SMC Networks 100BASE-TX инструкция обслуживания

T igerSwitch 10/100 16-P ort F ast Ether net Switch ◆ 16 10B ASE-T/100B ASE-T X ports ◆ Optional 1000B ASE-X or 100B ASE-FX modules ◆ 8.8 Gbps of agg re gate b andwidth ◆ Non-blocking switching architecture ◆ Spanning T ree Protocol ◆ Up to four port trunks ◆ RADIUS and T A CA CS+ authenti cation ◆ Rate li miting fo r bandwi dth man[...]

[...]

38 T esla Irvine, CA 92618 Phone: (9 49) 679-8000 T igerSwitch 10/100 Installation Guide From SM C’ s T iger line of feat ure-rich workgro up LAN solutio ns July 2004 Pub. # 15 0000013500H[...]

Infor mation furnished b y SMC Netw orks, Inc . (SMC) is believ ed to be accurate and reliable . Howev er, no r e sponsibility i s assumed by SMC for its u se, nor for any infringements of patents or other right s of third parties which may result from its use. No license is g ranted by implication or ot herwise under any patent or patent rights of[...]

i L IMITED W ARRANTY Limited W ar ranty Statement: SMC Ne tworks, Inc . (“SMC ”) warra nts its p roducts to be free from d efects in w orkmanship and materials , under nor mal use and ser vice, for the applicable warranty term . All SMC products carry a standard 90-day limited warranty from the date of purc hase from SMC or its Author i zed R e[...]

ii WARRA NTIES EXCLUSIV E: IF AN SMC PR ODUC T DOES NOT OPERATE AS W ARRANTED ABO VE, CUSTOM ER’S SOLE REMED Y SHALL BE R EP AIR OR REPLA CEMENT OF THE PR OD UCT IN Q UESTION , AT SM C’S OPTI ON. THE FOREGOING W ARRANTIES AND REMEDIES ARE EXCLUSIVE AN D ARE IN LIEU OF ALL OTHER W ARRANTIES OR CONDITIONS , EXPRESS OR IMPLI E D , EITHER IN F A CT[...]

i Contents Chapter 1: Introduc tion 1-1 Key Featu res 1-1 Descripti on of Software Feature s 1-2 Sys tem Def ault s 1-5 Chapter 2: Initial Configuration 2-1 Connectin g to the Switch 2-1 Config uration Options 2-1 Requi red C onn ections 2-2 Remo te Co nnect ion s 2-3 Basi c Confi gura tion 2-3 Conso le Connection 2-3 Setting Pa sswords 2-4 Sett in[...]

Contents ii Console Port Settings 3-19 Telnet Setti ngs 3-21 Confi guring Event Logg ing 3-23 System Log Conf iguration 3-23 Remot e Logs Configurati on 3-25 Displ aying Log Mes sages 3-26 Resettin g the System 3-27 Setti ng the System Clo ck 3-27 Config uring SNTP 3-28 Setting th e Time Zone 3-29 Simple Network Managem ent Protocol 3-29 Settin g C[...]

Contents iii Setting Bro adcast Storm Thresholds 3-77 Config uring Port Mirroring 3-79 Config uring Rate Limits 3-80 Rate Li mit Granular ity 3-80 Rate Li mit Configurat ion 3- 81 Showin g Port Statistics 3-82 Address T able Settings 3-86 Setting Sta tic Addresses 3-86 Displ aying the Addr ess Table 3-87 Chang ing the Aging Time 3-89 Spanning Tree [...]

Contents iv Config uring IGMP Snoop ing and Query Pa rameters 3-133 Displ aying Interface s Attached to a M ulticast Rout er 3-135 Specify ing Static Interfac es for a Multicas t Router 3-136 Displ aying Port Memb ers of Multic ast Services 3-137 Assigni ng Ports to Multi cast Services 3-138 Chapter 4: Comma nd Line Interface 4-1 Using the Command [...]

Contents v reload 4- 22 end 4- 22 exit 4- 23 quit 4- 23 System M anagement C omm ands 4-24 Devic e D esi gnation Comm ands 4-24 prompt 4- 24 hostnam e 4-25 User Acce ss Command s 4-25 usernam e 4-26 enable p assword 4-27 IP Filter Comm ands 4-28 managem ent 4-28 show man agement 4-29 Web Serve r Commands 4-30 ip http po rt 4-30 ip http s erver 4-30[...]

Contents vi sntp s erver 4-51 sntp po ll 4-51 show snt p 4-52 clock t imezo ne 4-52 calend ar set 4-53 show cal endar 4-53 System Status Commands 4-54 light un it 4-54 show sta rtup-config 4-55 show runn ing-config 4-56 show sy stem 4-58 show use rs 4-58 show ver sion 4-59 Frame Si ze Commands 4-60 jumbo f rame 4-60 Flash/F ile Commands 4-61 copy 4[...]

Contents vii dot1x re-a uthenticate 4- 80 dot1x re-a uthenticatio n 4-80 dot1x tim eout quiet-perio d 4-81 dot1x tim eout re-authp eriod 4-81 dot1x tim eout tx-period 4-82 show d ot1x 4- 82 Access Control List C ommands 4-85 IP ACLs 4-86 access -list ip 4-86 permit, d eny (Standard ACL ) 4-87 permit, d eny (Extended AC L) 4-88 show ip a ccess-list [...]

Contents viii show i nter faces count ers 4-112 show i nterf aces sw itch port 4-11 3 Mirror Port Commands 4-115 port monitor 4-115 show po rt monitor 4-116 Rate L imit Command s 4-117 rate-lim it 4-117 rate-lim it granularity 4-118 show rate -limit 4-118 Link Aggreg ation Comm ands 4-119 channe l-group 4-120 lacp 4 -121 lacp sy stem- prior ity 4-1[...]

Contents ix switchpo rt mode 4-1 48 switchpo rt acceptable -frame-types 4-148 switchpo rt ingress-filteri ng 4-149 swit chport native vlan 4-150 switchpo rt allowed vla n 4-151 switchpo rt forbidden vlan 4-152 Displ aying VLAN Informa tion 4-153 show vla n 4-153 Config uring Private VLANs 4-154 private-vla n 4-155 priv ate vl an asso ciat ion 4-15 [...]

Contents x ip igmp snooping v ersion 4-178 show ip igmp snoopi ng 4-1 78 show ma c-address-table mu lticast 4-179 IGMP Q uery Comman ds (Layer 2) 4-180 ip igmp snooping q uerier 4-180 ip igmp snooping q uery-count 4-180 ip igmp snooping q uery-interval 4-1 81 ip igmp snooping q uery-max-res ponse-time 4-182 ip igmp snooping route r-port-expire-tim [...]

xi Tabl es Table 1-1. Key Featu res 1-1 Table 1-2. System Defa ults 1-5 Table 3-1. Configura tion Options 3-3 Table 3-2. Main Menu 3-4 Table 3-3. Logging Leve ls 3-24 Table 3-4. Compatib le Operating Syste m s 3-37 Table 3-5. 802.1x Statisti cs 3-51 Table 3-6. LACP Statist ics 3-73 Table 3-7. Display ing LACP Loc al Settings 3-74 Table 3-8. Display[...]

T ables xii Table 4-2 7. Authe ntication Sequen ce 4-67 Table 4-28. RADI U S Clie nt Comman ds 4-69 Table 4-2 9. TACAC S Commands 4-73 Table 4-3 0. Port Secu rity Commands 4-75 Table 4-3 1. 802.1x Port Authenticatio n 4-7 7 Table 4-3 3. IP ACLs 4-86 Table 4-3 2. Acces s Co ntrol Lists 4-86 Table 4-3 4. Egress Queue Priority Mapping 4-9 2 Table 4-3 [...]

xiii Figu res Figure 3-1. Home Page 3-2 Figure 3-2. Front Panel Indicators 3-3 Figure 3-3. Displayi ng System Inform ation 3-8 Figure 3-4. Displayi ng Switch Inform ation 3-10 Figure 3-5. Displ a ying Bridge Extension Configurati on 3-11 Figure 3-6. IP Confi guration 3-13 Figure 3-7. IP Configuration using DHCP 3-14 Figure 3-8. Operatio n Code Imag[...]

Figures xiv Figure 3-4 3. LACP Port Confi guration 3-71 Figure 3-4 4. Display ing LACP Port Co unters 3-73 Figure 3-4 5. Display ing LACP Port Intern al Informatio n 3-75 Figure 3-4 6. Display ing LACP Port Ne ighbors Information 3-76 Figure 3-4 7. Enabling Port Broadcast Control 3-78 Figure 3-4 8. Mirror Port Configuration 3-79 Figure 3-4 9. Rate [...]

1-1 Chapter 1: Introduction This switc h provides a b road range of features for Layer 2 switchi ng. It includes a manage ment agent that allows yo u to configur e the features listed in this man ual. The defau lt configurat ion can be used for most of t he features pr ovided by this switch . However , there are man y options t hat you shoul d conf[...]

Introduction 1-2 1 Description of Software F eatures The sw itch prov ides a wide ra nge of advanc ed perfor mance e nhancin g features . Flow cont rol elimina tes the loss of packets due to bottlene cks cause d by port satura tion. Broadc ast storm sup pression pr events broadc ast traffic storms f rom eng ulfing th e network . Port -based an d pr[...]

Description of So ftware Feature s 1-3 1 Port Mirroring – The swi tch can unobt rusively m irror traffic from any port to a monitor port. Y ou ca n then attach a prot ocol analyzer or RMON probe to this port to perform traffic anal ysis and verify connec tion inte grity . Port T runking – Po rts can be combin ed into an agg regate conn ection. [...]

Introduction 1-4 1 Virtual LANs – The switch sup ports up to 255 VLA Ns. A Virtual LAN is a colle ction of network n odes that share the sam e collision do main rega rdless of the ir physica l location or connection point in the netw ork. The swit ch suppor t s tagged VLANs based on the IEE E 802.1Q standard. Mem bers o f VLAN groups c an be dy n[...]

System Default s 1-5 1 System Defaults The switc h’s system defa ults are provided i n the configur ation file “Fact ory_Defau lt_Con fig.cfg.” To re set the switc h defaults, thi s file should be set as the start up configurat ion file (page 3-19). The f ollowi ng tabl e lists so me of t he basic sy stem defa ults . T able 1 -2. System Defau[...]

Introduction 1-6 1 Port Conf iguratio n Admin Status Enabled Auto-neg otiation Enabl ed Flow Con trol Disabled Port Capa bility 100BA SE-TX – 10 Mbps half duple x 10 Mbps full duplex 100 Mbps half dupl ex 100 Mbps full duple x Full-duple x flow con trol dis abled Symmetri c flow c ontrol disa bled Module P ort Capab ility 100BASE -FX – 100 Mbps[...]

System Default s 1-7 1 Traffic Prioritization Ingress Port Prio rity 0 Weighted Ro und R obin Queue: 0 1 2 3 Weight: 1 2 4 6 IP Preceden ce Priority Disabled IP DSCP Priority Disabled IP Port Priori ty Dis abled IP Settings IP Address 0.0.0.0 Subnet M ask 255.0.0.0 Default G ateway 0.0.0.0 DHCP Client: En abled BOOTP Dis abled Multicast Filte ring [...]

Introduction 1-8 1[...]

2-1 Chapter 2: Initia l Configuration Connecting to the Switch Configurati on O ptions The switc h includes a bui lt-in netwo rk manageme nt agent. The agent offers a var iety of mana gement options, including SNMP , RM ON and a Web-base d inter face. A PC may also be connecte d directly to th e switch for con figurat ion and monit oring via a comm[...]

Initial Configur ation 2-2 2 • Configu re up to 4 stati c or LACP trunk s • Enable po rt mirrorin g • Set br oadcast storm c ontrol o n any port • Displa y system info rmation and statistics Required Connections The switch pr ovides an R S-232 seri al port that enab les a conne ction to a PC or termin al for monitori ng and config uring the[...]

Basic Co n figura tion 2-3 2 Remote Connections Prior to accessi ng the s witch’s on board age nt via a netwo rk connec tion, y ou must fi rst conf igure it wit h a val id IP address , subnet mask, and def ault g ateway using a console connectio n, DHCP or BO OTP proto col. The IP address f o r this s w itch is obt ained via DHCP by default. T o [...]

Initial Configur ation 2-4 2 Setting Passwords Note: If this is yo ur first time to log into the CLI program, y ou should define new passwords for both default user names us ing the “u sername” command, record them and put them in a safe place . Passwo rds can consi st of up to 8 alph anumeri c characters an d are case s ensitive. T o pre vent [...]

Basic Co n figura tion 2-5 2 Before y ou can assign an IP address t o the switch , you must ob t a in the follo wing inform ation from your network adm inistrat or: • I P address fo r the swit ch • Default ga teway for th e network • Network ma sk fo r this network T o assign an IP address to the switch , complete the followin g steps: 1. Fro[...]

Initial Configur ation 2-6 2 5. W ai t a few minut es, and then c heck the IP con figuratio n settings by t yping the “show ip int erface” co mmand. Press <Enter >. 6. Then save y our config uration ch anges by typi ng “copy run ning-conf ig startup-co nfig.” Enter the start up file name and press <E nter>. Enabling SNMP Managem[...]

Basic Co n figura tion 2-7 2 T o configure a community string, complete the following steps: 1. From the Pr ivileged Exe c level global con figuratio n mode prom pt, type “snmp -server comm unity stri ng mode ,” where “stri ng” is the com munity acces s string an d “mode” is rw (read/write) or ro (rea d only). Pres s <Enter>. (Not[...]

Initial Configur ation 2-8 2 2. Enter the na me of the start-up file. Press <E nter>. Managing System Files The s witch ’s fl ash memo ry supp orts three types of syste m file s that can be ma naged by the CLI prog ram, Web inter face, or SNMP . The sw itch’s file system allow s files to be upload ed and downl oaded, cop ied, deleted , an[...]

3-1 Chapter 3: Config urin g the Switch Using the Web In terface This swi tch prov ides an em bedded HTTP Web agent. U sing a Web browser you can configure t he switch and view st atistics to monito r network activity . The Web agent can be acce ssed by any comput er on the netwo rk using a standar d Web browser (Interne t Explorer 5.0 or above, or[...]

Configuri ng the Switch 3-2 3 Navigating the Web Brow ser Interface T o access the web-brow ser interfac e you mus t first enter a us er name and password . The adm inistrator h as Rea d/Write acce ss to all co nfigurati on paramete rs and statisti cs. The defa ult user nam e and passwor d for the ad ministrato r is “admin .” Home Page When you[...]

Panel Displa y 3-3 3 Configurati on O ptions Configu rable parame ters h ave a dial og box or a drop -down l ist. Once a confi guration change ha s been mad e on a page, be sur e to click on the App ly button to confirm the new set ting. The follow ing table sum marizes the web page configur ation buttons. Notes: 1. To ensu re proper screen ref res[...]

Configuri ng the Switch 3-4 3 Main Menu Using th e onboard we b agent, you can define sy stem paramet ers, manage an d contro l the switch, and a ll its ports, or monitor net work cond itions. The f ollowing table briefly des cribes the selections av ailable fr om this program . T able 3- 2. Main Me nu Menu Descr iption Page System 3-8 System Infor[...]

Main Menu 3-5 3 SSH 3-39 Sett ings Con figur es Secure Shell s erver s ettings 3-43 Host-Key Settings Generates th e host key pair (pub lic and priv ate) 3-41 Port Secu rity Configure s per port security , in cluding st atus, resp onse for security b reach, and maxim um allowe d MAC ad dresses 3-44 802.1x Port auth entication 3-46 Informatio n Disp[...]

Configuri ng the Switch 3-6 3 Input Trun k Configu ration Sets the i nput ra te limit for each trun k 3-8 1 Output Po rt Configu ration Sets the o utput rate limit for e ach port 3-81 Output Trunk C onfigurati on Sets the o utput rate limit for e ach trunk 3-81 Port Stati stics Lists Ethe rnet and R MON port statist ics 3-82 Address T abl e 3-86 St[...]

Main Menu 3-7 3 Port Infor mation Shows VL AN po rt type, an d associat ed primary or secon dary VLANs 3-1 17 Port Conf iguratio n Sets t he private VLAN inte rface type , and asso ciates the interfaces with a priv ate VLAN 3-1 18 Trunk Info rmation Shows VLAN po rt type, an d associat ed prim ary or sec ondary VLANs 3-1 17 Trunk Con figuration Set[...]

Configuri ng the Switch 3-8 3 Basic Configuration Displaying Syste m Information Y ou ca n easily ident ify the syst em by displ aying the de vice name , location and contac t information. Field Attributes • Syst em Name – Nam e assigned to the switch s ystem. • Object ID – MIB II object ID for switch’s net work man agement su bsystem. ?[...]

Basic Co n figura tion 3-9 3 CLI – S pecify the hos tname, locat ion and contac t inf ormati on. Displaying Sw it ch Hardware/Software Versions Use the Sw itch Inform ation page to disp lay hardwar e/firmwar e version nu mbers for the main board and management software, as well as the power status of the system. Field Attributes Main Board • Se[...]

Configuri ng the Switch 3-10 3 These addi tional paramet ers are dis played for the CLI. • Unit ID – Unit number in stack. • Redundant Power Statu s – Displays the status of the re dundant power supp ly. We b – Click System, Switch I n formation. Figure 3- 4. D isplaying S witch I nformatio n CLI – Use the foll owing comm and to dis pla[...]

Basic Co n figura tion 3-11 3 Displaying Bridge Extension Capabil ities The Bridg e MIB includes ex tensions for manage d devices that support Multi cast Fil terin g, T raf fic Cl asses, a nd Vi rtual LANs. Y ou c an acce ss thes e exte nsions t o dis play defau lt setti ngs for the ke y variabl es. Field Attributes • Extended Multicast Filtering[...]

Configuri ng the Switch 3-12 3 CLI – Enter the fo llowing com mand. Setting the Switch’s IP Address Thi s sectio n descri bes how to co nfigur e an IP inter face for manageme nt acces s over the networ k. The IP addres s for th is switch is obtained v ia DH CP by de fault. T o manuall y configure an address, you need to cha nge the swi tch’s [...]

Basic Co n figura tion 3-13 3 Manual Co nfiguration We b – Click Sy stem, IP Conf iguration. Selec t the VLAN throug h which th e manage ment station is attac hed, set the IP Ad dress Mode to “S tatic,” enter the IP address , subnet ma sk and gateway, t hen click Appl y . Figure 3-6. IP Configuration CLI – S pec ify the manag ement inte rfa[...]

Configuri ng the Switch 3-14 3 Using DHCP/BOOTP If your network pr o vides DHCP/BOOTP services, you can config u re the switc h to be dyna micall y confi gured by th ese serv ices. We b – Click Sy stem, IP Conf iguration. Specify the VLAN t o which the mana gement statio n is attached, set the IP Address Mode to DHCP or BOO TP . Click Apply to sa[...]

Basic Co n figura tion 3-15 3 We b – If the a d dress assign e d by DHCP is n o longer functioning, you will n ot be able to rene w the IP settin gs via the web int erface. Y ou can only re start DHCP service vi a the web int erface if the cur rent addre ss is still avai lable. CLI – Enter t h e foll o wing c o mmand to restart DHCP service. Ma[...]

Configuri ng the Switch 3-16 3 Downloadi ng System Software fr om a Server When dow nloadin g runtime cod e, you can spec ify the des tination file na me to replace th e current im age, or first dow nload the fil e using a different nam e from the current ru ntime code f ile, and then set the new file as the startup file. We b –Cl ick S yst em, F[...]

Basic Co n figura tion 3-17 3 T o delete a file select Syste m , File, Delete. Sel e ct the file name fro m the given list by checkin g the tick box an d click Appl y . Note that t he file currently designated as the startup code cannot be deleted. Figure 3-10. D eleting Files CLI – T o downlo ad new firmw are form a TFTP se rver , enter the IP a[...]

Configuri ng the Switch 3-18 3 - startup-confi g to tftp – Copies the st artup conf iguration to a TF TP server. - tftp to file – Cop ies a file from a TFTP server to th e switch. - tftp to runn in g- c onfig – Copies a file from a TF TP server to the running co nfig. - tftp to sta r tup-c o nfig – Copies a file from a TFTP s erver to the s[...]

Basic Co n figura tion 3-19 3 Note that yo u can also select any co nfiguration f ile as the start-u p configurat ion by using the Sy stem/File/ Set S tart-Up page. Figure 3-12. Setting the Star tup Configuration Setting s CLI – Enter the IP ad dress of the TFTP s erver , speci fy the s ource file on the ser ver , set the startup file name on th [...]

Configuri ng the Switch 3-20 3 • Password Threshold – Sets the password intrus ion thresh old, which lim its the number of failed log on attem pts. When the logon attem pt thres hold is reach ed, the system interface be comes silen t for a specif ied amount of time (set by the Silent Time para meter) befo re allowing the ne xt logon at tempt. ([...]

Basic Co n figura tion 3-21 3 CLI – Enter Line Co nfigurati on mode for the console, then specify the con nection parameter s as require d. T o display the cu rrent cons ole port sett ings, use the s how line command fr om the Normal Exec l evel. Telnet Set t ings Y ou ca n access the on board con figuratio n program over the netwo rk using T eln[...]

Configuri ng the Switch 3-22 3 • Password Threshold – Sets the password intrus ion thresh old, which lim its the number of failed log on attem pts. When the logon attem pt thres hold is reach ed, the system interface be comes silen t for a specif ied amount of time (set by the Silent Time para meter) befo re allowing the ne xt logon at tempt. ([...]

Basic Co n figura tion 3-23 3 CLI – Enter Line Co nfigurat ion mode for a virtual termin al, then specif y the connection parameters as required. T o display the current virtu al terminal setti ngs, use the sho w line comma nd from th e Normal Ex ec leve l. Configuring Event Logging The sw itch allow s you to c ontrol the logging of error m essag[...]

Configuri ng the Switch 3-24 3 • RAM Level – Lim its log m essage s saved to the s witch’s temporary RAM memory for all l e vels up to the specified level. For example, if level 7 is specifie d , all messages from l evel 0 to level 7 will be logged to RAM. (Rang e : 0-7 , Default: 6) Note: The Flash Level m ust be equal to o r less than the R[...]

Basic Co n figura tion 3-25 3 Remote Logs Configuration The Remot e Logs page allo ws you to co nfigure the logg ing of mess ages that are sent to sysl og serve rs or other ma nagemen t stations. Y o u can also lim it the error messag es sent to only t hose messa ges below a specified le vel. Command Attributes • Remote Log St atus – Enables/ d[...]

Configuri ng the Switch 3-26 3 CLI – Enter the sy slog server host IP addr ess, choose t he facility type and set the logging trap . Displaying Log Me ssages The Logs page al lows you to scroll throu gh the logge d system an d event mess ages. The switc h can store up to 2048 log entr ies in temporar y random ac cess mem ory (RAM; i. e., memory f[...]

Basic Co n figura tion 3-27 3 CLI – This exam ple shows t hat system logging is ena bled, the me ssage leve l for flash me mory is “error s” (i.e., de fault level 3 - 0 ), the message le vel for RAM is “debugg ing” (i.e., de fault level 7 - 0), a nd lists one samp le error . Resetting the Syste m We b – Click Sy stem, Rese t to reboot t[...]

Configuri ng the Switch 3-28 3 Configuring SNTP Y ou ca n configur e the switch to send time sy nchroniza tion reque sts to time server s. Command Attributes • SNTP Client – Config ures the switch to operate as an SNTP client. This requires at least o ne time serv er to be spec ified in the SNTP S erver field. (Defaul t: Disabled) • SNTP Poll[...]

Simple Networ k Management Prot ocol 3-29 3 Setting the T ime Zone SNT P us es Coor dinate d Unive rsal T i me (or UT C, for merly G reenwic h Mean Ti me, or GMT) based on the time a t the Earth’s prim e meridia n, zero deg rees long itude. T o display a t ime corresp onding to you r local tim e, you must in dicate the num ber of hours and minute[...]

Configuri ng the Switch 3-30 3 comm unity strin g for authen ticatio n. The opt ions for con figuring com muni ty strings, trap funct ions, and res tricting ac cess to clients wi th specifie d IP addresse s are described in t he followi ng sec tions. Setting C ommunity Access St rings Y ou m ay config ure up to five communi ty strings authorize d f[...]

Simple Networ k Management Prot ocol 3-31 3 Specifying Trap Managers and Trap Types T raps i ndicating s tatus change s are issue d by the s witch to sp ecified trap m anager s. Y ou m ust specify trap manage rs so that ke y events are rep orted by this sw itch to your ma nageme nt station (using n etwork man agemen t platforms such a s HP OpenVie [...]

Configuri ng the Switch 3-32 3 User Authentication Y ou can restrict management access to this s witch using the following o ptions: • User Accounts – Manually configure access rights on the switch for specified users. • Authent ication Set tings – Use re mote auth entication to configure a ccess rights. • HTTPS Set tings – Provide a s [...]

User Authenticati on 3-33 3 We b – Click Se curity , User Acco unts. T o configure a new user acc ount, specif y a user nam e, select th e user ’s access leve l, then enter a password and co nfirm it. Click Add to save the new user accoun t and add it to the Account L ist. T o change the password for a specific us er , enter the user name and n[...]

Configuri ng the Switch 3-34 3 Configuring Local/Remote Logon Authenti cation Use the Authe ntication Se ttings m enu to restrict m anageme nt acc ess bas ed on specifie d user n ames and passw ords. Y ou can manu ally con figure a ccess rights on the switc h, or yo u can us e a re mote acce ss aut henti cation server b ased on RADIUS or T ACAC S+ [...]

User Authenticati on 3-35 3 Command Attributes • Authen tication – Sel ect th e authe ntic ation, or aut hentic ation s equen ce requ ired: - Local – User authenticatio n is performed only locally by the switch. - Radi us – User authent ication is per formed us ing a RADIUS s erver only . - TACACS – Use r authentication is performe d usin[...]

Configuri ng the Switch 3-36 3 We b – Click Securit y , Authentication Sett ings. T o configure local or remote authenti cation pre ferences, sp ecify the au thenticat ion seque nce (i.e., one t o three methods), fill in the par a meters f or RADIUS or T ACACS+ authenti cation if selected, and click Ap ply . Figure 3-24. Auth entication Sett ings[...]

User Authenticati on 3-37 3 Configuring HTTPS Y ou ca n configur e the switch to e nable the Sec ure Hyperte xt T rans fer Protocol (HTTPS ) over the Secu re Socket Lay er (SSL) , providing se cure acce ss (i.e., an encrypt ed con nection) t o the s witch’s web interf ace. Command Usage • Both the HTTP and HTTP S service can be enabled inde pen[...]

Configuri ng the Switch 3-38 3 We b – Cl ick Securi ty , H TTPS Settings . Enable HTTPS a nd specify t he port number , then c lick App ly . Figure 3-25. HTTPS Se ttings CLI – This examp le enables the HTTP secu re server and modifies the po rt number. Replac ing the Default Secu re-site Certificate When you log onto the we b interface us ing H[...]

User Authenticati on 3-39 3 Configuring the Secure Shell The Berkl ey-standard in cludes rem ote access tools origin ally designe d for Unix systems. Some of the se tools hav e also been imp lemente d for Microsoft Wi ndows and other environmen ts. These tools, including co mmands su ch as rlo gin ( remote login), rsh (remote she ll), and rcp ( rem[...]

Configuri ng the Switch 3-40 3 3. Import Client ’s Public Key to the Switch – Use t he copy tf t p public-ke y comm and (page 4-61) to copy a file containi ng the public ke y for all the SSH client’s granted managem ent acces s to the switch. (Note that these clients must be conf igured local ly on t he swit ch via t he User Accoun ts p age a[...]

User Authenticati on 3-41 3 Generatin g the Host Key Pair A host pub lic/privat e key pair is used to provide secure com municat ions betwe en an SSH client and the switc h. Af ter gene rati ng this key p air , yo u must provide the ho st public key to SSH clients and imp ort the clie nt’s public key to the sw itch as described in the proce eding[...]

Configuri ng the Switch 3-42 3 We b – Click Security , SSH, Host-Key Settings. Se lect t h e host-key type from the drop-down b o x, select the option to save the host key from memor y to fla sh (if required ) prior to generat ing the key , and th en click Gene rate. Figure 3-2 6. SSH H ost-Key Settings CLI – Th is exa mple ge nerate s a hos t-[...]

User Authenticati on 3-43 3 Configuring the SSH Server The SSH se rver include s basic se ttings for au thentication . Field Attributes • SSH Server Status – Allo ws you to enable /disable the S SH server on the swi tch. (Def ault: Disab led) • Version – The Secure Shell versio n number . Vers ion 2.0 is dis playe d, but the switch supports[...]

Configuri ng the Switch 3-44 3 CLI – This examp le enables SSH, sets the authen tication parame ters, and dis plays the cur rent confi guration. It shows that the administ rator has made a connec tion via SHH, and then disables this connectio n. Configuring Port Securi ty Port securit y is a feature that allows you t o configure a sw itch port wi[...]

User Authenticati on 3-45 3 • I f a port is dis abled (shut d own) du e to a se curit y viol ation, it mus t be ma nually re-enab led from the Por t/Port Configu ration pag e (page 3-64) . Command Attributes • Port – Port num ber. • Name – Descr iptive t ext (page 4 -105). • Action – I n dicates th e action to be take n when a port se[...]

Configuri ng the Switch 3-46 3 Configuring 802. 1x Port Authentication Netw ork swi tches can pr ovide op en and eas y acce ss to netw ork resou rces by simply attac hing a client P C. Although this automatic co nfigurat ion and acce ss is a desirabl e feature, it also allows un authorized pe rsonnel to easily intrude and possibly gain acces s to s[...]

User Authenticati on 3-47 3 • The RAD IUS serve r and client also have t o support th e same EA P authentica tion type – MD 5. (Some cl ients have native suppo rt in Windows , otherw ise the dot1x client mus t support i t.) Displaying 802.1x Global Setti ngs The 802.1x protoc ol prov ides c lient authen ticat ion. Command Attributes • 802.1x [...]

Configuri ng the Switch 3-48 3 Configuring 80 2.1x Global Settings The 802.1x protoc ol prov ides c lient authen ticat ion. Command Attributes • 802.1x Sy stem Authen tication Co ntrol – Se ts the global setti ng for 802.1x . (Def ault: Disab led) We b – Se lect Security , 802. 1x, Configur ation. Enabl e 802.1x glob ally for the switch, and [...]

User Authenticati on 3-49 3 • Max-Req – Sets the maxi mum num ber of times the switch port will re transmit a n EAP request pack et to the client before it ti me s out the authentication sessio n. (Range: 1 -10; Default 2) • Quiet Period – Se ts the time th at a swi tch po rt wai ts after the Ma x Reques t Count has been ex ceede d before a[...]

Configuri ng the Switch 3-50 3 CLI – Th is exa mple se ts th e 802.1 x para meters on por t 2. For a descri ptio n of th e addition al fields disp layed in this exam ple, see “ show dot1 x” on page 4-82. Console(config)#interface ethernet 1/2 4-104 Console(config-if)#dot1x port-control aut o 4-79 Console(config-if)#dot1x re-authenticatio n 4-[...]

User Authenticati on 3-51 3 Display ing 802.1x Statistics Thi s switch can di splay s tati stics for dot 1x prot ocol e xchange s for any port . St ati stical V a lues T able 3-5. 802.1x St atistics Paramete r Descripti on Rx EAPO L Start The numb er of EAP OL Start f rames that have been rece ived by thi s Authentic ator. Rx EAPO L Logoff The numb[...]

Configuri ng the Switch 3-52 3 We b – Select S ecurity , 802.1x, S ta tistics. Select the re q uired por t and then click Query . Click Refresh to u pdate t h e st atistics. Figu re 3-3 2. Disp laying 802.1x P ort Sta tisti cs CLI – This examp le displays t he 802.1x statistic s for port 4. Console#show dot1x statistics interface e thernet 1/4 [...]

Acces s Con trol List s 3-53 3 Access Control Lists Access C ontrol Li sts (ACL) pr ovide packe t filtering f or IP fram es (based on addr ess, protocol , Layer 4 protoc ol port numbe r or TCP contr ol code) or any fram es (based on MAC address or Etherne t type). To filter inc oming pa ckets, fir st create a n access list, add th e required rules [...]

Configuri ng the Switch 3-54 3 Setting the ACL Name and Type Use the AC L Configurat ion page to design ate the nam e and type of an ACL. Command Attributes • Name – Name of the AC L. (Maximu m length: 16 ch aracters ) • Type – There are three filt ering modes: - Standa rd : IP ACL mod e that filters pac kets base d on the sou rce IP addres[...]

Acces s Con trol List s 3-55 3 Configuring a Standard IP ACL Command Attributes • Action – An ACL can con tain all permit rules or all deny r ules. (Defau lt: Permit) • Address Typ e – Specifies the so urce IP ad dress. Use “An y” to incl ude all possible address es, “Host” t o specify a s pecific hos t address i n the Addr ess fiel[...]

Configuri ng the Switch 3-56 3 Configuring an Extended IP ACL Command Attributes • Action – An ACL can con tain either all permit rules or all deny rules. (Def ault: P ermi t rule s) • Source/D estination Add ress Type – Specif ies th e sourc e or de stinat ion IP address . Use “Any” to include al l possible add resses, “H ost” to s[...]

Acces s Con trol List s 3-57 3 We b – S pecify the action (i.e., Per mit or Deny ). S pecify the source an d/or destinat ion addres ses. Select th e address type ( Any , Host, or IP). If you select “Host,” enter a specific address . If you selec t “IP ,” enter a subnet addre ss and the mask for an address r ange. Set any other requir ed c[...]

Configuri ng the Switch 3-58 3 Configuring a M AC ACL Command Attributes • Action – An ACL can con tain all permit rules or all deny r ules. (Def ault: P ermi t rule s) • Source/D estination Add ress Type – U se “Any” to inclu de all possi ble address es, “Host” to indicate a sp ecific MAC ad dress, or “MA C” to speci fy an addr[...]

Acces s Con trol List s 3-59 3 CLI – This rule pe rmits packets from any so urce MAC address to the destinat ion address 00-e0-29-9 4-34-de w here the Eth ernet type is 0800 . Binding a Port to an Access Control Lis t After configuri ng Access Co ntrol Lists (ACL ), you should bi nd them to th e ports that need to filt er traffic. Y ou can assign[...]

Configuri ng the Switch 3-60 3 Filtering Addresses for M anagement Access Y ou cr eate a list of up t o 16 IP address es or IP add ress groups tha t are allowed access to t h e switc h thro u gh th e web inte rface, SNMP , or T elnet. Command Usage • The ma nagemen t interfa ces are o pen to all IP ad dresses b y defau lt. Once you add an entry t[...]

Filtering Addre sses for Manage ment Access 3-61 3 We b – Click Securi ty , IP Filter . Enter the IP addresses or range of add resses, an d click Add I P Filtering Entry t o update the filter list. Figure 3-38. C reating a We b IP Filter List CLI – This examp le allows SNM P access for a specifi c client. Console(config)#management snmp-client [...]

Configuri ng the Switch 3-62 3 Port Configuration Displaying Connect ion Status Y ou ca n use the Port Information or T ru nk Informat ion pages to displ ay the curren t connect ion status, including link s tate, speed/ duplex m ode, flow con trol, and auto-n egotiation. Field Attributes (Web) • Name – Inte rface la bel. • Type – Indica tes[...]

Port Confi gurat ion 3-63 3 Field Attributes (CLI) Bas ic In forma tio n: • Port type – Indicate s the port type. (100BASE-TX , 1000BASE-T, or S FP) • MAC address – The physi cal layer add ress for th is port. (To acces s this item on the web, see “Setting the Sw itch’s IP Addr ess” on pag e 3-12.) Conf igurat ion: • Name – Inte r[...]

Configuri ng the Switch 3-64 3 CLI – This exam ple shows t he connecti on status for Port 5. Configuring I nterface Connections Y ou can use the Po rt Configur ation or Trunk Co nfigurati on page to e nable/disa ble an interface, set auto-ne gotiation and th e interface capab ilities to adve rtise, or manua lly fix the spe ed, duplex mod e, and f[...]

Port Confi gurat ion 3-65 3 - Sym (Gig abit only) - Ch eck this item t o transmit and r eceive paus e frames, or clear it to auto-nego tiate the se nder and r eceiver for asymmet ric pause frames. ( The c urrent switc h chip only su pports symm etric pau se frames . ) - FC - Suppor ts flow control Flow cont rol can elimi nate frame loss by “block[...]

Configuri ng the Switch 3-66 3 Creating Tr unk Groups Y ou ca n create mu ltiple links between de vices that w ork as one virtu al, aggreg ate link. A por t trunk offers a drama tic increase in bandwi dth for network se gments where b ottlenec ks exist , as w ell as pr oviding a fault-to lerant li nk betw een tw o devices. Y ou can create up to fou[...]

Port Confi gurat ion 3-67 3 Statically Configuring a Trunk Command Usage • When co nfiguring static tr unks, y ou may no t be able to link sw itches of different types , dependi ng on the man ufacturer’ s implemen tation. However, n ote that the stat ic trunks on th is switch are Ci sco EtherCh annel compatible. • To avoid cr eating a loop in[...]

Configuri ng the Switch 3-68 3 CLI – This exam ple crea tes trun k 2 wi th port s 1 and 2. Jus t co nnect th ese port s to two static trun k ports on anoth er switch to fo rm a trunk. Enabling LACP o n Selected Ports Command Usage • To avoid cr eating a loop in the networ k, be sure you enabl e LACP befor e connecti ng the port s, and also d is[...]

Port Confi gurat ion 3-69 3 We b – Click Po rt, LACP , Configurati on. Select any of the switch po rts from the scroll-dow n port list and click Add. After y ou have comp leted ad ding por t s to the member list, click Apply . Figu re 3-4 2. LA CP Conf igur ation CLI – The follo wing examp le enables LACP for por ts 1 to 6. Just con nect these [...]

Configuri ng the Switch 3-70 3 Configuring LACP Pa rameters Dynami cally Creating a Por t Channel – Ports assigne d to a comm on port chann el must meet the followi ng criteria: • Ports must have the same LACP System Priority . • Ports must have the same LACP port Admin Key. • Howeve r, if the “port cha nnel” Adm in Key is set (p age 4-[...]

Port Confi gurat ion 3-71 3 We b – Click Port, L ACP , Aggr egation Po rt. Set the System Priority , Adm in Key , and Por t Priori ty for t he Port Ac tor . Y ou can op tional ly con figure t hese sett ings fo r the Por t Part ner . (B e aware that t hese se ttings only affe ct the adminis trati ve st ate of the partner , and will not take effect[...]

Configuri ng the Switch 3-72 3 CLI – The followi ng exampl e configures LACP paramet ers for ports 1-4. Ports 1-4 are used as active me mbers of the LA G . Console(config)#interface ethernet 1/1 4-104 Console(config-if)#lacp actor system-prio rity 3 4-122 Console(config-if)#lacp actor admin-key 1 20 4-123 Console(config-if)#lacp actor port-priori[...]

Port Confi gurat ion 3-73 3 Displaying LACP Port Cou nters Y ou ca n display statist ics for LACP protocol m essages . We b – Click Port, L A CP , Port Counters In formation. Select a member po rt to display the corres ponding information . Figure 3-44. D isplaying LAC P Port Counter s CLI – The followi ng exampl e displays LACP coun ters. T ab[...]

Configuri ng the Switch 3-74 3 Displaying LACP Settings and Status for the Local Side Y ou ca n display co nfigurati on settings an d the operat ional state for th e local side of an link aggreg ation. T able 3 -7. Display ing LACP Local S ettings Field Descr iption Oper Key Cu rrent opera tional val ue of the k ey for the aggregati on port. Admin [...]

Port Confi gurat ion 3-75 3 We b – Click Port, L ACP , Port Inte rnal Information. Sele c t a p ort c h annel t o disp lay the corres ponding information . Figur e 3-45. Displaying LACP Port Int ernal Informat ion CLI – The followi ng exampl e displays the LACP configu ration sett ings and operat ional state for the lo cal side of por t channel[...]

Configuri ng the Switch 3-76 3 Displaying LACP Settings and Status for the Remote Side Y ou ca n display co nfigurati on settings an d the operat ional state for the re mote side of an link ag gregation. We b – Click Port , LACP , Port Neighbo rs Information . Select a port channel to display t he correspo nding info rmation. Figure 3-46. Display[...]

Port Confi gurat ion 3-77 3 CLI – The followi ng exampl e displays the LACP configu ration sett ings and operat ional state for the re mote side of po rt channel 1. Setting Broadcast Storm Thresholds Broadca st storms m ay occur whe n a device on your netw ork is malfunc tioning, or if applicat ion program s are not we ll designed or pro perly co[...]

Configuri ng the Switch 3-78 3 We b – Click Port, Po rt/T runk Broa d cast Contro l. Set the thresho ld , mark the Enabled field for the des ired inte rface and click Apply . Figure 3-47 . Enabling Port Broad cast Contro l CLI – S pec ify any inter face, and then enter the thre shold. The f ollowing d isables broadca st storm cont rol for port [...]

Port Confi gurat ion 3-79 3 Configuring Port Mirrorin g Y ou ca n mirror traffic fro m any source port to a target port for re al-time an alysis. Y ou can then attach a logic an alyzer o r RMON prob e to the target port and s tudy the traf f ic crossing the source port in a completel y unobtrus ive mann er . Command Usage • Monitor port speed sh [...]

Configuri ng the Switch 3-80 3 Configuring Rat e Limits This funct ion allows th e network ma nager to cont rol the maxim um rate for traffic transmi tted or receive d on a port. Rat e limiting is co nfigured on ports at the edge of a network to limit traffic coming into or out of the ne twork. Traffic that falls within t he rate limit is t ransmit[...]

Port Confi gurat ion 3-81 3 Rate Limit Co nfiguration Use the rate limit config uration pages to apply rate lim iting. Command Usage • Input and output rate limi t can be enabl ed or disabled for individual interfaces . Command Attributes • Port/Trunk – D isplays the po rt number. • Rate Limi t Status – Enable s or disables the r ate limi[...]

Configuri ng the Switch 3-82 3 Showing Port Statistics Y ou ca n display stan dard statistics on network traffic fro m the Interfac es Grou p and Ethernet- like MIBs, as well as a detailed bre akdown of tra f f ic based on the R MON MIB. Inter faces and Et hernet-like stati stics display errors on the traffic passing throug h each port. Thi s infor[...]

Port Confi gurat ion 3-83 3 Transmit Discard ed Packet s The numbe r of out bound p ackets w hich were chosen to be discarded even though no errors ha d been de tected to preven t their bein g transmit ted. One poss ible reaso n for disca rding such a packet could b e to free up buffer spa ce. Transmit Erro rs The nu mber of outb ound pack ets that[...]

Configuri ng the Switch 3-84 3 Received Frames Th e total num ber of fra mes (bad, broadcast and m ulticast) re ceived. Broadcas t Frames The total number of good fram es receive d that were direc ted to the broadcas t address. Note that this do es not incl ude multic ast packe ts. Multicast Frames The total number of good frames rec eived that wer[...]

Port Confi gurat ion 3-85 3 We b – Click Po rt, Port S tatistics. Se lect the requ ired interface, and click Query . Y o u can also use the Refres h button at the bottom of the page to update th e screen. Figure 3-51 . Port Statistics[...]

Configuri ng the Switch 3-86 3 CLI – Th is exa mple show s sta tisti cs for port 13 . Address Table Settings Switche s store the add resses for all know n devices. This informat ion is used to pass traffic directly between the inbo und and out bound por ts. All the address es learned by monito ring traffic are stored in the dynamic address table.[...]

Address T able Sett ings 3-87 3 We b – Click Ad dress T able, Static Addresses. S pecify t he interface , the MAC addr ess an d VLAN, t hen cl ick Add S tatic Addres s. Figure 3-52. Conf iguring a Static Address Table CLI – This exam ple adds an a ddress to th e static address t ab le, but sets it to be deleted when t he switch is reset. Displa[...]

Configuri ng the Switch 3-88 3 We b – Clic k Address T a ble, Dynam ic Addres ses. Specify the sea rch type ( i.e., ma rk the Interf ace, M AC Addre ss, or VLAN ch eckbox) , sel ect th e method of sort ing t he displaye d address es, and then c lick Quer y . Figu re 3-53 . Con figur ing a Dynam ic Addr ess Table CLI – This exam ple also dis pla[...]

Spanning Tree Algorithm Configu ration 3-89 3 Changing the Aging Time Y ou ca n set the agi ng time for en tries in the dyna mic addre ss table. Command Attributes • Aging Status – Enab les/disabl es the function . • Aging Time – The time after which a learned ent ry is discard ed. (Range: 10-30000 seconds; Default: 300 seconds) We b – Cl[...]

Configuri ng the Switch 3-90 3 Once a stable network top ology has bee n establishe d, all bridges lis ten for Hello BPDUs (Bri dge Protoco l Data Units) transmitted fro m the Root Bridge. If a bridge does not g et a Hello BPDU after a predefine d interval (Ma ximum Age), the bridge assumes that t h e link t o the Root Bridge is down. This b ridge [...]

Spanning Tree Algorithm Configu ration 3-91 3 • Forward Delay – Th e maximum time (in sec onds) the root device w ill wait before changin g states (i.e. , discarding to learning to fo rwarding). This delay is requi red because every devi ce must re ceive informa tion about topology ch anges befor e it starts t o fo rwa rd fra mes. In addition, [...]

Configuri ng the Switch 3-92 3 • Path Cost Me thod – The path cost is used to determ ine the best pat h between devices . The path cos t method is us ed to determi ne the range of values that can be assi gned t o each interfac e. We b – Click Sp an ning Tree, ST A, In formation. Figu re 3-55 . Di splayi ng Spanni ng Tree I nformat ion CLI –[...]

Spanning Tree Algorithm Configu ration 3-93 3 Configuring Globa l Settings Global s ettings appl y to the entire sw itch. Command Usage • Spann ing Tree Protoc ol Uses RSTP for the internal st ate machine , but sends on ly 802.1D BPDU s. This create s one spannin g tree instanc e for the entire n etwork. If m ultiple VLANs are implemen ted on a n[...]

Configuri ng the Switch 3-94 3 • Maximu m Ag e – The maximum time (in secon ds) a device can wait wi thout receivin g a configurat ion messa ge before at tempting to re configur e. All device ports (exc ept for design ated por ts) should rec eive configu ration m essages at regular int ervals. Any por t that ages out STA i nformation ( provided[...]

Spanning Tree Algorithm Configu ration 3-95 3 We b – Click Sp an ning Tree, ST A, Configuratio n. Modify the re quired attrib utes, and click Apply . Figu re 3-56 . Confi gurin g Spanni ng Tree CLI – Th is exa mple en ables S panni ng T ree Pr otocol , set s th e mode to RSTP , an d then configu res the ST A and RST P parameters. Console(config[...]

Configuri ng the Switch 3-96 3 Displaying Int erface Settings The S T A Port Infor mation a nd ST A Trunk Info rmation pag es display the cur rent status of ports and tru nks in the Sp an ning Tree. Field Attributes • Spanning Tree – Shows if STA has b een enabled on this interfac e. • STA Status – Dis plays current state of this por t with[...]

Spanning Tree Algorithm Configu ration 3-97 3 • Trunk Me mber – Indica tes if a port is a mem ber of a trunk. (STA Port Information only) Figure 3-57. BPDU Transmis sion These addi tional paramet ers are onl y displayed fo r the CLI: • Admin stat us – Shows if this interface is enabled. • Path cost – This parameter is used by the STA t [...]

Configuri ng the Switch 3-98 3 • Admin Edge Port – You ca n enabl e this op tion if an inte rface is attach ed to a LAN segmen t that is at the end of a bridged LAN or to an end no de. Since e nd nodes cannot cause f orwar ding lo ops, th ey can p ass dir ectly throug h to the s panni ng tree forwardi ng state. Specifyi ng Edge Ports provi des [...]

Spanning Tree Algorithm Configu ration 3-99 3 Configuring I nterface Settings Y ou can conf igure RST P attrib utes for specific interfaces , including port p riority , path cost, link t ype, and edge port. Y o u may use a different priority or path co st for ports of the same media typ e to indicate the preferred path, link type to indica te a poi[...]

Configuri ng the Switch 3-100 3 • Admin Link Type – T he link type attach ed to thi s int erface . - Point -to-Point – A connectio n to exactly one other bridge. - Sha red – A conne ction to two or more bridges . - Aut o – The switch automatica lly determ ines if the inte rface is att ached to a point-to- point link or to s hared medi a. [...]

VLAN Configu ration 3-101 3 VLAN Configuration IEEE 802.1Q VLANs In large netw orks, rou ters are use d to isolate broa dcast traffic for eac h subnet into separate doma ins. This switch pr ovides a similar service at Layer 2 by using VLANs to organ ize any group of network no des into separat e broadcast domains. VLANs confine br oadcast traffic t[...]

Configuri ng the Switch 3-102 3 Note: VLAN-tagged frames c an pass throug h VLAN-aware or V LAN-unaware network interconnection devices, but the VLAN tags should be st ripped off bef or e passing it on to any en d-node host that does not support V LAN tagging. VLAN Classification – When the switch rece ives a frame, it classifie s the frame in on[...]

VLAN Configu ration 3-103 3 T o impleme nt GVRP in a ne twork, firs t add the host dev ices to the req uired VLAN s (using t he oper ating sy stem or o ther ap plication s oftware), so that th ese VLAN s can be propagat ed onto the ne twork. For both the edge sw itches attache d directly to these hos ts, and core swit ches in the ne twork, enab le [...]

Configuri ng the Switch 3-104 3 Enabling or Di sabling GVRP (Global Se tting) GARP VLAN Registration Protocol (GVR P) defines a way for switches to exc hange VLAN inform ation i n order to reg ister VLAN memb ers on por ts acr oss the ne twork . VLANs ar e dynamic ally configure d based on j oin messa ges issued by host device s and pro pagated thr[...]

VLAN Configu ration 3-105 3 CLI – Enter the fo llowing com mand. Displaying Current VLANs The VLAN Cu rrent T able sh ows the curr ent port membe rs of each VLAN an d whether or not the port supp orts VLAN tagging. Ports as signed to a large VL AN group th at crosses s everal switch es should use VLAN tagging . However , i f you just want to crea[...]

Configuri ng the Switch 3-106 3 We b – Click VLAN, 802.1Q VLAN, Current T able. Select any ID from the scroll-do w n lis t. Figure 3-62. Displaying Current VLANs Command Attributes (CLI) • VLAN – ID of con figured VLAN (1 -4094, no leadi ng zeroes) . • Type – Show s how this VLAN was added to the switch. - Dynamic : Automa tically le arne[...]

VLAN Configu ration 3-107 3 CLI – Current VLAN informat ion can be displ ayed with the f ollowing com mand. Creating VLANs Use the VLAN S tatic List to creat e or remove V LAN groups. T o propagate informat ion about VLAN gro ups used on this switch t o extern al networ k devices, you must spec ify a VLAN ID for eac h of these gr oups. Command At[...]

Configuri ng the Switch 3-108 3 We b – Click VLA N, 802.1Q VLAN, S tatic List. T o cre ate a new VLAN, enter the VLAN ID and VLAN name, mark the Enable checkbox to acti v ate the VLAN, a nd then c lick Add . Figu re 3-63 . Configu ring a VL AN Stati c List CLI – Th is exa mple cr eates a new VLAN . Adding Static Members to VLANs (VLAN Inde x) U[...]

VLAN Configu ration 3-109 3 Command Attributes • VLAN – ID of con figured VLAN (1 -4094, no leadin g zeroes). • Name – Name of t he VLAN (1 to 32 characters ). • Status – Enabl es or disables th e specified VL AN. - Enable : VLAN is oper ational. - Disable : VLAN is suspe nded; i.e., doe s not pass pa ckets. • Port – Port i dentifie[...]

Configuri ng the Switch 3-110 3 CLI – The followin g example ad ds tagged and untagged ports to VLAN 2. Adding Static M ember s to VLANs (Po rt Index) Use the VLAN S tatic Membe rship by Port men u to assign VLAN gr oups to the selected interface as a tagged mem ber . Command Attributes • Inte rfac e – Port or tr u nk identi fier. • Member [...]

VLAN Configu ration 3-111 3 Configuring VLAN Be havior for Interfaces Y ou can config ure VLAN beh avior fo r specif ic int erfac es, incl uding th e defau lt VLAN identifier ( PVID), acce pted frame type s, ingress filtering, GVR P status, and GAR P time rs. Command Usage • GVRP – GA RP VLAN R egistration Pr otocol defines a way for switc hes [...]

Configuri ng the Switch 3-112 3 • GARP Leave Timer * – The int erval a po rt waits befor e leavin g a VLAN gr oup. This time sh ould be set to more than twice t he join ti me. This en sures that after a Le ave or LeaveA ll messag e has been issu ed, the appl icants can rejoin before t he port actually leaves the grou p. (Range : 60-3000 ce ntis[...]

VLAN Configu ration 3-113 3 CLI – Th is examp le sets port 3 to acce pt only tagge d frames , assign s PVID 3 as the nati ve V LA N ID , en abl es G VRP , sets t he G AR P ti mer s, a nd t hen sets the swi tchp ort mode to hybr id. Private VLANs Private VLA Ns provide po rt-based s ecurity an d isolation bet ween ports within the assigne d VLAN. [...]

Configuri ng the Switch 3-114 3 channel ing all other traffic through a pro miscuous port). Then ass ign any promisc uous ports to a pri mary VLAN and any host por ts a secondary VLAN (i.e., commu n ity VLAN). Displaying Current Priv a te VLANs The P rivate VLAN Informat ion page d isplays informati on on th e privat e VLANs configur ed on the swit[...]

VLAN Configu ration 3-115 3 CLI – Th is exa mple sh ows the switc h confi gured wi th pr imary VL AN 5 and secondar y VLAN 6. Port 3 has been configur ed as a promisc uous port and m apped to VLAN 5, wh ile ports 4 and 5 have been config ured as a host p orts and are associa ted with VLA N 6. This means t hat traffic for port 4 and 5 can only pas[...]

Configuri ng the Switch 3-116 3 We b – Click VL AN, Private VLAN , Configuration. Enter the VLAN ID numb er , select Primary , Isolated or Communit y type, then click Ad d. T o remove a pr ivate VLAN from the swi tch, highl ight an en try in the Current lis t box and t hen clic k Remove . Note th at all member ports must be remo ved from the VLAN[...]

VLAN Configu ration 3-117 3 We b – Click VLAN , Private VLAN, Ass ociation. Select t he required prima ry VLAN from the scroll-down bo x, highligh t one or more com munit y VLANs in the Non- Associ ation l ist bo x, and c lick A dd to as sociat e thes e entri es wit h the se lected primary VLA N. (A com munity VLA N can on ly be assoc iated with [...]

Configuri ng the Switch 3-118 3 We b – Click VLAN, Priv a te VLAN, Port Information or Trunk I n formation. Figure 3-70. Displa ying Private VLA N Port Info rmation CLI – This examp le shows the sw itch con figured with prim ary VLAN 5 an d comm unity VLAN 6. Port 3 has been configured as a pro miscuous port and mapped to VLAN 5, wh ile ports 4[...]

VLAN Configu ration 3-119 3 • Secondar y VLAN – On this switch al l seconda ry VLANs are commu nity VLAN s. A comm unity VLAN c onveys tra ffic bet ween comm unity por ts, and from com munity ports to their d esignated promiscuous ports. If PVLAN Port T ype is “ Host,” then specify t he associat ed second ary VLAN. We b – Click VLAN, Priv[...]

Configuri ng the Switch 3-120 3 Class of Service Config uration Class of Service (CoS) allows you to sp ecify whic h data packets have gre ater precede nce when tr affic is buffered in the switc h due to conges tion. This swi tch supports Co S with four prior ity queues for each port. Da ta packets in a port’s high-priorit y queue will be transmi[...]

Class of Service Configuration 3-121 3 We b – Click Priority , Default Port Priority o r Default T runk Priority . Modify the default priority for any interface, then click Apply . Figure 3-72. Po rt Priority Configuration CLI – Th is exa mple assi gns a defaul t prior ity o f 5 to po rt 3. Console(config)#interface ethernet 1/3 4-104 Console(c[...]

Configuri ng the Switch 3-122 3 Mapping C oS Valu es to Egress Que ues Thi s switch proc esses Cl ass of S ervic e (CoS) pr iorit y ta gged tr aff ic by us ing fou r priority qu eues for each port, wit h service sch edules base d on strict or Wei ghted Round Ro bin (WRR ). Up to eight se parate traffic priorities are de fined in IEEE 802.1p. The de[...]

Class of Service Configuration 3-123 3 We b – Click Prio rity , T raffic Clas ses. Mark an in terface and cli ck Select to displ ay the curren t mapping of CoS values to out put queues . Assign priori ties to the traffic classes (i.e., output que ues) for th e selected interface, the n click Apply . Figure 3-73 . Traffic Classes CLI – Th e foll[...]

Configuri ng the Switch 3-124 3 Command Attributes • WRR - W e ighted Roun d-Rob in shares ban dwidth at the eg ress ports by using schedul ing weight s 1, 2, 4, 6 for queues 0 through 3 respectivel y . (Th is is the default se lection .) • Stri ct - Services the eg ress queu es in sequent ial order, tra nsmitting all tra ffic in the higher pri[...]

Class of Service Configuration 3-125 3 We b – Click Pri ority , Queue Sched uling. Selec t the interface, highlight a tra f f ic class (i.e., output queue), ente r a weight, then click Apply . Figure 3-75. Configuring Interfaces for Queu e Scheduling CLI – The followi ng exampl e shows how to assign WR R weights to eac h of the priority qu eues[...]

Configuri ng the Switch 3-126 3 Layer 3/4 Priori ty Settings Mapping Layer 3/4 Priorities to CoS Values This swi tch supports seve ral comm on method s of prioritiz ing layer 3/4 traffic to meet applicat ion requireme nts. T raffic priorities can be specified in t he IP heade r of a frame, u sing the priori ty bits in the T ype of S ervice (T oS) o[...]

Class of Service Configuration 3-127 3 Mapping IP Preceden ce The T ype of Serv ice (T oS) octe t in the IP v4 header in cludes t hree prec edence bi ts defining eight different prior ity levels ran ging from hi ghest prior ity for netwo rk control pac ket s to lo west p riori ty for routi ne traf fic . The de faul t IP Pr ecedenc e valu es are map[...]

Configuri ng the Switch 3-128 3 CLI * – The followi ng exampl e globally enab les IP Preced ence serv ice on the switch , maps IP Prec edence va lue 1 to CoS value 0 (on port 1), and t hen displays the IP Pre cedence se tting s. * Mapping specific values for IP Precedence i s implemented as an interface configuration command, but any changes will[...]

Class of Service Configuration 3-129 3 Command Attributes • DSCP Priority Table – Shows the D SCP Prior ity to Co S ma p. • Class of Se rvice Valu e – Maps a Co S value to the se lected DSC P Priority value. Note tha t “0” represen ts low priority and “7” represe nt high prior ity. Note: IP DSCP s ettings apply to all interfaces. We[...]

Configuri ng the Switch 3-130 3 Mapping IP Port Priority Y ou ca n also map ne twork app lications to C lass of Servi ce values bas ed on the IP port numb er (i.e., TCP/UDP port numbe r) in the frame head er . Some of th e more common TC P service por ts include: HTTP: 80, FTP: 21, T elnet: 23 an d POP3: 1 10. Command Attributes • IP P ort Prio r[...]

Class of Service Configuration 3-131 3 CLI * – T he follow ing exam ple globa lly enables IP Port P riority serv ice on th e switch, maps HTTP traffic on por t 5 to Co S value 0, and th en disp lays all the IP Port Priority settings for that port. * Mapping specific values for IP Port Priority is implemented as an interfac e configuration command[...]

Configuri ng the Switch 3-132 3 We b – Click Prior ity , ACL CoS Priorit y . Enable mapping fo r any port, select an ACL from the scroll-down list , then click Ap ply . Figure 3-81. A CL CoS Priorit y CLI – Th is exa mple assi gns a CoS val ue of ze ro to p acket s matc hing r ules wi thin the specif ied ACL on port 24. Multicast Filtering Mult[...]

Mult icast Filterin g 3-133 3 to tho se port s only . It the n prop agates t he servi ce reques t up to any ne ighbor ing multicast switch/rout er to ensure that it will continue to r eceive the mul ticast service . This procedure is called multicast filtering. The purpose of IP multic ast fi lteri ng is t o opti mize a sw itched networ k’s perfo[...]

Configuri ng the Switch 3-134 3 Command Attributes • IGM P St atu s — When ena bled, the swit ch will monitor network traffic to determine which hosts w ant to r eceive multicast traffi c. This is also referr ed to as IGMP Snoo ping. ( Default : Enable d) • Act as IGMP Querier — When ena bled, the sw itch can serve as the Querier , which is[...]

Mult icast Filterin g 3-135 3 CLI – Th is examp le modifie s the set tings for multicas t filtering, and then displays the current status . Displaying Interfaces Attached to a Multicast Router Multicast routers that are attached to po rts on the switch use informat ion obtained fro m IGMP , al ong wi th a mu ltica st rou ting pr otocol such as DV[...]

Configuri ng the Switch 3-136 3 CLI – This examp le shows t hat Port 1 1 has bee n statically configur ed as a port attached to a m ulticast route r . Specifying Static Interfaces fo r a M ulticast Router Depend ing on your n etwork co nnection s, IGMP sno oping ma y not always be able to locate the IGMP querier. Therefore, if the IG MP querier i[...]

Mult icast Filterin g 3-137 3 Displaying Port Members of Mu lticast Services Y ou ca n display the po rt memb ers assoc iated with a spe cified VLA N and multica st serv ice. Command Attributes • VLAN ID – Sele cts the VLAN for whi ch to display port member s. • Multicast IP Address – The IP address for a specific multicast s ervice. • Mu[...]

Configuri ng the Switch 3-138 3 Assigning Po rts to Multicast Se r vices Multicast filtering can be d ynamical ly configured u sing IGMP Sn ooping an d IGMP Query me ssages as described in “C onfiguring IGMP snoo ping and Que ry Parame ters” on page 3-13 3. For certain a pplications t hat require ti ghter cont rol, you may ne ed to st aticall y[...]

Mult icast Filterin g 3-139 3 CLI – This example a ssigns a m ulticast ad dress to V LAN 1, an d then d isplays all the kno wn mult icast servic es supp orted on VLAN 1. Console(config)#ip igmp snooping vlan 1 s tatic 224.1.1.12 ethernet 1/12 4-177 Console(config)#exit Console#show mac-address-table multicast vlan 1 4-179 VLAN M'cast IP addr[...]

Configuri ng the Switch 3-140 3[...]

4-1 Chapter 4: Command Line Interface This chap ter describe s how to use the Comman d Line Interf ace (CLI). Using the Command Line Interface Accessing the CLI When acc essing the managem ent interface for the sw itch over a direc t connecti on to the serve r ’s console port, or via a T elnet con nection, the sw itch can be managed by enter ing [...]

Command Line Interface 4-2 4 T o access the switch t hrough a T elnet session, yo u must firs t set the IP addr ess for the switch , and set the default gatewa y if you are m anaging th e switch from a different IP su bnet. For exam ple, If your cor porate netw ork is conne cted to anothe r network outside your office or to the Int ernet, y ou need[...]

Entering C ommands 4-3 4 Entering Commands Thi s sectio n descri bes how to ent er CLI com mands. Keywords and Argument s A CLI comma nd is a series of keywords and argumen t s . Keyword s identify a comm and, and argu ments specify configuration parameters. Fo r example, in t he comma nd “s how inte rfaces sta tus et hernet 1 /5,” show interfa[...]

Command Line Interface 4-4 4 Showing Commands If you ente r a “?” at the com mand prom pt, the sys tem will disp lay the first leve l of keywords for the curren t comman d class (Nor mal Exec or Pri vileged Exe c) or configur ation class ( Global, ACL, In terface, Line or VLAN Database ). Y ou can also display a l ist of valid keyw ords for a s[...]

Entering C ommands 4-5 4 Partial Keyword Lookup If you termi nate a partial keyw ord with a ques tion mar k, alternatives that matc h the initial lette rs are provide d. (Remem ber not to leav e a space betwe en the comm and and quest ion mark.) For exampl e “ s? ” s hows all the keywords sta rting with “s.” Negating t he Effect of Commands[...]

Command Line Interface 4-6 4 Exec Commands When you open a new console sess ion on the swi tch with the use r name and password “g uest,” the sys tem enters the N ormal Exec comman d mode (or gu est mode), di splaying th e “Console>” command prompt. On ly a limited nu mber of the comm ands are avai lable in this m ode. Y ou can access al[...]

Entering C ommands 4-7 4 T o enter the Glo bal Configu ration m ode, ent er the co mmand co nfigure in Privileged Exec mode. The sys tem prompt will change to “Co n sole(c o nfig)#” which gives you access pr ivilege to all G lobal Conf iguration co mmands. T o enter the other modes, at the configu ration prom pt type one o f the following comm [...]

Command Line Interface 4-8 4 Command Line Processi ng Comma nds are not ca se sensiti ve. Y ou ca n abbrevia te comma nds and paramet ers as long as they contain enoug h letters to diff e rentiate th em from any ot her curre ntly availabl e comman ds or paramete rs. Y ou can use the T ab k ey to complet e partial comm ands, or en ter a partial c om[...]

Command Group s 4-9 4 Command Groups The syst em comm ands ca n be bro ken down i nto the fun ctional g roups shown below . The access mode sho wn in the follo wing tables is indicat ed by these ab breviation s: NE (Nor mal Exec) IC (Interfa ce Conf iguration) PE (Privileg ed Exec) LC (Line C onfigurat ion) GC (Global Configur a tion) VC (VLAN Data[...]

Command Line Interface 4-10 4 Line Commands Y ou ca n access the on board con figuratio n program by attaching a VT100 compatible de vice to the server ’s serial port. These com mands are us ed to set communicati on parameters f or the serial p o rt o r T elnet (i.e ., a virtual termin al). line This comm and ident ifies a spe cific line fo r con[...]

Line Command s 4-11 4 Command Usage T elnet is consi dered a virtua l terminal conn ection and wi ll be shown as “Vty” in screen disp lays suc h as show users . However, the serial com municat ion parameter s (e.g., databits) do not affect T el net connect ions. Example T o enter con sole line mod e, enter the fo llowing com mand: Related Comma[...]

Command Line Interface 4-12 4 Example Related Commands usernam e (4-26 ) pass w or d (4-12) passwo r d This comm and speci fies the passwor d for a line. Us e the no form to remove th e password . Syntax pas s w o rd { 0 | 7 } pas sword no password •{ 0 | 7 } - 0 mean s plain pass word, 7 mea ns encryp ted passwo rd • passw ord - Ch aracte r st[...]

Line Command s 4-13 4 timeout log in response This comm and sets the inte rval that th e system wai ts for a user to log into the CLI. Use t he no fo rm to restore t he default . Syntax timeout login response [ seco nds ] no silent-time seconds - Integer that specifies the ti m eout interval. (Range: 0 - 300 seconds; 0: disabled) Default Sett ing ?[...]

Command Line Interface 4-14 4 Command Mode Line Co nfigurati on Command Usage • If user inp ut is detected w ithin the timeo ut interval , the session is ke pt open; otherwise the session is terminate d. • This c ommand applies to bot h the l ocal co nsole a nd Telnet conne ctions. • The timeo ut for Telnet cannot be disabl ed. • Using th e[...]

Line Command s 4-15 4 Related Commands silent-tim e (4-15) timeout lo gin respons e (4-13) silent-time This comm and sets the am ount of time th e managem ent cons ole is inacces sible after the numbe r of unsuc cessful logo n attempts e xceeds the t hreshold se t by the p asswor d-thres h command. Use the no form to r e move th e silent time v a l[...]

Command Line Interface 4-16 4 Command Usage The d ata bi ts comman d can be used t o mask the hi gh bit on i nput fro m devices that g enerate 7 data bits with parity . If parity is b eing gene rated, specify 7 data bits p er charac ter . If n o parity is required, specify 8 data bi t s per charact er . Example T o specify 7 data bits, enter this c[...]

Line Command s 4-17 4 speed This comm and sets the term inal line’s baud rat e. This comm and sets both t he transmi t (to termina l) and receiv e (from termi nal) speed s. Use the no form to rest ore the defaul t setting. Syntax speed bps no speed bps - Baud rate in bits per second. (Options: 9600, 19200, 38400, 57600, 1 15200 bps) Default Sett [...]

Command Line Interface 4-18 4 disco nnect Thi s command termi nates an SSH, T elne t, or c onsol e connect ion. Syntax disconnect sessi on-id sessio n-id – The session identifier for an SSH, T elnet or console connection. (Range: 0-4) Command Mode Privileged Exec Command Usage S pecifying session iden tifier “0” will disconnect the console co[...]

General Command s 4-19 4 Example T o show all l ines, enter thi s command : General Commands enab le Thi s command activa tes P rivil eged Exec mode. In priv ileg ed mode, additi onal comm ands are av ailable, a nd certain c ommands display a dditional information . See “Unde rstanding Com mand Mod es” on page 4-5. Syntax enable [ le vel ] leve[...]

Command Line Interface 4-20 4 Default Sett ing Level 15 Command Mode Normal Exec Command Usage • “super ” is the def ault pas sword requi red to ch ange th e comma nd mode from Normal Exec to Pr iv ile g ed Exec. (To s e t this password, see the enable password command on pag e 4-27.) • The “#” ch aracter is app ended to the e nd of the[...]

General Command s 4-21 4 configure This c ommand activates Global Configu ration mo de. Y ou mus t enter t his mo de to modify an y setting s on the switch. Y ou must also enter Global Config uration m ode prior to en abling some o f the other conf iguration modes, incl uding Interfac e Configu ration, Line Con figuration, VLAN Database Co nfigurat[...]

Command Line Interface 4-22 4 The ! comman d repeat s co mmands f rom the Execut ion comm and hist ory bu ffer when yo u are in Normal Exec or Privilege d Exec Mode, and comman ds from the Configu ration comm and hist ory buffer when you ar e in any of the configurat ion mode s. In thi s example , the !2 com mand re peats the secon d command in the[...]

General Command s 4-23 4 exit This comm and retur ns to the previo us configu ration mode or exit the confi guration program. Default Sett ing None Command Mode Any Example This examp le shows ho w to return to the Pr ivileged Exe c mode from t he Global Configu ration mode , and then quit the CLI session : quit This c ommand exits the c onfigura t[...]

Command Line Interface 4-24 4 System Management Co mmands Thes e comman ds are u sed to c ontrol system logs, p assw ords, u ser name s, brow ser configur ation option s, and display or configur e a variety of othe r system inf ormation. Device Designation Commands prompt Thi s command custo mizes t he CLI p rompt. Use th e no form to rest ore the [...]

System Management C ommands 4-25 4 Example hostname This comm and speci fies or mod ifies the host na me for this de vice. Us e the no form to restor e the default ho st name. Syntax hostnam e name no hostname name - The name of this host. (Maxim um length: 255 characters) Default Sett ing None Command Mode Global Co nfiguration Example User Access[...]

Command Line Interface 4-26 4 username This comm and adds n amed use rs, requires authenticati on at login, sp ecifies or changes a user's password ( or specify t hat no passw ord is re quired), or s pecifies or changes a user's acc ess level. U se the no form to remove a user name. Syntax usernam e name { a ccess -level le vel | nopasswo[...]

System Management C ommands 4-27 4 enable pa ssword Afte r init ial ly lo ggi ng o nto the s yste m, you shou ld set the P rivi lege d E xec pass wor d. Remem ber to record i t in a safe place . This comma nd controls ac cess to the Privileged Exec level from the No rmal Exec level. U se the no form t o reset t he default pass word. Syntax enab le [...]

Command Line Interface 4-28 4 IP Filt er Commands managem ent This comm and speci fies the clien t IP address es that are allow ed manage ment access t o the switch through vario us protocol s. Use the no form to restore th e default se tting. Syntax [ no ] management { all-c lient | http-client | snmp-client | telnet -cli ent } start-addres s [ en[...]

System Management C ommands 4-29 4 Example Thi s example res trict s manage ment acc ess to the in dicate d addres ses. show ma nagement This comm and disp lays the client IP addresses that are allo wed manag ement access t o the switch through vario us protocol s. Syntax show management { al l-client | http-clie nt | snmp-client | telnet -cli ent [...]

Command Line Interface 4-30 4 Web Server Commands ip http port This comm and specif ies the TCP por t number us ed by the we b browser inter face. Use t he no fo rm to use the de fault port. Syntax ip http port port-num ber no ip http port port-number - The TCP p ort to be used by the browser interface. (Range: 1-65535) Default Sett ing 80 Command [...]

System Management C ommands 4-31 4 Example Related Commands ip htt p port (4 -30) ip http sec ure-server This comm and enable s the secure hy pertext tra nsfer protoc ol (HTTPS) ove r the Secure Socket Lay er (SSL), p roviding secure a ccess (i .e., an en crypted c onnection ) to the swit ch’s web interfac e. Use the no form to disa ble this func[...]

Command Line Interface 4-32 4 Example Related Commands ip http secu re-port ( 4-32) copy tftp https-certif icate (4-61) ip http sec ure-port This comm and specifi es the UDP port n umber used for HTTPS/SSL co nnection to the switch’ s web interface. Us e the no fo rm to restore the d efault p ort. Syntax ip http secure-por t port_n umber no ip ht[...]

System Management C ommands 4-33 4 Telnet Ser ver Commands ip telnet po rt This co mmand s pecifies t he TCP po rt numb er used by the T e lnet interf ace. Use t he no form to use th e default port. Syntax ip telnet port port-n umber no ip telnet port port-number - The TCP p ort to be used by the browser interface. (Range: 1-65535) Default Sett ing[...]

Command Line Interface 4-34 4 Related Commands ip tel net port (4-33) Secure Shell Command s The Berkl ey-standard in cludes rem ote access tools origin ally designe d for Unix systems. Some of the se tools hav e also been imp lemente d for Micros oft Windows and other environmen ts. These tools, including co mmands su ch as rl ogin (re mote login)[...]

System Management C ommands 4-35 4 The SSH se rver on thi s switch supp orts both passwor d and public key authenti cation. If passw ord authen tication is spe cified by the SSH client, then the password can be authent icated eit her locally or vi a a RADIUS or T A CACS+ r emote authenti cation serve r , as specifi ed by the auth entication lo gin [...]

Command Line Interface 4-36 4 corres ponding to the p ublic keys s tored on the switch can gain a ccess . The followi ng exchang es take place during this proces s: a. The c lient s ends i ts pu blic ke y to th e switch . b. The switc h compares the cl ient's publ ic key to those stor ed in mem ory . c. If a ma tch is found, the swi tch us es [...]

System Management C ommands 4-37 4 ip ssh tim eout This comm and conf igures the tim eout for the SSH server. Use the no form to rest ore the defaul t setting. Syntax ip s sh timeout seconds no ip ssh time out seconds – The timeout for client response during SSH negotiation. (Range: 1- 120) Default Sett ing 10 seco nds Command Mode Global Co nfig[...]

Command Line Interface 4-38 4 Example Related Commands show ip ss h (4-40) ip ssh se rver-key siz e This comm and sets the SSH server key si ze. Use the no form to restore the de fault setting. Syntax ip ssh serv er-key siz e key- size no ip ssh ser ver-key size key-size – The size of server key . (Range: 512-896 bits) Default Sett ing 768 bits C[...]

System Management C ommands 4-39 4 Example ip ssh cr ypto host-key gene r ate This comm and gener ates the hos t key pair (i.e., pub lic and private). Syntax ip ssh cryp to host-key gener ate [ dsa | rsa ] • dsa – DSA (V ersion 2) key t ype. • rsa – RSA ( Version 1) key type. Default Sett ing Generat es both the DSA an d RSA key pairs. Comm[...]

Command Line Interface 4-40 4 Command Mode Privileged Exec Command Usage • This com mand clea rs the host key f rom volatile memory (RAM ). Use the no ip ssh save h ost-key com mand to cl ear the host key from flash m emory. • The SSH se rver must be di sabled bef ore you ca n execute this command. Example Related Commands ip ssh cryp to host-k[...]

System Management C ommands 4-41 4 Example show ss h This comm and displ ays the current SSH server con nections. Command Mode Privileged Exec Example Console#show ip ssh SSH Enabled - version 1.99 Negotiation timeout: 120 secs; Authentica tion retries: 3 Server key size: 768 bits Console# Console#show ssh Connection Version State Use rname Encrypt[...]

Command Line Interface 4-42 4 show pub lic-key Thi s command shows the publ ic key for t he spec ified u ser or for th e host. Syntax show p ublic-key [ user [ username ]| hos t ] username – Name of an SSH user . (Range: 1-8 ch aracters) Default Sett ing Shows all public keys . Command Mode Privileged Exec Command Usage • I f no pa ramete rs ar[...]

System Management C ommands 4-43 4 Event Logging Com mands logging on This comm and cont rols logging of error messag es, sending debug or er ror messag es to switch m emory . T he no form dis ables th e loggin g process . Syntax [ no ] logging on Default Sett ing None Command Mode Global Co nfiguration Command Usage The logging process co ntrols e[...]

Command Line Interface 4-44 4 logging his tory This com mand limits sy slog messa ges sa ved to switc h memory ba sed on seve rity . The no form re turns the logging o f sysl og messages to the default level. Syntax logging history { flas h | ram } level no logging history { fla sh | ra m } • flas h - Event hist ory stored in flash memo ry (i.e.,[...]

System Management C ommands 4-45 4 logging hos t This comm and adds a syslog serve r host IP addr ess that wi ll receive logg ing messag es. Use the no form to remove a syslog server hos t. Syntax [ no ] logging host host_ip_ address host_ip_address - The IP address of a syslog server . Default Sett ing None Command Mode Global Co nfiguration Comma[...]

Command Line Interface 4-46 4 logging trap This comm and enabl es the logg ing of system messages t o a remote se rver , or limits the sysl og message s saved to a remote ser ver based on severity . Us e this comm and without a specified leve l to enable rem ote loggi ng. Use the no form to disable re mote loggi ng. Syntax logging trap [ level ] no[...]

System Management C ommands 4-47 4 Related Commands show logg ing (4-48) show log This c ommand displays the system and eve nt mess ages st ored in memo ry . Syntax show log { flash | ram } • flas h - Event hist ory stored in flash memo ry (i.e., perman ent memo ry). • ram - Event history st ored in temp orary RAM (i.e., memo ry flushed on powe[...]

Command Line Interface 4-48 4 show log ging This comm and displ ays the loggin g configur ation. Syntax sh ow loggi ng { flash | ram | tr ap } • flas h - Event hist ory stored in flash memo ry (i.e., perman ent memo ry). • ram - Event histor y stored in tempo rary RAM (i.e., memo ry flushed on power reset). • trap - Displays se ttings for the[...]

System Management C ommands 4-49 4 The follow ing exampl e displays set tings for the t rap function . Time Commands The syste m clock can be dynamic ally set by pol ling a set of spe cified time ser vers (NTP or SNT P). Mai ntai ning a n accur ate ti me on t he swi tch enab les th e syst em log to record meaningful dates and ti mes for event ent r[...]

Command Line Interface 4-50 4 sntp clien t This comm and enable s SNTP client reques ts for time synchron ization from NTP or SNTP time se rvers sp ecified with the snt p serv ers comm and. Us e the no form to disable SNTP c lient reque sts. Syntax [ no ] sn tp cli ent Default Sett ing Disabled Command Mode Global Co nfiguration Command Usage • T[...]

System Management C ommands 4-51 4 sntp server This comm and sets the IP addr ess of the se rvers to which SN TP time req uests are issued. U se the this com mand wit h no argumen ts to clear all time ser vers from th e current l ist. Syntax sntp server [ ip 1 [ ip2 [ ip3 ]]] ip - IP address of an t ime server ( N TP or SN TP). (Range: 1-3 addresse[...]

Command Line Interface 4-52 4 Command Usage This command is on ly applicable when the switch is set to SNTP client mode. Example Related Commands sntp c lient (4- 50) show sntp This comm and displ ays the current time and co nfiguration s ettings for the SNTP client, and indicates whether or no t the local time ha s been prop erly updated. Command [...]

System Management C ommands 4-53 4 Command Usage This c ommand sets the l ocal tim e zone relative to the Coordinat ed Uni versal T ime (UT C, former ly Gree nwich Mea n Ti me or GMT), ba sed on th e earth’ s prime m eridian, zero de grees lon gitude. T o display a tim e corres ponding to your l ocal time , you m ust indicat e the number o f hour[...]

Command Line Interface 4-54 4 Command Mode Normal Exec, Priv ileged Exec Example System Status Com mands light unit This comm and disp lays the unit ID of a switch usi ng its front-panel LE D indicato rs. Syntax light unit [ unit ] • unit - spec ifies a unit in a swit ch stack to li ght the panel LED s Default Sett ing None Command Mode Normal Ex[...]

System Management C ommands 4-55 4 show sta rtup-config This comm and disp lays the config uration file st ored in non- volatile mem ory that is used to start up the system. Default Sett ing None Command Mode Privileged Exec Command Usage • Use th is command in conjunc tion wit h the show runnin g-config command to compar e the informat ion in ru[...]

Command Line Interface 4-56 4 Related Commands show runni ng-con fig (4-56) show runn ing-config This comm and disp lays the con figuration inf ormation cu rrently in us e. Default Sett ing None Command Mode Privileged Exec Command Usage • Us e this co mmand in conjunc tion wi th the show startup-config co mmand to compar e the informat ion in ru[...]

System Management C ommands 4-57 4 Example Related Commands show startu p-config (4- 55) Console#show running-config building running-config, please wait..... ! SNTP server 0.0.0.0 0.0.0.0 0.0.0.0 ! ! ! SNMP-server community private rw SNMP-server community public ro ! ! username admin access-level 15 username admin password 7 21232f297a57a5a 74389[...]

Command Line Interface 4-58 4 show sy stem This command displays system information. Default Sett ing None Command Mode Normal Exec, Priv ileged Exec Command Usage • For a descr iption of the i tems show n by this comm and, refer t o “Display ing System In formation” o n page 3-8. • Th e POST res ults sh ould all displ ay “PASS. ” If an[...]

System Management C ommands 4-59 4 Command Usage The sess ion use d to exec ute this comman d is indi cated by a “*” sym bol n ext to the Line (i.e ., session) i ndex number. Example show ve rsion This c ommand displays hardwa re and software version i nforma tion for the syst em. Default Sett ing None Command Mode Normal Exec, P rivileged Exec[...]

Command Line Interface 4-60 4 Example Frame Size Commands jumbo frame This comm and enable s support fo r jumbo frames . Use the no fo rm t o disabl e it. Syntax [ no ] jumbo frame Default Sett ing Disabled Command Mode Global Co nfiguration Command Usage • This swi tch provides m ore effici ent throughpu t for large seq uential data transfer s b[...]

Flash/File C ommands 4-61 4 • Enabli ng jumbo frame s will limit the maximum t hreshold for broadcast s torm contro l to 64 pac kets per s econd. (Se e the switchp ort broadcast co mmand on pag e 4-110. ) Example Flash/File Commands These c omman ds are u sed to mana ge the s ystem code o r configur ation fi les. copy This comm and mov es (upload[...]

Command Line Interface 4-62 4 Default Sett ing None Command Mode Privileged Exec Command Usage • The syst em prompts for data required to comple te the copy command. • The de stination fi le name s hould not c ontain slas hes ( or /) , the lead ing letter of the file na me should no t be a period (.), and the maxi mum lengt h for file names on[...]

Flash/File C ommands 4-63 4 The follow ing exampl e shows how t o copy the run ning configu ration to a startup file. The follow ing example sh ows how t o downloa d a configurat ion file: This examp le shows ho w to copy a se cure-site ce rtificate from an TFTP server. I t then r eboots the switch to acti vate the certificat e: This examp le shows[...]

Command Line Interface 4-64 4 delete This comm and delete s a file or image . Syntax delete [ unit :] file n ame filename - Name of the configurati on file or image name. unit - S pecifies the unit number . Default Sett ing None Command Mode Privileged Exec Command Usage • If the file type is used fo r system startup, then t his file cannot be d [...]

Flash/File C ommands 4-65 4 Command Mode Privileged Exec Command Usage • If you e nter the command dir wit hout an y parame ters, t he syst em disp lays al l files. • A colon (:) is required af ter the specified unit numbe r. • Fi le inf ormati on is sh own bel ow: Example The follow ing exampl e shows how t o display all file informat ion: w[...]

Command Line Interface 4-66 4 Example This examp le shows t he informati on displayed by the whichboot com mand. See the table un der the dir com mand for a descr iption of the file inform ation disp layed by this co mma nd. boot syste m This comm and speci fies the imag e used to start up th e system. Syntax boot syst em [ uni t :] { boot-rom | co[...]

Authentication C ommands 4-67 4 Authentication Commands Y ou ca n configur e this switch t o authentica te users logging into the system fo r manage ment acces s using loca l or RADIUS authentic ation metho ds. Y ou can also enable po rt-based aut henticati on for network cl ient access u sing IEEE 802.1x. Authenticat ion Sequence authentica tion l[...]

Command Line Interface 4-68 4 • RADIUS and TACACS+ logon authentication assigns a specif ic privile g e level for each us er name and pa ssword pa ir. T he user name, password , and privilege l evel must be c onfigured on the authen tication se rver. • You c an specif y three au thenticat ion meth ods in a s ingle co mmand t o indicate the auth[...]

Authentication C ommands 4-69 4 • You c an specif y three au thenticat ion meth ods in a s ingle co mmand t o indicate the authen tication seq uence. Fo r example, if y ou enter “ auth enticat ion enable ra dius tacacs local ,” the us er name and pa sswor d on the RADI US server is v e rifie d first. If the RADIUS s e rver is n ot a vailable,[...]

Command Line Interface 4-70 4 • timeout - Number of seconds the switch waits for a reply before resending a request. (Range: 1-65535) • retr ansmi t - Number of times the swi tch will try to authenticate logon access via the RA DIUS serve r. (Range: 1 -30) • key - Encryption key used to authenticate logon access for client. Do not use blank s[...]

Authentication C ommands 4-71 4 radius- server key This comm and sets the RA DIUS encr yption key . Use the no f o rm to restor e the default. Syntax radi us-ser ver key key_stri ng no radius-server key key_string - Encryption key used to authenticate logon access for cl ient. Do not use bl ank spaces in the string. (Maximum length: 20 characters) [...]

Command Line Interface 4-72 4 radius- server timeout This comm and sets the inte rval betwe en transmit ting authent ication reque sts to the RADIUS server . Use the no form to res tore the d efa ult. Syntax radius-server t imeout numb er_of_sec onds no radius-server timeou t number_of_seconds - Number of seconds the switch waits for a reply before[...]

Authentication C ommands 4-73 4 TACACS+ Client T erminal Access Co ntroller Access Control Sys tem (T ACA CS+) is a logon authenti cation proto col that uses s oftware running on a centra l server to con trol access t o T A CACS-a ware device s on the netw ork. An auth entication ser ver contains a d atabase o f multiple user na me/password pairs w[...]

Command Line Interface 4-74 4 Command Mode Global Co nfiguration Example tacacs-se rver key This comm and sets the T ACACS + encrypt ion key . Use the no form to rest ore the default. Syntax t a cacs-se rver k ey key_st ring no tacacs-serv er key key_string - Encryption key used to authenticate logon access for t he client. Do not use b lank spaces[...]

Authentication C ommands 4-75 4 Port Security Commands These com mands can be used to ena ble port se curity on a port . When using po rt securi ty , the switch stops learn ing new MA C addr esses on the specifi ed port w hen it has r eached a co nfigur ed maximum nu mber . Onl y incomi ng traf fic wit h source address es already s tored in th e dy[...]

Command Line Interface 4-76 4 Command Usage • If you enable p ort se curity, the switch stops learni ng new MAC a ddresse s on the spec ified port whe n it has reached a configure d maximu m number . Only incomin g traffic wit h source addresses a lready stored in th e dynamic or static address table will be ac cepted. • First use t he port sec[...]

Authentication C ommands 4-77 4 802.1x Port Authenti cation The switch su pports IEEE 802 .1x (dot1x ) port-based ac cess contr ol that preven t s unautho rized acce ss to the netw ork by requ iring users to f irst submit cr edentials f or authenti cation. Client authentica tion is control led central ly by a RADIUS server using EAP (Exten sible Au[...]

Command Line Interface 4-78 4 dot1x default This comm and sets all conf igurable dot 1x global an d port settings to their defau lt values. Syntax dot1x d efault Command Mode Global Co nfiguration Example dot1x max- req This co mmand se ts the maxim um numb er of ti mes the s witch por t will retra nsmit an EAP request/identity packet to the client[...]

Authentication C ommands 4-79 4 dot1x port-control This comm and sets the dot1x mode on a po rt interface. Use the no for m to r e store the defaul t. Syntax dot1x p ort-control { auto | force-au thorized | fo rce -unau tho rized } no dot1x port-con trol • auto – Requi res a dot1x- aware con nected clien t to be autho rized by the RADIUS server[...]

Command Line Interface 4-80 4 Example dot1x re-aut henticate This comm and forces re-authen tication on all por ts or a specific inte rface. Syntax dot1x re- authenticat e [ interface ] interfa ce • etherne t unit / port - unit - This is device 1. - port - Port number. Command Mode Privileged Exec Example dot1x re-aut hentication This comm and en[...]

Authentication C ommands 4-81 4 dot1x timeout quiet- period This comm and sets the tim e that a switch port waits after the Max Request C ount has been ex ceede d before attemp ting to acqu ire a new clien t. Use the no form to reset the de fault. Syntax dot1x ti meout quiet-p eriod sec onds no dot1x timeou t quiet-period secon ds - The n umber of [...]

Command Line Interface 4-82 4 dot1x timeout tx-perio d This comm and sets the time that the sw itch waits during an aut hentication session bef ore re-t ransmi tting an EA P pac ket. Use the no form to res e t to the default value. Syntax dot1x ti meout tx-period seconds no do t1x timeo ut tx -per iod secon ds - The n umber of seconds. (Range: 1-65[...]

Authentication C ommands 4-83 4 • 802.1X Port Details – D isplays the port access control parame ters for each interface , including the following items: - reaut h-ena bled – Periodi c re -authe nticat ion ( page 4-80). - reau th-perio d – Time after wh ich a connect ed client m ust be re-authe nticated (page 4- 81). - qui et-per iod – Ti[...]

Command Line Interface 4-84 4 Example Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status Operation Mode Mode Authorized 1/1 disabled Single-Host ForceAuthorized n/a 1/2 enabled Single-Host auto yes . . . 1/18 disabled Single-Host ForceAuthorized n/a 802.1X Port Details 802.1X is disabled on [...]

Access Control List Commands 4-85 4 Access Control List Com mands Access C ontrol Li sts (ACL) pr ovide packe t filtering f or IP fram es (based on addr ess, protocol , Layer 4 protoc ol port numbe r or TCP contr ol code) or any fram es (based on MAC address or Ether net type). To fi lter packets , first create an ac cess list, ad d the requ ired r[...]

Command Line Interface 4-86 4 IP ACLs access-l ist ip This co mmand ad ds an I P access list and e nters c onfiguratio n mode for standard or extende d IP ACLs. Us e the no form to remove th e specified ACL. Syntax [ no ] access-list ip { st andard | extended } acl_ name • standar d – Specifies an AC L that filters packets base d on the sourc e[...]

Access Control List Commands 4-87 4 Command Usage • When y ou crea te a new ACL or enter c onfiguration mode for an e xisting ACL , use the permit or deny command to add n e w rule s to the bottom of the l ist. To create an AC L, you mus t add at least one r ule to the list. • To remove a rule, use th e no permit or no deny comm and followed by[...]

Command Line Interface 4-88 4 Example This examp le config ures one perm it rule for the spe cific add ress 10.1.1. 21 and another rule for the addr ess range 168.92.16.x – 168.92. 31.x using a bitm ask. Related Commands access-l is t ip ( 4-86) permit , deny (Extended ACL) This comm and adds a rul e to an Extended IP ACL. The rule sets a filter [...]

Access Control List Commands 4-89 4 Default Sett ing None Command Mode Extende d ACL Command Usage • All new ru les are appen ded to the end of the list. • Address bitmask s are similar to a subn et mask, con taining fou r integer s from 0 to 25 5, each separate d by a p eriod. T he binary mask use s 1 bits to indi cate “match” and 0 bits t[...]

Command Line Interface 4-90 4 This perm its all TCP packets from class C addresses 192.168.1. 0 with the TCP control code set to “SYN.” Related Commands access-l is t ip ( 4-86) show ip access-list This comm and displ ays the rules fo r configured IP ACLs. Syntax show ip acce ss-list { standard | exten ded } [ ac l_name ] • standar d – Spec[...]

Access Control List Commands 4-91 4 Command Usage • A port can only be bound to one ACL. • If a port is alre ady bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. • You must configur e a mask for an A CL rule before y ou can bind it to a port. Example Related Commands show ip acc ess[...]

Command Line Interface 4-92 4 Command Usage A packet match ing a rule within the specified ACL i s mapped to on e of the output que ues as sho wn in th e following tabl e. For inform ation on m apping th e CoS v alues to output queues, see queue cos -map on page 4-16 6. Example Related Commands queue c os-map (4-166) show map ac cess -list ip (4-92[...]

Access Control List Commands 4-93 4 MAC ACLs access-l ist mac This comm and adds a MAC access list and enters M AC ACL con figuration m ode. Use t he no fo rm to remov e the specified AC L. Syntax [ no ] access-list mac acl _name acl_name – Name of the ACL. (Maximum length: 16 characters) Default Sett ing None Command Mode Global Co nfiguration C[...]

Command Line Interface 4-94 4 Related Commands permit, de ny (MAC ACL) (4 -94) mac access -gro up (4 -95) show mac a ccess-l ist (4-95 ) permit , deny (MAC ACL) This comm and adds a rule to a MAC ACL. Th e rule filters packets ma tching a specifie d MAC sour ce or desti nation addres s (i.e., phys ical layer ad dress), or Ethernet p rotocol type. U[...]

Access Control List Commands 4-95 4 Example This rule pe rmits packets from any so urce MAC address t o the destinat ion address 00- e0-29-9 4-34-d e wher e the Et hernet type i s 0800. Related Commands access -list mac (4-93) show ma c access-list This comm and displ ays the rules fo r configured MAC ACLs . Syntax show m ac ac cess-list [ acl_ nam[...]

Command Line Interface 4-96 4 Command Usage • A port can only be bound to one ACL. • If a port is alre ady bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. Example Related Commands show mac a ccess-l ist (4-95 ) show ma c access-group This comm and shows the ports assi gned to MA C AC[...]

Access Control List Commands 4-97 4 Command Usage • You mus t configu re an ACL ma sk befo re you ca n map CoS values to the rule. • A packe t matching a rul e within the sp ecified ACL is mapped to one of the output q ueues as sh own bel ow. Example Related Commands queue co s-map (4-166) show m ap access -list mac (4-9 7) show ma p access-lis[...]

Command Line Interface 4-98 4 ACL I nfor matio n show ac cess-list This co mmand s hows all ACLs an d assoc iated rule s, as wel l as all t he user-d efined masks. Command Mode Privileged Exec Command Usage Once the ACL is bound to a n interfa c e (i.e., the ACL is active), th e order in which th e rules are disp layed is deter mined by th e associ[...]

SNMP Commands 4-99 4 SNMP Command s Controls a c cess t o th is switch from management stations usin g the Simple Network Manage ment Protoc ol (SNMP ), as well as the err or types sen t to trap manager s. snmp- server community This comm and define s the comm unity acce ss string for th e Simple Netw ork Manage ment Protoc ol. Use the no form to r[...]

Command Line Interface 4-100 4 Example snmp- server contact This comm and sets the sys tem contact st ring. Use the no for m to re mo ve t he system cont act informati o n. Syntax snmp-s erver contact str ing no snmp-s erver con t a ct string - S tring that describes the system con tact information. (Maximum l ength: 255 characters) Default Sett in[...]

SNMP Commands 4-101 4 Related Commands snmp- server contac t (4-100) snmp- server host This comm and specif ies the recip ient of a Simpl e Network Man agemen t Protocol notificat ion operati on. Use the no form to remov e the speci fied host. Syntax snmp-s erver host hos t-addr community-str ing [ vers ion { 1 | 2c }] no snmp-s erver hos t host-ad[...]

Command Line Interface 4-102 4 Related Commands snmp-se rver enable trap s (4-102) snmp- server enable traps Thi s command enabl es thi s device to se nd Simpl e Netw ork Manag ement P rotocol traps (SNMP no tifications). U se the no form to dis a ble SNMP noti fications. Syntax [ no ] snmp-ser ver ena ble tr aps [ aut hentication | link-up-down ] [...]

SNMP Commands 4-103 4 Command Usage This comm and prov ides informa tion on the communi ty access stri ngs, count er inf ormati on for SNM P input and out put prot ocol dat a unit s, and wh ether or not SNMP log ging has been en abled with the snmp-ser ver enabl e traps comm and. Example Console#show snmp System Contact: Joe System Location: Room 2[...]

Command Line Interface 4-104 4 Interface Commands Thes e command s are used to di splay or set commun icatio n param eters fo r an Ethernet p ort, aggregate d link, or VLAN. interface This comm and config ures an interface type and enter inter face configu ration mode . Use t he no form to remove a t runk. Syntax inte rfac e inte rfac e no interfac[...]

Interface C ommands 4-105 4 Command Mode Global Co nfiguration Example T o spec ify port 16, en ter the f ollowing comma nd: descri ption This comm and adds a descripti on to an interfac e. Use the no form to r e move the descri ption. Syntax description string no description string - Comment or a description to help you remember what is attached t[...]

Command Line Interface 4-106 4 Default Sett ing • Auto-ne gotiation is enabled by def ault. • When a uto-neg otiation is disabled , the de fault speed -duplex s etting is 100hal f for 100BASE- TX ports and 1000 full for Gigabit Ethernet ports. Command Mode Interface C onfigurat ion (Ethernet , Port Chann el) Command Usage • To force operation[...]

Interface C ommands 4-107 4 • If autone g otiati o n is dis a bled , au to-MDI/MDI- X pin signal configuratio n will also be disa bled for th e RJ-45 ports . Example The fo llowing example configures port 1 1 t o use autone gotiation. Related Commands capabili ties (4-1 07) speed-d uplex (4-1 05) capabiliti es This c ommand advertises the p ort c[...]

Command Line Interface 4-108 4 Example The follo wing exam ple configu res Ethern et port 5 capabi lities to 10 0half, 100f ull and fl ow contro l. Related Commands negotiat ion (4-106) speed-d uplex (4-1 05) flo wcont rol (4 -108 ) flowcontrol This comm and enable s flow control . Use the no form to disable flo w control. Syntax [ no ] flowcontrol[...]

Interface C ommands 4-109 4 Example The follow ing example en ables flo w control on p ort 5. Related Commands negotiat ion (4-106) capa b iliti es (flowcontrol, sy mmetric) (4-107) shutdown This comm and disabl es an interfa ce. T o restart a disabl ed interfac e, use the no form . Syntax [ no ] shut dow n Default Sett ing All interface s are enab[...]

Command Line Interface 4-110 4 switchpo r t broad cast packet-rate This comm and conf igures broadc ast storm control. Use the no form to disable broadca st stor m contr ol. Syntax switchport broadc ast octet-rate rate no switchport broadc ast rate - Threshold level as a rate; i .e., octet s per second. (Range: 64-95232000 ) Default Sett ing Enab l[...]

Interface C ommands 4-111 4 Command Mode Privileged Exec Command Usage S tatistic s are o nly init ialized for a power r e set. T his c o mmand set s the base value fo r displaye d statistics to zer o for the curre nt mana gement ses sion. How ever , if you lo g out an d back i nto t he manage ment in terfac e, the s tati stics displayed will show [...]

Command Line Interface 4-112 4 Example show inte rfaces counters This comm and disp lays inte rface statistics. Syntax show i nterface s counte rs [ in terface ] interfa ce • etherne t unit / port - unit - This is device 1. - port - Port number. • port-chann el cha nnel-id (Range: 1-4) Default Sett ing Shows the co unters for all interfaces. Co[...]

Interface C ommands 4-113 4 Example show inte rfaces switchpo rt This comm and displ ays the adm inistrati ve and operat ional status of th e specified int erfa ces . Syntax show i nterface s switchpo rt [ interface ] inte rface • etherne t unit / port - unit - This is device 1. - port - Port number . • port-chann el cha nnel-id (Range: 1-4) De[...]

Command Line Interface 4-114 4 Example This examp le shows t he configu ration setting fo r port 16. Console#show interfaces switchport ethern et 1/16 Broadcast threshold: Enabled, 3 2000 octets/second LACP status: Enabled Ingress rate limit: disable, Level: 30 Egress rate limit: disable, Level: 30 VLAN membership mode: Hybrid Ingress rule: Disable[...]

Mirror Port Command s 4-115 4 Mirror Port Commands This secti on describ es how to mirro r traffic from a sour ce port to a target por t. port monitor This c ommand configur es a mi rror se ssion. U se the no form to cl ear a mirror session . Syntax port mo n ito r interface [ rx | tx ] no port monitor in terf ace • interface - etherne t unit / p[...]

Command Line Interface 4-116 4 Example The follow ing exampl e configures the switch to m irror receive d packets from po rt 6 to 1 1: show port monitor This command displays mirr or information. Syntax sh ow port mo nitor [ inte rfa ce ] interfa ce - ethern et unit / port (source port) • unit - Switch (unit 1 ). • port - Port number. Default S[...]

Rate Limit Commands 4-117 4 Rate Limit Commands This funct ion allows th e network ma nager to cont rol the maxim um rate for traffic transmi tted or receive d on an interfa ce. Rate limi ting is conf igured on inte rfaces at the edg e of a n etwork to limit traffic into or out of the ne twork. Traffic that falls within the rate lim it is transmit [...]

Command Line Interface 4-118 4 Example rate-li mit granularit y Use this com mand to define the rate limit granul arity for the Fast Ethernet ports, and the Gigab it Ethernet por t s . Use the no form of this comm and to restor e the defaul t setting. Syntax rate- limit { fastethernet | gigabitethernet } granularity [ granularity ] no r ate-lim it [...]

Link Aggr egation Commands 4-119 4 Command Usage • For Fast Ethernet int erfaces, th e rate limit gran ularity is 51 2 Kbps, 1 Mbps, or 3.3 Mbp s. • For Gigab it Ethernet interfaces, the ra te limit granul arity is 33.3 Mbps . Example Link Aggregation Comma nds Ports can be statica lly grouped i nto an aggreg ate link (i.e., trunk) to increa se[...]

Command Line Interface 4-120 4 Guidelines for Creati n g Trunks General Guidelines – • Finish configuri ng port trun ks before you conn ect the correspon ding netwo rk cabl es bet ween sw itches to avoi d crea ting a loop. • A trunk ca n have up to e ight ports. • The port s at both ends o f a connecti on must be co nfigured as trunk ports.[...]

Link Aggr egation Commands 4-121 4 Example The follow ing exampl e creates tru nk 1 and the n adds port 1 1: lacp Thi s comma nd enab les 802 .3ad Li nk Aggr egati on Con trol Pr otocol (LACP) for the cur rent in terf ace. Us e the no form to disabl e it. Syntax [ no ] la c p Default Sett ing Disabled Command Mode Interface C onfigurat ion (Etherne[...]

Command Line Interface 4-122 4 Example The follow ing shows L ACP enabled on ports 1 1-13. Beca use LACP has also been enabled on the ports at the oth er end of the links , the show inte rfaces s t atus port-chann el 1 com mand shows that Trunk 1 has bee n established . lacp system- priority This c ommand configures a por t's LACP system prior[...]

Link Aggr egation Commands 4-123 4 Command Mode Interface C onfigurat ion (Ethernet ) Command Usage • Port mu st be configur ed with the s ame system priority to joi n the same LA G. • System priority is comb ined with the s witch’s M AC address to form the LAG ide ntifi er. Th is iden tifie r is us ed to i ndicat e a spec ific LAG duri ng LA[...]

Command Line Interface 4-124 4 • Once the re mote sid e of a link has been established , LACP op erational settings are already in use on that side. Configurin g LACP settin gs for the partne r only applies to its adminis trative stat e, not its operat ional state , and will only tak e effect the ne xt time an agg regate link i s establishe d wit[...]

Link Aggr egation Commands 4-125 4 lacp port-priority This comm and config ures LACP po rt priority . Use the no form to rest ore the defa ult setting. Syntax lacp { ac tor | pa rt n e r } por t-priority priority no lacp { actor | pa r t ne r } po rt-pri orit y • actor - Th e local side an ag gregate link . • partner - The remote s ide of an ag[...]

Command Line Interface 4-126 4 Default Sett ing Port Ch annel: a ll Command Mode Privileged Exec Example Console#show 1 lacp counters Channel group : 1 ----------------------------------------- -------------------------------- Eth 1/ 1 ----------------------------------------- -------------------------------- LACPDUs Sent : 21 LACPDUs Received : 21[...]

Link Aggr egation Commands 4-127 4 Console#show lacp 1 internal Channel group : 1 ----------------------------------------- -------------------------------- Oper Key : 4 Admin Key : 0 Eth 1/1 ----------------------------------------- -------------------------------- LACPDUs Internal : 30 sec LACP System Priority : 32768 LACP Port Priority : 32768 A[...]

Command Line Interface 4-128 4 Console#show lacp 1 neighbors Channel group 1 neighbors ----------------------------------------- -------------------------------- Eth 1/1 ----------------------------------------- -------------------------------- Partner Admin System ID : 32768, 00-00- 00-00-00-00 Partner Oper System ID : 32768, 00-00-0 0-00-00-01 Pa[...]

Address T abl e Commands 4-129 4 Address Table Command s Thes e command s are used t o config ure the addr ess ta ble for f ilteri ng speci fied addr esses , di splayi ng curren t entri es, clea ring the t able, or setti ng the agi ng time. Console#show lacp sysid Port Channel System Priority Syste m MAC Address ------------------------------------[...]

Command Line Interface 4-130 4 mac-addr ess-table static This comm and maps a static ad dress to a destina tion port in a VL AN. Use the no form to rem ove an addr ess. Syntax mac-ad dress-table static mac-a ddress in terface in terf ace vlan vlan-i d [ acti on ] no ma c-addre ss-t able stat ic mac- address vlan vlan- id • mac-a ddress - MAC a dd[...]

Address T abl e Commands 4-131 4 clear mac -address-table dynamic This comm and remov es any l earned entr ies from the fo rwarding da tabase and clears the transmit an d receive co unts for any static or s ystem confi gured entr ies. Default Sett ing None Command Mode Privileged Exec Example show ma c-address-table This comm and shows classes o f [...]

Command Line Interface 4-132 4 00-00-0 0-00-00- 00 means an exa ct match , and a mask of FF-FF-FF -FF-FF-FF mean s “any.” • The maxi mum num ber of addre ss entries is 8191. Example mac-addres s-table aging-time This comm and sets the aging time for ent ries in the add ress table. Use th e no form to restor e the default agi ng time. Syntax m[...]

Spanning Tree Commands 4-133 4 Spanning Tree Command s This secti on includes co mmand s that config ure the S panni ng T r ee Algorithm (S T A) globally fo r the switch, and comman ds that conf igure ST A for the sele cted interf ace. span ning -tree Thi s comman d enable s the S p anning Tr ee Algori thm glo bally f or the s witch. Use th e no fo[...]

Command Line Interface 4-134 4 an ST A-com pliant sw itch, bridge or router) in your netw ork to en sure that on ly one rout e exists between an y two station s on the networ k, and prov ide backu p links wh ich automat ically take over w hen a primary link goes down. Example This examp le shows ho w to enable th e S panning Tree Algorithm for the [...]

Spanning Tree Commands 4-135 4 spanning-tre e forward-time This comm and config ures the spannin g tree bridg e forward time g lobally for this switch. Use the no fo rm to restore th e defa ult. Syntax spanning-tree forw ard- time seco nds no spanning-tree fo rward -time seconds - T i me in seconds. ( Range: 4-30 seconds) The minimum value i s the [...]

Command Line Interface 4-136 4 Command Usage Thi s comma nd set s the t ime int erval (in s econds) at whi ch the root de vice transmi ts a configuratio n message. Example span ning -tree max- age Thi s command con figur es the sp anning t ree brid ge maximum age globa lly for th is switch. Use the no fo rm to restore th e defa ult. Syntax spanning[...]

Spanning Tree Commands 4-137 4 spanning-tre e priority This c ommand configur es the s panning tree priori ty globa lly for th is switc h. Use t he no form to restore the default. Syntax spanning-tree priority prior ity no spanning-tree priorit y priority - Pr iority of the bridge. (Range – 0-61440, in steps of 4096; Options: 0, 40 96, 8192, 1228[...]

Command Line Interface 4-138 4 Command Usage The path cost me thod is used to determine the best path betwee n device s. Therefo re, lower value s should be assi gned to ports attached to fast er media, and hi gher va lues ass igned to ports with slower media. N ote tha t path cos t (page 4-138 ) takes precede nce over port pri ority (page 4-139) .[...]

Spanning Tree Commands 4-139 4 Default Sett ing • Etherne t – half duplex : 2,000,000; full duplex: 1,00 0,000; tr unk: 500,00 0 • Fast Eth ernet – half dup lex: 200,000 ; full duplex: 100,000; trun k: 50,000 • Gigabit Et hernet – ful l duplex: 10, 000; trunk: 5,000 Command Mode Interface C onfigurat ion (Ethernet , Port Chann el) Comma[...]

Command Line Interface 4-140 4 Example Related Commands spanning-tr ee cos t (4-138 ) spanning-tre e edge-port This comm and spe cifies an inte rface as an edge port. Use the no for m to restore the default. Syntax [ no ] sp an ning-tree edge -port Default Sett ing Disabled Command Mode Interface C onfigurat ion (Ethernet , Port Chann el) Command U[...]

Spanning Tree Commands 4-141 4 spanning-tre e portfast This comm and sets an inter face to fast for warding. Use the no form to d is able fast forwar ding. Syntax [ no ] sp an ning-tree p ortfast Default Sett ing Disabled Command Mode Interface C onfigurat ion (Ethernet , Port Chann el) Command Usage • This co mmand i s used to enable/di sable th[...]

Command Line Interface 4-142 4 Default Sett ing auto Command Mode Interface C onfigurat ion (Ethernet , Port Chann el) Command Usage • Specif y a point-to-poi nt link if the inter face can only be connec ted to exact ly one oth er bridge , or a shar ed link if i t can be con nected to two or mo re bridge s. • When au tomati c detection is selec[...]

Spanning Tree Commands 4-143 4 Example show sp anning-tree This comm and shows the configu ration for the s panning tree. Syntax show s p an ning-tree [ inte rface ] • interface • etherne t unit / port - unit - This is device 1. - port - Port number . • port-chann el cha nnel-id (Range: 1-4) Default Sett ing None Command Mode Privileged Exec [...]

Command Line Interface 4-144 4 Example Console#show spanning-tree Spanning-tree information ----------------------------------------- ---------------------- Spanning tree mode: RSTP Spanning tree enabled/disabled: enabled Priority: 40960 Bridge Hello Time (sec.): 2 Bridge Max Age (sec.): 20 Bridge Forward Delay (sec.): 15 Root Hello Time (sec.): 2 [...]

VLAN Commands 4-145 4 VLAN Commands A VLAN is a gro up of ports that ca n be located anyw here in the ne twork, but comm unicate as tho ugh they be long to the sam e physic al segment. This section describes comma nds used to cr eate VLAN grou ps, add port me mbers, speci fy how VLAN taggi ng is u sed, and enable automa tic VLAN registratio n for t[...]

Command Line Interface 4-146 4 Example Related Commands show vlan (4-153) vlan This co mmand co nfigure s a VLAN. Use the no form to restore the def ault settings or de lete a V LAN . Syntax vlan vlan-i d [ name vlan -name ] media ethe rnet [ state { act ive | suspend }] no vlan vlan-id [ name | state ] • vlan-i d - ID of con figured VLAN. (Range[...]

VLAN Commands 4-147 4 Configuring VLAN Inte rfaces interfac e vlan This comm and enters interface conf iguration mod e for VLANs, whic h is used to configur e VLAN parame ters for a physi cal interfac e. Syntax interf ace vlan vlan-id vlan-id - ID of the configured VLAN. (Range: 1-4094, no leading zeroes) Default Sett ing None Command Mode Global C[...]

Command Line Interface 4-148 4 switchpo rt mode This comm and config ures the VLAN m embersh ip mode for a por t. Use the no form to restor e the default. Syntax switchport mode { trunk | hybri d | priv ate-vl an } no switchport mode • trunk - Spe cifies a por t as an end -point for a VLAN trun k. A trunk is a direct link betw een two sw itches, [...]

VLAN Commands 4-149 4 Command Mode Interface C onfigurat ion (Ethernet , Port Chann el) Command Usage When set to receive all fram e types, an y received fra mes that are un tagged are assigne d to the defau lt VLAN. Example The follow ing exampl e shows how t o restrict the tra ffic received on port 1 to tagged fram es: Related Commands switch por[...]

Command Line Interface 4-150 4 Example The follow ing exampl e shows how t o set the interf ace to port 1 an d then enabl e ingress fil tering: switchpo rt native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no form to rest ore the def ault. Syntax switchpo rt native vlan vlan-i d no switchp ort native vl an vla[...]

VLAN Commands 4-151 4 switchpo r t allo wed vlan This c ommand configures VLAN groups o n the se lected i nterface. Use t he no form to restor e the default. Syntax switchpo rt allowed vl an { ad d vlan-lis t [ tagged | untagged ] | remo ve vlan -list } no switchp ort allowed v lan • add vlan-l ist - List of VLAN i dentifi ers t o add. • remo v[...]

Command Line Interface 4-152 4 switchpo r t forbid den vlan This c ommand configures forbidden VLANs . Use the no form to remove the list of forbidde n VLANs. Syntax switchport forbidden vlan { add vlan -list | remo ve vlan-l ist } no switchp ort forbidd en vlan • add vlan-l ist - List of VLAN i dentifi ers t o add. • remo ve vlan- list - List [...]

VLAN Commands 4-153 4 Displaying VLAN Infor m ation show vl an This c ommand shows V LAN inf ormation. Syntax show v lan [ id vlan- id | name v lan-na me | priv ate-v lan priv ate-vlan -type ] • id - Key word to be followe d by the VLAN I D. - vlan-i d - ID o f the con figured V LAN. (Ran ge: 1-409 4, no leadin g zeroes) • name - Keyw ord to be[...]

Command Line Interface 4-154 4 Configuring Pri vate VLANs Private VLA Ns provide po rt-based s ecurity an d isolation bet ween ports within the assigne d VLAN. This s witch suppo rts two types of pr ivate VLAN po rts: promiscuo us, and comm unity ports. A promi scuous por t can communi cate with all inter faces within a priv ate VLAN . Communi ty p[...]

VLAN Commands 4-155 4 private -vlan Use this c ommand to crea te a prima ry , iso lated or communit y private VL AN. Use t he no form to remove th e specified private VLAN. Syntax private- vlan vlan -id { communit y | p rimary | isolat ed } no private- vlan vlan-i d • vlan-i d - ID of priv ate VLAN. (Ran ge: 1-40 94, no leading zeroes). • commu[...]

Command Line Interface 4-156 4 private vlan associati on Use this com mand to ass ociate a pr imary VLAN wi th a seconda ry (i.e., commu nity) VLA N. Us e th e no form to remove a ll associations for the specified primary V LAN. Syntax private- vlan prim ary-vlan -id associatio n { second ary-vl an-id | add second ary-vlan -id | remo ve seco ndary-[...]

VLAN Commands 4-157 4 Default Sett ing Normal VLAN Command Mode Interface C onfigurat ion (Ethernet , Port Chann el) Command Usage Promisc uous ports assign ed to a primary VLAN can co mmunicat e with all other prom iscuous po rts in the same VLAN, as well as with all the ports in the associ ated seconda ry VLANs. Example switchpo r t priva te-vlan[...]

Command Line Interface 4-158 4 swit chp ort pr ivate -vla n ma ppin g Use this com mand to map a n interface to a pr imary VLAN . Use the no form to remove this mappi n g. Syntax swit chport p rivat e-vlan ma pping pr imary-vl an-i d no switchp ort privat e-vlan mapp ing primary-vlan-id – ID of primary VLAN. (Range: 1-4094, no leading zeroes). De[...]

GVRP and Bridge Exten sion Commands 4-159 4 Example GVRP and Bridge Extens ion Commands GARP VL AN Registra tion Protoco l defines a wa y for switches to exchang e VLAN informat ion in order to aut omatically register VLAN m embers on i nterfaces ac ross the netwo rk. This se ction descri bes how to en able GVRP for individua l interface s and glob[...]

Command Line Interface 4-160 4 Example show bridg e-ext Thi s command shows the conf igurat ion f or brid ge exte nsion commands. Default Sett ing None Command Mode Privileged Exec Command Usage See “Enabli ng or Disablin g GVRP (Globa l Setting)” on page 3-104 and “Dis playing Bridge Extension C apabilities” on page 3 -1 1 for a descrip ti[...]

GVRP and Bridge Exten sion Commands 4-161 4 show gv r p con figuration This c ommand shows i f GVRP is ena bled. Syntax show g vrp configurat ion [ interface ] inte rface • etherne t unit / port - unit - This is device 1. - port - Port number . • port-chann el cha nnel-id (Range: 1-4) Default Sett ing Shows bo th global and i nterface-sp ecific[...]

Command Line Interface 4-162 4 Command Usage • Group Address Registrati on Protoc ol is use d by G VRP a nd GMRP to regi ster or deregi ster cl ient a ttrib utes fo r clien t serv ices wi thin a bridge d LAN. T he default v alues for the GA RP timers ar e independe nt of the me dia access metho d or data rate. These values s hould not be c hanged[...]

Priority Commands 4-163 4 Related Commands garp timer (4-1 61) Priority Commands The comm ands des cribed in this se ction allow y ou to specif y which data packets have grea ter preced ence when t raffic is buffered in the switc h due to conges tion. This switch suppor ts CoS with four prior ity queues for each port. Da t a packets in a port’s h[...]

Command Line Interface 4-164 4 queue mod e This comm and sets the que ue mode to st rict priority or W e ighted R ound-Rob in (WR R) for t he class of serv ice (C oS) pri ority q ueues. U se the no form t o res tore the default va lue. Syntax queue mod e { strict | wrr } no queue mode • strict - Se rvices the egr ess queues in sequential order, t[...]

Priority Commands 4-165 4 Default Sett ing Weights 1, 2, 4, 6 are as signed to queues 0-3 re spective ly . Queue 0 is no n-config urable. Command Mode Global Co nfiguration Command Usage WRR co ntrols ba ndwid th shar ing at the eg ress po rt by defin ing sch edulin g weights. Example Thi s exampl e shows how to assign WRR weig hts t o prior ity qu[...]

Command Line Interface 4-166 4 • This switch provides ei ght priority que ues for each por t. It is configured to use Weigh ted Round Ro bin, which c an be viewed w ith the show queue bandwidth comma nd. Inboun d frames that do no t have VLAN t ags are tagged with the input p ort’s def ault ingre ss user p riority, an d then placed i n the appr[...]

Priority Commands 4-167 4 Command Usage • CoS val ues assigne d at the ingres s port are also us ed at the egre ss port. • This comm and sets th e CoS priority for all interfaces. Example The follo wing exam ple shows how to map CoS value s 0, 1 and 2 t o egress qu eue 0, value 3 to egress q ueue 1, v alues 4 and 5 to egress queue 2, and val ue[...]

Command Line Interface 4-168 4 Example show que ue cos-map This co mmand shows th e class of se rvice pri ority map. Syntax show q ueue cos -map [ interface ] interfa ce • etherne t unit / port - unit - This is device 1. - port - Port number. • port-chann el cha nnel-id (Range: 1-4) Default Sett ing None Command Mode Privileged Exec Example Con[...]

Priority Commands 4-169 4 Priority Comma nds (Layer 3 and 4) map ip port (Gl obal Configura tion) This co mmand en ables IP p ort mapp ing (i.e., cl ass of ser vice map ping for TCP/ UDP socke ts). Use the no f orm to disabl e IP port mapp ing. Syntax [ no ] m ap ip port Default Sett ing Disabled Command Mode Global Co nfiguration Command Usage The[...]

Command Line Interface 4-170 4 map ip port (Inte rface Configura tion) This command set s IP port priority (i.e., TCP/UDP port pri o rity). Use the no form to remove a sp e cifi c setti ng. Syntax map ip port port numb er cos co s-value no map ip port port-nu mber • port -num ber - 16-bi t TCP/U DP port number.(R ange 1 -65535) • cos-val ue - C[...]

Priority Commands 4-171 4 Example The follow ing example sh ows how t o enable IP pr ecedence mapping glob ally: map ip pr ecedence (Interfa ce Configu ration) This co mmand se ts IP preced ence priori ty (i.e., IP T y pe of Se rvice priori ty). Use the no form to restore the default table . Syntax map ip preceden ce ip-prec edence-value cos co s-v[...]

Command Line Interface 4-172 4 map ip ds cp (Global Con figuration) This comm and enable s IP DSCP mapp ing (i.e., Different iated Services Code Point mapping) . Use the no f orm to disabl e IP DSCP mappin g. Syntax [ no ] m ap ip dscp Default Sett ing Disabled Command Mode Global Co nfiguration Command Usage • The prece dence for pr iority map p[...]

Priority Commands 4-173 4 Default Sett ing The DS CP defaul t value s are defin ed in the f ollowi ng tabl e. Not e that all the DSCP values th at are n ot spec ified are mapped to CoS value 0. Command Mode Interface C onfigurat ion (Ethernet , Port Chann el) Command Usage • The prece dence for pr iority map ping is IP Port, IP P recedence or IP [...]

Command Line Interface 4-174 4 Default Sett ing None Command Mode Privileged Exec Example The follow ing shows tha t HTTP traffic has bee n mapped to Co S value 0: Related Commands map ip port ( Global Configuration) (4- 1 69) map ip port (Interface C onfiguration ) (4-170) show ma p ip precedence This comm and shows the IP preced ence priorit y ma[...]

Priority Commands 4-175 4 Example Related Commands map ip port ( Global Configuration) (4- 1 69) map ip prec edence (Int erface Conf iguration ) (4-171) show ma p ip dscp This comm and shows the IP DSC P priority map. Syntax show m ap ip d scp [ interface ] inte rface • etherne t unit / port - unit - This is device 1. - port - Port number . • p[...]

Command Line Interface 4-176 4 Example Related Commands map ip dscp ( Global Co nfiguration) (4-172) map ip dscp (Int erface C onfigu ration ) (4-1 72) Multicast Filtering Comma nds This switc h uses IGMP (Int ernet Grou p Manage ment Protoco l) to query for an y attached ho sts that w ant to receive a specific multicas t servic e. It ide ntifies t[...]

Multicas t Filtering Command s 4-177 4 ip igmp sn ooping This comm and ena bles IGM P snooping o n this sw itch. Use t he no form t o disabl e it. Syntax [ no ] ip igm p snooping Default Sett ing Enabled Command Mode Global Co nfiguration Example The follow ing example en ables IG MP snoopin g. ip igmp sn ooping vlan stati c This comm and adds a po[...]

Command Line Interface 4-178 4 ip igmp sn ooping version This c ommand configures the IG MP snoo ping v ersion. Us e the no form to restore the defaul t. Syntax ip igmp s nooping version { 1 | 2 } no ip igmp snooping ve rsion • 1 - IGMP Version 1 • 2 - IGMP Version 2 Default Sett ing IGMP V ersion 2 Command Mode Global Co nfiguration Command Us[...]

Multicas t Filtering Command s 4-179 4 Example The fo llowing sh ows the curre nt IGMP snooping configu ration: show ma c-address-table m ulticast This comm and shows known mul ticast addr esses. Syntax show m ac-addre ss-table multic ast [ vlan vlan-id ] [ user | igmp-snooping ] • vlan-i d - VLAN ID (1 to 4 0 94) • user - Display only th e use[...]

Command Line Interface 4-180 4 IGMP Query Commands (Layer 2) ip igmp sn ooping querier This co mmand e nables the switch a s an IG MP quer ier . Use the no form to disable it. Syntax [ no ] ip igm p snooping querier Default Sett ing Enabled Command Mode Global Co nfiguration Command Usage If enabled , the switch will ser ve as querie r if elected. [...]

Multicas t Filtering Command s 4-181 4 Default Sett ing 2 times Command Mode Global Co nfiguration Command Usage The que ry coun t defin es how long the querier waits for a respo nse from a multicas t client b efore t a king a ction. If a queri er has se nt a nu mber of queries defined by this comm and, but a client has no t respon ded, a countdown[...]

Command Line Interface 4-182 4 ip igmp sn ooping query-max- response-time This c ommand configur es the q uery rep ort de lay . Use t he no form to restore the default. Syntax ip igmp s nooping query-max-res ponse-time seco nds no ip igmp snooping que ry-max-respon se-time seconds - The report delay advertised in IGMP queries. (Range: 5-25) Default[...]

Multicas t Filtering Command s 4-183 4 Default Sett ing 300 secon ds Command Mode Global Co nfiguration Command Usage The swit ch must use IGMPv2 for thi s command to t ake effe ct. Example The follow ing shows h ow to configu re the defau lt timeout to 300 seconds: Related Commands ip i gmp sn ooping v ersion (4-17 8) Static Mul t icast Rout ing C[...]

Command Line Interface 4-184 4 Command Usage Depend ing on your netw ork connec tions, IGMP snooping may not alway s be able to loca te the IGMP quer ier . Theref ore, if the IGMP querier is a known multicast router/sw itch connect ed over the ne twork to an in terface (por t or tru nk) on you r router , you can m anuall y config ure that int erfac[...]

IP Interface Command s 4-185 4 IP Interface Commands An IP addre sses may be us ed for mana gement ac cess to the sw itch over you r network . The IP addre ss for this switc h is obtained via DHCP by defaul t. Y ou can manuall y configure a sp ecific IP a ddress, or direc t the devic e to obtain an addre ss from a BOOTP or DHCP server when it is po[...]

Command Line Interface 4-186 4 • If you select the bootp or dhcp opt ion, IP i s enabled but will n ot funct ion until a BOOTP or DH CP reply has been rece ived. Reques ts will be broadc ast periodic ally by this de vice in an effort to learn its IP ad dress. (BOO TP and DHCP values can include the IP address, de fault gateway, and subnet mask). [...]

IP Interface Command s 4-187 4 Related Commands ip a ddress (4-185) ip default-g ateway This comm and establishe s a static route be tween this sw itch and mana gement stations th at exist on an other netw ork segm ent. U se the no form to remo ve the sta tic route. Syntax ip default- gateway gatew ay no ip default-gateway gateway - IP address of t[...]

Command Line Interface 4-188 4 show ip r edirec ts Thi s command shows the def ault gat eway co nfigur ed for this d evice. Default Sett ing None Command Mode Privileged Exec Example Related Commands ip default- gateway (4-187) ping This comm and sends ICMP echo request packets to an other node on the netwo rk. Syntax ping host [ size si ze ] [ cou[...]

IP Interface Command s 4-189 4 Example Related Commands int erface ( 4-104) Console#ping 10.1.0.9 Type ESC to abort. PING to 10.1.0.9, by 5 32-byte payload IC MP packets, timeout is 5 seconds response time: 10 ms response time: 10 ms response time: 10 ms response time: 10 ms response time: 10 ms Ping statistics for 10.1.0.9: 5 packets transmitted, [...]

Command Line Interface 4-190 4[...]

A-1 Appendix A: Software Specifications Software Features Authentication Local, RADIUS, T ACACS, Port (802.1x), HTTPS, SSH, Port Securi ty Acce ss Contro l List s IP , MAC (up to 88 lists) DHCP Client Port Co nfiguration Fixed Ports:100 BASE-TX –1 0/100 Mb ps, half/full duplex Optiona l Modules : 100BASE-F X: 100 Mbps, full du plex, 1000BASE- T :[...]

Software Specifi cations A-2 A Addi tiona l Featur es BOOTP client CIDR (Classless In ter-Domain Routing) SNTP (Simpl e Network Time Protocol) SNMP (Si mple Netwo rk Manageme nt Protocol) RMON (R emote Mon itoring, grou ps 1,2,3,9) Management Features In-Band Managem ent T elnet, Web-base d HTTP or HTT PS, SNMP man ager , or Sec ure Shell Out-of-Ba[...]

Management Inf ormation Bases A-3 A SNMPv2 (R FC 2571) SNTP (RFC 2030) SSH (V ersi on 2.0) TFTP (RFC 1350) Management Information Bases Bridge MIB (R FC 1493) Entity MI B (RFC 2 7 37) Ether-l ike MIB (RFC 2665) Extende d Bridge MIB (RFC 267 4) Extensible SNMP Age nts MIB (RFC 2742) Forwardin g T able MIB (RFC 20 96) IGMP MIB (RF C 2933) Interface G[...]

Software Specifi cations A-4 A[...]

B-1 Appe ndix B: Trouble shooting Problems Accessing the Management Interface T abl e B-1. T rou blesho oting Cha rt Sympt om Acti on Cannot co nnect usin g T e lnet, web brow ser, or SNMP software • Be sure the s witch is po wered up . • Check netwo rk cabl ing betwee n the man agement station an d the switc h. • Check that you ha ve a valid[...]

T ro ubleshooting B-2 B Using System Logs If a fau lt does occur , refe r to the Installa tion Guide to ensur e that the problem you encount ered is act ually caused by the switch. If the problem appears to be c aused by th e switch, fol low thes e step s: 1. Enable logg ing. 2. Set the erro r messages reported to i nclude all categ ories. 3. Desig[...]

Glos sary-1 Glossary Acces s Control List (ACL) ACLs ca n limit netw ork tra ffi c and restr ict acce ss to cert ain user s or devic es by checkin g each packet for certain IP or MA C (i.e., Laye r 2) informa tion. Boot Protocol (BOOTP) BOOTP is use d to provid e bootup infor mation for network de vices, includi ng IP address information , the addr[...]

Glossar y Glossar y-2 GARP VLAN Registration Protoco l (GVRP) Defines a way for switche s to excha nge VLAN infor mation in orde r to register necessa ry VLAN me mbers on po rts along the Spanning T re e so that VLANs defined in each swi tch can wo rk automatica lly over a Sp an ning Tree network. Generic Att r ibute Registration Protocol (GARP) GA[...]

Glos sary-3 Glossar y IGMP Snoo ping Listenin g to IGMP Query and I GMP Report packe ts transferred betw een IP Multicas t Routers and IP Multic ast host gr oups to identify IP Multicast gro up member s. IGMP Query On eac h subne twork, on e IGMP-ca pable devic e will act as the q uerier — that is, t he device tha t asks all ho sts to report on t[...]

Glossar y Glossar y-4 Multicas t Switching A proce ss wher eby th e switch filters i ncoming multica st frames for se rvices for which n o attached host has reg istered, or forwards them to all p orts contained within the design ated multicas t VLAN grou p. Network Time Prot ocol (NTP) NTP prov ides the mech anisms to synchroni ze time acros s the [...]

Glos sary-5 Glossar y Secure Shell (SSH) A secure r eplaceme nt for remote ac cess functio ns, includ ing T e lnet. SSH can authenti cate users with a cryptogr aphic key , and en crypt data con nections be tween manage ment clients and t he switch. Simple Netw ork Management Protoc ol (SNMP) The ap plicat ion pro tocol in the I ntern et suite of pr[...]

Glossar y Glossar y-6 Vir tual LAN (VLAN) A Virtual LAN is a colle ction of netwo rk nodes tha t share the sa me collision domain regardle ss of their phys ical locatio n or connection point in the netwo rk. A VLAN serves as a logical wo rkgroup with no physica l barriers, and allows users to share informat ion and resou rces as thou gh located on [...]

Index-1 Numerics 802.1x, po rt authent ication 3 -46, 4-77 A accepta ble frame ty pe 3-111, 4-14 8 Acce ss Contro l List Se e ACL ACL Extende d IP 3-54 , 4-85, 4-86, 4-88 MAC 3- 54, 4- 85, 4-93 , 4-93 –4-95 Standard I P 3-54, 4-85 , 4-86, 4-87 address table 3-86 , 4-129 aging time 3-89, 4-132 B BOOTP 3- 14, 4-18 5 BPDU 3-90 broadca st storm, thre[...]

Index-2 Index IGM P groups, displaying 3-137, 4-179 Laye r 2 3-1 33, 4-17 6 quer y 3-133 , 4-180 query, Layer 2 3-1 33, 4-180 snoopin g 3-133, 4-177 snoo ping, c onfi guring 3-1 33, 4-17 6 ingress fil tering 3-11 1, 4-149 IP ad dress BOOTP /DHCP 3-14 , 4-185, 4-186 set ting 2-4, 3-12, 4-185 IP pr ecedenc e enabling 3-126, 4-169, 4 -170 mapping pr i[...]

Index-3 Index R RADIUS , logon auth entication 4- 69 rate limit s, setting 3-80, 4-117 rem ote l oggin g 4-4 6 restartin g the system 3-27, 4-22 RSTP 3-89 , 4-134 global c onfigura tion 3-90, 4- 134 S secondar y VLAN 3-114 secure sh ell 3-39 , 4-34 Secure She ll configurat ion 3-39, 4-37 serial por t configur ing 4-10 Simple N etwork Ma nageme nt P[...]

Index-4 Index W Web inter face access re quireme nts 3 -1 configur ation button s 3 -3 home pag e 3- 2 menu list 3-4 panel disp lay 3-3[...]

[...]

38 T esla Irvine, CA 92618 Phone: (9 49) 679-8000 Model Num ber: SMC6716AL2 V ersion Num b er: F2.2 .3.9 E072004-R01 Publicati on Numb er: 150 000013500 H FOR TECHNICAL SUPPOR T , CALL: From U.S.A. an d Canada (2 4 hours a day , 7 days a wee k) (800) SMC-4-YOU; (94 9) 679-8000; F a x: (949) 679- 1481 From E urope (8:00 AM - 5: 30 PM U K Time) 44 (0[...]