Cisco Systems WSC3750X48TS инструкция обслуживания

Americas Headquarters Cisco Systems, In c. 170 West Tasman Drive San Jose, CA 951 34-1706 USA http://www.ci sco.com Tel: 408 526-4000 800 553-NETS (638 7) Fax: 408 527-0883 Catal yst 3750-X and 3560-X S witc h S of tw are Conf iguration Guide Cisco IOS Release 12.2(53)SE2 May 20 1 0 Text Part Number: OL -21521-01[...]

THE SPECIFICATION S AND INFORMATION RE GARDING THE PRODU CTS IN THIS MANU AL ARE SUBJECT TO CHANGE WITHOUT N OTICE. ALL STATEMENTS , INFORMATION , AND RECOMMEN DATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESEN TED WITHOUT WARRANTY OF ANY KIND, EX PRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSI BILITY FOR THEIR APPLICATION OF ANY PRO[...]

iii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 CONTENTS Preface xlix Audience xlix Purpose xlix Conventi ons xlix Related Publica tion s l Obtaining Documentation and Submitting a Serv ice Request li CHAPTER 1 Overview 1-1 Features 1-1 Deployment Features 1-2 Performance Feature s 1-4 Management Options 1-5 Manageab[...]

Contents iv Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Understanding no and default Forms of Co mmands 2-4 Understanding CLI Error Messages 2-4 Using Configuration Logging 2-4 Using Command History 2-5 Changing the Co mmand History Buffer Size 2-5 Recalling Commands 2-6 Disabling the Command History Feature 2-6 Using[...]

Contents v Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Modifying the Startu p Con figuration 3-16 Default Boot Configuration 3-17 Automatically Downloading a Configuration File 3-17 Specifying the Filename to Read and Write the System Configuration 3-17 Booting Manually 3-18 Booting a Specific Software Image 3-19 Con[...]

Contents vi Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Stack Member Priority Values 5-8 Switch Stack Offl in e Configurati on 5-8 Effects of Adding a Provisioned Switch to a Sw itch Stack 5-9 Effects of Replacing a Provisioned Switch in a Switch Sta ck 5-1 0 Effects of Removing a Provisioned Switch from a Switch Stac[...]

Contents vii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Hardware Loopback Example: LINK OK event 5-30 Hardware Loo p Example: L INK NOT OK Eve nt 5-31 Finding a Disconnecte d Stack Cable 5-32 Fixing a Bad Connection Between Sta ck Ports 5-33 CHAPTER 6 Clustering Switches 6-1 Understanding Switch Clusters 6-2 Cluster[...]

Contents viii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Configuring NTP 7-4 Default NTP Configuration 7-4 Configuring NTP Authentication 7-4 Configuring NTP Associations 7-5 Configuring NTP Broadcast Service 7-6 Configuring NTP Access Restriction s 7-8 Configuring the Source IP Address for NTP Packets 7-10 Displayin[...]

Contents ix Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 CHAPTER 8 Configuring SDM Temp lat es 8-1 Understanding the SDM Te mplates 8-1 Dual IPv4 and IPv6 SDM Templates 8-2 SDM Templates and Switch Stack s 8-3 Configuring the Switch SDM Template 8-4 Default SDM Template 8-4 SDM Template Configuratio n Guidelines 8-4 S[...]

Contents x Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Default TACACS+ Configuration 10-13 Identifying the TACACS+ Server Host and Setting the Authen tica tion Key 10-13 Configuring TACACS+ Login Authentication 10-14 Configuring TACACS+ Authorization for Pr ivileg ed EXEC Access and Network Services 10-16 Starting TA [...]

Contents xi Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Configuring SSH 10-46 Configuration Guidelines 10 -46 Setting Up the Switch to Run SSH 10-46 Configuring the SSH Server 10-47 Displaying the SSH Configuration and Statu s 10-48 Configuring the Switch for Secure Socket Layer HTTP 10-49 Understanding Secure HTTP S[...]

Contents xii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 802.1x Authen tication with Downloadab le ACLs and Redirect URLs 11-17 Cisco Secure ACS and Attribute-Value Pairs fo r the Redirect URL 11-17 Cisco Secure ACS and Attribute-Value Pairs fo r Downloadable ACLs 11-18 VLAN ID-based MAC Authentication 11-18 802.1x Au[...]

Contents xiii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Configuring 802.1x Violation Modes 11-41 Configuring 802.1x Authenticatio n 11 -41 Configuring the Switch-to-R ADIUS-Server Commun ication 11-43 Configuring the Host Mode 11-44 Configuring Periodic Re-Authentication 11-45 Manually Re-Au thenticating a Client C[...]

Contents xiv Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Session Creation 12-3 Authentication Process 12-3 Local Web Authentication Banner 12 -4 Web Authenticatio n Customizable Web Pages 12-6 Guidelines 12-6 Web-based Authentication In teraction s with Other Features 12-7 Port Security 12-7 LAN Port IP 12-8 Gateway I[...]

Contents xv Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 EtherChannel Port Group s 13-6 10-Gigabit Ethernet Interfaces 13-7 Power over Ethernet Ports 13-7 Supported Protocols and Standa rds 13-7 Powered-Device Detection and Initial Power Allocatio n 13-8 Power Management Mo des 13-9 Power Monitoring and Power Policing[...]

Contents xvi Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Monitoring and Maintaining the Interfaces 13-45 Monitoring Inte rface Status 13-45 Clearing and Resetting Interfaces and Counters 13-46 Shutting Down and Re starting the Interface 13-47 CHAPTER 14 Configuring Auto Smartports Macros 14-1 Understanding Au to Smart[...]

Contents xvii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Configuring Extended-Ra nge VLANs 15-10 Default VLAN Configuration 15-10 Extended-Range VLAN Configuration Gu idelines 15-10 Creating an Extende d-Range VLAN 15-11 Creating an Ex tended-Range VLAN with an Internal VLAN ID 15-13 Displaying VLANs 15-14 Configuri[...]

Contents xviii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 VTP Advertisements 16-4 VTP Versio n 2 16-4 VTP Versio n 3 16-5 VTP Pruning 16-6 VTP and Switch Stacks 16-7 Configuring VTP 16-8 Default VTP Configuration 16-8 VTP Configuration Guidelines 16-9 Domain Names 16-9 Passwords 16-9 VTP Versio n 16-10 Configuration [...]

Contents xix Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Private-VLAN Interaction with Other Features 18-4 Private VLANs and Unicast, Broadcast, and Multicast Traffic 18-4 Private VLANs and SVIs 18-5 Private VLANs and Switch Stacks 18-5 Configuring Private VLANs 18-5 Tasks for Configuring Private VLANs 18-6 Default P[...]

Contents xx Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Spanning-Tree T opology and BPDUs 20-3 Bridge ID, Switch Priority, and Extended System ID 20-4 Spanning-Tree Interfa ce States 20-5 Blocking State 20-6 Listening State 20-7 Learning State 20-7 Forwarding State 20-7 Disabled State 20-7 How a Switch or Port Becomes[...]

Contents xxi Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 CHAPTER 21 Configuring MSTP 21-1 Understanding MST P 21-2 Multiple Spanning-Tree Region s 21-2 IST, CIST, and CST 21-2 Operations Within an MST Region 21-3 Operations Between MST Regions 21-3 IEEE 802.1s Terminology 21-5 Hop Count 21-5 Boundary Ports 21-6 IEEE [...]

Contents xxii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 CHAPTER 22 Configuring Optiona l Spanning-Tree Features 22-1 Understanding Op tional Spanning-Tree Features 22 -1 Understanding P ort Fast 22-2 Understanding BPDU Guard 22-2 Understanding BPDU Filtering 22-3 Understanding Up linkFast 22-3 Understanding Cross -S[...]

Contents xxiii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Configuring Flex Links 23-8 Configuring VLAN Load Balancing on Flex Links 23-10 Configuring the MAC Address-Table Move Upd ate Feature 23 -12 Monitoring Flex Links an d the MAC Address-Table Move Update 23 -14 CHAPTER 24 Configuring DHCP Features and IP Sourc[...]

Contents xxiv Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Configuring DHCP Server Port-Based Address Allocation 24-26 Default Port-Based Address Allocation Configuration 24-26 Port-Based Address Allocati on Configuration Guidelines 24-26 Enabling DHCP Server Port-B ased Address Allocation 24-27 Displaying DHCP Server [...]

Contents xxv Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Configuring TCN-Related Command s 26-11 Controlling the Multicast Floodin g Time After a TCN Event 26-11 Recovering from Flood M ode 26-12 Disabling Multicast Floodin g During a TCN Event 26-12 Configuring the IGMP Snooping Querier 26-13 Disabling IGMP Rep ort [...]

Contents xxvi Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Enabling MLD Immediate Leave 27-9 Configuring MLD Snooping Queries 27 -10 Disabling MLD Listener Message Suppression 27-11 Displaying MLD Snooping In formation 27-12 CHAPTER 28 Configuring Port-Bas ed Traffic Control 28-1 Configuring Storm Control 28-1 Understa[...]

Contents xxvii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 CHAPTER 30 Configuring LLDP, LLDP-MED , and Wired Lo cation Service 30-1 Understanding L LDP, LLDP-MED, and Wired Loca tion Service 30-1 LLDP 30-1 LLDP-MED 30-2 Wired Location Service 30-3 Configuring LLDP, LLDP-MED, and Wired Location Service 30-5 Default LL[...]

Contents xxviii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 SPAN and RSPAN Interaction with Other Feature s 32-9 SPAN and RSPAN and Switch Stacks 32-10 Understanding F low-Based SPAN 32-11 Configuring SPAN and RSPAN 32-12 Default SPAN and RSPAN Configuration 32-12 Configuring Local SPAN 32-12 SPAN Config uration Gui d[...]

Contents xxix Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Setting the Mes sage Display Destination De vice 34-5 Synchronizing Log Messa ges 34-6 Enabling and Disabling Time Stamps on Log Messag es 34-8 Enabling and Disabling Sequence Numbers in Log Messa ges 34-8 Defining the Message Severity Level 34-9 Limiting Sysl[...]

Contents xxx Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Embedded Event Manager Enviro nmen t Variables 36-5 EEM 3.2 36-5 Configuring Embedded Event Man age r 36-6 Registering and Defining an Embedded Event Manager Applet 36-6 Registering and Defining an Em bedded Event Manager TCL Script 36-7 Displaying Embedded Eve [...]

Contents xxxi Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Configuring VLAN Maps 37-31 VLAN Map Configuration Guidelines 37-31 Creating a VLAN Map 37 -32 Examples of ACLs and VLAN Maps 37-3 3 Applying a VLAN Map to a VLAN 37-35 Using VLAN Maps in Your Network 37-35 Wiring Closet Configuration 37-35 Denying Access to a[...]

Contents xxxii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Queueing and Scheduling Overview 39 -14 Weighted Tail Drop 39-15 SRR Shaping and Sharing 39-15 Queueing and Scheduling on Ingress Queues 39-16 Queueing and Scheduling on Egress Queues 39-19 Packet Modification 39-22 Configuring Auto-QoS 39-23 Generated Auto-Qo[...]

Contents xxxiii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Configuring DSCP Maps 39-70 Configuring the CoS-to-DSCP Map 39-71 Configuring the IP-Precede nce-to-DSCP Map 39-72 Configuring the Policed-DSCP Map 39-73 Configuring the DSCP-to-CoS Map 39-74 Configuring the DSCP-to-DSCP -Mutation Map 39-75 Configuring Ingre[...]

Contents xxxiv Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Configuring Layer 3 EtherChannels 40-15 Creating Port-Channel Logical Interfaces 40-15 Configuring the Physical Interfaces 40-16 Configuring EtherChannel Lo ad-Balancing 40-18 Configuring the PAgP Learn Method and Priority 40-19 Configuring LACP Hot-Standby Po[...]

Contents xxxv Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Routing Assistance When IP Routing is Disabled 42-12 Proxy ARP 42-12 Default Gateway 42-12 ICMP Router Discovery Protocol (IRDP) 42-13 Configuring Broadcast Packet Ha ndling 42-14 Enabling Directed Broadcast-to- Physical Broadcast Translation 42 -15 Forwarding[...]

Contents xxxvi Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Managing Routing Policy Changes 42-50 Configuring BGP Decision Attributes 42-52 Configuring BGP Filtering with Route Maps 42-54 Configuring BGP Filtering by Neighbor 42-54 Configuring Prefix Lists for BGP Filtering 42-56 Configuring BGP Community Filtering 42-[...]

Contents xxxvii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Configuring Unicast Reverse Path Forw arding 42-89 Configuring Protocol-Independ ent Features 42-89 Configuring Distributed Cisco Expre ss Forwarding 42-89 Configuring the Number of Equal-Cost Routing Path s 42 -91 Configuring Static Unica st Routes 42-92 Sp[...]

Contents xxxviii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Unsupported IPv6 Unicast Ro uting Features 43-8 Limitations 43-9 IPv6 and Switch Stacks 43-9 Configuring IPv6 43-10 Default IPv6 Configuration 43-11 Configuring IPv6 Addressing and Enabling IPv6 Routing 43-11 Configuring Default Router Preference 43 -13 Conf[...]

Contents xxxix Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 CHAPTER 45 Configuring Cisco IOS IP SLAs Operations 45-1 Understanding Cisco IOS IP SLAs 45-1 Using Cisco IOS IP SLAs to Measure Network Perform ance 45-3 IP SLAs Responder and IP SLAs Control Protocol 45-4 Response Time Computation for IP SLAs 45-4 IP SLAs O[...]

Contents xl Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 WCCP and Switch Stacks 47-4 Unsupported WCCP Features 47-5 Configuring WCCP 47-5 Default WCCP Configuration 47-5 WCCP Configuration Guidelines 47-5 Enabling the Web Cache Se rvice 47-6 Monitoring and Maintaining WCCP 47-10 CHAPTER 48 Configuring IP Multicast Rout[...]

Contents xli Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Configuring Source Specific Multicast Ma pping 48-17 SSM Mapping Configuration Gu idelin es and Restrictions 48-17 SSM Mapping Overview 48-18 Configuring SSM Mapping 48-20 Monitoring SSM Mapping 48 -22 Configuring PIM Stub Routing 48-22 PIM Stub Routing Config [...]

Contents xlii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Configuring Advanced DVMRP Interope rability Features 48-54 Enabling DVMRP Unicast Routing 48-54 Rejecting a DVMRP Nonpruning Neighbor 48-55 Controllin g Ro ut e Exchanges 48-58 Limiting the Number of DVMRP Routes Advertised 48-58 Changing the DVMRP Route Th re[...]

Contents xliii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 CHAPTER 50 Configuring Fallback Bridging 50-1 Understan di ng Fallbac k Bridging 50-1 Fallback Bridging Overview 50 -1 Fallback Bridging and Switch Stacks 50-3 Configuring Fallback Bridging 50 -3 Default Fallback Bridging Configuration 50-3 Fallback Bridging [...]

Contents xliv Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Using Layer 2 Traceroute 51-16 Understanding L ayer 2 Tra ceroute 51-16 Usage Guidelines 51-17 Displaying the Physical Path 51-17 Using IP Traceroute 51-18 Understanding IP Traceroute 51-18 Executing IP Traceroute 51-18 Using TDR 51-19 Understanding TDR 51-19 R[...]

Contents xlv Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 APPENDIX A Supported MIBs A-1 MIB List A-1 Using FTP to Access the MIB Files A-4 APPENDIX B Working with the Cisco IOS File System, Configuration Fi les, and Software Images B-1 Working with the Flash File System B-1 Displaying Available File Systems B-2 Settin[...]

Contents xlvi Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Working with Software Images B-25 Image Location on th e Switch B-26 File Format of Im ag e s on a Server or Cisco . c o m B-26 Copying Image Files By Using TFTP B-27 Preparing to Download or Upload an Image File By Using TFTP B-28 Downloading an Image File By [...]

Contents xlvii Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Fallback Bridging C-4 Unsupported Privileged EXEC Comma nds C-4 Unsupported Global Configuratio n Commands C-4 Unsupported Interface Configuration Commands C-5 HSRP C-5 Unsupported Global Configuratio n Commands C-5 Unsupported Interface Configuration Command[...]

Contents xlviii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 QoS C-12 Unsupported Global Configura tion Command C-12 Unsupported Interface Configuration Commands C-12 Unsupported Policy-Ma p Configuration Command C-12 RADIUS C-12 Unsupported Global Configura tion Commands C-12 SNMP C-13 Unsupported Global Configura tio[...]

xlix Catalyst 3750-X and 3560-X Switch Software Configurat ion Guide OL-21521-01 Preface Audience This guide is for the n etworking pr ofessional managing the st andalone Catalyst 3750-X or 35 60-X switch or the Cataly st 3750-X switch st ack, referred to as the switc h . Before using this guide, you should ha ve exp erience working with the Cisco [...]

l Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Preface • Square brackets ([ ]) mean optional el ements. • Braces ({ }) group required choices, and v ertical bars ( | ) separate the alternati ve elements. • Braces and vertical bars within square brackets ([ { | }]) mean a required choi ce within an optional elemen[...]

li Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Preface • Cisco IOS Softwar e Installation Docu ment • Catalyst 3750-X and 3560- X Switc h Getting Started G uide • Catalyst 3750-X and 3560- X Switc h Har dwar e Installation Guide • Re gulatory Compliance and Safety Informati on for the Catalyst 3750-X an d 3560[...]

lii Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Preface[...]

CH A P T E R 1-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 1 Overview This chapter p rovides these topics ab out the Catalyst 3750-X and 356 0-X switch software : • Features, page 1-1 • Default Setti ngs After Initial Switch Conf iguration, page 1-16 • Network Confi guration Examples, p age 1-19 • Where to G[...]

1-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Features • IP services feature set, which prov ides a richer set of enterprise-cla ss intellig ent services and full IPv6 support. It inclu des all IP base features plus full Layer 3 routing (IP unicast routin g, IP mu lticast routin g, and fallback[...]

1-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Features – Interacti ve guide mode that guides you in co nfiguring complex featu res such as VLANs, A CLs, and quality of service (QoS). – Config uration wizards that prompt you to provi de only the minimum requi red information to configure comple[...]

1-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Features • Smart Install to allo w a single point of manage ment (direct or) in a network. Y ou can use Smart Install to pro vide zero touch image and conf iguration upgrade of ne wly deployed switches and image and conf iguration downloads for any [...]

1-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Features • IGMP snooping quer ier support to conf igure switch to generate perio dic IGMP General Query messages • IIGMP Helper to allo w the switch to forward a host request to join a multicast stream to a specif ic IP destination address • Mult[...]

1-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Features station or PC. Y ou can manage the switch stack by connecting to the console port or Ethernet management port of an y stack member . Fo r more information about the CLI, see Chapter 2, “Using the Command-Line Interface. ” • SNMP—SNMP [...]

1-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Features • Config uration logging to lo g and to vie w changes to t he switch conf iguration • Config uration replacement an d rollback to replace t he running conf iguration on a swi tch with any sav ed Cisco IOS configuratio n file • Unique de [...]

1-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Features • USB T ype A port for e xternal Cisco USB flash memor y de vices (thumb dri ves or USB ke ys). Y ou can use standard Cisco CLI commands to rea d, writ e, eras e, copy , or boot from the flash memory . Note For addition al descriptions of t[...]

1-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Features • Flex Link Layer 2 inte rfaces to back up one another as an al ternativ e to STP for basic link redundanc y • Link-state tracking t o mirror the state of the ports that carry upstream tra ff ic from connected hosts and servers and to allo[...]

1-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Features • Password-protected access (read-only and read-wr ite access) to management interf aces (de vice manager , Network Assistant, and t he CLI) for protection ag ainst unauthorized conf iguration changes • Multile vel security f or a choice[...]

1-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Features – IP phone detec tion enhancemen t to de tect and recognize a Cisco IP phone – Guest VLAN to pro vide limited services t o non-IEEE 802.1x-co mpliant users – Restricted VLAN to pro vide limited services to users who are IEEE 802.1x comp[...]

1-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Features • IEEE 802.1x readiness check to dete rmine the readiness of connected end hosts before conf iguring IEEE 802.1x on the switch • Support for IP source guard on st atic hosts • RADIUS Change of Authorization (CoA) to change the attrib u[...]

1-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Features • Classification – IP type-of-service/Dif ferentiated Services Co de Point (IP T oS/DSCP) and IEEE 802.1p CoS marking priorities on a p er-port b asis for protecting the perf ormance of mission-critical applications – IP T oS/DSCP and I[...]

1-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Features Layer 3 Features Note Features in this section are not supported on swi tches running the LAN base feature set. Some features noted are av ailable only in the IP services feature set. • HSRP V ersion 1 (HSRPv1) an d HSRP V ersion 2 (HSRPv2[...]

1-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Features • IPv6 default router prefer ence (DRP) for improv ing the ability of a host t o select an appropriate router • Support for EIGRP IPv6, which utilizes IPv6 transport, communicates with IPv6 peer s, and advertis es IPv6 routes • IP unica[...]

1-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Default Settings After In itial Switch Configuration • Four gro ups (history , statistics, alarms, and events) of embedded RM ON agents for network monitoring and traf fic analysis • Syslog facil ity for logging system messages ab out authenticat[...]

1-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Default Settings After In itial Switch Configuration • Default d omain name is not conf igured. For more in formation, see Chapter 3, “ Assigning th e Switch IP Address and Default Gateway . ” • DHCP client is enabled, the DHCP server is enabl[...]

1-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Default Settings After In itial Switch Configuration – VTP version is V ersion 1. Fo r more information, see Chapter 16, “Conf iguring VTP . ” – No pri vate VLANs are conf igured. For more information, see Chapter 18, “Conf iguring Priv ate[...]

1-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Network Config uration Example s • No A CLs are configured. For more information, see Chapter 37, “Configuring Network Secu rity with A CLs. ” • QoS is disabled. For more information, see Chapter 39, “Configuring QoS. ” • No EtherChannel[...]

1-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Network Config uration Examples Bandwidth alone is not th e only consideration when designing y our network. As you r network traf fic prof iles ev olve, consider prov iding network services th at can support appli cations for v oice and data integra[...]

1-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Network Config uration Example s Y ou can use the switches a nd switch stacks to create the follo wing: • Cost-ef fecti ve wiring closet ( Figure 1-1 )—A cost-ef fectiv e way to connect man y users to the wiring closet is to ha ve a switch stack o[...]

1-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Network Config uration Examples • High-performance wiring closet ( Figure 1-2 )—F or high-speed access to n etwork resources, you can use Catalyst 3750-X switches an d switch stacks in the ac cess layer to provide Gigabit Ethernet access to the d[...]

1-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Network Config uration Example s Figur e 1 -3 High-P erfor mance W ork group (Gi g abit-to-the-Deskt o p) with Catalyst 3560-X Standalone Switches 200853 Access-la yer standalone s witches Stacking-capab le s witches 200854 Cisco 2600 router Access-la[...]

1-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Network Config uration Examples • Redundant Gigabi t backbone ( Figure 1-4 )—Using HSRP , you can create back up paths between two Catalyst 3750-X Gigabit switches to enhance netw o rk reliability and load-b al ancing for dif ferent VLANs and sub[...]

1-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Network Config uration Example s Figur e 1 -5 Server A ggregation 86931 Si Si Si Si Si Si Campus core Catalyst 6500 s witches Catalyst 4500 multila yer switches StackWise Plus s witch stacks Ser v er rac ks 200857 Campus core Catalyst 6500 s witches S[...]

1-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Network Config uration Examples 86931 Si Si Si Si Si Si Campus core Catalyst 6500 s witches Catalyst 4500 multila yer switches StackWise Plus s witch stacks Ser v er rac ks Figur e 1 -6 Linux Serv er Cluster Small to Medium-Sized Network Using Cataly[...]

1-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Network Config uration Example s This network uses VLANs to logically segment the netwo rk into well-def ined broadcast groups and for security management. Dat a and multimedia traf fic are config ured on the same V LAN. V oice traf fic fr om the Cisc[...]

1-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Network Config uration Examples Figur e 1 -8 Catalyst 3560-X Switc h es in a Collapsed Bac kbone Configur ation Large Network Using Cata lyst 3750-X and 3560-X Switches Switches in the wiri ng closet ha ve trad itionally been only Layer 2 de vices, b[...]

1-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Network Config uration Example s Figur e 1 -9 Catalyst 3750-X Switch Stac ks in Wir i ng Closets in a Backbone Configuration Cisco 7x00 routers Catalyst 6500 multila yer switches Cisco IP Phones with workstations IEEE 802.3af-compliant powered de vice[...]

1-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Network Config uration Examples Figur e 1 -1 0 Catalyst 3560-X Switc hes in Wiring Closets in a Backbone Configuration Cisco 7x00 routers Catalyst 6500 multila yer switches Standalone s witches Standalone s witches Cisco IP Phones with workstations W[...]

1-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Network Config uration Example s Multidwelling Network Using Catalyst 3750-X Switches A gro wing segment of resi dential and commerci al cu stomers are requ iring high- speed access to Ethernet metropolitan-area n etworks (MANs). Figur e 1-11 shows a [...]

1-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Network Config uration Examples Figur e 1 -1 1 Catalyst 3 750-X Switches in a MAN Con figuration Long-Distance, High-Bandwidt h Transport Configuration Figure 1-12 shows a configuration for sending 8 Gi gabits of data over a single fiber-optic cable.[...]

1-33 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overview Where to Go Next Figur e 1 -12 Long-Distance, High -Bandwidth T ransport Configuration Where to Go Next Before conf iguring the switch, re view th ese sections for startup information: • Chapter 2, “Using t he Command-Line Interface” • Chapter[...]

1-34 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 1 Overvi ew Where to Go Ne xt[...]

CH A P T E R 2-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 2 Using the Command-Line Interface This chapter descr ibes the Cisco IOS command-line interface (CLI ) and ho w to use it t o configure your standalone Catalyst 3750-X or 356 0-X switch or a Catalyst 3750-X s witch stack , referred to as the switc h . It con[...]

2-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 2 Using the Comman d-Line Interface Understanding Command Modes Ta b l e 2-1 describes the main comma nd modes, ho w to acc e ss each one, the prompt you see in that mode, and ho w to exit the mode. The e xamples in the table use the hostname Switc h . Ta b l e 2[...]

2-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 2 Using th e Co mmand-Line Interface Understanding the Help Syste m For more detail ed information on the co mmand modes, see the co mmand reference gu ide for this release. Understanding the Help System Y ou can enter a question mark (?) at the system prompt to [...]

2-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 2 Using the Comman d-Line Interface Understanding no an d default Forms of Command s Understanding no and default Forms of Commands Almost e very conf iguration command also h as a no form. In general, use the no form to disable a featur e or function or re verse[...]

2-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 2 Using th e Co mmand-Line Interface Using Comman d History command was entered, and the parser return code for the command. This feat ure includes a me chanism for asynchronous notif ication to registered appli cations whene ver the conf iguration changes. Y ou [...]

2-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 2 Using the Comman d-Line Interface Using Editing Features Recalling Commands T o recall commands from the history b uffer , perform one of the actions listed in Ta b l e 2-4 . These actions are optional. Disabling the Command History Feature The command history [...]

2-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 2 Using th e Co mmand-Line Interface Using Editing Features T o re-enable the enhanced editing mode for the current terminal session, enter this command i n pri vileged EXEC mod e: Switch# terminal editing T o reconf igure a specific lin e to hav e enhanced editi[...]

2-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 2 Using the Comman d-Line Interface Using Editing Features Editing Command Lines that Wrap Y ou can use a wraparound featu re for commands that e xtend be yond a single line on the screen. Wh en the cursor reaches the right margin, the command line shifts ten spa[...]

2-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 2 Using th e Co mmand-Line Interface Searching and Filtering Output of show and more Commands After you complete the entry , press Ctrl-A to check the c omplete sy ntax before pressing the Return key to ex ecute the command. The dollar sign ($) appears a t th e e[...]

2-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 2 Using the Comman d-Line Interface Accessing the CLI T o debug a specif ic stac k member , you can a ccess it from the stack master b y using the session stac k-member- number privile ged EXEC command . The stack member number is appe nded to the system prompt.[...]

CH A P T E R 3-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 3 Assigning the Switch IP Address and Default Gateway This chapter describes ho w to create the initial sw itch configur ation (for ex ample, assigning the IP address and default ga te way information) by using a v a riety of automatic and man ual methods. I[...]

3-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information The normal boot process in vol ves the operati on of the boot loader softw are and includes these activities: • Performs lo w-lev el CPU initialization. It initi alizes the CPU [...]

3-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information Note Stack members retain their IP addr ess when you remov e them from a sw itch stack. T o av oid a conflict by ha ving two dev ices with the same IP address in your netw ork, ch[...]

3-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information W ith DHCP-based autoconfigurati on, no DHCP client-si de configurati on is needed on your swi tch. Howe ver , you need to configure the DHCP server for v arious lease opti ons as[...]

3-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information The DHCP serv er sends the clien t a DHCPN AK denial broadc ast message, w hich means th at the of fered confi guration parameters ha ve not been assigned, that an erro r has occu[...]

3-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information Note For procedures to c onfigure the sw itch as a D HCP server , see the “Configuring DHCP Au toconfiguration (Only Configuration File)” se ction on page 3-1 1 and the “Con[...]

3-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information DHCP Server Configuration Guidelines Follo w these guidelines if you are co nf iguring a device as a DHCP server: • Y ou should configure the DHCP server with reserv ed leases t[...]

3-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information For the swit ch to successfully do wnload a configuration f ile, the TFTP serv er must contain one or mor e confi guration fi les in its base directory . The files can include th [...]

3-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information Figur e 3-2 Relay Device Used in A utoconfigur ation Obtaining Configuration Files Depending on the a vailability o f the IP address a nd the conf iguration filen ame in the DHCP [...]

3-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information Note The switch broadcasts TFTP serv er requests if the TFTP server is not obtained from the DHCP replies, if all attempts to read the conf iguration f ile through unicast transm[...]

3-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information TFTP Server Conf iguration (on UNIX) The TFTP serv er base di rectory is set t o /tftpserver/ w ork/. Th is directory contai ns the network-co nfg fi le used in the two-f ile rea[...]

3-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information This exampl e show s how to configu re a switch as a DHCP server so th at it will do wnload a configura - tion file: Switch# configure terminal Switch(config)# ip dhcp pool pool [...]

3-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information This exampl e sho ws how to conf igure a switch as a DHCP serv er so it downloads a conf iguration file: Switch# config terminal Switch(config)# ip dhcp pool pool1 Switch(dhcp-co[...]

3-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Assigning Switch Information Configuring the Client Beginning in pri vileged EXEC mode, foll ow th ese steps to conf igure a switch to do wnload a confi guration f ile and ne w image from a DHCP serv er: Thi[...]

3-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Checking and Saving the Running Configuration Manually Assigning IP Information Beginning in pri vileged EXEC mod e, follo w these steps to manually assign IP inform ation to multiple switched virtual interf[...]

3-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Modifying the Star tup Configuration service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname Stack1 ! enable secret 5 $1$ej9.$DMUvAUnZOAmvmgqBEzIxE0 ! . <ou[...]

3-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Modifying the Startup Configuration See also Appendix B, “W orking with the Cisco I OS File System, Conf iguration Files, and Softw are Images, ” for information about switch configur ation f iles. See t[...]

3-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Modifying the Star tup Configuration T o return to the def ault setting, use the no boot conf ig-file global con figurat ion command. Booting Manually By default, th e switch automatically boot s up; ho we v[...]

3-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Modifying the Startup Configuration Booting a Specific Software Image By default, the switch at tempts to automatically bo ot up t he system using information in th e BOO T en vironment var iable. If this v [...]

3-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Modifying the Star tup Configuration Controlling Environment Variables W ith a normally operating swit ch, you enter the boot loader mo de only through a switch consol e connection conf igured for 9600 b/s. [...]

3-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Modifying the Startup Configuration When the switch is connected to a PC thr ough the Ethernet manageme nt port, you can download or upload a conf iguration f ile to the boot loader b y using TFTP . Make su [...]

3-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Scheduling a Reload of the Software Image Scheduling a Reload of the Software Image Y ou can schedule a relo ad of t he software image to occur on the switch at a later ti me (for example, late at night or d[...]

3-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Scheduling a Relo ad of the Software Image This exampl e show s how to reload the software on th e switch at a future tim e: Switch# reload at 02:00 jun 20 Reload scheduled for 02:00:00 UTC Thu Jun 20 1996 ([...]

3-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 3 Assigning the Sw itch IP Address and Default Gateway Scheduling a Reload of the Software Image[...]

CH A P T E R 4-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 4 Configuring Cisco IOS Configuration Engine This chapter describe s ho w to configure the feature on t he Catalyst 3750-X or 3560-X swit ch. Unless otherwise noted , the term switc h refers to a Catalyst 3750-X o r 3560-X standalone switch and to a Ca talys[...]

4-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Understanding Cisco Configuration Engine Softw ar e Figur e 4-1 Config uration Engi ne Arc hi tect u ral Overview These sections contain this conceptual information: • Config uration Service, page 4-2 • Event Servi[...]

4-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Understanding Cisco Co nfig uration Engine Software Event Service The Configuration Engine uses th e Event Service for receipt and generati on of conf iguration ev ents. The ev ent agent is on the sw it ch and facilita[...]

4-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Understanding Cisco Configuration Engine Softw ar e DeviceID Each confi gured switch participating on the ev ent bu s has a uni que DeviceID, which is analogous to th e switch source address so that the sw itch can be [...]

4-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Understanding Cisco IOS Agents Understanding Cisco IOS Agents The CNS ev ent agent feature allows the switch to publish and subscrib e to e vents on the e vent bu s and works with the Cisco IOS ag ent. The Cisco IOS ag[...]

4-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Configuring Cisco IO S Agents Incremental (Partial) Configuration After the networ k is running, ne w services can be added by using the Cisco IOS agent. Incremental (partial) conf igurations can be sent to the switch.[...]

4-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Configuring Cisco IOS Agents Note For more informati on about running the set up program and creatin g templates on the Conf iguration Engine, see the Cisco Configur ation Engine Insta llation and Setup Gui de, 1.5 for[...]

4-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Configuring Cisco IO S Agents Enabling the CNS Event Agent Note Y ou must enable the CNS event ag ent on the switch before you en able the CNS configuration agent. Beginni ng in pri vileged EXEC mod e, follo w these st[...]

4-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Configuring Cisco IOS Agents Enabling the Cisco IOS CNS Agent After enabling the CNS ev ent agent, start the Cisco IOS CNS agent on the switch. Y ou can enable the Cisco IOS agent with these commands: • The cns confi[...]

4-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Configuring Cisco IO S Agents Step 7 di scover { contr oller contr oller -type | dlci [ subinterface subinterfa ce-number ] | interface [ interface-type ] | line line-type } Specify the interface parame ters in the CN[...]

4-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Configuring Cisco IOS Agents Step 13 cns id interface num { dns-reverse | ipad dress | mac-addr ess } [ eve nt ] [ image ] or cns id { har dwar e-serial | hostname | string string | udi } [ event ] [ image ] (Optional[...]

4-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Configuring Cisco IO S Agents T o disable the CNS Cisco IOS agent, us e the no cns conf ig initial { ip-addr ess | hostname } g lobal confi guration command. This exampl e sho ws how to conf igure an initial co nfigu [...]

4-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Configuring Cisco IOS Agents This exampl e sho ws how to conf igure an initial co nfigu ration on a remote switch when the switch IP address is kno wn. The Configurat ion Engine IP address is 172 .28.129.22. Switch(co[...]

4-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 4 Configuring Cisco IOS Configuration Engine Displaying CNS Configuration Displaying CNS Configuration Y ou can use the pri vileg ed EXEC commands in Ta b l e 4-2 to display CNS configu ration informat ion. Ta b l e 4-2 Displaying CNS Configur ation Command Purp[...]

CH A P T E R 5-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 5 Managing Switch Stacks This chapter pro vides the concepts and procedures to manage Catalyst 3750-X switch stacks. Note The LAN base feature set supports sw itch stacks only wh en all switches in the stack are run th e LAN base feature set. The switch comm[...]

5-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Understanding Switch Stacks Understanding Switch Stacks A switch stack is a set of up to nine stacking-capab le switches connected thro ugh their StackW ise Plus or StackW ise ports. Y ou c an connect only one swit ch type in a stack, o[...]

5-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Understanding Switch Stack s The system-le vel features supported on the stack ma ster are supported on the entire switch stack. If a switch in the stack is runnin g the IP base or IP services feature set a nd the cryptographic (that is, [...]

5-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Understanding Switch Stacks – Additional Considerations fo r System-W ide Configurati on on Switch Stacks, page 5-16 – Switch Stack Management Co nnecti vity , page 5-17 – Switch Stack Configuration Sce narios, page 5-18 Note A sw[...]

5-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Understanding Switch Stack s For more inf ormation about cablin g and p owering switch stacks, see th e “Switch Installation” chapter in the hardware installation guide. Figur e 5-1 Creating a S witch Stac k fr om T wo Standalone Swit[...]

5-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Understanding Switch Stacks 4. The switch with the hig her priority feature set and so ftware image combination. These co mbinations are listed from highest to lo west priority . Note The noncryptograp hic images apply only to mixed sta[...]

5-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Understanding Switch Stack s As described in the hardware instal lation guide, you can use the Master LED on the switch to see if th e switch is the stack master . Switch Stack Bridge ID and Router MAC Address The bridge ID and rout er MA[...]

5-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Understanding Switch Stacks • If you mer ge switch stacks, the switches th at join the switch stack of a ne w stack master select the the lo west av ailable numbers in the stack. For mo re information about merging switch stacks, see [...]

5-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Understanding Switch Stack s Effects of Adding a Provisi oned Switch to a Switch Stack When you add a provisioned switch to the sw itch stack, the stack applies either the provisioned confi guration or the defau lt configu ration. Ta b l [...]

5-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Understanding Switch Stacks If you add a prov isioned switch that is a diff erent type than specif ied in th e provisioned conf iguration to a po wered-do wn switch stack and then apply po wer, the switch stack rejects the (no w incorr[...]

5-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Understanding Switch Stack s V ersion-mismatch (VM) mode has pri ority ov er SD M-mismatch mode. If a VM-mode condition and an SDM-mismatch mode e x ist, the switch stack f irst attempts to resolv e the VM-mode condition. Y ou can use th[...]

5-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Understanding Switch Stacks Minor Version Number Incompatibility Among Switches Switches with the same m ajor version numb er but wit h a dif ferent minor version numbe r are considere d partially compat ible. When connected to a switc[...]

5-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Understanding Switch Stack s • Automatic advise (auto -advise) oc curs when th e au to-upgrade process cannot f ind appropriate stack member software t o copy to the switch in VM mode. This process tells you th e command ( ar chive cop[...]

5-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Understanding Switch Stacks *Mar 11 20:36:15.038:%IMAGEMGR-6-AUTO_COPY_SW: Minimum Dram required:0x08000000 *Mar 11 20:36:15.038:%IMAGEMGR-6-AUTO_COPY_SW: Image Suffix:ipservices-122-35.SE2 *Mar 11 20:36:15.038:%IMAGEMGR-6-AUTO_COPY_SW[...]

5-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Understanding Switch Stack s *Mar 1 00:04:22.537:%IMAGEMGR-6-AUTO_ADVISE_SW:members have been scanned, and it h as *Mar 1 00:04:22.537:%IMAGEMGR-6-AUTO_ADVISE_SW:been determined that the stack can be *Mar 1 00:04:22.537:%IMAGEMGR-6-AUTO_[...]

5-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Understanding Switch Stacks The interface-specific conf iguration of each stack me mber is associated with the stack member numb er . As mentioned in the “Stack Member Numbers” section on page 5-7 , stack members re ta in their num[...]

5-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Understanding Switch Stack s Switch Stack Management Connectivity Y ou manage the sw itch stack and the stack member in terfaces through the sta ck master . Y ou can use the CLI, SNMP , Network Assistant, an d CiscoW orks netw o rk manag[...]

5-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Understanding Switch Stacks Be careful w hen using multiple CLI sessions to the stack master . Commands that you enter in one session are not displa yed in the oth er sessions. Therefor e, it is possible that you might not be ab le to [...]

5-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Understanding Switch Stack s Stack master election specifically determined by the cr yptographic softwar e image and th e IP services feature set and the IP servi ces feature set Assuming that all stack members have the same pr iority v [...]

5-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Configuring the Switch Stack Configuring the Switch Stack These sections contain this configu ration informat ion: • Default Swi tch Stack Conf iguration, page 5-20 • Enabling Persistent MA C Address, page 5-20 • Assigning Stack [...]

5-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Configuring the Switc h Stack the previous stack ma ster does not rejoin the stack during this period, the switch stack takes the MA C address of the new stack master as the stack MA C a d dress.Y ou can also conf igure stack MA C persis[...]

5-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Configuring the Switch Stack Use the no stack-mac persistent timer global conf iguration command to disable the persist ent MA C address feature. This examp le shows h ow to conf igure the persistent MA C address feature for a 7-mi nut[...]

5-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Configuring the Switc h Stack Beginni ng in pri vileged EXEC mode, fo llow th ese steps to assign a member number to a stack member . This procedure is optional. Setting the Stack Member Priority Value Note This task is av ailable only f[...]

5-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Configuring the Switch Stack Beginning in pri vileged EXEC mode, follo w these steps to prov ision a ne w member for a switch stack. This procedure is optional. T o remov e pro visioned information and to av oid rece i ving an error me[...]

5-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Accessing the CLI of a Specific Stack Member Accessing the CLI of a Specific Stack Member Note This task is only for deb ugging purposes, and is only a vailable fr om the master . Y ou can access all or specific members by using the r em[...]

5-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Troubleshooting Stacks • Finding a Disconnected Stack Cable, page 5-3 2 • Fixing a Bad Connection Between Stack Ports, page 5-33 Manually Disabling a Stack Port If a stack port is flap ping and causing instabilit y in the stack rin[...]

5-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Troubleshooting Stacks Understanding the show switch stack-ports summary Output Only Port 1 on stack member 2 is disabled. Switch# show switch stack-ports summary Switch#/ Stack Neighbor Cable Link Link Sync # In Port# Port Length OK Act[...]

5-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Troubleshooting Stacks Identifying Loopback Problems • Software Loopback, page 5-28 • Software Loopback Example: No Connected Stack Cable, page 5-29 • Software Loopback Exampl es: Connected Stack Cabl es, page 5-29 • Hardware L[...]

5-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Troubleshooting Stacks Switch#/ Stack Neighbor Cable Link Link Sync # In Port# Port Length OK Active OK Changes Loopback Status To LinkOK -------- ------ -------- -------- ---- ------ ---- --------- -------- 1/1 Absent None No cable No N[...]

5-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Troubleshooting Stacks Hardware Loopback The show platf orm stack ports b uffer pri vileged EXEC co mmand output sho ws the hardware loopback va lu e s . Switch# show platform stack ports buffer Stack Debug Event Data Trace ===========[...]

5-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Troubleshooting Stacks On a Catalyst 3750-E or 3750-X sw itch: Switch# show platform stack ports buffer Stack Debug Event Data Trace ========= ===================================================== Event type LINK: Link status change Even[...]

5-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Troubleshooting Stacks On a Catalyst 3750-E or 3750-X sw itch: Switch# show platform stack ports buffer Stack Debug Event Data Trace ========= ===================================================== Event type LINK: Link status change Ev[...]

5-33 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 Managing Switch Stacks Troubleshooting Stacks Switch#/ Stack Neighbor Cable Link Link Sync # In Port# Port Length OK Active OK Changes Loopback Status To LinkOK -------- ------ -------- -------- ---- ------ ---- --------- -------- 1/1 OK 2 50 cm Yes Yes Yes 1 [...]

5-34 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 5 M ana ging Switch Stacks Troubleshooting Stacks[...]

CH A P T E R 6-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 6 Clustering Switches This chapte r provid es the concepts and procedures to create and manage Catalyst 3750-X and 3560-X switch clusters. Unless otherwise noted, the te rm switch refers to a stan dalone switch and to a switch stack. Y ou can create and mana[...]

6-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Sw itc hes Understanding Switch Clusters Understanding Switch Clusters A switch clus ter is a set o f up to 16 c onnected, cluster- capable Catalyst switches that are managed as a single entity . The switches in the cluster use the swi t ch clusterin[...]

6-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Switches Understanding Switch Cluste rs Cluster Command Switch Characteristics A cluster command switch must meet these requirements: • It is running a supported sof tware release. • It has an IP address. • It has Cisco Disco very Pro tocol (CD[...]

6-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Sw itc hes Planning a Switch Cluster Note Standby clu ster command switches must be th e same type of switches as the cluster command switch. For e xample, if the cluster command switch is a Catalyst 3750-E sw itch, the standb y clu ster command swit[...]

6-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Switches Planning a Switch Cluster • SNMP Community Strings, page 6- 14 • Switch Clusters and Switch S tacks, page 6-14 • T ACA CS+ and RADIUS, page 6-16 • LRE Prof iles, page 6-16 See the release notes for the list of Cataly st switches elig[...]

6-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Sw itc hes Planning a Switch Cluster Figur e 6-1 Discovery Through CDP Hops Discovery Through Non-CDP-Capable and Noncluster-Capable Devices If a cluster command switch is connected to a non-CDP-capab le thir d-party hub (such as a non-Cisco hub), it[...]

6-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Switches Planning a Switch Cluster Discovery Through Different VLANs If the cluster command switch is a Catalyst 3560-E, Catalyst 3750-E, Catalyst 3560-X , or Catalyst 3750-X switch, the cluster can hav e cluster member switches in dif ferent VLANs. [...]

6-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Sw itc hes Planning a Switch Cluster Note If the switch cluster has a Catal yst 3750-E or Cata ly st 3750-X switch or switch stack, that switch or switch stack must be the cluster command switch. The cluster command switch an d standby command swit c[...]

6-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Switches Planning a Switch Cluster Figur e 6-5 Discovery Through Routed P orts Discovery of Newly Installed Switches T o join a cluster , the new , out-of-the-box switch must be connected to t he cluster through one of its access ports. An access por[...]

6-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Sw itc hes Planning a Switch Cluster HSRP and Standby Cluster Command Switches The switch supports Hot Standb y Router Protocol (HSRP) so that you can con figur e a group of standb y cluster command switches. Because a cluster co mmand switch manage[...]

6-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Switches Planning a Switch Cluster Virtual IP Addresses Y ou need t o assign a uni que virtual IP ad dress and group number and name to the cluster standb y group. This information must be conf igur ed on a specif ic VLAN or routed port on the acti [...]

6-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Sw itc hes Planning a Switch Cluster • Each standb y-group member ( Figure 6-7 ) must be connected to th e cluster command switch through the same VLAN. In this example, the clus t er command switch and standby cluster command switches are Catalys[...]

6-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Switches Planning a Switch Cluster • This limitation applies to all clu sters: If the acti ve cluster command swi tch fails and there are more than two switches in the cluster standb y group, the ne w cluster command switch does not discov er any [...]

6-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Sw itc hes Planning a Switch Cluster Passwords Y ou do not ne ed to assign passwords to an indi vidual swit ch if it wi ll be a cl uster mem ber . When a switch joins a cluster , it inherits the com mand-switch password and retains i t when it lea v[...]

6-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Switches Planning a Switch Cluster Recall that stack members w ork together to beha ve as a unif ied system (as a single switch st ack) in the network and are presented to the network as such by Layer 2 an d Layer 3 protocols. Th erefore, the swi tc[...]

6-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Sw itc hes Using the CLI to Mana ge Switch Clusters • If a cluster member switch stack reloads and a ne w stack master is elected, the switch stack loses connecti vity with the cluster command switch. Y ou must add the switch stack back to the swi[...]

6-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Switches Using SNMP to Manage Switch Clusters Catalyst 1900 and Catalyst 2820 CLI Considerations If your switch cluster has Cat alyst 1900 and Catalyst 2820 switches run ning standard edit ion software, the T elne t session accesses the management c[...]

6-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 6 Clustering Sw itc hes Using SNMP to Manage Switch Clusters Figur e 6-8 SNMP Ma nagement f or a Cluster Tr a p Tr a p Tr a p Command s witch T rap 1, T rap 2, T rap 3 Member 1 Member 2 Member 3 33020 SNMP Manager[...]

CH A P T E R 7-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 7 Administering the Switch This chapter describes h ow to perf orm one-t ime operat ions to administer the Catalyst 3750-X or 35 60-X switch. Unless otherwise not ed, the term switc h refers to a Catalyst 3750-X or 3560-X standalon e switch and to a Ca talys[...]

7-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the System Time and Date Understanding the System Clock The heart of the time service is th e system clock. This clock runs fro m the moment the system st arts up and keeps track of the date and time. The system clock can then[...]

7-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the System T ime and Date Cisco’ s implementation o f NTP does not support st ratum 1 service; it is n ot possible to connect to a radio or atomic clock. W e recommend that the time service for your network be deri ved from t[...]

7-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the System Time and Date Configuring NTP The switch does not ha ve a hardware-sup ported cloc k and cannot functi on as an NTP master clock to which peers synchronize themselv es when an ex ternal NTP source is not a vailable.[...]

7-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the System T ime and Date T o disable NTP authentication, use the no ntp authenticate global conf iguration command. T o remove an authentication key , us e th e no ntp authentication-key number global conf iguration co mmand. [...]

7-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the System Time and Date Beginni ng in pri vileged EXEC mode, follo w these steps to fo rm an NTP associat ion with another de vice: Y ou need to conf igure only one end of an associat ion; the other de vice can automatically [...]

7-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the System T ime and Date The switch can send or receiv e NTP broadcast packets on an interface-by -interfa ce basis if there is an NTP broadcast server , such as a router, broadcasting time i nformation on the netw ork. The sw[...]

7-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the System Time and Date T o disable an inte rface from receiv ing NTP br oadcast packets, use the no ntp broadcast client interface confi guration command. T o change the estimated round-trip delay to the default, use the no [...]

7-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the System T ime and Date The access group keyw ords are scanned in this orde r, from least restricti ve to most restr ictiv e: 1. peer —Allows time req uests and NTP control queries and allo ws the switch to synchronize it s[...]

7-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the System Time and Date Disabling NTP Services on a Spe cific Interf ace NTP services are enabled on all interfaces by default. Be gi nn in g i n pr ivi le ge d E X EC mo de , fo ll ow t he s e s te p s t o d is a bl e NTP p[...]

7-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the System T ime and Date Displaying the NTP Configuration Y ou can use two privile g ed EXEC comman ds to display NT P information: • show ntp associations [ detail ] • show ntp status For detailed in formation ab out the[...]

7-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the System Time and Date Displaying the Time and Date Configuration T o display the time and date conf iguration, use the show clock [ detail ] pri vileged EXEC command. The system clock keeps an au thoritative flag that sho [...]

7-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the System T ime and Date Configuring Summer Time (Daylight Saving Time) Beginni ng in pri vileged EXEC mode, follo w these steps to conf igure summer time (daylight sa ving time) in areas where it starts and ends on a particu[...]

7-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Configuring a System N ame and Prompt Beginni ng in pri vileged EXEC mod e, follo w these steps if summer ti me in your area does not f ollo w a recurring pattern (conf igure the exact date and time of the ne xt summer time e vents): [...]

7-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Configuring a System Name and Prompt For complete syntax and usage information for t he commands used in this section, see the Cisco IOS Confi gurati on Fundamentals Comm and Refer ence, Release 12.2 and the Cisco IOS IP Command Refer [...]

7-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Configuring a System N ame and Prompt T o keep track o f domain names, IP h as defined th e concept of a d omain name ser ver , which holds a cache (or database) of names mapped to IP addresses. T o map domain names to IP addresses, y[...]

7-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Creating a Banner If you use the sw itch IP address as its hostname, th e IP ad dress is u sed and no DNS query occurs. If you confi gure a hostname that contains no periods (.), a period follo wed by the def ault domain name is append[...]

7-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Creating a Banne r Configuring a Message-of-the-Day Login Banner Y ou can create a sing le or multiline message banner th at appears on the screen when someone logs in to the switch. Beginning in pri vileged EXEC mod e, follo w these [...]

7-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the MA C Address Table Configuring a Login Banner Y ou can co nfigure a login banner to be displayed on all connected terminals. This banner appears after the MO TD banner and before the login prompt. Beginni ng in pri vileged[...]

7-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the MAC Address Table These sections contain this configu ration informat ion: • Building the Address T able, page 7-20 • MA C Addresses and VLANs, page 7-20 • MA C Addresses and Switch Stacks, page 7-21 • Defaul t MA[...]

7-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the MA C Address Table When pri v ate VLANs are conf igured, address learning depends on the type of MA C address: • Dynamic MAC addresses learned in one VLAN of a private VLAN are replicat ed in the associated VLANs. For ex[...]

7-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the MAC Address Table Beginni ng in pri vileged EXEC mod e, follo w these steps to conf igure the dynamic address table aging time: T o re turn to the default value, use the no mac addr ess-table aging-time global co nfigu ra[...]

7-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the MA C Address Table Beginning in pri vileged EXEC mode, follow these steps to conf igure the switch to send MA C address change notification tr aps to an NMS host: Command Purpose Step 1 configure terminal Enter global conf[...]

7-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the MAC Address Table T o disable MAC address-change notif ication traps, use the no snmp-server enable traps mac-notif ication change global conf iguration command. T o disable the MAC address-change notifi cation traps on a[...]

7-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the MA C Address Table Beginning in pri vileged EXEC mode, follow these steps to conf igure the switch to send MA C address-mov e notification traps to an NMS host: T o disable MA C address-mov e notif ication traps, use t he [...]

7-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the MAC Address Table Beginning in pri vileged EXEC mode, foll ow th ese steps to conf igure the switch to send MA C address table threshold not ificat ion traps to an NMS host: T o disable MA C address-threshold notif icatio[...]

7-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the MA C Address Table Y ou can verify your settings b y entering th e show mac address-tabl e noti f ication thr eshold pri vileged EXEC commands. Adding and Removing Static Address Entries A static address has these characte[...]

7-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the MAC Address Table This exampl e sho ws how to add the static address c2f3.22 0a.12f4 to the MA C address table. When a packet is re ceived in VLAN 4 w ith this M AC address as its destination address, the packet is forwar[...]

7-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the MA C Address Table T o disable unicast MA C address filtering, us e the no mac address-table static mac-addr vlan vlan-id global conf iguration command. This exampl e sho ws how to enable unicast MA C address f iltering an[...]

7-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the MAC Address Table Beginning in pri vileged EXEC mod e, follow these steps to disable MA C address learning on a VLAN: T o reenable MA C address l earning on a VL AN, use the defaul t mac addr ess-table learning vlan vlan-[...]

7-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administering the Switch Managing the ARP Table Managing the ARP Table T o communicate with a de vice (ov er Ethernet, for e xam ple), the software f irst must l earn the 48 -bit MA C address or the local data lin k addre ss of that de vice. The process of lea[...]

7-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 7 Administerin g the Switch Managing the ARP Table[...]

CH A P T E R 8-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 8 Configuring SDM Templates This chapter descri bes how to configure the Switch Databa se Management (SDM ) templates on th e Catalyst 37 50-X or 3560-X switch. U nless otherwise note d, the term sw itch refers to a Catalyst 3750-X or 3560-X standalone switc[...]

8-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 8 Config uring SDM Templates Understanding the SDM Temp lates Note On switches running the LAN base feature set, routing v alues shown in the temp lates are not va lid. The switch also supports multipl e dual IPv4 and IP V ersion 6 (IPv6) templates for en vironme[...]

8-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 8 Configuring SDM Templates Understanding the SDM Template s • Dual IPv4 and IP v6 routing template—supports Laye r 2, mu lticast, routing (including pol icy-based routing), QoS, an d A CLs for IPv4; and Layer 2, routing, A CLs, and QoS for IPv6 on t he switc[...]

8-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 8 Config uring SDM Templates Configuring the Switch SDM Temp late This is an examp le of a syslog message notifying the stack master that a stack member is in SDM mismatch mode: 2d23h:%STACKMGR-6-SWITCH_ADDED_SDM:Switch 2 has been ADDED to the stack (SDM_MISMAT C[...]

8-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 8 Configuring SDM Templates Configuring the Switch SDM Template Setting the SDM Template Beginning in pri vileged EXEC mode, follow these steps to conf igure an SDM template: After the system reboots, you can use the sho w sdm pr efer privile ged EXEC command to [...]

8-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 8 Config uring SDM Templates Displaying the SDM Templates T o return to the default temp late, use the no sdm prefer global conf iguration command. This exampl e sho ws how to conf igure a switch running the I P base or IP services feature set with the ro uting t[...]

8-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 8 Configuring SDM Templates Displaying the SD M Templates number of qos aces: 0.5K number of security aces: 1K This is an example of output from the show sdm pr efer dual-ipv4-and-ipv6 ro uting command: Switch# show sdm prefer dual-ipv4-and-ipv6 routing The curre[...]

8-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 8 Config uring SDM Templates Displaying the SDM Templates[...]

CH A P T E R 9-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 9 Configuring Catalyst 3750-X StackPower The Catalyst 3750 -X and 3560-X swi tches hav e two po wer supplies per system, allo wing the po wer load to be split between them . This accommodates the increased maximu m po wer of 30 watts per po rt provided to a [...]

9-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 9 Configuring Catalyst 3750-X StackPower Understanding StackPowe r • System operation can be come more green b y maxi mizing po wer supply eff iciency and worki ng with the most ef ficient load (30 to 90% of their maximum load). StackPower uses these terms: •[...]

9-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 9 Configur ing Catalyst 3750-X StackPower Understanding StackPo wer Y ou can also configure a switch connected in a po we r stack to not participate i n the po wer stack b y setting the switch to standalone p ower mode. Thi s mode shuts do wn both stack po wer po[...]

9-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 9 Configuring Catalyst 3750-X StackPower Understanding StackPowe r Graceful load shedding is al ways enabled and imme diate load sheddi ng occurs only when necessary , so both can occur at th e same time. Note Load shedding does not occur in redundan t mode unles[...]

9-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 9 Configur ing Catalyst 3750-X StackPower Understanding StackPo wer The output of the show stack-power priv ileged EXEC command sh ow s the priorities of the p owered devices and switches in the po w er stack. Switch# show stack-power Power stack name: Powerstack[...]

9-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 9 Configuring Catalyst 3750-X StackPower Configuring Stack Power • Switch 4 (priority 4) • Switch 3 (priority 3) • Switch 1 (priority 2) Switch 2 would ne ver ha ve to be s hut do wn because all po wer would ha ve been lost by the time priority 1 devices we[...]

9-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 9 Configur ing Catalyst 3750-X StackPower Configuring Stack Power This is an ex ample of setting the stack power mode for the stack named power1 to redundant po wer mode. The largest p ower supply in the stack is remo ved from the po wer budget and used as a back[...]

9-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 9 Configuring Catalyst 3750-X StackPower Configuring Stack Power Note Enterin g the write era se and relo ad privile g ed EXEC commands do wn not change the p ower priority or po wer mode non-defa ult config uration sa ved in t he switch flash memory . Configurin[...]

CH A P T E R 10-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 10 Configuring Switch-Based Authentication This chapter describes how to conf igure switch-based authen tication on th e Catalyst 3750-X or 3560-X switch. Unless otherwise not ed, the term switc h refers to a Catalyst 3750-X or 3560-X stan dalone switch and[...]

10-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Protecting Acce ss to Pr ivileged EXEC Commands • If you want to use userna me and password pairs, but you want to store them cent rally on a server instead of loca lly , you ca n store the m in a database on a secu[...]

10-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Protecti ng Access to Privi leged EXEC Commands Setting or Changing a Static Enable Password The enable password controls acces s to the pri vileged EX EC mode. Begin ning in pri vileged EXEC mode, follo w these steps [...]

10-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Protecting Acce ss to Pr ivileged EXEC Commands Beginning in pri vileged EXEC mod e, follo w these steps to conf igure encryption for enable and enable secret passwords: If both the enable and enable secret passwords [...]

10-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Protecti ng Access to Privi leged EXEC Commands This example sho ws how to conf igure the encrypted password $1$F aD0$Xyti5Rkls3LoyxzS8 for pri vilege lev el 2: Switch(config)# enable secret level 2 5 $1$FaD0$Xyti5Rkls[...]

10-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Protecting Acce ss to Pr ivileged EXEC Commands Setting a Telnet Password for a Terminal Line When you po wer -up your switch for the f irst time, an automatic setup p rogram runs to assign IP information and to creat[...]

10-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Protecti ng Access to Privi leged EXEC Commands Beginning in pri vileged EXEC mode, follow these st eps to establish a username- based authentication system that requ ests a login use rname and a password: T o disable [...]

10-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Protecting Acce ss to Pr ivileged EXEC Commands Setting the Privilege Level for a Command Beginni ng in priv ileged EXEC mode , follow th ese steps to set the pri vileg e lev el for a command mode: When you set a comm[...]

10-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Protecti ng Access to Privi leged EXEC Commands Changing the Default Privilege Level for Lines Beginni ng in pri vileged EXEC mode, follo w these steps to change the d efault pri vilege le vel for a line: Users can ove[...]

10-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with TACACS+ Controlling Switch Access with TACACS+ This section describes how to enable and conf igur e T erminal Access Controller Acces s Control System Plus (T ACA CS+), which provides d[...]

10-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Control ling Switch Access with TACACS+ Figur e 1 0-1 T ypical T ACA CS+ Networ k Configuration T ACA CS+, administered throu gh the AAA securi ty services, can provide these services: • Authentication—Pro vides c[...]

10-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with TACACS+ TACACS+ Operation When a user attempt s a simple ASCII login by authenticatin g to a switch using T A CA CS+, this process occurs: 1. When the c onnection is e stablished, the s[...]

10-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Control ling Switch Access with TACACS+ • Config uring T A CA CS+ Authorization for Pri vileged EXEC Access and Network Serv ices, page 10-16 • Starting T A CA CS+ Accounting, page 10-17 Default TACACS+ Configurat[...]

10-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with TACACS+ T o remove the specif ied T A CA C S+ server name or address, use the no tacacs-server host hostname global conf iguration command. T o remov e a server g roup from the conf igu[...]

10-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Control ling Switch Access with TACACS+ T o disable AAA, use the no aaa new-model global conf iguration command. T o disable AAA authenticati on, use the no aaa authentication logi n { default | list-name } method1 [ [...]

10-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with TACACS+ Note T o secure the sw itch for HTTP access by using AAA methods, you must conf igure the switch with the ip http authentication aaa g lobal conf iguration command. Conf iguring[...]

10-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS Starting TACACS+ Accounting The AAA accounting feature tracks the servic es that users are accessing and the amount of network resources that the y are consuming. When AAA account[...]

10-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS Understanding RADIUS RADIUS is a distributed client/server system th at secures networks against unauthorized access. RADIUS clients run on supported Ci sco routers and swit ches[...]

10-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS Figur e 1 0-2 T r ansitioning fr om R ADIUS to T ACACS+ Services RADIUS Operation When a user attempts to log in and auth enticate to a switch that is acc ess controlled by a RADI[...]

10-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS • CoA Request Commands, page 10-22 • Session Reauthentication , page 10-23 • Stacking Guidelines f or Session T ermination, page 10-25 A standard RADIUS interface is typica[...]

10-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS Ta b l e 10-3 sho ws the possible values fo r the Error-Cause attrib ute. Preconditions T o use the CoA interface, a session must already ex ist on the switch. CoA ca n be used to[...]

10-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS Session Identification For disconnect and CoA requests tar geted at a partic ular session, the switch lo cates the session based on one or more of the follo wing attributes: • [...]

10-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS • Session Reauthentication in a Switch Stack • Session T ermination • CoA Disconnect-Request • CoA Request: Di sable Host Port • CoA Request: Bounce-Port Beginning with [...]

10-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS • If authentication comp letes with either success or failure, th e signal that triggered the reauthentication is remo ved from the stack member . • If the stack master fails[...]

10-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS Note A Disconnect-Request f ailure follo wing command re-sen ding could be th e result of either a successful session termination before change- ov er (if the Disconnect-A CK was [...]

10-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS When the Auth Manager comman d handler on the stack master rec eiv es a v alid disable-port command, it verif ies this information before returning a CoA-A CK message: • the ne[...]

10-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS Default RADIUS Configuration RADIUS and AAA are disabl ed by def ault. T o prev ent a lapse in security , you cannot conf igure RADIUS through a n etwork managemen t application. [...]

10-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS Beginning in priv ileged EXEC mode, foll ow these steps to configu re per-serv er RADIUS server communication. This procedure is req uired. Command Purpose Step 1 configur e term[...]

10-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS T o remove the specif ied RADIUS se rv er , use the no radius-server host hostname | ip-addr ess glo bal confi guration command. This example shows ho w to conf igure one RADIU S [...]

10-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS Step 3 aaa authentication login { default | list-name } method1 [ method2... ] Create a login authen tication method list. • T o create a def ault list that is used when a name[...]

10-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS T o disable AAA, use the no aaa new-model global conf iguration command. T o disable AAA authenticati on, use the no aaa authentication logi n { default | list-name } method1 [ me[...]

10-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS Beginning in p rivile ged EXEC mode, follo w these st eps to def ine the AAA server group a nd associate a particular RADIUS server with it: Command Purpose Step 1 configur e ter[...]

10-33 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS T o remove the specif ied RADIUS se rv er , use the no radius-server host hostname | ip-addr ess glo bal confi guration command. T o remo ve a server gro up from the conf iguratio[...]

10-34 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS T o disable authorization, use the no aaa authorization { network | exec } method1 global configuration command. Starting RADIUS Accounting The AAA accounting feature tracks the [...]

10-35 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS Configuring Settings fo r All RADIUS Servers Beginni ng in pri vileged EXEC mode, follo w these steps to conf igure global communication settin gs between the switch and all RADIU[...]

10-36 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS This example sho ws how to pro vide a user logging in from a sw itch w ith immediate access to pri vileged EXEC commands: cisco-avpair= ”shell:priv-lvl=15“ This example sho w[...]

10-37 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with RADIUS As mentioned earlier , to conf igure RADIUS (whether v endor-proprietar y or IETF draft -compliant), you must specify the host ru nning the RADIUS serv er daem on and the secret t[...]

10-38 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with RADIUS T o disable AAA, use the no aaa new-model global co nfigurat ion command. T o disable the AAA server functionality on the swit ch, use the no aaa ser ver radius dynamic authoriza[...]

10-39 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with Kerberos Configuring RADIUS Se rver Load Balancing This feature allo ws access and authen tication requests to be e venl y across all RADIUS ser vers in a server group. For more informat[...]

10-40 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with Kerberos K erberos verif ies that users are w ho they claim to be and the netw ork service s that the y use a re what the services claim to be. T o do this, a KDC or trusted Ker b eros [...]

10-41 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Controlling Switch Access with Kerberos Kerberos Operation A Kerberos serv er can be a Catalyst 3750-X or 3560-X swi tch that is conf igured as a network securi ty server and t hat can authenticate remote user s by us[...]

10-42 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Controlling Switch Access with Kerberos Authenticating to a Boundary Switch This section describes the first layer of security th rough which a remo te user must pass. The user must first authenticate to the boundary[...]

10-43 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Configuring the Switch for Local Au thentication and Au th orization When you add or create entries for the hos ts and users, follo w these guidelin es: • The K erberos principal name must be in all lowercase charac[...]

10-44 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Configuring the Switch for Secure Shell T o disable AAA, use the no aaa new-model global conf iguration command. T o disable authori zation, use the no aaa authorization { network | ex ec } method1 global co nfigur a[...]

10-45 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Configur ing the Switch for Secure She ll Note For complete syntax and usage in formation for the co mmands used in this section, see the command reference for this release and the “Secure She ll Co mmands” sectio[...]

10-46 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Configuring the Switch for Secure Shell Limitations These limitations apply to SSH: • The switch supports Ri v est, Shamir , and A delman (RSA) authentication. • SSH supports only th e ex ecution-shell appl icati[...]

10-47 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Configur ing the Switch for Secure She ll 3. Configure user authentication fo r local or remote access. This step is required. For mo re information, see t he “Confi guring the Switch for Local Authenticati on and A[...]

10-48 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Configuring the Switch for Secure Shell T o return to the def ault SSH control p arameters, use the no ip ssh { timeout | authentication-retries } global conf iguration command. Displaying the SSH Configuration and S[...]

10-49 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Configuring the Switch for Secure So cket La yer HTTP Configuring the Switch for Secure Socket Layer HTTP This section descri bes ho w to conf igure Secure Sock et Layer (SSL) V ersion 3.0 supp ort for the HTTP 1.1 se[...]

10-50 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Configuring the Switch for Secure Sock et La yer HTTP If you do not conf igure a CA tru stpoint, when you en able a se cure HTTP connec tion, eith er a tempo rary or a persistent self-signed certif icate for the secu[...]

10-51 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Configuring the Switch for Secure So cket La yer HTTP CipherSuites A CipherSuite specifies the encryption al gorithm and the di gest algorithm to us e on a SSL connection. When connecting to the HTTPS serv er , the cl[...]

10-52 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Configuring the Switch for Secure Sock et La yer HTTP SSL Configuration Guidelines When SSL is used in a switch cluster , the SSL se ssion terminat es at the cluster commander . Cluster member switches must run stand[...]

10-53 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Configuring the Switch for Secure So cket La yer HTTP Use the no crypto ca trustpoint name global conf iguration command to delete all identity informati on and certificates associated with the CA. Configuring the Sec[...]

10-54 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Configuring the Switch for Secure Sock et La yer HTTP Use the no ip http server global configuration command to dis a ble the standard HTTP server . Use the no ip http secure-serv er global configurat ion command t o[...]

10-55 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Configur ing Switch-Based Authentication Configuring the Switch fo r Sec ure Copy Protocol Use the no ip http client secure-trustpoint name to remov e a client trustpoi nt configuration. Use the no ip http client secur e-ciphersuite to re mov e a previously [...]

10-56 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 10 Co nfiguri ng Switch-Based Authentication Configuring the Switch for Secure Copy Pro t oco l Information About Secure Copy T o conf igure the Secure Copy featu re, you should understand t hese concepts. The behav ior of SCP is similar to that of remote copy [...]

CH A P T E R 11-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 11 Configuring IEEE 802.1x Port-Based Authentication This chapter describes ho w to c onf igure IEEE 802.1x port-based authen tication on th e Catalyst 3750-X or 3560-X switch. IEEE 80 2.1x authentication pre vents unauth orized de vices (clients) from ga i[...]

11-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802.1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication Until the client is auth enticated, IEEE 802.1x access control al lows only Extensible Authentication Protocol over LAN (EAPOL), Cisco Discovery Prot ocol ([...]

11-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication Device Roles W ith 802.1x port-based authenticati on, the de vices in the net work ha ve specif ic roles as show n in Figure 11-1 . Figur e 1 1 -1 802.[...]

11-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication The devices that can act as interme diaries include the C atalyst 3750-X, Catalyst 3750- E, Catalyst 3750, Catalyst 3650 -X, Catalyst 3560-E, Cata lyst 356[...]

11-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication Figur e 1 1 -2 Authenticati on Flo wc h ar t The switch re-authenticates a client when one of these situations oc curs: • Periodic re-authentication [...]

11-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication The T ermination-Action RADIUS attrib ute (Attrib u te [29]) specifies the action to take during re-authentication. The act ions are Initialize and ReA uth[...]

11-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication Figur e 1 1 -3 M essag e Ex chan ge If 802.1x authent ication times out while w aiti ng for an EAPOL message exchange and MA C authentica tion b ypass [...]

11-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication Authentication Manager In Ci s co IO S Re le as e 12 .2 (4 6 )S E a n d e ar li e r , y o u could not use the same aut horization methods, including CL I c[...]

11-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication Per-User ACLs and Filter-Ids A CLs configured on the switch are compatible with other devi ces running Cisco IOS releases. Y ou can only set any as the[...]

11-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication For more information, see the co mmand reference for this release. Ports in Authorized and Unauthorized States During 802.1x authenti cation, depending on[...]

11-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication • auto —enables 802.1x authen tication and causes th e port to be gin in the unauthorized state, allo wing only EAPOL frames t o be sent and recei[...]

11-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication 802.1x Host Mode Y ou can confi gure an 802.1x port for single-host or for multiple-hosts mode. In single-host mode ( see Figure 12-1 on page 12-2 ), only[...]

11-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication MAC Move When a M A C address is authenticated on one sw itch po rt, that address is no t allowed on another 802.1x port of the switch. If the swit ch[...]

11-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication Ta b l e 11-3 lists the A V pairs and when the y are sent are sent by the switch: Y ou can vie w the A V pairs that are bei ng sent b y the switch by ente[...]

11-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication 802.1x Authentication with VLAN Assignment The switch support s 802.1x authentication with VLAN assignment. Aft er successful 802.1x authentication of[...]

11-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication T o conf igure VLAN assignment yo u need to perform these tasks: • Enable AAA authoriz atio n by using the network ke yword to allo w interf ace configu[...]

11-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication Only one 802.1x-authenticated user is supp orted on a port. If the mul tiple-hosts mode is enabled o n the port, the per -user A CL attrib ute is disa[...]

11-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication The switch uses the CiscoSecure-Defined-A CL A V pair to intercept an HTTP or HTTPS request from the endpoint de vice. The switch then forwards the client[...]

11-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication 802.1x Authentication with Guest VLAN Y ou can configu re a guest VLAN for each 802.1x port on the switch to provide limited serv ices to clients, suc[...]

11-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication 802.1x Authentication with Restricted VLAN Y ou can conf igure a restricte d VLAN (also referred to as an authentication f ailed VLAN ) for each IEEE 802.[...]

11-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication When a ne w host tries to connect to the criti cal port , that host is mo ved to a user-specified access VLAN, the critical VLAN . The administrator g[...]

11-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication – If all the RADIUS serv ers are n ot a vai lable and th e client is not connec ted to a critic al port, the switch might not assi gn clients to the gue[...]

11-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication 802.1x User Distribution Configuration Guidelines • Confir m that at least one VLAN is mapped to th e VLAN group. • Y ou can map more than one V L[...]

11-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication IEEE 802.1x Authentication with Port Security Y ou can configure an IEEE 802.1x port with port secu rity in either single-hos t or multiple-hosts mode. (Y[...]

11-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication When a host that uses W oL is attached through an IEEE 802.1x port and t he host po wers of f, the IEEE 802.1x port beco mes unauthorized. The port ca[...]

11-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication If re-authentication i s based on the Session- T i meout RADIUS attrib ute (Attribute[27]) and the T ermination-Action RADIUS att ribute (Attrib ute [29])[...]

11-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication Config uring N A C Layer 2 IEEE 802.1x v alidation is similar to conf iguring IEEE 802.1x p ort-based authentication except that you must conf igure a[...]

11-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication Note If you use a d ynamic VLAN to a ssign a v oice VLAN on an MD A-enabled swi tch port, the v oice device fails authorization. • T o authorize a vo ic[...]

11-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication 802.1x Supplicant and Authenticator Switches with Network Edge Access Topology (NEAT) The Network Edge Access T opology (NEAT) feature e xtends identi[...]

11-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication • The VSA changes the authe nticator switch port mode from access to trunk and enables 80 2.1x trunk encapsulation and the access VLAN if any would be c[...]

11-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication The session ID is us ed by the N AD, the A AA server , and other report-analyzing application s to identify the client. The ID appears automatically .[...]

11-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Understanding IEEE 802.1x Po rt-Based Authentication MKA Policies Y ou apply a def ined MKA polic y to an interface to enable MKA on the interface. Removing the MKA policy d isables MKA on that interf ace. Y[...]

11-33 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Understanding IEEE 802.1x Po rt-Bas ed Au th entication MACsec, MKA and 80 2.1x Host Modes Y ou can u se MA Csec and the MKA Protocol with 802.1x sin gle-host mode, multiple-host mode, or Multi Domain Authe[...]

11-34 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication MKA Statistics Some MKA coun ters are aggre gated globally , while others are updated both g lobally and per session. Y ou can also obtain info rmation ab out the status of [...]

11-35 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication • Config uring a W eb Authentication Local Banner , page 11-65 (optional) • Disabling 802.1x A uthentication on t he Port, page 11-66 (optional) • Resetting the 802.1[...]

11-36 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication 802.1x Authentication Configuration Guidelines These section has conf iguration guidelines for these features: • 802.1x Aut hentication, pa ge 11-36 • VLAN Assignme nt, [...]

11-37 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication – EtherChann el port—Do not co nfigure a port that is an acti ve or a not- yet-activ e member of an EtherChann el as an 802.1x port. If you try to enable 802.1x authent[...]

11-38 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication – If the W indo ws XP client is con figured for DHC P and has a n IP address from the D HCP server , receiving an EAP-Success message on a cri tical port might not re-i ni[...]

11-39 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication Follo w these guidelines to ena ble the readiness check on the switch: • The readiness check is typi ca lly used before 80 2.1x is enabled on the switch. • If you use t[...]

11-40 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication Note If you do not include th e shutdown vlan k eyw ords, the entire port is shut do wn when it enters the error-disabled state. • If you use the errdisable recov ery caus[...]

11-41 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication Configuring 802.1x Violation Modes Y ou can conf igure an 802.1x port so that i t shuts do wn, generates a syslog error , or discards packets from a ne w de vice when: • [...]

11-42 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication This is the 802.1x A AA process: Step 1 A user connects to a port on the switch. Step 2 Authentication is performed. Step 3 VLAN assignment is enabled, as appr opriate , bas[...]

11-43 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication Configuring the Switch-to-RADIUS-Server Communication RADIUS security servers are identif i ed by their hostname or IP address, hostname and specif ic UDP port numbers, or [...]

11-44 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication This example sho ws how to specify the server with IP address 172.2 0.39.46 as the RADIUS server , to use port 1612 as t he authorization p ort , and to set the encryption k[...]

11-45 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication T o disable multiple hosts o n the port, use the no authenti cation h ost-mo de or the no dot1x host-mode multi-host interf ace conf iguration command. This exampl e sho ws[...]

11-46 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication T o disable periodic re-authentication, use the no authentication periodic or the no dot1x reauthenti cation interface conf iguration command. T o return to the d efault num[...]

11-47 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication Changing the Quiet Period When the sw itch cannot authenticate the client, the switch remai ns idle for a set period of time and then tries ag ain. The dot1x timeout quiet-[...]

11-48 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication T o return to th e default retransmission time, use the no dot1x timeout tx-period interface conf iguration command. This exampl e sho ws how to set 60 as the number of seco[...]

11-49 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication This example sho ws how to set 5 as the number of times that the sw itch sends an EAP-request/identi ty request before restarting the authentication process: Switch(config-[...]

11-50 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication This example sh ows ho w to global ly enable MAC move on a switch: Switch(config)# authenti cation mac-mo ve permit Configuring 802.1x Accounting Enabling AAA system account[...]

11-51 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication This exampl e sho ws how to conf igure 802.1x accounti ng. The first command conf igures the RADIUS server , specifying 1813 as the UDP por t for accounting: Switch(config)[...]

11-52 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication This ex ample sho ws ho w to set 3 as t he quiet time on th e switch, to set 15 as th e number of se conds that the switch waits for a resp on se to an EAP-request/identity [...]

11-53 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication Y ou can configure th e maximum number of auth entication attempts allowed before a user is assig ned to the restri cted VLAN b y using th e dot1x auth-fail max-attempts i [...]

11-54 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication Beginning in pri vileged EXEC mode, follo w these steps to configure the port as a critical port a nd enable the inaccessible authentication bypass feature. This procedure i[...]

11-55 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication T o return to the RADIUS server def ault settings, use the no radius-serv er dead-criteria , the no radius-serv er deadtime , and the no radius-server host global conf igur[...]

11-56 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication Switch(config-if)# dot1x critical Switch(config-if)# dot1x critical recovery action reinitialize Switch(config-if)# dot1x critical vlan 20 Switch(config-if)# end Configuring[...]

11-57 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication T o disable MA C authentication b ypass, use the no dot1x mac-auth-bypass interf ace configuration command. This exampl e sho ws how to enable MA C authentication b ypass: [...]

11-58 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication switch(config)# vlan group eng-dept vlan-list 30 switch(config)# show vlan group eng-dept Group Name Vlans Mapped ------------- -------------- eng-dept 10,30 This exampl e s[...]

11-59 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication This exampl e sho ws how to conf igure N AC Lay er 2 802.1x v alidation: Switch# configure terminal Switch(config)# interface gigabite thernet2/0/1 Switch(config-if)# dot1x[...]

11-60 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication This exampl e sho ws how to conf igure a switch as an 802.1x aut henticator: Switch# configure terminal Switch(config)# ci sp enable Switch(config)# interface gigabit ethern[...]

11-61 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication This exampl e sho ws how to conf igure a switch as a suppli cant: Switch# configure terminal Switch(config)# cisp enable Switch(config)# dot1x credentials test Switch(confi[...]

11-62 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication Configuring a Do wnloadable Policy Beginning in pri vileged EXEC mod e: Step 7 ip access-group acl-id in Confi gure the default A CL on the port in the input direction . Not[...]

11-63 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication This exampl e sho ws how to conf igure a switch for a do wnloadable policy : Switch# config terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(con[...]

11-64 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication This exampl e sho ws how to glob ally enable VLAN ID-ba sed MA C authentica tion on a switch: Switch# config terminal Enter configuration commands, one per line. End with CN[...]

11-65 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication This exampl e sho ws how to conf igure open 1x on a port: Switch# configure terminal Switch(config)# interface gigabite thernet 1/0/1 Switch(config)# a uth en ti ca ti on c[...]

11-66 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication Disabling 802.1x Authentication on the Port Y ou can disable 802.1x aut hentication on the port b y using the no dot1x pae inter face configuration command. Beginning in pri[...]

11-67 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Configuring 802.1x Authentication Configuring MKA and MACsec • Config uring an MKA Polic y , page 11-67 • Config uring MA Csec on an Interface, page 11 -67 Configuring an MKA Policy Beginning in pri vil[...]

11-68 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Configuring 802.1x Authentication This is an example of conf igurin g and verifying MA Csec on an interface: Switch(config)# interface GigabitEthernet1/0/25 Switch(config-if)# switchport acc ess vlan 10 Swit[...]

11-69 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring I EEE 802.1x Port-Bas ed Authentication Displaying 802.1x Stat istics and Stat us Oper control dir: both Authorized By: Authentication Server Vlan Policy: 10 Session timeout: 3600s (server), Remaining: 3567s Timeout action: Reauthenticate Idle ti[...]

11-70 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 11 Configuring IEEE 802. 1x Port-Based Authentication Displaying 802.1x Statistics and Status[...]

CH A P T E R 12-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 12 Configuring Web-Based Authentication This chapter d escribes how to configure web-based au thentication on the Catalyst 3750-X o r 3560-X switch. It c ontains these sections: • Understanding W e b-Based Authen tication, page 12-1 • Config uring W eb-[...]

12-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configurin g Web-Based Authentication Understanding Web-Ba sed Authentication • Authentication Pr ocess, page 12-3 • W eb Authentication Customizable W eb Pages, page 12-6 • W eb-based Authentication I nteractions with Other Features, page 12-7 Device R[...]

12-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configuring Web-Based Authentic ation Understanding Web-Based Auth entication Session Creation When web-based authentication dete cts a ne w host, it creates a session as follow s: • Re view s the except ion list. If the host IP is in cluded in t he excepti[...]

12-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configurin g Web-Based Authentication Understanding Web-Ba sed Authentication Local Web Authentication Banner Y ou can create a banner that will appear when you log in to a switch by using web authent ication. The banner appears on both the log in page and th[...]

12-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configuring Web-Based Authentic ation Understanding Web-Based Auth entication Figur e 12-3 Customiz ed W eb Bann er If you do not enab le a banner , only the username and password dialog box es appear in the web authentication login screen, and no banner appe[...]

12-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configurin g Web-Based Authentication Understanding Web-Ba sed Authentication Web Authentication Customizable Web Pages During the web-based authentication process, the sw itch internal HTTP server hosts four HTML pages to deli ver to an authenticating client[...]

12-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configuring Web-Based Authentic ation Understanding Web-Based Auth entication Figur e 12-5 Customiz eable A uthentication P age For more informati on, see the “Customizing the Authen tication Proxy W eb Pages” section on page 12-13 . Web-based Authenticat[...]

12-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configurin g Web-Based Authentication Understanding Web-Ba sed Authentication LAN Port IP Y ou can con figure LAN port IP (LPI P) and Layer 2 w e b-based authentication on the same port. The ho st is authenticated b y using web-based authentication first, fo [...]

12-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configuring Web-Based Authentic ation Configuring Web-Based Authentication Configuring Web-Based Authentication • Default W eb-Based Authentication Conf iguration , page 12-9 • W eb-Based Authentication Co nfigur ation Guidelines and Restricti ons, page 1[...]

12-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configurin g Web-Based Authentication Configuring Web-Base d Authentication • Hosts that are more than one hop aw ay might e xperience traf fic disrup tion if an STP topology change results in the host traf fic arri ving on a di fferent port. This occurs b[...]

12-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configuring Web-Based Authentic ation Configuring Web-Based Authentication Authentication global absolute time is 0 minutes Authentication global init state time is 2 minutes Authentication Proxy Watch-list is disabled Authentication Proxy Rule Configuration[...]

12-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configurin g Web-Based Authentication Configuring Web-Base d Authentication T o config ure the RADIUS server parameters, perform this task: When you configure the RADIUS server parameters: • Specify the key string on a separate command line. • For ke y s[...]

12-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configuring Web-Based Authentic ation Configuring Web-Based Authentication This example sho ws how to conf igure the RADIU S server parameters on a switch: Switch(config)# ip radius source-interface Vlan80 Switch(config)# radius-server host 172.l20.39.46 tes[...]

12-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configurin g Web-Based Authentication Configuring Web-Base d Authentication When configuring customized authentication pr oxy web pages, follo w these guidelines: • T o enable the custom web pages feature, specify all four custom HTML f iles. If you specif[...]

12-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configuring Web-Based Authentic ation Configuring Web-Based Authentication Specifying a Redirection URL for Successful Login Y ou can specify a URL to whic h the user is redirected after authentication, effecti vely replacing the internal S uccess HTML page.[...]

12-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configurin g Web-Based Authentication Configuring Web-Base d Authentication This example sh ows ho w to determine whether any conn ected hosts are in the AAA Do wn state: Switch# show ip admission cache Authentication Proxy Cache Client IP 209.165.201.11 Por[...]

12-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configuring Web-Based Authentic ation Displaying Web-Based Authentication Status This exampl e sho ws how to conf igure a local banner wit h the custom message My Switch : Switch(config) configure terminal Switch(config)# aaa new-model Switch(config)# aaa ip[...]

12-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 12 Configurin g Web-Based Authentication Displaying Web-Based Authentication Status[...]

CH A P T E R 13-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 13 Configuring Interface Characteristics This chapter de f ines the types of in terfaces on the Catalyst 3750-X or 3560-X sw itch and describes ho w to conf igure them. Unless otherwise noted, the t erm switch refers to a Catalyst 3750-X or 3560-X stand alo[...]

13-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Interface Types These sections describe the interface types: • Port-Based VLANs, page 13-2 • Switch Ports, page 13-2 • Routed Ports, page 13-4 • Switch V irtual Interfaces, page 13-5 • EtherChannel Port Groups,[...]

13-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Interface Types confi gure tunnel ports as part of an asymmetri c li nk connected to an IEEE 802.1 Q trunk port. Switch ports are used for managing the physical interf ace a nd associated Layer 2 protocols and do not han[...]

13-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Interface Types Although b y default, a trunk port is a member of e very VLAN kno wn to the VTP , you can limit VLAN membership by conf iguring an allo wed list of VLANs for each trun k port. The list of allo wed VLANs d[...]

13-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Interface Types The number of routed port s that you can conf igure is not limi ted by so ftware. Ho weve r , the interrelationship between this number and the numbe r of other features being conf igured might impact CPU[...]

13-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Interface Types Note The LAN base feature set does not support rout ing. The IP base feature set supports static routing an d RIP . For more adv anced routing or for fa llback bridging, en able the IP services featu re s[...]

13-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Interface Types 10-Gigabit Ethernet Interfaces The Catalyst 3750-X an d 3560-X switches ha ve a netw ork module slot into which you can inser t a 10-Gigabit Ethern et network module, a 1 -Gigabit Ethernet network module,[...]

13-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Interface Types Cisco intelligent po wer management is backward -compatible with CDP with po wer consumption; the switch responds according to the CDP message that it recei ves. CDP is not supported on third-party po wer[...]

13-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Interface Types W ith PoE+, po wered devices use IEEE 802.3at and LLDP po wer with media dependent interface (MDI) type, length, and v alue descriptions (TL Vs), Powe r-via-MD A TL Vs, for negotiat ing po wer up to 30 W [...]

13-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Interface Types • static —The switch pre-allocates po wer to the port (e ven w hen no po wered device is connected) and guarantees that power will be av ailable for the port. The switch alloca tes the port configure[...]

13-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Interface Types Maximum Power Allocation (Cuto ff Power) on a PoE Port When po wer policing is enabled, th e switch dete rmines one of t he th ese values as the cutof f power on the PoE port in this order: 1. Manually w[...]

13-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Interface Types (6300 mW). The switch provides po wer to the connect ed devices on the port if the de vice ne eds up to 6.3 W . If the CDP-po wer negotiated v alue or the IEEE c lassification v alue exceeds the conf igu[...]

13-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Using the Switch USB Ports possible, to maintain high perfor mance, forwarding is done b y the switch hardware. Ho wever , only IPv4 packets with Ethernet II encapsul ation are routed in hardware. Non -IP traff ic and t[...]

13-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Using the Switch USB Ports switch-stack-1 *Mar 1 00:01:00.171: %USB_CONSOLE-6-MEDIA_RJ45: Console media-type is RJ45. *Mar 1 00:01:00.431: %USB_CONSOLE-6-MEDIA_USB: Console media-type is USB. switch-stack-2 *Mar 1 00:01[...]

13-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Using the Switch USB Ports This example re verses the pre vious configuration and immediately acti vates an y USB console that is connected. Switch# configure terminal Switch(config)# line console 0 Switch(config-line)#[...]

13-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Using the Switch USB Ports USB Type A Port The USB T ype A port pro vides ac cess to e xternal Ci sco USB fl ash devices, also known as thumb drives or USB ke ys. The switch supports Cisco 64 MB, 256 MB, 512 MB, and 1 G[...]

13-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Using Interface Configuration Mode Interface: Number: 0 Description: Bulk Class Code: 8 Subclass: 6 Protocol: 80 Number of Endpoints: 2 Endpoint: Number: 1 Transfer Type: BULK Transfer Direction: Device to Host Max Pack[...]

13-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Using Interface Configuration Mode • Module number—The module o r slot number on the switch t hat is alw ays 0. • Port number—The interface numb er on the switch. The 10/100/1000 po rt numbers always be gin at 1[...]

13-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Using Interface Configuration Mode Step 3 Follo w each interface command with the interface configurati on commands that the interface requires . The commands that you enter define the protocols and applications th at w[...]

13-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Using Interface Configuration Mode – gigabitethernet module/ {first port } - { last port } (for 3560-X switches), where the module is always 0 – gigabitethernet stack member/module/{f irst port } - { last port } (fo[...]

13-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Using Interface Configuration Mode Configuring and Using Interface Range Macros Y ou can create an interface range macro to automatica lly select a range of interfaces for configu ration. Before you can use the macr o k[...]

13-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Using the Ethernet Man agement Port • Y ou must add a space between the first interface number and th e hyphen when entering an interface-rang e . For example, gigabitether net1/0/1 - 4 is a valid range; giga bitether[...]

13-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Using the Ethernet Mana gemen t Port Understanding the Ethernet Management Port The Ethernet management port, also referred to as the F a0 or fastethernet0 port , is a Layer 3 host po rt to which you can connect a PC. Y[...]

13-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Using the Ethernet Man agement Port Figur e 13-3 Connecting a Switc h Stac k to a PC By default, the Ethern et management port is enable d. The switch cannot route packets from the Ethernet management port to a ne twork[...]

13-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Using the Ethernet Mana gemen t Port Supported Features on the Ethernet Management Port The Ethernet management port supports th ese features: • Express Setup (onl y in switch stacks) • Network Assistant • T elnet[...]

13-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring Ethern et Inter f ace s TFTP and the Ethernet Management Port Use the commands in Ta b l e 13-2 when using TFTP to do wnload or upload a con fi guration f ile to the b oot loader . Configuring Ethernet Inter[...]

13-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Configuring Ethernet Interfaces Default Ethernet Interface Configuration Ta b l e 13-3 sho w s the Ethernet interface default configur ation, including some features that apply only to Layer 2 interfaces. F or more deta[...]

13-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring Ethern et Inter f ace s Configuring Interface Speed and Duplex Mode Ethernet interfaces on the switch operate at 10, 100 , 1000, or 10,000 Mb/s and in either full- or half-duplex mode. In full-duple x mo de,[...]

13-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Configuring Ethernet Interfaces Caution Changing th e interface speed and dupl ex mode configuration might shu t down and re-enable the interface during the reconf iguration. Setting the Interface Spe ed and Duplex Para[...]

13-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring Ethern et Inter f ace s This example sho ws how to set the interface speed to 100 Mb/s and the duplex mode to half o n a 10/100/1000 Mb/s port: Switch# configure terminal Switch(config)# interface gigabit et[...]

13-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Configuring Ethernet Interfaces T o disable flo w control, use th e flowcontro l receiv e off interface configuration command. This exampl e sho ws how to turn on flo w control on a port: Switch# configure terminal Swit[...]

13-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring Ethern et Inter f ace s T o disable auto-M DIX, use the no mdix auto interface conf iguration command. This exampl e sho ws how to enable auto-MDIX on a port: Switch# configure terminal Switch(config)# inter[...]

13-33 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Configuring Ethernet Interfaces For informatio n about the output of the sho w power inlin e user EXEC command, see the c ommand reference for t his release. F or more info rmati on about PoE-related commands, see t he [...]

13-34 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring Ethern et Inter f ace s Caution Y ou should carefully plan your switch po wer budget , enable the po wer monito ring feature, and make certain not to o versubscr ibe the po wer supply . Note When you manuall[...]

13-35 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Configuring Ethernet Interfaces T o return to the default setting, use the no power inline consumption interface configuration command. For informatio n about the output of the sho w power inline consumpti on pri vilege[...]

13-36 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring Ethern et Inter f ace s T o disable policing of the real-time po wer consumption, use the no power inline police in terface confi guration command. T o disable error recov e ry for PoE error-disa bled cause,[...]

13-37 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Configuring Layer 3 Interfaces This exampl e sho ws how to add a description on a p ort and ho w to veri fy the description: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch[...]

13-38 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring La yer 3 Interfaces • If the switch is n otifi ed by VLAN T runking Protocol (VTP) of a new VLAN, it sends a message that there are not enough hardware re sources av ailable and shuts do wn the VLAN. The o[...]

13-39 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Configuri ng the System MTU Configuring SVI Autostate Exclude Config uring SVI autostate ex clude on an access or trunk port in an SVI excludes that port in the calculation of the stat us of the SVI line state (up or do[...]

13-40 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring the System MTU • Y ou can enter the system mtu bytes gl obal configuration command on a Catalyst 3750-X switch , but the command does not take ef fect on the sw itch. This command only af fe cts the system[...]

13-41 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Configuri ng the System MTU The upper limit of the system routi ng MTU v alue is based on the switch or switch stack conf iguration and refers to either the current ly applied system MTU or the sy stem jumbo MTU value. [...]

13-42 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring the Cisco RPS 2300 in a Mixed Stack If you enter a v alue that is outside the allo wed range for th e specific type of interface, th e v alue is not accepted. This example sh ows ho w to set the maximum pack[...]

13-43 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Configuring the Cisco RPS 2300 in a Mixed Stack Beginning in user EXEC mode, follo w these steps to configure and manage the RPS 230 0: Command Purpose Step 1 power rps switc h-number name { string | serialnumber } Spec[...]

13-44 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Configuring the Power Supp lies T o return to the RPS 2300 de fault settings, use these commands: • T o return to th e default name setti ng (no name is conf igured), use the power rps switch-number port rps-port-id n[...]

13-45 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Monitoring and Main ta ining the Interfaces Monitoring and Mainta ining the Interfaces These sections contain interface moni toring and maintenance information: • Monitoring Interf ace Status, page 13-45 • Clearing [...]

13-46 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Monitoring and Main ta ining the Interfaces Clearing and Resetting Interfaces and Counters Ta b l e 13-7 lists the pri vileged EXEC mode clear commands that you can use to clear counters and rese t interfaces. T o clear[...]

13-47 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configuring Interfac e Characteristics Monitoring and Main ta ining the Interfaces Note The clear counters privi leged EXEC comman d does not clear counters retr iev ed by using Simple Network Management Protocol (SNMP), b ut only those seen wi th the show i[...]

13-48 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 13 Configur ing Interface Characteristics Monitoring and Main ta ining the Interfaces[...]

CH A P T E R 14-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 14 Configuring Auto Smartports Macros This chapter describes ho w to configure and apply Auto Smartports and static Smartp orts macros on the Catalyst 3750-X or 3560-X switch. Note For complete syntax and usage in formation for the commands u sed in this ch[...]

14-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Understanding Auto Sma rtp or ts an d Static Smartports Macros Auto Smartports uses e vents to map macros to the source port of the e vent. The most common e vent triggers are based on Cisco Di scovery Prot ocol (C DP) mess[...]

14-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configuring Auto Smar tports Macros Configuring Auto Smartports Figur e 14-1 Cisco Medianet Deployment Example Configuring Auto Smartports • Default Au to Smartports Conf iguration, page 14-3 • Auto Smartports Conf iguration Guidelines, page 14-4 • Enab[...]

14-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Configuring Auto Smartports Auto Smartports Configuration Guidelines • The bui lt-in macros cannot be deleted or changed. H owe ver , you can ov erride a b uilt-in macro by creating a user-def ined macro with the sa me na[...]

14-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configuring Auto Smar tports Macros Configuring Auto Smartports • For 802.1x aut hentication or MAB, conf igure the RADIUS serv er to support the Cisco attrib ute-v alue (av ) pair auto-smart-port = event trig ger to detect non-Cisco de vices. • For stat [...]

14-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Configuring Auto Smartports Configuring Auto Smartports Default Parameter Values The switch automatically maps from e vent triggers to b uilt-in macros. Y ou can follo w this procedure to replace Auto Smartports macro def a[...]

14-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configuring Auto Smar tports Macros Configuring Auto Smartports Default Macro:CISCO_PHONE_AUTO_SMARTPORT Current Macro:CISCO_PHONE_AUTO_SMARTPORT Configurable Parameters:ACCESS_VLAN VOICE_VLAN Defaults Parameters:ACCESS_VLAN=1 VOICE_VLAN=2 Current Parameters:[...]

14-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Configuring Auto Smartports This example sho w s ho w to create a MA C-address-g roup e vent trigger cal led addr ess_trigger and ho w to verify your entr ies: Switch# configure terminal Switch(config)# macro auto addres s-[...]

14-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configuring Auto Smar tports Macros Configuring Auto Smartports Configuring Auto Smartports Built-In Macro Options Use this procedure to map ev ent triggers to b uilt-in macros and to replace the built-in macro default parameter v alues with v a lues that are[...]

14-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Configuring Auto Smartports This ex ample sho ws ho w to use tw o b uilt-in Auto Sm artports macros for co nnec ting Cisco switches and Cisco IP phones to the sw itch. Th is example modifies the def ault voice VLAN, access[...]

14-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configuring Auto Smar tports Macros Configuring Auto Smartports Current configuration : 284 bytes ! interface GigabitEthernet1/0/1 interface GigabitEthernet0/1 switchport trunk encapsulation dot1q switchport trunk native vlan 10 switchport mode trunk srr-que[...]

14-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Configuring Auto Smartports Beginning in pri vileged EXEC mod e: Use the no shell t rigger identif ier global conf iguration command to delete th e ev ent trigger . This example sh ows ho w to map a user-def ined ev ent tr[...]

14-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configuring Auto Smar tports Macros Configuring Auto Smartports This example sh ows ho w to use the show shell trigg ers pri vileged EXEC command to vie w the event triggers in the switch softw are: Switch# show shell triggers User defined triggers ---------[...]

14-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Configuring Auto Smartports switchport trunk native vlan $NATIVE_VLAN switchport trunk allowed vlan ALL switchport mode trunk switchport nonegotiate auto qos voip trust mls qos trust cos exit end fi if [[ $LINKUP -eq NO ]][...]

14-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configuring Auto Smar tports Macros Configuring Auto Smartports Configuring Auto Smartports User-Defined Macros The Cisco IOS shell provi des basic scripting capa bilities for configu ring the user -def ined Auto Smartports macros. These macros can contain m[...]

14-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Configuring Auto Smartports conf t interface $INTERFACE no macro description $TRIGGER no switchport access vlan 1 if [[ $AUTH_ENABLED -eq NO ]]; then no switchport mode access fi no switchport port-security no switchport p[...]

14-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configuring Auto Smar tports Macros Configuring Static Sma rtports M acro s Configuring Static Smartports Macros • Default Stati c Smartports Conf iguration, page 14-17 • Static Smartports Conf iguration Guidelines, page 14-17 • Applying Static Smartpo[...]

14-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Configuring Static Sma rtp or ts Macr os • Applying a macro to an interface range is the same as app lying a m acro to a single interface. When you use an interface range, the mac r o is applied sequentially to each inte[...]

14-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configuring Auto Smar tports Macros Configuring Static Sma rtports M acro s Y ou can only delete a global macro-applied configurati on on a switch b y entering the no version of ea ch command in the macro. Y ou can delete a macro-a p plied conf iguration o n[...]

14-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 14 Configur ing Auto Smartports Macros Displaying Auto Smartports and Static Smartports Macros Switch(config)# interface gigabitethernet1/0/4 Switch(config)# interface gigabit ethernet0/4 Switch(config-if)# macro apply ci sco-desktop $AVID 25 Displaying Auto Sm[...]

CH A P T E R 15-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 15 Configuring VLANs This chapter describe s ho w to configure no rmal-range VLANs (VLAN IDs 1 to 1005) and extended -range VLANs (VLAN IDs 10 06 to 4094) on the Catalyst 3750- X or 35 60-X switch. It in cludes i nformation abou t VLAN mem bership modes, VL[...]

15-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Understanding VLANs Figure 15-1 sho ws an example of VLANs seg mented into logically def ined networks. Figur e 15-1 VLANs as Logically Defined Networ ks VLANs are oft en associated with IP subnet works. F or example, all the end stations i[...]

15-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Understanding VLANs The switch supports per -VLAN spanning-tree plus (PVST+) or rapid PVST+ w ith a maximum of 128 spanning-tree instances . One spanning-tre e instance is allo wed per VLAN. See the “Normal-Range VLAN Config uration Guidel[...]

15-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring Normal-Ra nge VLANs For more detailed definit ions of access and trunk modes an d their functions, see Ta b l e 15-4 on page 15-16 . When a port belongs to a VLAN, th e switch learns a nd manages the addresses assoc iated with t[...]

15-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring Normal-Range VLANs Note This section does not pr ovide conf iguration details for most of these paramet ers. For complete information on the commands and parameters that control VLAN configurati on, see the command reference for [...]

15-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring Normal-Ra nge VLANs • The switch supports 128 spanning-tree instances. If a sw itch ha s more acti ve VLANs than supported spanning-tree instances, spanning tree can be enabl ed on 128 VLANs and is disabl ed on the remaining V[...]

15-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring Normal-Range VLANs • In VTP v ersions 1 and 2, if VTP mode is serv er , the domain name an d VLAN conf iguration for only the fir st 1005 VLANs use t he VLAN database information. VTP v ersion 3 also supports VLANs 1006 to 4094[...]

15-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring Normal-Ra nge VLANs Beginning in pri vileged EXEC mod e, follo w these steps to create or mod ify an Ethernet VLAN: T o return the VLAN name to the default sett ings, use the no name , no mtu , or no r emote-span commands. This [...]

15-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring Normal-Range VLANs Beginning in priv ileged EXEC mode, foll ow these steps to delete a VLAN on the switch: Assigning Static-Access Ports to a VLAN Y ou can assign a static-access port to a VLAN without ha ving VTP globally propag[...]

15-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring Extende d- Range VLANs Switch(config-if)# switchport mode access Switch(config-if)# switchport acc ess vlan 2 Switch(config-if)# end Configuring Extended-Range VLANs W ith VTP v ersion 1 and v ersion 2, when the swit ch is in V[...]

15-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring Extended-Rang e VLANs • For VTP v ersion 1 or 2, you can set t he VTP mod e to transparent i n global conf iguration mode. See the “Conf iguring VTP Mode” section on p age 16-11 . Y ou should sa ve this conf iguration to t[...]

15-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring Extende d- Range VLANs In VTP ve rsion 1 and 2, e xtended-range VLANs are no t sav ed in the VLAN database; they are sa ved in the switch running conf iguration file. Y ou can sa ve the e xtended-range VLAN conf iguration in th[...]

15-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring Extended-Rang e VLANs Creating an Extended-Range VLAN with an Internal VLAN ID If you enter an e xtended-range VLAN ID that is al re ady assigned to an internal VL AN, an e rror message is generated, and the e x tended-ran ge VL[...]

15-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Displa yi n g VLANs Displaying VLANs Use the show vlan pri vileged EXEC command to d isplay a list of all VLANs on t he switch, including extended-range VLANs. The disp lay includes VLAN st atus, ports, and configuration in formation. Ta b[...]

15-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring VLAN Trunks Figure 15-2 sho ws a network of switches that are connected by ISL trunks. Figur e 15-2 Switc hes in an ISL T r unking Environment Y ou can confi gure a trunk on a si ngle Ethernet int erface or on an Ether Channel b[...]

15-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring VLAN Trunk s Encapsulation Types Ta b l e 15-5 lists the Ethernet trunk enca psulatio n types and keywords. Note The switch does not support Laye r 3 trunks; you cannot config ure subinterfaces or use the encapsulation keyw ord[...]

15-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring VLAN Trunks IEEE 802.1Q Configur ation Considerations The IEEE 802.1Q trunks impose th ese limitations on the trunking strate gy for a network: • In a network of Cisco switches co nnected through IEEE 802.1Q trunk s, the switc[...]

15-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring VLAN Trunk s • Changing the Pruning-Eligi ble List, page 15-20 • Config uring the Nati ve VLAN for U ntagged T raffic, page 15-21 Note By default, an interf ace is in Layer 2 mode . The default mode for La yer 2 interfaces [...]

15-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring VLAN Trunks T o return an interface to it s default con figurat ion, use the default interface interface-id interface confi guration command. T o reset all trunking characteri stics of a trunking in terface to the def aults, use[...]

15-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring VLAN Trunk s T o reduce the risk of spanning-tree loops or storms, you can disable VLAN 1 on any indiv idual VLAN trunk port b y remov ing VLAN 1 from the allo wed list. When you remov e VLAN 1 from a trunk port, the interface [...]

15-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring VLAN Trunks Beginning in pri vileged EXEC mode, fol low th ese steps to remov e VLANs from t he pruning-eligible list on a trunk po rt: T o return to the default pruning-el igible list of all VLANs, use the no swit chport trunk [...]

15-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring VLAN Trunk s T o return to the default nati ve VLAN, VLAN 1, use the no switchport trunk nati ve vlan interface confi guration command. If a packet has a VLAN ID that is the same as th e out going por t nati ve VLAN ID, t he pa[...]

15-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring VLAN Trunks Figur e 15-3 Load Shar ing b y Using S TP P ort Pr ior ities Note If your switch is a member of a switch stack, you must use the spanning-tr ee [ vlan vlan-id ] cost cost interface configuration command instead o f t[...]

15-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring VLAN Trunk s Load Sharing Usin g STP Path Cost Y ou can confi gure parallel trunks to share VLAN traf fic by setti ng dif ferent path costs on a trunk an d associating the path costs with dif ferent sets of VLANs, blocking d if[...]

15-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring VMPS Beginni ng in pri vileged EXEC mode, fo llo w these steps to co nfigur e the netw ork sho wn in Figure 15-4 : Configuring VMPS The VLAN Query Protocol (VQP) is used to suppo rt dynamic-access ports, which are not permanentl[...]

15-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring VMPS These sections contai n this information: • “Understanding VMPS” section on page 15-26 • “Default VMPS Client Con figur ation” section on pag e 15-27 • “VMPS Config uration Guidelines” section on page 15-[...]

15-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring VMPS If there is a match, the VMPS sends the VLAN number for that port. If the client switch w as not pre viously conf igured, it uses the domain name from the first VTP p acket it recei ves on its trunk port from the VMPS. If t[...]

15-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring VMPS • Secure ports cannot be dynamic-access ports. Y o u mu st disable port security on a port bef ore it becomes dynamic. • Pri vate VLAN ports cannot be dynamic-access ports. • Dynamic-access ports cannot be memb ers o[...]

15-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring VMPS Caution Dynamic-access port VLAN membership is for en d stations or hubs connected to end stations. Connecting dynamic-access port s to other switches can cause a loss of connectivity . Beginning in pri vileged EXEC m ode, [...]

15-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring VMPS Beginni ng in pri vileged EXEC mod e, follo w these steps to change the reconfi rmation interv al: T o return the switch to its default setting, use the no vmps r econfi rm global conf iguration command. Changing the Retry[...]

15-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLANs Configuring VMPS This is an example of output for the show vmps pri vileged EXEC command: Switch# show vmps VQP Client Status: -------------------- VMPS VQP Version: 1 Reconfirm Interval: 60 min Server Retry Count: 3 VMPS domain server: 172[...]

15-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 15 Configuring VLA Ns Configuring VMPS Figur e 15-5 Dynamic P ort VLAN Membership Configuration Primar y VMPS Ser v er 1 Catalyst 6500 series Secondar y VMPS Ser v er 2 Catalyst 6500 series Secondar y VMPS Ser v er 3 172.20.26.150 172.20.26.151 Catalyst 6500 se[...]

CH A P T E R 16-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 16 Configuring VTP This chapter describe s ho w to use the VL AN T run king Protocol (VTP) and the VLAN database for managing VLANs with the Catalyst 3750-X or 3560-X sw itch. Unless otherwise noted, the term sw itch refers to a Catalyst 3750-X or 356 0-X s[...]

16-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configur in g VTP Understanding VTP The switch supports 1005 VLANs, b ut the number of ro uted ports, SVIs, and other conf igured features affects the usage of the switch hardware. If the switch is noti fied by VTP of a ne w VLAN and the switc h is already us[...]

16-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configuring VTP Understanding VTP If you conf igure a sw itch for VTP transparent mode, you can create an d modify VLANs, b ut the changes are not sent to other switches in the domain, and they affect only the indi vidual switch. Howe ver , configuration chan[...]

16-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configur in g VTP Understanding VTP VTP Advertisements Each switch in the VTP domain se nds periodic glob al configuration adv ertisements from ea ch trunk port to a reserved multicast add ress. Neighboring switche s recei ve these advertisements and update t[...]

16-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configuring VTP Understanding VTP • Consistency Checks—In VTP ve rs ion 2, VLAN consistenc y checks (such as VLAN names and v alues) are performed only when y ou enter new in formation throug h the CLI or SN MP . Consistenc y checks are not performed when[...]

16-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configur in g VTP Understanding VTP VTP Pruning VTP pruning incr eases network a vailable b andwidth b y restricting flood ed traff ic to those trunk links that the traf fic must use to reach the destination de vices. W ithout VTP prunin g, a switch floods br[...]

16-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configuring VTP Understanding VTP Figure 16-2 sho ws a switched netw ork with VTP pruni ng enabled. The broadcast traf fic from Switch A is not forwarded to Switches C, E, and F because tr af f i c for the Re d VLAN has been pruned on the links sho wn (Port 5[...]

16-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configur in g VTP Configuring VTP • When VTP mode is changed in a switch in the stack , the other sw itches in the s tack also change VTP mode, and the switch VLAN da tabase remains consistent. VTP version 3 fun ctions the same o n a standalone swit ch or a[...]

16-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configuring VTP Configuring VTP VTP Configuration Guidelines Y ou use the vtp global configuration command to set the VTP passw ord, the v ersion, the VTP file name, the interface providing updated VTP information, th e domain name, and the mo de, and to disa[...]

16-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configur in g VTP Configuring VTP Caution When you conf igure a V TP domain password, the manag ement domain does not funct ion properly if you do not assign a management do main password to each switch in the domain. VTP Version Follo w these guidelines whe[...]

16-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configuring VTP Configuring VTP Configuration Requirements When you confi gure VTP , you must conf igure a trunk port so th at the switch can send and recei ve VTP advertisements to and from ot her swit ches in the domain. For more informati on, see the “C[...]

16-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configur in g VTP Configuring VTP • If you conf igure the switch for VTP client mode, t h e switch does not create the VLA N database file (vlan.dat). If the switch is then po wered off, it rese ts the VTP co nfiguratio n to the default. T o keep the VTP c[...]

16-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configuring VTP Configuring VTP T o return a switch in another mode t o VTP server mode, use the no vtp mode gl obal conf iguration command. T o return the switch to a no-password state, use the no vtp password global conf iguration command. This e xample sh[...]

16-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configur in g VTP Configuring VTP Configuring a VTP Version 3 Primary Server Beginni ng in pri vileged EXEC mod e, follo w these steps on a VTP ser ver to conf igure it as a VTP primary server (v ersion 3 only), which starts a tak eov er operation: This exam[...]

16-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configuring VTP Configuring VTP Caution In VTP version 3, both the primary and secondary servers can ex ist on an instance in the domain. For more informati on on VTP versi on conf iguration guidelines, see the “VTP V ersion” section on page 16-10 . Begi[...]

16-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configur in g VTP Configuring VTP Configuring VTP on a Per-Port Basis W ith VTP version 3, you can enable or disable VTP on a p er-port basis. Y ou can enable VTP only on ports that are in trun k mode. Incoming and ou tgoing VTP traffic are blocked, not forw[...]

16-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configuring VTP Monitoring VTP After resetting the conf iguration revision number , add the switch to the VTP domain. Note Y ou c an use the vtp mode transparent global conf iguration command to disable VTP o n the switch and then to change its VLAN informat[...]

16-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 16 Configur in g VTP Monitoring VTP[...]

CH A P T E R 17-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 17 Configuring Voice VLAN This chapter describes ho w to configure the v o ice VLAN feature on the Catalyst 3750-X or 3560-X switch. Unless otherwise not ed, the term switc h refers to a Catalyst 3750-X or 3560-X stan dalone switch and to a Ca talyst 3750 -[...]

17-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 17 Configurin g Voice VLAN Understanding Voice VLAN Figure 17-1 sho ws one way to connect a Cisco 7960 IP Phone. Figur e 1 7 -1 Cisco 7960 IP Phone Connected t o a Switc h Cisco IP Phone Voice Traffic Y ou can configure an access port w ith an attac hed Cisco IP[...]

17-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 17 Configuring Voice VLAN Configuring Voic e VLAN Note Untagged traff ic from the de vice attached to the Ci sco IP Phone passes throu gh the phone unchanged, regardless of t he trust state of the access port on the phone. Configuring Voice VLAN These sections c[...]

17-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 17 Configurin g Voice VLAN Configuring Voice VLAN • The Port Fast feature is auto ma tically enabled when vo ice VLAN is conf igured. When you disable voice VLAN, the Port Fast featur e is not automatically disabl ed. • If the Cisco IP Ph one and a de vice a[...]

17-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 17 Configuring Voice VLAN Configuring Voic e VLAN Configuring Cisco IP Phone Voice Traffic Y ou can conf igure a port con nected to the Cisco IP Phone to send CDP packet s to the phone t o confi gure the way in which the phone sends v o ice traffic. The phone ca[...]

17-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 17 Configurin g Voice VLAN Configuring Voice VLAN This exampl e sho ws how to conf igure a port connected t o a Cisco IP Phone to use the CoS v alue to classify incoming traff ic, to use IEEE 802.1p priority tagging for v o ice traf f ic, and to use the default [...]

17-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 17 Configuring Voice VLAN Displaying Voice VLAN This exampl e sho ws how to configure a por t connected to a Cisco IP Pho ne to not change the p riority of frames receiv ed from the PC or the attached device: Switch# configure terminal Enter configuration comman[...]

17-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 17 Configurin g Voice VLAN Displaying Voice VLAN[...]

CH A P T E R 18-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 18 Configuring Private VLANs This chapter describes ho w to configure pri vate VLANs on the Catalyst 3750- or 35 60-X switch. Unless otherwise noted , the term switc h refers to a Catalyst 3750-X or 3560-X stand alone switch and to a Ca talyst 37 50-X switc[...]

18-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLANs Understanding Private VLANs Figur e 18-1 Pr ivate-VLAN Domain There are two types of secondary VLANs: • Isolated VLANs—Ports within an isolated VLAN cannot communi cate with each other at the Layer 2 level. • Community VLANs—[...]

18-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLAN s Understanding Private VLANs Primary and secondary VLANs have these characteristics: • Primary VLAN—A pri vate VLAN has only one primary VLAN. Every port i n a pri v ate VLAN is a member of the primary VLAN. The primar y VLAN car[...]

18-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLANs Understanding Private VLANs Private VLANs across Multiple Switches As with regular VLANs, pri vate VLANs can span mul tiple switches. A trunk port carries the p rimary VLAN and secondary VLANs t o a neighboring switch. The t runk por[...]

18-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLAN s Configuring Private VLANs Private VLANs and SVIs In a Layer 3 swit ch, a swit ch virtual interface (SVI ) represents the La yer 3 interf ace of a VLAN. Layer 3 de vices communicate with a pri vate VLAN only throug h the primary VLAN[...]

18-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLANs Configuring Private VLANs Tasks for Configuring Private VLANs T o configure a pri vate VLAN, perform these steps: Step 1 Set VTP mode to transparent. Step 2 Create the primary and secondary VLA Ns and associate them. See the “Confi[...]

18-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLAN s Configuring Private VLANs • W ith VTP version 1 or 2, after you ha ve confi gured pri vate VLA Ns, use the copy running-config startup conf ig privileg ed EXEC comm and to sav e the VTP transparent mode configuration and pri v ate[...]

18-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLANs Configuring Private VLANs T o filter out specif ic IP traff ic for a priv ate VLAN, you should apply the VLAN map to b oth the primary and secondary VLANs. • Y ou can apply router A CLs only on the primary-VLAN SVIs. The A CL is ap[...]

18-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLAN s Configuring Private VLANs – Link Aggre gation Control Prot ocol (LA CP) – Multicast VLAN Re gistration (MVR) – voi c e V L AN – W eb Cache Communication Protocol (WCCP) • Y ou can confi gure IEEE 802. 1x port-based authent[...]

18-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLANs Configuring Private VLANs When you associate secondary VLANs with a pr imary VLAN, note this syntax information: • The secondary_vlan_list pa rameter can not contain s paces. It ca n contai n multiple co mma-separated items. Each [...]

18-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLAN s Configuring Private VLANs Switch(config-vlan)# end Switch(config)# show vlan private vlan Primary Secondary Type Ports ------- --------- ----------------- ------------------------------------------ 20 501 isolated 20 502 community [...]

18-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLANs Configuring Private VLANs Administrative private-vlan trunk encapsulation: dot1q Administrative private-vlan trunk normal VLANs: none Administrative private-vlan trunk private VLANs: none Operational private-vlan: 20 501 <output [...]

18-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLAN s Configuring Private VLANs Use the show vlan pri vate-vla n or the show interface status privi leged EXEC comman d to display primary and secondary VLAN s and pri v ate-VLAN ports on the sw itch. Mapping Secondary VLANs to a Primary[...]

18-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 18 Configuring Private VLANs Monitoring Private VLANs --------- -------------- ----------------- vlan10 501 isolated vlan10 502 community Monitoring Private VLANs Ta b l e 18-1 sho ws the pri vileged EXEC commands for m onitoring pri vate-VLAN acti vity . This [...]

CH A P T E R 19-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 19 Configuring IEEE 802.1Q and Layer 2 Protocol Tunneling V irtual pri vate netw orks (VPNs) provide enterprise-s cale connecti vity on a shar ed infrastructu re, often Ethernet-based, with the same secu rity , prioritization, reliability , and manageabilit[...]

19-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q an d Layer 2 Protocol Tunneling Understanding IEEE 802.1Q Tunneling tagged packets. A port conf igured to su pport IEEE 802.1Q tunne ling is called a tunnel port . When yo u confi gure tunneling, yo u assign a t unnel port to a VLAN ID[...]

19-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q and Layer 2 Pr otocol Tunneling Understanding IEEE 802. 1 Q Tu nneling Figur e 19-2 Or ig inal (Normal), IEEE 802.1Q, an d Double-T agged Ether net P ack et For mats When the packet enters the trunk port of the service-provider e g re [...]

19-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q an d Layer 2 Protocol Tunneling Configuring IEEE 802.1Q Tunneling Configuring IEEE 802.1Q Tunneling These sections contain this configu ration informat ion: • Default IEEE 802.1Q T unne ling Configur ation, page 19-4 • IEEE 802.1Q [...]

19-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q and Layer 2 Pr otocol Tunneling Configu ring IEEE 802.1Q Tunneling These are some wa ys to solve t his problem: • Use ISL trunks be tween core sw itches in th e service-provider netw ork. Although customer interfaces connected to edg[...]

19-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q an d Layer 2 Protocol Tunneling Configuring IEEE 802.1Q Tunneling For e xample, the switch supports a maxi mum frame size of 1496 bytes with one of these conf igurations: • The switch has a system jumbo MT U value of 1500 bytes, and [...]

19-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q and Layer 2 Pr otocol Tunneling Configu ring IEEE 802.1Q Tunneling Configuring an I EEE 802.1Q Tunneling Port Beginning in priv ileged EXEC mode, foll ow these step s to co nfigu re a port as an IEEE 802. 1Q tunnel port: Use the no swi[...]

19-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q an d Layer 2 Protocol Tunneling Understanding Layer 2 Protoco l Tu nne ling Understanding Layer 2 Protocol Tunneling Customers at dif ferent sites connect ed across a service-provider netw ork need to use v arious Layer 2 protocols to [...]

19-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q and Layer 2 Pr otocol Tunneling Understan ding Layer 2 Protocol Tunneling Figur e 19-4 Lay er 2 Protocol T unnel ing Figur e 19-5 La yer 2 Networ k T opology without Pr oper Conv e r gence In an SP network, you can use Layer 2 protocol[...]

19-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q an d Layer 2 Protocol Tunneling Configuring La yer 2 Protocol Tunnelin g For e xample, in Figure 19-6 , Customer A has two switches in the same VLAN that are connected through the SP ne twork. When the network t unnels PD Us, sw itche[...]

19-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q and Layer 2 Pr otocol Tunneling Configuring Layer 2 Protoc ol Tunneling See Figure 19-4 , with Customer X and Customer Y in access VLANs 30 and 40, respe cti vely . Asymmetric links connect the cust omers in Site 1 t o edge switches i[...]

19-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q an d Layer 2 Protocol Tunneling Configuring La yer 2 Protocol Tunnelin g Layer 2 Protocol Tunneling Co nfiguration Guidelines These are some configuration guidel ines and operating characteristics of Layer 2 p rotocol tunneling: • T[...]

19-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q and Layer 2 Pr otocol Tunneling Configuring Layer 2 Protoc ol Tunneling Configuring Layer 2 Protocol Tunneling Beginni ng in pri vileged EXEC mod e, follo w these steps to conf igure a port for Layer 2 protoco l tunneling : Command Pu[...]

19-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q an d Layer 2 Protocol Tunneling Configuring La yer 2 Protocol Tunnelin g Use the no l2protocol-tunnel [ cdp | stp | vtp ] i nterface conf iguration command to disable protocol tunneling for one of the Layer 2 protocols or fo r all thr[...]

19-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q and Layer 2 Pr otocol Tunneling Configuring Layer 2 Protoc ol Tunneling Use the no l2protocol-tunnel [ point-to-point [ pagp | lacp | udld ]] interface conf iguration command to disable point-to -point protocol tunneli ng for one of t[...]

19-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q an d Layer 2 Protocol Tunneling Configuring La yer 2 Protocol Tunnelin g Configuring the Customer Switch After conf iguring the SP edge switch, be gin in pri vileged EXEC mode and follo w these steps to configure a customer switch for[...]

19-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q and Layer 2 Pr otocol Tunneling Configuring Layer 2 Protoc ol Tunneling Switch(config-if)# l2protocol-tunnel drop-threshold point-to-point pagp 1000 Switch(config-if)# exit Switch(config)# interface gigabite thernet1/0/3 Switch(config[...]

19-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 19 Configuring IEEE 802.1Q an d Layer 2 Protocol Tunneling Monitoring and Main ta ining Tunneling Status Monitoring and Mainta ining Tunneling Status Ta b l e 19-2 sho ws the pri vileged EXEC commands for monitoring and maintaining IEEE 802. 1Q and Layer 2 prot[...]

CH A P T E R 20-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 20 Configuring STP This chapter d escribes ho w to conf igure the Spannin g T ree Protocol (STP) o n port-based VLANs on the Catalyst 37 50-X or 35 60-X swit ch. The sw it ch can use either the per -VLAN spanning-tree pl us (PVST+) protocol based on the IEE[...]

20-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Understanding Spannin g- Tr ee Featu res • Spanning-T ree Modes and Protocols, page 20-9 • Supported Spanning- T ree Instances, page 20-10 • Spanning-T ree Interoperability and Backw ard Compatibility , page 20-10 • STP and IEEE 802.[...]

20-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Understanding Spanning -Tree Features Spanning-Tree Topology and BPDUs The stable, activ e spa nning-tree to pology of a switch ed network is controlled b y these elements: • The unique bridge ID (switch pr iority and MA C address) associat [...]

20-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Understanding Spannin g- Tr ee Featu res Only one outgoing port on the stack roo t switch is selected as th e root port. The remain ing switches in the stack become its desi gnated switches (Switch 2 and Switch 3) as shown in Figure 20-1 on [...]

20-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Understanding Spanning -Tree Features The switch suppo rts the IEEE 802.1t sp anning-tree extensions, an d some of the bits previously used for the switch priority are no w used as the VLAN identif ier . The result is that fe wer MA C addresse[...]

20-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Understanding Spannin g- Tr ee Featu res • From learning to forw arding or to disabled • From forwarding to dis abled Figure 20-2 illustra tes how an interface moves through the states. Figur e 20-2 Spanning-T ree Interf ace States When [...]

20-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Understanding Spanning -Tree Features • Does not learn addr esses • Receiv es BPDUs Listening State The listening state is the first state a Layer 2 inte rface enters after the blocking state. The interface enters this state when the spann[...]

20-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Understanding Spannin g- Tr ee Featu res How a Switch or Port Becomes the Root Switch or Root Port If all switches in a network are enabled with defaul t spanning-tree settings, the swi tch with the lo west MA C address becomes the root swit[...]

20-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Understanding Spanning -Tree Features Regardless of the spanning-tree state, each switch in the stack recei ves b ut does not forward packets destined for addresses between 0 x0180C2000000 and 0x0 180C200000F . If spanning tr ee is enabled, th[...]

20-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Understanding Spannin g- Tr ee Featu res forward delay and by quick ly transitioning root p orts and designated ports t o the forwardin g state. In a switch stack , the cross-stack rapid transition (CSR T) feature performs t he same functio[...]

20-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Understanding Spanning -Tree Features When you connect a Cisco switch to a non-Cisco device through an I EEE 802.1Q trunk, the Cisco switch uses PVST+ to provide spann ing-tree interoperability . If rapid PVST+ is enabled, the swit ch uses it[...]

20-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Configuring Spanning -T ree Features For more information about switch stacks, see Chapter 5, “Managing Switch Stacks. ” Configuring Spanning-Tree Features These sections contain this configu ration informat ion: • Default Spann ing-T[...]

20-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Configuring Spa nning -Tree Features Spanning-Tree Configuration Guidelines Each stack member runs its o wn spanning tree, and the entire stack a ppears as a single swit ch to the rest of the network. If more VLANs are defined in the VTP than[...]

20-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Configuring Spanning -T ree Features Spanning-tree com mands control the conf iguratio n of VLAN spa nning-tree instances. Y ou create a spanning-tree instance when you assign an interface to a VLAN. The spanning-tree instance is removed wh[...]

20-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Configuring Spa nning -Tree Features T o return to the defa ult setting, use th e no spanning-tree mode global conf iguration command. T o return the port to its def ault setting, use the no spanning-tree link-type interface conf iguration co[...]

20-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Configuring Spanning -T ree Features T o conf igure a switch to become the roo t for the specif ied VLAN, use the spanning-tree vlan vlan-id roo t global configuratio n command to modify the swit ch priority from t he default v alue (32768)[...]

20-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Configuring Spa nning -Tree Features Beginning in p rivile ged EXEC mod e, follow these step s to conf igure a switch to become the root for the specified VLAN. This procedure is optional. T o return to the default setti ng, use the no spanni[...]

20-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Configuring Spanning -T ree Features Beginning in privil eged EXEC mode, fol low these st eps t o conf igure a switch to become the secondary root for the sp ecified VLAN. This pro cedure is optional . T o return to the def ault setting, us[...]

20-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Configuring Spa nning -Tree Features Beginning in pri vileged EXEC mode, follow these steps to conf igure the port priority of an interf ace. This procedure is optional. Note The show spanning-tr ee interface interfac e-id pri vileged EXEC co[...]

20-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Configuring Spanning -T ree Features Configuring Path Cost The spanning-tree path cost default v alue is deri ved from the media sp eed of an interface. If a l oop occurs, spanning tree uses cost when se lecting an in terface to put in the [...]

20-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Configuring Spa nning -Tree Features T o return to the default setti ng, use the no spanning-tree [ vlan vlan-id ] cost interface c onf iguration command. For inf ormation on ho w to configure load sharing on t runk ports by using spannin g-t[...]

20-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Configuring Spanning -T ree Features Configuring Spanning-Tree Timers Ta b l e 20-4 describes the timers that af fect the entire spanning-tree p erformance. The sections that fol low pro vide the configuratio n steps. Configuring the Hello [...]

20-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configuring STP Configuring Spa nning -Tree Features Configuring the Forwardi ng-Delay Time for a VLAN Beginni ng in pri vileged EXEC mode, follo w these steps to conf igure the forwarding-delay time for a VLAN. This procedure is optional. T o return to the [...]

20-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 20 Configur in g STP Displaying the Spanning-T re e Status Configuring the Transmit Hold-Count Y ou can confi gure the BPDU b urst size by changi ng the transmit hold coun t v alue. Note Changing this parameter to a h igher v alue can ha ve a significant impact[...]

CH A P T E R 21-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 21 Configuring MSTP This chapter describe s ho w to configure the Cisco i mplementation of t he IEEE 802.1s Multip le STP (MSTP) on the Catalyst 3750-X or 3 560-X switch. Note The multiple spanning-tree (MST ) implementation is based on the IEEE 802.1s stan[...]

21-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Understanding MSTP Understanding MSTP MSTP , which uses RSTP for rapid con ver gence, en ables VLANs to be grouped into a spanning-tree instance, with each instance h aving a spann ing-tree topology ind ependent of other spanni ng-tree insta[...]

21-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Understanding MSTP The IST is the only spanni ng-tree instance that sends and recei ves BPDUs. All of the other spanning-tree instance informatio n is cont ained in M-records, wh ich are encapsulate d with in MSTP BPDUs. Because the MSTP BPDU[...]

21-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Understanding MSTP The IST connects all the MSTP switches in the regi on and appears as a s ubtree in the CIST that encompasses the entire swit ched domain. The root of the subtree is the CIST re gional root. The MST region appears as a virt[...]

21-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Understanding MSTP IEEE 802.1s Terminology Some MST naming con ventions used in Cisco ’ s pres tandard implementation ha ve been changed to identify some internal or r e gional parameters. These parameters are signif icant only within an MS[...]

21-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Understanding MSTP Boundary Ports In the Cisco prestandard i mplementation, a boundar y port connects an MST r egion to a sing le spanning-tree re gion running RSTP , to a single spanning-tree region running PVST+ or rapid PVST+, or to anoth[...]

21-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Understanding MSTP • The boundary port is not t he root port of the CIST re gional root—The MSTI po rts follo w the state and role of the CIST port. Th e standard pro vides less information, and it mi ght be dif f icult to understand why [...]

21-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Understanding MSTP Figure 21-3 illustrates a un idirectional link failu re that typically creates a bridging loop. Switch A is the root switch, and its BPDUs are lost on the link leading to switch B. RSTP and MST BPDUs include the ro le and [...]

21-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Understanding RSTP to a po rt when the switch to which this switch is co nnected has joined the re gion. T o restart th e protocol migration process (force th e renegotiati on with neighboring switches), use the clear spanning -tree detected-[...]

21-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Understanding RSTP In a stab le topology with consistent port roles throughout the netw ork, the RSTP ensur es that ev ery root port and designated port immediat ely transition to th e forwarding state while all alternate and backup ports a[...]

21-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Understanding RSTP When Switch C is connected to Switch B, a si milar set of handshak ing messages are exchanged. Switch C selects the port connected to Switch B as its roo t port, and both ends immediately transition to t he forwarding stat[...]

21-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Understanding RSTP After ensuring that all of the ports are synchroniz ed, the switch sends an agreement message to the designated switch co rrespondin g to its root port. When the switches connected b y a point-to- point link are in agreem[...]

21-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Understanding RSTP The sending switch sets the proposal flag in the RSTP BPDU to propose itself as the designated switch on that LAN. The port role in the proposal message is always set to the designated port. The sending switch sets the agr[...]

21-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Configuring MSTP Features • Propagation—When an RSTP switch recei ves a TC message from another switch through a designated or root port, it propagates the chang e to all of its nonedge, desig nated ports and to the root port (e xcludin[...]

21-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Configuring MSTP Features For info rmation about the supported nu mber of spanning-tree instan ces, see the “Support ed Spanning-T ree Instanc es” section on page 20-10 . MSTP Configuration Guidelines These are the configurati on guid el[...]

21-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Configuring MSTP Features • All MST boundary po rts must be forwarding for lo ad-balancing b etween a PVST+ and an MST cloud or between a r apid-PVST+ and an MST cloud. F or this to occur , the IST master of t he MST cloud should also be [...]

21-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Configuring MSTP Features T o return to the def ault MST region config uration, use the no spanning-tr ee mst configurati on global confi guration command. T o return to the default VLAN-to-i nstance map, use the no instance instance-id [ vl[...]

21-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Configuring MSTP Features Instance Vlans Mapped -------- --------------------- 0 1-9,21-4094 1 10-20 ------------------------------- Switch(config-mst)# exit Switch(config)# Configuring the Root Switch The switch maintains a spanning-t ree [...]

21-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Configuring MSTP Features Beginning in priv ileged EXEC mode, foll ow these step s to co nfigu re a switch as the root switch. Thi s procedure is optional . T o return the switch to its default setting, use the no spanni ng-tr ee mst instanc[...]

21-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Configuring MSTP Features Beginning in pri vileged EXEC mode, foll ow th ese steps to conf igure a switch as the secondary root switch. This procedure is optional. T o return the switch to its default setting, use the no spanni ng-tr ee mst[...]

21-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Configuring MSTP Features Beginning in pri vileged EXEC mod e, follo w these steps to conf igure the MSTP port priority of an interface. This pro cedure is optional. Note The show spanning-tr ee mst interface interfac e-id pri vileged EXEC c[...]

21-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Configuring MSTP Features Beginning in privil eged EXEC mode, follo w these steps to configure the MSTP cost of an interface. This procedure is optional . Note The show spanning-tr ee mst interface interfac e-id pri vileged EXEC co mmand di[...]

21-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Configuring MSTP Features Beginni ng in pri vileged EXEC mo de, follow these step s to conf igure the switch priority . This procedure is optio nal. T o return the switch to its default setting, use the no spanni ng-tr ee mst instance-id pri[...]

21-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Configuring MSTP Features Configuring the Forwarding-Delay Time Beginni ng in pri vileged EXEC mod e, follo w these steps to conf igure the forwarding-delay t ime for all MST instances. This procedure is optio nal. T o return the switch to [...]

21-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Configuring MSTP Features Configuring the Maximum-Hop Count Beginni ng in pri vile ged EXEC mode, follo w these steps to conf igure the maximum-hop count for all MST instances. This procedure is optio nal. T o return the switch to it s defau[...]

21-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Configuring MSTP Features Designating the Neighbor Type A topology could contain both pr estandard and IEEE 802.1s standard comp liant devices. By default, ports can automatically de tect prestandard de vices, but the y can still recei ve b[...]

21-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring MSTP Displaying the MST Co nfiguration and Status Displaying the MST Configuration and Status T o display the spanning-tree status, u se one or more of the pri vileged EXEC commands in Ta b l e 21-5 : For info rmation about other k eywo rds for t[...]

21-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 21 Configuring M STP Displaying the MST Configuration and Status[...]

CH A P T E R 22-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 22 Configuring Optional Spanning-Tree Features This chapter describes h ow to con figure o ptional spanning -tree features on the Catalyst 3750-X or 3560-X switch. Y o u can co nfigur e all of these features when your switch is runnin g the per -VLAN spanni[...]

22-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Understanding Op tional Spanning-Tree Features Understanding Port Fast Port Fast immediately brings an interface conf igured as an access or trunk port to the f orwarding state from a blocking state, b y passing t[...]

22-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configuring Optiona l Spanning-Tree Feature s Understanding Optional Spa nning -Tree Features At the interf ace le vel, you enable BPDU guard on an y port by usin g the spanning-tree bpduguard enable interface conf iguration command without also en abling the[...]

22-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Understanding Op tional Spanning-Tree Features Figur e 22-2 Switc hes in a Hierarc hical Networ k If a switch loses connecti vity , it beg ins using the alte rnate paths as soon as th e spanning tree selects a ne [...]

22-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configuring Optiona l Spanning-Tree Feature s Understanding Optional Spa nning -Tree Features Figur e 22-3 UplinkF ast Example Before Dir ect Link Failur e If Switch C de tects a link f ailure on the currentl y acti ve link L2 on the ro ot port (a dir ect lin[...]

22-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Understanding Op tional Spanning-Tree Features How CSUF Works CSUF ensure s that one link in t he stack is electe d as the path to th e root. As shown in Figure 22-5 , the stack-root port on Switch 1 p rovides the[...]

22-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configuring Optiona l Spanning-Tree Feature s Understanding Optional Spa nning -Tree Features Each switch in the stack decides if the send ing switch is a better choice than itself to be the stack root of this spanning-tree instan ce by comparing the root , c[...]

22-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Understanding Op tional Spanning-Tree Features BackboneF ast, which is enabled b y using the spanning-tr ee backbonefast global confi guration command, starts when a root port or block ed interface on a switch rec[...]

22-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configuring Optiona l Spanning-Tree Feature s Understanding Optional Spa nning -Tree Features If link L1 fa ils as show n in Figure 22-7 , Switch C cannot detect this failure because it is not connected directly to l ink L1. Ho wev er , because Switch B is d [...]

22-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Understanding Op tional Spanning-Tree Features Understanding EtherChannel Guard Y ou can use EtherChannel guard to d etect an EtherC hannel misconf iguration between the switch and a connected device. A misconf i[...]

22-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configuring Optiona l Spanning-Tree Feature s Configuring Optional Spanning -Tree Features Figur e 22-9 Root Guard in a Service-Pro v ider Networ k Understanding Loop Guard Y ou can use loop guar d to pre vent al ternate or root ports from becomi ng designat[...]

22-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Configuring Optio na l Spannin g-Tree Features • Enabling BackboneF ast, page 22-16 (optional) • Enabling Ethe rChannel Gua rd, page 22-17 (optional) • Enabling Root Guard, page 22 -18 (optional) • Enabli[...]

22-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configuring Optiona l Spanning-Tree Feature s Configuring Optional Spanning -Tree Features Y ou can enable this feature if your switch is running PVST+, rapid PVST+, or MSTP . Beginning in pri vileged EXEC mode, fol low these steps t o enable Port Fast. Thi [...]

22-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Configuring Optio na l Spannin g-Tree Features The BPDU guard feature pro vides a secure response to in v alid configurat ions because you must manually put the port b ack in service. Use the BPDU guard feature i[...]

22-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configuring Optiona l Spanning-Tree Feature s Configuring Optional Spanning -Tree Features Y ou can also use the spanning-tr ee bpdufilter enable interface conf iguration command to enable BPDU filteri ng on any interface wi thout also enabling th e Port Fas[...]

22-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Configuring Optio na l Spannin g-Tree Features Beginning in p rivile ged EXEC mode, follow these st eps to enable Up linkFast and CSUF . This procedure is optio nal. When UplinkFast is enabled, the sw i tch prior[...]

22-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configuring Optiona l Spanning-Tree Feature s Configuring Optional Spanning -Tree Features Note If you use BackboneFast, y ou must enable it on all switches in the netw ork. BackboneFast is no t supported on T oken Ring VLANs. This feature is supported f or [...]

22-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Configuring Optio na l Spannin g-Tree Features Enabling Root Guard Root guard enabled on an int erface applies to all the VLANs to which t he interface belongs. D o not enable the root guar d on interfaces to be [...]

22-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configuring Optiona l Spanning-Tree Feature s Displaying th e Spanning-Tree Status T o globally disable loop g uard, use the no spanning-tr ee loopguard default g lobal configuration command. Y ou can o verride the se tting of the no spanning-tree loopguard [...]

22-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 22 Configur in g Optional Spanning-Tree Features Displaying the Spanning-T re e Status[...]

CH A P T E R 23-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 23 Configuring Flex Links and the MAC Address-Table Move Update Feature This chapter describe s ho w to configure Flex Li nks, a pair of interf aces on the Catalyst 3750-X or 3560-X switch that pro vide a mu tual backup. It a lso descri bes how to configure[...]

23-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links a nd the MAC Address-Table Move Upd ate Feature Understanding Flex Links and the MAC Address-Table Move Update typically conf igured in service pro vider or enterprise networ ks where customers do not w ant to run STP on the switch. If [...]

23-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links and the MA C Address-Tabl e Move Update Featu re Understanding Flex Links and the MAC Address-Table Move U pdate Figur e 23-2 VLAN Flex Links Load Bala ncing Configur ati on Example Flex Link Multicast Fast Convergence Flex Link Multica[...]

23-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links a nd the MAC Address-Table Move Upd ate Feature Understanding Flex Links and the MAC Address-Table Move Update Leaking IGMP Reports T o achie ve multi cast traf fic con vergence with mini mal loss, a redun dant data path mu st be set up[...]

23-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links and the MA C Address-Tabl e Move Update Featu re Understanding Flex Links and the MAC Address-Table Move U pdate Similarly , both Flex Link p orts are part of learn ed groups. In this e xample, Giga bitEthernet2/0/11 is a recei ver/host[...]

23-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links a nd the MAC Address-Table Move Upd ate Feature Understanding Flex Links and the MAC Address-Table Move Update Whene ver a host responds to the general query , the switch forwards this repo rt on all the mrouter ports. When you turn on [...]

23-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links and the MA C Address-Tabl e Move Update Featu re Configuring Flex Links and MA C Address-Table M ove U pdate Figur e 23-3 MAC A ddress-T able Mo ve Update Example Configuring Flex Links and MA C Address-Table Move Update These sections [...]

23-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links a nd the MAC Address-Table Move Upd ate Feature Configuring Flex Lin ks and MAC Ad dr ess-T able Move Update • An interface can belong to only one Fle x Link pair . An interface can be a backup link for only one activ e link. An activ[...]

23-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links and the MA C Address-Tabl e Move Update Featu re Configuring Flex Links and MA C Address-Table M ove U pdate T o disable a Fle x Link backup interf ace, use the no switchport backup interface interface-id interface confi guration comman[...]

23-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links a nd the MAC Address-Table Move Upd ate Feature Configuring Flex Lin ks and MAC Ad dr ess-T able Move Update T o remove a preemption scheme, u se the no switchport backup interface interface-id pr eemption mode interface conf iguration[...]

23-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links and the MA C Address-Tabl e Move Update Featu re Configuring Flex Links and MA C Address-Table M ove U pdate In the follo wing example, VLANs 1 to 50, 6 0, and 100 to 120 ar e configur ed on the switch: Switch(config)# interface gigabi[...]

23-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links a nd the MAC Address-Table Move Upd ate Feature Configuring Flex Lin ks and MAC Ad dr ess-T able Move Update Configuring the MAC Address-Table Move Update Feature This section contains this information: • Config uring a switch to sen[...]

23-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links and the MA C Address-Tabl e Move Update Featu re Configuring Flex Links and MA C Address-Table M ove U pdate This exampl e show s how to verify the conf iguration: Switch# show mac-address-table move update Switch-ID : 010b.4630.1780 D[...]

23-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 23 Configuring Flex Links a nd the MAC Address-Table Move Upd ate Feature Monitoring Flex Links and the MAC Address-Ta ble Move Update Monitoring Flex Links and the MAC Address-Table Move Update Ta b l e 23-1 sho ws the pri vile ged EXEC commands for monitoring[...]

CH A P T E R 24-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 24 Configuring DHCP Featur es and IP Source Guard This chapter describe s ho w to configure DHCP snoo ping and option-82 data insertion, and the DHCP server port-based address alloca tion featur es on the Cat alyst 3750-X or 35 60-X switch. It also describe[...]

24-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Understanding DHCP Features • Cisco IOS DHCP Server Database, page 24 -6 • DHCP Snooping Binding Database, page 24-6 For information about the D HCP client, see the “ Configuring DHCP ” section of the “[...]

24-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Understanding DHCP Features When a switch receiv es a packet on an untrusted in terface and the inte rface belongs to a V LAN in which DHCP snooping is en abled, the swit ch compares th e source MA C address and[...]

24-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Understanding DHCP Features Figur e 24-1 DHCP Rela y A gent in a Metropolitan Ether net Netw ork When you enable the DHCP snooping in formation option 82 on the switch, th is sequence of eve n ts occurs : • The[...]

24-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Understanding DHCP Features In the port f ield of the circuit ID suboption, the port numbers start at 3. F or example, on a Catalyst 37 50-E switch with 24 10/100/1000 ports and four small form-factor pluggable [...]

24-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Understanding DHCP Features Figur e 24-3 User -Configur ed Subo pti on P ack et For mats Cisco IOS DHCP Server Database During the DHCP -based autoconfiguration proc ess, the designated DHCP server uses th e Cisc[...]

24-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Understanding DHCP Features When reloading, the switch r eads the binding f ile to build the DH CP snooping binding d atabase. The switch updates the f ile when the database changes. When a switch learns of ne w[...]

24-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Configuring DHCP Features When a stack merge occurs, all DHCP sn ooping bindings in th e stack master are lost if it i s no longer the stack master . With a stack partition, the exis ting stack master is unch ang[...]

24-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Configuring DHCP Features DHCP Snooping Configuration Guidelines • Y ou must globally enable DHCP sn ooping on the switch. • DHCP snooping is n ot acti ve until D HCP snooping is enabled on a VLAN. • Befor[...]

24-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Configuring DHCP Features • Follo w these guidelines when conf iguring the DHCP snooping binding datab ase: – Because both NVRAM and the flash memor y hav e limited storage capacity , we reco mmend that you [...]

24-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Configuring DHCP Features Configuring the DHCP Relay Agent Beginning in priv ileged EXEC mode, foll ow these steps to enable th e DHCP relay agent on the switch: T o disable the DHCP server and relay agent, use[...]

24-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Configuring DHCP Features T o remove the DHCP packet forw arding address, use the no ip helper -address addr ess interface confi guration command. Enabling DHCP Snooping and Option 82 Beginning in pri vileged EX[...]

24-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Configuring DHCP Features T o disable DHCP snooping, use the no ip dhcp snooping global conf iguration command. T o disable DHCP snooping on a VLAN or range o f VLANs, use the no ip dhcp snooping vlan vlan-r an[...]

24-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Configuring DHCP Features This exampl e sho ws how to enable DHCP snooping globally and on VLAN 10 and to conf igure a rate limit of 100 pa ckets per second on a p ort: Switch(config)# ip dhcp snooping Switch(co[...]

24-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Configuring DHCP Features Enabling the DHCP Snooping Binding Database Agent Beginning in pri vileged EXEC mode, follow these steps to enable and conf igure the DHCP snooping binding database agen t on the switc[...]

24-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Displaying DHCP Sno oping Inform ation Displaying DHCP Snooping Information Note If DHCP snoopi ng is enabled and an interf ace changes to the do wn state, the swit ch does not delete the statically conf igured [...]

24-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Understanding IP Sou rce Guard Source IP Address Filtering When IPSG is enabled wit h this option, IP traff ic is filtered b ased on the source IP address. The swit ch forwards IP traf fic when the sourc e IP a[...]

24-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Configuring IP Source Gua rd Note Some IP hosts with multiple netw ork interfaces can inject some in valid packet s into a network interface. The in valid packets co ntain the IP or MA C address for another netw[...]

24-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Con f ig uring IP Source Guard • If you enable IP source guard with source IP and MA C address filtering, DHCP snooping and port security must be enabled on the in terface. Y ou must also enter the ip dhcp sn[...]

24-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Configuring IP Source Gua rd T o disable IP source guard with source IP address f iltering, use the no ip verify sour ce interface confi guration command. T o delete a static IP source binding entry , use the no[...]

24-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Con f ig uring IP Source Guard Beginni ng in pri vileged EXEC mod e: This example sho ws how to stop IPSG with static hosts on an interf ace. Switch(config-if)# no ip verify source Switch(config-if)# no ip devi[...]

24-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Configuring IP Source Gua rd This exampl e show s how to enable IPSG with static hosts on a port. Switch(config)# ip device tracking Switch(config)# ip device trackin g max 10 Switch(config-if)# ip verify sour c[...]

24-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Con f ig uring IP Source Guard IP Address MAC Address Vlan Interface STATE --------------------------------------------------------------------- 200.1.1.8 0001.0600.0000 8 GigabitEthernet1/0/1 INACTIVE 200.1.1.[...]

24-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Configuring IP Source Gua rd Configuring IP Source Guar d for Static Hosts on a Private VLAN Host Port Note Y ou must globally conf igure the ip device tracking maximum limit-number interf ace configuration comm[...]

24-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Displaying IP Source Guard Information This exa mple sho ws how to enab le IPSG for static ho sts with IP filters on a pri vate VLAN host port: Switch(config)# vlan 200 Switch(config-vlan)# private-vlan primary[...]

24-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Understanding DHCP Se rver Port-Based Ad dress Allocation Understanding DHCP Server Port-Based Address Allocation DHCP server port-based address allocation is a fe ature that enables DHCP to maintain t he same I[...]

24-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Configuring DHCP Server Port -Based Address Allocation Enabling DHCP Server Port-Based Address Allocation Beginni ng in pri vileged EXEC mod e , follo w these steps to g lobally enable port-b ased address alloc[...]

24-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Configuring DHCP Server Port- Ba se d Add re ss Allocation T o disable DHCP port-based address allocation, use the no ip dhcp use subscriber- id client-id global confi guration command. T o disable the automatic[...]

24-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Fea tures and IP Source Gua rd Displaying DHCP Server Port-Based Add ress Allocation For more inf ormation about conf iguring the DHCP server por t-based address allocation feature, go to Cisco.com, and enter Cisco IOS IP Addr essing Service[...]

24-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 24 Configuring DHCP Feature s and IP Source Guard Displaying DHCP Se rve r Port-Based Address Allocation[...]

CH A P T E R 25-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 25 Configuring Dynamic ARP Inspection This chapter describes ho w to conf igure dynamic Addr ess Reso lution Protocol inspectio n (dynamic ARP inspection) on the Catalyst 3750-X or 3560-X switch. This feature helps pre vent malicious att acks on t he switch[...]

25-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Co nfig uring Dynamic ARP Inspection Understanding Dynamic ARP Inspection Figur e 25-1 ARP Cache P oisoning Hosts A, B, and C are connected to the switch on in terfaces A, B and C, all of which are on the sa me subnet. Their IP and MAC addresses are sho wn in[...]

25-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Configuring Dynamic ARP Insp ection Understanding Dynamic ARP In spection Y ou can configure dynamic ARP insp ection to drop AR P packets when the IP a ddresses in the packets are in valid or when the MA C a ddresses in the bod y of the ARP packets do not mat[...]

25-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Co nfig uring Dynamic ARP Inspection Understanding Dynamic ARP Inspection Dynamic ARP inspection ensures that hosts (on untru sted interfaces) conn ected to a switch running dynamic ARP in spection do not poison the ARP cach es of other hosts in t he network.[...]

25-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection Logging of Dropped Packets When the switch drops a pac ket, it pl aces an entry in the log b uffer and then generates system me ssages on a rate-con trolled basis. Aft er the message is ge[...]

25-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Co nfig uring Dynamic ARP Inspection Configuring Dynamic ARP Inspection Dynamic ARP Inspection Configuration Guidelines • Dynamic ARP inspection is an ingress securit y feature; it does not perform an y egress checking. • Dynamic ARP inspection is not ef [...]

25-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection • The operating rate for th e port channel is cumu lativ e across all the p hysical ports within the channel. For e xample, if you conf igure the port channel with an ARP rate-limit of 4[...]

25-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Co nfig uring Dynamic ARP Inspection Configuring Dynamic ARP Inspection T o disable dynamic ARP insp ection, use the no ip arp inspecti on vlan vlan-rang e global config uration command. T o return the interfaces to an untrusted state, use the no ip arp inspe[...]

25-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection If you conf igure port 1 on Switch A as trusted, a security hole is created because both Sw itch A and Host 1 could be attacked b y either Switch B or Host 2. T o prev ent this possibility[...]

25-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Co nfig uring Dynamic ARP Inspection Configuring Dynamic ARP Inspection T o remove the A RP A CL, use the no arp access-list global conf iguration command. T o remove the ARP A CL attached to a VLA N, use the no ip arp inspect ion f ilter arp-acl-name vlan v[...]

25-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection For conf iguration guidelines for rate limitin g trunk ports and EtherChannel ports, see the “Dyna mic ARP Inspection Conf iguration Guidelines” section on p age 25-6 . Beginni ng in [...]

25-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Co nfig uring Dynamic ARP Inspection Configuring Dynamic ARP Inspection Performing Validation Checks Dynamic ARP inspection intercepts, logs, and discar ds A RP packets with in vali d IP-to-MA C address bindings. Y ou can conf igure the switch to perform add[...]

25-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Configuring Dynamic ARP Insp ection Configuring Dynamic ARP Inspection Configuring the Log Buffer When the switch drops a pac ket, it pl aces an entry in the log b uffer and then generates system me ssages on a rate-con trolled basis. Aft er the message is g[...]

25-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Co nfig uring Dynamic ARP Inspection Displayi n g Dynamic AR P Inspection Information T o return to the def ault log b uf fer settings, use th e no ip arp inspection log-b uffer { entries | logs } global conf iguration command. T o return to the d efault VLA[...]

25-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Configuring Dynamic ARP Insp ection Displaying Dynamic ARP In spection Information For th e show ip arp inspection statistics command, the switch increments the number of forw arded packets for each A RP request and r esponse packet on a t rusted dynamic ARP[...]

25-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 25 Co nfig uring Dynamic ARP Inspection Displayi n g Dynamic AR P Inspection Information[...]

CH A P T E R 26-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 26 Configuring IGMP Snooping and MVR This chapter describes ho w to conf igure Internet Group Management Protocol (IGMP) snoopin g on th e Catalyst 37 50-X or 3560-X switch, including an application of lo cal IGMP snooping, Multicast VLAN Re gistration (MVR[...]

26-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Understanding IGMP Snooping Understanding IGMP Snooping Layer 2 switches can use IGMP snooping to constrain th e flooding of multicast traf fic by d ynamically configuring Laye r 2 interfaces so th at multicast traf fic is [...]

26-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Understanding IGMP Snooping IGMP Versions The switch supports IGMP V ersion 1, IGMP V ersion 2, and IGMP V ersion 3. These versions are interoperable on the switch. F or example, i f IGMP snooping is enabled on an IGMPv2 swit[...]

26-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Understanding IGMP Snooping The switch hardware can d istinguish IGMP information pack ets from other packets for th e multicast group. The information in the table tell s the switching engine to send frames addressed to th[...]

26-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Understanding IGMP Snooping Immediate Leave Immediate Leav e is only supported on IGMP V ersion 2 hosts. The switch uses IGMP snooping Imme diate Leav e to remo v e from the forw arding table an inte rface that sends a leav e[...]

26-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Configuring IGMP Snooping IGMP Snooping and Switch Stacks IGMP snooping functions acro ss the switch stack; that is, I GMP control information from one swi tch is distribu ted to all switches in the stack. (S ee Chapter 5, [...]

26-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Configuring IGMP Snooping Enabling or Disabling IGMP Snooping By default, IGMP sno oping is globally enabled on the switch. When globally en abled or disabled, it is also enabled or disabled in all ex isting VLAN interf aces.[...]

26-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Configuring IGMP Snooping Y ou can configure the switch either to snoop on IG MP queries and PIM/D V MRP packets or to liste n to CGMP self-join or proxy-jo in packets. By def ault, the switch snoops on PIM/D VMRP packets o[...]

26-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Configuring IGMP Snooping Beginning in pri vileged EXEC mode, follow these steps to enable a static connection to a mult icast router: T o remov e a multicast router port fr om the VLAN, use the no ip i gmp snooping vlan vlan[...]

26-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Configuring IGMP Snooping This example sh ows ho w to statically configure a host on a port: Switch# configure terminal Switch(config)# ip igmp snooping vlan 105 static 224.2.4.12 interface gigabitethern et1/0/1 Switch(con[...]

26-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Configuring IGMP Snooping Beginni ng in pri vileged EXEC mode, follo w these steps to enable the I GMP configu rable-leav e timer: T o globally reset the IGMP lea ve timer to the def ault setting, use t he no ip igmp snoopin[...]

26-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Configuring IGMP Snooping T o return to the defau lt flooding query co unt, use th e no ip igmp snooping tcn flood query count global confi guration command. Recovering from Flood Mode When a topology change occ urs, th e [...]

26-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Configuring IGMP Snooping T o re-enable multicast flooding on an interf ace, use the ip igmp snoopi ng tcn flood interface confi guration command. Configuring the IGMP Snooping Querier Follo w these guidelines when conf igur[...]

26-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Configuring IGMP Snooping This exampl e sho ws how to set the IGMP snooping querier source address to 10 .0.0.64: Switch# configure terminal Switch(config)# ip igmp snooping querier 10.0.0.64 Switch(config)# end This examp[...]

26-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Displaying IGMP Snooping Information Beginning in pri vileged EXEC mode, follow these steps to disable IGMP report suppression: T o re-enable IGMP report suppression, use the ip i gmp snooping r eport-suppression global conf[...]

26-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Understanding Multicast VLAN Registration For more inf ormation about the ke ywords and o ptions in these commands, see the command reference for this release. Understanding Multicast VLAN Registration Multicast VLAN Regis[...]

26-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Understanding Multicast VLAN Registration Y ou can set the switch for compatible o r dynamic mode of MVR operation: • In compatible mode, multicast data recei ved by MVR host s is forwarded to all MVR data po rts, regar dl[...]

26-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Understanding Multicast VLAN Registration Figur e 26-3 Multicas t VLAN Registra ti on Example When a subscriber changes channels or t urns of f the television, the set-top box send s an IGMP leave message for the multicast[...]

26-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Configuri ng MVR Layer 3 de vice. The access layer switch, Sw itch A, modifi es the forwarding behavior to allo w the traffi c to be forwarded from th e multicast VLAN to the subscriber port in a di f ferent VLAN, selectivel[...]

26-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Configuring MVR • MVR can coe xist with IGMP snooping on a sw itch. • MVR data receiv e d on an MVR receiv er port is no t forwarded to MVR source ports . • MVR does not support IGMPv3 messages. Configuring MVR Globa[...]

26-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Configuri ng MVR This exampl e sho ws how to enable MVR, conf igure the group address, set the q uery time to 1 second (10 tenths), specify the MVR multi cast VLAN as VLAN 22, and set the MVR mode as d ynamic: Switch(config)[...]

26-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Displaying MVR Information T o return the interface to its de fault settings, use the no mvr [ type | immed iate | vlan vlan-id | group ] interface configuration commands. This example sho ws how to conf igure a port a s a[...]

26-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Configuring IGMP Filtering and Throttling Configuring IGMP Filtering and Throttling In some en vironments, for e xample, metropolitan or multiple-dwelling un it (MDU) installations, yo u might want t o control the set of mul[...]

26-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Configuring IGMP F iltering a nd Throttling When the maximum number of groups is in forw arding table, the def ault IGMP throttling action is to deny the IGMP report. For conf iguration guidelines, see the “Conf iguring [...]

26-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Configuring IGMP Filtering and Throttling This example sho ws how to cr eate IGMP profile 4 allowin g access to the single IP m ulticast address and ho w to verify the conf iguration. If the action wa s to deny (th e default[...]

26-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Configuring IGMP F iltering a nd Throttling Setting the Maximum Number of IGMP Groups Y ou can set t he maximum number of I GMP groups th at a Layer 2 interface can j oin by using the ip igmp max-gr oups interface conf igu[...]

26-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Configuring IGMP Snooping and MVR Configuring IGMP Filtering and Throttling • If you conf igure the throttling action and set th e maximum group limit ation after an interface has added multicast entries to t he forwarding tabl e, th e forwarding-table ent[...]

26-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 26 Config ur ing IGMP Snooping and MVR Displaying IGMP Filtering and Throttling Co nfiguration Displaying IGMP Filtering and Throttling Configuration Y ou can display IGMP prof ile characteristics, and you can display the IGMP pro file and maximu m group confi [...]

CH A P T E R 27-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 27 Configuring IPv6 MLD Snooping Y ou can use Mul ticast Listener Discov ery (MLD) snooping to en able ef ficient distri buti on of IP Ve r s i o n 6 (IPv6) multicast data to clients and rout ers i n a swit ched network on the Cataly st 3750-X or 3560-X swi[...]

27-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 M LD Snooping Understanding MLD Snooping MLD is a p rotocol used b y IPv6 multicast routers to discov er the presence of multicast listeners (nodes wishing to recei ve IPv6 multicast pack ets) on the links that are directly attach ed to the r[...]

27-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 MLD Snooping Understanding MLD Sno oping MLD Messages MLDv1 supports three types of messages: • Listener Que ries are the e qui v alent of IGMPv2 qu eries and ar e either Gene ral Queries or Multicast-Address-Specific Queries (MASQs). • M[...]

27-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 M LD Snooping Understanding MLD Snooping Multicast Router Discovery Like IGMP snoop ing, MLD snooping per forms multic ast route r disco very , with these ch aracteristic s: • Ports conf igured by a user ne ver ag e out. • Dynamic port le[...]

27-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 MLD Snooping Configuring IPv6 MLD Snooping The number of MASQ s generated is con f igured by using the ipv6 mld snooping last-listener -query count global conf iguration command. The d efault number i s 2. The MASQ is sent to the IPv6 mu ltic[...]

27-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 M LD Snooping Configuring IPv6 MLD Snooping Default MLD Snooping Configuration MLD Snooping Configuration Guidelines When config uring MLD snooping, consider these guidelines: • Y ou can confi gure MLD snooping characteristics at an y time,[...]

27-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 MLD Snooping Configuring IPv6 MLD Snooping Enabling or Disabling MLD Snooping By default, IPv 6 MLD snooping is glo bally disabled on the sw itch and enabled on all VLANs. When MLD snooping is globall y disabled, it is also disa bl ed on all [...]

27-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 M LD Snooping Configuring IPv6 MLD Snooping Configuring a Static Multicast Group Hosts or Layer 2 p orts normally join mu lticast groups dynamicall y , but you can also st atically conf igure an IPv6 multicast address an d member ports for a [...]

27-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 MLD Snooping Configuring IPv6 MLD Snooping Beginning in pri vileged EXEC mode, follow these st eps to add a multicast router port to a VLAN: T o remov e a multicast r outer port fro m the VLAN, use the no ipv6 m ld snooping vlan vlan-id mrout[...]

27-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 M LD Snooping Configuring IPv6 MLD Snooping Configuring MLD Snooping Queries When Immediate Leav e is not enabled and a port recei ves an MLD Done message, the switch generates MASQs on the po rt and sends th em to the IPv6 mult icast addres[...]

27-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 MLD Snooping Configuring IPv6 MLD Snooping This example sho ws how to set the MLD sn ooping g lobal robu stness vari able to 3: Switch# configure terminal Switch(config)# ipv6 mld snooping robustness-variable 3 Switch(config)# exit This exam[...]

27-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 27 Configuring IPv6 M LD Snooping Displayi ng MLD Sn ooping Information T o re-enable MLD message suppression, us e the ipv6 mld snooping liste ner -message-suppression global conf iguration command. Displaying MLD Snooping Information Y ou can display MLD snoo[...]

CH A P T E R 28-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 28 Configuring Port-Based Traffic Control This chapter describe s ho w to configure the port -ba sed traf fic control features on the Catalyst 3750-X or 3560-X switch. Unless otherwise noted, t he term switch refers to a Catalyst 3750-X or 3560-X stand alon[...]

28-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Storm Control Storm control uses one of these metho ds to measure traf fic acti vity: • Bandwidth as a percentage of the tot al av ailable bandwidth of the port that can be used by the broadcast, multicast[...]

28-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Conf iguring Storm Control Note Because packets do not arri ve at uniform interv als, the 1-second time interv al during which traf fic activity is measured can af fect the behavior o f storm control. Y ou use the storm[...]

28-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Storm Control Step 3 storm-control { broadcast | multicast | unicast } level { level [ l evel-low ] | bps bps [ bps-low ] | pps pps [ pps-l ow ]} Conf igure broadcast, multicast, or unicast storm control . B[...]

28-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Conf iguring Storm Control T o disable storm control, use the no storm-con trol { br oadcast | multicast | unicast } le vel interface confi guration command. This exampl e sho ws how to enable unicast storm control on a[...]

28-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Protecte d Ports This example shows ho w to enable t he small-frame arri v al-rate feature, configure the por t recovery ti me, and conf igure the threshold for error disabling a port: Switch# configure term[...]

28-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Blocking Protected Port Configuration Guidelines Y ou can confi gure protected por ts on a physical interf ace (for e xample, Gigabit Ethernet po rt 1) or an EtherChann el group (for e xample, p ort-cha[...]

28-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security Default Port Blocking Configuration The default is t o not block flooding of unkno wn multicast and unicast traf fic out of a port, b ut to flood these packets to all ports. Blocking Flooded Tr[...]

28-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security If a port is configured as a secu re port and the maximum number of secure MAC addresses is reached, when the MA C address of a station attempting to access the port is di fferent from any of t[...]

28-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security If stick y learning is disabled, th e stick y secu re MA C addre sses are con verted to dynamic secure addresses and are removed fro m the ru nning conf iguration. The maximum number of secure[...]

28-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security Default Port Security Configuration Port Security Configuration Guidelines • Port security can only be configur ed on static a ccess ports or trunk ports. A secure port cannot be a dynamic a[...]

28-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security VLAN, but is not learned on the access VLAN. If you connect a single PC t o the Cisco IP phone, no additional MA C addresses are required. If y ou co nnect more than one PC to the Cisco IP pho[...]

28-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security Enabling and Configuring Port Security Beginning in priv ileged EXEC mode, follo w these steps to restrict input to an interf ace by limiting and identifying MA C addresses of the stat ions al[...]

28-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security Step 7 switchport port-security violation { protect | r estrict | shutdown | shutdown vlan } (Optional) Set the vi olation mode, the act ion to be taken wh en a security violation is detected,[...]

28-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security Step 8 switchport port-secur ity [ mac-address mac- addr ess [ vla n { vlan-id | { access | voice }}] (Optional) Enter a secure MAC address for the interf ace. Y ou can use this command to ent[...]

28-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security T o return the interf ace to the def ault condition as no t a secu re port, use the no switchport port-security interface conf iguration command. If you enter t his comm and when stick y learn[...]

28-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security Switch(config-if)# switchport port-security mac-address 0000.0000.0003 Switch(config-if)# switchport port -security mac-address sticky 0000.0000.0001 vlan voice Switch(config-if)# switchport p[...]

28-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Configuring Port Security T o disable port security aging for all secure addr esses on a port, use the no switchport port-security aging time interface conf iguration command. T o disable aging for only staticall y con[...]

28-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Displaying Po rt-Based Tr affic Contro l Settings This exampl e sho ws how to conf igure port security on a PVLAN host and promi scuous ports Switch(config)# interface gigabitethernet 0/8 Switch(config-if)# switchport [...]

28-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 28 Configuri ng Port-Based Traffic Control Displaying Port-Based Traffic Control Settings[...]

CH A P T E R 29-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 29 Configuring CDP This chapter describes ho w to configure Cisco Disco very Protocol (CDP) on the Catalyst 375 0-X or 3560-X switch. Unless otherwis e noted, the term switch refers to a Catalyst 3750- X or 3560-X stand alone switch and to a Cataly st 3750-[...]

29-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 29 Configur ing CDP Configuring CDP CDP and Switch Stacks A switch stack appears as a single switch in the ne twork. Therefore, CDP discove rs the switch stac k, not the individual stack members. Th e switch stack sends CDP messages t o neighboring netw ork de v[...]

29-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 29 Configuring CDP Configuring CDP Use the no form of the CDP commands to return to the def ault settings. This example sh ows ho w to configure CDP ch aracteristics. Switch# configure terminal Switch(config)# cdp timer 50 Switch(config)# cdp holdtime 120 Switch[...]

29-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 29 Configur ing CDP Configuring CDP Disabling and Enabling CDP on an Interface CDP is enabled by d efault on all supported i nterfaces to send and to recei ve CDP information. Beginning in pri vileged EXEC mod e, follo w these steps to disable CDP on a port: Beg[...]

29-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 29 Configuring CDP Monitori ng and Maintaining CDP Monitoring and Maintaining CDP Ta b l e 29-2 Commands f or Displa ying CDP Inf o r mation Command Description clear cdp counters Reset the traff ic counters to zero. clear cdp table Delete the CDP table o f info[...]

29-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 29 Configur ing CDP Monitoring and Maintaining CDP[...]

CH A P T E R 30-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 30 Configuring LLDP, LLDP-MED, and Wired Location Service This chapter describe s ho w to configure the Link Layer D iscov ery Protocol (LLDP), LL DP Media Endpoint Discovery (LLDP-MED) and wi red location servic e on the Ca ta lyst 3750-X or 3560-X swi tch[...]

30-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Co nfiguring LLDP , LLDP-MED, and Wired Location Service Understanding LLDP, LLDP-MED, and Wired Location Service LLDP supports a set of attrib utes that it uses to discov er neighbor de vices. T he se a ttr ib ut es con ta in t yp e, length, and v alue descr[...]

30-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Configuring LLDP, LLDP- M ED , and Wired Location Servic e Understanding LLDP, LLDP-MED, and Wired Location Service LLDP-MED also support s an ext ended pow er TL V to advertise f ine-grained power requi rements, end-point po wer priority , and end-point and [...]

30-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Co nfiguring LLDP , LLDP-MED, and Wired Location Service Understanding LLDP, LLDP-MED, and Wired Location Service Depending on the d evice cap abilities, the switch obtains this client infor mation at link up: • Slot and port specified in port connection ?[...]

30-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Configuring LLDP, LLDP- M ED , and Wired Location Servic e Configuri ng LLDP, LLDP-MED, and Wired Location Service Configuring LLDP, LLDP-MED, and Wired Location Service • Default LLDP Conf iguration, page 30-5 • Config uration Guidelines, pa ge 30-5 • [...]

30-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Co nfiguring LLDP , LLDP-MED, and Wired Location Service Configuring LLDP, LLD P -ME D, and Wired Location Service Enabling LLDP Beginning in pri vileged EXEC mode, foll ow th ese steps to enable LLDP: T o disable LLDP , us e the no ll dp run gl obal configur[...]

30-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Configuring LLDP, LLDP- M ED , and Wired Location Servic e Configuri ng LLDP, LLDP-MED, and Wired Location Service Use the no form of each of the LLDP commands to return to the defaul t setting. This exampl e sho ws how to conf igure LL DP characteristics. Sw[...]

30-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Co nfiguring LLDP , LLDP-MED, and Wired Location Service Configuring LLDP, LLD P -ME D, and Wired Location Service This example sho ws how to enable a TL V on an interface: Switch# configure terminal Switch(config)# interface interfa ce_id Switch(config-if)# [...]

30-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Configuring LLDP, LLDP- M ED , and Wired Location Servic e Configuri ng LLDP, LLDP-MED, and Wired Location Service Use the no form of each command to return to the def ault setting. This exampl e sho ws how to conf igure VLAN 100 fo r v oice application with [...]

30-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Co nfiguring LLDP , LLDP-MED, and Wired Location Service Configuring LLDP, LLD P -ME D, and Wired Location Service Use the no form of each command to return to the default set ting. This exampl e sho ws how to conf igure ci vic location infor mation on the s[...]

30-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Configuring LLDP, LLDP- M ED , and Wired Location Servic e Monitoring and Main taining LLDP, LLDP-MED, and W ired Location Service This exampl e sho ws how to enable NMSP on a switch an d to set the locatio n notif ication time to 10 seconds: Switch(config)#[...]

30-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 30 Co nfiguring LLDP , LLDP-MED, and Wired Location Service Monitoring and Main taining LLDP, LLDP-MED , and Wired Lo cation Service[...]

CH A P T E R 31-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 31 Configuring UDLD This chapter describe s ho w to configure the UniDirec tional Link Detectio n (UDLD) protoc ol on the Catalyst 37 50-X or 3560-X switch. U nless otherwise note d, the term sw itch refers to a Catalyst 3750-X or 3560-X standalone switch a[...]

31-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 31 Configuring UDLD Understanding UDLD A unidirectional link occurs whene ver traf fi c sent by a local device is rece iv ed by its neighbor b ut traff ic from the neighbor is not receiv ed by the local de vice. In normal mode, UDLD detect s a unidirectional lin[...]

31-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 31 Configuring UDLD Understanding UDLD • Event-dri ven detectio n and echoing UDLD relies on echoing as i ts detection mechan ism. W hene ver a U DLD device learns about a new neighbor or recei ves a resynchronization request from an out- of-sync neighbor , it[...]

31-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 31 Configuring UDLD Configuring UDLD Configuring UDLD • Default UD LD Config uration, page 31-4 • Config uration Guidelines, page 31- 4 • Enabling UDLD G lobally , page 31-5 • Enabling UDLD on an Interface, page 31-6 • Resetting an Interface Disabled b[...]

31-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 31 Configuring UDLD Configuri ng UDLD Enabling UDLD Globally Beginning in pri vileged EXEC mode, follow these steps to enable UDLD in the aggressi ve or normal mode and to set the con figur able message timer on all f iber-optic ports on th e switch and all memb[...]

31-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 31 Configuring UDLD Configuring UDLD Enabling UDLD on an Interface Beginning in pri vileged EXEC mode, foll ow th ese st eps either to enable UDLD in the aggressi ve or normal mode or to disable UDLD on a por t: Resetting an Interface Disabled by UDLD Beginning [...]

31-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 31 Configuring UDLD Displaying UDLD Status Displaying UDLD Status T o display the UDLD status for th e specif ied port or for all ports, use the show udld [ interface-id ] pri vileged EXEC command. For detailed i nformation about the fi elds in the command outpu[...]

31-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 31 Configuring UDLD Displayi ng UDLD Sta tus[...]

CH A P T E R 32-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 32 Configuring SPAN and RSPAN This chapte r describes ho w to configu re Switched Port Analyzer (SP AN) and Remote SP AN (RSP AN) on the Catalyst 3750-X or 3 560-X switch. Unle ss otherwise noted, the t erm sw itch refers to a Catalyst 3750-X or 3560-X stan[...]

32-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Understanding SPAN and RSPAN These sections contain this conceptual information: • Local SP AN , page 32-2 • Remote SP AN, page 32 -3 • SP A N and RSP AN Conce pts and T erminology , page 32-4 • SP AN and RSP AN Interaction [...]

32-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Understanding SPAN and RSPAN Figure 32-2 is an ex ample of a local SP AN in a switch stack, where the source and destination ports reside on different stack members. Figur e 32-2 Example of Local SP AN Configuration on a Switc h Sta[...]

32-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Understanding SPAN and RSPAN Figur e 32-3 Example of RSP AN Config uration SPAN and RSPAN C oncepts and Terminology • SP AN Sessions, page 32-4 • Monitored T raf fi c, page 32-6 • Source Ports, page 32-7 • Source VLANs, page[...]

32-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Understanding SPAN and RSPAN RSP AN consists of at least one RSP AN source se ssion, an RSP AN VLAN, and at least one RSP AN destination session. Y ou separately configure RSP A N s ource sessions and RSP AN destination sessions on [...]

32-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Understanding SPAN and RSPAN Monitored Traffic SP AN sessions can monitor these traff ic types: • Receiv e (Rx) SP AN—The goal of recei ve (or ingress) SP AN is to monitor as much as possible all the packets recei ved by the sou[...]

32-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Understanding SPAN and RSPAN Source Ports A source port (also called a monitor ed port ) is a switched or routed port that you monitor for network traf fic analysis. In a local SP AN session or RSP AN source session, you can monitor[...]

32-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Understanding SPAN and RSPAN • When a VLAN filt er list is specif ied, only those VLANs in the list are monito red on trunk ports or on voice VLAN access ports. • SP AN traff ic coming from other port types is no t affect ed by [...]

32-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Understanding SPAN and RSPAN Local SP AN and RSP AN destination ports beha ve dif ferently re garding VLAN tagging and encapsulation: • For local SP AN, if the encapsulation replicate k eywords are specif ied for the destination p[...]

32-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Understanding SPAN and RSPAN • VLAN and trunking—Y ou can modify VLAN membership or trunk settings for so urce or destination ports at an y time. Howev er, changes in VLAN membership or trunk settings for a destination port do [...]

32-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Underst anding Flow- Based SPAN Understanding Flow-Based SPAN Y ou can control the type of netw ork traf fic to be mon itored in SP AN or RSP AN sessions by using flow-based SP AN (FSP AN) or flo w-based RSP AN (FR SP AN), w hich a[...]

32-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN Configuring SPAN and RSPAN • Default SP AN and RSP AN Configurat ion, page 32-12 • Config uring Local SP AN, page 32-12 • Config uring RSP AN, page 32-17 Default SPAN and RSPAN Configuration Configu[...]

32-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN • For local SP AN, outgoing packets throu gh the SP AN destination port carry the o riginal encapsulation he aders—untagged, ISL, or IEEE 802.1Q—if the encapsulation replicate keyw ords are specifie[...]

32-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN T o dele te a SP AN se ssion, use the no monitor session session_number global conf iguration command. T o remove a sou rce or destination port or VLAN from the SP AN session, use the no monitor session s[...]

32-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN This exampl e sho ws how to remov e any e xisting conf iguration on SP AN session 2, conf igure SP AN session 2 to monito r receiv ed traff ic on all ports belonging to VLANs 1 thro ugh 3, and send it to [...]

32-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN T o dele te a SP AN se ssion, use the no monitor session session_number global conf iguration command. T o remove a sou rce or destination port or VLAN from the SP AN session, use the no monitor session s[...]

32-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN T o monitor all VLANs on the trunk port, use the no monitor session session_n umber fi lt er globa l confi guration command. This exampl e sho ws how to remov e any e xisting conf iguration on SP AN sessi[...]

32-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN • For RSP AN configuration, you can distrib ute the source ports and the destination p orts across multiple switches in you r network. • RSP AN does not suppo rt BPDU packet monito ring or other Layer[...]

32-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN This exampl e sho ws how to create RSP AN VLAN 901. Switch(config)# vlan 901 Switch(config-vlan)# remote span Switch(config-vlan)# end Creating an RSPAN Source Session Beginni ng in p rivile ged EXEC mod [...]

32-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN T o delete a SP AN session, use the no monitor session session_number glob al configurati on command. T o remove a source port or VLAN from the SP AN session, use the no monitor session session_number sou[...]

32-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN T o monitor all VLANs on th e trunk port, use the no monitor session session_number f ilter vlan global confi guration command. This exampl e show s ho w to remov e any existin g configur ation on RSP AN [...]

32-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN T o dele te a SP AN se ssion, use the no monitor session session_number global conf iguration command. T o remove a desti nation port from the SP AN session, use the no monitor session session_number dest[...]

32-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring SPAN and RSPAN T o delete an RSP AN session, use the no monitor session session_number g lobal conf iguration command. T o remov e a destination port from the RSP AN session, use the no monitor session session_number de[...]

32-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring FSPAN and FRSPAN Configuring FSPAN and FRSPAN • FSP AN and FRSP AN Configuratio n Guidelines, page 32-24 • Config uring an FSP AN Session, page 32-25 • Config uring an FRSP AN Session, page 32-26 FSPAN and FRSPAN [...]

32-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring FSPAN and FRSPAN Configuring an FSPAN Session Beginning in pri vileged EXEC mode, follow these st eps to create a SP AN session, s pecify the source (monitored) ports or VLANs and the destin ation (monitoring) ports, an[...]

32-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring FSPAN and FRSPAN Configuring an FRSPAN Session Beginning in pri vileged EXEC mode, foll ow th ese st eps to start an RSP AN so urce session, specify the monitored source and th e destination RSP AN VLAN, and conf igure [...]

32-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Configuring FSPAN and FRSPAN Step 3 monitor session session_number source { interface interface-id | vlan vlan-id } [, | -] [ both | rx | tx ] Specify the RSP A N sessi on and the so urce port (monitored port). For sessi on_number [...]

32-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 32 Configuring SPAN and RSPAN Displaying SPAN, RSPAN. FSPAN, and FRSPAN Status Displaying SPAN, RSPAN. FSPAN, and FRSPAN Status T o display the current SP AN, RSP AN, FSP AN, or FRSP AN configuration, use th e show monitor user EXEC command. Y ou can also use t[...]

CH A P T E R 33-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 33 Configuring RMON This chapter describes ho w to configu re Remo te Netw ork Monitoring ( RMON) on the Catalyst 37 50-X or 3560-X switch. Unless other wise noted, the term switch refers to a Catalyst 3750-X or 3560-X stand alone switch and to a Catalyst 3[...]

33-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 33 Configuring RMON Configuring RMON Figur e 33-1 Remot e Monitor ing Example The switch supports these RMON groups (defined in RFC 1757): • Statistics (RMON gro up 1)—Collects Ethern et statistics (includin g Fast Ethernet and Gigabit Ethernet statistics, d[...]

33-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 33 Configuring RMON Configuri ng RMON • Collecting Group Ethernet Sta tistics on an Interface, page 33-5 (optional) Default RMON Configuration RMON is disabled by def a ult; no alar ms or e vents are conf igured. Configuring RMON Alarms and Events Y ou can con[...]

33-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 33 Configuring RMON Configuring RMON T o disable an alarm, use the no rmon alarm number global configuration command on each alarm you confi gured. Y ou cannot disable at on ce all the alarms that you conf igured. T o disable an e vent, use th e no rmon ev ent n[...]

33-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 33 Configuring RMON Configuri ng RMON Collecting Group History Statistics on an Interface Y ou must f irst conf igure RMON alarms and ev ents to display collection information . Beginni ng in pri vileged EXEC mode, follo w these steps to collect group h istory s[...]

33-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 33 Configuring RMON Displaying RMON Status T o disable the collection of grou p Ethernet statistics, use the no rmo n collection stats inde x inte rface confi guration command. This example sh ows ho w to collect RMON statistics for the o wner ro o t : Switch(co[...]

CH A P T E R 34-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 34 Configuring System Message Logging This chapter describe s ho w to configur e system message logging on the Cata lyst 3750-X or 35 60-X switch. Unless otherwise not ed, the term switc h refers to a Catalyst 3750-X or 3560-X stan dalone switch and to a Ca[...]

34-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Config ur ing System Message Logging Configuring System Message Logging Y ou can set the se verity le vel of the messages to cont rol the type of messages disp layed on the cons oles and each of the destinations. Y ou can time-stamp log messages or set the sy[...]

34-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Configuring System Messag e Logging Configuring System Message Logging This example sho w s a partial switch system message for a stack master and a stack member (hostname Switch-2 ): 00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up 00:0[...]

34-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Config ur ing System Message Logging Configuring System Message Logging This example sh ows a p artial switch system message on a Catalyst 3560-X switch: 00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up 00:00:47: %LINK-3-UPDOWN: Interfac[...]

34-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Configuring System Messag e Logging Configuring System Message Logging Disabling the lo gging process can sl ow do wn the switch because a pr ocess must wait until t he messages are written to the c onsole before co ntinuing. When the logging process is disab[...]

34-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Config ur ing System Message Logging Configuring System Message Logging The logging buffer ed global configurati on command copies loggin g messages to an internal b uffer . The buf fer is circular , so newer messages o verwrite ol de r messages afte r the bu[...]

34-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Configuring System Messag e Logging Configuring System Message Logging Beginning in pri vileged EXEC mod e, follo w these steps to conf igure synchronous logging. This procedure is optional . T o disable synchronization of unsolic ited messag es an d debug ou[...]

34-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Config ur ing System Message Logging Configuring System Message Logging Enabling and Disabling Time Stamps on Log Messages By default, log messag es are not time-stamped. Beginni ng in pri vileged EXEC mode, follo w these steps to en able time-stamping of log[...]

34-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Configuring System Messag e Logging Configuring System Message Logging T o disable sequence numbe rs, use the no service sequence-numbers global conf iguration command. This example sh ows part o f a logging di splay with sequenc e numbers enabled: 000019: %S[...]

34-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Config ur ing System Message Logging Configuring System Message Logging Ta b l e 34-3 describes the level ke ywords. It also lists the corresponding UNIX syslo g definitions fro m the most se vere le vel to the least se vere lev el. The software generates fo[...]

34-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Configuring System Messag e Logging Configuring System Message Logging Beginning in pri vileged EXEC mod e, follo w these steps to change the le vel and history table size defaults. This p rocedure is option al. When the history table is fu ll (it contains t[...]

34-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Config ur ing System Message Logging Configuring System Message Logging Beginning in pri vileged EXEC mod e, follo w these steps to enable conf iguration logging: This exampl e sho ws how to enable the conf iguration-change logger and t o set the number of e[...]

34-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Configuring System Messag e Logging Configuring System Message Logging Log in as root, and perform these steps: Note Some recent versio ns of UNIX syslog daemons no lo nger accept by default syslog packets from the network. If this is t he case with your sys[...]

34-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 34 Config ur ing System Message Logging Displaying the Logging Configuration T o remove a syslog serv er , use the no logging host global conf iguration comman d, and specify the syslog server IP address. T o disable logg ing to syslog servers, enter the no log[...]

CH A P T E R 35-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 35 Configuring SNMP This chapter describe s ho w to configure the Simp le Network Management Protocol (SNMP) on the Catalyst 37 50-X or 3560-X switch. U nless otherwise note d, the term sw itch refers to a Catalyst 3750-X or 3560-X standalone switch and to [...]

35-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Understanding SNMP These sections contain this conceptual information: • SNMP V ersions, page 35-2 • SNMP Manager Functions, page 35-3 • SNMP Agent Functions, p age 35-4 • SNMP Community Strings, page 35 -4 • Using SNMP to Access [...]

35-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configuring SNMP Understanding SNMP Ta b l e 35-1 identif ies the characteristics of the different combin ations of security models and le vels. Y ou must confi gure the SNMP agent to use the SNMP v e rsion supp orted by the manag ement station. Be cause an a[...]

35-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Understanding SNMP SNMP Agent Functions The SNMP agent responds to SNMP manager requests as follo ws: • Get a MIB v ariable—T he SNMP agen t begins this func tion in response to a request fr om the NMS . The agent retrie ves the v alue [...]

35-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configuring SNMP Understanding SNMP Figur e 35-1 SNMP Networ k For information on supported MIBs and ho w to access them, see Appendix A, “Supported MIBs. ” SNMP Notifications SNMP allows the switch to send notifications to SN MP managers when particular [...]

35-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Configuring SNMP Note The switch might not use sequen tial v alues with in a range. Configuring SNMP • Default SNMP Conf iguration, page 35-6 • SNMP Configurat ion Guidelin es, page 35-7 • Disabling th e SNMP Agent, page 35 -7 • Con[...]

35-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configuring SNMP Configuring SNMP SNMP Configuration Guidelines If the switch starts an d the switch st artup conf iguration ha s at least one snmp-server global configuration command, the SNMP agent is enabled. An SNMP gr oup is a table that maps SNMP users [...]

35-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Configuring SNMP Configuring Community Strings Y ou use the SNMP community string to def ine th e relationship between the SNMP manager and the agent. The community string acts lik e a p assword to permit access to the agent on the switch. [...]

35-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configuring SNMP Configuring SNMP Note T o disable access for an SNMP community , set the community strin g for that community to the null string (do not enter a v alue for the community string). T o remov e a specific commu nity string, use t he no snmp-serv[...]

35-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Configuring SNMP Beginning in pri vileged EXEC mod e, follo w th ese steps to configure SNMP on the switch: Command Purpose Step 1 conf igure terminal Enter global conf iguration mod e. Step 2 snmp-server engineID { local engineid-string |[...]

35-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configuring SNMP Configuring SNMP Step 4 snmp-server user username gr oupname { remote host [ udp-port port ]} { v1 [ access access-list ] | v2c [ access access-list ] | v3 [ encrypted ] [ access access-list ] [ auth { md5 | sha } auth-passwo r d ]} [ priv {[...]

35-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Configuring SNMP Configuring SNMP Notifications A trap manager is a management station that receives and processes traps. T rap s are system alerts that the switch generates when certain e vents occur . By de fault, no trap manager is def [...]

35-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configuring SNMP Configuring SNMP Note Though visible in the command- line help strings, the fru-ctrl , inserti on , and rem ova l ke ywords are not supported on the356 0-X switch. T o enable the sending of SNMP inform notif ications, use the snmp-server ena[...]

35-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Configuring SNMP Beginning in pri v ile ged EXEC mode, follo w these steps to confi gure the switch to send traps or informs to a host: Command Purpose Step 1 configure terminal Enter global configurati on mode. Step 2 snmp-server engineID[...]

35-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configuring SNMP Configuring SNMP The snmp-server host command specif ies which hosts receiv e the notificat ions. The snmp-server enable trap command globally enables the mechanism for the specif ied notification (for traps and informs). T o enable a ho st [...]

35-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Configuring SNMP Setting the CPU Threshold Notification Types and Values Beginni ng in pri vileged EXEC mode, follo w these steps to set the CPU threshold notif ication types and va lu e s : Setting the Agent Contact and Location Informati[...]

35-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configuring SNMP Configuring SNMP Limiting TFTP Servers Used Through SNMP Beginning in pri vileged EXEC mode, follow these steps to limit the TFTP servers used f or saving an d loading configuratio n files through SNMP to the servers specif ied in an access [...]

35-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Configuring SNMP SNMP Examples This examp le shows h ow to enable all v ersions of SNMP . The con fi guration permits an y SNMP manager to access all objects with read-only permissions using the community string public . This conf iguratio[...]

35-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configuring SNMP Displaying SNMP Status Displaying SNMP Status T o display SNMP input an d output statisti cs, including the number of illegal comm unity string entries, errors, and requested v ariables, use the show snmp pri v ileged EXEC command. Y ou also[...]

35-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 35 Configur in g SNMP Displaying SNMP Status[...]

CH A P T E R 36-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 36 Configuring Embedded Event Manager Embedded Event Manager (EEM) is a dist ributed an d customized approach to e vent detecti on and recov ery within a Cisco IOS de vice. EEM offers the ability to monitor e vents and take informational, correcti ve, or an[...]

36-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 36 Configuring Embedded Event Manager Understanding Embedd ed Even t Manager because some problems compromise communicati on bet ween the switch and the e x ternal netw ork management de vice. Network av ailability is improv ed if automatic recovery actions are [...]

36-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 36 Configuring Embedded Event Manage r Understanding Embedd ed Event Manager Event Detectors EEM software progr ams kno wn as e vent detecto r s determine when an EEM event occurs. Event detectors are se parate systems that provide an interface betw een the agen[...]

36-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 36 Configuring Embedded Event Manager Understanding Embedd ed Even t Manager • Syslog e vent detector—Allo ws for screening syslog messages for a reg ular expressio n pattern match. The selected messages can be further qu alified, requiri ng that a specifi c[...]

36-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 36 Configuring Embedded Event Manage r Understanding Embedd ed Event Manager Y ou use EEM to writ e and implement your o w n polici es using the EEM po licy to ol command language (TCL) script. When you configure a TCL script on the master switch and the f ile i[...]

36-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 36 Configuring Embedded Event Manager Configuring Embedde d Ev ent Mana ger • Mac-Address-T able—Mac-A ddress-T able ev ent detect or generates an e vent when a MA C address is learned in the MA C address table. Note The Mac-Address-T able e vent detector is[...]

36-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 36 Configuring Embedded Event Manage r Configuring Embedd ed Event Manager This example sho ws the output for EEM when one of th e fields specif i ed b y an SNMP object ID crosses a defined t hreshold: Switch(config-applet)# event snmp oid 1.3.6.1.4.1.9.9.48.1.1[...]

36-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 36 Configuring Embedded Event Manager Displaying Embedded Event Mana ger Information 4 _config_cmd1 interface Ethernet1/0 5 _config_cmd2 no shut Th is exa mp l e sh ows a CRON timer en vironment variable, which is assigned b y the software, to be set to ev ery s[...]

CH A P T E R 37-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 37 Configuring Network Security with ACLs This chapter describe s ho w to configure network security on th e Catalyst 3750-X or 35 60-X switch by using access control li sts (A CLs), which in comma nds and tables are also referred to as access lists.Unless [...]

37-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Understanding ACLs Understanding ACLs Pack et filter ing can h elp limit network traf fic and r estrict network use b y certain users or de vices. ACLs filt er traf fic as it passes thr ough a router or switch and permi[...]

37-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Understanding ACLs • VLAN A CLs or VLAN maps access-control all pack ets (bridg ed and routed). Y ou c an use VLAN maps to fi lter traf fic between d evices in t he same VLA N. VLAN maps are configured to provide acce[...]

37-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Understanding ACLs Figur e 37 -1 Using ACLs to Contr ol T raf fic to a Netw or k When you apply a port A CL to a trunk port , the A CL f ilters traf fic on all VLANs present on the t runk port. When you app ly a port A [...]

37-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Understanding ACLs As with port ACLs, the switch exam ines A CLs associated wi th features configured on a gi ven interface. Howe ver , router ACLs are supported in both directio ns. As packets enter the sw itch on an i[...]

37-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Understanding ACLs Some A CEs do not check Layer 4 i nformation and therefore can be ap plied to all p acket fragments. A CEs that do test Layer 4 i nformation cannot be applied in the st andard manner to mo st of the f[...]

37-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs • If packets must be forw arded b y software for an y reason (for ex ample, not enough hardware resources), the master switch forwards the pa ckets only after applying A CLs on the packets. • I[...]

37-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs Creating Standard and Extended IPv4 ACLs This section describes IP A CLs. An A CL is a sequen tial collection of permit and den y conditions. One by one, the switch t ests pack ets against the cond[...]

37-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs Note In addition to num bered standard and e xtended A CLs , you can also create standard a nd extended named IP A CLs by using the supported numbers. That is , the name of a standard IP A CL can b[...]

37-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs Creating a Numbered Standard ACL Beginning in pri vileged EXEC mod e, follo w th ese steps to create a numbered standard A CL: Use the no ac cess-list access-list-number global conf iguration comm[...]

37-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs The switch always rewrites the order of st andard access lists so that e ntries with host matches and e ntries with matches h aving a don’ t car e mask of 0.0 .0.0 are mov ed to the to p of the [...]

37-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs Beginning in pri vileged EXEC mode, foll ow th ese steps to create an extend ed A CL: Command Purpose Step 1 conf igure terminal Enter gl obal conf iguration mode. Step 2a access-list access-list-[...]

37-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs or access-list access-list-number { deny | permit } pr otocol any any [ precedence pr ecedence ] [ tos tos ] [ fragments ] [ log ] [ log-input ] [ time-range time-r ange-name ] [ dscp dscp ] In ac[...]

37-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs Use the no access-list access-list-number global configuration command to delete the entire a ccess list. Y ou cannot delete indi vidual A CEs from numbered access lists. This exampl e show s how [...]

37-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs After creating a nu mbered extended A CL, you can apply it to terminal lin es (see the “ Applying an IPv4 A CL to a T erminal Line” section on page 37-19 ), to interfaces (see the “ Applying[...]

37-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs Beginning in pri vileged EXEC mode, foll ow th ese steps to create a standard A CL using names: T o remove a named stan dard A CL, use the no ip acces s-list standard name global conf iguration co[...]

37-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs When you are creating standard exte nded AC Ls, remember that, b y defa ult, the end of th e A CL contains an implicit deny statement for ev erything if it did not fin d a match b efore reaching t[...]

37-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs Beginni ng in pri vileged EXEC mode, fo llow these steps to co nfigure a time-range parameter for an A CL: Repeat the steps if yo u hav e multiple items t hat you want in ef fect at dif ferent tim[...]

37-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs This example u ses named A CLs to permit and deny the same traf fic. Switch(config)# ip access-list extended deny_access Switch(config-ext-nacl)# deny tcp any any time-range new_year_day_2006 Swit[...]

37-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs Beginni ng in pri vileged EXEC mode, follo w these steps to restrict incoming and outgoin g connections between a virtual terminal line and the addresses in an A CL: T o remove an A CL from a term[...]

37-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs Beginni ng in pri vileged EXEC mode, follo w th ese steps to control access to an interface: T o remove the specif ied access group, us e the no ip access-group { access-list-number | name } { in [...]

37-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs Hardware and Software Treatment of IP ACLs A CL processing is primarily accompl ished in hardwa re, b ut requires forwarding o f some traf fic flo ws to the CPU for software processing. If the har[...]

37-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs Use one of these workarounds: • Modify the A CL configu ration to use fe wer resources. • Rename the A CL with a name or number that alphanumerically precedes the A CL names or numbers. T o de[...]

37-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs ACLs in a Small Networked Office Figure 37-3 sho ws a small networked of fice en vironment wi th routed Port 2 connected to Server A, containing benef its and other information that all em plo yee[...]

37-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs Extended IP access list 106 10 permit ip any 172.20.128.64 0.0.0.31 Switch(config)# interface gigabite thernet1/0/1 Switch(config-if)# ip access-group 106 in Numbered ACLs In this example, netw or[...]

37-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring IPv4 ACLs Named ACLs This example creates a standard A CL named inte rnet_filter and an extended ACL named marketing_gr oup . The internet_fil ter A CL allows all traf fic from the source address 1.2.3.4. S[...]

37-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring IPv4 ACLs In this example of a numbered A CL, the W inter an d Smith workstations are not allo wed to browse t he web: Switch(config)# access-list 100 remark Do not allow Winter to browse the web Switch(con[...]

37-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Creating Named M AC Ex te nded ACLs This is a an e xample of a log for an extended A CL: 01:24:23:%SEC-6-IPACCESSLOGDP:list ext1 permitted icmp 10.1.1.15 -> 10.1.1.61 (0/0) , 1 packet 01:25:14:%SEC-6-IPACCESSLOGDP:l[...]

37-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Creating Named MAC Extended ACLs Beginning in pri vileged EXEC mod e, follo w thes e steps to create a named MA C extended A CL: Use the no mac access-list extende d name glob al conf iguration command to d elete the e[...]

37-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Creating Named M AC Ex te nded ACLs Applying a MAC ACL to a Layer 2 Interface After you create a MA C A CL, you can apply it to a La yer 2 interface to f ilter non-IP traf fic coming in that interface. When you apply t[...]

37-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring VLAN Maps Configuring VLAN Maps Note VLAN maps are not supported on switches runn ing the LAN base feature set. This section descri bes ho w to conf igure VLAN maps, which is the only w ay to control f ilte[...]

37-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring VLAN Maps • If the VLAN map has at least one match clause for the type of pack et (IP or MA C) and the packet does not ma tch any of these match c lauses, the default is t o drop the packet. If the re is [...]

37-33 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring VLAN Maps Use the no vlan access-map name global configu ration command to delete a map. Use the no vlan access-map name number global conf iguration command to d elete a sing le sequence entry from withi n[...]

37-34 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring VLAN Maps Example 2 In this e xample, the VLAN map has a def a ult action of drop for IP pack ets and a d efault action of forward for MA C packets. Used with standard A CL 101 and extended named access lis[...]

37-35 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Configuring VLAN Maps Example 4 In this example, the VLAN map has a default action of drop for all packets (IP and non-IP). U sed with access lists tcp-match and good-hosts from Examples 2 and 3, the map will h av e th[...]

37-36 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Configuring VLAN Maps Figur e 37 -4 Wiring Closet Configur ation If you do not w a nt HTTP traf fic switched from Host X to Host Y , you can conf igure a VLAN map on Switch A to drop all HTTP traf fic from Host X (IP a[...]

37-37 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Using VLAN Maps with Router ACLs Figur e 37 -5 Deny A ccess to a Serv er on Another VLAN This example sho ws how to den y access to a server on another VLAN by creating the VLAN map SER VER 1 that de nies access to hos[...]

37-38 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Using VLAN Maps with Ro ute r ACLs If a packet flo w matches a VLAN-map deny clause in the A CL, regard less of the router A CL configuration, the packet flo w is denied. Note When you use router ACLs with VLAN maps, p[...]

37-39 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Using VLAN Maps with Router ACLs Examples of Router ACLs and VLAN Maps Applied to VLANs This section gi ves ex amples of app lying router A CLs and VLAN maps t o a VLAN for switched, bridged, routed, and multica st pac[...]

37-40 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Using VLAN Maps with Ro ute r ACLs Figur e 37 -7 Applying ACLs on Bridg ed Pac k ets ACLs and Routed Packets Figure 37-8 sho ws ho w A CLs are applied on routed pack ets. The A CLs are appli ed in this order: 1. VLAN m[...]

37-41 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configuri ng Network Security with ACLs Displaying IPv4 ACL C onfiguration ACLs and Multicast Packets Figure 37-9 sho w s ho w A CLs are applied on pack ets that ar e replicated f or IP multicasting. A multicast packet being r outed has tw o dif ferent kinds[...]

37-42 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 37 Configurin g Network Security with ACLs Displaying IPv4 AC L Configuration Y ou can also display info rmation about VLAN access maps or VLAN filters. Use the pr iv ileged EXEC commands in Ta b l e 37-3 to display VLAN map information. show ip interface inter[...]

CH A P T E R 38-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 38 Configuring IPv6 ACLs Y ou can filter IP V ersion 6 (IPv6) tra ff ic by creating IPv6 access control lists (ACLs) and applying the m to interfaces simil arly to the way th at you create and apply IP V ersion 4 (IPv4) named A CLs. Y ou can also create a n[...]

38-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 38 Configuring IPv6 A CLs Understanding IPv6 ACLs Understanding IPv6 ACLs A switch support s two types of IPv6 A CLs: • IPv6 router A CLs are supported on outbound or in bou nd traff ic on Layer 3 i nterfaces, which can be routed ports, switch virtual interfac[...]

38-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 38 Configuring IPv6 ACLs Understanding IPv6 ACLs • Routed or bridged pack ets with hop-b y-hop options ha ve IPv6 A CLs applied in software. • Logging is supp orted for router A CLs, but n ot for port A CLs. • The switch support s IPv6 address-matching for[...]

38-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 38 Configuring IPv6 A CLs Configuring IPv6 ACLs Configuring IPv6 ACLs Before conf iguring IPv6 A CLs, you must select one of t he dual IPv4 and IPv6 SD M templates. T o filter IPv6 t raff ic, you perform these steps: Step 1 Create an IPv6 A CL, and enter IPv6 ac[...]

38-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 38 Configuring IPv6 ACLs Co nfiguring IPv6 ACLs Creating IPv6 ACLs Beginning in pri vileged EXEC mode, follow these steps to create an IPv6 A CL: Command Purpose Step 1 conf igure terminal Enter global config uration mode. Step 2 ipv6 access-list access-list-nam[...]

38-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 38 Configuring IPv6 A CLs Configuring IPv6 ACLs Step 3b { deny | permit } tcp { sour ce-ipv6-pref ix / pref ix-l ength | any | host sour ce-ipv6-addr ess } [ operator [ p ort-number ]] { destination-ipv6 - pr efix / pr efix-l ength | any | host destination-ipv6-[...]

38-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 38 Configuring IPv6 ACLs Co nfiguring IPv6 ACLs Use the no { deny | permit } IPv6 access-list configuration commands with keywords to remo ve the deny or permit conditions from the specified access list. This example configures the I Pv6 access list nam ed CISCO[...]

38-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 38 Configuring IPv6 A CLs Displaying IPv6 ACLs Use the no ipv6 tr aff ic -f ilter access-list-name interface conf iguration command to remov e an access list from an interface. This example sho ws how to apply the access list Ci sco to outbound traff ic on a Lay[...]

CH A P T E R 39-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 39 Configuring QoS This chapter describe s ho w to configure quality of serv ice (QoS) by using automatic QoS (auto-Q oS) commands or by usin g standard QoS commands on the Catalyst 3750- X or 3560-X switch. W ith QoS, y ou can provide preferenti al treatme[...]

39-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS Understanding QoS T ypically , networks operate on a b est-effor t deliv ery ba sis, which m eans that all t raf fic has eq ual priority and an equal chance of being deli vered in a timely manner . When conge stion occurs, al[...]

39-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS Figur e 39-1 QoS Classification Lay ers in Frames and P ack ets All switches and routers that access the I nternet re ly on the cl ass information to provide the same forwarding treatment to packets with the same class infor[...]

39-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS Basic QoS Model T o implement QoS, the switch must distingu ish packets or flo w s from one anoth er (classify), assign a label to indicat e the gi ven qual ity of service as the pack ets mov e through the swit ch, make the p[...]

39-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS Figur e 39-2 Basic QoS Model Classification Classificat ion is the process of di stinguishing one ki nd o f traf fic from another b y examining the f ields in the pack et. Classification is enab led only if QoS i s globally [...]

39-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS For IP traf fic, you ha ve these classificat ion options as sho wn in Figure 39-3 : • T rust the DSCP v alue in the incoming packet ( configure t he port to trust DSCP), and assign the same DSCP v alue to the packet. The IE[...]

39-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS Figur e 39-3 Cl ass ification Flo wchar t Classification Based on QoS ACLs Y ou can us e IP standard, IP ex tended, or Layer 2 MA C A CLs to define a gro up of packets with the same characteristics ( class ). Y ou can also c[...]

39-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS In the QoS context, the permit and deny actio ns in the access control entries (A CEs) hav e different meanings than with securi ty A CLs: • If a match with a permit action is encountered (first-match principle), the specif[...]

39-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS T o enable the polic y map, you attach it to a port b y using the service-policy interface conf iguration command. Y ou can apply a nonhierarchical polic y map to a ph ysical port or an SVI. Howe ver , a hi erarchical polic [...]

39-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS Policing on Physical Ports In polic y maps on physical ports, you can create these t ypes of policers: • Indi vidual—QoS applies the bandwidth limits sp ecified i n the policer separately t o each matched traf fic class.[...]

39-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS Figur e 39-4 P olicing and Marking Flo w chart on Ph ysical Por ts Policing on SVIs Note Before conf iguring a hierarchical policy map w ith indi vidual policers on an SVI, you must enable VLAN-based QoS on the physical po [...]

39-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS When configuring policing on an SV I, you can create and configure a hi erarchical policy map with these two le vels: • VLAN le vel—Create t his primary le vel b y configuring class maps and classes that specify the port[...]

39-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS Mapping Tables During QoS processing, the switch represents the priority of all traf fic (inclu ding non-IP traf fic) with a QoS label based on the DSCP or CoS v alue from the classificatio n stage: • During classificatio[...]

39-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS Queueing and Scheduling Overview The switch has queues at sp ecific points to help pre vent congestion as sho wn in Figure 39-6 and Figure 39-7 . Figur e 39-6 I ngr ess and Egr ess Queue Loca tion on Cata lyst 3750-X S witch[...]

39-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS Weighted Tail Drop Both the ingress and egress queues u se an enhanced versi on of the tail-drop congest ion-a voidance mechanism called weighted tail dr op (WTD). WTD is implemented on queues to man age the queue lengths a[...]

39-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS In shared mode, the queu es share the bandwidt h among them according to the conf igured weights. The bandwidth is guaranteed at th is lev e l b ut not limited to it . For example, if a queue is emp ty and no longer requires[...]

39-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS Figur e 39-1 0 Queueing and Scheduling Flow c hart for Ingr ess Por ts on Catalyst 3560-X Switches Note SRR service s the priority queue for its configured s hare before servic ing the other que ue. The switch supports tw o[...]

39-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS Y ou assign each packet that flo w s through the sw itch to a queue a nd to a threshold. Specif ically , you map DSCP or CoS v alues to an ingress queue and map DSCP or CoS v alues to a threshold ID. Y ou use the mls qos srr[...]

39-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS Queueing and Scheduling on Egress Queues Figure 39-11 and Figure 39-12 sho w the queueing and scheduling fl owch arts for e gress ports. Note If the e xpedite queue is enabled, SRR services it u nt il it is empty before ser[...]

39-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS Figur e 39-12 Queueing and Scheduling Flow char t f o r Egr ess P orts on Catalyst 3560-X S witches Each port supports fou r egress queues, o ne of which (queue 1) can be th e egress expedite queu e. These queues are assigne[...]

39-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understand ing QoS buf fers) or not empty (free buf fers). If the queue is not ov er-limit, the switch can allocate buf fer space from the reserv ed pool or from the co mmon pool (if it is not empty ). If there are no free b uffers in the com[...]

39-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Understanding QoS The queues use WTD to support dis tinct drop percentage s for dif feren t traff ic classes. Each queue has three drop threshol ds: two conf igurable ( explicit ) WTD th resholds and one nonconf igurable ( implicit ) threshol[...]

39-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto-QoS • Depending on the QoS label ass igned to a fram e a nd the mutation chosen, the D SCP and C oS v a lues of the frame are re written. If you do not configure the mutati on map an d if yo u conf igure the port to trust t[...]

39-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto- QoS Generated Auto-QoS Configuration By default, auto-Qo S is disabled on all ports. When auto-QoS is enabled, it uses th e ingres s packet label to categorize traf fic, to assign packet labels, and to configure the ingress [...]

39-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto-QoS trust the QoS label receiv ed in the pa cket. The switch also uses policing to determine wheth er a packet is in or out of profil e and to specify the action on t he packet. If the pack et does not hav e a DSCP v alue of [...]

39-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto- QoS The switch automatically maps DSCP v alues to an ingress queue and to a threshold I D. Switch(config)# no mls qos srr-queue input dscp-map Switch(config)# mls qos srr-queue input dscp-map queue 1 threshold 2 9 10 11 12 1[...]

39-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto-QoS The switch automatically conf ig ures the egress queue buf fer sizes. It conf igures the bandwidth and the SRR mo de (shaped or shared) on the e gress queues mapped to the port. Switch(config)# mls qos queue-set output 1 [...]

39-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto- QoS Effects of Auto-QoS on the Configuration When auto-QoS is enabled, the auto qos voip interface conf iguration command an d the generated confi guration are added to the running conf iguration. The switch applies the auto[...]

39-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto-QoS • T o take adv antage of the auto-QoS def aults, you should enable aut o-QoS before you conf igure other QoS commands. If necessary , you can f ine-tune the QoS configuration, but we recommend that you do so on ly after[...]

39-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto- QoS T o display the QoS commands that are automatically generated when auto-QoS is enabled or disabled, enter the debug auto qos pri vileged EXEC command befor e enabling au to-QoS. For more informati on, see the debug autoq[...]

39-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto-QoS Figur e 39-14 A uto-QoS Configuration Example Networ k Figure 39-14 sho ws a netw ork in which t he V oIP traf fic is pr ioritized ove r all other traf fic. Au to-QoS is enabled on the switches in the w iring closets at t[...]

39-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Auto- QoS Beginni ng in priv ileged EXEC mode, fo llow these steps to configur e the switch at the edge of the QoS domain to prioritize the V oIP traf fic o ver all other traf fic: Command Purpose Step 1 debug auto qos Enable debu[...]

39-33 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Displaying Auto-QoS Information Displaying Auto-QoS Information T o display the initial au to-QoS conf iguration, use the sho w auto qos [ interfac e [ interface-id ]] pri vileged EXEC co mmand. T o display any user changes to that conf igura[...]

39-34 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Default Standard QoS Configuration QoS is disabled. There is no concept of trusted or untrusted ports because the pack ets are not modif ied (the CoS, DSCP , and IP precedence values in the packet are not changed). [...]

39-35 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Default Egress Queue Configuration Ta b l e 39-9 sho w s the def ault eg ress queue conf iguration for each queue-set when QoS is enabled. All ports are mapped to queue-set 1. The port band wi d th limit is set to 100[...]

39-36 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Default Mapping Table Configuration Ta b l e 39-12 on page 39-70 shows the default CoS-t o-DSCP map. Ta b l e 39-13 on page 39-71 sho ws the default IP -precedence-to-DSCP map. Ta b l e 39-14 on page 39-73 sho ws th[...]

39-37 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Applying QoS on Interfaces These are the guidelines for configuring QoS on p hysical ports and SVIs (Layer 3 VLAN interfaces): • Y ou can con f igure QoS on p hysical ports and SVIs. When configuring QoS on phy sica[...]

39-38 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS • QoS policies that include IPv6-specif ic classification (such as an IPv 6 A CL or th e match pr otocol ipv6 command) are supported on Catalyst 3750-X and Catalyst 3750-E interfaces and on any SVI when a C atalys[...]

39-39 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Beginning in pri vileged EXEC mode, follow these steps to enable QoS. This procedure is requi red. T o disable QoS, use the no ml s q os global conf iguration command. Enabling VLAN-Based QoS on Physical Ports By defa[...]

39-40 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Configuring Classification Using Port Trust States These sections describe ho w to cl assify incoming traf fic by usin g port trust states. Depending on y our network co nfigu ration, you must perform one or mo re o[...]

39-41 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Beginning in pri vileged EXEC mod e, follo w these steps to conf igure the port to trust the classif ication of the traff ic that it receives: T o return a port to its u ntrusted state, use t he no ml s qos trust inte[...]

39-42 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS T o return to the default setting, use t he no mls qos cos { default-cos | ov erride } interface conf iguration command. Configuring a Trusted Bou ndary to Ensure Port Security In a typical network, yo u connect a C[...]

39-43 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS In some situations, yo u can pre vent a PC conn ected to the Cisco IP Phone fro m taking adv antage of a high-priority d ata queue. Y ou can use the switchport priority extend cos interface configuration command to co[...]

39-44 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Regardl ess of the DSCP tran sparency conf iguration, the switch modi fies the i nternal DSCP v alue of the packet, which the switch uses to generate a class of service (CoS) v alue that represents the priority of t[...]

39-45 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Beginning in pri vileged EXEC mod e, follo w these steps to conf igure the DSCP-trusted state on a port and modify th e DSCP-to-DSCP-muta tion map. T o ensure a consi stent mapping strategy across both Qo S domains, y[...]

39-46 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Configuring a QoS Policy Config uring a QoS polic y typically requires classifying t raff ic into classes, conf iguring policies ap plied to those traf fic classes, and at taching policies to ports. For background i[...]

39-47 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS T o delete an access list, use the no access-list acce ss-list-number global configuration c ommand. This example sho ws how to allo w access for only those hosts on the three specified networks. The wildcard bits ap [...]

39-48 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS T o delete an access list, use the no access-list acce ss-list-number global conf iguration command. This example sho ws how to create an A CL that permits IP traff ic from any source to an y destination that has th[...]

39-49 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS T o delete an access list, use the no ipv6 access-list access-list-number global confi guration command. Step 3 { deny | permit } pr otocol { s our ce-ipv6-pref ix/pref ix-len gth | any | host sour ce-ipv6-addr ess } [...]

39-50 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS This example sho ws how to create an A CL that perm its IPv6 traf fi c from any source to an y destination that has the DSCP v alue set to 32: Switch(config)# ipv6 access-list 100 permit ip any any dscp 32 This exam[...]

39-51 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS This example sho ws ho w to crea te a Layer 2 M A C AC L with two perm it statements. The first statem ent allo ws traf fic from the ho st with MA C address 0001.0000.0001 to the host with MA C address 0002.0000.0001.[...]

39-52 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Step 3 class-map [ match-all | match-any ] class-map-name Create a class map, and enter class-map c onf iguration mode. By default, no cl ass maps are defined. • (Optiona l) Use the match-all keyw ord to perform a[...]

39-53 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS T o delete an existing pol icy map, use the no policy-map policy-map-name global configuration command. T o delete an existin g class map, use the no class-map [ match-al l | match-any ] class-map-n ame global conf ig[...]

39-54 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Classifying Traffic by Using Cla ss Maps and Filtering IPv6 Traffic The switch supports both IPv4 and IPv6 QoS when a dual- ipv4-and-ipv6 SDM te mplate is confi gured. When the dual IP SDM template is configu red, t[...]

39-55 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS T o delete an existing pol icy map, use the no policy-map policy-map-name global configuration command. T o delete an existin g class map, use the no class-map [ match-al l | match-any ] class-map-n ame global conf ig[...]

39-56 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Classifying, Policing, and Mark ing Traffic on Physical Ports by Using Policy Maps Y ou can confi gure a nonhierarchical poli cy map on a p hysical port that specif ies which traff ic class to act on. Actions can in[...]

39-57 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Beginning in pri vileged EXEC mod e, follo w thes e steps to cr eate a nonhier archical po licy map: Command Purpose Step 1 configur e terminal Enter global conf iguration mode. Step 2 class-map [ match-all | match-an[...]

39-58 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Step 5 trust [ cos | dscp | ip-precedence ] Conf igure the trust state, which QoS uses to generate a CoS-based or DSCP-based QoS label. Note This command is mutually e xclusi ve with the set command within the same [...]

39-59 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS T o delete an existing pol icy map, use the no policy-map policy-map-name global configuration command. T o delete an existin g class map, use the no class class-map-name pol icy-map conf iguration command. T o return[...]

39-60 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Switch(config-ext-mac)# exit Switch(config)# class-map macclas s1 Switch(config-cmap)# match access -group maclist1 Switch(config-cmap)# exit Switch(config)# policy-map macpol icy1 Switch(config-pmap)# class maccla [...]

39-61 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS • In a switch stack, you cannot use the match input-interface class-map conf iguration command to specify interfaces acro ss stack members in a polic y-map class. • A policy-map and a port trust sta t e can both r[...]

39-62 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Beginning in pri vileged EXEC mod e, follo w these steps to create a hier archical polic y map: Command Purpose Step 1 configur e terminal Enter global conf iguration mode. Step 2 class-map [ match-all | match-any ][...]

39-63 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Step 4 match protocol [ ip | ipv6 ] (Optional) Specify the IP proto col to which the class map applies. • Use the argument ip to specify IPv4 traf f ic, and ipv6 to specify IP v 6 t r affi c . • When you use the m[...]

39-64 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Step 11 policy-map policy-map-name Create an interface-le vel polic y map b y entering the po licy-map name, and enter polic y-map configuration mode. By default, no polic y maps are de f ined, and no policing is pe[...]

39-65 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Step 18 trust [ cos | dscp | ip-precedence ] Conf igure the trust state, which QoS uses to generate a Co S-based or DSCP-based QoS label. Note This command is mutually e xclusi ve with the set command within the same [...]

39-66 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS T o delete an existing pol icy map, use the no policy-map policy-map-name global configuration command. T o delete an existin g class map, use the no class class-map-name policy -map config uration command. T o retu[...]

39-67 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Switch(config-pmap-c)# exit Switch(config-pmap)# class-map cm- 2 Switch(config-pmap-c)# match ip ds cp 2 Switch(config-pmap-c)# service-pol icy port-plcmap-1 Switch(config-pmap)# exit Switch(config-pmap)# class-map cm[...]

39-68 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Beginning in priv ileged EXEC mode, foll ow these steps to create an aggreg ate policer: Command Purpose Step 1 configur e terminal Enter global conf iguration mod e. Step 2 mls qos aggregate-policer aggr e gate-pol[...]

39-69 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS T o remove the specif ied aggre gate policer from a policy map, use the no police aggr egate aggr e gate-policer-name polic y map configu ration mode. T o delete an aggregate poli cer and its parameters, use the no ml[...]

39-70 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Configuring the CoS-to-DSCP Map Y ou use the CoS-to-DSCP map to map CoS v alues in incoming packets to a DSCP v alue that QoS uses internally to represent the priority of the traf fic. Ta b l e 39-12 sho ws the def [...]

39-71 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Configuring the IP-Precedence-to-DSCP Map Y ou use the IP-precedence-to-DSC P map to map IP pr ecedence values in incoming packets to a DSCP v alue that QoS uses intern ally to represent th e priority of the tr af fic[...]

39-72 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Configuring the Policed-DSCP Map Y ou use the policed-DSCP map to mark do wn a DSCP v alue to a new v alue as the result of a policing and marking action. The default po liced-DSCP map is a null map, whi ch maps an [...]

39-73 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Configuring the DSCP-to-CoS Map Y ou use the DSCP-to-CoS map to gene rate a CoS v alue, which is used to select one of the four egress queues. Ta b l e 39-14 sho ws the default DSCP-to-CoS map. If these v alues are no[...]

39-74 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS 3 : 03 03 00 04 04 04 04 04 04 04 4 : 00 05 05 05 05 05 05 05 00 06 5 : 00 06 06 06 06 06 07 07 07 07 6 : 07 07 07 07 Note In the abov e DSCP-to-CoS map, the CoS v alues are shown in the body of th e matrix. The d1 [...]

39-75 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS T o return to the default map, u se the no mls qos dscp-mutation dscp-mutation-name glo bal confi guration command. This exampl e show s how to define the DSCP-to-DSCP- mutation map. All the entries that are not e xpl[...]

39-76 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Mapping DSCP or CoS Values to an Ingress Queue and Setting WTD Thresholds Y ou can prioritize traff ic by placing packets with particular DSCPs or CoSs into certain queues and adjusting the queue thresho lds so that[...]

39-77 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS This exampl e sho ws how to map DSCP v alues 0 to 6 to in gress queue 1 and to threshold 1 with a drop threshold of 50 percent. It map s DSCP v alues 20 t o 26 to ingress queue 1 and to threshold 2 with a drop thresho[...]

39-78 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Beginning in pri vileged EXEC mode, foll ow th ese steps to allocate bandwidth between the ingress queues. This procedure is optional. T o return to the def ault setting, use the no ml s q os srr -queue input bandwi[...]

39-79 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Beginni ng in pri vileged EXEC mode, follo w these steps to configure the priorit y queue. This procedure is optio nal. T o return to the default setti ng, use the no ml s qos srr -queue input priority-queue queue-id [...]

39-80 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS These sections contain this configu ration informat ion: • Config uration Guidelines, page 39- 80 • Allocating Buffer Space to and Setting WTD Th resholds for an Egress Queue-Set, page 39-80 (optio nal) • Mapp[...]

39-81 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Beginni ng in pri vileged EXEC mo de, follow these steps to conf igure the memory allocation and to drop thresholds for a queue-set. This procedure is opti onal. Command Purpose Step 1 configur e terminal Enter global[...]

39-82 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS T o return to the default set ting, use the no mls qos queue-set output qset-id buffers global configuration command. T o return to the default WTD threshold percentages, use the no mls qos queue-set output qset-id [...]

39-83 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Beginni ng in pri vileged EXEC mode, follo w these steps to map DSCP or Co S values to an e gress queue and to a threshold ID. This p rocedure is optional. T o return to the defaul t DSCP output queue threshol d map o[...]

39-84 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Configuring SRR Shaped Weights on Egress Queues Y ou can specify ho w much o f the av ailable bandwidt h is allocated to each queue. The ratio of t he weights is the ratio of frequenc y in which the SRR scheduler se[...]

39-85 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Standard QoS Configuring SRR Shared Weights on Egress Queues In shared mode, the queu es share the bandwidt h among them according to the conf igured weights. The bandwidth is g uaranteed at this le vel b ut not limited to it. F o[...]

39-86 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Configuring Stand ar d QoS Beginning in priv ileged EXEC mode, foll ow these steps to enable the egress e xpedite queue. This procedure is optional . T o disable the eg ress expedite queue, use the no priori ty-queue out interf ace configurat[...]

39-87 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Displaying Standard QoS Information T o return to the defa ult setting, use th e no srr -queue bandwidth limit in terface conf iguration command. This example sh ows ho w to limit the bandwidth on a port to 80 percent: Switch(config)# interfa[...]

39-88 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 39 Configuring QoS Displaying Standard QoS Information[...]

CH A P T E R 40-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 40 Configuring EtherChannels and Link-State Tracking This chapter de scribes ho w to co nfigure EtherChannels on Layer 2 and Layer 3 ports on the Catalyst 3750-X or 3560-X switch. EtherChannel provid es f ault-tolerant high- speed links between switches, ro[...]

40-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Understanding EtherCh an nels • Load-Balancing and Forwardi ng Methods, page 40-8 • EtherChannel and Switch Stacks, page 40 -10 EtherChannel Overview An EtherChannel consists of in di vidual Gigabit Ether[...]

40-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Understanding EtherChann els Y ou can confi gure an EtherChannel in o ne of thes e modes: Port Aggre gation Protocol (P AgP), Link Aggreg ation Control Protocol (LA CP), or On. Config ure both end s of the Et[...]

40-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Understanding EtherCh an nels Figur e 40-3 Cr oss-Stack EtherChannel Port-Channel Interfaces When you create an EtherChannel, a port-c hannel logical interf ace is in volved: • W ith Layer 2 p orts, use the[...]

40-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Understanding EtherChann els Figur e 40-4 Relationship of Ph ysical P orts, Logical P ort Channels, and Channel Gr oups After you conf igure an EtherChannel, conf iguration changes applied to the port-channel[...]

40-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Understanding EtherCh an nels PAgP Modes Ta b l e 40-1 sho ws the user -configurable EtherChannel P AgP modes for the channel -group interface confi guration command. Switch ports exchange P AgP packets only [...]

40-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Understanding EtherChann els T o prev ent a dual-activ e situation, the core switches send P AgP protocol data units (PDUs) through the RSLs to the remote switches. The P AgP PDUs id entify the acti ve switch[...]

40-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Understanding EtherCh an nels Ports can form an EtherChannel when the y are in dif ferent LA CP modes as long as the mo des are compatible. For e xample: • A port in the active mode can form an EtherC hanne[...]

40-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Understanding EtherChann els W ith destination-M A C address forw arding, when packets are forwarded to an EtherChannel, they are distrib uted across the po rts in t he channel based on the destinat ion host?[...]

40-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Understanding EtherCh an nels Figur e 40-5 Load Distr ibution and F orwar ding Methods EtherChannel and Switch Stacks If a stack member that h as ports participating in an EtherC hannel fails or leaves the s[...]

40-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Configuring EtherChannels For more information about switch stacks, see Chapter 5, “Managing Switch Stacks. ” Configuring EtherChannels These sections contain this configu ration informatio n: • Defaul[...]

40-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Configuring EtherCh ann els EtherChannel Configuration Guidelines If improperly conf igured, some EtherChannel ports ar e automaticall y disabled to a void network l oops and other problems. F ollow these gu[...]

40-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Configuring EtherChannels – Ports with dif ferent spanning-tre e path costs can form an EtherChannel i f the y are otherwise compatibly conf igured. Setting dif ferent spanning-tree path costs does not, b [...]

40-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Configuring EtherCh ann els T o remove a po rt from the EtherChannel group, use t he no channel-group interf ace configuration command. Step 4 channel-group c hannel-gr oup-number mode { auto [ non-silent ] [...]

40-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Configuring EtherChannels This exampl e sho ws how to conf igure an EtherChannel on a single switch in the stack . It assigns two ports as static-a ccess ports in VLAN 10 to channel 5 wi th the P AgP mode de[...]

40-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Configuring EtherCh ann els Beginning in pri vileged EXEC mode, follow these steps to creat e a port-channel interface for a Layer 3 EtherChann el. This procedure is requir ed. T o remove the port-channel, u[...]

40-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Configuring EtherChannels Step 5 channel-group c hannel-gr oup-number mode { auto [ non-silent ] | desirable [ non-silent ] | on } | { active | passi ve } Assign the port t o a channel group, and sp ecify th[...]

40-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Configuring EtherCh ann els This ex ample sho ws ho w to conf igure an Et herChannel. It assi gns two ports t o channel 5 with th e LA CP mode activ e : Switch# configure terminal Switch(config)# interface r[...]

40-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Configuring EtherChannels T o return EtherChannel load-balan cing to the defau lt confi guration, use the no port-channel load-balance global conf iguration command. Configuring the PAgP Learn Method and Pri[...]

40-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Configuring EtherCh ann els Beginning in pri vileged EXEC mode, foll ow th ese steps to conf igure your switch as a P AgP physical-port learner and to adjust the prior ity so that the same port in the b undl[...]

40-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Configuring EtherChannels If you conf igure more than eight links for an EtherChannel group, the softw are automatically decides which of the hot-standb y ports to make acti ve based on the LA CP priority . [...]

40-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Displaying EtherChann el, PAg P, and LACP Status Configuring the LACP Port Priority By default, all port s use the same port priority . If the local system has a lo wer value f or the system priority and th [...]

40-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Understanding Link -State Tracking Y ou can clear P AgP channel-group information and t raf fic cou nters by usin g the clear pagp { channel -gr oup-number counters | counters } pri vileged EXEC command. Y o[...]

40-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Understanding Link-State Trac king Figur e 40-6 T ypical Link-State T racking Configur ation The configuration in Figure 40-6 ensures th at the netw ork traff i c flow is balanced as follo ws: • For link s[...]

40-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Configuring Link -State Tra cking • Link-state group 2 on sw itch A – Switch A provides secondary links to serv er 3 and server 4 through l ink-state group 2. Port 3 is connected to serv er 3, and port 4[...]

40-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Configuring Link-S tate Tr ack ing Default Link-State Tracking Configuration There are no link-state groups def ined, and link-state tracking is not enabl ed for any group. Link-State Tracking Con figuration[...]

40-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring Et herChannels and Link-State Tracking Configuring Link -State Tra cking Switch(config-if)# interface gigabitethernet1/0/3 Switch(config-if)# link state grou p 1 downstream Switch(config-if)# interface gigab itethernet1/0/5 Switch(config-if)# lin[...]

40-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 40 Configuring EtherChannels an d Link-State Tracking Configuring Link-S tate Tr ack ing[...]

CH A P T E R 41-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 41 Configuring TelePresence E911 IP Phone Support Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. Note This feature is not supported on swit ches running the LAN base feature set. The Catalyst 3750-X an d 3560-X [...]

41-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 41 Configuring TelePresenc e E911 IP Phone Support Configuring TelePre sence E911 IP Phone Support Use the T elePresence E911 IP phone support feature to ensure that th e IP phone is alw ays on and av ailable for emer gency calls. When a CDP-enabled IP phone is [...]

41-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 41 Configuring TelePresence E9 11 IP Pho ne Support Configuring TelePresence E911 IP Phone Support Enabling TelePresence E911 IP Phone Support Beginni ng in pri vileged EXEC mod e: Example Switch# configure terminal Enter configuration commands, one per line. En[...]

41-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 41 Configuring TelePresenc e E911 IP Phone Support Configuring TelePre sence E911 IP Phone Support Switch# show cdp forward Ingress Egress # packets # packets Port Port forwarded dropped ------------------------------------------------------------- Gi2/0/2 Gi2/0[...]

CH A P T E R 42-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 42 Configuring IP Unicast Routing This chapter describe s ho w to configure IP V ersion 4 (IPv4) unicast routing on th e Catalyst 3750-X or 3560-X switch. Note Routing is not supported on swi tches running the LAN base feature set. Unless otherwise noted , [...]

42-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Understanding IP Routing • Config uring Multi-VRF CE, pag e 42-74 • Config uring Protocol-Indepen dent Features, page 42-89 • Monitoring and Maintaini ng the IP Network, page 42 -104 Note When configuri ng routing paramete[...]

42-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Understanding IP Routing Types of Routing Routers and Layer 3 switches can rout e packets in three dif ferent ways: • By using defau lt routing • By using preprogrammed static routes for the traff ic • By dynamically calc[...]

42-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Understanding IP Routing • The MA C address of the stack master is used a s th e router MA C address for the whole stack, and all outside de vices use this address to send IP p ackets to the stack. • All IP packets t hat req[...]

42-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Steps for Configuring Routing Caution Partit ioning of the switch stack into two or more stacks mi ght lead to undesirable b ehavior in the network. Steps for Configuring Routing By default, IP routi ng is disabled on the switc[...]

42-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring IP Addressing Configuring IP Addressing A required task for conf iguring IP routing is to a ssign IP addresses to Layer 3 network interfaces to enable the interfaces and allow communication with the hosts on those in[...]

42-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Config uring IP Addressing Assigning IP Addresses to Network Interfaces An IP address identif ies a location to which IP pack ets can be sent. Some IP addresses are reserv ed for special uses and cannot be used for host, subnet[...]

42-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring IP Addressing Y ou can use the all ones subne t (131.108.255. 0) and e ven though it i s discouraged, you can enable the use of subnet zero i f you need the enti re subnet space for your IP address. Beginning in priv[...]

42-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Config uring IP Addressing Figur e 42-3 No IP Classless Routing T o prev ent the switch from forwardi ng packets destined for unrecognize d subnets to the best supernet route possible, you can disable classless routing beha vio[...]

42-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring IP Addressing The switch can use these fo rms of address resolution: • Address Resolution Protocol (ARP) is used t o asso ciate IP address with MA C addresses. T aking an IP address as in put, ARP learns t he asso[...]

42-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Config uring IP Addressing T o remove an entry from the ARP cache, use the no arp ip- addr ess hardwar e-addr ess type global confi guration command. T o remo ve all nonstatic ent ries from the ARP cache, use the clear arp-cac[...]

42-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring IP Addressing Enable Proxy ARP By default, t he switch uses proxy ARP to help host s learn MA C addresses of h osts on other netw orks or subnets. Beginning in pri vileged EXEC mode, foll ow th ese steps to enable p[...]

42-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Config uring IP Addressing Beginning in priv ileged EXEC mode, foll ow these steps to define a def ault gate way (router) when IP routing is disab led: Use the no ip d efault-gateway global configuration comm and to disable t [...]

42-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring IP Addressing If you change the maxadv ertinterval valu e , t he holdtime and minadvertinter val v alues also change, so it is imp ortant to first change the maxadvertinterv al v alue, before manually changing eith [...]

42-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Config uring IP Addressing Enabling Directed Broadcast-to-P hysical Broadcast Translation By default, IP directed broadcasts are dropped; they are no t forwarded. Dropping IP-directed broadcasts makes routers less susceptible [...]

42-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring IP Addressing Forwarding UDP Broadcast Packets and Protocols User Datagram Protocol (UDP) is an IP host -to-host layer protocol, as is TCP . UDP prov ides a lo w-ov erhead, connectionl ess session between tw o end s[...]

42-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Config uring IP Addressing Establishing an IP Broadcast Address The most popular IP broadcast address (and the de f ault) is an addres s consisting of all ones (255.255.255.25 5). How ev er , the switch can b e configur ed to [...]

42-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring IP Addressing Beginning in pri vileged EXEC mode, foll ow th ese st eps to use the bridging sp anning-tree databa se to flood UDP datagrams: Use the no ip f orward- protocol spanning-tr ee global configuration comma[...]

42-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Enabling IP Unicast Routing Enabling IP Unicast Routing By default, th e switch is in Layer 2 switchin g mo de and IP routing is di sabled. T o use the Layer 3 capabilities of the switch , you must enable IP routing. Beginning[...]

42-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring RIP This exampl e sho ws how to enable IP routing using RIP as the routing prot ocol: Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# ip routing Switch(config)[...]

42-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuri ng RIP Default RIP Configuration Configuring Basic RIP Parameters Note T o configu re RIP , you enable RIP routing for a network and optionally conf igure other parameters. On the Catalyst 3750-X and 3560-X switches,[...]

42-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring RIP Step 4 network network number Associate a net work with a RIP ro uting process. Y ou can sp ecify multiple network commands. RIP routing updates are sent and recei ved th rough interfaces onl y on these networks[...]

42-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuri ng RIP T o turn of f the RIP rout ing process, use the no router ri p global confi guration command. T o display the parameters and curren t state of the activ e routing protocol process, use the sho w ip proto cols [...]

42-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring RIP If you want to conf igure an interf ace running RIP to advertise a summar ized local IP address p ool on a network access server for dial-up clients, use the ip summary-address rip interface configuration comman[...]

42-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring OSPF Configuring Split Horizon Routers connected to broadcast-ty pe IP networks and using distance-v e ctor rout ing protocols nor mally use the split-horizo n mechanism to reduce the p ossibility of routing loops.[...]

42-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring OSPF • Plain te xt and MD5 authenticat ion among neighborin g routers within an area is suppor ted. • Config urable routing interf ace parameters include interface output cost, retransmission interval, interface[...]

42-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring OSPF Default OSPF Configuration Ta b l e 42-5 Def ault OSPF Configur ation Feature Default Setting Interface paramete rs Cost: No default cost predef ined. Retransmit interv al: 5 seconds. T ransmit delay: 1 second[...]

42-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring OSPF OSPF Nonstop Forwarding The switch or switch stack supports tw o le vels of n onstop forwarding (NSF) : • OSPF NSF A wareness, page 42-28 • OSPF NSF Capability , page 42-28 OSPF NSF Awareness The IP-service[...]

42-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring OSPF When the neighbor relationshi ps are reestablished, the NSF-capable stack master resynchronizes its database with its NS F-aware neig hbors, and routing inf ormation is e xchanged between the OSPF neighbors. T[...]

42-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring OSPF Configuring OSPF Interfaces Y ou can use the ip ospf interface conf iguration commands to modify interf ace-specif ic OSPF parameters. Y ou are not requir ed to modify an y of th ese parameters, b ut some inter[...]

42-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring OSPF Use the no form of these commands to remo ve the conf igured parameter value or return to the default val ue . Configuring OSPF Area Parameters Y ou can optionally conf igure sev eral OSPF area parameters. Th [...]

42-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring OSPF Use the no form of these commands to remo ve the conf igured parameter value or to return to t he default val ue . Configuring Other OSPF Parameters Y ou can optionally conf igure other OSPF pa rameters in rout[...]

42-33 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring OSPF • Administrati ve distance i s a rating of the trustw orthiness of a routing inform ation source, an inte ger between 0 and 255, with a higher v alue meaning a lo wer trust rating. An administrat iv e distan[...]

42-34 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring OSPF Changing LSA Group Pacing The OSPF LSA group pacing feature allo ws the rout er to group OSPF LSAs and pace the refreshing, check-summing, and aging functions for more ef ficien t router use. This feature is en[...]

42-35 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring EIGRP Use the no interface loopback 0 global configuratio n command to disable the loopback interface. Monitoring OSPF Y ou can displa y specif ic statis tics such as the conten ts of IP routing t ables, caches , a[...]

42-36 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring EIGRP IP EIGRP pro vides increased network w idth. W ith RIP , the largest possible wi dth of your netwo rk is 15 hops. Because the EIGRP metric is larg e enough to su pport thousands of hops, the onl y barrier to e[...]

42-37 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring EIGRP These sections contain this configu ration informatio n: • Default EIGRP Conf iguration, page 42-37 • Config uring Basic EIGRP Parameters, page 42 -39 • Config uring EIGRP Interf aces, page 42-40 • Co[...]

42-38 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring EIGRP T o create an EIGR P routing process, you m ust enable EIGRP and assoc iate networks. EIGRP sends updates to the interfaces in the specif ied networks. If you d o not specify an interface netw ork, it is not a[...]

42-39 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring EIGRP EIGRP NSF Capability The IP-services feature se t also supports EIGRP NSF- capable routing for IPv4 for better con vergence and lo wer traf fic loss fol lowing a stack master ch ange. Wh en an EIGRP NSF-ca pa[...]

42-40 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring EIGRP Use the no forms of these commands to disable the feature or retu rn the setting to the defa ult v alue. Configuring EIGRP Interfaces Other optional EI GRP parameters can be conf igured on an interface basis. [...]

42-41 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring EIGRP Use the no forms of these commands to disable the feature or retur n the setting to the defa ult v alue. Configuring EIGRP Route Authentication EIGRP route authenticat ion prov ides MD5 authentication of rout[...]

42-42 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring EIGRP Use the no forms of these commands to disable the featur e or to return the setting to the default valu e. EIGRP Stub Routing The EIGRP stub routing feature, av ailable in all fe ature sets, reduces resource u[...]

42-43 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP Figur e 42-4 EIGRP Stub Router Configuration For more info rmation about EIGRP stub routing , see “Con figuring EIGRP Stub Ro uting” section of the Cisco IOS IP Conf igurati on Guide, V olume 2 of 3: Routi[...]

42-44 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP For detai ls about BGP commands and ke ywords, see the “IP Routing P rotocols” part of the Cisco IOS IP Command Refer ence, V olume 2 of 3: Routing Pr otocols, Release 12.2 . For a list of BGP comman ds that[...]

42-45 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP In BGP , each route consists of a netwo rk number , a list of autonomous systems that information has passed through (th e autonomou s system path ), and a list of other path attributes . The primary function [...]

42-46 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP Ta b l e 42-9 Def ault BGP Configur ation Feature Default Setting Aggreg ate address Disabled: None defi ned. AS path access lis t Non e defined. Auto summary Enabled. Best path • The router considers as-path [...]

42-47 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP Nonstop Forwarding Awareness The BGP NSF A wareness feature is su pported for IPv4 in the IP services feature set. T o enable this feature with BGP routing, you need to enable Gr aceful Restart. When the neigh[...]

42-48 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP neighboring r outer during the i nterv al between the pr imary Route Processor (RP) i n a router f ailing and the backup RP taking ov er , or while the primary RP is manuall y reloaded for a nond isrupti ve soft[...]

42-49 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP Use the no router bgp autonomous-system global conf iguration command to remo ve a BGP AS. Use the no network network-number ro uter configuration comma nd to remove the network from the BG P table. Use the no[...]

42-50 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP Router B: Switch(config)# router bgp 200 Switch(config-router)# neighbor 1 29.213.1.2 remote-as 100 Switch(config-router)# neighbor 1 75.220.1.2 remote-as 200 Router C: Switch(config)# router bgp 200 Switch(conf[...]

42-51 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP establish a TCP se ssion. A soft rese t allo ws the dyna mic exchange of route refre sh requests and routing information betw een BGP routers and the subsequ ent re-advertisement of t he respectiv e outbound r[...]

42-52 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP Configuring BGP Decision Attributes When a BGP speaker receiv es updates from multiple au tonomous systems that de scribe dif ferent paths to the same destination, it must choose the single be st path for reachi[...]

42-53 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP Beginning in pri vileged EXEC mode, follow these steps to conf igure some decision attrib utes: Command Purpose Step 1 conf igure terminal Enter global conf iguration mode. Step 2 router bgp autonomous-system [...]

42-54 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP Use the no form of each command to return to the default state. Configuring BGP Filtering with Route Maps W ithin BGP , route maps can be used to control and to modify rout ing information an d to def ine the co[...]

42-55 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP path, comm unity , and network numbers. Autono mous system pa th matching requires the match as-path access-lis t route-map command, community based matching requires the match community-list route-map command[...]

42-56 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP Configuring Prefix Lists for BGP Filtering Y ou can use prefix lists as an alterna tiv e to acce ss lists in man y BG P route f iltering commands, including the neighbor distribute-list router conf iguration com[...]

42-57 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP sequence number command; to reenable automatic generati on, use the ip pr efi x-list sequence number command. T o clear the hit-count ta bl e of p refix list entries, use th e clear ip prefix-list pri vileged [...]

42-58 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP Configuring BGP Neighbors and Peer Groups Often many BGP n eighbors are conf igured with the same update policies (that is, th e same outbound route maps, distrib ute lists, fi lter lists, update source, and so [...]

42-59 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP Step 7 neighbor { ip-addr ess | peer -gr oup-name } default-originate [ r oute-map map-name ] (Optional) Allo w a BGP speaker (the local router) to send the default route 0.0 .0.0 to a neighbor for use as a de[...]

42-60 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP T o disable an e xisting BGP neighbor or neighbo r peer group, use the neighbor shutdown router confi guration command. T o enable a previ ously existi ng neighbo r or neighbor peer group that had been disabled,[...]

42-61 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP T o delete an aggregate entry , use the no aggregate-addr ess address mask router config uration command. T o return options to the def ault values, use the command with ke ywords. Configuring Routing Domain C[...]

42-62 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring BGP When the route reflector receives an adv ertised route, it t akes one of these act ions, depending on the neighbor: • A route from an external BGP speaker is adve rtised t o all clients and nonclient peers. ?[...]

42-63 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring B GP Beginni ng in pri vileged EXEC mod e, use these commands to config ure BGP route dampening: T o disable flap dampenin g, use the no bgp dampeni ng router co nfigu ration command without key words. T o set damp[...]

42-64 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring ISO CLNS Routing Y ou can also enable the logg ing of messages generate d when a BGP neighbor resets, comes up, or go es down b y using th e bgp log-neighbor changes rou ter configurati on command. Configuring ISO C[...]

42-65 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring ISO CLNS Routing When dynamically routing, y ou use IS-IS. This routin g protocol supports th e concept of ar eas . Wi thin an area, all rou ters kno w ho w to reach all the system IDs. Be tween areas, rout ers kno[...]

42-66 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring ISO CLNS Routing These sections briefly describes ho w to configure IS-IS ro uting. • Default IS-I S Confi guration, page 42-66 • Enabling IS-IS Routi ng, page 42-67 • Config uring IS-IS Global Parameters, pag[...]

42-67 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring ISO CLNS Routing Nonstop Forwarding Awareness The integrated IS-IS NSF A wareness feature is supported for IPv4 , beginning with Cisco IOS Release 12.2(25)SEG. The fe ature allo ws customer premises equipment (C PE[...]

42-68 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring ISO CLNS Routing T o disable IS-IS routing, use the no r outer isis ar ea-tag router co nfigu ration command. This ex ample sho ws how to conf igure three routers to run co n ventional IS-IS as an IP routing prot oc[...]

42-69 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring ISO CLNS Routing Configuring IS-IS Global Parameters These are so me optional IS-IS globa l parameters that you can conf igure: • Y ou can force a default route into an IS- IS routing domain b y configuring a de [...]

42-70 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring ISO CLNS Routing Step 9 set- overlo ad-b it [ on-startup { seconds | wait-for -bgp }] (Optional) Set an ov e rload bit (a hi ppity bit) to allo w other routers to ig nore the router in their shortest path f irst (SP[...]

42-71 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring ISO CLNS Routing T o disable default r oute generatio n, use the no default-inf ormation originate router configuration command. Use the no area-password or no domain-passw ord router conf iguration command to disa[...]

42-72 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring ISO CLNS Routing frequently and IS-IS adjacencies are f ailing unnecessarily . Y ou can raise the hello multiplier and lo wer the hello interv al correspondingly to make th e hell o protocol more rel iable without i[...]

42-73 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring ISO CLNS Routing T o return to the default setti ngs, use the no forms of the commands. Monitoring and Maintaining ISO IGRP and IS-IS Y ou can remov e all co ntents of a CLNS cach e or remov e information for a par[...]

42-74 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Multi-VRF CE Configuring Multi-VRF CE V irtual Pri vate Netw orks (VPNs) provide a secure way for customers to share bandwidth over an ISP backbone netw ork. A VPN is a collection of sit es sharing a common r outing[...]

42-75 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Multi-VRF CE Note The switch does not use Mul tiprotocol Label Switch ing (MPLS) to support VPNs. For information about MPLS VRF , see the Cisc o IOS Switching Se rvices Configuration Guid e, Release 12.2 . • Und[...]

42-76 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Multi-VRF CE Figure 42-6 sho ws a configuratio n using Catalyst 3750-X or 3 560-X switches as multiple virtual CEs. This scenario is su ited fo r customers who h a ve lo w bandwidth re quirements for their VPN servi[...]

42-77 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Multi-VRF CE T o configure VRF , you create a VRF table and specif y the Layer 3 interface assoc iated with the VRF . Then confi gure the routing protocols in the VPN an d between the CE and the PE. BGP is the pref[...]

42-78 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Multi-VRF CE • A customer can use multiple VLA Ns as long as they do not ov erlap with those of other customers. A customer’ s VLANs are mapped to a specific rou ting table ID that is used to identify the approp[...]

42-79 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Multi-VRF CE Use the no ip vrf vrf-name global configuration command to dele te a VRF an d to remove all interf aces from it. Use the no ip vrf forwarding interf ace configuration command to remov e an inte rface f[...]

42-80 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Multi-VRF CE User Interface for PING Beginning in pri vilege d EXEC mode, follo w these steps to conf igure VRF-aware services for p ing. For complete syntax and usage i nformation for the co mmands, refer to the sw[...]

42-81 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Multi-VRF CE User Interface for uRPF uRPF can be co nfigured on an interf ace assigned to a VRF , and source lookup is done in the VRF table. Beginning in p rivile ged EXEC mode, follo w these steps t o configur e [...]

42-82 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Multi-VRF CE User Interface for Traceroute Beginni ng in pri vileged EXEC mode, follo w these step s to conf igure VRF-aware services for tr aceroute. For complete syntax and usage information for t he commands, ref[...]

42-83 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Multi-VRF CE Configuring Multicast VRFs Beginni ng in priv ileged EXEC mod e, follo w these steps to conf igure a mul ticast within a VRF table. For complete syntax and usage i nformation for the comma nds, see the[...]

42-84 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Multi-VRF CE Beginning in pri vileged EXEC mode, follo w these steps to configure OSPF in the VPN: Use the no r outer ospf pr ocess-id vrf vrf-name global configurati on command to disassociate the VPN forwarding ta[...]

42-85 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Multi-VRF CE Multi-VRF CE Configuration Example Figure 42-7 is a simplif ied example of the physical connections in a netw ork similar to that in Figure 42-6 . OSPF is the protocol used in VPN1, VPN2, and the globa[...]

42-86 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Multi-VRF CE Config ure the loopback and ph ysical interf aces on Switch A. Gigabit Ethernet port 1 is a trun k connection to the PE. Gig abit Ethernet ports 8 and 11 connect to VPNs: Switch(config)# interface loopb[...]

42-87 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Multi-VRF CE Config ure BGP for CE to PE routing. Switch(config)# router bgp 800 Switch(config-router)# address-fam ily ipv4 vrf vl2 Switch(config-router-af)# redistri bute ospf 2 match internal Switch(config-route[...]

42-88 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Multi-VRF CE Router(config-vrf)# rd 100:1 Router(config-vrf)# route-target export 100:1 Router(config-vrf)# route-target import 100:1 Router(config-vrf)# exit Router(config)# ip vrf v2 Router(config-vrf)# rd 100:2 R[...]

42-89 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Unicast Re verse Path Forwarding For more inf ormation about the informat ion in the displays, see the Cisco IOS Switc hing Services Command Refer ence, Release 12.2 . Configuring Unicast Reverse Path Forwarding Th[...]

42-90 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Protoco l -Ind ependent Features more CPU processing po wer to be dedicated to pack et forwarding. In a switch stack, the hardw are uses distribu ted CEF (dCEF) in the stack. In dynamic netwo rks, fast switching cac[...]

42-91 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Protocol-Independent Features Configuring the Number of Equal-Cost Routing Paths When a router has two or more rout es to the same network with the sa me metrics, th ese routes can be thought of as ha ving an equal[...]

42-92 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Protoco l -Ind ependent Features Configuring Static Unicast Routes Static unicast routes are user-d efined routes that cause packet s moving between a source and a destination to take a specif i ed path . Static rou[...]

42-93 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Protocol-Independent Features When an interface goes down, all static routes through that interface are remo ved from the IP routing table. When the soft ware can no longer fin d a v alid ne xt hop for the addr ess[...]

42-94 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Protoco l -Ind ependent Features Y ou can also conditional ly control the redistrib ution of routes between routing d omains by def ining enhanced packet filters or route maps between the two d omains. The match and[...]

42-95 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Protocol-Independent Features Step 3 match as-path path-list-numb er Match a BGP AS path access list. Step 4 match community-list community-list-number [ exact ] Match a BGP community list . Step 5 match ip address[...]

42-96 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Protoco l -Ind ependent Features T o delete an entry , us e the no route-map ma p ta g global conf iguration command or the no match or no set route-map conf iguration commands. Y ou can distrib u te routes from on [...]

42-97 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Protocol-Independent Features T o disable redistrib u tion, use the no form of the commands. The metrics of one r outing protocol do no t necessarily translate into the metrics of another . For ex ample, t he RIP m[...]

42-98 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Protoco l -Ind ependent Features If match clauses are satisfied, you can use a set clause to specify the IP addresses identifying the ne xt hop router in t he path. For details about PBR commands and ke ywords, see [...]

42-99 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Protocol-Independent Features • The switch support s QoS DSCP and IP precede nce matching in PBR route ma ps, with these limitation s: – Y ou cannot apply Qo S DSCP mutation maps and PBR r oute maps to the same[...]

42-100 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Protoco l -Ind ependent Features Use the no route-map map-ta g global conf iguration command or the no match or no set route-map confi guration commands to de lete an entry . Use the no ip policy route-map map-tag [...]

42-101 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Protocol-Independent Features Note When routes are redistribute d between OSPF processes, no OSPF metrics are preserv e d. Setting Passive Interfaces T o prev ent other routers on a local network fr om dynamically[...]

42-102 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Configuring Protoco l -Ind ependent Features Beginning in pri vileged EXEC mode, foll ow th ese steps to control the adve rtising or processi ng of routing upd ates: Use the no dist ribute-li st in router co nfigu ration comma[...]

42-103 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Config uring IP Unicast Routing Configuring Protocol-Independent Features T o remove a distance def inition, use the no distance router configuration command. Managing Authentication Keys K ey management is a method of controlling auth entication k eys used[...]

42-104 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 42 Configuring IP Unicast Routing Monitoring and Main ta ining the IP Network T o remove the k ey chain, use the no key chain name-of- chain global conf iguration command. Monitoring and Maintaining the IP Network Y ou can remove all contents of a particular c[...]

CH A P T E R 43-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 43 Configuring IPv6 Unicast Routing This chapter describes h ow to config ure IPv6 unicast rou ting on the Cataly st 3750-X or 3560 -X switch. For info rmation about conf iguring IPv4 un icast routing, see Chapte r 42, “Conf iguring IP Unic ast Routing. ?[...]

43-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Understanding IPv6 For information about IPv6 and ot her features in this ch apter • See the Cisco IOS IPv6 Conf igurati on Library at this URL: http://www .cisco.com/en/US/ docs/ios/ipv6/conf iguration/guide/12_4t/ipv6_12[...]

43-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Understanding IPv6 Supported IPv6 Unicast Routing Features These sections describe the IPv6 prot ocol features supported b y the switch: • 128-Bit W ide Unicast Addresses, page 43-3 • DNS for IPv6, page 43-4 • Path MTU D[...]

43-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Understanding IPv6 process. Nodes on a local link use link-local addre sses and do not require globally unique ad dresses to communicate. IPv6 rout ers do not forw ard packets with link-local source or destination addresses [...]

43-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Understanding IPv6 reachability is unknown or suspect. For reachable or probably reachable routers, NDP can either select the same router e very time or c ycle through the router list. By using DRP , you can conf igure an IPv6[...]

43-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Understanding IPv6 Figur e 43-1 Dual IPv4 and IPv6 Support on an Interf ace Use the dual IPv4 and IPv6 switch database manageme nt (SDM) templ ate to enable IPv6 rout ing dual stack en vironments (supporting both IPv4 and IP[...]

43-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Understanding IPv6 For more in formation about stat ic routes, see the “Implementing Stati c Routes for IPv6” chapter in the Cisco IOS IPv6 Confi guration Library on Cisco.com. RIP for IPv6 Routing Information Protocol (RI[...]

43-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Understanding IPv6 SNMP and syslog over IPv6 pro vide these features: • Support for both IPv4 and IPv6 • IPv6 transport fo r SNMP and to modify the SNMP ag ent to support traps for an IPv 6 host • SNMP- and syslog-rel [...]

43-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Understanding IPv6 • The switch as a tunnel endpoint su pporting IPv4-to-IPv6 or IPv6-to-IPv4 tunnelin g protocols • IPv6 unicast re verse-path f orwarding • IPv6 genera l prefix es Limitations Because IPv6 is implemente[...]

43-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Configuring IPv6 If a ne w switch becomes the stack master , it reco mputes the IPv6 routing tables and distrib utes them to the member switches. While the ne w stack master is be ing elected and is resettin g, the sw itch [...]

43-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Configuring IPv6 Default IPv6 Configuration Configuring IPv6 Addressing and Enabling IPv6 Routing This section descri bes ho w to assign IPv6 addresses to indi vidual Layer 3 interfaces and to globally forward IPv6 traf fic o[...]

43-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Configuring IPv6 Beginning in p rivile ged EXEC mo de, follow these step s to assign an I Pv6 address to a Layer 3 interface and enable IPv6 routin g: T o remove an IPv6 address from an inte rface, use the no ipv6 addr ess [...]

43-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Configuring IPv6 without ar guments. T o disable IPv6 processing on an interf ace that has not been explicitly con figur ed with an IPv6 address, use the no ipv6 enable interface co nfigu ration command. T o globally disable [...]

43-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Configuring IPv6 Use the no ipv6 nd router -prefer ence interface conf iguration command to disabl e an IPv6 DRP . This exampl e sho ws how to conf igure a DRP of hi gh for the router on an interf ace. Switch# configure ter[...]

43-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Configuring IPv6 T o disable IPv4 routing, use the no ip routing global conf iguration command. T o disable IPv6 routing, use the no ipv6 unicast-routing g lobal conf iguration command. T o re move an IPv4 address from an int[...]

43-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Configuring IPv6 Enabling DHCPv6 Server Function Beginning in pri vileged EXEC mode, foll ow th ese st eps to enable the DHCPv6 serv er function on an interface. Command Purpose Step 1 conf igure terminal Enter global confi[...]

43-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Configuring IPv6 T o delete a DH CPv6 pool, use the no ipv6 dhcp pool poolname global con f iguration c ommand. Use th e no form of the DH CP pool configuratio n mode comma nds to change the DHCPv6 pool characteristics. T o d[...]

43-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Configuring IPv6 This example sho ws how to conf igure a pool ca lled 350 with vendor-specific options: Switch# configure terminal Switch(config)# ipv6 dhcp pool 35 0 Switch(config-dhcpv6)# address pr efix 2001:1005::0/48 S[...]

43-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Configuring IPv6 Configuring IPv6 ICMP Rate Limiting ICMP rate limitin g is enabled by d efault with a d efault interv al between error messages of 100 milliseconds and a bucket size (maximum number of tokens to be stored in [...]

43-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Configuring IPv6 Configuring Static Routing for IPv6 Before conf iguring a static IPv6 route, you must enable routing by u sing the ip routing global confi guration command, en able the forward ing of IPv6 pack ets by usin [...]

43-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Configuring IPv6 T o remove a conf igured static route, use the no ipv6 route ipv6-pr ef ix/pr efix length { ipv6-addr ess | interface- id [ ipv6-address ]} [ administrative distance ] global confi guration command. This exam[...]

43-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Configuring IPv6 T o disable a RIP routing process, use the no ipv6 r outer rip name global conf iguration command. T o disable the RIP rou ting proce ss for an interface, use the no ipv6 rip name interf ace conf iguration [...]

43-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Configuring IPv6 Beginning in pri vileged EXEC mode, follo w these required and optional step s to conf igure IPv6 OSPF: Command Purpose Step 1 configur e terminal Enter global co nfiguration mode. Step 2 ipv6 router ospf pr [...]

43-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Configuring IPv6 T o disable an OSPF routing process, use the no ipv6 r outer ospf pr oc ess-id glob al configuration command. T o disable the OSPF routing process for an interf ace, use the no ipv6 ospf pr ocess-id area ar[...]

43-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Configuring IPv6 Enabling HSRP Version 2 Beginni ng in pri vileged EXEC mo de, follo w these steps to enable HSRP ve rsion 2 on a Lay er 3 interface. Enabling an HSRP Group for IPv6 Beginning in p rivile ged EXEC mode, follo [...]

43-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Configuring IPv6 Use the no standby [ gr oup-number ] ipv6 interface conf iguration command to disable HSRP for IPv6. This exampl e sho ws how to acti v ate HSRP for IPv6 for group 1 on a port. The IP address used by the h [...]

43-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Configuring IPv6 Unicast Routing Displaying IPv6 Displaying IPv6 For complete syntax and usage in formation on these commands, see the Cisco IOS command reference publications. Ta b l e 43-2 Commands f or Monito r ing IPv6 Command Purpose show ipv6 access-li[...]

43-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 43 Co nfig uring IPv6 Unicast Routing Displaying IPv6 This is an example of the output from the show ipv6 interface pri vileged EXEC command: Switch# show ipv6 interface Vlan1 is up, line protocol is up IPv6 is enabled, link-local address is FE80::20B:46FF:FE2F[...]

CH A P T E R 44-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 44 Configuring HSRP This chapter describes h ow to u se Hot Standby Router Protocol (HSRP) on the Catalyst 3750-X or 3560-X switch to pro vide routing r edundancy for r outing IP traf fic withou t being dependent on the a v ailability of an y single router [...]

44-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Understanding HSRP Note Routers in an HSRP group can be an y router interface t hat supports HSRP , including Catalyst 3750-X or 3560-X routed ports and switch virtual in terfaces (SVIs). Ro uter interfaces are not sup ported when the switch [...]

44-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Understanding HSRP Figur e 44-1 T ypical HSRP Configuration HSRP Versions The switch supports these HSRP versions: • HSRPv1—V ersion 1 of the H SRP , the default v ersion of HSRP . It has these features: – The HSRP group number can be f[...]

44-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Understanding HSRP HSRPv2 has a different pack et format th an HSRPv1. A HSR Pv2 packet uses the type-length-v alue (TL V) format and has a 6-byte iden tifier f ield with the MA C address of the physical router that sent the packet. If an int[...]

44-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Configuring HSRP HSRP and Switch Stacks HSRP hello messages are generated b y the stack master . If an HSRP-activ e stack ma ster fails, a flap in the HSRP acti ve state might occur . This is becau s e HSRP hello messages are not generated wh[...]

44-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Configuring HSRP HSRP Configuration Guidelines • HSRPv2 and HSRPv1 are mutuall y exclusi ve. HSRPv2 is not interoperable wi th HSRPv1 on an interface and the re verse. • In the procedures, the specified interface mu st be one of these Lay[...]

44-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Configuring HSRP Beginni ng in pri vilege d EXEC mode, follo w these steps to create or enable HSRP on a Lay e r 3 in terface: Use the no standby [ gr oup-number ] ip [ ip-addr ess ] interface conf iguration command to disable HSRP . This exa[...]

44-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Configuring HSRP Configuring HSRP Priority The standby priority , standby pr eempt , and standby track in terface conf iguration commands ar e all used to set characteristics for f inding acti ve and stan dby router s and beha vior reg arding[...]

44-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Configuring HSRP Use the no standby [ gr oup-number ] priority priority [ preempt [ delay delay ]] and no standby [ gr oup-number ] [ priority priority ] preempt [ delay delay ] interface conf iguration commands to restore default pri ority ,[...]

44-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Configuring HSRP This example acti vates a port, sets an IP address an d a pri ority of 120 (higher than t he default v alue), and waits for 30 0 seconds (5 minutes) before at tempting to become the acti ve router: Switch# configure terminal[...]

44-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Configuring HSRP When configuring these attrib ut es, follow these guidelines: • The authentication strin g is sent unencrypt ed in all HSRP messages. Y ou must configure the same authentication string on all r outers and access serv ers o[...]

44-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Configuring HSRP This exampl e sho ws how to set the timers on standb y group 1 with the time between hello pack ets at 5 seconds and the t ime after which a router is consider ed do wn to be 15 seconds: Switch# configure terminal Switch(con[...]

44-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Displaying HSRP Configurations Troubleshooting HSRP for Mixed Stacks of Catalyst 3750-X, 3750-E and 3750 Switches If one of the situations in Ta b l e 44-2 occurs, this message appears: %FHRP group not consistent with already configured grou[...]

44-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 44 Configuring HSRP Displaying HSRP Configurati ons[...]

CH A P T E R 45-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 45 Configuring Cisco IOS IP SLAs Operations This chapter describes ho w to use Cisco IOS IP Se rvice Le vel Agreements (SLAs) o n the Catalyst 3750-X or 3560- X switch. Cisco IP SLAs is a part of Ci sc o IOS software that allo ws Cisco customers to analyze [...]

45-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Config uring Cisco IO S IP SLAs O p e rations Understanding Cisco IOS IP SLAs Depending on the specif ic Cisco IOS IP SLAs oper ation, vari ous networ k pe rformance statistics are monitored within the Cisc o de vice and stored in both command-l ine inte rfac[...]

45-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Configuring Cisco IOS IP SLAs Ope rations Understand ing Cisco IOS IP SLAs Using Cisco IOS IP SLAs to Measure Network Performance Y ou can use IP SLAs to mon itor the performance be tween any area in the netw ork—core, distrib ution, and edge—wit hout dep[...]

45-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Config uring Cisco IO S IP SLAs O p e rations Understanding Cisco IOS IP SLAs IP SLAs Responder and IP SLAs Control Protocol The IP SLAs res ponder is a componen t embedded in the destination Ci sco de vice that allo ws the system to anticipate and resp ond t[...]

45-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Configuring Cisco IOS IP SLAs Ope rations Understand ing Cisco IOS IP SLAs Figur e 45-2 Cisco IOS IP SLAs Responder Time Stamping An additional benef it of the two time stamp s at the ta rget devi ce is the ability to track one-way delay , jitter , and direct[...]

45-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Config uring Cisco IO S IP SLAs O p e rations Configuring IP SLAs Operations An IP SLAs threshold vi olation can also trigger another IP SLAs op eration for further analysis. F o r exam ple, the frequenc y could be in cr eased or an ICMP path echo or I C MP p[...]

45-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Configuring Cisco IOS IP SLAs Ope rations Configuring IP SLAs Opera tions Before configuring any IP SLAs application, you can use the show ip sla application pri vileged EX EC command to veri fy that the operation typ e is supported on you r software imag e. [...]

45-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Config uring Cisco IO S IP SLAs O p e rations Configuring IP SLAs Operations T o disable the IP SLAs responder , enter the no ip sla responder global conf iguration command. This example shows ho w to confi gure the de vice as a responder for the UD P jitter [...]

45-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Configuring Cisco IOS IP SLAs Ope rations Configuring IP SLAs Opera tions Beginni ng in p rivile ged EXEC mod e, follow these steps to co nfigure UDP jitter operation o n the source device: Command Purpose Step 1 configur e terminal Enter global config uratio[...]

45-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Config uring Cisco IO S IP SLAs O p e rations Configuring IP SLAs Operations T o di s ab l e t h e I P SL A s operation, ente r the no ip sla operation-number global configur ation command. This exampl e sho ws how to conf igure a UDP jitter IP SLAs operatio[...]

45-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Configuring Cisco IOS IP SLAs Ope rations Configuring IP SLAs Opera tions Schedule: Operation frequency (seconds): 30 Next Scheduled Start Time: Pending trigger Group Scheduled : FALSE Randomly Scheduled : FALSE Life (seconds): 3600 Entry Ageout (seconds): n[...]

45-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Config uring Cisco IO S IP SLAs O p e rations Configuring IP SLAs Operations T o disable the IP SLAs operation, enter th e no ip sla operation-number global config uration command. This exampl e sho ws how to conf igure an ICMP echo IP SLAs oper ation: Switc[...]

45-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Configuring Cisco IOS IP SLAs Ope rations Monitoring IP SLAs Operations Next Scheduled Start Time: Pending trigger Group Scheduled : FALSE Randomly Scheduled : FALSE Life (seconds): 3600 Entry Ageout (seconds): never Recurring (Starting Everyday): FALSE Stat[...]

45-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 45 Config uring Cisco IO S IP SLAs O p e rations Monitoring IP SLAs Operations[...]

CH A P T E R 46-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 46 Configuring Enhanced Object Tracking This chapter describe s ho w to configure enhanced object tracking on the Catalyst 3750-X or 3560-X switch. This feature pro vides a mo re complete alternati ve to t he Hot Standb y Routing Protocol ( HSRP) tracking m[...]

46-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configur in g Enhanced Object Trackin g Configuring Enh anced Object Trac king Features Y ou can also track a combination of objects in a list by us ing either a weight th reshold or a percent age threshold to measure the state of the list. Y ou can combine o[...]

46-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configuring Enhanced Object Trac king Configuring Enhanced Obje ct Tracking Features This example configures the tracki ng of an interface line-proto col st ate and verifi es the configuration: Switch(config)# track 33 interface gigabitethernet 1/0/1 line-pro[...]

46-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configur in g Enhanced Object Trackin g Configuring Enh anced Object Trac king Features Configuring a Tracked List with a Boolean Expression Config uring a tracked list wi th a Boolean expressio n enables calcul ation by using either “ AND” or “OR” op[...]

46-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configuring Enhanced Object Trac king Configuring Enhanced Obje ct Tracking Features Configuring a Tracked List with a Weight Threshold T o track by weight threshold, configure a track ed list of objects, specify that weight is used as the threshold, and conf[...]

46-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configur in g Enhanced Object Trackin g Configuring Enh anced Object Trac king Features Configuring a Tracked List with a Percentage Threshold T o track by percentage threshold, configure a tracked list of objects, specify th at a percentage will be used as t[...]

46-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configuring Enhanced Object Trac king Configuring Enhanced Obje ct Tracking Features Configuring HSRP Object Tracking Beginni ng in pri vileged EXEC mode, follo w these steps to conf igure a standb y HSRP group to track an object and change the HSRP p rio rit[...]

46-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configur in g Enhanced Object Trackin g Configuring Enh anced Object Trac king Features Configuring Other Tracking Characteristics Y ou can also use the enha nced object trac king for tracking ot her characteristics. • Y ou can track the reachability of an [...]

46-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configuring Enhanced Object Trac king Configuring Enhanced Obje ct Tracking Features Object tracking of IP SLAs operati ons allow s client s to track the output fr om IP SLAs objects and use this information to tr igger an actio n. Every IP SLAs operation mai[...]

46-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configur in g Enhanced Object Trackin g Configuring Enh anced Object Trac king Features This exampl e output sho ws wh ether a route is reachable: Switch(config)# track 3 500 reachability Switch(config)# end Switch# s how track 3 Track 3 Response Time Report[...]

46-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configuring Enhanced Object Trac king Configuring Enhanced Obje ct Tracking Features Beginning in pri vileged EXEC mod e, follo w these steps to conf igure a primary interface for DHCP: Configuring a Cisco IP SLAs Monitoring Agent and Track Object Beginni ng[...]

46-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configur in g Enhanced Object Trackin g Monitoring Enhanced Ob ject Tr ack ing Configuring a Routing Policy and Default Route Beginning in pri vileged EXEC mode, follo w these steps to configure a rout ing policy for backup stati c routing by usin g object t[...]

46-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configuring Enhanced Object Trac king Monitoring Enhanced Object Tra cking show track resolution Display the resolution of track ed parameters. show track timers Display tracke d polling interv al timers. T able 46-1 Commands f o r D ispl ayi ng T rack in g [...]

46-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 46 Configur in g Enhanced Object Trackin g Monitoring Enhanced Ob ject Tr ack ing[...]

CH A P T E R 47-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 47 Configuring Web Cache Services By Using WCCP This chapter describe s ho w to configure your Catalyst 3750-X or 35 60-X switch to redirect traf fic to wide-area application en gines (such as the Cisco Cache Engine 55 0) by using th e W eb Cache Communicat[...]

47-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 47 Configuring Web Cac he Services By Using WCCP Understanding WCCP Understanding WCCP The WCCP and Cisco cache engines (or other appl ication engines running WCCP) localize traff ic patterns in the net work, enabling content requests to be fulf illed locally . [...]

47-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 47 Configuring Web Cache Services By Using WCCP Understanding WCCP WCCP Negotiation In the ex change of WCCP protocol messages, the designated appl ication engi ne and th e WCCP-enabled switch nego tiate these items: • Forward ing method (the method b y which [...]

47-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 47 Configuring Web Cac he Services By Using WCCP Understanding WCCP Y ou can confi gure up to 8 service grou ps on a switch or switch stack and up to 32 cache engines per service group. WCCP maintains the pr iority of the se rvice group in th e group def inition[...]

47-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 47 Configuring Web Cache Services By Using WCCP Configuring WCCP • It distrib utes the WCCP information to an y switch that joins the st ack. • It programs its hardw are with th e WCCP information it pr ocesses. Stack members recei ve the WCCP information fr[...]

47-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 47 Configuring Web Cac he Services By Using WCCP Configuring WCCP • WCCP entries and PBR entries use the same TCAM re gion. WCCP is supported onl y on the templates that support PBR: access, routing, and dual IPv4/ v6 routing. • When TCAM entries are not av [...]

47-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 47 Configuring Web Cache Services By Using WCCP Configuring WCCP Command Purpose Step 1 configur e terminal Enter global conf iguration mode. Step 2 ip wccp { web-cache | service-number } [ group-addr ess gr oupaddr ess ] [ group-li st access-list ] [ red ire c [...]

47-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 47 Configuring Web Cac he Services By Using WCCP Configuring WCCP T o disable the web cache service, use the no ip wccp w eb-cache global confi guration command. T o disable inbound packet redirection, u se the no ip wccp web-cache r edirect in interface conf ig[...]

47-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 47 Configuring Web Cache Services By Using WCCP Configuring WCCP This exampl e sho ws how to conf igure SVIs and ho w to enable the web cache service with a multicast group list. VLA N 299 is created and conf igured with an IP address of 175.20.20.1 0. Gigabit E[...]

47-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 47 Configuring Web Cac he Services By Using WCCP Monitoring and Maintaining WCCP Monitoring and Maintaining WCCP T o monitor and maintain WCCP , use one or more of the pri vileged EXEC commands in Ta b l e 47-2 : Ta b l e 47 -2 Commands f or Monit oring and Mai[...]

CH A P T E R 48-1 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 48 Configuring IP Multicast Routing This chapter describes h ow to configu re IP multicast routing on the Catalyst 3750-X or 3560-X swit ch. IP multicasting is a more ef ficient way to us e ne twork resour ces, especially for bandwidth-i ntensi ve services [...]

48-2 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Understanding Cisco’s Impleme ntation of IP Multicast Routing Understanding Cisco’s Implementation of IP Multicast Routing The Cisco IOS software supports these pr otocols to implement IP multicast routing: • Internet G[...]

48-3 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Understanding Cisco’s Implementa tion of IP Multicast Routing Understanding IGMP T o participate in IP multicasting, multicast hosts, routers, and mul tilayer switches must hav e the IGMP operating. This protocol def ines t[...]

48-4 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Understanding Cisco’s Impleme ntation of IP Multicast Routing Understanding PIM PIM is called pr oto col-independent : regardless of the unicast ro uting protocols u sed to populate t he unicast routing table, PIM uses this[...]

48-5 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Understanding Cisco’s Implementa tion of IP Multicast Routing When a new recei ver on a previously pruned bran ch of the tree join s a multicast g roup, the PIM DM dev ice detects the ne w receiv er and immediately sends a [...]

48-6 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Understanding Cisco’s Impleme ntation of IP Multicast Routing The redundant PIM stub router to pology is not support ed. The redu ndant topology exists wh en there is more than one PIM router forwar ding multicast tr af fic[...]

48-7 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Understanding Cisco’s Implementa tion of IP Multicast Routing Auto-RP This proprietary feature eliminates the need to manually conf igure the RP information in e very router and multilayer switch in the netwo rk. For auto-R[...]

48-8 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Understanding Cisco’s Impleme ntation of IP Multicast Routing Multicast Forwarding and Reverse Path Check W ith unicast routing, routers and mu ltilayer switches forwar d traf fic through the n etwork alon g a sing le path [...]

48-9 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Understanding Cisco’s Implementa tion of IP Multicast Routing PIM uses both source trees and RP-rooted shared trees to f orward datagr ams (described in the “PIM DM” section o n page 48-4 and the “PIM-SM” section on[...]

48-10 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Multicast Routing and Switch Stacks CGMP is nec essary be cause the Layer 2 switch cannot distinguish between IP mu lticast data p a ckets and IGMP report messages, which are both at t he MA C-le vel and are addressed to the[...]

48-11 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing Default Multicast Routing Configuration Multicast Routing Configuration Guidelines T o av oid misconfiguring mu lticast routing on yo ur switch, re vie w the informati on in these sections: ?[...]

48-12 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing Sparse-mode groups in a mix ed PIMv1 and PIMv2 re gion are possible because the Auto-RP feature in PIMv1 interoperates with the PIMv2 RP featu re. Al though all PIMv2 de vices can also use PI[...]

48-13 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing In populating the multicast routin g table, dense-mode i nterfaces are alw ays added to the table. Sparse-mode interfaces are added to the table onl y when periodic join messages are recei ve[...]

48-14 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing T o disable multicasting, use the no ip multicast-routing distrib uted global conf iguration command. T o return to the def ault PIM versio n, use the no ip pim version interf ace configurati[...]

48-15 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing the IP addresses of sources from which they recei ve their t raf fic. Th e proposed standard approach for channel subscription si gnalling use IGMP in clude mo de membership reports, whi ch a[...]

48-16 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing Configuration Guidelines This section contains the guidelines for conf iguring SSM. Legacy Applications Within the SSM Range Restric tions Existing applications in a network pred ating SSM do[...]

48-17 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing Configuring SSM Beginni ng in pri vileged EXEC mod e, follo w these steps to conf igure SSM. This procedure is optional . Monitoring SSM Beginni ng in pri vile ged EXEC mode, use these comman[...]

48-18 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing • Before you can con figure and use SSM mappi ng with DNS lookups, you must b e able to add recor ds to a running D NS server . If you do not already ha ve a DNS serv er running, yo u need [...]

48-19 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing DNS-Based SSM Mapping Y ou can u se DNS-based SSM mappi ng to configure the last hop router to perform a re verse DNS lookup to determine sources sendi ng to groups. When DNS - based SSM mapp[...]

48-20 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing Configuring SSM Mapping • Config uring Static SSM Mapping, page 48 -20 (required) • Config uring DNS-Based SSM Mapping, page 48-20 (required) • Config uring Static T raff ic Forwarding [...]

48-21 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing Beginning in pri vileged EXEC mod e, follo w these steps to conf igure DNS-based SSM mapping: Configuring Static Traffic Forwarding with SSM Mapping Use static traf fic for warding with SSM m[...]

48-22 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing Monitoring SSM Mapping Use the privile ged EXEC commands in Ta b l e 48-3 to monitor SSM mapping. Go to this URL to see SSM mapping monit oring examples: http://www .cisco.com/en/US/prod ucts[...]

48-23 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing Enabling PIM Stub Routing Beginning in pri vileged EXEC mode, follo w these steps t o enable PIM stub routing on an interf ace. This procedure is optional . T o disable PIM s tub routing on a[...]

48-24 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing Use these pri vileged EXEC commands to display inf ormation about PIM stub co nfigur ation and status: • show ip pim interface displays the PIM stub that is enabled on each interface. • s[...]

48-25 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing Beginning in pri vileged EXEC mode, follow these steps to manually config ure the address of the RP . This procedure is optional. T o remove an RP address, use the no ip pi m rp-addr ess ip-a[...]

48-26 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing Configuring Auto-RP Auto-RP uses IP mu lticast to automate the distrib ution of g roup-to-RP mappings to all Cisco routers and multilayer switches in a PIM netw ork. It has these benef its: ?[...]

48-27 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing Beginning in pri vileged EXEC mode, follo w these steps to deploy Auto-RP in an e xisting sparse-mode cloud. This procedure is opti onal. Command Purpose Step 1 show running-config V erify th[...]

48-28 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing T o remove the PIM de vice configured as the candidate RP , use the no ip pim send-rp-announce interface- id global conf iguration command. T o remove the swit ch as the RP-mapping agent, use[...]

48-29 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing Beginni ng in pri vileged EXEC mode, follo w these steps to f ilter incoming RP an nouncement messages. This procedure is optional. T o remove a f ilter on incoming RP announcement messages, [...]

48-30 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing Switch(config)# access-list 20 deny 239.0.0.0 0.0.255.255 Switch(config)# access-list 20 pe rmit 224.0.0.0 15.255.255.255 In this e xample, the mapping agent accepts candidate RP announcement[...]

48-31 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing Figur e 48-5 Constraining PIMv2 BSR Messages Defining the IP Multicast Bounda ry Y ou define a m ulticast boundary to pre vent Auto -RP messages from en tering the PIM domain. Y ou create an [...]

48-32 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing This exampl e sho ws a portion of an IP mul ti cast boundary configuration that denies Auto-RP inform ation: Switch(config)# access-list 1 deny 224.0.1.39 Switch(config)# access-list 1 den y [...]

48-33 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring IP Multicast Routing Configuring Candidate RPs Y ou can configu re one or more candidate RPs. Similar to BSRs, the RPs should also hav e good connectivity to other devices and b e in the backbone port ion of the [...]

48-34 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring IP Multicast Routing This exampl e sho ws how to conf igure the switch to advertise itself as a candidate RP to the BSR in its PIM domain. Standard access list number 4 specifies th e group prefix associated with[...]

48-35 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Advanc ed PIM Feature s Monitoring the RP Mapping Information T o monitor the RP mapping inf ormation, use these comman ds in pri vileged EXEC mode: • show ip pim bsr displays i nformation about the elected BSR[...]

48-36 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Adva nce d PIM Features Figur e 48-6 Shar ed T ree and Source T r ee (Short est-P a th T ree) If the data rate warrants, leaf routers (routers w ithout an y do wnstream conne ctions) on the s hared tree can use t[...]

48-37 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Advanc ed PIM Feature s Delaying the Use of PIM Shortest-Path Tree The change from shared to source tr ee happens when the first data packet arri ves at the last-hop router (Router C in Figure 48-6 ). This change[...]

48-38 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Optio na l IGMP Feature s T o return to the def ault setting, use the no ip pim spt-t hreshold { kbps | infinity } global conf iguration command. Modifying the PIM Router-Query Message Interval PIM routers and mu[...]

48-39 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Optio nal IGM P Features • Changing th e IGMP Query Timeout for IGMPv2, page 48 -42 (optiona l) • Changing the Ma ximum Query Response Time for IGMPv2, page 48-43 (optional ) • Config uring the Switch as a [...]

48-40 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Optio na l IGMP Feature s Beginning in pri vileged EXEC mode, foll ow th ese steps to conf igure the switch to be a member of a group. This procedur e is optional. T o cancel membership in a group, use the no ip [...]

48-41 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Optio nal IGM P Features T o disable groups on an interf ace, use the no ip igmp access-group interface con figuration command. This exampl e sho ws how to conf igure hosts attached to a port as able to j oin onl[...]

48-42 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Optio na l IGMP Feature s T o return to the def ault setting, use the no ip ig mp version interface configuration command. Modifying the IGMP Host-Query Message Interval The switch periodically sends IGMP host-qu[...]

48-43 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Optio nal IGM P Features Y ou can confi gure the query in terval by entering t he show ip igm p interfac e interf ace-id priv ileged EXEC command. Beginning in pri vileged EXEC mode, follow these steps to change [...]

48-44 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Optional Multicast Routing Features Configuring the Switch as a Statically Connected Member Sometimes there is either no group memb er on a network se gment or a host cannot report its group membership by using I[...]

48-45 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Optional Multicast Routing Features Enabling CGMP Server Support The switch serves as a CGMP serv er for devices that do not support IGMP snooping b ut have CGMP client functionality . CGMP is a protocol used on [...]

48-46 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Optional Multicast Routing Features Configuring sdr Listener Support The MBONE is the small subset of Internet routers and hosts that ar e interconnected and capable of forwarding IP mult icast traf fic. Other mu[...]

48-47 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Optional Multicast Routing Features Beginni ng in pri vileged EXEC m ode, follow these steps to limit ho w long an sdr cache entry stays acti ve in the cache. This procedure is optional. T o return to the default[...]

48-48 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Optional Multicast Routing Features Figur e 48-7 Admi ni str atively -Scoped Boundar ies Y ou can def ine an administrati vely-scoped boun dary on a routed interface f or multicast group addresses. A standard acc[...]

48-49 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Basic DVMRP Interoperability Features T o remove t he boundary , use the no ip multicast boundary interface config uration command. This exampl e sho ws how to set up a boundary for all administrati vely-scoped a[...]

48-50 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Basic DVMRP Interoperabi lity Features Beginning in p rivile ged EXEC mod e , follo w these step s to configu re the sources that are adv ertised and the metrics that are us ed when D VMRP route-report messages a[...]

48-51 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Basic DVMRP Interoperability Features This exampl e sho ws how to conf igure D VMRP interoperability when the PI M dev ice and the D VMRP router are on the same network se gment. In this example, access li st 1 a[...]

48-52 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Basic DVMRP Interoperabi lity Features Beginning in pri vileged EXEC mode, follo w these steps to conf igure a D VMRP tunnel. This procedure is optio nal. Command Purpose Step 1 configur e terminal Enter g lobal [...]

48-53 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Basic DVMRP Interoperability Features T o disable the filter , use the no ip dvmrp accept-f ilter access-list-number [ di stance ] neighbor -list access-list-number interface conf iguration command. This exampl e[...]

48-54 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Advanced DVMRP Interoperability Features T o prev ent the default rout e advertisement, use the no ip dvmr p default-information interf ace confi guration command. Responding to mrinfo Requests The software answe[...]

48-55 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Advanced DVMRP Interoperability Feature s Cisco devices do not perfo rm D VM RP multicast routin g among each ot her , but they can exchange D VMRP routes. The D VMRP routes pro vide a multicast top ology that mi[...]

48-56 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Configur ing IP Multicast Routing Configuring Advanced DVMRP Interoperability Features Figur e 48-8 Leaf Nonpr uning D VMRP Neighbor Y ou can pre vent the switch from peering (communicating) with a D VMRP neighbor if that neighbor does not support D VMRP pru[...]

48-57 Catalyst 3750-X and 3560-X Switch Software Configuration Guide OL-21521-01 Chapter 48 Config uring IP Multicast Routing Configuring Advanced DVMRP Interoperability Feature s Figur e 48-9 Router Rejects N onpr uning D VMRP Neighb or Note that the ip dvmr p reject-non- pruners interface conf iguration command pre vents peer ing with neighbors o[...]