 1 (1) Matrix for cat4500e-ENTSERV[...]

5-40 Software Configuration Guide—Rele ase 15(02)SG OL-23818-01 Chapter 5 Configur ing the Cisco IOS In-Service Softw are Upgrade Process Related Documents[...]

CH A P T E R 6-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 6 Configuring Interfaces This chapter describes ho w to configure i nterfaces for the Catalyst 4500 series sw itches. It also provides guidelines, proced ures, and configu ration examp les. This chapter includ es the follo w ing major sections: • About Interf ace Conf i[...]

6-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces About Interface Configuration About Interface Configuration By default, all interfaces are enabled. The 10/100-Mbps Ethernet interf aces autonegotiate connection speed and duplex . The 10/100/1000-Mbps Ethernet inte rfaces negotiate speed, duple x, [...]

6-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Using the interface Command Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets[...]

6-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Configuring a Ra nge of Interfaces Step 4 T o begi n conf iguring F ast Ethernet interf ace 5/5, as sho wn in the follow ing example, enter the interfac e ke yword, interf ace type, slot number , and interface nu mber in global conf iguration mode: [...]

6-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Configuring a Range of Interfaces Note The interface range co mmand wor ks only wi th VLAN interfaces that have been configured with the interface vlan command (the show running-conf iguration command displays the conf igured VLAN interfaces). VLAN int[...]

6-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Using the Etherne t Management Port Using the Ethernet Management Port This section has this in formati on: • Understanding the Et hernet Management Port, page 6-6 • Supported Features on the Ethern et Management Port, page 6-9 • Conf iguring [...]

6-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Using the Ethernet Mana gemen t Port Figure 6-2 Networ k with Routi ng Prot ocols Enable d The specific implementation of Ethernet manageme nt port depend s on the redundancy mod el you are applying. For detai ls on config uring SSO and ISSU, refer to [...]

6-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Using the Etherne t Management Port • T elnet, pa ge 6-8 • TFTP , page 6-8 • FTP , page 6-9 • SSH, page 6-9 Note Command usage specifi c to the mgmtVrf are mentioned belo w . The additional conf iguration that is necessary to make the featur[...]

6-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Using the Ethernet Mana gemen t Port FTP If you want t o use an Fa1 port for an FTP op eration, conf igure the Fa1 port as the so urce interface for FTP as follo ws: Switch(config)# ip ftp source-interface fastEthernet1 SSH If you want i nitiate SSH fr[...]

6-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Defining and U sing Interface-Ran ge Macros • Secure Shell (SSH) • DHCP-based autoconf iguration • SNMP (only the ENTITY -MIB and the IF-MIB) • IP ping • Interface features – Speed—10 Mb/s, 100 Mb /s, 1000Mb/s, and autone gotiation ?[...]

6-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Deploying SFP+ in X2 Ports T o define an in terface-rang e macro, en ter this command: This exampl e show s how to def ine an interface-range macro named enet_list to select F ast Ethernet interfaces 5/1 t hrough 5/4: Switch(config)# define interface-[...]

6-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Deploying 10-Gigabit E thernet and Gigabit Ethernet SFP Ports on Supe rvisor Engine V-10GE T o use an SFP+ in an X2 port to obtain 10-Gigabit Et hernet bandwi dth, the Cata lyst 4500 series switch supports OneX Con vertor modules. When you plug a O[...]

6-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Deploying 10-Gigabit Ethernet o r Gigab it Etherne t Po rts on Supervisor Engine 6-E , Supervisor Engine 6L-E and with the ne w uplink mode into flash memory , the uplink mode must be changed to t he ne w uplink mode through the command interf ace bef[...]

6-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Deploying 10-Gigabit E thernet or Gigabit Ethe rnet Ports on Su pervisor Engine 6-E, Sup ervisor Engine 6L-E and In Cisco IOS, ports 1 th rough 18 alw ays exist. This mean s that you can apply conf igurations on them and they d isplay in the CLI ou[...]

6-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Deploying 10-Gigabit Ethernet o r Gigab it Etherne t Po rts on Supervisor Engine 6-E , Supervisor Engine 6L-E and Te1/1 notconnect 1 full 10G 10GBase-LR Te1/2 connected 1 full 10G 10GBase-LR Te1/3 notconnect 1 full 10G No X2 Te1/4 notconnect 1 full 10[...]

6-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Invoking Shared-Bac kplane Uplink Mode on Supervisor Engine 6- E Gi1/13 inactive 1 full 1000 No Gbic Gi1/14 inactive 1 full 1000 No Gbic Gi1/15 inactive 1 full 1000 No Gbic Gi1/16 inactive 1 full 1000 No Gbic Gi1/17 inactive 1 full 1000 No Gbic Gi1[...]

6-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Configuring Optional Interface Feature s Note This featur e is only av ai lable when a DOM ca pable transceiv er is present and configured for monito ring. The frequenc y at which the sensor informatio n is re freshed depends on default v alues config[...]

6-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Configuring Optio na l Interfa ce Featu res • If the interface speed is set to 10 or 100 , the duple x mode is set to half duplex b y d ef aul t unless you expli citly conf igure it. Caution Changing the interf ace speed and duplex mode conf igur[...]

6-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Configuring Optional Interface Feature s T o restore autone gotiation, enter the no speed nonegotiate command in the int erface conf iguration mode. Note For the blockin g ports on the WS-X4416 modul e, do not set the speed to autone gotiate. Setting [...]

6-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Configuring Optio na l Interfa ce Featu res 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 input packets with dribble condition detected 1456 packets output, 111609 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babb[...]

6-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Configuring Optional Interface Feature s T o conf igure flo w control, perform this task: This exampl e show s how to conf igure flo w control on an o versubscribed Gigabit Ethernet port 7/5: Switch# configure terminal Switch(config)# interface g7/5 S[...]

6-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Configuring Optio na l Interfa ce Featu res Duplex: full Trunk encap. type: 802.1Q,ISL Trunk mode: on,off,desirable,nonegotiate Channel: yes Broadcast suppression: percentage(0-100), hw Flowcontrol: rx-(off,on,desired),tx-(off,on,desired) VLAN Memb[...]

6-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Configuring Optional Interface Feature s Configuring Jumbo Frame Support These sections describe jumbo frame support: • Ports and Modules That Supp ort Jumbo Frames, page 6-23 • Jumbo Frame Support, page 6-23 • Conf iguring MTU Sizes, page 6-25 [...]

6-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Configuring Optio na l Interfa ce Featu res If the maximum limit of 32 is reached and an attempt is made to configure a ne w MTU size on a new interface, the system only all ows configu ration to proceed if the ne w MTU size has previou sly been co[...]

6-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Configuring Optional Interface Feature s Layer 3 and Layer 2 EtherChannels Starting with Release Cisco IOS Release 12.2(25) EW, you can configure all the interfaces in an EtherChannel pro vided that the y hav e the same MTU. Changing the MTU of an Eth[...]

6-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Configuring Optio na l Interfa ce Featu res This exampl e shows ho w to conf igure the MTU size on Gigabit Ethernet port 1/1: switch# conf terminal switch(config)# interface gi1/1 switch(config-if)# mtu 9198 switch(config-if)# end switch(config)# e[...]

6-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Configuring Optional Interface Feature s Note The default time i s 10ms for E-series supervisor engi nes and line cards (incl uding Catalyst 4900M, Catalyst 4948-E, Superv isor Engine 6-E, and Supe rvior Engine 6L-E). A ll other supervisor engines use[...]

6-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Configuring Optio na l Interfa ce Featu res Note The follo wing line cards support Auto -MDIX by def ault, when port auto -negotiatio n is enabled: WS-X4424-GB-RJ45, WS-X4448- GB-RJ45,WS-X4548- GB-RJ45 and WS-X4412-2GB-T . Y ou cannot disable them [...]

6-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Configuring Optional Interface Feature s Switch(config-if)# end Displaying the Interface Auto-MDIX Configuration T o display the interf ace speed and duplex mode conf iguration for an interface, perform t his task: Depending on how the speed auto and [...]

6-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Understanding Online Insertion and Removal 0 input packets with dribble condition detected 3552 packets output, 269088 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collision, 0 deferred 1 lost carrier, 0 no[...]

6-31 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Monitoring and Main taining the In terface T o display informat ion about the interf ace, enter one of the follo wing commands: This exampl e show s how to disp lay the st atus of Fast Ethernet interf ac e 5/5: Switch# show protocols fastethernet 5/5 [...]

6-32 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Monitoring and Main taining the Interface T o shut down an interface and then restart it, perform this task: This exampl e shows ho w to shut do wn Fast Eth ernet interface 5/5: Switch(config)# interface fastethernet 5/5 Switch(config-if)# shutdown[...]

6-33 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Monitoring and Main taining the In terface Configuring Link Status Event Notification for an Interface T o enable or disable a link status logging e vent, enter one of the follo wing commands: Global Settings Y ou can also provide a glob al configurat[...]

6-34 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Monitoring and Main taining the Interface The follo wing exampl e displays the conf iguration and logging message output for link status and trunk status loggin g ev ents: // // The global link status and trunk status logging events are enabled. //[...]

6-35 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 6 Configuring Interfaces Monitoring and Main taining the In terface This command clears all the configurat i ons and shut do wn the interface: Switch# show run interface fastethernet 3/5 Building configuration... Current configuration : 58 bytes ! interface FastEthernet3/5 no[...]

6-36 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 6 Config uring Inter faces Monitoring and Main taining the Interface[...]

CH A P T E R 7-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 7 Checking Port Stat us and Connectivity This chapter describes how to check switch port stat us and connecti vity on the Catalyst 4500 series switch. This chapter includ es the follo w ing major sections: • Checking Module Status, page 7-1 • Checking Interfaces Statu[...]

7-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 7 Check in g Port Status and Connectivity Checking Interfaces Status This exampl e show s how to ch eck module status for all modules on your switch: Switch# show module all Mod Ports Card Type Model Serial No. ----+-----+--------------------------------------+---------------[...]

7-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 7 Checking Port Status and Connec tivity Displaying MAC Addresses Displaying MAC Addresses In addition to displaying the MA C address range for a module u sing the show module command , you can display the MA C address table in formation of a specif ic MA C addre ss or a speci[...]

7-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 7 Check in g Port Status and Connectivity Checking Cable Status U si ng Time Domain Reflectometer Note Four pair s of standard cate gory 5 cable exist. Each pair can assume one of the follo wing states: open (not connected), brok en, shorted, or terminated. The TDR test detec[...]

7-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 7 Checking Port Status and Connec tivity Using Telnet Note After this command is deprecated, use the diagnostic star t and the show diagnostic re sult commands to run the TDR test an d display the test results. Note TDR is a port test; the port cannot handle traff ic for the d[...]

7-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 7 Check in g Port Status and Connectivity Changing the Logout Timer This example sh ows ho w to establish a T elnet connection from the switch to t he remote host named labsparc: Switch# telnet labsparc Trying 172.16.10.3... Connected to labsparc. Escape character is '^][...]

7-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 7 Checking Port Status and Connec tivity Using Ping 2 vty 1 00:00:00 3 vty 2 00:00:00 4 vty 3 00:00:00 5 vty 4 00:00:00 Interface User Mode Idle Peer Address Switch# T o disconnect an activ e user session, enter this command: This example sh ows ho w to disconnect an acti ve c[...]

7-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 7 Check in g Port Status and Connectivity Using IP Traceroute Running Ping T o ping another de vice on the network from the swit ch, enter this command in normal ex ecutive and pri vileged EXEC mod e: This example sh ows ho w to ping a remote host from normal e xecuti ve mode[...]

7-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 7 Checking Port Status and Connec tivity Using Layer 2 Traceroute drops the datagram and sends b ack an Internet Control Messag e Protocol (ICMP) Time-Exceeded message to the sender . Traceroute determines the address of th e first hop b y examining the source address field of[...]

7-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 7 Check in g Port Status and Connectivity Using Layer 2 Traceroute These sections describe ho w to us e the Layer 2 traceroute feature : • Layer 2 T raceroute Usage Guidelines, page 7-10 • Running Layer 2 T raceroute, page 7-11 Layer 2 Traceroute Usage Guidelines These a[...]

7-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 7 Checking Port Status and Connec tivity Configuring ICMP Running Layer 2 Traceroute T o display the physical path that a pack et takes from a sour ce de vice to a desti nation de vice, ent er either one of these commands: or These examples sho w how to use the traceroute mac[...]

7-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 7 Check in g Port Status and Connectivity Configuring ICMP Enabling ICMP Protocol Unreachable Messages If the Cisco IOS softwa re receiv es a nonbroadcast packet that uses an unkno wn protocol, it sends an ICMP Protocol Unreachable message back to t he source. Similarly , if[...]

7-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 7 Checking Port Status and Connec tivity Configuring ICMP T o enable the sending of ICMP Redirect messages if the Cisco IOS software is fo rced to resend a packet through th e same inte rface on whi ch it was rec e i ved, enter the foll owin g command in interface confi gurat[...]

7-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 7 Check in g Port Status and Connectivity Configuring ICMP[...]

CH A P T E R 8-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 8 Configuring Supervisor Engine Redundancy Using RPR and SSO Catalyst 4500 series switche s allow a redundant superviso r engine to take over if the activ e supervisor engine fails. In softw are, supervisor engine redunda nc y is enabled by running th e redundant supervis[...]

8-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 8 Configuring Supervi sor Engine Redundancy Using RPR and SSO About Supervisor Engine Re du ndancy About Supervisor Engine Redundancy These sections describe supervisor engine red undancy: • Overvie w , pa ge 8-2 • RPR Operation, page 8-3 • SSO Operation, page 8-3 Overv[...]

8-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 8 Configuring Superv isor Engine Redunda ncy Using RPR and SSO About Supervisor Engine Red und ancy RPR Operation RPR is supported in Cisco IO S Release 12.2(12c)EW and l ater releases. Wh en a redundant superv isor engine runs in RPR mode, it start s up in a partially-initial[...]

8-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 8 Configuring Supervi sor Engine Redundancy Using RPR and SSO About Supervisor Engine Re dundancy Synchronizatio n • 802.1D (Spanning T ree Protocol) • 802.3af (Inline p ower) • PA g P • VTP • Dynamic ARP Inspection • DHCP snoopin g • IP source guard • IGMP sn[...]

8-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 8 Configuring Superv isor Engine Redunda ncy Using RPR and SSO Supervisor Engine Redun dan cy Guidelines and Restrictions Note Y ou cannot enter CLI co mmands on the redundant su pervisor engine console. These sections describe supervisor engine redund ancy synchronization: ?[...]

8-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 8 Configuring Supervi sor Engine Redundancy Using RPR and SSO Supervisor Engine Redun dancy Guideline s and Restric tions C4K_REDUND ANCY -2-IOS_ VERSION_CHECK_F AIL and ISSU-3-PEER_IMA GE_INCOMP A TIBLE messages to app ear because the peer image is listed as incompatible. If[...]

8-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 8 Configuring Superv isor Engine Redunda ncy Using RPR and SSO Supervisor Engine Redun dan cy Guidelines and Restrictions • In Cisco IOS Release 12.2(25)SG and lat er releases, when using a Supervisor En gine V -10GE (WS-X4516-10GE) on a Catalyst 4510 R series sw itch, you c[...]

8-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 8 Configuring Supervi sor Engine Redundancy Using RPR and SSO Configuring Supe rvisor Engine Redunda ncy • Conf iguration changes made t o the redundant supe rvisor engi ne through SNMP synchron ization and SNMP set operations in SSO mode are n ot synchron ized to the redun[...]

8-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 8 Configuring Superv isor Engine Redunda ncy Using RPR and SSO Configuring Supervisor En gine Red undancy This exampl e shows ho w to configu re the system for SSO and display the redu ndancy f acility inform ation: Switch> enable Switch# configure terminal Enter configurat[...]

8-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 8 Configuring Supervi sor Engine Redundancy Using RPR and SSO Configuring Supe rvisor Engine Redunda ncy Manual Swact = enabled Communications = Up client count = 21 client_notification_TMR = 240000 milliseconds keep_alive TMR = 9000 milliseconds keep_alive count = 0 keep_al[...]

8-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 8 Configuring Superv isor Engine Redunda ncy Using RPR and SSO Configuring Supervisor En gine Red undancy Y ou exit the virtual console wi th the exit or quit commands. When the inacti vity period of the ter minal on the acti ve supervisor engine where you logged in exceeds t[...]

8-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 8 Configuring Supervi sor Engine Redundancy Using RPR and SSO Configuring Supe rvisor Engine Redunda ncy Note Configurati on changes made to the acti ve supervisor engine through SNMP are n ot syn c hron ized to the redundant superviso r engine. For in formation on ho w to h[...]

8-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 8 Configuring Superv isor Engine Redunda ncy Using RPR and SSO Performing a Manual Switchover Performing a Manual Switchover This section descri bes how to perform a manual switchov er (from the acti ve supervisor eng ine to the redundant superviso r engine) for test purpos e[...]

8-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 8 Configuring Supervi sor Engine Redundancy Using RPR and SSO Performing a So ftwa re Upgrade The follo wing scenario is not supported: An acti ve supervisor engine running Cisco IOS Release 12.1(x)E, and a standb y supervisor engine runn ing Cisclo IOS Release 12.2(x)S. The[...]

8-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 8 Configuring Superv isor Engine Redunda ncy Using RPR and SSO Manipula ting Bootflash on the Redun dan t Supervisor Engine Switch(config)# redundancy Switch(config-red)# main-cpu Switch(config-r-mc)# auto-syn standard Switch(config-r-mc)# end Switch# copy running-config star[...]

8-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 8 Configuring Supervi sor Engine Redundancy Using RPR and SSO Manipulating Bootflash on the Redundant Supe rvisor Engine Switch# format slaveslot0: or Switch# format slavebootflash: Form at s th e slot0: device on the redundant supervisor engine. Form at s t he bootflash: de[...]

CH A P T E R 9-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 9 Configuring Cisco NSF with SSO Supervisor Engine Redundancy This chapter describes h ow to confi gure supervisor engin e redundancy using Cisco nonst op forwarding (NSF) with stateful switchover (SSO). Note Starting with Cisco IOS Release 12.2 (52)SG, the Catalyst 4500 [...]

9-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 9 Configurin g Cisco NS F with SSO Supervisor Engine Redu ndancy About NSF with SSO Supe rvisor Engine Redu ndancy • Routing Protocol s, page 9-5 • NSF Guidelines and Restrictions, page 9-9 About Cisco IOS NSF-Awar e and NSF-Capable Support Cisco IOS Nonstop F orwarding ([...]

9-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 9 Configuring Cisco NS F with SSO Supervisor Engine Redundancy About NSF with SSO Supervisor En gine Red undancy T able 9-1 lists t he supervisor engines and Catalyst 4 500 seri es switches that support NSF- awar eness: Starting with Cisco IOS Rel ease 12.2(20)EW A, the Cataly[...]

9-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 9 Configurin g Cisco NS F with SSO Supervisor Engine Redu ndancy About NSF with SSO Supe rvisor Engine Redu ndancy NSF with SSO Supervisor Engine Redundancy Overview Catalyst 45 00 series switches support fault r esistance b y allo wi ng a redundant supervisor engin e to take[...]

9-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 9 Configuring Cisco NS F with SSO Supervisor Engine Redundancy About NSF with SSO Supervisor En gine Red undancy NSF Operation NSF always runs with SSO and pro v ides redundancy for Layer 3 traf fi c. NSF is supported by the BGP , OSPF , IS-IS, and EIGRP routing protocols and [...]

9-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 9 Configurin g Cisco NS F with SSO Supervisor Engine Redu ndancy About NSF with SSO Supe rvisor Engine Redu ndancy help reb uild the routing tables. Alt ernately , the IS-IS protocol can be confi gured to synchronize state information fro m the acti ve to the red undant super[...]

9-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 9 Configuring Cisco NS F with SSO Supervisor Engine Redundancy About NSF with SSO Supervisor En gine Red undancy OSPF Operation When an OSPF NSF-capable router performs a superv i sor engine switchov er , it must perform the follo wing tasks in order to resy nchronize its link[...]

9-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 9 Configurin g Cisco NS F with SSO Supervisor Engine Redu ndancy About NSF with SSO Supe rvisor Engine Redu ndancy IETF IS-IS Configuration As quickly as possible after a supervisor engine switchov er, the NSF-capable router sends IS-I S NSF restart requests to neighborin g N[...]

9-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 9 Configuring Cisco NS F with SSO Supervisor Engine Redundancy About NSF with SSO Supervisor En gine Red undancy quickly notif ied of the NSF restart. W i thout seeing the RS bit, the neig hbor can only detect an adjacenc y reset by recei ving a n INIT update or by the expira [...]

9-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 9 Configurin g Cisco NS F with SSO Supervisor Engine Redu ndancy Configuring NSF with SSO Supervisor Engin e Re dundancy • All OSPF networking de vices on the same network segment must be NSF-aw are (running an NSF software image). • F or IETF IS-IS, all neighboring de v[...]

9-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 9 Configuring Cisco NS F with SSO Supervisor Engine Redundancy Configuring NSF with SSO Supervisor Engine Redund ancy Switch(config-red)# mode sso Switch(config-red)# end Switch# show redundancy states my state = 13 -ACTIVE peer state = 8 -STANDBY HOT Mode = Duplex Unit = Pri[...]

9-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 9 Configurin g Cisco NS F with SSO Supervisor Engine Redu ndancy Configuring NSF with SSO Supervisor Engin e Re dundancy Configuring BGP NSF Note Y ou m ust configure BGP graceful restart on all peer devi ces participating in BGP NSF . T o configure BGP for NSF , perform thi[...]

9-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 9 Configuring Cisco NS F with SSO Supervisor Engine Redundancy Configuring NSF with SSO Supervisor Engine Redund ancy Step 3 On the SSO de vice and the neighbor de vice, verify that the graceful rest art function is sho wn as both advertised and recei ved, and confirm the add[...]

9-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 9 Configurin g Cisco NS F with SSO Supervisor Engine Redu ndancy Configuring NSF with SSO Supervisor Engin e Re dundancy nsf network 192.168.20.0 0.0.0.255 area 0 network 192.168.30.0 0.0.0.255 area 1 network 192.168.40.0 0.0.0.255 area 2 . . . Step 2 Enter the show ip ospf [...]

9-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 9 Configuring Cisco NS F with SSO Supervisor Engine Redundancy Configuring NSF with SSO Supervisor Engine Redund ancy Verifying IS-IS NSF T o verif y IS-IS NSF , you must check that the NSF function is conf igured on the SSO- e nabled netw orking device. T o v erify IS-IS NSF[...]

9-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 9 Configurin g Cisco NS F with SSO Supervisor Engine Redu ndancy Configuring NSF with SSO Supervisor Engin e Re dundancy Step 3 If the NSF conf i gurat ion is set to ietf , enter the show isis nsf command to v erify that NSF is enabled o n the de vice. The follo wing display[...]

9-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 9 Configuring Cisco NS F with SSO Supervisor Engine Redundancy Configuring NSF with SSO Supervisor Engine Redund ancy Configuring EIGRP NSF T o conf igure EIGRP NSF , perform this task: Verifying EIGRP NSF T o verify EIGRP NSF , you must check that the NSF function is conf ig[...]

9-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 9 Configurin g Cisco NS F with SSO Supervisor Engine Redu ndancy Configuring NSF with SSO Supervisor Engin e Re dundancy[...]

CH A P T E R 10-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 10 Environmental Monitoring and Power Management Note Before reading this chapter , read the “Preparing for In stallation” section of the Catalyst 4500 Series Installati on Guide . It is important to ensu re that your installation si te has enough po wer and cooling [...]

10-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment About Environmental Monito rin g En vironmental monitoring of chassis components pro vides early warning indications of possible component failure. This w arning helps you to ensure the safe and reliable operation of yo ur [...]

10-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement About Environmental Monitoring Conditions on Supervisor Engi ne 6-E and Supervisor Engine 6L-E Supervisor Engine 6-E, Supervisor Engine 6L-E, and its associated line cards suppor t multiple temperature sensors per c ard. The e[...]

10-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment About Environmental Monito rin g In Case 4, the stan dby supervisor eng ine takes ov e r wh en the active engine resets itsel f. If the temperat ure emer gency re mains, the ne wly acti ve s upervisor engine resets t he sta[...]

10-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement About Environmental Monitoring When the system issues a major alarm, it starts a timer whose duration depends on the alarm. If the alarm is not canceled before the timer e xpires, the system takes emer gency action to pr otect[...]

10-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment Power Management Power Management This section describes the po wer management feature in the Catalyst 4500 series swi tches. It includes the following topics: • Po wer Management for the Catalyst 4500 Series Switches, pa[...]

10-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement Power Management Supported Power Supplies Y ou can select from sev eral different po wer supplies to ensure that you hav e enough power for the modules installed in your switch. Note Y ou should select a powe r supply based on[...]

10-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment Power Management The follo wing example sho ws the output for the show po wer command for mixed po wer supplies: Switch# show power Power Fan Inline Supply Model No Type Status Sensor Status ------ ---------------- --------[...]

10-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement Power Management Y our swi tch hardware configuratio n dictates wh ich power supply or supplies yo u should use . For example, if y our switch conf i guratio n requires more po wer than a single po wer supply pro vides, use th[...]

10-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment Power Management (for lack of po wer) into reset mode. The supervisor engine and modules for which there is adequate po wer always remain enabled, with no disrup tion of network connecti vity . Modules placed in reset mode[...]

10-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement Power Management • Dual supervisor engines: WS-X45-Sup 6-E and WS-X45-Sup6L-E • One or more: WS-X4448 -GB-RJ45 or WS-X4148-FX-MT T o maximize the 10/100/1 000 port density of 7- and 10- slot chassis when usin g redundant [...]

10-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment Power Management The follo wing example sho ws how to set the po wer management mode to redundant mode: Switch (config)# power redundancy-mode redundant Switch (config)# end Switch# The follo wing example sho ws how to d i[...]

10-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement Power Management The follo wing example sho ws how to set the po wer management mode to combined mode: Switch(config)# power redundancy-mode combined Switch(config)# end Switch# The follo wing example sho ws how to display th[...]

10-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment Power Management Special Considerations for the 4200 W AC and 6000 W AC Power Supplies The 4200 W A C and 6000 W A C power sup ply has two input s: each can be pow ered at 110 or 220 V . The output of the show power comman[...]

10-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement Power Management Note When the system is po wered with a 4200 W or 6000 W po wer supply either in 110 V or 220 V combined mode operation, the a vailable po wer is determined by the conf iguration of the system (the t ype of l[...]

10-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment Power Management In combined mode, all t he inputs to the chassis must be at the same v oltage. T able 10-10 illu strates how t he 6000 W A C power supply is e valuated in comb ined mode. Combined Mode Power Resiliency Not[...]

10-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement Power Management If you have max input s 3 configured with four “go od” (220 V) inputs and you li mit t he user to 5500 W instead of 7600 W and on e sub uni t fails or is po wered o f f, you ha ve three q uali ty inputs p[...]

10-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment Power Management PS1-2 110V good PS2 PWR-C45-4200ACV AC 4200W good good good PS2-1 110V good PS2-2 110V good Power supplies needed by system : 2 Maximum Inputs = 3 Power supplies currently available : 2 Power Summary Maxim[...]

10-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement Power Management The same conf iguration is applied to both po wer slots. For e xample, if you set the dc power input to 1000 W , the switch e xpects 1000 W as the external DC source fo r both slot 1and slot 2 (if present). T[...]

10-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment Power Management The output of the show po wer detail and show power module com mands re veals the v ariable amount of po wer consumption attributabl e to the supervis or engine and summarizes the supervisor en gine’ s i[...]

10-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement Power Management Switch# show power module sh power module Watts Used of System Power (12V) Mod Model currently out of reset in reset ---- ----------------- --------- ------------ -------- 1 WS-X4013+TS 180 180 180 2 WS-X4506[...]

10-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment IEEE 802.3az Energy Efficient Ethernet Note After you enter no hw-mod mod x power command and OIR the linecard, the configuration persists and is v alid for an y slot in the chassi s it is applied to. Y ou observ e the sam[...]

10-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 10 Environmental Monitoring and Power Man agement IEEE 802.3az Energy Efficient Ethernet Determining EEE Capability T o determine whether a lin e card supports EEE, use the sho w interface capabilities module module command, as follo ws: Switch# show interface capabilities m[...]

10-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 10 Environmental M onitoring a nd Power Manage ment IEEE 802.3az Energy Efficient Ethernet[...]

CH A P T E R 11-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 11 Configuring Power over Ethernet Note Before reading this chapter , read the “Preparing for In stallation” section of the Catalyst 4500 Series Installati on Guide . Y ou must ensure that your install ation site has enough po wer and cooling to accommod ate the addi[...]

11-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 11 Config uring Power ov er Ethernet About Power over Etherne t the PoE capabilities of in divid ual power suppl ies. Support for PoE enables the system to p ower inlin e devices, such as IP phones, IP vi deo phones, and wireless access poin ts over standard copper cabling ([...]

11-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 11 Configuring Power over Ethernet Power Management Mode s Power Management Modes If your switch has a module capabl e of providing PoE to end statio ns, you can set each interface on the module to automati cally detect and apply PoE i f the end station requires po wer . The [...]

11-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 11 Config uring Power ov er Ethernet Power Management Modes Note If you set a non-PoE-capable interface to automatically detect and apply power , an error message indicates that th e confi guration is not v alid. The follo wing e xample sho ws ho w to set the F ast Ethernet [...]

11-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 11 Configuring Power over Ethernet Configuring Power Co ns umption fo r Powered Devices on an Interface Configuring Power Consumption for Powered Devices on an Interface By default, wh en the switch detects a po wered device on an interface, it assumes the pow ered de vice co[...]

11-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 11 Config uring Power ov er Ethernet Displaying the Operationa l Status for an Interface Interface AdminPowerMax AdminConsumption (Watts) (Watts) ---------- --------------- -------------------- Gi7/1 15.4 15.4 Switch# config terminal Enter configuration commands, one per lin[...]

11-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 11 Configuring Power over Ethernet Displaying all PoE Detection and Removal Events Fa3/1 auto on 17.3 15.4 Ieee PD 0 Fa3/2 auto on 4.5 4.0 Ieee PD 1 Fa3/3 auto on 7.1 6.3 Cisco IP Phone 7960 0 Fa3/4 auto on 7.1 6.3 Cisco IP Phone 7960 n/a Fa3/5 auto on 17.3 15.4 Ieee PD 0 Fa3[...]

11-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 11 Config uring Power ov er Ethernet Displaying the PoE Consumed by a Module Displaying the PoE Consumed by a Module A Catalyst 4500 series switch can measure the act ual PoE consumption for an 802.3af-compliant PoE module. Y ou can observ e this consumption b y using show p[...]

11-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 11 Configuring Power over Ethernet Displaying the PoE Co nsumed by a M odule The follo wing example uses the show power detai l and show power inline commands to di splay the PoE consumption for an 80 2.3af-compliant modu le: Switch# show power detail Power Fan Inline Supply [...]

11-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 11 Config uring Power ov er Ethernet Displaying the PoE Consumed by a Module Switch# show power inline g1/1 Module 1 Inline Power Supply: Available:158(w) Used:128(w) Remaining:30(w) Interface Admin Oper Power(Watts) Device Class From PS To Device --------- ------ ---------[...]

11-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 11 Configuring Power over Ethernet Displaying the PoE Co nsumed by a M odule switch# show power inline module 2 Chassis Inline Power Supply: Available:800(w) Used:138(w) Remaining:662(w) Interface Admin Oper Power(Watts) Device Class From PS To Device --------- ------ ------[...]

11-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 11 Config uring Power ov er Ethernet PoE Policing and Monitoring Gi2/45 auto off 0.0 0.0 n/a n/a Gi2/46 auto off 0.0 0.0 n/a n/a Gi2/47 auto off 0.0 0.0 n/a n/a Gi2/48 auto off 0.0 0.0 n/a n/a --------- ------ ---------- ---------- ---------- ------------------- ----- Total[...]

11-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 11 Configuring Power over Ethernet PoE Policing and M onitoring Configuring Power Policing on an Interface The default polici ng lev els are determined by the disc ov ery and po wer allocation methods (listed in order of priority): • Conf igured consumption v alues, in cas[...]

11-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 11 Config uring Power ov er Ethernet PoE Policing and Monitoring Interface Admin Oper Admin Oper Cutoff Oper State State Police Police Power Power --------- ------ ---------- ---------- ---------- ------ ----- Gi2/1 auto errdisable errdisable overdrawn 0.0 0.0 Displaying Po[...]

11-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 11 Configuring Power over Ethernet Enhanced Power PoE Supp ort on the E-Series Chassis The errdisable autorecov ery mechanism allows you to configure a t imer for errdis able recov ery so that when an interface enters errdisable state (after the timer expires), the interface[...]

11-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 11 Config uring Power ov er Ethernet Enhanced Power PoE Support on th e E-Series Chassis The default po wer inline conf igurations usually are sif ficient; no addition al conf iguration is requir ed e ven for high po wer-consumpti on Cisco powered d e vices (for example, a [...]

CH A P T E R 12-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant This chapter describes ho w to install Network Assistant on the w orkstation and conf igure the Catalyst 4500 (or 4900) series switch to communi cate with Network Assistant. (The term Catalyst 45[...]

12-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant About Netw ork Assistan t Note For information on softwar e and hardware requirements, installin g Network Assistant, launch ing Network Assistant, and connecting Netw ork Assistant to a device refer[...]

12-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Ci sco Network Ass istant Network Assistant-R elated Parameters and Their Defaults Network Assistant-Related Parameters and Their Defaults T able 12-1 li sts the Network Assistant -related configur ation parameters on a Cata[...]

12-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant Configuring Your Sw itch for Network Assista nt Configuring Your Switch for Network Assistant This section includes the following topics: • (Minimum) Required Con figur ation, page 12-4 • (Additi[...]

12-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Ci sco Network Ass istant Configuring Your Switch for N etwor k Assistant Note If you ha ve enabled clusterin g, disable clustering before conf iguring a community (see Ta b l e 1 2 - 2 ). (Additional) Configuration Required[...]

12-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant Managing a Networ k Using Community Managing a Network Using Community This section descri bes how to use communities to manage de vices (including Catalyst 4500 series switches, routers, access poin[...]

12-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Ci sco Network Ass istant Managing a Network Using Co mmunity This section descri bes the guidelines and requiremen ts you should understand before yo u create a community . This section cont ains the follo wing topics: • [...]

12-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant Managing a Networ k Using Community Note Do not disable CDP on cand idates, members, or on an y network dev ices that you might w ant Network Assistant to discover . Note PIX fire walls do not su ppo[...]

12-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Ci sco Network Ass istant Managing a Network Using Co mmunity Access Modes in Network Assistant When Network Assistant is connec ted to a community or cluster , two access modes are av ailable: read-write and read-o nly , de[...]

12-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant Converting a Cluster into a Community Note If you are logged into a community an d you delete that community from some ot her CN A i nstance, then unless you close that commun ity session, you can p[...]

12-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Ci sco Network Ass istant Managing a Netwo rk Using Cluster Note If you ha ve enabled clus tering, you should disable clusteri ng before conf iguring a community ( see T able 12-2 ). Managing a Network Using Cluster This se[...]

12-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant Managing a Network U sing Cluster • Has 16 VTY lines. Note On a Catalyst 4500 series switch, the default is 4 li nes. Y ou configure the switch to set the v alue to 16. • Is not a command or clu[...]

12-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Ci sco Network Ass istant Configuring Network Assistant in Community or Cluste r M ode W e recommend that you conf igure the Catalyst 45 00 candidate a nd cluste r member switch es with an SVI on the VLAN connection to the [...]

12-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant Configuring Network Assistant in Community or Cluster Mo de Step 6 Switch(config-if)# switchport access vlan vlan_id Enables the selected interface to be in the specif ied VLAN. Step 7 Switch(config[...]

12-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Ci sco Network Ass istant Configuring Network Assistant in Community or Cluste r M ode This exampl e shows ho w to configu re Network Assistant on a netw orked switch in communit y mode: Switch# configure terminal Switch(co[...]

12-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant Configuring Network Assistant in Community or Cluster Mo de subject-name cn=IOS-Self-Signed-Certificate-913087 revocation-check none rsakeypair TP-self-signed-913087 !! crypto pki certificate chain [...]

12-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Ci sco Network Ass istant Configuring Network Assistant in Community or Cluste r M ode ! interface GigabitEthernet1/13 ! interface GigabitEthernet1/14 ! interface GigabitEthernet1/15 ! interface GigabitEthernet1/16 ! interf[...]

12-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant Configuring Network Assistant in Community or Cluster Mo de This exampl e shows ho w to conf igure Network Assistant on a netw orked switch in clust er mode: Switch# configure terminal Switch(config[...]

12-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Ci sco Network Ass istant Configuring Network Assistant in Community or Cluste r M ode Switch(config)# line con 0 Switch(config-line)# exec-timeout 0 0 Switch(config-line)# password keepout Switch(config-line)# login Switch[...]

12-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 12 Configuring the Catalyst 4500 Series Switch with Cisco Network Assistant Configuring Network Assistant in Community or Cluster Mo de interface GigabitEthernet1/8 ! interface GigabitEthernet1/9 ! interface GigabitEthernet1/10 ! interface GigabitEthernet1/11 ! interface Gi[...]

CH A P T E R 13-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 13 Configuring VLANs, VTP, and VMPS This chapter describes VLANs on Catalyst 4500 se ri es switches. It a lso describes h ow to enable the VLAN T runking Protocol (VTP) and to conf igure th e Catalyst 4500 series switch as a VMPS client. This chapter includ es the follo [...]

13-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLANs Note VTP version 3 upd ates do not pass through promiscuous tru nk ports. VLANs define bro adcast domains in a Layer 2 network. A broadcast domain is the set of all d e vices that receiv es broadcast frames origina ting from any de v[...]

13-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLANs • VLAN state (activ e or suspended) • Maximum transmission unit (MTU) for the VLAN • Security Association Id entif ier (SAID) • VLAN number to use when tr anslating from one VLAN t ype to another Note When the software transl[...]

13-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLANs T able 13-1 describes the uses f or VLAN ranges. Configurable Normal-R ange VLAN Parameters Note Ethernet VLANs 1 and 1006 through 4094 use onl y default v alues. Y ou can configure the follo wing parameters for VLANs 2 through 1001:[...]

13-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLANs Note Catalyst 4500 series switches do n ot support T oken Ring or FDDI med ia. The switch does not forw ard FDDI, FDDI-NET , T rCRF , or T rBRF traf fic, b ut it does propagate the VLAN co nfigu ration by using VTP . The software res[...]

13-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLANs Configuring VLANs in Gl obal Configuration Mode If the switch is in VTP serv er or transparent mode (see the “VLA N T runking Protocol” section on page 13-7 ), you can conf igure VLANs in global and VLAN confi guration modes. Whe[...]

13-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Trunking Protocol • Because Layer 3 ports and some software features require internal VLANs allocated from 1006 and up, conf igure extended- range VLANs starting with 4094 and w ork downward. • Y ou can confi gure e xtended-range [...]

13-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Trunkin g Protocol About VTP VTP is a Layer 2 messaging protocol that maintains VLAN conf iguration consistency by managing the addition, delet i on , and renaming of V LANs within a VTP domain. A VTP domain (also called a VLAN manage[...]

13-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Trunking Protocol Understanding VTP Modes Y ou can configure a Cat alyst 4500 series switch to operate in any one of these VTP mo des: • Server—In VTP server mode, yo u can create, modify , and delete VLANs and specify other confi[...]

13-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Trunkin g Protocol Note Catalyst 4500 series switches do not su pport T oken Ring or FDDI med ia. The switch does not forw ard FDDI, FDDI-Net, T oken Ri ng Concentrator Relay Function (T rCRF), or T oken Ring Bridge Relay Function (T[...]

13-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Trunking Protocol database information. The up dates sent out are honored b y all the de vices in the system. A VTP secondary serv er can only back up to its NVRA M t h e VTP co nf iguration recei v ed b y using updates from the VTP [...]

13-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Trunkin g Protocol Figur e 13-3 Flooding T raffic wi th VTP Pr uning Enabling VTP pruning o n a VTP server enable s pruning for the enti re management domain. VTP p runing takes ef fect sev e ral seconds after you enable it. By defau[...]

13-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Trunking Protocol • In a T ok en Ring en vironment, you must enable VTP v ersion 2 or v ersion 3 for T oken Ring VLAN switching to functio n properly . • T wo VPT v ersion 3 regions can only communicate in transparent mode ove r [...]

13-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Trunkin g Protocol Configuring VTP These sections describe ho w to configure VTP: • Conf iguring VTP Global Paramet ers, page 13-14 • Conf iguring the VTP Mode, page 13-16 • Starting a T ak eov er , page 13-19 • Displaying VT[...]

13-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Trunking Protocol This exampl e show s how to co nfigu re a VTP password in EXEC mode: Switch# vtp password WATER Setting device VLAN database password to WATER. Switch# Note The password is not stored in th e running-conf ig file. T[...]

13-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Trunkin g Protocol Caution VTP versi on 1 and VTP v ersion 2 are not i nteropera ble on net work de vices in the same VTP domain. Every netw ork de vice in the VTP domai n must use th e same VTP v e rsion. Do not enabl e VTP v ersion[...]

13-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Trunking Protocol Note When VTP is disabled, you can enter VLAN conf iguration command s in config urati on mode instead of the VLAN database mode and the VLAN configuratio n is stored in the startup conf iguration f ile. This exampl[...]

13-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Trunkin g Protocol This exampl e show s an example of th e VTP configurati on parameters when the de vice is running VTP versio n 2: Switch# show vtp st atus VTP Version capable : 1 to 3 VTP version running : 2 VTP Domain Name : Lab_[...]

13-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Trunking Protocol Starting a Takeover This process applies to VTP v e rsion 3 only . T o start a takeov e r , perform this task: This example sho ws how to start a tak eover and direct it to the vlan database: Switch# vtp primary-ser[...]

13-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Membership Policy Server Request advertisements transmitted : 3 Number of config revision errors : 0 Number of config digest errors : 0 Number of V1 summary errors : 0 VTP pruning statistics: Trunk Join Transmitted Join Received Summ[...]

13-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Membership Policy Server About VMPS These subsections describe what a VMPS server does and ho w it operates: • Understanding the V MPS Server , page 13-21 • Security Modes for VMPS Serv er, page 13- 22 • F allback VLAN, page 13[...]

13-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Membership Policy Server Security Modes fo r VMPS Server VMPS operates in three dif ferent modes. The w ay a VM PS server responds to illegal requests depends on the mode in whi ch the VMPS is conf igured: • Open Mode, page 13-22 ?[...]

13-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Membership Policy Server Fallback VLAN Y ou can configure a f allback VLAN name on a VMPS server . If no VLAN has be en assigned to this port, VMPS compares the requ esting MA C address to this port: • If you conn ect a dev ice wit[...]

13-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Membership Policy Server Multiple hosts (MA C addresses) can be acti v e on a dy namic po rt if all are in the same VLAN. If the l ink goes do wn on a dynamic port, the port retu rns to th e unassigned state and does not belong to a [...]

13-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Membership Policy Server T o defi ne the primary and second ary VMPS on a Ca talyst 4500 series switch, perf orm this task: This exampl e show s how to def ine the primary and secondary VMPS de vices: Switch# configure terminal Enter[...]

13-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Membership Policy Server This example sho ws how to conf igure a dy namic access port and to verify the entry: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface fa1/1 Sw[...]

13-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Membership Policy Server This exampl e show s how to ch ange the reconf irmation interv al to 60 minutes and v erify the change: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# [...]

13-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Membership Policy Server Administering and Monitoring the VMPS Y ou can display the follo wing information about the VMPS with the show vmps command : The follo wing example sho ws how to display VMPS information : Switch# show vmps [...]

13-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Membership Policy Server Troubleshooting Dynamic Po rt VLAN Membership VMPS errdisables a dynamic port under the foll owin g conditions: • The VMPS is in secure mode, and it does not al low the host to co nnect to the port. The VMP[...]

13-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Membership Policy Server Figur e 13-4 Dynamic P ort VLAN Me mbership Configur ation T wo topologies are possible. Figure 1 3-5 illustrates a top ol ogy with one end stati on attached directly to a Catalyst 45 00 seri es switch operat[...]

13-31 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Membership Policy Server Figur e 13-6 T opolog y with an End Station At tached to a Cisco IP Phone that is Attac hed to a Catalyst 4 500 Ser ie s Switch In the follo w ing procedure, the Catalyst 4500 a nd Catalyst 6500 series switch[...]

13-32 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Membership Policy Server d. Assign the port dynamic VLAN membersh ip: switch(config-if)# switchport access vlan dynamic e. Return to pri vileged EXEC mode: switch(config-if)# exit switch# Step 3 Connect End Station 2 o n port Fa2 /1.[...]

13-33 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 13 Config uring VLANs, VTP, and VMPS VLAN Membership Policy Server !MAC Addresses ! vmps-mac-addrs ! ! address <addr> vlan-name <vlan_name> ! address 0012.2233.4455 vlan-name hardware address 0000.6509.a080 vlan-name hardware address aabb.ccdd.eeff vlan-name Gree[...]

13-34 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 13 Configuring VLANs, VTP, and VMPS VLAN Membership Policy Server[...]

CH A P T E R 14-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 14 Configuring IP Unnumbered Interface This chapter discusses the IP Unnum bered In terface feature, whi ch allows you to enable IP p rocessing on an interface with out assigning an e xplicit IP address. This chapter contains these sections: • About IP Unnumbered In te[...]

14-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 14 Configurin g IP Unnumbered Interface About IP Unnumbered Inte rfac e Supp ort IP Unnumbered Interface Support w ith DHCP Server and Relay Agent The IP unnumbered interface conf iguration allo ws you to enable IP processing on an int erface without assigning it an e x plic[...]

14-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 14 Configuring IP Unnumbered Interface IP Unnumbered Configura tion Guide lines and Restrictions Figur e 14-2 F orm at of the Ag ent Remote ID Suboption T able 14-1 describes the agent remote ID su boption fields displaye d in Figure 14-2 . IP Unnumbered Interface with Connec[...]

14-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 14 Configurin g IP Unnumbered Interface Configuring IP Unnu mb ered Interface Suppor t with DHCP Server • The option to add dhcp host r o utes as connecte d routes is available in Cisco IOS. When using connected m ode, howev e r , the clear ip r oute * comm and dele tes th[...]

14-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 14 Configuring IP Unnumbered Interface Configuring IP Unnumbered Interfac e Support with Conne cted H ost Polling Configuring IP Unnumbered Interface Support on a Range of Ethernet VLANs T o configure IP unnumbered interf ac e support on a range of Ethern et VLA N interfaces,[...]

14-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 14 Configurin g IP Unnumbered Interface Displaying IP Unnumb ered Interface Settings The follo wing example sho ws how to enable IP proce ssing and connected host po lling on F ast Ethernet interface 6/2. I t also shows h ow to set t he global backlog queue to 2000 an d the [...]

14-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 14 Configuring IP Unnumbered Interface Troubleshooting IP Unnumbered In te rface T o display status of an unnumber ed interface, enter this co mmand: The follo wing example sho ws how to display the stat us of unnumbered interfaces with connected host polling: Switch# show ip[...]

14-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 14 Configurin g IP Unnumbered Interface Related Documents When an IP unnumbered interfac e shares the IP a ddress of a loopback interface whose pref ix is advertised in an OSPF netw ork, you must modify the loop back interface as a po int-to-point interface. Otherwise, only [...]

CH A P T E R 15-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 15 Configuring Layer 2 Ethernet Interfaces This chapter describes how to use the command-lin e interface (CLI) to configure Fast Ethernet and Gigabit Ethernet interf aces for Laye r 2 switching on Catalyst 4500 se ries switches. It also provides guidelines, procedures, a[...]

15-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 15 Configuring Layer 2 Ethernet Interfaces About Layer 2 E thernet Switching Layer 2 Ethernet Switching Catalyst 4500 series switches su pport simultaneous, parallel conn ections between Layer 2 Et hernet segments. Switched connections between Ethernet segments la st only fo[...]

15-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 15 Configuring Layer 2 Ether net Interfaces About Layer 2 Ethernet Switching VLAN Trunks A trunk is a point-to-poi nt link between on e or more Et hernet switch interfaces and another netwo rking device such as a router or a switch. T runks carry the traff ic of multiple VLAN[...]

15-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 15 Configuring Layer 2 Ethernet Interfaces Default Layer 2 E thernet Interface Configuration Layer 2 Interface Modes T able 15-2 list s the Layer 2 interface modes and describe s ho w they function o n Ethernet interfaces. Note DTP is a point-to-poi nt protocol. Ho wev er , [...]

15-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 15 Configuring Layer 2 Ether net Interfaces La ye r 2 Interface Configuratio n Guidelines an d Restrictions Layer 2 Interface Configuratio n Guidelines and Restrictions When using (or conf iguring) Layer 2 interfaces , consider these guidelines and restrictions: • In a netw[...]

15-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 15 Configuring Layer 2 Ethernet Interfaces Configuring Ethe rnet Interfaces for Laye r 2 Switching Configuring an Ethernet Interface as a Layer 2 Trunk Note The default for Lay er 2 interfaces is switchport mode dynamic auto . If the neighboring interf ace supports trunking [...]

15-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 15 Configuring Layer 2 Ether net Interfaces Configuring Ethernet Interfaces for Laye r 2 Switching This example sho ws ho w to conf igure the Fast Ethern et interface 5/8 as a n 802.1Q trunk. This example assumes that the neighbor interf ace is config ured t o support 802.1Q [...]

15-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 15 Configuring Layer 2 Ethernet Interfaces Configuring Ethe rnet Interfaces for Laye r 2 Switching This exampl e show s how to v erify the trunk configu ration: Switch# show interfaces fastethernet 5/8 trunk Port Mode Encapsulation Status Native vlan Fa5/8 desirable n-802.1q[...]

15-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 15 Configuring Layer 2 Ether net Interfaces Configuring Ethernet Interfaces for Laye r 2 Switching This example sho ws how to conf igure the Fast Ethe rnet interface 5/6 as an access port in VLAN 200: Switch# configure terminal Enter configuration commands, one per line. End [...]

15-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 15 Configuring Layer 2 Ethernet Interfaces Configuring Ethe rnet Interfaces for Laye r 2 Switching This e xample sho ws how to cl ear the Layer 2 co n figuration on the Fast Ethernet interface 5/6: Switch# configure terminal Enter configuration commands, one per line. End w[...]

CH A P T E R 17-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 17 Configuring Auto SmartPort Macros This chapter describes ho w to configur e and apply Auto SmartPor t macros on the Catalyst 4500 series switch. This chapter includ es the follo w ing major sections: • About Auto SmartPorts, page 17-1 • Conf iguring Auto SmartPort[...]

17-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 17 Configurin g Auto SmartPort Mac ros Configuring Auto SmartPor ts System b uilt-in e vent triggers exist for vario us devi ces based mostly on CDP and LLDP messages ( T able 17-1 ) and some MA C address.and some MA C ad dre ss. (Through Cisco IOS Release 12.2(54)SG, DMP is[...]

17-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 17 Configuring Auto SmartPor t Macros Configuring Auto SmartPorts Enabling Auto SmartPorts Note By default, Aut o SmartPort is disab led globally . T o disable Auto SmartPorts macro s on a specif ic port, use the no macro auto global processing interface command befo re enabl[...]

17-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 17 Configurin g Auto SmartPort Mac ros Configuring Auto SmartPor ts T able 17-2 sho ws the Auto SmartPorts built- in macros that are embedded in the switch soft ware. Note By default, the b uilt-in ev ent triggers are mapped to the built-in macro s. Auto SmartPorts Configura[...]

17-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 17 Configuring Auto SmartPor t Macros Configuring Auto SmartPorts • If the macro conflicts wit h the original conf iguration, some macro commands might not be applied , or some antimacro co mmands might not be applied. ( The antimacro is the portion of t he applied macro th[...]

17-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 17 Configurin g Auto SmartPort Mac ros Configuring Auto SmartPor ts Configuring Auto SmartPorts Built-in Macro Parameters The switch automatically maps from b uilt-in ev en t triggers to bu ilt-in macros. Y ou can replace the bui lt-in macro default v alues with v alues that[...]

17-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 17 Configuring Auto SmartPor t Macros Configuring Auto SmartPorts The no macro auto execute e vent trigger {[ buil t in built-in macr o name [ parameter=valu e ]] | [[ par ameter = value ] { function contents } ]} command deletes th e mapping. This exampl e sho ws ho w t o us[...]

17-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 17 Configurin g Auto SmartPort Mac ros Configuring Auto SmartPor ts T o conf igure an even t trigger , perform this task: Use the no shell trigger identif ier global conf iguration command to delete the e vent trigger . The follo wing example sho ws how to def ine a user-def[...]

17-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 17 Configuring Auto SmartPor t Macros Configuring Auto SmartPorts Configuring Mapping Between User-Defined Triggers and Built-in Macros Y ou need to map the user -defined trigger to either a b uilt-in macro or user- defined macro. T o map a user-def ined trigger to a b uilt-i[...]

17-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 17 Configurin g Auto SmartPort Mac ros Configuring Auto SmartPor ts Inside a user-def ined mac ro, besides parameters specified through macro auto execute trigger parameter -name=value .., you also can use the follo wing variables pub lished by EEM ( T able 17-3 ): T o map [...]

17-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 17 Configuring Auto SmartPor t Macros Configuring Auto SmartPorts This example sho ws how to map a user-def ined even t trigger called Cisco Digital Media Player (DMP) to a user -defined macro . Step 1 Connect the DMP to an 802.1X- or MAB-ena bled switch port. Step 2 On the [...]

17-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 17 Configurin g Auto SmartPort Mac ros Configuring Auto SmartPor ts T able 17-4 lists the supported shell keywords your can app ly in your mac ros and anti macro statem ents. T able 17-5 list s the shell ke ywords that are not suppor ted in macros and antimacros. T able 17 [...]

17-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 17 Configuring Auto SmartPor t Macros Displaying Auto SmartPorts Displaying Auto SmartPorts T o display the Auto SmartPorts and static SmartPorts macros, use on e or more of the pri vileged EXEC commands in Ta b l e 1 7 - 6 . This example sh ows ho w to use the show shell tr[...]

17-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 17 Configurin g Auto SmartPort Mac ros Displaying Auto SmartPorts function CISCO_AP_AUTO_SMARTPORT () { if [[ $LINKUP -eq YES ]]; then conf t interface $INTERFACE macro description $TRIGGER switchport trunk encapsulation dot1q switchport trunk native vlan $NATIVE_VLAN switc[...]

CH A P T E R 16-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 16 Configuring SmartPort Macros This chapter describes ho w to configu re and apply SmartPort and Stati c SmartPort macros on your switch. This chapter consists of these sections: • About SmartPort Macros and St atic SmartPort, page 16-1 • Conf iguring SmartPort Macr[...]

16-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 16 Con figuring SmartPort Macros Configuring SmartPort Macr os Cisco-default Smart Port macr os are embedded in the switch softw a re (see T able 16- 1 ). Y ou can display these macros and the commands they contain b y using the show parser ma cro user EXEC command. Cisco al[...]

16-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 16 Configuring SmartPort Macros Configuring SmartPort Macros Passing Parameters Through the Macro Some commands might not be suff iciently generic for all the interf aces; for example, VLAN ID for Layer 2 interfaces and the IP address for Layer 3 inte rface. Retaining such co[...]

16-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 16 Con figuring SmartPort Macros Configuring SmartPort Macr os Default SmartPort Macro Configuration This section illustrates th e de fa ult con f igurations for the four supported macros. These macro s can only be viewed and applied; the y ca nnot be modified b y the user .[...]

16-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 16 Configuring SmartPort Macros Configuring SmartPort Macros cisco-phone This is the e xample for the cisco-phone macro: # VoIP enabled interface - Enable data VLAN # and voice VLAN (VVID) # Recommended value for access vlan (AVID) should not be 1 switchport access vlan $AVI[...]

16-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 16 Con figuring SmartPort Macros Configuring SmartPort Macr os # Recommended value for native vlan (NVID) should not be 1 switchport trunk native vlan $NVID # Update the allowed VLAN range (VRANGE) such that it # includes data, voice and native VLANs # switchport trunk allow[...]

16-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 16 Configuring SmartPort Macros Configuring SmartPort Macros • Use the macro global trace macr o-name global configur ation command or th e macro trace macr o-name interface configuration command to apply and debug a macro to find any syntax or configuration errors. If a co[...]

16-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 16 Con figuring SmartPort Macros Configuring SmartPort Macr os Creating SmartPort Macros T o create a SmartPort macro, perform this task: Command Purpose Step 1 Switch# configure terminal Enters global conf iguration mode. Step 2 Switch(config)# macro name macro-name Creates[...]

16-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 16 Configuring SmartPort Macros Configuring SmartPort Macros Applying SmartPort Macros T o apply a SmartPort macro, perform t his task: Command Purpose Step 1 Switch# configure terminal Enters global conf iguration mode. Step 2 Switch(config)# macro global { apply | trace } m[...]

16-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 16 Con figuring SmartPort Macros Configuring SmartPort Macr os Y ou can delete a global macro-applied conf iguration on a switch onl y by entering th e no v ersion of each command that is in the macro. Y ou can delete a macro-applied conf i guration on an interface b y ente[...]

16-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 16 Configuring SmartPort Macros Configuring SmartPort Macros cisco-desktop This exampl e show s how to us e the system-defined macro cisco-desktop to assign a v alue of 35 to the access VLAN of the Fast Ethernet interface 2/9. Note This macro requires the $A VID ke yword, wh[...]

16-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 16 Con figuring SmartPort Macros Configuring SmartPort Macr os Macro type : customizable # VoIP enabled interface - Enable data VLAN # and voice VLAN (VVID) # Recommended value for access vlan (AVID) should not be 1 switchport access vlan $AVID [access_vlan_id] switchport [...]

16-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 16 Configuring SmartPort Macros Configuring SmartPort Macros # speed up convergence switchport mode trunk switchport nonegotiate # Configure qos to trust this interface auto qos voip trust # 802.1w defines the link as pt-pt for rapid convergence spanning-tree link-type point[...]

16-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 16 Con figuring SmartPort Macros Displaying SmartPort Macros Displaying SmartPort Macros T o display the SmartPort macros, use one o r more of the pri vileged EXEC commands in Ta b l e 1 6 - 2 . Configuring Static SmartPort Macros This section descri bes ho w to conf igur e[...]

16-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 16 Configuring SmartPort Macros Configuring Static SmartPort Macros Static SmartPort Configuration Guidelines • When a macro is applied globally to a switch or to a swit ch interface, all existing con figur ation on the interface is retained. it is helpful when applying an[...]

16-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 16 Con figuring SmartPort Macros Configuring Sta tic SmartPort Macros Y ou can only delete a global macro-applied conf iguration on a switch b y enter ing the no version of each command in the macro. Y ou can delete a macro-ap plied configurat ion on a port b y entering the[...]

CH A P T E R 18-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 18 Configuring STP and MST This chapter descri bes how to configure the Spanning Tree Protocol (STP) on a Cata lyst 4500 se ries switch. This chapter also describes ho w to config ure the IEEE 802.1s Multiple Sp anning T ree (MST) protocol on the Catalyst 4500 series swi[...]

18-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T About STP A Catalyst 4500 series switch us e STP (the IEEE 802 .1D bridge protocol) on all VLANs. By default, a single spanning t ree runs on each conf igured VLAN (pro vided you do not manually d isable the spanning tree). Y ou ca n enable and [...]

18-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST About STP Extended System ID Extended system IDs are VLAN IDs between 1025 and 4096. Cisco IOS Releases 12.1(1 2c)EW and later releases support a 12-bit e xtended system ID f ield as part of the bridge ID (see Ta b l e 1 8 - 2 ). Chassis that suppor[...]

18-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T About STP • The identif ier of the transmitting port • V alues for the hello , forward delay , and max-age protocol t imers When a switch transmits a BPDU frame, all switc h es connected to the LAN on which th e frame is transmitted recei ve[...]

18-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST About STP Creating the STP Topology The goal of the spanning tree algo rithm is to mak e th e most direct link the roo t port. When the spanning tree topolog y is calculated based on defaul t parame ters, the path between so urce and destination end[...]

18-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T About STP • Disabled—In this state, th e Layer 2 interface does not participate i n spanning tree and does not forward frames. MAC Address Allocation The supervisor engi ne has a pool of 10 24 MAC addresses t hat are used as the bridge IDs f[...]

18-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Default STP Co nfiguration For enabling informat ion, see “Enabling Per -VLAN Rapid Spanning T ree” on page 20. Default STP Configuration T able 18-4 sho ws the default spannin g tree conf iguration. Configuring STP The follo wing sections descr[...]

18-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring STP • Disabling Sp anning T ree Protocol, page 18-20 • Enabling Per-VLAN Rapid Spanni ng Tree, page 18-20 Note The spanning tree commands describe d in this chapter can be config ured on any interface except those configured with[...]

18-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Configuring STP Designated bridge has priority 32768, address 00e0.4fac.b000 Designated port id is 128.2, designated path cost 19 Timers: message age 3, forward delay 0, hold 0 Number of transitions to forwarding state: 1 BPDU: sent 3, received 3417[...]

18-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring STP Configuring the Root Bridge A Catalyst 4000 family switch main tains an instan ce of spanni ng tree for each acti ve VLAN conf ig ured on the switch. A b ridge ID, consisting of the bridge priority and the bridge MA C address, i[...]

18-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Configuring STP VLAN1 is executing the ieee compatible Spanning Tree protocol Bridge Identifier has priority 32768, address 0030.94fc.0a00 Configured hello time 2, max age 20, forward delay 15 Current root has priority 32768, address 0001.6445.4400[...]

18-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring STP Port 324 (FastEthernet6/4) of VLAN1 is listening Port path cost 19, Port priority 128, Port Identifier 129.68. Designated root has priority 8192, address 0030.94fc.0a00 Designated bridge has priority 8192, address 0030.94fc.0a00[...]

18-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Configuring STP Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Bridge ID Priority 32768 Address 0003.6b10.e800 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Aging Time 300 Interface Role Sts Cost Prio.Nbr Status ---------------- ---- -[...]

18-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring STP Switch(config-if)# spanning-tree port-priority 100 Switch(config-if)# end Switch# This exampl e shows ho w to verify the conf iguration of a Fast Ethernet interfac e when it is conf igured as an access port: Switch# show spannin[...]

18-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Configuring STP Designated root has priority 32768, address 0003.6b10.ebec Designated bridge has priority 32768, address 0003.6b10.ebec Designated port id is 128.129, designated path cost 0 Timers:message age 0, forward delay 0, hold 0 Number of tr[...]

18-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring STP This e xample sho ws how to ch ange the spannin g tree port cos t of a Fast Ethernet interf ace: Switch# configure terminal Switch(config)# interface fastethernet 5/8 Switch(config-if)# spanning-tree cost 18 Switch(config-if)# e[...]

18-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Configuring STP Number of transitions to forwarding state: 1 BPDU: sent 0, received 13513 <...output truncated...> Switch# Note The show spanning-tr ee command displays only information f or ports with an acti ve link (green li ght is on). If[...]

18-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring STP T o conf igure the spanning tr ee hello time of a VLAN, perform this task: This exampl e show s how to conf igure the hello time for VLAN 20 0 to 7 seconds: Switch# configure terminal Switch(config)# spanning-tree vlan 200 hello[...]

18-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Configuring STP This exampl e shows ho w to verify the conf iguration: Switch# show spanning-tree vlan 200 bridge brief Hello Max Fwd Vlan Bridge ID Time Age Delay Protocol ---------------- -------------------- ---- ---- ----- -------- VLAN200 4915[...]

18-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring STP Disabling Spanning Tree Protocol T o disable spanning t ree on a per-VLAN basis, perform this task: This exampl e show s how to disable spanning tree o n VLAN 200: Switch# configure terminal Switch(config)# no spanning-tree vlan[...]

18-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Configuring STP Switch# clear spanning-tree detected-protocols The follo wing example sho ws how to v erify the conf iguration: Switch# show spanning-tree summary totals Switch is in rapid-pvst mode Root bridge for:VLAN0001 Extended system ID is di[...]

18-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T About MST About MST The follo wing sections describe how MST w orks on a Catalyst 4000 fami ly switch: • IEEE 802.1s MST , page 18-22 • IEEE 802.1w RSTP , page 18-23 • MST -to-SST Interop erability , page 18-24 • Common Spanning T ree, [...]

18-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST About MST • MST establishes and mai ntains additional spanning trees within each MST region. These spanni ng trees are termed MST instances (MSTIs). The IST is numbered 0, and the MSTIs are numbered 1, 2, 3, and so on. An y MSTI is local to the M[...]

18-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T About MST RSTP Port Roles In RSTP , the port roles are defined as follo ws: • Root—A forw arding port elected for the spanning tree topolog y . • Designated—A forw arding port elected for e very switched LAN se gment. • Alternate—An[...]

18-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST About MST Figur e 18-2 Networ k with Inter connected S ST and M ST Region s T o STP running in t he SST region, an MS T region appears as a sing le SST or pseudo bridge, whic h operates as follows: • Although t he valu es for root identif iers an[...]

18-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T About MST MST Instances W e support 65 instances including i nst ance 0. Each spanning tree instance is identified by an instance ID that ranges from 0 to 40 94. Instance 0 is mandatory and is al ways present. Rest of the inst ances are optiona[...]

18-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST About MST T o form an MST region, bridges can be either of the follo wing: • An MST bridge that is the only member of the MST re gion. • An MST bridge interconnected by a LAN. A LAN’ s designated bridge ha s the same MST configuration as an M[...]

18-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T About MST T o pre v ent a misconf iguration, the PortFast operatio n is turned of f if the port receiv es a BPDU. Y ou can display the conf igured and operational status of PortFast b y using the show spanning-tr ee mst interface command. Link [...]

18-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST MST Configu ration Restrict ions and Guid elines • Do not locate the roo t for some or all of the VLANs inside the PVST+ side of the MST switch because when the MST switch at the boundary receiv es PVST+ BPDUs for all or some of the VLANs on its [...]

18-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring MST This example sho w how to enable MST : Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# spanning-tree mode mst Switch(config)# spanning-tree mst configuration Switch(config-[...]

18-31 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Co nfig uring MST Switch(config-mst)# instance 1 vlan 2000-3000 Switch(config-mst)# no instance 1 vlan 1500 Switch(config-mst)# show pending Pending MST configuration Name [cisco] Revision 2 Instance Vlans mapped -------- --------------------------[...]

18-32 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring MST Switch# show spanning-tree mst ###### MST00 vlans mapped: 11-4094 Bridge address 00d0.00b8.1400 priority 24576 (24576 sysid 0) Root this switch for CST and IST Configured hello time 2, forward delay 15, max age 20, max hops 20 I[...]

18-33 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Co nfig uring MST Switch# show spanning-tree mst 1 interface fastethernet 4/4 FastEthernet4/4 of MST01 is backup blocking Edge port:no (default) port guard :none (default) Link type:point-to-point (auto) bpdu filter:disable (default) Boundary :inte[...]

18-34 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring MST The follo wing examples sho w how to display spann ing tree VLAN conf igurations in MST mode: Switch(config)# spanning-tree mst configuration Switch(config-mst)# instance 1 vlan 1-10 Switch(config-mst)# name cisco Switch(config-[...]

18-35 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP and MST Co nfig uring MST Switch# show spanning-tree mst interface fastethernet 4/4 FastEthernet4/4 of MST00 is backup blocking Edge port:no (default) port guard :none (default) Link type:point-to-point (auto) bpdu filter:disable (default) Boundary :intern[...]

18-36 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 18 Configuring STP an d M S T Configuring MST Bridge ID Priority 32769 (priority 32768 sys-id-ext 1) Address 00d0.00b8.1400 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec Interface Role Sts Cost Prio.Nbr Status ---------------- ---- --- --------- -------- ------------[...]

CH A P T E R 19-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 19 Configuring Flex Links and MAC Address-Table Move Update Flex Links pr ovide a f ast and simplifi ed Layer 2 Link redundanc y mechanism. This chapter describes ho w to confi gure Flex Links o n the Catalyst 4500 series switch. It also describ es how to con figur e the[...]

19-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 19 Configu rin g Flex Links and MAC Address-Table Mo ve Update About Flex Li n ks Flex Links Flex Links are a pair of Layer 2 interfaces (switc h ports or port channels) where one interface is confi gured to act as a backup to the ot her . Users can disable STP and still ret[...]

19-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 19 Configuring Flex Links and MAC Ad dress-Table Move U pdate About Flex Links port reactiv ates, it resumes forwarding traff ic in the preferred VLANs. In addit ion to providin g the redundanc y , this Flex Links pair can be used for load balancing. Also, Fl ex Links VLA N l[...]

19-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 19 Configu rin g Flex Links and MAC Address-Table Mo ve Update MAC Address -Table Move Update MAC Address-Table Move Update In Figure 19-3 , ports 1 and 2 on switch A are con nected to uplink switches B and D through a Fle x Links pair . Port 1 is forwarding traf fic, and p [...]

19-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 19 Configuring Flex Links and MAC Ad dress-Table Move U pdate Configuring Flex Links Figure 1 9-3 MAC Addr ess-T ab le Mov e Up date Example Configuring Flex Links These sections contain this configu ration informatio n: • Defa ult Conf iguration, page 19-5 • Conf igurati[...]

19-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 19 Configu rin g Flex Links and MAC Address-Table Mo ve Update Configuring Flex Lin ks Configuration Guidelines Follo w these guidelines to conf igure Flex Links and associated features: • Y ou can confi gure only one Fle x Link backup link for any acti ve link, and it mu [...]

19-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 19 Configuring Flex Links and MAC Ad dress-Table Move U pdate Configuring Flex Links T o disable a Flex Links backup interface, enter the no switchport backup interface interface-id interface configuration command. This exampl e show s how to co nfigure an interfa ce with a b[...]

19-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 19 Configu rin g Flex Links and MAC Address-Table Mo ve Update Configuring Flex Lin ks T o remov e a preemption scheme, ente r the no switchport backup interface interface-id preemption mode interface conf iguration command. T o reset the dela y time to the default, en ter t[...]

19-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 19 Configuring Flex Links and MAC Ad dress-Table Move U pdate Configuring Flex Links When both interf aces are up, Fast Ethernet port 1/0/8 forward s traf f i c for VLANs 60 and 100 to 120 and Fast Ethern et port 1/0/6 forw ards traff ic for VLANs 1 to 50. Switch# show interf[...]

19-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 19 Configu rin g Flex Links and MAC Address-Table Mo ve Update Configuring MAC Addres s- Table Move Update Configuring MAC Address-Table Move Update These sections contain this configu ration informatio n: • Defa ult Conf iguration, page 19-5 • Conf iguration Guidelin e[...]

19-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 19 Configuring Flex Links and MAC Ad dress-Table Move U pdate Con figuring MAC Address-Table Move Update T o disable the MA C address-table move updat e feature on the access switch, enter the no mac address-t able move update transmit interface conf iguration command. T o d[...]

19-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 19 Configu rin g Flex Links and MAC Address-Table Mo ve Update Monitoring Flex Links and the MAC Address-Ta ble Move Update Configuring a Switch to Receive MAC Address-Table Move Updates T o configure a switch to recei ve and process MA C address-table mov e update messages[...]

CH A P T E R 20-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 20 Configuring Resilient Ethernet Protocol This chapter descri bes how to use Resilient Ethernet Protocol (REP) on the Ca talyst 4500 series sw itch. REP is a Cisco proprietary protoco l that provides an alternati ve to Spanning Tree Protocol (STP) to control netw ork lo[...]

20-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilie nt Ethern et Protoc ol About REP Figur e 20-1 REP Open Segments The segment sho wn in Figure 20-1 is an open segment; there is no connecti vity between the two edge ports. The REP segment cannot cause a brid ging loop and it is safe to connect the seg[...]

20-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilient Ethern et Protocol About REP Y ou can construct almost any type of network ba sed on REP segments. REP also supports VLAN load balancing, co ntrolled b y the primary edge port b ut occurring at any port in the seg ment. In access ring topologies, th [...]

20-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilie nt Ethern et Protoc ol About REP Link Integrity REP does not use an end-to-end pollin g mechanism between edge ports to v erify link integrity . It implements local link failure detecti on. When enabled on an interface, the REP Link Status Layer (LSL)[...]

20-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilient Ethern et Protocol About REP The neighbor of fset number range is –256 to +256; a val ue of 0 is in valid. The primary edge p ort has an of fset number of 1; positiv e numbers above 1 identify do wnstream neighbors of the primary edge port. Ne gati[...]

20-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilie nt Ethern et Protoc ol About REP When VLAN load balancing is triggered, t he primar y edge port then sends out a message to alert all interfaces in th e segment about t he preemption. When th e message is rece iv ed by the second ary edge port, it is [...]

20-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilient Ethern et Protocol Configuring REP Configuring REP A segment is a collection of ports connected one to the other in a ch ain and configured with a segment ID. T o conf igure REP se gments, you should co nf igure the REP administrati ve VLAN (or use t[...]

20-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilie nt Ethern et Protoc ol Configuring REP • Y ou cannot ru n REP and ST P on the sam e segment or interface. • If you conn ect an STP network to the REP se gment, be sure that the connection is at the se gment edge. An STP connection that is not at t[...]

20-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilient Ethern et Protocol Configuring REP T o conf igure the REP administrati ve VLAN, perform this task: This exampl e shows ho w to conf igure the administrati ve VLAN as VLAN 100 and veri fy the configuration b y entering the show interfac e rep detail c[...]

20-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilie nt Ethern et Protoc ol Configuring REP T o enable and conf igure REP on an interface, perform this task: Command Purpose Step 1 Switch# configure terminal Enters global conf iguration mode. Step 2 Switch(config)# interface interface-id Specifies the [...]

20-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilient Ethern et Protocol Configuring REP Step 4 Switch(config-if)# rep segment segment-id [ edge [ no-neighbor ] [ primary ]] [ preferred ] Enables REP on the interface, and identifies a se gment number . The segment ID r ange is from 1 to 1024. These opt[...]

20-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilie nt Ethern et Protoc ol Configuring REP Enter the no form of each command to retu rn to the defaul t confi gu r at io n. Enter the show r ep topology pri vileged EXEC co mmand to see which port in the se gment is the primary edge port. This example sh[...]

20-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilient Ethern et Protocol Configuring REP This exampl e shows ho w to configu re the same conf iguration when the interf ace has no external REP neighbor: Switch# configure terminal Switch (config)# interface gigabitethernet1/1 Switch (config-if)# rep segm[...]

20-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 20 Configuri ng Resilie nt Ethern et Protoc ol Monitoring REP Configuring SNMP Traps for REP T o conf igure the switch to send REP-specif ic traps to notify the SNMP server of link operational status changes and port role cha nges, perform this task: T o remove the trap, en[...]

CH A P T E R 21-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 21 Configuring Optional STP Features This chapter describes the Spannin g T ree Protocol (S TP) features supported on the Catalyst 4500 series switch. It also pro vides guidelines, procedur es, and conf iguration ex amples. This chapter includ es the follo w ing major se[...]

21-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features About Root Guard Note For complete syntax and usage info rmation for the switch commands used in this chapte r, look at the Cisco Catalyst 4500 Series Switc h Command Refer ence and related publications at thi s location: http://www .cisc[...]

21-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features About Loop Guard interface FastEthernet5/8 switchport mode access spanning-tree guard root end Switch# This exampl e shows ho w to determine whether any ports are in root inconsistent state: Switch# show spanning-tree inconsistentports Nam[...]

21-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features About Loop Guard Figur e 21 -1 T riang ular S witch Conf iguratio n with Loop Guar d Figure 21-1 ill ustrates the follo wing configuration: • Switches A and B are distribution switches. • Switch C is an access switch. • Loop guard i[...]

21-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features En abling Lo op Guard – If a channel is block ed by loo p guard and the channel breaks, spanning tree loses all the state information. The i ndi vidual physical por ts may obtai n the forw arding state with the designated role, e ven if [...]

21-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features About EtherChannel Gua rd This exampl e show s how to enable loop guard on port 4/4: Switch(config)# interface fastEthernet 4/4 Switch(config-if)# spanning-tree guard loop Switch(config-if)# ^Z This exampl e show s how to verify the conf [...]

21-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features About PortFast T o disable the EtherChannel gu ard feature, use the no spanning-tree ether channel guard misconf ig global conf iguration command. Use the show interfaces status err-disabled pri vileged EXEC command to sho w which switch p[...]

21-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features About BPDU Gu ar d This exa mple sho ws how to enab le PortFas t on Fast Ethernet interf ace 5/8: Switch(config)# interface fastethernet 5/8 Switch(config-if)# spanning-tree portfast Switch(config-if)# end Switch# This exampl e shows ho w[...]

21-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features Enabling BPDU Guard Enabling BPDU Guard T o enable BPDU guard to shut down PortFast-configu red interf aces that rece i ve BPDUs, perform this task: This e xample sho ws how to enable BPDU g uard: Switch(config)# spanning-tree portfast bpd[...]

21-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features Enabling PortFast BPDU Filtering When you enable PortFast BPDU f iltering globally and set the p ort conf iguration as the defa ult for PortFast BPDU filtering (se e the “Enabling BackboneFast” section o n page 21-16 ), PortFast enab[...]

21-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features About UplinkFast Note For PVST+ information, see Chap ter 18, “Conf iguring STP and MST . ” T o enable PortF ast BPDU filt ering, perform this task: This exampl e show s how to enable PortFast BPDU filteri ng on port 4/4: Switch(confi[...]

21-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features Enabling UplinkFast Figure 21-2 sh ows an example of a topolog y with no link fa ilures. Switch A, the root switch , is connected directly t o Switch B ov er link L1 and to Switch C ov er link L2. The Layer 2 interface on Switch C that i[...]

21-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features Enabling UplinkFast Note When you enable UplinkFa st, it affects all VLANs on the swit ch . Y ou cannot configure Upli nkFast on an indi vidual VLAN. T o enable UplinkF ast, perform this task: This e xample sho ws how to enable UplinkF as[...]

21-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features About BackboneFast About BackboneFast BackboneFast is a complementary tech nology to UplinkF ast. UplinkF ast is designed to quickly respond to fail ures on links directly co nnected to leaf-node swi tches, b ut it does not help w ith in[...]

21-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features About BackboneFast Next, assume t hat L1 fails. Swit ch A and Switch B, the switches directly co nnecte d to this s egment, instantly kno w that the li nk is do wn. The blocking i nterface on Switch C must enter the forwarding state for t[...]

21-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features Enabling Backbo neFast Figure 21 -6 Adding a Switch in a Shar ed-M edium T opology Enabling BackboneFast Note For BackboneF ast to work, you must enable it on all sw itch es in the network. Backb oneFast is supported for use with third-p[...]

21-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features Enabling BackboneFast Number of RLQ request PDUs received (all VLANs) : 0 Number of RLQ response PDUs received (all VLANs) : 0 Number of RLQ request PDUs sent (all VLANs) : 0 Number of RLQ response PDUs sent (all VLANs) : 0 Switch# This e[...]

21-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 21 Configuring Optional STP Features Enabling Backbo neFast Number of RLQ request PDUs received (all VLANs) :0 Number of RLQ response PDUs received (all VLANs) :0 Number of RLQ request PDUs sent (all VLANs) :0 Number of RLQ response PDUs sent (all VLANs) :0 Switch#[...]

CH A P T E R 22-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 22 Configuring EtherChannel and Link State Tracking This chapter describes how to use the command-lin e interface (CLI) to configure EtherChannel on the Catalyst 45 00 series switc h Layer 2 o r Layer 3 int e rfaces. It also provides guidelines, procedures, and configura[...]

22-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking About EtherChannel About EtherChannel EtherChannel b u ndles up to eight ind ividu al Ethernet links into a singl e logical ink that pro vides an aggregate band width of up to 800 Mbps (F ast EtherChannel), 8 Gbps (Gigabi[...]

22-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking About EtherChannel Configuring EtherChannels These subsections describe ho w EtherChannels are conf igured: • EtherChannel Conf iguration Over view , page 22-3 • Manual EtherChann el Configuration, pag e 22-3 • P AgP [...]

22-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking About EtherChannel The protocol learn s the capabilities of LAN port groups dynamical ly and informs the other LAN ports. Once P AgP identif ies correctly matched Ethernet li nks, it facilit ates grouping the lin ks into [...]

22-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking EtherChannel Configuration Guide lines and Restrictions • LA CP admi nistrati ve k e y—LA CP automaticall y confi gures an admini strati ve ke y v alue equal to th e channel group identif ication numb er on each port co[...]

22-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking Configuring EtherCh ann el • F or Layer 2 EtherChannels: – Assign all interfaces in the EtherChannel to the same VLAN, or configur e them as trunks. – If you conf igure an EtherChannel from trunk int erfaces, verif [...]

22-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking Configuring EtherChannel These sections describe Layer 3 EtherChannel conf iguration: • Creating Port Ch annel Logical Interfaces, page 22-7 • Conf iguring Physical Interf aces as Layer 3 EtherChannels, page 22-7 Creati[...]

22-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking Configuring EtherCh ann el This exampl e show s how to confi gure Fast Et hernet interfaces 5 /4 and 5/5 into port chan nel 1 with P AgP mode desirable : Switch# configure terminal Switch(config)# interface range fastethe[...]

22-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking Configuring EtherChannel Timers: H - Hello timer is running. Q - Quit timer is running. S - Switching timer is running. I - Interface timer is running. Local information: Hello Partner PAgP Learning Group Port Flags State T[...]

22-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking Configuring EtherCh ann el Number of aggregators: 2 Group Port-channel Protocol Ports ------+-------------+-----------+----------------------------------------------- 1 Po1(SD) LACP Gi1/23(H) Gi1/24(H) Switch# Configurin[...]

22-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking Configuring EtherChannel interface Port-channel2 switchport access vlan 10 switchport mode access end Switch# The follo wing two examples sho w how to v erify the conf iguration of Fast Ethernet interf ace 5/6: Switch# sho[...]

22-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking Configuring EtherCh ann el 0 00 Fa5/7 Time since last port bundled: 00h:23m:33s Fa5/6 Switch# Configuring LACP Standalone or Independent Mode This feature is particularly rele v ant when a port (A ) in a Layer 2 LA CP Et[...]

22-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking Configuring EtherChannel end Switch# This example show s how to v erify th e state of port channel interface 1: Switch# show etherchannel 1 port-channel Port-channels in the group: --------------------------- Port-channel:[...]

22-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking Configuring EtherCh ann el This exampl e shows ho w to verify the conf iguration: Switch# show lacp sys-id 23456,0050.3e8d.6400 Switch# The system priority is displaye d first, follo wed by the MA C address of the switch[...]

22-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking Configuring EtherChannel IPv6: Source XOR Destination IP address Switch# Removing an Interface from an EtherChannel T o remove an Ethernet interface from an EtherChann el, perform this tas k: This example sho ws how to rem[...]

22-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking Displaying EtherChann el to a Virtual Switch Syste m Displaying EtherChannel to a Virtual Switch System Catalyst 4500 series switches support enhanced P AgP . If a Catalyst 4500 series switc h is connected to a Catalyst [...]

22-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking Displaying Et herChannel to a Virtual Switch System remote switch stores the ne w activ e ID and immedi ately transmits asynchrono us P AgP messages with TL Vs containing the new acti ve ID. Upon r eceiving th e ne w activ[...]

22-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking Understanding Link-State Trac king Displaying EtherChannel Links to VSS T o display the dual-acti ve detectio n capability of a conf igured P AgP port channel, enter the show pagp port_c hannel_number dual-active command[...]

22-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking Understanding Link-State Tracking Figure 22-3 on p age 22-20 sho ws a network configu red with link-state tracking. T o enable link-state tracking, create a link-state g roup, and specify the interfaces that are assi gned [...]

22-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking Understanding Link-State Trac king As an example of a connectivity change from link-s tate g roup 1 to link-state group 2 on switch A, see Figure 22-3 on page 22-20 . If the upstream link for port 6 is lost, the link sta[...]

22-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State Tracking Configuring Link -State Tracking Configuring Link-State Tracking These sections describe ho w to configure li nk-state tracking ports: • Defaul t Link-State T racking Configurati on, page 22-21 • Link-State T racking C[...]

22-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 22 Configuring Et herChannel and Link State T racking Configuring Link-S tate Tr ack ing This exampl e show s how to create a link- state group and configure the interf ac es: Switch# configure terminal Switch(config)# link state track 1 Switch(config)# interface gigabiteth[...]

CH A P T E R 23-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 23 Configuring IGMP Snooping and Filtering This chapter describes ho w to configure Internet Group Management Protocol (IGMP) snooping on th e Catalyst 4500 series switch. It provides guidelines, procedures, an d config uration examples. This chapter consis ts of the fol[...]

23-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering About IGMP Snooping • IGMP Snoopin g Querier , page 23-4 • Explicit Host T racking, page 23-4 Note Quality of service does not apply to IG MP packets. IGMP snooping allo ws a switch to snoop or capture informatio n from IGM[...]

23-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering About IGMP Snooping In contrast, IGMPv3 hosts send IG MPv3 membership reports (with the allow group record mode) to join a specif ic multicast group. When IGMPv3 hosts send membership reports (with the block group re cord) to reject[...]

23-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering About IGMP Snooping IGMP Configurable-Leave Timer Immediate-leav e processing cannot be used on VL ANs where multipl e hosts may be connected to a single interface. T o reduce leave latency in such a scenario, IGMPv3 provides a[...]

23-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Configuring IGMP Snooping Configuring IGMP Snooping Note When configuring IGMP , configure the VL AN in the VLAN database mode. See Chapter 13, “Configuring VLANs, VTP , and VMPS. ” IGMP snooping allo ws switches to ex amine IGM[...]

23-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Configuring IGMP Snooping Enabling IGMP Snooping Globally T o enable IGMP snooping globall y , perform this task: This exampl e show s how to enable IGMP snooping glo bally and verify t he conf iguration: Switch# configure term[...]

23-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Configuring IGMP Snooping This exampl e show s how to enable IGMP snooping on VLAN 2 and veri fy the conf iguration: Switch# configure terminal Switch(config)# ip igmp snooping vlan 2 Switch(config)# end Switch# show ip igmp snoopin[...]

23-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Configuring IGMP Snooping This exampl e show s how to configu re IP IGMP snooping to learn from CGMP self-join pack ets: Switch# configure terminal Switch(config)# ip igmp snooping vlan 1 mrouter learn cgmp Switch(config)# end [...]

23-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Configuring IGMP Snooping This exampl e show s how to en able IGMP immediate-lea ve processing on interface VLAN 200 and to verify the conf iguration: Switch# configure terminal Switch(config)# ip igmp snooping vlan 200 immediate-le[...]

23-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Configuring IGMP Snooping Switch# show ip igmp snooping show ip igmp snooping Global IGMP Snooping configuration: ----------------------- ------------ IGMP snooping : Enabled IGMPv3 snooping : Enabled Report suppression : Enab[...]

23-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Configuring IGMP Snooping For an e xample of how to display Sn ooping Querier information , refer to the “Displaying IGMP Snooping Quer ier Information” section on page 23 -19 . Configuring Explicit Host Tracking For IGMP v3, E[...]

23-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Configuring IGMP Snooping This exampl e show s how to configu re a host statically in V LAN 200 on interface F ast Ethernet 2/11: Switch# configure terminal Switch(config)# ip igmp snooping vlan 200 static 0100.5e02.0203 inter[...]

23-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Configuring IGMP Snooping When the spanni ng tree protocol is runnin g in a VLAN, a spanning tree t opology change notif ication (TCN) is issued by the root switch in the VLAN. A Ca talyst 4500 series switch that recei ves a TCN in[...]

23-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Displaying IGMP Sn ooping Information T o establ ish an I GMP query thresho ld, perf orm thi s task: This example sh ows ho w to modify the switch to stop floodi ng multicast traf fic after four queries: Switch(config)# ip igm[...]

23-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Displaying IGMP Snooping Information • Displaying MA C Address Multic ast Entries, page 23-18 • Displaying IGMP Snooping Informatio n on a VLAN Inte rface, page 23-18 • Conf iguring IGMP Filtering, page 23-20 Displaying Queri[...]

23-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Displaying IGMP Sn ooping Information 40.40.40.2/224.10.10.10 Gi4/1 20.20.20.20 00:23:37 00:06:50 00:20:30 40.40.40.3/224.10.10.10 Gi4/2 20.20.2020 00:23:37 00:06:50 00:20:30 40.40.40.4/224.10.10.10Gi4/1 20.20.20.20 00:39:42 0[...]

23-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Displaying IGMP Snooping Information This exampl e show s how to display the host types and ports of a group in VLAN 1: Switch# show ip igmp snooping groups vlan 10 226.6.6.7 Vlan Group Version Ports -------------------------------[...]

23-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Displaying IGMP Sn ooping Information T o display multicast router interfaces, perform this task: This example sh ows ho w to display the multicast router interf aces in VLAN 1: Switch# show ip igmp snooping mrouter vlan 1 vla[...]

23-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Displaying IGMP Snooping Information This exampl e show s how to display IGMP snooping informati on on VLAN 5: Switch# show ip igmp snooping vlan 5 Global IGMP Snooping configuration: ----------------------------------- IGMP snoopi[...]

23-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Configuring IGMP Filtering Vlan 2: IGMP switch querier status ------------------------------------------------ admin state : Enabled admin version : 2 source IP address : 1.2.3.4 query-interval (sec) : 55 max-response-time (se[...]

23-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Configuring IGMP Filtering Configuring IGMP Profiles T o conf igure an IGMP prof ile and to enter IGMP prof ile configuration mode, use th e ip igmp pro fil e global configuration com mand. From th e IGMP profile configuration mode[...]

23-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Configuring IGMP Filtering T o delete a profile, use the no ip ig mp prof ile pr ofile number global conf iguration command. T o delete an IP multicast address or ra nge of IP multicast addresses, use the no range ip mult icas[...]

23-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 23 Configuri ng IGMP Snooping and Filtering Configuring IGMP Filtering Switch# show running-config interface fastethernet2/12 Building configuration... Current configuration : 123 bytes ! interface FastEthernet2/12 no ip address shutdown snmp trap link-status ip igmp max-gro[...]

23-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 23 Configu r in g IGMP Snoopin g an d Filtering Displaying IGMP Filte ring Configuration interface FastEthernet2/12 no ip address shutdown snmp trap link-status ip igmp max-groups 25 ip igmp filter 4 end Displaying IGMP Filtering Configuration Y ou can display IGMP profile [...]

CH A P T E R 24-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 24 Configuring IPv6 MLD Snooping Note IPv6 MLD Snooping i s only suppo rted on Cata lyst 49 00M, Cataly st 4948E, Supe rvisor Engine 6-E, and Supervisor Engin e 6L-E. Use Multicast Listener Discovery (M LD) snooping to enable ef ficient d istribution o f IP version 6 (IP[...]

24-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 24 Config uring IPv6 M LD Sn ooping About MLD Snooping MLD is a protocol used b y IPv6 multicast routers to disco ver the pr esence of multicast listeners (nodes that want to receiv e IPv6 multic ast packets) on its di rectly attached links and to discover which multicast pa[...]

24-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 24 Configuring IPv6 MLD Sn ooping About MLD Snooping MLD Queries The switch sends out MLD queries, const ructs an IPv6 multicast ad dress database, and generates MLD group-specif ic and MLD group-and-source-specif ic queri es in response to MLD Done messages. The switch also [...]

24-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 24 Config uring IPv6 M LD Sn ooping About MLD Snooping MLD Reports The processing of MLDv1 join messages is e ssent ially the same as with IGMPv2. When no IPv6 multicast routers are detected in a VLAN, reports are not processed or forwarded from the switch. When IPv6 multica[...]

24-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 24 Configuring IPv6 MLD Sn ooping Configuring IPv6 MLD Snooping confi guration command. The def ault is to send tw o queries. The switch also generates MLDv 1 global Done messages with v alid link-local IPv6 source addre sses when the swit ch becomes the STP root in the VLAN [...]

24-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 24 Config uring IPv6 M LD Sn ooping Configuring IPv6 MLD Snooping MLD Snooping Configuration Guidelines When config uring MLD snooping, consider these guidelines: • Y ou can confi gure MLD snooping characteristics at an y time, but you must glob ally enable MLD snooping b [...]

24-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 24 Configuring IPv6 MLD Sn ooping Configuring IPv6 MLD Snooping T o disable MLD snooping on a VLAN inte rface, use the no ipv6 mld snooping vlan vlan-id global confi guration command for t he specifi ed VLAN number . Configuring a Static Multicast Group Hosts or Layer 2 ports[...]

24-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 24 Config uring IPv6 M LD Sn ooping Configuring IPv6 MLD Snooping Note Static connections t o multicast routers are supported on ly on switch ports. T o add a multicast router port to a VLAN, follow these steps: T o remov e a multicast router port fro m the VLAN, use the no [...]

24-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 24 Configuring IPv6 MLD Sn ooping Configuring IPv6 MLD Snooping T o disable MLD Immediate Leave on a VLAN, use the no ipv6 mld snooping vlan vlan-id immediat e-leave global config uration command. This e xample sho ws how to enable MLD Immedi ate Lea ve on VLAN 1 30: Switch# [...]

24-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 24 Config uring IPv6 M LD Sn ooping Configuring IPv6 MLD Snooping This example sho ws how to set the MLD sn ooping glo bal robustness v ariable to 3: Switch# configure terminal Switch(config)# ipv6 mld snooping robustness-variable 3 Switch(config)# exit This exampl e show s[...]

24-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 24 Configuring IPv6 MLD Sn ooping Displaying MLD Snooping Information Displaying MLD Snooping Information Y ou can display MLD snooping i nformation for dynami cally lear ned and statically conf igured router ports and VLAN interfaces. Y ou can also display MA C address mult[...]

24-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 24 Config uring IPv6 M LD Sn ooping Displayi n g MLD Sn ooping Information[...]

CH A P T E R 25-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunneling V irtual priv ate networks (VPNs) provide enterprise-s cale connecti vity on a shar ed infrastr ucture, often Ethernet-based, with the same secu rity , prioritization, reliability , and managea[...]

25-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling About 802.1Q Tunneling About 802.1Q Tunneling The VLAN ranges required by dif ferent customers in the same service provider netw ork might ov erlap, and customer traf f ic through the infrastruct[...]

25-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunnelin g Configuring 802.1Q Tunneling Figur e 25-2 Or iginal (Nor mal) , 802.1Q, and Double-T agged Ether net P ack et For mats When the packet enters the trunk port of the serv ice provider egress switch ,[...]

25-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling Configuring 802.1Q Tunn eling Native VLANs When config uring 802.1Q tunneling o n an edge switch, you must use 802.1Q trunk po rts for sending packets into the service provider network. Howe ver [...]

25-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunnelin g Configuring 802.1Q Tunneling Figure 25-3 P otential Pr oblem with 802.1Q T unnelin g and Native VLANs System MTU The default system MTU for traf fic on the Catalyst 4500 series switch is 1500 bytes[...]

25-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling Configuring 802.1Q Tunn eling • EtherChannel port grou ps are compatible with tunnel ports as long as the 802.1Q conf iguration is consistent within an EtherChannel port group. • Port Aggre g[...]

25-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunnelin g About VLAN Mapping Switch(config-if)# exit Switch(config)# vlan dot1q tag native Switch(config)# end Switch# show dot1q-tunnel interface gigabitethernet2/7 Port ----- LAN Port(s) ----- Gi2/7 Switch[...]

25-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling About VLAN Mapping Figure 25-4 La yer 2 VPN Deplo yment All forwarding operations on the Catalyst 4500 se ries switch are performed using S-VLAN and not C-VLAN informat ion because the VLAN ID is[...]

25-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunnelin g Configuring VLAN Ma pping Mapping Customer VLANs to Service-Provider VLANs Figure 25-5 sho ws a topology where a customer uses the sa me VLA Ns in multip le sites on different sides of a service-pr[...]

25-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling Configuring VLAN Mapping VLAN Mapping Configuration Guidelines Guidelines include t he follo wing: • T radi tional QinQ uses 802.1Q tunnel po rts; you conf igure one-to-one VLAN mapping and se[...]

25-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunnelin g Configuring VLAN Ma pping Configuring VLAN Mapping The follo wing procedures sh o w ho w to config ure each type o f VLAN mapping on trunk port s. T o verify your configuration, enter either the s[...]

25-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling Configuring VLAN Mapping Switch(config-if)# switchport vlan mapping 4 104 Switch(config-if)# switchport vlan mapping 4 105 Switch(config-if)# exit In the pre vious exampl e, at the ingress of th[...]

25-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunnelin g Abou t Layer 2 Protocol Tunneling Use the no switchport vlan mapping vlan-id dot1q-tunnel ou ter vlan-id comm and to remov e the VLAN mapping conf iguration. Entering the no switchport vlan mappin[...]

25-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling About Layer 2 Proto col Tunneling • VTP pro vides consistent VLAN conf iguration thro ughout the customer netw ork, propagating to all switches through the service provider . Layer 2 protocol [...]

25-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunnelin g Configuring Layer 2 Protocol Tu nneling Figur e 25-7 La yer 2 Networ k T opol ogy without Pr oper Conver gence Configuring Layer 2 Protocol Tunneling Y ou can enable Layer 2 protocol tunneling (by[...]

25-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling Configuring La yer 2 Protocol Tunneling • Layer 2 Protocol T unneling Conf iguration Guidelines, p age 25-16 • Conf iguring Layer 2 T u nneling, page 25-17 Default Layer 2 Protocol Tunneling[...]

25-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunnelin g Configuring Layer 2 Protocol Tu nneling • Because tunneled PDUs (especially STP BPDUs) must be deliv ered to all remote sites so that the customer virtual networ k operates properly , you can gi[...]

25-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling Configuring La yer 2 Protocol Tunneling Use the no l2protocol-tunnel [ cdp | stp | vtp ] interf ace configuration command to disable protocol tunneling for one of the Layer 2 protocols or for al[...]

25-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunnelin g Monitoring a nd Maintaining Tunneling Status Monitoring and Maintaining Tunneling Status T able 25-2 sho ws the comman ds for monitoring and mainta in ing 802.1Q and Layer 2 protocol tunneling. No[...]

25-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 25 Configuring 802.1Q Tu nne ling, VLAN Mapping, and Layer 2 Protocol Tunneling Monitoring and Main ta ining Tunneling Status[...]

CH A P T E R 26-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 26 Configuring CDP This chapter describe s how to configure Cisco Disc overy Protocol (CDP) on the Catalyst 450 0 series switch. It also pro vides guidelines, procedur es, and conf iguration ex amples. This chapter includ es the follo w ing major sections: • About CDP [...]

26-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 26 Configur ing CDP Configuring CDP Each CDP-conf igured de vice sends periodic messages to a multicast address. Each de vice advertises at least one address at which it can receive SNMP messages. The adv ertisem ents also contain the time-to-li ve, or holdtime informat ion [...]

26-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 26 Configuring CDP Configuring CDP Enabling CDP on an Interface T o enable CDP on an interf ace, use this command: This example sho ws how to enable CDP on Fast Ethernet interf ac e 5/1: Switch(config)# interface fastethernet 5/1 Switch(config-if)# cdp enable This exampl e sh[...]

26-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 26 Configur ing CDP Configuring CDP This exampl e show s how to clear the CDP counter conf iguration on your switch : Switch# clear cdp counters This exampl e show s how to display information abou t the neighboring equipment: Switch# show cdp neighbors Capability Codes: R -[...]

CH A P T E R 27-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 27 Configuring LLDP, LLDP-MED, and Location Service This chapter describe s how to configure the Link Layer Discovery Protocol (LLDP), LLDP Media Endpoint Discov ery (LLDP-MED) , and Location Service on the Catalyst 45 00 series switch. Note For complete syntax and usage[...]

27-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Service About LLDP, LLDP-MED, and Loca tion Ser vice LLDP supports a set of attrib utes that it uses to discov er neighbor dev ices. Th es e att ri b ut es c on tai n ty pe, length, and value descriptions and are referred to as TL [...]

27-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Ser vic e About LLDP, LLDP-MED, and Location Service • In ventory man agement TL V Allo ws an endpoint to send detailed in ventory in formation abo ut itself to the switch, including information hardware re vision, firmware v ersi[...]

27-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Service Configuring LLDP and LLDP -ME D, and Location Service • De vice category is specif ied as a wir ed station • State is specified as Connected • Serial number , UDI • Model number • Software v e rsion • VLAN ID an[...]

27-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Ser vic e Configuring LLDP and LLDP-M ED , and Location Service Configuring LLDP Characteristics Y ou can configure t he frequency of LLDP updates, the amo unt of time to hold the information before discarding it, the init ializatio[...]

27-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Service Configuring LLDP and LLDP -ME D, and Location Service This exampl e shows ho w to configure a h o ldtime of 12 0 seconds, a delay time of 2 seconds and an update frequenc y of 30: Switch# configure terminal Switch(config)# [...]

27-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Ser vic e Configuring LLDP and LLDP-M ED , and Location Service This example sho ws how to globally enable LLDP: Switch# configure terminal Switch(config)# lldp run Switch(config)# end Disabling and Enabling LLDP on an Interface LLD[...]

27-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Service Configuring LLDP and LLDP -ME D, and Location Service Configuring LLDP-MED TLVs By default, the sw itch only sends LLDP packets un til it recei ves LLDP-MED packets fr om the end device. The switch continue s to send LLDP-M[...]

27-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Ser vic e Configuring LLDP and LLDP-M ED , and Location Service Configuring Network-Policy Profile T o create a netw ork-policy profile, conf igure the polic y attributes, an d apply it to an interface, perform this task: Use the no[...]

27-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Service Configuring LLDP and LLDP -ME D, and Location Service This exampl e show s how to co nfigure VLAN 10 0 for voice ap plication with CoS and to en able the network-po licy prof ile and network-polic y TL V on an interface: S[...]

27-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Ser vic e Configuring LLDP and LLDP-M ED , and Location Service This exampl e show s how to enable LLDP po wer negotiation on interf ace Gigabit Ethernet 3 /1: Switch# config t Enter configuration commands, one per line. End with C[...]

27-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Service Configuring LLDP and LLDP -ME D, and Location Service Use the no form of each command to return to the default settin g. This exampl e show s how to co nfigu re ci vic location informat ion on the switch: Switch# configure[...]

27-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Ser vic e Monitoring and Maintaining LLDP, LLDP-MED, and Location Service This e xample sho ws how to enable NMSP on a sw itch and set the location noti ficati on time to 10 seconds: Switch# configure terminal Switch(config)# nmsp [...]

27-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 27 Configuring LLDP, LLDP-MED, and Location Service Monitoring and Maintaining LLDP, LLDP-MED, and Location Service show lldp entry entry-name Displays information ab out a specific neighbor . Y ou can enter an asterisk (*) to displa y all neighbors, or you can enter the na[...]

CH A P T E R 28-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 28 Configuring UDLD This chapter describes ho w to configure UniDirecti onal Link Detection (UDLD) Eth er net on a Cataly st switch. This chapter includ es the follo w ing major sections: • About UDLD, page 28 -1 • Defaul t UDLD Conf iguration, page 28-4 • Conf igu[...]

28-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 28 Configuring UDLD About UDLD Starting with Cisco IOS Release 12.2(54)SG, the en hancement Fast UDLD was added, which sup ports timers in the fe w-hundred milliseconds range, whic h enables subsecond unid irectional link detection. W ith Fast UDLD, the time to detect a unid[...]

28-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 28 Configuring UDLD About UDLD Figur e 28-2 F ast UDLD T opology Note For F ast UDLD, Catalyst 4900 M, Catalyst 4948E, Catalyst 4948E-F , Superv isor Engine 6-E, and Supervisor 6L-E support up t o 32 ports. For all other supervisor engines, the limi t is 16 ports. Operation M[...]

28-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 28 Configuring UDLD Default UDLD Configuration Default UDLD Configuration T able 28-1 sho ws the UDLD default conf iguration. Configuring UDLD on the Switch The follo wing sections describe how to conf igure UDLD: • Fast UDLD Guidelines and Restrictions, page 28-4 • Enab[...]

28-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 28 Configuring UDLD Configuring UDLD on the Switch Enabling UDLD Globally T o enable UDLD in aggressi ve or normal mode and to set the conf igurable message timer on all fiber -optic interfaces on the switch, perform t his task: Command Purpose Step 1 Switch# configure termin[...]

28-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 28 Configuring UDLD Configuring UDLD on the Switch Enabling UDLD on Individual Interfaces T o enable UDLD on indi vidual interfaces, perform this task: Command Purpose Step 1 Switch(config-if)# udld port Switch(config-if)# udld port aggressive Switch(config-if)# udld fast-he[...]

28-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 28 Configuring UDLD Configuring UDLD on the Switch Disabling UDLD on Individual Interfaces T o disable UDLD on individual interfaces, perform this task: Disabling UDLD on a Fiber-Optic Interface T o disable UDLD on individual fiber - optic interfaces , perform this task: Comm[...]

28-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 28 Configuring UDLD Configuring UDLD on the Switch Configuring a UDLD Probe Message Interval Globally T o conf igure the time between UDLD prob e messages on ports that are in adv ertisement mode and are currently determined to be bi directional, perform this task: Configuri[...]

28-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 28 Configuring UDLD Displaying UDLD Link Status Displaying UDLD Link Status T o verify link status reported b y UDLD, enter the followi ng command: Switch# show udld neighbors Port Device Name Device ID Port ID Neighbor State ---- ----------- --------- ------- -------------- [...]

28-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 28 Configuring UDLD Displaying UDLD Link Status T o verify st atus for a particular link as repo rted b y Fast UDLD, enter the following command: Switch# show udld fast-hello g1/33 Interface Gi1/33 --- Port enable administrative configuration setting: Enabled / in aggressiv[...]

CH A P T E R 29-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 29 Configuring Unidirectional Ethernet Note Unidirectional Ethernet is not supported o n Catalyst 4900M, Catalyst 4948 E, Su pervisor En gine 6-E, or Supervisor Engin e 6L-E. This chapter describe s ho w to conf igure Unidirect ional Ethernet on the Catalyst 4000 fami ly[...]

29-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 29 Configur ing Unidirectional Ethernet Configuring Unidirectional Ethernet Configuring Unidirectional Ethernet Note Y ou must configure Uni directional Ethernet on the non-blocki ng Gigabit Ethernet Port, which automatically disables UDLD on the port. T o enable Unidirectio[...]

29-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 29 Configuring Unidirectional Ethernet Configuring Unidirectional Eth erne t This exampl e shows ho w to verify the conf iguration: Switch> show interface gigabitethernet 1/1 unidirectional show interface gigabitethernet 1/1 unidirectional Unidirectional configuration mode[...]

29-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 29 Configur ing Unidirectional Ethernet Configuring Unidirectional Ethernet[...]

CH A P T E R 30-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 30 Configuring Layer 3 Interfaces This chapter describes the Layer 3 interfaces on a Cataly st 4500 series switch. It also pr ovides guidelines, proced ures, and configu ration examp les. This chapter includ es the follo w ing major sections: • About Layer 3 Interf ace[...]

30-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces About Layer 3 In terfaces Note On a Catalyst 4500 Series Switch, a p hysical Layer 3 interf ace has MAC address learni ng enabled. This section contains the fo llowi ng subsections: • Logical Layer 3 VLAN Interfaces, page 30-2 • Physical[...]

30-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces About Layer 3 Interfaces Figure 30-2 Physical La yer 3 Interf aces for the Catalyst 450 0 Ser ies S witch Understanding SVI Autostate Exclude T o be up/up, a router VLAN in terface must fulf ill the following general con ditions: • The VLA[...]

30-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces About Layer 3 In terfaces • Output unicast • Output multicast For each count er type, bo th the numb er of pack et s and the total number of b ytes receiv ed or transmit ted are counted. Y ou can collect the se statis tics uniquely for I[...]

30-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces Configuratio n G uidelines Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 53000 bits/sec, 122 packets/sec 5 minute output rate 53000 bits/sec, 122 packets/sec L3 in Switched: ucast: 37522 pkt, 752892 bytes - mcast:[...]

30-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces Configuring Logical Layer 3 VLAN Interfac es Configuring Logical Layer 3 VLAN Interfaces Note Before you can conf igure logical Layer 3 VLAN inte rfaces, you must create and configure the VLANs on the switch, assign VLAN membership to th e L[...]

30-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces Configuring VLANs as Laye r 3 Interface s 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 packe[...]

30-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces Configuring VLANs as Layer 3 Interfaces T o apply SVI Autostate Excl ude, perform this task: This exampl e show s how to apply SVI Autostate Exclude on interface g3/1: Switch# conf terminal Enter configuration commands, one per line. End wit[...]

30-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces Configuring VLANs as Laye r 3 Interface s Configuring IP MTU Sizes Y ou can set the protocol-specific maximu m transmission unit (MTU) size of IPv4 or IPv6 packets that are sent on an interface. For info rmation on MTU limitations, r efer to[...]

30-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces Configuring VLANs as Layer 3 Interfaces The follo wing example sho ws how to co nf igure IPv6 MTU on an interface: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface vlan 1 Swit[...]

30-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces Configuring VLANs as Laye r 3 Interface s This exampl e show s how to enable counters on interf ace VLAN 1: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface vlan 1 Switch(conf[...]

30-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces Configuring Physical Layer 3 Interface s Configuring Physical Layer 3 Interfaces Note Before you can conf igure physical Layer 3 interfaces, you must enable IP r outing if IP routing i s disabled, and specify an IP rou ting protocol. T o co[...]

30-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces Configuring EIGRP Stub Routing line vty 0 4 ! end Configuring EIGRP Stub Routing This section consists of th e follo wing subsections: • About EIGRP Stub Rou ting, page 30-13 • Conf iguring EIGRP Stub Routing, page 30-14 • Monitoring [...]

30-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces Configuring EIGRP Stub Routing Figure 30-3 EIGRP Stub Switch Configuration For more information abou t EIGRP stub routing, see the “Con fig uring EIGRP Stub Routin g” part of the Cisco IOS IP Conf igurati on Guide, V olume 2 of 3: Routi[...]

30-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces Configuring EIGRP Stub Routing Figure 30-4 Simpl e Hu b-and-Spoke Netw o rk The stub routing feature do es not pre vent routes fro m being advertis ed to the remote router . In the exa mp l e i n Figure 30-4 , the remote router can access t[...]

30-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces Configuring EIGRP Stub Routing Figure 30-5 Simpl e Dual-Homed Rem ote T opology Figure 30-5 sh ows a si mple dual-homed remote with one remote ro uter and two distrib ution routers. Both distrib ution routers maintain routes to the co rpora[...]

30-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces Configuring EIGRP Stub Routing network. The use of t he lower band width route that passes using the remote ro uter might cause W AN EIGRP distrib ution routers t o be dropped. Serial lines on distri bution and remote routers could also be [...]

30-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces Configuring EIGRP Stub Routing Note Multi-access interfaces, such as A TM, Ethernet, Frame Relay , ISDN PRI, and X.25, are supported by the EIGRP stub routing feature only when all routers on that interface, except the hub, are conf igured [...]

30-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces Configuring EIGRP Stub Routing (sec) (ms) Cnt Num 0 10.1.1.2 Se3/1 11 00:00:59 1 4500 0 7 Version 12.1/1.2, Retrans: 2, Retries: 0 Stub Peer Advertising ( CONNECTED SUMMARY ) Routes Monitoring and Maintaining EIGRP T o delete neighbors from[...]

30-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces Configuring EIGRP Stub Routing default route learned f rom the neighbors is displaced b y the summary default route, or if the summary route is the only def ault route present, all traf fic desti ned for the default rou te does not lea ve t[...]

30-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 30 Con figuring Layer 3 Interfaces Configuring EIGRP Stub Routing • static • summary This section prov id es config urati on examples for all forms of t he eigrp stub command. The eigr p stub command can be modif ied with seve ral options, and th ese options can be used [...]

30-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 30 Configuring Layer 3 Interfaces Configuring EIGRP Stub Routing[...]

CH A P T E R 31-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 31 Configuring Cisco Express Forwarding This chapter describes Cisco Express Forwarding (C EF) on the Catalyst 450 0 series switch. It also provides guidelines, procedu res, and ex amples to configure this feature. This chapter includ es the follo w ing major sections: ?[...]

31-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 31 Configurin g Cisco Express Forwardin g About CEF CEF provides th e follo wing features: • Impro ves performance ov er the caching schemes of multilayer switches, which oft e n flush the entire cache when information chan ges in the routing tables. • Prov ides load bal[...]

31-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 31 Configuring Cisco Express Forwardin g Catalyst 4500 Series Switch Implementation of CEF Adjacency Types That Require Special Handling In addition to adjacencies for next-hop in terfaces (h ost-route adjacencies), other types of adjacencie s are used to expedite switching w[...]

31-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 31 Configurin g Cisco Express Forwardin g Catalyst 4500 Series Switch Implementation of CEF Figur e 31 -1 Logical L2/L3 Switch Components The integrated swi tching engine performs inter -VLAN routing on logical Layer 3 interf aces with the ASIC hardware. The ASIC hardware al[...]

31-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 31 Configuring Cisco Express Forwardin g Catalyst 4500 Series Switch Implementation of CEF Figur e 31 -2 Hardwar e and Softw ar e Switching Components The integr ated switching engine performs i nter-VLAN ro uting in hardware. The CPU subsystem software support s Layer 3 inte[...]

31-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 31 Configurin g Cisco Express Forwardin g CEF Configuration Restrictions Load Balancing The Catalyst 4500 series switch supports load balancing fo r routing packets in the inte grated switching engine hardware. Load balancing is al ways enabled. It works when multip le ro ut[...]

31-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 31 Configuring Cisco Express Forwardin g Config uring CE F Configuring Load Balancing for CEF CEF load balancing is based on a combinatio n of sour ce and destin ation packet information; it allo ws you to optimize reso urces by distrib uting traff ic ov er mu ltiple paths fo[...]

31-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 31 Configurin g Cisco Express Forwardin g Monitoring and Maintaining CEF Note The include-ports optio n does not apply to software-switched tr aff ic on the Catalyst 4500 series switches. Viewing CEF Information Y ou can view t he collected CEF informatio n. T o view CEF inf[...]

31-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 31 Configuring Cisco Express Forwardin g Monitoring and Maintaining CEF This exampl e shows ho w to display IP unicast statistics for fastethernet 3/1: Switch# show interface fastethernet 3/1 counters detail Port InBytes InUcastPkts InMcastPkts InBcastPkts Fa3/1 7263539133 59[...]

31-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 31 Configurin g Cisco Express Forwardin g Monitoring and Maintaining CEF[...]

CH A P T E R 32-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 32 Configuring Unicast Reverse Path Forwarding Note The feature is only supported o n Catalyst 4900M, Catalyst 49 48E, Supervisor Engine 6-E, and Supervisor Engin e 6L-E . This chapter de scribes the Unic ast Re verse Path F orwarding (Unica st RPF) feature. The Unic ast[...]

32-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 32 Configurin g Unicast Reve rse Path Fo rwarding About Unicast Reverse Path Forwarding About Unicast Reverse Path Forwarding The Unicast RPF feature helps to mitigat e problems th at are caused b y the i ntroduction o f malformed or forged (spoofed) IP source addresses into[...]

32-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 32 Configuring Unicast Reverse Path Forward ing About Unicast Reverse Path Forwarding Step 2 Unicast RPF chec ks to see if the p acket has arri ved on th e best return path to the source, w hich it does by doing a re verse lookup in the FIB table. Step 3 CEF table (FIB) looku[...]

32-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 32 Configurin g Unicast Reve rse Path Fo rwarding About Unicast Reverse Path Forwarding 1/1. If there is a matching path, the pack et is forwarded. There is no re verse entry in t he routing table that routes the customer packet b ack to source addres s 209.165.2 00.225 on i[...]

32-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 32 Configuring Unicast Reverse Path Forward ing About Unicast Reverse Path Forwarding Caution Using optional BGP attrib utes such as weight and lo cal preference, you can modify the best path back to the source address. Modif ication affects the operati on of Unicast RPF . Th[...]

32-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 32 Configurin g Unicast Reve rse Path Fo rwarding About Unicast Reverse Path Forwarding A CLs work well for man y single-homed cust omers; ho wever , there are trade- off s when A CLs are used as ingress fil ters, including two co mmonly referenced limitations: • P acket p[...]

32-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 32 Configuring Unicast Reverse Path Forward ing About Unicast Reverse Path Forwarding Unicast RPF works wi th a si ngle def a ult ro ute. No ad diti onal routes o r rou ting pro tocols e xist. Network 192.168.10.0/22 is a connected network. P ackets arri vi ng from the Intern[...]

32-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 32 Configurin g Unicast Reve rse Path Fo rwarding About Unicast Reverse Path Forwarding Figure 32-4 Unicast RPF Bloc king T raffic in an Asymmetr ical Routing Envir onment Unicast RPF with BOOTP and DHCP Unicast RPF will allo w packets with 0.0.0.0 source and 255.2 55.255.25[...]

32-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 32 Configuring Unicast Reverse Path Forward ing Unicast RPF Configuration Tasks – Ingress filtering applies f ilters to traffi c receiv ed at a network interface fro m e ither int ernal or external netw orks. W ith ingress filterin g, packets that arri ve from other network[...]

32-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 32 Configurin g Unicast Reve rse Path Fo rwarding Unicast RPF Configuration Tasks T o conf igure Unicast RPF , perform the followi ng task: Verifying Unicast RPF T o verify that Uni cast RPF is o perational, use the sho w cef interface command. T he following e xample sho w[...]

32-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 32 Configuring Unicast Reverse Path Forward ing Monitoring and Maintaining Unicast RPF Monitoring and Maintaining Unicast RPF T o monitor and maintain Unic ast RFP , perform this task: Unicast RPF counts the numbe r of packets dropped or suppressed because of malformed or fo[...]

32-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 32 Configurin g Unicast Reve rse Path Fo rwarding Unicast RPF Configuration Exam ple: Inbou nd and Outb ound Filters The sho w access-lists command displays the number of matches found for a specific entry in a specif ic access list. Switch> show access-lists Extended IP[...]

CH A P T E R 33-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 33 Configuring IP Multicast This chapter describes I P multicast routing on the Cataly st 4500 series switch. It also pr ovides procedures and exampl es to config ure IP multicast routing. Note For more detailed inf ormation on IP Multicast, refer to this URL: http://ww [...]

33-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast About IP Multicast to the destination host b y routers. At each point on th e path between source and destination, a r outer uses a unicast routing table to mak e unicast forwarding decisions, based on the IP destination address in the packet. At[...]

33-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast About IP Multicast Figure 33-1 IP Mu lt icast Routing Protocols Internet Group Management Protocol IGMP messages are used by IP multicast hosts to send their loca l Layer 3 sw itch or router a req uest to join a specif ic multicast group and be gin[...]

33-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast About IP Multicast PIM Sparse Mode PIM Sparse Mode (PIM-SM) uses a pull model to deli ver multicast tra f fic. Only netw orks with acti ve recei vers that ha ve explicitly r equested the data are forwa rded the traf fic. PIM-SM is intended for ne[...]

33-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast About IP Multicast IP Multicast Implementation on the Catalyst 4500 Series Switch The Catalyst 4500 series switch supports an ASIC-b ased integ r ated switching engine that provides Ethernet brid ging at Layer 2 and IP routing a t Layer 3. Be cause[...]

33-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast About IP Multicast upper -layer routing table, only one route needs to be changed in the hardw a re ro uting state. T o forward unicast packets in hardw are, the integrated switching en gine looks up source and destination routes in ternary conte[...]

33-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast About IP Multicast The route (*,224.1.2.3) i s loaded in the hardw are FIB table and the list of output interf aces is loaded into the MET . A pointe r to the list of output inte rfaces, the MET index, and the RPF interface are also loaded in the h[...]

33-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast About IP Multicast Figure 33-4 IP Mu lt icast T a bles and Protocols The integrated swi tching engine maintains the hardw are FIB table to identify indi vidual IP multicast routes. Each entry consists of a destination group IP address and an opti[...]

33-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast About IP Multicast Hardware and Software Forwarding The integrated swi tching engine forwards the majority of packets in hardware at very high rates of speed. The CPU subsystem forwards e xception packets in software. Stati stical reports should sh[...]

33-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast About IP Multicast The follo wing conditions cause some rep licas of a packet for a route to be forwarded by the CPU subsystem: • The switch is configured w ith the ip igmp join-group command as a member of the IP multicast group on the RPF in[...]

33-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast About IP Multicast Figur e 33-6 Redundant Mult icast Router Configuration in a Stub Networ k In this kind of to pology , only Router A, the PIM designated router (PIM DR), forw ards data to the common VLAN. Router B recei ves the forwarded mu ltic[...]

33-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast About IP Multicast Multicast Forwarding Information Base The Multicast Fo rwarding Informatio n Base (MFIB) subsystem supports I P multicast routing in the integrated switch ing engi ne hard ware on th e Cataly st 4500 series switch. The M FIB l[...]

33-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast Configuring IP Multicast Routing S/M, 224/4 An (S/M, 224/4) entr y is created in the MFIB for e very multicast-enabled interface. This en try ensures that all packets sent by directly connected neighbors can be regist er -encapsulated to the PIM-S[...]

33-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast Configuring IP Multicast Routing Note Source-specific multicast and IGMP v3 are supported. For more i nformation about source-specif ic multi cast with IGM Pv3 and IGMP , see the follo wing URL: http://www .cisco.com/en/US/ docs/ios/ipmulti/conf[...]

33-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast Configuring IP Multicast Routing encapsulated and sent tow ard the RP . When no RP is kno wn, the packet is flooded in a dense-mode fashion. If the multicast traf fic from a specific source is suf ficient, the receiv er’ s first-hop router can s[...]

33-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast Configuring IP Multicast Routing When an interface is treat ed in sparse mode, it is popul ated in a multicast rou ting table’ s outgoing interface list when either of the following is tru e: • When members or D VMRP neighbors exist on t he [...]

33-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast Configuring IP Multicast Routing For an e xample of how to conf igure bidir-PIM, see the “Bidirectio nal PIM Mode Example” section on page 33-29 . Enabling PIM-SSM Mapping The Catalyst 4500 series switch supports SSM mapping, enabling an SSM t[...]

33-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast Configuring IP Multicast Routing Step 5 Switch(config-if)# ip pim [ sparse-mode | sparse-dense-mode ] Enables PIM sparse or sparse-dense mode on an interface. When conf iguring Auto-RP in sparse mode, you must al so config ure the Auto-RP listen[...]

33-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast Configuring IP Multicast Routing Step 10 Switch(config)# ip pim send-rp-discovery [ interface-type interface-number ] scope ttl-value [ interval seconds ] Conf igures the router to be an RP mapping ag ent. • Perform this step on the RP router on[...]

33-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast Configuring IP Multicast Routing This example illustr ates how to configure Auto-RP: Switch> enable Switch# configure terminal Switch(config)# ip multicast-routing Switch(config)# interface ethernet 1 Switch(config-if)# ip pim sparse-mode Swi[...]

33-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast Configuring IP Multicast Routing T o conf igure a single static RP , perform this task: Command or Action Purpose Step 1 Switch> enable Enables privile ged EXEC mode. Step 2 Switch# configure terminal Enters global config uration mode. Step 3 S[...]

33-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast Configuring IP Multicast Routing This exampl e show s how to configu re a single-static RP: Switch> enable Switch# configure terminal Switch(config)# ip multicast-routing Switch(config)# interface ethernet 1 Switch(config-if)# ip pim sparse-m[...]

33-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast Monitoring and Maintainin g IP Multicast Routing The follo wing example sho ws ho w to enable ECMP multicast load splitt ing on a router based on a source and group ad dress using t he basic S-G -hash a lgorithm: Switch(config)# ip multicast multi[...]

33-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast Monitoring and Maintain ing IP Multicast Routing Switch# show ip mroute cbone-audio IP Multicast Routing Table Flags: D - Dense, S - Sparse, C - Connected, L - Local, P - Pruned R - RP-bit set, F - Register flag, T - SPT-bit set Timers: Uptime/E[...]

33-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast Monitoring and Maintainin g IP Multicast Routing (130.207.8.33/32, 224.2.127.254), 00:00:25/00:02:32, flags: CLJT (131.243.2.62/32, 224.2.127.254), 00:00:51/00:02:03, flags: CLJT (140.173.8.3/32, 224.2.127.254), 00:00:26/00:02:33, flags: CLJT (171[...]

33-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast Monitoring and Maintain ing IP Multicast Routing Source: 128.195.7.62/32, 527/0/118/0 Source: 128.223.32.25/32, 554/0/105/0 Source: 128.223.32.151/32, 551/1/125/0 Source: 128.223.156.117/32, 535/1/114/0 Source: 128.223.225.21/32, 582/0/114/0 Sou[...]

33-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast Monitoring and Maintainin g IP Multicast Routing (10.34.2.92, 239.192.128.80), flags () Packets: 24579/100/0, 2113788/15000/0 bytes Vlan7 (F NS) Vlan100 (A) (*, 239.193.100.70), flags () Packets: 1/0/0, 1500/0/0 bytes Vlan7 (A) .. The fast-switche[...]

33-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast Configuration Examples Switch# show ip pim interface count States: FS - Fast Switched, H - Hardware Switched Address Interface FS Mpackets In/Out 192.1.10.2 Vlan10 * H 40886/0 192.1.11.2 Vlan11 * H 0/40554 192.1.12.2 Vlan12 * H 0/40554 192.1.23.[...]

33-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Multicast Configuration Example s ip multicast-routing ip pim rp-address 10.8.0.20 1 interface ethernet 1 ip pim sparse-mode Bidirectional PIM Mode Example By default, a bidirectio nal RP advertises all groups as bidirectional. Use an access list on the RP [...]

33-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 33 Configuring IP Mu lticast Configuration Examples Sparse Mode with Auto-RP: Example The follo wing example conf igures sparse mode wit h Auto-RP: ip multicast-routing ip pim autorp listener ip pim send-rp-announce Loopback0 scope 16 group-list 1 ip pim send-rp-discovery L[...]

CH A P T E R 34-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 34 Configuring ANCP Client This chapter describes Access-Netw ork Control Protocol (ANCP) Cli ent on Catalyst 4500 series switches. It includes the following sections: • About ANCP Clie nt, page 34-1 • Enabling and Conf iguring ANCP Client, page 34-2 Note For complet[...]

34-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 34 Configuring ANCP Client Enabling and Configuring ANCP Client Note IGMP snooping must be enabled o n an ANCP client (Catalyst 4500 seri es switch) for processing multicast commands (join, lea v e, lea v e all request s, and request for act i ve flo ws report) from the ANCP[...]

34-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 34 Configuring ANCP Clie nt Enabling and Configuring ANCP Client Step 3 (Optional) Enable the ANCP multicast client to identify thi s VLAN interface using the port-identi fier as opposed to the Optio n 82 circuit-id: Switch(config)> ancp client port identifier [ port-ident[...]

34-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 34 Configuring ANCP Client Enabling and Configuring ANCP Client Example 2 ANCP_Client# show ancp multicast interface Fa2/3 vlan 19 ANCP Multicast Streams Interface FastEthernet2/3 VLAN 19: client ID 0x0106000700130203 Group Source Joined on 239.5.6.7 - 15:03:14 UTC Tue Aug 2[...]

34-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 34 Configuring ANCP Clie nt ANCP Guidelin es and Restrictio ns ANCP Guidelines and Restrictions When using (or conf iguring) ANCP , consider these guidelines and restrictions: • Entering a shut co mmand on a port remo v es ANCP acti vated mult icast streams from the por t. [...]

34-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 34 Configuring ANCP Client ANCP Guidelines and Restrict io ns[...]

CH A P T E R 35-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 35 Configuring Policy-Based Routing This chapter describes the tasks fo r configu ring polic y-based routing (PBR) on a Cat alyst 4500 series switch and includes these major sections: • About Polic y-Based Routing, page 35-1 • Polic y-Based Routing Conf iguration T a[...]

35-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 35 Confi guring Polic y-Based Routing About Policy-Based Ro uting Y ou c an set up PBR as a way t o route packets bas ed on configured polici es. For example, you can implement routing polici es to allo w or deny paths based on the i dentity of a particular end system, or an[...]

35-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 35 Configuring Policy-Based Routing About Policy-Based Routing route-map rm-test permit 23 match ip address 101 2102 set interface vlan23 ! route-map rm-test deny 24 match ip address 104 set ip next-hop 24.4.4.1 ! route-map rm-test deny 25 match ip address 105 set ip next-hop[...]

35-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 35 Confi guring Polic y-Based Routing About Policy-Based Ro uting PBR Route-Map Processing Logic Example Consider a route-map called rm-test defined as follo ws: access-list 101 permit tcp host 61.1.1.1 host 133.3.3.1 eq 101 access-list 102 deny tcp host 61.1.1.1 host 133.3.[...]

35-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 35 Configuring Policy-Based Routing About Policy-Based Routing • TCP packet from 6 1.1.1.1 to 133.3.3.1 with desti nation port 105 – Processing mov es from sequence #21 to #24, b ecause all ACLs in these sequence numbers ha ve a deny action for po rt 105. – In sequence [...]

35-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 35 Confi guring Polic y-Based Routing Policy-Based Routing Configuration Tasks • Routing based on dedi cated links Some applications or traf fic can benef it from source-s pecif ic routing; for example, you can tran sfer stock records to a corporate off ice on a higher-ban[...]

35-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 35 Configuring Policy-Based Routing Policy-Bas ed Routing Co nfiguratio n Tasks Step 4 Swit ch(config-route-map)# set interface interface-type interface-number [... type number ] Or Specif ies the output interf ace from which the pack et will be sent. This action specif ies t[...]

35-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 35 Confi guring Polic y-Based Routing Policy-Based Routing Co nfiguration Examples Use the set commands with each other . These commands are ev aluated in the order shown in Step 3 in the pre vious task table. A usable n ext hop impl ies an interface. Once the local swi tch [...]

35-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 35 Configuring Policy-Based Routing Policy-Based Routing Configuration E xamp les Switch (config)# access-list 1 permit ip 1.1.1.1 access-list 1 permit ip 1.1.1.1 ! interface fastethernet 3/1 ip policy route-map equal-access ! route-map equal-access permit 10 match ip address[...]

35-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 35 Confi guring Polic y-Based Routing Policy-Based Routing Co nfiguration Examples route-map Texas permit 10 match ip address 1 set ip next-hop 3.3.3.3 ! route-map Texas permit 20 match ip address 2 set ip next-hop 3.3.3.5[...]

CH A P T E R 36-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 36 Configuring VRF-lite V irtual Priv ate Networks (VPNs) provide a secure way for customers to share bandwidth ov er an ISP backbone network . A VPN is a collection of sit es sharing a common rout ing table. A customer si te is connected to the service provider ne twork[...]

36-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite About VRF-lite • VRF-lite Conf iguration Guidelines, page 36-4 • Conf iguring VRFs, page 36-5 • Conf iguring VRF-A ware Services, page 36-6 • Conf iguring Per -VRF for T A CA CS+ Servers, page 36-9 • Conf iguring Multicast VRFs, page 36-11 ?[...]

36-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Default VRF-lite Configuration Figur e 36-1 Ca t al yst 4500 Ser ies Switc h es Acting as Multipl e Virtual CEs Figure 36-1 ill ustrates the packet-f orwarding proc ess in a VRF-lite CE-enabled network. • When the CE receiv es a packet from a VPN, it[...]

36-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite VRF-lite Configuration Guidelines VRF-lite Configuration Guidelines Consider these points when conf iguring VRF in your netw ork: • A switch with VRF-l ite is shared b y multiple customers, an d all customers ha ve thei r own r outing tables. • Be[...]

36-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Configuring VRFs • Multicast VRF is suppor ted on Supervisor Engine 6- E, Supervisor 6L-E, Catalyst 4900M, and Catalyst 49 48E. • The capability vrf-l ite subcommand under ro uter ospf should be used when configuring OSPF as the routing prot ocol b[...]

36-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Configuring VRF-Aw ar e Se rvices Configuring VRF-Aware Services IP services can be conf igured on gl obal interfaces and withi n the global routing instance. IP services ar e enhanced to run on mu ltiple routing instances; the y are VRF-aware. Any co[...]

36-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Configuring VRF-Aware Services Configuring the User Interface for SNMP T o configure VRF-a ware services for SNMP , perform this task: Configuring the User Interface for uRPF Y ou can configure uRPF on an interface assigned to a VRF . Source lookup is [...]

36-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Configuring VRF-Aw ar e Se rvices Configuring the User Interface for Syslog T o configure VRF-a ware services for syslog, perform this task: Configuring the User Interface for Traceroute T o configure VRF-a ware services fo r traceroute, perform this [...]

36-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Configuring Per-VRF for TACACS+ Servers T o specify the IP address of an interface as th e source address for TFTP connec tions, use the ip tftp source-interface sho w mode command. T o return to the defa ult, use the no form of this command. Configuri[...]

36-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Configuring Per-VRF for TACACS+ Servers . The follo wing example lists all the st eps to configure per -VRF T A CA CS+ : Switch> enable Switch# configure terminal Switch (config)# ip vrf cisco Switch (config-vrf)# rd 100:1 Switch (config-vrf)# exi[...]

36-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Configuring Multicast VRFs Configuring Multicast VRFs T o conf igure multicast within a VRF table, perform this task: For more inf ormation about conf iguring a multicast within a Multi-VRF CE, see the Cisco IOS IP Multicast Conf iguration Guide , Rel[...]

36-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Configuring a VPN Routing Session Configuring a VPN Routing Session Routing within the VPN can be conf i gured with an y supported rou ting pr otocol (RIP , OSPF , or BGP) or with static routing. Th e conf iguration sho wn here is for OSPF , but th e[...]

36-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite VRF-lite Configuration Example Use the no router bgp autonomous-syste m-number global conf iguration command to delete the BGP routing process. Use the command with keyw or ds to delete routing characteristics. VRF-lite Configuration Example Figure 36[...]

36-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite VRF-lite Configuration Example Configuring Switch S8 On switch S8, enable rou ting and conf igure VRF . Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# ip routing Switch(config)# ip vrf v11 Swit[...]

36-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite VRF-lite Configuration Example Switch(config)# interface Vlan20 Switch(config-if)# ip vrf forwarding v12 Switch(config-if)# ip address 83.0.0.8 255.255.255.0 Switch(config-if)# exit Switch(config)# interface Vlan118 Switch(config-if)# ip vrf forwardin[...]

36-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite VRF-lite Configuration Example Configuring Switch S11 Config ure S11 to connect to CE: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# ip routing Switch(config)# interface Gigabit Ethernet 0/3 S[...]

36-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Displaying VRF-lite Stat us Router(config)# router bgp 100 Router(config-router)# address-family ipv4 vrf v2 Router(config-router-af)# neighbor 83.0.0.8 remote-as 800 Router(config-router-af)# neighbor 83.0.0.8 activate Router(config-router-af)# netwo[...]

36-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 36 Configuring VRF-lite Displaying VRF-lite Status Note For more informati on about the information in the displays, refer to the Cisco IOS Switching Servic es Command Refer ence at: http://www .cisco.com/en/US/ docs/ios/ipswitch/command/r eference/isw_book.html[...]

CH A P T E R 37-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 37 Configuring Quality of Service Note QoS functionality on Supervisor Eng ine 6-E, Superv isor Engine 6L-E, Catalyst 4 900M, and Catalyst 4948E are equivalent. This chapter describe s how to configure quality of service (QoS) by using automa tic QoS (auto-Q oS) commands[...]

37-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e About QoS Note For complete syntax and usag e infor mation for the swi tch command s used in thi s chapter , see the Cisco Catalyst 4500 Series Switc h Command Refer ence and related p ublicat ions at t his locat ion: http://www .cisco.com[...]

37-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service About QoS – Layer 2 Inter -Switch Link (ISL) frame headers ha ve a 1-byte User field that carries an IEEE 802.1p class of service (CoS) value in the three least-signif icant bits. On interfaces configured as Layer 2 ISL trunk s, all traf f[...]

37-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e About QoS Switches and routers along th e path can use the class information to limi t the amount of resources allocated per traf fic class. The beha vior of an individu al de vice when handling traf fic in the Dif fServ architecture i s c[...]

37-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service About QoS • Classifi cation is the se lection o f traffi c to be m arked. • Marking , according to RFC 2475, is the process of setting a Layer 3 DSCP valu e in a packet; in this publication, th e defin ition of marking is e xtended to in[...]

37-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e About QoS Basic QoS Model Figure 37-2 sh ows the b asic QoS model (also referred to as Switch QoS mo del; it is not MQC compliant). Actions at the ingress and egress inte rfaces include classifying traff ic, policing, and marking: • Clas[...]

37-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service About QoS For non- IP traff ic, you hav e the follo wing classif ication options: • Use the port def ault. If the packet is a non-IP packet, assign the def ault port DSCP va lue to the incoming packet. • T rust the CoS value in the in co[...]

37-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e About QoS Figur e 37 -3 Classification Flowc hart Ye s Ye s Ye s No No No No No No No No No Ye s Ye s Ye s Ye s Ye s Ye s Read interface configuration for classification. Is there a QoS policy attached to this interface? T rust DSCP? IP Pa[...]

37-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service About QoS Classification Based on QoS ACLs A packet can be classified for Qo S using mu ltiple match criteria, and the classif ication can specify whether the packet should match all of the specif ied match cr iteria or at least one of the m[...]

37-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e About QoS Y ou create a cla ss map by us ing the class-map global conf iguration command. When you enter the class-map command, the switch enters the class map confi guration mode. In this mode, y ou define the match criteria for the traf[...]

37-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service About QoS When config uring policing and po li cers, observ e these gui delines: • On Supervisor Engine 6- E, Supervisor Engine 6L -E, Cat alyst 4900M, an d Catalyst 4948 E, policers account only for the Layer 2 header length when calcula[...]

37-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e About QoS Figur e 37 -4 P olicing and Mar king Flowc hart Star t Use QoS policy on the VLAN Use QoS policy on the por t Done QoS P olicy attached to the por t? Any more QoS ACLs in the policy? P acket match a "permit" ACB in the[...]

37-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service About QoS Internal DSCP Values The follo wing sections describe the internal DSCP values: • Internal DSCP Sour ces, page 37-13 • Egress T oS and CoS Sources, page 37-13 Internal DSCP Sources During processin g, QoS repres ents the prior[...]

37-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e About QoS Mapping Tables During QoS proc essing, the switch repr esents the priority of all traf fic (includ ing non-IP tr af f ic) wit h an internal DSCP v alue: • During classif ication, QoS uses configurable mappin g tables t o deri [...]

37-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service About QoS The follo wing table provides the def a ult DSCP-to-transmit qu eue mapping: For e xample, if you are sending two streams, one wi th a DSCP of 16 and other w ith a valu e of 0, they will transmit from dif ferent queues. Ev en thou[...]

37-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e About QoS Traffic Shaping T raff ic shaping prov ides the ability to control th e rate of outgoing traf fic in ord er to make sure that the traff ic conforms to the maxim um rate of transmissi on contracted for it . T raf f ic t hat me et[...]

37-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Ho wever , Cisco IO S marks all the generated control pa ckets appropriately and uses the internal I P DSCP to determine the transmit queue o[...]

37-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE • Conf iguring the T rust State of Interfaces, page 37-48 • Conf iguring the CoS V alue for an Interface, page 37-49 • Conf iguring D[...]

37-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Configuration Guidelines Before begin ning the QoS conf iguration, you should be a ware of this information: • If you ha ve EtherChannel po[...]

37-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Enabling QoS Globally T o enable QoS globally , perform this task: This exampl e show s how to en able QoS globally and to v erify the conf[...]

37-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Note The qos rewrite ip dscp comman d is not supported on Supervisor Engine 6- E, Supervisor Engine 6L -E, Catalyst 49 00M, and Ca talyst 49 [...]

37-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Note On a gi ven port, the Cisco IP phone disco very information is not maintained on th e standby supervi sor engine. When the standb y su[...]

37-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Enabling DBL Globally T o enable DBL globally on the switch , perform this task: This exampl e show s how to enable DBL globally and v erify [...]

37-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE The follo wing sections describe how to enable the packets: • Enabling DBL on Sp ecific IP DSCP V alues, page 37-24 • Enabling DBL on S[...]

37-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Provided th e val ue has been set according to your network polici es, you must configu re trust DSCP on the ingress interface of the aggre s[...]

37-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Switch(config-pmap-c)# dbl Switch(config-pmap-c)# end Switch# show policy-map cos Policy Map cos Class cos dbl Switch# configure terminal S[...]

37-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE When creating a named aggreg ate policer , note the following: • The v a lid range of values for the rat e parameter is as follows: – Min[...]

37-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE This example sho ws how to create a named aggre gate policer with a ten MBps rate li mit and a one mb burst size that transmits conforming [...]

37-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE • policy-map —Enter the policy-map command to define the follo wing for ea ch class of traff i c: – Internal DSCP source – Aggreg ate[...]

37-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Note Any Input or Outpu t policy that use s a class m ap with the match ip precedence or match ip dscp class-map commands, requires that yo[...]

37-31 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE This examp le shows h ow to co nfigu re match CoS for non-IPv4 traf fic an d ho w to config ure filt ering to match traffic with CoS value of[...]

37-32 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Configuring the Policy-Map Marking State T o conf igure the polic y map to mark the IP precedence or dscp of a packet, enter this command: [...]

37-33 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Configuring Policy-Map Class Policing These sections describe conf iguration of policy-map class pol icing: • Using a Named Aggregate Polic[...]

37-34 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE • Bursts can be entered in b ytes, or you can use the follo w ing abbre viation: – k to denot e 1000 bytes – m to denote 1000000 b yt[...]

37-35 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Verifying Policy-Map Configuration T o verify policy-map conf iguration, perform this task: This exampl e shows ho w to verify the conf igura[...]

37-36 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE This exampl e show s how to at tach the policy m ap named pmap1 to Fa st Ethernet interface 5/36 and to verify the conf iguration: Switch# [...]

37-37 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Class Map match-any c4 Match cos 4 Class Map match-any c5 Match cos 5 Class Map match-any c6 Match cos 6 Class Map match-any c7 Match cos 7 P[...]

37-38 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE A flow is defined as a fi ve-tuple (IP source address, IP destination address, IP head protocol f ield, Layer 4 source, and destination por[...]

37-39 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Example 3 Assume there are two activ e flows on the F ast Et hernet interface 6/1 wi th source addresses 192.168.10.20 and 192 .168.10.21. Th[...]

37-40 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Class-map: c1 (match-all) 2965072 packets Match: flow ip destination-address police: Per-interface Conform: 6105636 bytes Exceed: 476652528[...]

37-41 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Class c1 police 1000000 bps 9000 byte conform-action transmit exceed-action drop Switch# show policy-map interface FastEthernet6/1 Service-po[...]

37-42 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Note In a hierarchal po licer configuratio n with pare nt as aggregat e policer and c hild as microflo w policer , child microflo w policer[...]

37-43 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Conform: 3627000 bytes Exceed: 0 bytes Service-policy : flow-policy Class-map: flow-class (match-all) 8867 packets Match: access-group 20 Mat[...]

37-44 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Figur e 37 -5 Per -P ort P er -VLAN T opolog y The follo wing conf igurati on f ile sho ws ho w to perform ingress and egress pol icing per[...]

37-45 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Switch# configure terminal Switch(config)# interface gigabitethernet 6/1 Switch(config-if)# vlan-range 20,400 Switch(config-if-vlan-range)# s[...]

37-46 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE police: Per-interface Conform: 0 bytes Exceed: 0 bytes GigabitEthernet6/1 vlan 400 Service-policy input: p1 Class-map: class-default (match[...]

37-47 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Note If no input QoS p olicy is attached to a Layer 2 interface, then the input QoS po licy attached to th e VLAN (on which the packet is rec[...]

37-48 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Configuring the Trust State of Interfaces This command configures the trust state of interf aces. By default, all interfaces are untrusted.[...]

37-49 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Configuring the CoS Value for an Interface QoS assigns the CoS value spec ified with this co mmand to untagged frames from in gress interface[...]

37-50 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE This example sho ws how to configure the DSCP 5 as the default on Fast Ethernet interface 5/24: Switch# configure terminal Enter configurat[...]

37-51 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Mapping DSCP Values to Specific Transmit Queues T o map the DSCP values to a transmit queue, perform this task: This exampl e show s how to m[...]

37-52 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE For systems u sing Superv isor En gine II-Plus, Supervisor Engine II-P lus TS, Supervi s or Eng ine III , and Supervisor Engin e IV , bandw[...]

37-53 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE Configuring a High Pr iority Transmit Queue T o conf igure transmit queue 3 at a higher priorit y , perform this task: This exampl e show s h[...]

37-54 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Engines II- Plus , II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE T o modify the CoS-to-DSCP map, perform this task: This exampl e show s how to configu re the ingress CoS-to-DSCP mapping for CoS 0: Switch[...]

37-55 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Supervisor Engi nes II-Plus, II+10GE, IV, V, V-1 0GE, 4924, 4948, and 4948-10GE T o return to the default map, u se the no qos dscp policed global confi guration command. This exampl e show s how to map DSCP 50 to 57 to a[...]

37-56 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring Auto-QoS on Supervisor Engines II- Pl us, II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE T o modify the DSCP-to-CoS map, perform this task: This exampl e shows ho w to map DSCP va lues 0, 8, 16, 24, 32, 40, 48, and 50 to Co[...]

37-57 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring Auto-QoS on Supervisor Engines II-Plus, II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE When you enable auto-QoS, it automa tically classifies traf fic based on ingress packet label. The switch uses the resulting classif icati[...]

37-58 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring Auto-QoS on Supervisor Engines II- Pl us, II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Effects of Auto-QoS on the Configuration When auto-QoS is enabled, the auto qos voip interface conf iguration command and t he generat[...]

37-59 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring Auto-QoS on Supervisor Engines II-Plus, II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Enabling Auto-QoS for VoIP T o enable auto-QoS for V oIP within a QoS domain, perform this ta sk: T o disable auto-QoS on an interface, us[...]

37-60 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring Auto-QoS on Supervisor Engines II- Pl us, II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE This example sho ws ho w to displa y the QoS commands that are au toma tically generated when auto-QoS is enabled: Switch# debug auto [...]

37-61 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring Auto-QoS on Supervisor Engines II-Plus, II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE Figur e 37 -6 A uto-QoS Conf iguration Example Networ k The intelligent wiring closets in Figure 37-6 are compo sed of Catalyst 4500 switc[...]

37-62 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring Auto-QoS on Supervisor Engines II- Pl us, II+10GE, IV, V, V-10GE, 4924, 4948, and 4948-10GE T o conf igure th e switch at the edge of the QoS domain to prioritiz e the V oIP traf f ic o v er all othe r traf f i c, perform this[...]

37-63 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E Configuring QoS on Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M, and Catalyst 4948E Note QoS functionality on Catalyst[...]

37-64 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E by def ault. Only when t he trusted boundary feature is enabled on an interface can the port enter untrusted mode. In this mode, the s[...]

37-65 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E Platform-Supported Classification Criteria and QoS Features The follo wing table provides a summary of v arious classificati on criteri[...]

37-66 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E Platform Hardware Capabilities Prerequisites for Applying a QoS Service Policy Unlike the switch Qo S model, there is no prerequisi te[...]

37-67 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E Policy Map p1 class ipp5 police rate 1 m bur st 200000 If polic y map p1 is applied to interf aces Gig 1/1 and Gig 1/2, one CAM entry i[...]

37-68 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E – 0 Input Policers and 16 K Out put Policers – 2 K Input Policers and 14 K Output Policers – 4 K Input Policers and 12 K Output [...]

37-69 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E Marking Network Traffic Marking netw ork traf fic allo ws you to set or modify th e attributes of traf fic (that is, packets) bel ongin[...]

37-70 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E T raff ic marking allo ws you to determine ho w traff ic w ill be tr eated, ba sed on ho w the attributes for the network tr af f ic a[...]

37-71 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E For info rmation on conf iguring a polic y map, see th e “Creating a Polic y Map” section on page 37-31. The final t ask is to atta[...]

37-72 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E Traffic Marking Procedure Flowchart Figure 37-8 illustrat es the order of the pr ocedures for configuring traf fic marking. Figure 37 [...]

37-73 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E Multi-attribute Marking Support Catalyst 4900M, Catalyst 4948E, Supervi sor Engine 6-E, and Supervisor Engin e 6L-E can mark more than [...]

37-74 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E Configuring Table Map-Ba sed Unconditional Marking T o conf igure table map-based uncondi tional marking , perform this task: The foll[...]

37-75 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E Policy Map police Class ipp5 police cir percent 20 pir percent 30 conform-action set-cos-transmit 3 conform-action set-dscp-transmit af[...]

37-76 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E Dynamic resizing of queues (q ueue limit class- map action) is supp orted using the use of the queue-limit command. Based on the chass[...]

37-77 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E T o delete an existing p olicy map, use the no policy-map policy-map-name global conf iguration command. T o delete an existing cl ass,[...]

37-78 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E Sharing (Bandwidth) The bandwidth assigned to a class of t raf fic i s the minimum bandwidth that is guaranteed to the class during co[...]

37-79 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E T o delete an existing p olicy map, use the no policy-map policy-map-name global conf iguration command. T o delete an existing cl ass,[...]

37-80 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E Class prec3 bandwidth 100000 (kbps) When a queuing class is configured without an y explicit share/bandwidth co nfiguratio n, because [...]

37-81 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E T o enable class-le vel priori ty queuing in a service polic y , perform this task: T o delete an existing p olicy map, use the no poli[...]

37-82 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E Queue-limiting When a class-based queue is instanti ated on a physical port, it is se t up with a default size. This size represents t[...]

37-83 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E Queue Allocation Failure The switch might not be able t o meet the expl ic it queue size required on one or more queues on an interface[...]

37-84 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E This exampl e show s how to configu re a class-based queue with an explicit queue-limi t command. It limits traf fic class class1 to a[...]

37-85 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E T o delete an existing p olicy map, use the no policy-map policy-map-name global conf iguration command. T o delete an existing cl ass,[...]

37-86 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E QoS Action Restrictions Action restrictions include th e follo wing: • The same actions cannot b e performed multiple times in a gi [...]

37-87 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E Classification criteria for the poli c y map on the physical member ports cannot be based on a combination of fi elds. This restriction[...]

37-88 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring QoS on Supervisor Eng ine 6- E, Supervisor Engine 6L-E, Catalyst 4900M, and Cataly st 4948E – If there is an e gress queuin g polic y on the port, the queue is selected based on the classif ication criteria applicab le to th[...]

37-89 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configuring QoS on Super visor Engine 6-E, Su pervisor Engine 6L-E, Ca talyst 4900M, a nd Catalyst 4948E service-policy input my ! interface GigabitEthernet2/6 switchport mode trunk Configuring System Queue Limit Note This feature is supp o[...]

37-90 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring Auto-QoS on Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M, and Catalyst 4948E This exampl e show s how to set the queue limit globally t o 1024 on a standalone supervisor engine: Switch> enable Switch# confi[...]

37-91 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Service Configu rin g Auto-QoS on Super visor Engine 6-E, Supervi sor E ngine 6L-E, Catalyst 4900M, and Catalyst 4948E set qos-group 24 policy-map AutoQos-VoIP-Output-Policy class AutoQos-VoIP-Bearer-QosGroup set dscp ef set cos 5 priority police c[...]

37-92 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 37 Config uring Quality of Servic e Configuring Auto-QoS on Supervisor Engine 6-E, Supervisor Engine 6L-E, Catalyst 4900M, and Catalyst 4948E It establishes a trusted boundar y that recognizes Cisc o IP phones and trusts the CoS setting of the packets from the phone. If a C[...]

CH A P T E R 38-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 38 Configuring Voice Interfaces This chapter descri bes how to configure voice in terfaces for the Catalyst 4500 series switches. This chapter includ es the follo w ing major sections: • About V oice Interfaces, page 38-1 • Conf iguring a Port to Connect to a Cisco 7[...]

38-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 38 Configuring Voice Interfaces About Voice Interfaces The Cisco 7960 IP Phone contai ns an integrated three-port 10/100 switch . The ports are dedica ted connection s as describ ed below: • Port 1 connects to the Catalyst 4500 series switch or oth er devi ce that supports[...]

38-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 38 Con figuring Voice Interfaces Configur ing a Port to Conn ect to a Cisco 7960 IP Phone Configuring a Port to Conne ct to a Cisco 7960 IP Phone Because a Cisco 7960 IP Phone also supports conn ection to a PC or a nother device, an interface connecting a Catalyst 4500 series[...]

38-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 38 Configuring Voice Interfaces Configuring Voice Ports fo r Voice and Data Traffic In the follo w ing example, VLAN 1 car ries data tra ff ic, and VL AN 2 carries voice traf fic. In this confi guration, you must connect al l Cisco IP phones and other v oice-related de vices[...]

38-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 38 Con figuring Voice Interfaces Overriding the CoS Prior ity of Incomin g Frames Overriding the CoS Priority of Incoming Frames A PC or another data de vice can connect to a Cisc o 7960 IP Phone port. The PC can generate packets with an assigned CoS v alue. Y ou ca n also us[...]

38-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 38 Configuring Voice Interfaces Configuring Power[...]

CH A P T E R 39-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 39 Configuring Private VLANs This chapter de scribes ho w to implement pri vate VLANs (PV LANs) on Catalyst 4500 series switches. It also pro vides restrictions, proc edures, and conf iguration e xamples. This chapter includ es the follo w ing major sections: • About P[...]

39-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs About Private VLANs Purpose of a PVLAN Using PVLA Ns provides scalab ilit y and IP address management benefits fo r service providers and Layer 2 security for customers. PVLANs partiti on a regular VLAN domain in to subdomains. A subdomain is rep[...]

39-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs About Private VLANs In a switched e n vironment, yo u can assign an i ndivi dual PVLAN and associated IP subnet to each indi vidual or common group of end stations. The end station s need to communicat e only with a defaul t gate way to communicat[...]

39-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs About Private VLANs Isolated Port An isolated port is a ho st port that belongs to an isolated secondary VLAN. It has complete Layer 2 separatio n from other ports within the same PVLAN, ex cept for the promiscuous ports. PVLANs block all traff i[...]

39-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs About Private VLANs PVLANs across Multiple Switches This section discusses the fo llowi ng topics: • Standard T runk Ports, page 39 -5 • Isolated PVLAN Trunk Ports, page 39-6 • Promiscuous PVLAN T runk Ports, page 39-7 Standard Trunk Ports A[...]

39-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs About Private VLANs Because VTP does not support PVLANs, you must manually configu re PVLANs on all switches in the Layer 2 network. If you do not conf igure the primary and secondary VLAN association in some switches in the network , the Layer 2[...]

39-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs About Private VLANs T raff ic in the upstream direction is sent b y host1 to the non-PVLAN switch , arri ving in VLAN 11 . The packets are then transmitted to the switch tagg ed with that VLA N’ s tag (VLAN 11) over the trunk port. On the switch[...]

39-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs About Private VLANs PVLAN Modes Over Gigabit Etherchannel Beginni ng with Cisco IOS Release 15.0(2)SG you can configu re PVLAN modes ov er Etherchannel. These ne w modes are: • Host mode - Isolated, Co mmunity and 2-way commu nity • Promiscuo[...]

39-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs About Private VLANs • A packet r eceiv ed on a PVLAN trunk port belongs to the secon dary VLAN if the packet i s tagged with a secondary VLAN or if the pa cket is untagge d and the nati ve V LAN on the port i s a secondary VLAN. A packet recei v[...]

39-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs PVLAN Commands PVLANs and SVIs In a Layer 3 switch, a switch virtua l interface (SVI) represents the Layer 3 interface of a VLAN. Layer 3 devices communicate wi th a PVLAN only us ing the prim ary VLAN and not through second ary VLANs. Config ur[...]

39-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Configuring PVLANs These sections describe ho w to configure PVLANs: • Basic PVLAN Con figur ation Procedure, page 39-12 • Defaul t Priv ate-VLAN Configuration , page 39-12 • PVLAN Configuration Gu idelines and Restrictio[...]

39-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs • Conf iguring a Layer 2 Interf ace as an Isolated PVLAN T runk Port, page 39-19 • Conf iguring a Layer 2 Interface as a Pr omi scuous PVLAN T runk Port, page 39-21 • Permitting Routin g of Secondary VL AN Ingress T raff[...]

39-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs • Do not include VLAN 1 or VLANs 10 02 through 10 05 in PVLANs. • Use only PVLAN commands to assign ports to primary , isolated, community VLANs, or two way-community VLANs. Layer 2 interfaces on pr imary , isolated, commun[...]

39-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs • W ith port A CLS functionality av ailable, you can apply Cisco IOS A CLS to secondary VLAN ports and Cisco IOS A CLS to PVLANS (V A CLs). For more information on V A CLs, see Chapter 47, “Configuring Network Securit y wi[...]

39-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Configuring a VLAN as a PVLAN T o configure a VLAN as a PVLAN, perform this task: This exampl e sho ws how to conf igure VLAN 202 as a primary VLAN and verify the conf iguration: Switch# configure terminal Switch(config)# vlan [...]

39-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs This exampl e sho ws how to conf igure VLAN 550 as a tw ow ay-community VLAN an d verify th e configuration: Switch# configure terminal Switch(config)# vlan 550 Switch(config-vlan)# private-vlan twoway-community Switch(config-[...]

39-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Switch# configure terminal Switch(config)# vlan 202 Switch(config-vlan)# private-vlan association 303-307,309,440 Switch(config-vlan)# end Switch# show vlan private-vlan Primary Secondary Type Interfaces ------- --------- -----[...]

39-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs • Use the remove keyw ord with a secondary_vlan_list to clear the mapping between se condary VLANs and the PVLAN promis cuous port. This example sho ws how to configure interface Fast Ethernet 5/2 as a PVLAN promiscuous port[...]

39-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs This example sho ws how to conf igure inte rface FastEt hernet 5/1 as a PVLAN host port and verify the configuration: Switch# configure terminal Switch(config)# interface fastethernet 5/1 Switch(config-if)# switchport mode priv[...]

39-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs This example sho ws how to conf igure inte rface FastEt hernet 5/2 as a secondar y trunk port, and v erify the conf iguration: Switch# configure terminal Switch(config)# interface fastethernet 5/2 Switch(config-if)# switchport[...]

39-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Trunking Native Mode VLAN: 1 (default) Administrative Native VLAN tagging: enabled Voice VLAN: none Administrative private-vlan host-association: none A Administrative private-vlan mapping: none Administrative private-vlan trun[...]

39-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs The [ no ] switchport priv ate-vlan mapping comman d provides the f ollowing three levels of removal: • Remov e one or more secondary VLANs from the list. F or example: Switch(config-if)# switchport private-vlan mapping trun[...]

39-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Capture Mode Disabled Capture VLANs Allowed: ALL Unknown unicast blocked: disabled Unknown multicast blocked: disabled Appliance trust: none Permitting Routing of Secondary VLAN Ingress Traffic Note Isolated, community VLANs, a[...]

39-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs vlan202 309 community vlan202 440 isolated Switch# Configuring PVLAN over EtherChannel After creating a Layer 2 Etherchannel, yo u can config ure it with any o f the four PVLAN port mod es (promiscuous host, secondar y host, i[...]

39-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Note The maximum number of unique PVLAN pairs supported b y the switchport private-vlan mapping command is 1000. When you conf igure a Layer 2 Etherchannel as a PVLAN pro miscuous port, note the follo wing: • The secondary_vl[...]

39-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Configuring a Layer 2 EtherCh annel as a PVLAN Host Port T o conf igure a Layer 2 EtherChannel as a PVLA N host port, perform this task: This example sho w s how to configure interf ace port ch annel 63 as a PVLAN host port an[...]

39-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Configuring a Layer 2 EtherChannel as an Isol ated PVLAN Trunk Port T o conf igure a Layer 2 EtherChannel as an is olat ed PVLAN trunk port, perform this task: Command Purpose Step 1 Switch# configure terminal Enters global con[...]

39-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs This example shows ho w to configure interface port chan nel 63 as a secondary trunk port , and to verify the conf iguration: Switch# configure terminal Switch(config)# interface port-channel 63 Switch(config-if)# switchport m[...]

39-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Note The maximum number of unique PVLAN pairs supported by th e switchpo rt pri vate-vlan mapping tru nk command is 500. F or example, 500 i solated secondary VLANs could map to 5 00 primary VLANs, because only one isolated VLA[...]

39-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 39 Configuring Private VLANs Configuring PVLANs Switch(config-if)# switchport private-vlan trunk native vlan 10 Switch(config-if)# switchport private-vlan trunk allowed vlan 10, 3-4 Switch(config-if)# switchport private-vlan mapping trunk 3 301, 302 Switch(config-if)# end S[...]

CH A P T E R 40-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 40 Configuring 802.1X Port-Based Authentication This chapter describe s how to configure IEEE 802.1X po rt-based authent ication on the Catalyst 450 0 series switch to pre vent unauthorized client de vices from gaining access t o the network. This chapter includ es the f[...]

40-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Until a client is authen ticated, only Extensible Authenti cation Protocol o ver LAN (EAPOL) traf fic is allowed using the port to which the client is connected. Af ter authentica tion suc[...]

40-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Figure 40-1 802.1X Device Roles • Client—The wor kstation that requests access to th e LAN, and responds to requests from the switch. The workstation must b e running 802.1X-compliant c[...]

40-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Authentication Initiation and Message Exchange The switch or the client can in itiate authentication. If you en able authentication on a port b y using the authentication port-contr ol aut[...]

40-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Ports in Authorized and Unauthorized States The switch port state determines wh ether the client is granted access to the network. The port starts in the unauthorized state. While in this s[...]

40-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Figur e 40-3 A uthentication Flo wch art 802.1X Host Mode The 802.1X port’ s host mode determines whether mor e than one client can be authenticate d on the port and ho w authentication [...]

40-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication • Pre-authentication Open Access, page 40-8 Single-Host Mode Y ou can configur e an 802.1X port for sing le-host or multiple-host s mode. In single-host mode (see Figure 40-1 on p age 40-[...]

40-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Figur e 40-5 Multidomain A uth entication Mode Example Figure 40-5 sho ws a typical M D A application w ith a singl e host behin d an IP phone co nnected to t he 802.1X-enabled port. Becau[...]

40-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication In single-host mode, a security violation is trig gered when more than one device are detected on the data vlan. In multidomain au thentication mode, a security violat ion is triggered when[...]

40-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Using 802.1X with VLAN Assignment Y ou can use the VLAN assignment to limit network a ccess for certain users. W ith the VLAN assignment, 802.1X-authenticated ports are assigned to a VLAN[...]

40-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication • Enable AAA authoriz ation by usin g the network ke yword to allo w interf ace conf iguration from the RADIUS server . For an illustration of ho w to apply the aaa authorization network[...]

40-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Usage Guidelines for Using 802.1X Authen tication with Guest VLANs on Windows-XP Hosts When using 802.1X authent ication with guest VLA Ns on W ind o ws-XP hosts, consider these gu idelin[...]

40-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Feature Interaction This section lists feature interactions and restrictio ns when MAB is enabled. If a feature is not listed, assume that it interacts seamlessly with MA B (such as Unidir[...]

40-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication • When both MAB and gues t VLAN are co nfigu red and no EAPOL pa ckets ar e recei ve d on a port, t he 802.1X sta te-mach ine is moved to a MAB state where it opens the port to li sten [...]

40-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Note Inaccessible Authentication Bypa ss allows a v o ice client to a ccess configured voice VLAN when RADIUS becomes unav ailable. For the v oice de vice to operate properly , it must lea[...]

40-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication For detai ls on ho w to config ure 802.1X with Unidirectional Con trolled Port, see the “Conf iguring 802.1X with Unidir ectional Contr olled Port” section on page 4 0-63 . Unidirecti[...]

40-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Deployment Example In a lar ge campus LAN design, you might want to design the VLAN infrastructure wit hout large Layer 2 domain. For the same employee VLAN, customers might hav e differen[...]

40-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Y ou can set the maximum number of aut hentication a ttempt s that the authent icator sends before mo ving a port into the authentication-fai led VLAN. The authenticator keeps a count of [...]

40-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication • Internal VLANs that are used for Layer 3 ports cannot be conf igured as authentication-fail ed VLANs. • The authentication -failed VLAN i s supported only in single-host mode (the de[...]

40-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication • Whene v er port security ag es out a 802.1X client’ s MA C address, 802.1X attempts to reau thenticate the client. Only if the reauthenti c ation succeeds is the client’ s MA C ad[...]

40-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication – url-redirect = <HTTP or HTTPS URL> – url-redirect-acl = switch A CL name or number These A V pa irs enable the switch to intercept an HTTP or HTTPS request from the endpoi nt d[...]

40-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Using 802.1X with Voice VLAN Ports A voice VLAN port is a special access por t associated with two VLAN identifi ers: • V oic e VLAN ID (VV ID) to carry voice traf fic to and from th e [...]

40-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication MD A does not enforce the order of de vice authentication. For best r esults, howe ver , you should authenticate a voice de vice befo re you authenticate a data de vice on an MD A-e nabled[...]

40-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication 802.1X Supplicant and Authenticator Switches with Network Edge Access Topology The Network Edge Access T opol og y (NEAT) feature ext ends id en tity to areas outside t he wiring closet ([...]

40-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication About 802.1X Port-Based Authentication Host Authorization— Ensures that on ly traf f ic from authorized hosts (connect ing to the switch with a supplicant) is allo wed on the network. The switc hes use Client Inf ormation Sig[...]

40-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication switch denies access to the netw ork for all wireless access point-attached clients. I n this topology , the wireless access point is responsibl e for authenticating clients attach[...]

40-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication • Conf iguring 802.1X with Inaccessible Authentication Bypass, page 40-60 (optional) • Conf iguring 802.1X with Unidirection al Controlled Port, page 40-6 3 (optional) • Conf [...]

40-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication 802.1X Configuration Guidelines Guidelines for conf iguring 802.1X authentication in clude the follo wing: • The 802.1X protoco l is supported only on Laye r 2 static access, PVL[...]

40-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Note T o allow VLAN assignment, you must enable AAA authorization to configure the switch for all network-related service requests. T o conf igure 802.1X port-based aut hentication,[...]

40-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Note Enabling Spanning T ree PortFast ensures that a port comes up immediately after authorization. Note Whenev er you conf igure an y 802.1X paramete r on a po rt, a dot1x auth en[...]

40-31 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Switch(config-if)# switchport mode access Switch(config-if)# dot1x pae authenticator Switch(config-if)# dot1x port-control auto Switch(config-if)# end Switch# show dot1x interface f[...]

40-32 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Dot1x Authenticator Client List ------------------------------- Supplicant = 0015.e981.0531 Session ID = 0A053F0F00000004041E6B0C Auth SM State = AUTHENTICATED Auth BEND SM State =[...]

40-33 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication T o conf igure the RADIUS server parameters on the swi tch, perform this task: Command Purpose Step 1 Switch# configure terminal Enters global conf iguration mode. Step 2 Switch(con[...]

40-34 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication This ex ample shows ho w to specify t he server with IP address 17 2.120.39.46 as the RADIUS serv er . The first co mmand specifies por t 1612 as the authori zation port, sets the [...]

40-35 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication This exampl e show s how to en able 802.1X authentication and to allo w multiple hosts: Cisco IOS Release 12.2(50)SG and later Switch(config)# interface gigabitethernet2/1 Switch(co[...]

40-36 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication This example sho ws ho w to enable MD A and to allo w both a host and a 802.1X voice de vice (a Cisco or third-party phon e with 802.1X supplicant) on the port: Cisco IOS Release 1[...]

40-37 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Switch(config-if)# dot1x port-control auto Switch(config-if)# dot1x host-mode multi-domain Switch(config-if)# dot1x mac-auth-bypass Switch(config-if)# no shut Switch(config-if)# end[...]

40-38 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Switch(config-if)# authentication port-control auto Switch(config-if)# authentication host-mode multi-auth Switch(config-if)# map eap Switch(config-if)# no shut Switch(config-if)# [...]

40-39 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication switchport voice vlan 1234 access-group mode prefer port ip access-group pacl-4 in speed 100 duplex full authentication event fail action authorize vlan 111 authentication event ser[...]

40-40 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Cisco ACS Configuration for DACL Note O n l y C i s c o AC S s u p p o r t s DAC L . T o ensure correct functioni ng of the A CS configurat ion required for D A CL, follo w these s[...]

40-41 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Configuring ACS T o conf igure two Cisco-A V pairs, add the follo wing statements under the user or gr oup Cisco IOS/PIX 6x RADIUS attrib utes: url-redirect-acl=urlacl url-redirect=[...]

40-42 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication dot1x pae authenticator end Switch# Switch# show access-list pacl-4 10 permit ip host 1.1.1.1 host 2.2.2.2 20 permit icmp host 1.1.1.1 host 2.2.2.2 Switch# V erify URL-redirect by [...]

40-43 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Configuring a Do wnloadable Policy T o configure do wnloadable po licies, perform this task: Command Purpose Step 1 Switch# configure terminal Enters global conf iguration mode. Ste[...]

40-44 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication The follo wing example illustrates ho w to configure a swit ch for do wnloadable policy: Switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. Switch[...]

40-45 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Configuring the Switch T o conf igure the switch for per -user AC L and filt er-ID A CL: Step 1 Config ure the IP de vice tracking table. Switch(config)# ip device tracking Step 2 C[...]

40-46 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Figure 40-12 sho ws how members of the group you are conf iguring are denied all acce ss to the 10.100.60.0 subnet, are denied HTTP access to the serv er at 10.100.10.116, and are [...]

40-47 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Figure 40-13 Configur ing the Filter -ID At tribute Note Outbound A CLs (for example, 100 .out) are not supported. Debug Commands for Per-User ACL and Filter-ID ACL The IP de vice t[...]

40-48 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication The follo w ing command sho ws that the Policy Enforced Module (EPM) session contains the per-user -a cl from A CS: Switch# show epm session ip 50.0.0.12 Admission feature : DOT1X [...]

40-49 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication The follo wing command shows t hat the Policy Enfor ced Module (EPM) session contains the Filter -Id 155 from A CS: Note The 156 IP extended A CL is to be preconfigured on the switc[...]

40-50 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Configuring a Per-User ACL and Filter-ID ACL T o conf igure per- user A C L and Filter-I D A CL, perform this task: Command Purpose Step 1 Switch# configure terminal Enters global [...]

40-51 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication The follo wing example illustrates ho w to configure a swit ch for do wnloadable policy: Switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. Switch([...]

40-52 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication This example sho ws ho w to configure a switch to deri ve the reauthenti cation period from the server and to verify the conf iguration: Cisco IOS Release 12.2(50): Switch# configu[...]

40-53 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Dot1x Authenticator Client List Empty Port Status = AUTHORIZED Switch# Configuring MAC Move MA C move allo ws an authenticated host to move fro m one switch port to anoth er . Note [...]

40-54 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication This exampl e show s how to glo bally enable MA C replace on a switc h: Switch# configure terminal Switch(config)# interface f7/1 Switch(config-if)# authentication violation replac[...]

40-55 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication %PM-4-ERR_DISABLE: security-violation error detected on <interface name>, putting <interface name> in err-disable state Configuring 802.1X with Guest VLANs Y ou c an con[...]

40-56 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication This example sho ws how to enable regular VLAN 50 on Fast Ethernet 4/3 as a guest VLAN on a static access port: Cisco IOS Release 12.2(50)SG and later Switch# configure terminal Sw[...]

40-57 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Cisco IOS Release 12.2(46)SG or ea rlier Switch# configure terminal Switch(config)# interface fa4/3 Switch(config-if)# switchport mode private-vlan host Switch(config-if)# dot1x por[...]

40-58 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication This e xample sho ws how to en able the gues t VLAN feature and to specify VLAN 5 as a guest VLAN: Cisco IOS Release 12.2(50)SG and later Switch# configure terminal Switch(config)#[...]

40-59 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Note Removing a 802 .1X MAB conf igurat ion from a port does not imp act th e authorized or authenticated state of the port. If the port is in an unauthenticated state, it remains i[...]

40-60 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication QuietPeriod = 60 ServerTimeout = 30 SuppTimeout = 30 ReAuthPeriod = 3600 (Locally configured) ReAuthMax = 2 MaxReq = 2 TxPeriod = 1 RateLimitPeriod = 0 Mac-Auth-Bypass = Enabled Do[...]

40-61 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Step 4 Switch(config)# interface interface-id Specifi es the port to be configured and enters interface configuration mode. Step 5 Switch(config-if)# switchport mode access or Switc[...]

40-62 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication The follo wing example shows a full configuration of 802.1X with In acce ssible Authentica tion Bypass, including required AAA and RADIUS configuration as specif ied in the “Enab[...]

40-63 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Switch# configure terminal Switch(config)# aaa new-model Switch(config)# aaa authentication dot1x default group radius Switch(config)# dot1x system-auth-control Switch(config)# radi[...]

40-64 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Note Unidirectional controlled port only w orks when Sp anning Tree PortF ast is enabled on the port. Unidirectional controlled port an d Spanning T ree PortFast should be conf igu[...]

40-65 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication SuppTimeout = 30 ReAuthPeriod = 3600 (Locally configured) ReAuthMax = 2 MaxReq = 2 TxPeriod = 30 RateLimitPeriod = 0 Switch# Cisco IOS Release 12.2(46)SG or ea rlier Switch# configu[...]

40-66 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Note Ensure that the VLANs yo u specify as part of the VLA N group are enabled on the switch. Only specif ied VLANs are considered for assignment. Step 2 Config ure the indi vidual[...]

40-67 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication ACS Configuration After conf iguring the switch, you mu st provide the VLAN gro up name in the A CS configur ation. By default, A CS sends only one VLAN name or group per user . How[...]

40-68 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Figur e 40-15 VLAN User Distr ibut ion on ACS: Multiple V LAN Numbers Confi gured per User After you complete these two tasks and r eceiv e au thorization, A CS sends the configure[...]

40-69 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication This exampl e shows ho w to enable a regular VLAN 4 0 on Fast Ethernet 4 /3 as a authentication-fa iled VLAN on a static access port: Cisco IOS Release 12.2(50)SG and later Switch# [...]

40-70 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Cisco IOS Release 12.2(46)SG or ea rlier Switch# configure terminal Switch(config)# interface gigabitEthernet3/1 Switch(config-if)# switchport mode access Switch(config-if)# dot1x [...]

40-71 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication This exampl e show s how to enable 802.1X with v oice VLAN feature on Fa st Ethernet interface 5/ 9: Cisco IOS Release 12.2(50)SG and later Switch# configure terminal Switch(config)[...]

40-72 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication T o enable 802.1X with VLAN assignment, perfo rm this task: The follo wing example sho ws ho w to configure MD A on an interface and 802.1X as the authenticati on mechanism: Switch[...]

40-73 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Figure 40-16 User Se t Up Note The procedure is the same for voice devices except that th e AAA server must be configured t o send a Cisco Attrib ute-V alue (A V) pair attribu te wi[...]

40-74 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Step 3 Switch(config-fallback-profile)# ip access-group rule-name in Specif ies the default A CL to apply to network tr af fic before web-based aut hentication. Step 4 Switch(confi[...]

40-75 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Step 3 Switch(config-fallback-profile)# ip access-group rule-name in Specif ies the default A CL to apply to network tr af fic before web-based aut hentication. Step 4 Switch(config[...]

40-76 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication This exampl e show s how to enable 802.1X fal lback to MAB, and then to enable web-based authentication, on an 802 .1X-enabled port: Switch(config)# ip admission name rule1 proxy h[...]

40-77 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Dot1x Info for GigabitEthernet7/2 ----------------------------------- PAE = AUTHENTICATOR PortControl = AUTO ControlDirection = Both HostMode = MULTI_AUTH QuietPeriod = 60 ServerTim[...]

40-78 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication T o determine if a host was au thenticated using web authenticati on when fallback auth entication is confi gured on the port, enter the follo wing commands: Switch# show authentic[...]

40-79 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication T o enable periodic reauthentication of the client and to configure t he number of seconds between reauthentication at tempts, perform this task: This exampl e show s how to enable [...]

40-80 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication Cisco IOS Release 12.2(46)SG or ea rlier Switch# configure terminal Switch(config)# interface fastethernet5/9 Switch(config-if)# switchport mode access Switch(config-if)# dot1x pae[...]

40-81 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication This exampl e shows ho w to enable 802.1X on Fa st Ethernet interface 5/9 and to allo w multiple hosts: Cisco IOS Release 12.2(50)SG and later Switch# configure terminal Switch(conf[...]

40-82 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication This exampl e shows ho w to set the quiet period on the swi tch to 30 seconds: Cisco IOS Release 12.2(50)SG and later Switch# configure terminal Switch(config)# interface fastether[...]

40-83 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication This example sho ws how to set the re transm ission time to 60 seconds: Cisco IOS Release 12.2(50)SG and later Switch# configure terminal Switch(config)# interface fastethernet5/9 S[...]

40-84 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication T o set the switch-to-client frame-retransmission numbers, perform this task: This exampl e shows ho w to set 5 as the number of times that the switch retransmits an EAP-request/id[...]

40-85 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Cisco IOS Release 12.2(46)SG or ea rlier Switch# configure terminal Switch(config)# interface fastethernet5/9 Switch(config-if)# switchport mode access Switch(config-if)# dot1x pae [...]

40-86 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication When CISP is enabled on a trunk po rt, the following features are iner t. When CI SP is neither running nor configured, these features operate as e xpected: • VLAN assignment •[...]

40-87 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Figur e 40-17 Specifying the Cisco A V P air Starting with Cisco IOS XE Release 3.2. 0 SG (15.0(2)SG) the spanning-tree bpdug uard feature is automatically disabled or enabled as pa[...]

40-88 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication dot1x pae authenticator authentication port-control auto spanning-tree portfast trunk no spanning-tree bpduguard end Scenario 2: W ithout port le vel BPDU Guard Conf iguration (wit[...]

40-89 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication Current configuration : 149 bytes ! interface GigabitEthernet5/23 switchport mode trunk authentication port-control auto dot1x pae authenticator spanning-tree portfast trunk end Swi[...]

40-90 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port -Based Authentication This exampl e show s how to configu re a switch as a supplicant: Switch# configure terminal Switch(config)# cisp enable Switch(config)# dot1x credentials test Switch(config)# usern[...]

40-91 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Configuring 802.1X Port-Based Auth entication • Although modif ied trunk parameters are retained, when the trunk lin k is down or authentication is cleared, the interface is reconfigured to the follo wing: – spanning-tree p[...]

40-92 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Switch# dot1x initialize Removing 802.1X Client Information The clear dot1x command causes all e xisting supplicants to be completely delet ed from an interf ace or from all the interf ace[...]

40-93 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Understanding RADIUS RADIUS is a distributed client/server system th at secures networks against unauthorized access. RADIUS clients run on supported Cisco routers and swit ches. Clients se[...]

40-94 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Figur e 40-18 T ransiti oning fr om RADIUS t o T ACA CS+ Services RADIUS Operation When a user attempts to log in and auth enticate to a switch that is access controlle d by a RADIUS serve[...]

40-95 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS • CoA Request Commands, page 40 -97 • Session Reauthenticati on, page 40-98 • Displaying 802.1X Statistics and Status , page 40-113 Overview A standard RADIUS interface is typically u[...]

40-96 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS T able 40-3 sho ws the possible values fo r the Error-Cause attribute. Preconditions T o use the CoA interface, a session must already ex ist on the switch. CoA ca n be used to identify a [...]

40-97 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS • Audit-Session-Id (Cisco VSA) • Acct-Session-I d (IETF attribut e #44) Unless all session identif ication attributes incl uded in the CoA messag e match the session, the switch returns[...]

40-98 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Session Reauthentication The AAA server typically generates a session reauth entication request when a host with an unkno wn identity or posture joins the netw ork and is associated with a[...]

40-99 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS CoA Disconnect-Request This command is a standard Discon nect-Request. Be cause this command is session-oriented, it must be accompanied b y one or more of the session identif ication attri[...]

40-100 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Configuring RADIUS This section descri bes ho w to conf igure your switch to suppor t RADIUS. At a minimum, y ou must identify the host or hosts that run the RADIUS serv er softw are and [...]

40-101 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Y ou identify RADIUS security servers b y their hostnam e or IP address, hostname and specif ic UDP port numbers, or their IP address and specif ic UDP port numbers. The combin ation of th[...]

40-102 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS T o configure per -server RADIUS server communication, perform this task. This procedure is required . T o remove the specif ied RADIUS server , use the no radius-server host hostname | i[...]

40-103 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS This exampl e sho ws how to conf igure host1 as the RADIUS server and to use the default ports fo r both authentication an d accounting: Switch(config)# radius-server host host1 Note Y ou [...]

40-104 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Step 3 Switch(config)# aaa authentication login { default | list-name } method1 [ method2... ] Creates a login authentication meth od list. • T o create a default list that is used w h [...]

40-105 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS T o disable AAA, use the no aaa new-model global conf iguration command. T o disable AAA authentic ation, use the no aaa authentication login { default | list-name } metho d1 [ method2... [...]

40-106 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS T o define th e AAA server group and associate a part icular RADIUS serv er with it, perform this task: Command Purpose Step 1 Switch# configure terminal Enters global configu ration mode[...]

40-107 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS T o remove the specif ied RADIUS server , use the no radius-server host hostname | ip-addr ess global confi guration command. T o remo ve a server gro up from the conf iguration list, use [...]

40-108 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS T o disable authorization, use the no aa a authorization { network | exec } me thod1 global configuratio n command. Starting RADIUS Accounting The AAA accounting feature tracks the servic[...]

40-109 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Configuring Settings fo r All RADIUS Servers T o conf igure global commun ication settings between the switch and all RADI US serv ers, perform these steps: T o return to the defaul t sett[...]

40-110 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS For e x ample, this A V pair activ ates Cisco’ s multiple named ip addr ess pools feature during IP authorization (during PPP IPCP address assignment) : cisco-avpair= ”ip:addr-pool=fi[...]

40-111 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Configuring the Switch for Vendor-Proprietary RADI US Server Communication Although an IETF draft standard for RADI US specifies a method for communicat ing vendor -proprietary information[...]

40-112 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Controlling Switch Access with RADIUS Configuring CoA on the Switch T o conf igure CoA on a switch, perfo rm th ese steps. This procedure is required. Command Purpose Step 1 Switch# configure terminal Enters global configu ra[...]

40-113 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Displaying 802.1X Statistics and Status T o disable AAA, use the no aaa new-model global configurat ion comm and. T o disable the AAA server functionality on the swit ch , use the no aaa serv er radius dynamic authorization gl[...]

40-114 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Displaying Authentication Details Displaying Authentication Details This section includes these topics: • Determining t he Authentication Methods Re gistered with the Auth Manager , page 40-114 • Displaying the Auth Manag[...]

40-115 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Displaying Authentication Details Displaying a Summary of All Auth M anager Sessions on t he Switch Authorized for a Specified Authentication Method This exampl e shows ho w to display a summary of all sessions for a specif ic[...]

40-116 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Displaying Authentication Details The indi vidual output can be further ref ined by using the handle , interface , MA C , session-id , or method ke ywords: Switch# show authentication sessions mac 000f.23c4.a401 Interface: Gi[...]

40-117 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Displaying Authentication Details mab Not run Displaying MAB Details The follo wing commands display these details: Switch# show mab all MAB details for FastEthernet5/9 ------------------------------------- Mac-Auth-Bypass = E[...]

40-118 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 40 Configuring 802.1X Port-Based Authentication Displaying Authentication Details Switch(config)# epm logging Switch# clear dot1x all Switch# *May 15 08:31:26.561: %EPM-6-POLICY_REQ: IP=100.0.0.222| MAC=0000.0000.0001| AUDITSESID=0A050B2C000000030004956C| AUTHTYPE=DOT1X| E[...]

CH A P T E R 41-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 41 Configuring the PPPoE Intermediate Agent DSL Forum TR-101 [1] of fers a means by which the PPPoE Discov ery packets are tagged at the service provider's access switch with subscriber line specif ic information. Th e mechanism speci f ies using VSA of the PPPoE Di[...]

41-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 41 Configuring the PPPoE Intermediate Agent Related Documents Related Documents RFCs About PPPoE Intermediate Agent PPPoE Intermediate Agent ( PPPoE IA) is placed betwee n a subscriber and BRAS to help the service provider BRAS disting uish betw een end ho sts conn ected ove[...]

41-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 41 Configuring the PPPoE Intermediate Agent RFCs The follo wing example sho ws how to set an access node id entifier o f abcd : Switch> enable Switch# configure terminal Switch(config)# pppoe intermediate-agent format-type access-node-id string abcd By default, access-node[...]

41-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 41 Configuring the PPPoE Intermediate Agent RFCs Enabling PPPoE IA on an Interface This functionality enables the PPPoE IA feature on an interf ace. The pppoe intermediate-agent command has an effect only if the PPPoE IA feature was enabled globally with this command. (Y ou [...]

41-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 41 Configuring the PPPoE Intermediate Agent RFCs Configuring PPPoE IA Vendor-tag Stripping on an Interface This functionality enabl es an administrator to strip the v endor-specif ic tag (VSA) from P ADO, P ADS, and P ADT packets recei ved on an interfac e before forw arding [...]

41-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 41 Configuring the PPPoE Intermediate Agent Displaying Config uration Parameters Specif ic VLAN: Switch# configure terminal Switch(config)# interface FastEthernet 3/1 Switch(config-if)# vlan-range 5 Switch(config-if-vlan-range)# pppoe intermediate-agent Comma-separated VLAN [...]

41-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 41 Configuring the PPPoE Intermediate Agent Displaying Configuration Parameters The info ke yword appears if the PPPoE Intermediate Agent is enabled globally on an interf ace or on a VLAN (in an interface). It also informs you about the access node ID and ge neri c error me s[...]

41-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 41 Configuring the PPPoE Intermediate Agent Clearing Packet Counters Server responses from untrusted ports = 0 Client requests towards untrusted ports = 0 Malformed PPPoE Discovery packets = 0 Vlan 2: Packets received PADI = 0 PADO = 0 PADR = 0 PADS = 0 PADT = 0 Vlan 3: Pack[...]

41-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 41 Configuring the PPPoE Intermediate Agent Tro ublesho oting Tips The event option of the command echoes important messag es (interf ace st at e change to errd isabled due to PPPoE discov ery packet s entering at a rate exceedin g the conf igured limit). it is t he only e ve[...]

41-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 41 Configuring the PPPoE Intermediate Agent Troubleshooting Tips[...]

CH A P T E R 42-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 42 Configuring Web-Based Authentication This chapter describe s how to configure web-based authentication. It consis ts of these sections: • About W eb-Based Auth entication, page 42-1 • Conf iguring W eb-Based Authent ication, page 42-6 • Displaying W eb-Based Aut[...]

42-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 42 Configurin g Web-Based Authenticatio n About Web-Based Authentic ation These sections describe the role of web-based authenti cation as part of the authentication, authorization, and accounting (AAA) system: • De vice Roles, page 42-2 • Host Detection, page 42-2 • S[...]

42-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 42 Configuring Web-Based Authentic ation About Web-Based Authentication For Layer 3 interfaces, web-based authentication se ts an HTTP intercept ACL when the feature is configured on the interf ace (or when the interface is put in service). For Layer 2 interfaces, web-based a[...]

42-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 42 Configurin g Web-Based Authenticatio n About Web-Based Authentic ation Customization of the Authentication Proxy Web Pages During the web-b ase d auth ent icat ion proc ess, the internal HTTP server of the switch hosts four HTML pages for deli very to an authenticating cl[...]

42-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 42 Configuring Web-Based Authentic ation About Web-Based Authentication LAN Port IP Y ou can configur e LAN port IP (LPIP) and Layer 2 we b-based auth entication on the same port. The host is authenticated using w eb-based authentication f irst, followed b y LPIP posture val [...]

42-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 42 Configurin g Web-Based Authenticatio n Configuring Web-Base d Authentication Configuring Web-Based Authentication These sections describe ho w to configure web-b ased authentication: • Defa ult W eb-Based Authenticati on Configur ation, page 42-6 • W eb-Based Authenti[...]

42-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 42 Configuring Web-Based Authentic ation Configuring Web-Based Authentication proxyacl# 40=permit udp any any eq tftp Note The proxyacl entry determines the type of allowed network access. • W eb-based authentication is an ingress-only feature. • Y ou can configure web-b [...]

42-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 42 Configurin g Web-Based Authenticatio n Configuring Web-Base d Authentication This exampl e show s how to enable web-based authenticatio n on Fast Ethernet p ort 5/1: Switch(config)# ip admission name webauth1 proxy http Switch(config)# interface fastethernet 5/1 Switch(co[...]

42-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 42 Configuring Web-Based Authentic ation Configuring Web-Based Authentication Configuring AAA Authentication T o enable web-based auth entication, perform this task : This e xample sho ws how to enable AAA: Switch(config)# aaa new-model Switch(config)# aaa authentication logi[...]

42-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 42 Configurin g Web-Based Authenticatio n Configuring Web-Base d Authentication When you configure the RADIUS serv er parameters, foll ow these steps: • Specify th e key string on a separate command line. • For ke y string , specify the authentication and en cryption ke[...]

42-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 42 Configuring Web-Based Authentic ation Configuring Web-Based Authentication This example sho ws how to conf igure the RADIUS server parameters on a switch: Switch(config)# ip radius source-interface Vlan80 Switch(config)# radius-server host 172.l20.39.46 test username user[...]

42-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 42 Configurin g Web-Based Authenticatio n Configuring Web-Base d Authentication When configuring customized auth entication pro xy web pa ges, observe the following guide lines: • T o enable the custom web pages featur e, specify all four cust om HTML f iles. If you speci[...]

42-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 42 Configuring Web-Based Authentic ation Configuring Web-Based Authentication Specifying a Redirection URL for Successful Login W ith Cisco IOS Release 12.2(50)SG, you ha ve the option t o specify a URL to which the user is redirected upon successful authentication, effect i[...]

42-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 42 Configurin g Web-Based Authenticatio n Displaying Web-Based Authentication Status This exampl e shows ho w to set the maximum number of f ailed login attempts to 10: Switch(config)# ip admission max-login-attempts 10 Removing Web-Based Authentication Cache Entries T o de[...]

CH A P T E R 43-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 43 Configuring Port Security This chapter descr ibes how to config ure port security on the Catalyst 4500 series switch. It provides an ov erview of port secur ity on the Catalyst 4500 ser ies switch and det ails the conf iguration on v arious types of ports such as acce[...]

43-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Port Securi ty Comm ands Port Security Commands This table lists the commands most commonly used with port secur ity . Command Purpose Navigation errdisable recov ery cause psecure-vi olation Brings a secure p ort out of error-disabled state. V [...]

43-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security About Port Security About Port Security Port security enables you to res trict the number of MA C addresses (termed secur e MA C addresses ) on a port, allowing you to pre vent access by unauthorized M AC addresses. It also allo ws you to configur[...]

43-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity About Port Security Secure MAC Addresses Port security supports th e follo w ing types of secure MA C addresses: • Dynamic or Learned—Dynamic secure MAC addresses are learned when packets are recei v ed from the host on the secure port. Y ou[...]

43-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security About Port Security Note On a trunk port, a maximum numb er of secure MA C addresses can be configured on both the port and port VLAN. The por t’ s maximum v alue can be greater than or equal to the port VLAN max imum( s) b ut not less than the [...]

43-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity About Port Security The sticky secure MA C a ddresses do not automatically become part of the conf iguration f ile, which is the startup config uration used each time the sw itch restarts. If you sa ve the running conf ig file to the confi gurat[...]

43-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuring Port Security on Acc ess Ports Invalid Packet Handling Y ou might want to rate limit in val id source MA C addr ess packets on a secure port if you anticipate that a de vice will send in v alid packets (such as traf fic generator , sni[...]

43-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on Ac cess Po rts Step 4 Switch(config-if)# [ no ] switchport port-security maximum value (Optional) Sets the max imum number of secure MA C addresses for the interface. The range is 1 to 3072; the default is 1. T o ret[...]

43-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuring Port Security on Acc ess Ports Step 6 Switch(config-if)# [ no ] switchport port-security violation { restrict | shutdown | shutdown vlan } (Optional) Sets the violat ion mode, the action to be taken when a security violation is detecte[...]

43-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on Ac cess Po rts Note T o clear dynamic ally learned port security MA C addre sses in the CAM table, use the clear port-security dynamic command. The address keyw ord enables you to clear a secure MA C addresses. The [...]

43-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuring Port Security on Acc ess Ports Example 1: Setting Maximum Nu mber of Secure Addresses This exampl e show s how to enable port security on the F ast Ethernet interface 3/12 and ho w to set the maximum number of secure ad dresses to 5. [...]

43-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on Ac cess Po rts This exampl e shows ho w to set the aging time to 2 minut es: Switch(config-if)# switchport port-security aging time 2 Y ou can verify the pre vious commands with the show port-security interface comm[...]

43-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuring Port Security on Acc ess Ports Example 6: Configuring Sticky Port Security This examp le sho ws ho w to conf igure a stick y MA C address on Fast Ethernet interf ace 5/1 and to v erify the conf iguration: Switch# configure terminal En[...]

43-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on PVLA N Po rts The follo wing example sho ws how to conf igure rate limit for in val id source packets on F ast Ethernet interface 5/1: Switch# configure terminal Enter configuration commands, one per line. End with [...]

43-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuring Port Security on PVLAN Ports Figur e 43-1 P ort Secur i ty on Isol ated Pr ivat e VLAN Host P orts Note Dynamic addresses secured on an is olated priv ate VLAN host port on pri v ate VLANs are secured on the secondary VLAN s, and not [...]

43-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on PVLA N Po rts Example of Port Security on an Isolated Private VLAN Host Port The following e xample shows ho w to co nfigure port security on an isolat ed pri v ate VLA N host port, Fast Ethernet interface 3/12: Swi[...]

43-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuri ng Port Securit y on Trunk Port s Example of Port Security on a Private VLAN Promiscuous Port The follo wing e xample sh o ws ho w to conf igure port s ecurity on a pri v ate VLAN promiscuous port, Fast Ethernet interface 3/12: Switch# [...]

43-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on Trun k Ports Figure 43-2 T r unk Por t Se cur ity Y ou can configure various po rt security related parameters on a per -port per-VLAN basis. Note The steps in volved i n configuring port securi ty parameters is sim[...]

43-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuri ng Port Securit y on Trunk Port s Examples of Trunk Port Security The follo wing examples are pro vided: • Example 1: Conf iguring a Maximum Limit of Secure MA C Addresses for All VLANs, page 43-19 • Example 2: Conf iguring a Maximu[...]

43-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on Trun k Ports 5 3 0 6 3 0 Switch# Switch# show running interface gi1/1 Building configuration... Current configuration : 161 bytes ! interface GigabitEthernet1/1 switchport trunk encapsulation dot1q switchport mode t[...]

43-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuri ng Port Securit y on Trunk Port s Switch# show port-security interface g1/1 address vlan 2-4 Secure Mac Address Table ------------------------------------------------------------------------ Vlan Mac Address Type Ports Remaining Age (mi[...]

43-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on Voice Ports Port Mode Changes Generally , when a port mode changes, all dynamic ad dresses associated with that port are removed. All static or sticky addresses and other port security paramete rs configured on the [...]

43-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuring Port Security on Voice Ports Configuring Port Security on Voice Ports T o conf igure port security on a v oice port, perform this task: Command Purpose Step 1 Switch(config)# interface interface_id Enters interface conf igurat ion mod[...]

43-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on Voice Ports Step 6 Switch(config-if)# [ no ] switchport port-security mac-address mac_address [ vlan { voice | access }] (Optional) Specif ies a secure MA C address for the interface. When you specify the vlan ke yw[...]

43-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuring Port Security on Voice Ports Note T o clear dynamically learned port security MA C addresses in the CAM table, use the clear port-security dynamic command. The address ke yword enables you to clear a secure MA C addresses. The interfa[...]

43-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security on Voice Ports Switch# show port-security address Secure Mac Address Table ------------------------------------------------------------------------ Vlan Mac Address Type Ports Remaining Age (mins) ---- ----------- ----[...]

43-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Displaying Port Security Settings Total Addresses in System (excluding one mac per port) : 5 Max Addresses limit in System (excluding one mac per port) : 3072 Switch# show running-config interface fastEthernet 5/1 Building configuration... Curren[...]

43-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Displaying Port Security Settings T o display traf fic contro l information, perform one or more of t hese tasks: Examples of Security Settings The follo wing examples are pro vided: • Example 1: Displayi ng Security Set tings for the Enti re[...]

43-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Displaying Port Security Settings Fa3/6 2 2 0 Shutdown Fa3/7 2 2 0 Shutdown Fa3/8 2 2 0 Shutdown Fa3/10 1 0 0 Shutdown Fa3/11 1 0 0 Shutdown Fa3/12 1 0 0 Restrict Fa3/13 1 0 0 Shutdown Fa3/14 1 0 0 Shutdown Fa3/15 1 0 0 Shutdown Fa3/16 1 0 0 Shut[...]

43-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Displaying Port Security Settings 1 0000.0001.1201 SecureSticky Fa3/7 - 1 0000.0001.1300 SecureSticky Fa3/8 - 1 0000.0001.1301 SecureSticky Fa3/8 - 1 0000.0001.2000 SecureSticky Po2 - ------------------------------------------------------------[...]

43-31 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Configuring Port Security with Oth er Features/Environments Example 7: Displaying Secured MAC Addresse s for a VLAN Range on an Interface This example sh ows ho w to display all secure MA C ad dresses configured on VLAN s 2 and 3 on Gigabit Ether[...]

43-32 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Configuring Port Security w ith Other Features/En vironments Any combination of the source MA C and IP address traffic will be allo wed as shown here: – MA C1 <---> IP1, valid – MA C2 <---> IP2, valid – MA C1 <---> IP2, [...]

43-33 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Security Port Security Configuration Guidelines and Restrictions Figur e 43-3 P ort Secur ity in a Wireless En vironment Configuring Port Security over Layer 2 EtherChannel Note Catalyst 4900M, Catalyst 4948E, Supervis or Engine 6-E, and Supervisor Engine[...]

43-34 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 43 Configuring Port Secu rity Port Security Con figuration Guidelines an d Re stric tions • When you enter a maximum secu re address v alue for an interf ace, and the ne w value is greater than the pre vious v alue, the ne w val ue overwri tes the previously configured va[...]

CH A P T E R 44-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 44 Configuring Control Plane Policing and Layer 2 Control Packet QoS This chapter cont ains information on ho w to protect yo ur Catalyst 4500 series switch using control plane policing (CoPP). The informati on cov ered in this chapte r is unique to the Cataly st 4500 se[...]

44-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 44 Configuri ng Control Plane Policing and Layer 2 Control Packet QoS Configuring Control Plane Policing • General Guid elines for Cont rol Plane Polici ng, page 44-3 • Defa ult Conf iguration, page 44-4 • Conf iguring CoPP for Control Plane T raffic, page 44 -4 • Co[...]

44-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 44 Configuring Control Pl ane Policing and Layer 2 Control Packet QoS Configuring Cont ro l Plane Policing For the data and m anagement p lane traff ic, you can de fine your own A CLs to m atch the tra f fi c class that you want to police. CoPP uses MQC to define traf fic cla[...]

44-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 44 Configuri ng Control Plane Policing and Layer 2 Control Packet QoS Configuring Control Plane Policing • Begi nning with Cisco IOS Release 12.2(31) SGA1, the GARP class wa s excluded from CoPP . T o manipulate GARP traf fic, you need to use A CLs and QoS. If you want to [...]

44-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 44 Configuring Control Pl ane Policing and Layer 2 Control Packet QoS Configuring Cont ro l Plane Policing The follo wing example sho ws how to pol ice CDP packets: Switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# qos Switch[...]

44-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 44 Configuri ng Control Plane Policing and Layer 2 Control Packet QoS Configuring Control Plane Policing Configuring CoPP for Data Plane and Management Plane Traffic T o conf igure CoPP for data plane and management plane traf fic, perform t his task: Command Purpose Step 1 [...]

44-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 44 Configuring Control Pl ane Policing and Layer 2 Control Packet QoS Configuring Cont ro l Plane Policing The follo wing example sho ws how to configure trusted hosts wi th source addresses 10.1.1.1 and 10.1.1.2 to forwar d T elnet packets to the control plan e without const[...]

44-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 44 Configuri ng Control Plane Policing and Layer 2 Control Packet QoS Configuring Control Plane Policing Class system-cpp-cgmp Class system-cpp-ospf Class system-cpp-hsrpv2 Class system-cpp-igmp Class system-cpp-pim Class system-cpp-all-systems-on-subnet Class system-cpp-all[...]

44-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 44 Configuring Control Pl ane Policing and Layer 2 Control Packet QoS Monitoring CoPP Monitoring CoPP Y ou can e nter the show policy-map contr ol-plane command to de velop site-specifi c policies, to monit or statistics for the control pl ane policy , and to troubl eshoot Co[...]

44-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 44 Configuri ng Control Plane Policing and Layer 2 Control Packet QoS Monitoring CoPP Match: access-group name system-cpp-ripv2 Class-map: system-cpp-ip-mcast-linklocal (match-all) 0 packets Match: access-group name system-cpp-ip-mcast-linklocal Class-map: system-cpp-dhcp-c[...]

44-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 44 Configuring Control Pl ane Policing and Layer 2 Control Packet QoS Configuring Layer 2 Control Packet QoS permit any 0180.c200.0000 0000.0000.000f Extended MAC access list system-cpp-cdp permit any host 0100.0ccc.cccc Extended MAC access list system-cpp-cgmp permit any ho[...]

44-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 44 Configuri ng Control Plane Policing and Layer 2 Control Packet QoS Configuring Layer 2 Control Packet QoS Enabling Layer 2 Control Packet QoS T o enable Layer 2 control packet Qo S, perform this task: T able 44-1 list s the types of packets impacted b y this feature. The[...]

44-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 44 Configuring Control Pl ane Policing and Layer 2 Control Packet QoS Configuring Layer 2 Control Packet QoS Switch(config-if-vlan-range)# exit Switch(config-if)# exit Switch(config)# exit Switch# show policy-map interface gi3/1 GigabitEthernet3/1 vlan 1 Service-policy input[...]

44-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 44 Configuri ng Control Plane Policing and Layer 2 Control Packet QoS Configuring Layer 2 Control Packet QoS Note TCAM resources are not consumed when the interface is in a down state. T able 44-2 displays the auto-generated MA CLs and class maps tha t are created w hen you[...]

44-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 44 Configuring Control Pl ane Policing and Layer 2 Control Packet QoS Configuring Layer 2 Control Packet QoS Switch(config)# qos control-packets Switch(config)# policy-map police_bpdu_1 Switch(config-pmap)# class system-control-packet-bpdu-range Switch(config-pmap-c)# police[...]

44-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 44 Configuri ng Control Plane Policing and Layer 2 Control Packet QoS Configuring Layer 2 Control Packet QoS The follo w ing example sho ws how to create user-def ine d MACLs and class maps to id entify EAPOL and BPDU pack ets. Beca use the aut o -g enerated c l a ss map sy[...]

44-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 44 Configuring Control Pl ane Policing and Layer 2 Control Packet QoS Policing IPv6 Control Traffic Policing IPv6 Control Traffic On Catalyst 4900M, Catalyst 4948E, Supervisor Engi ne 6-E, and Supervisor En gine 6L-E, I Pv6 cont rol packets such as OSPF , PIM and MLD can be [...]

44-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 44 Configuri ng Control Plane Policing and Layer 2 Control Packet QoS Policing IPv6 Control Traffic police cir 32000 bc 1500 conform-action transmit exceed-action drop Class pimv6class police cir 32000 bc 1500 conform-action transmit exceed-action drop The follo wing exampl[...]

CH A P T E R 46-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 46 Configuring Dynamic ARP Inspection This chapter descri bes how to configure Dynamic ARP Inspection (D AI) on the Catalyst 4500 series switch. This chapter includ es the follo w ing major sections: • About Dynamic ARP In spection, page 46-1 • Conf iguring Dynamic A[...]

46-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n About Dynamic ARP Inspectio n ARP Cache Poisoning Y ou can atta ck hosts, switches, and routers connected to your Layer 2 network by “poisoning ” their ARP caches. For e xample, a malicious user might intercep t traf fic intended [...]

46-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection About Dynamic ARP In spection Interface Trust State, Security Co verage and Network Configuration D AI assoc iates a trust state with each interface on the system. Packets arri ving on trusted interfaces bypass all D AI validation checks[...]

46-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n About Dynamic ARP Inspectio n Relative Priority of Static Bindings and DHCP Snooping Entries As mentioned pre viously , DAI populates it s database of v alid MA C address to IP address bindings through DHCP snoo ping. It also validate[...]

46-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection Port Channels Function A gi ve n physical port can join a chann el only when th e trust state of the physical port and of the channel match. Otherwise, the physical port remains suspend e d in the chann[...]

46-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n Configuring Dynamic ARP Inspection Figur e 46-3 ARP P ack et V alidation on a VLAN Enabled for D AI Note D AI depends on the entries in the DHCP snooping bindin g database to v erify IP-to-MA C address bindings in in comin g ARP reque[...]

46-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection DAI Configuration Example This example sh ows ho w to configu re D A I on Switch A in VLAN 100. Y ou would perform a similar procedure on Switch B. Switch A SwitchA# show cdp neighbors Capability Codes:[...]

46-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n Configuring Dynamic ARP Inspection Gi3/1 Untrusted 15 1 Gi3/2 Untrusted 15 1 Gi3/3 Untrusted 15 1 Gi3/4 Untrusted 15 1 Gi3/5 Untrusted 15 1 Gi3/6 Untrusted 15 1 Gi3/7 Untrusted 15 1 Gi3/8 Untrusted 15 1 Gi3/9 Untrusted 15 1 Gi3/10 Unt[...]

46-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection SwitchA# show ip dhcp snooping binding MacAddress IpAddress Lease(sec) Type VLAN Interface ------------------ --------------- ---------- ------------- ---- -------------------- 00:01:00:01:00:01 170.1.1[...]

46-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n Configuring Dynamic ARP Inspection Gi3/20 Untrusted 15 1 Gi3/21 Untrusted 15 1 Gi3/22 Untrusted 15 1 Gi3/23 Untrusted 15 1 Gi3/24 Untrusted 15 1 Gi3/25 Untrusted 15 1 Gi3/26 Untrusted 15 1 Gi3/27 Untrusted 15 1 Gi3/28 Untrusted 15 1 [...]

46-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection Configuring ARP ACLs for Non-DHCP Environments This procedure sho ws ho w to conf igure D AI when Switch B show n in Figure 46-3 does not support D AI or DHCP snoopi ng. If you conf igure port 1 on Swi[...]

46-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n Configuring Dynamic ARP Inspection Step 5 Switch(config)# ip arp inspectio n filter arp-acl-name vlan vlan-range [ static ] Applies the ARP A CL to the VLAN. By default, no defined ARP A CLs are applied to any VLAN. • Fo r arp-acl-[...]

46-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection T o remov e the ARP A CL, use the no arp access-list gl obal confi guration command. T o remov e the ARP A CL attached to a VLA N, use the no ip arp inspection f ilter arp-acl-name vlan vl an-rang e gl[...]

46-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n Configuring Dynamic ARP Inspection Gi3/35 Untrusted 15 1 Gi3/36 Untrusted 15 1 Gi3/37 Untrusted 15 1 Gi3/38 Untrusted 15 1 Gi3/39 Untrusted 15 1 Gi3/40 Untrusted 15 1 Gi3/41 Untrusted 15 1 Gi3/42 Untrusted 15 1 Gi3/43 Untrusted 15 1 [...]

46-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection T o conf igure the log b uffer , perform this task: Command Purpose Step 1 Switch# configure terminal Enters global configurati on mode. Step 2 Switch(config)# ip arp inspection log-buffer { entries nu[...]

46-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n Configuring Dynamic ARP Inspection T o return to the default lo g buf fer settings, use th e no ip arp inspection log-b uffer global configuration command. T o return to the def ault VLAN log settings, us e the no ip arp inspection v[...]

46-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection T o limit the rate of incoming ARP pack ets, perform this task: T o return to the defaul t rate-limit conf iguration, use the no ip arp inspection limit interf ace configuration command. T o disable er[...]

46-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n Configuring Dynamic ARP Inspection SwitchB# show ip arp inspection interfaces Interface Trust State Rate (pps) Burst Interval --------------- ----------- ---------- -------------- Gi1/1 Untrusted 15 1 Gi1/2 Untrusted 15 1 Gi3/1 Untru[...]

46-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection vmps Disabled pagp-flap Disabled dtp-flap Disabled link-flap Disabled l2ptguard Disabled psecure-violation Disabled gbic-invalid Disabled dhcp-rate-limit Disabled unicast-flood Disabled storm-control D[...]

46-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n Configuring Dynamic ARP Inspection T o perform specific checks on incomin g ARP pack ets, perform this task: T o disable checking , use the no ip arp inspection v alidate [ src-mac ] [ dst-mac ] [ ip ] global confi guration command. [...]

46-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 46 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection Vlan Configuration Operation ACL Match Static ACL ---- ------------- --------- --------- ---------- 100 Enabled Active Vlan ACL Logging DHCP Logging ---- ----------- ------------ 100 Deny Deny SwitchB#[...]

46-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 46 Co nfig uring Dynamic ARP Inspectio n Configuring Dynamic ARP Inspection[...]

CH A P T E R 45-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 45 Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts This chapter describes ho w to configu re Dynamic Host Conf iguration Protocol (DHCP) snoopin g, IP source guard, and IP source guard (IPSG) for static hosts on Catalyst 4500 series switches. It pro[...]

45-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts About DHCP Snooping The DHCP snooping binding table contains the MA C address, IP address, lease time, binding type, VLAN number , and interface informat ion that corresponds to the local untrusted int[...]

45-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts About DHCP Snooping The mechanism for the database agent stores the bindings in a file at a conf igured location . Upon reload, the switch reads the f ile to build the da tabase for the bindings. The sw[...]

45-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts About DHCP Snooping Option 82 Data Insertion In residential, metropolit an Ethern et-acces s en vironments, DHCP can cent rally manage the IP address assignments for a large number of subscribers. When[...]

45-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts About DHCP Snooping • The DHCP serv er unicasts the reply to the switch if the request was relayed to the server b y the switch. The switch v erif ies that it ori ginally insert ed t he Option 82 data[...]

45-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping Figure 45-3 sho ws the packet formats for user-confi gured remote ID and circuit ID suboptions. The switch uses these packet formats when DHC P snooping is globally enabled an[...]

45-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping • Enabling DHCP Sn ooping on the Aggre gration Switch, page 45-9 • Enabling DHCP Sn ooping and Option 82, page 45 -10 • Enabling DHCP Snoo ping on Pri vate VLA N, page 45[...]

45-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping T o enable DHCP snooping, perform th is task: Y ou can configure DHCP snooping for a single VLAN or a r ange of VLANs. T o conf igure a single VLAN, enter a single VL AN numbe[...]

45-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping Switch(config-if)# ip dhcp snooping vlan 555 information option format-type circuit-id string customer-555 Switch(config-if)# interface FastEthernet 2/1 Switch(config-if)# ip d[...]

45-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping the ip dhcp snooping information opti on allow-untrusted global conf iguration command on the aggregation switch, the aggreg ation switch can accept DHCP requests w ith Optio[...]

45-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping T o disable DHCP snooping, use the no ip dhcp snooping global config uration command. T o disable DHCP snooping on a V LAN or range of VLANs, use th e no ip dhcp snooping vlan[...]

45-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping This exampl e shows ho w to configu re the Option 82 circuit-ID o verride subop tion: Switch(config-if)# ip dhcp snooping vlan 250 information option format-type circuit-id o[...]

45-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping Enabling the DHCP Snooping Database Agent T o conf igure the database agent, perfo rm one or more of the foll owing tasks: Note Because both NVRAM and bootflash ha ve limited [...]

45-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping T o pre vent the port from shuttin g down, you can use the errdisable de tect cause dhcp-rate-limit action shutdown vlan global conf iguration command to sh ut do wn just the[...]

45-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping Switch# show errdisable recovery ErrDisable Reason Timer Status ----------------- -------------- udld Disabled bpduguard Disabled security-violatio Disabled channel-misconfig [...]

45-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping Switch# show ip dhcp snooping database detail Agent URL : tftp://10.1.1.1/directory/file Write delay Timer : 300 seconds Abort Timer : 300 seconds Agent Running : No Delay Ti[...]

45-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring DHCP Snooping The switch maintains tw o sets of counters for thes e i gnored bindings. One pro vides the counters for a read that has at least on e binding ignored by at least one of th ese[...]

45-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Displaying DHCP Sno oping Inform ation Last Succeded Time : 15:24:34 UTC Sun Jul 8 2001 Last Failed Time : None Last Failed Reason : No failure recorded. Total Attempts : 1 Startup Failures : 0 Succes[...]

45-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts About IP Source Gu ard Displaying a Binding Table The DHCP snooping bindi ng table f or each switch contains bi nding entries that correspond to unt rusted ports. The table does not contain in formatio[...]

45-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring IP Source Gua rd the client IP traf fic to those source IP addresses co nfigu red in the binding; an y IP traf fic wi th a source IP address other than that in the IP source bi nding is f [...]

45-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring IP Source Guard If you want to stop IP so urce gua rd with static hosts on an interface, use th e following commands in interface configuration submode: Switch(config-if)# no ip verify sour[...]

45-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Displaying IP Source Guar d Information Switch# show ip verify source interface f6/1 Interface Filter-type Filter-mode IP-address Mac-address Vlan --------- ----------- ----------- --------------- ---[...]

45-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Displaying IP Source Bindi ng Information • This e xample sho ws displayed PV AC Ls for a port configur ed for IP-to-MA C filtering b ut not for port security: Interface Filter-type Filter-mode IP-ad[...]

45-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring IP Source Guard for Static Hosts Configuring IP Source Guard for Static Hosts Note IPSG for static hosts should not be used o n uplink ports. IP source guard (IPSG) for static hosts e xten[...]

45-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring IP Source Gu ard for Static Hosts Configuring IPSG for Static Hosts on a Layer 2 Access Port Y ou c an configure IPSG for static hosts on a Laye r 2 access po rt. T o enable IPSG for static[...]

45-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring IP Source Guard for Static Hosts T o stop IPSG with static hosts on an interface, use the follo wing commands in interface con figur ation submode: Switch(config-if)# no ip verify source S[...]

45-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring IP Source Gu ard for Static Hosts The follo wing example displays all IP- to-MA C binding entries for all interfaces. The CLI displays all activ e as well as inactive entries. When a host i[...]

45-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring IP Source Guard for Static Hosts 200.1.1.5 0001.0600.0000 8 GigabitEthernet3/1 INACTIVE 200.1.1.6 0001.0600.0000 8 GigabitEthernet3/1 INACTIVE 200.1.1.7 0001.0600.0000 8 GigabitEthernet3/1[...]

45-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 45 Configuring DHCP Snoopin g, IP Source Guard, and IPSG for Static Hosts Configuring IP Source Gu ard for Static Hosts Switch(config-vlan)# exit Switch(config)# vlan 200 Switch(config-vlan)# private-vlan association 201 Switch(config-vlan)# exit Switch(config)# int fastEthe[...]

45-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 45 Configurin g DHCP Snooping, IP Source Guard, and IPSG for Static Hosts Configuring IP Source Guard for Static Hosts[...]

CH A P T E R 47-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 47 Configuring Network Security with ACLs This chapter describes how to use access control lists (A CLs) to configure network security on the Catalyst 4500 series switches. Note The Catalyst 4500 series switch supports time-b ased A CLs. Note For complete syntax and usag[...]

47-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs About ACLs • Using VLAN Maps with Router A CLs, page 47-32 • Conf iguring P ACLs, p age 47-35 • Using P A CL with VLAN Maps and Router A CLs, page 47-41 • Conf iguring RA Guard, page 47- 43 Note The follow ing discussions a[...]

47-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs About ACLs The Catalyst 4500 seri es switch supports three types of A CLs: • IP A CLs, which filt er IP tr af fic, includin g TCP , the User Datagram Prot ocol (UDP) , Int ernet Gr oup Management Proto col (IGMP), and Intern et Con[...]

47-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs About ACLs • Extended IP access lists u se source and destination addresses and o ptional protocol type information for matching operations. The switch examines A CLs ass ociated with features configured on a gi ven interface and[...]

47-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs About ACLs As with router A CLs, the switch examines A CLs assoc i ated with features configured on a gi ven interface and permits or denies pack et forwardi ng based on ho w the packet ma tches the ent ries in the A CL. In the exa m[...]

47-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Hardware and Software ACL Support Figur e 47 -2 Using VLAN Maps t o Control T raf fic Hardware and Software ACL Support This section descri bes how to determine whether A C Ls are processed in hardware or in software: • Flo ws th[...]

47-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs TCAM Programming and ACLs for Supervisor En gine II-Pl us, Supervisor Eng in e IV, Supervisor Eng in e V, and TCAM Programming and ACLs for Supervisor Engine II-Plus, Supervisor Engine IV, Supervisor Engine V, and Supervisor Engine V[...]

47-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs TCAM Programming and ACLs for Supervisor Engine II-Plus, Su perviso r Engine IV, Supervisor Engine V, and Supervisor For Super visor En gi nes II -Plus- TS , IV , V , and the Catalyst 4948 switch runnin g th e Cisco IOS softw are p[...]

47-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs TCAM Programming and ACLs for Supervisor En gine II-Pl us, Supervisor Eng in e IV, Supervisor Eng in e V, and This is a summary of scenarios that cause TCAM utilization to change: • Adding or delet ing A CLs or A CEs in the running[...]

47-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs TCAM Programming and ACLs for Supervisor Engine II-Plus, Su perviso r Engine IV, Supervisor Engine V, and Supervisor Note access-list hardware entries packed is the d efault and does not appear in the output of the sh ow running-c[...]

47-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs TCAM Programming and ACLs for Supervisor En gine II-Pl us, Supervisor Eng in e IV, Supervisor Eng in e V, and Output Acl(PortOrVlan) 0 / 4096 ( 0) 0 / 512 ( 0) Output Qos(PortAndVlan) 0 / 4096 ( 0) 0 / 512 ( 0) Output Qos(PortOrVlan[...]

47-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs TCAM Programming and ACLs for Supervisor Engine II-Plus, Su perviso r Engine IV, Supervisor Engine V, and Supervisor Note Y o u can only shift en tries bet ween th e PortAnd Vlan r egion and the Po rtOrVlan region for a s pecific [...]

47-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs TCAM Programming and ACLs for Supervisor En gine II-Pl us, Supervisor Eng in e IV, Supervisor Eng in e V, and Pack ets that match entries in partiall y programmed A C Ls are processed in software using the CPU. Th is may cause high [...]

47-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs TCAM Programming and ACLs for Supervisor Engine II-Plus, Su perviso r Engine IV, Supervisor Engine V, and Supervisor • DHCP Snooping shoul d be enabled globally on a gi ven VLAN. The follo wing bullets only appl y to supervisor [...]

47-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs TCAM Programming and ACLs for Supervisor En gine II-Pl us, Supervisor Eng in e IV, Supervisor Eng in e V, and Selecting Control Packet Capture T o select th e mode of capturing control packet s, perform this task: This exampl e show[...]

47-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs TCAM Programming and ACLs for Superviso r En gine 6-E and Supervisor Engine 6L-E TCAM Programming and ACLs for Supervisor Engine 6-E and Supervisor Engine 6L-E Y ou apply three types of hardw are resources when yo u program A CLs [...]

47-17 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Layer 4 Operators in ACLs • gt (greater than) • lt (less than) • neq (not equal) • range (inclusi ve range) For Supervi sor Engine II+ through V -10GE, you should not sp ecify more than six dif ferent operations on the same [...]

47-18 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Layer 4 Operators in ACLs Note The eq operator can be used an unlimited n umber of times because eq does not use a Layer 4 operation in hardware. • Layer 4 operations are considered dif ferent if th e same operator/operand coupl[...]

47-19 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Layer 4 Operators in ACLs • F or some packets, when the hardware runs out of resources, t he software must perform the A C L matches: – For Supervisor Engine 2-Plus to V -10GE, the TCP flag com binations rst ack and syn fin rst [...]

47-20 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring Unicast MA C Address Filtering access-list 103 permit tcp any gt 1024 any gt 1023 Note Remember that source port lt 80 an d destination port lt 80 are consider ed dif ferent operations. • Some pack ets must be sent t[...]

47-21 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring Named MAC Exten ded ACLs For more in formation about the supp orted non-IP protocols in the mac access-list extended command, refer to the Catalyst 4500 Series Switc h Cisco IOS Command Refer e nce . T o create a named M[...]

47-22 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring EtherT ype Matching Switch(config)# mac access-list extended mac1 Switch(config-ext-nacl)# hardware statistics Switch(config-ext-nacl)# end Switch# show access-lists Extended MAC access list macl deny any any decnet-iv[...]

47-23 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring Named IPv6 ACLs Switch(config)# mac access-list extended matching Switch(config-ext-macl)# permit any any 0x8863 Switch(config-ext-macl)# permit any any 0x8040 Switch(config-ext-macl)# end Switch # show access-lists matc[...]

47-24 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Applying IPv6 ACLs to a Layer 3 Interface Note Hardware stat istics is disabled b y default. Applying IPv6 ACLs to a Layer 3 Interface T o apply an IPv6 A CL to a Layer 3 interface, perform the follo wing task: Note IPv6 A CLs are[...]

47-25 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring VLAN Maps • VLAN Map Conf iguration Guidelines, page 47-25 • Creating and Deletin g VLAN Maps, page 47-26 • Applying a VLAN Map to a VL AN, page 47-29 • Using VLAN M aps in Y our Network, page 47 -29 This section[...]

47-26 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring VLAN Maps • If the VLAN map has at least one match clause for the type of packet (IP or MA C) and the packet does not ma tch any of these match c lauses, the de fault is to drop the pac ket. If there is no match clau[...]

47-27 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring VLAN Maps Example 1 This example sho ws how to create an A CL and a VLAN map to deny a packet. In the f irst map, any packets that match the ip1 A CL (TCP pack ets) wo uld be dropp ed. Y ou first create the ip1 A C L to [...]

47-28 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring VLAN Maps Example 3 In this examp le, the VLAN map is configured to dr op MA C packets and forward IP packets by default. By applying MA C extended access lists, good-ho sts and good-pr otocols , the VLAN map is config[...]

47-29 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring VLAN Maps Applying a VLAN Map to a VLAN T o apply a VLAN map to on e or more VLANs, perform this task: Note Y ou cannot apply a VLAN map to a VLAN on a switch that has A CLs appl ied to Layer 2 interfaces (port AC L s ) [...]

47-30 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring VLAN Maps Figur e 47 -3 Wiring Closet Configur ation For e xample, if you do not want HTTP t raff ic to be switched from Host X to Host Y , you could apply a VLAN map on Switc h A to drop all HTTP traff ic moving from [...]

47-31 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring VLAN Maps Denying Access to a Server on Another VLAN Figure 47-4 sho ws how to restrict access to a server on another VLAN. In this example, serv er 10.1.1.100 in VLAN 10 has the follo wing access restrictions: • Hosts[...]

47-32 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Displaying VL AN Ac cess Map Information Displaying VLAN Access Map Information T o display informatio n about VLAN access maps or VLAN filters, perform on e of these commands: it is a sample output of th e show vlan access-map co[...]

47-33 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Using VLAN Maps with Router ACLs When possible , try to writ e the ACL so that all entrie s have a single action except for the final, default action. Y ou should write the A C L using one of these tw o forms: permit... permit... pe[...]

47-34 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Using VLAN Maps with Ro ute r AC Ls Figur e 47 -5 Applying ACLs on S witched P a ck ets ACLs and Routed Packets Figure 47-6 sho ws how A CLs are applied on routed packet s. For routed packets, the A CLs are applied in this order: [...]

47-35 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring PACLs Figur e 47 -6 Applying ACLs on Routed P ack ets Configuring PACLs This section describes ho w to conf igure P A CLs, which are used to control f iltering on Layer 2 interfaces. P A CLs can filter t raff ic to or fr[...]

47-36 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring PACLs Step 2 Use the IP access-group, IPv6 traff i c-filter , or mac access-group interface co mmand to apply IPv4, IPv6, or MA C A CLs to one or more La yer 2 interfaces. PACL Configuration Guidelines When configuring[...]

47-37 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring PACLs ip access-list extended AUTH-DEFAULT-ACL This A CL is not n vgened. A UTH-DEF A UL T -A CL is a ttached provided there are sessions applying dynamic A CLs (Per-user/Filter -Id/DA CL). A U TH-DEF A UL T -A CL is rem[...]

47-38 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring PACLs Configuring IPv4, IPv6, and MAC ACLs on a Layer 2 Interface Note Only IPv4, IPv6 and MA C A CLs can be applied to Layer 2 physical in terfaces. Standard (numbered, named) , Extended (numbered, named) IP A CLs, an[...]

47-39 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring PACLs Using PACL with Access-Group Mode Y ou can use the access group mode to change the way P A CLs interact with other A CLs. For exam ple, if a Layer 2 interface bel ongs to VLAN100, V A CL (V LAN f ilter) V1 is appli[...]

47-40 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring PACLs Applying ACLs to a Layer 2 Interface T o apply IPv4, IPv6, an d MA C A CLs to a Laye r 2 interface, perform one of these tasks: Note Supervisor Engines III and Supervisor Engine IV runn in g on a Catalyst 4500 se[...]

47-41 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Using PACL with VLAN Maps an d Router ACLs This example sho ws that MA C a ccess group simple-mac -acl is conf igured on the inbound di rection of interface fa6/1: Switch# show mac access-group interface fast 6/1 Interface FastEther[...]

47-42 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Using PACL with VLAN Maps and Router ACLs Figur e 47 -7 Scenar io 1: P ACL Int e raction with an Input Rout er ACL If the interface access gro up mode is prefer por t, then only the input P A CL is applied on the i ngress traf fic[...]

47-43 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring RA Guard Scenario 3 : Host A is connected to an interface in VLAN 10, which has a V A CL and an SVI conf igured. The SVI has an input Router A C L conf igured and the interf ace has an input P A CL conf igured, as sho wn[...]

47-44 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring RA Guard obtained from the obser ved source address of the Router-Adv ertisement (RA) message. Howev er, in some networks, in v alid RAs are observed. Th is may ha ppen because of misconf igurations or a malicious atta[...]

47-45 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring RA Guard Figur e 47 -1 0 T ypical RA Guard Deployment Configuring RA Guard T o conf igure RA Guard, perform this step: Examples This e xamples sho ws how to enable RA Gu ard on the switch: Switch(config)# int gi1/1 Switc[...]

47-46 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring RA Guard ! interface GigabitEthernet1/1 ipv6 nd raguard end The follo wing example sho ws a sample output of the show ipv6 command s: Switch# show ipv6 snooping counters int gi 2/48 Received messages on Gi2/48: Protoco[...]

47-47 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 47 Configuri ng Network Security with ACLs Configuring RA Guard • RA Guard is purely an Layer 2 port based feature and can be conf igured only on switchpo rts. It works irresp ectiv e of whether IPv6 routing is enabled. It i s not supported on router in terfaces and VLANs.[...]

47-48 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 47 Configurin g N etwork Security with ACLs Configuring RA Guard[...]

CH A P T E R 48-1 Catalyst 4500 Switch Software Configuration Guide OL-23818-01 48 Support for IPv6 This chapter lists th e IP version 6 (IPv6) features supported on the Catalyst 45 00 and Catalyst 4900 series switches. The IPv6 for Cisco IOS softw are feature documentation prov ides implementation and command reference information for IPv6 feat ur[...]

48-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 48 Suppo rt for IPv6 About IPv6 For informatio n about ho w Cisco Systems implements IPv6, go to thi s URL: http://www .cisco.com/en/ US/products/ps6553/pro ducts_ios_technolog y_home.html This section describes the featur es that are supported for IPv6: • IPv6 Addressing [...]

48-3 Catalyst 4500 Switch Software Configuration Guide OL-23818-01 Chapter 48 Support for IPv6 About IPv6 Y ou can find infor mation about these features at t his location: http://www .cisco.com/en/ US/docs/ios/ipv6/conf iguration/guide/ip6-addr g_bsc_con.html DHCP The follo wing DHCP features are supported for IPv6 on the Catalyst 4500 seri es swi[...]

48-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 48 Suppo rt for IPv6 About IPv6 • MQC traf fic po licing • MQC packing marking an d remarking • Queueing Y ou can find infor mation about these features at t his location: http://www .cisco.com/en/US/ docs/ios/i pv6/conf iguration/guide/ip6-qos.html Management The foll[...]

48-5 Catalyst 4500 Switch Software Configuration Guide OL-23818-01 Chapter 48 Support for IPv6 About IPv6 Static Routes Networking de vices forward pack ets using route information t hat is either manually conf igured or dynamically learned using a routing protocol. St atic routes are manually conf igured and defin e an expli cit path between tw o [...]

48-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 48 Suppo rt for IPv6 About IPv6 http://www .cisco.com/en/ US/docs/ios/ipv6/con figuration /guide/ip6-rip.htm l OSPF The switch running the IP services feature set su pports Open Shortest P ath First (OSPF) for IPv6, a link-state protocol for IP . Y ou can find more informati[...]

48-7 Catalyst 4500 Switch Software Configuration Guide OL-23818-01 Chapter 48 Support for IPv6 IPv6 Default States Tunneling The follo wing tunneling features are supported for IPv6 on the Cat alyst 4500 series switch: • Automatic 6to4 • ISA T AP • Conf igured tunnels Note T unneling is not supported in hardw a re but is sup ported in softwar[...]

48-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 48 Suppo rt for IPv6 IPv6 Default States[...]

CH A P T E R 49-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 49 Port Unicast and Mult icast Flood Blocking This chapter de scribes how to configure multicast a nd unicas t flood bloc king on th e Cataly st 4000 family swi tch. This chapter contains these t opics: • About Flood Block ing, page 49-1 • Conf iguring Port Blocking,[...]

49-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 49 Port Unic as t and Multicast Flood Blocking Configuring Port Block ing Note Blocking of unicast or multicast traf fic is not auto matically en abled on a switch port; you must explicit ly configure it. Blocking Flooded Traffic on an Interface Note The interface can be a p[...]

49-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 49 Port Unicast and Multicast Flo od Blocking Configuring Port Blocking Broadcast Suppression Level: 100 Multicast Suppression Level: 100 Unicast Suppression Level: 100 Resuming Normal Forwarding on a Port T o resume normal forw arding on a port, perform th is task: Command P[...]

49-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 49 Port Unic as t and Multicast Flood Blocking Configuring Port Block ing[...]

CH A P T E R 50-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 50 Configuring Storm Control This chapter describe s how to configure port-based traf fic con trol on the Catalyst 4500 series swit ch. This chapter consists of these sections: • About Storm Cont rol, page 50-1 • Enabling Broadcast Sto rm Control, page 50-3 • Enabl[...]

50-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 50 Configuring Sto rm Control About Storm Control Note Storm control and Multicast storm con trol are supported in hardw are on all ports on the WS-X4516 , WS-X4013+10GE, WS-X4516-10GE, WS-C4948, WS-C4948-10GE, WS-C4900M, WS-C4948E, WS-X45-Sup6-E, and WS-X45 -Sup6L-E. In con[...]

50-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 50 Configuring Storm Control Enabling Broadcast Storm Control Software-Based Storm Control Implementation When storm control is enabled on an inte rface, the switch monitors pack ets receiv ed on the interface and determines whether the packets are broadcast. The switch monit[...]

50-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 50 Configuring Sto rm Control Enabling Multicast Storm Control The follo wing example sho ws how to enab le storm control on interf ace: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface fa3/1 Switch(config-if)#[...]

50-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 50 Configuring Storm Control Enabling Multicast Storm Control Enabling Multicast Suppression on Catalyst 4900M, Catalyst 4948E, Supervisor Engine 6-E, and Supervisor Engine 6L-E Catalyst 4900M, Catalyst 4948E, Supervi sor Engine 6-E, and Supervisor Engin e 6L-E support per -i[...]

50-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 50 Configuring Sto rm Control Disabling Broadca st Storm Control Enabling Multicast Suppression on All Other Supervisor Engines Multicast suppression can be enabled on a WS-X451 6, WS-X4013+10GE, WS-X4516-10G E, WS-C4948, and WS-C4 948-10GE sup ervisor engi nes for all ports[...]

50-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 50 Configuring Storm Control Disabling Multicas t Storm Control The follo wing example sho ws how to disabl e storm control on interf ace. Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# int fa3/1 Switch(config-if)# no s[...]

50-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 50 Configuring Sto rm Control Displaying St orm Control Displaying Storm Control Note Use the show interface capabilities command to determine the mode in which storm con trol is supported on an i nterface. The follo wing example sho ws an interface that suppo rts broadcast [...]

CH A P T E R 51-1 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 51 Configuring SPAN and RSPAN This chapter descri bes how to configure the Swit ched Port Analyzer (SP AN) and Remote SP AN (RSP AN) on the Catalyst 4500 seri es switches. SP AN selects netwo rk traf fic f or analysis by a netw ork analyzer , such as a SwitchProbe device[...]

51-2 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 51 Config uring SPAN and RSPAN About SPAN and RSPAN • Defa ult SP AN and RSP AN Configurat ion, page 51-6 SP AN mirrors traf fic from one or more source interfaces on an y VLAN or from one or more VLANs to a destination interface for analysis. In Figure 51-1 , all traf fic[...]

51-3 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 51 Configuring SPAN and RSPAN About SPAN and RSPAN SPAN and RSPAN C oncepts and Terminology This section describes co ncepts and terminology a ssociated with SP AN and R SP AN configuration and includes th e following subsect ions: • SP AN Session, page 51-3 • T raffic T [...]

51-4 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 51 Config uring SPAN and RSPAN About SPAN and RSPAN Some features that can cause a pa cket to be dropped du ring recei ve processing hav e no effect on SP AN; the destination port recei ves a copy of th e packet e ven if the actual incoming packet is dropped. These features [...]

51-5 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 51 Configuring SPAN and RSPAN About SPAN and RSPAN Destination Port Each local SP AN session or RSP AN destin ation sessi on must ha ve a destination port (also called a monitoring port ) that recei ves a copy of traff ic from the source ports and VLANs. A destination port ha[...]

51-6 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 51 Config uring SPAN and RSPAN About SPAN and RSPAN • VSP AN monitors only t raff ic that enters the sw itch, not traff ic that is routed betwee n VLANs. For exam ple, if a VLAN is being Rx-monit ored, and the multilayer switch routes tr af fic from ano ther VLAN to the mo[...]

51-7 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 51 Configuring SPAN and RSPAN Configuring SPAN Configuring SPAN The follo wing sections describe how to conf igure SP AN: • SP A N Configuration G uidelines and Restriction s, page 51 -7 • Conf iguring SP AN Sources, page 51-8 • Conf iguring SP AN Destinations, page 51-[...]

51-8 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 51 Config uring SPAN and RSPAN Configuring SPAN Configuring SPAN Sources T o conf igure the source for a SP AN session, perform this task: This exampl e shows ho w to conf igure SP AN session 1 to moni tor bidirectional traf fic from source interface Fast Ethernet 5/1: Switc[...]

51-9 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 51 Configuring SPAN and RSPAN Configuring SPAN Configuring SPAN Destinations T o conf igure the destination for a SP AN session, perform this task: Note SP AN is limited t o one destinat ion port per session. This exam ple shows ho w to conf igure interface F ast Ethernet 5/4[...]

51-10 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 51 Config uring SPAN and RSPAN CPU Port Sniffing Configuration Scenario This exampl e shows ho w to use the commands described in this chapter to completely configu re and unconf igure a span session. Assume that you want to monito r bidirectional traf f ic from source inte[...]

51-11 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 51 Configuring SPAN and RSPAN CPU Port Sniffing T o conf igure CPU source snif fing, perform this task: This e xample sho ws how to configu re a CPU source to snif f all pack ets receiv ed by the CPU: Switch# configure terminal Enter configuration commands, one per line. End[...]

51-12 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 51 Config uring SPAN and RSPAN Encapsulation Configuratio n This example sh ows ho w to use queue names and queue number ranges for the CPU as a SP AN source on Catalyst 4900M, Catalyst 4948E, Su pervisor Engine 6-E, or Supervisor Engin e 6L-E: Switch(config)# monitor sessi[...]

51-13 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 51 Configuring SPAN and RSPAN Access List Filtering T o configure ingress packets and en capsulati on, perform this task: This examp le shows ho w to conf igure a destination port with 802.1 q encapsulation and ingress pack ets using native VLAN 7: Switch(config)# monitor se[...]

51-14 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 51 Config uring SPAN and RSPAN Access List Filtering • When no A CLs are applied to packets e xiting a SP AN destination interf ace, all traff ic is permitted regar dless of the P A CLs, V A CLs, or RA CLs that hav e been pre viously applied to the destinatio n interface [...]

51-15 Software Configuration Guide—Release 15.0(2)SG OL-23818-01 Chapter 51 Configuring SPAN and RSPAN Packet Type Filtering This example sho ws how to conf igure IP access grou p 10 on a SP AN session and verify that an access list has been conf igured: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switc[...]

51-16 Software Configuration Guide—Rele ase 15.0(2)SG OL-23818-01 Chapter 51 Config uring SPAN and RSPAN Configuration Example This example sho ws how to conf igure a session to a ccept only unicast packets in the ingress direction: Switch(config)# monitor session 1 filter address-type unicast rx Configuration Example The follo wing is an example[...]