SMC Networks SMC6224M инструкция обслуживания

T igerStack 10/100 24/48-P ort 10/100Mbps Stackable Managed Switch Management Guide ◆ 24/48 au to-MDI/M DI-X 10BASE-T/100B AS E-TX ports ◆ 2 Gigabit RJ-45 port s shared with 2 SFP transcei ver slots ◆ 2 Gigabit stacking ports that act as E thernet ports in standalo ne mode ◆ Stacks up to 8 units (SMC6224M ) ◆ Stacks up to 4 units (SMC6248[...]

[...]

38 T esla Irvine, CA 9261 8 Phone: (9 49) 679-8000 T igerStack 10/100 Management Guide From SMC’ s T iger line of feature-r i ch w orkgroup LAN solutions Janu ary 2 005 Pub. # 14 9100005900[...]

Infor mation fur nished by SMC Networks , In c . (SMC) is believed to be accu- rate and reliable. How ever, no responsibility is assumed by SMC for its use, nor fo r any inf ringeme nts of pa tents or oth er rights of third pa rtie s which may result from its use. No license is g ranted by implication or ot herwise under any patent or patent ri ght[...]

i L IMITED W ARRANTY Limited W ar ranty Statement: SMC Networks, Inc. (“SM C”) war rants it s products to be free from defects in w orkmanship and materials, under nor mal use and ser vice, for t he applicable warranty term . All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized R eseller[...]

L IMIT ED W AR RAN TY ii WARRA NTIES EXCLUSIVE : IF AN SMC PR ODUCT DOES NOT OPERA TE AS W ARRANTED ABO VE, CUSTOM ER’S SOLE REMED Y SHALL BE R EP AIR OR REPLA CEMENT OF THE PR ODUCT IN QUESTION , A T SMC’S OPTION . THE FOREGOIN G W ARRANTIES AND REMEDIES AR E EXCL USIVE AND AR E IN LIEU OF ALL OTHER W ARRANTIES OR CONDITION S , EXPRESS OR IMPL[...]

iii C ONTENTS 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Key Featu res . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Descripti on of Software Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 System Defa ults . . . . . . . . . . . [...]

C ONTENTS iv Displaying Sw itch Hardware/S oftware Version s . . . . . . . . . . . 3-13 Displaying Bridge Extension Capabilitie s . . . . . . . . . . . . . . . . . 3-15 Setting th e Switch’s IP Ad dress . . . . . . . . . . . . . . . . . . . . . . . . 3-17 Manual Con figuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-18 Using D[...]

C ONTENTS v Filtering A ddresses fo r Management A ccess . . . . . . . . . . . . . . . 3-75 Access Con trol Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-77 Configuri ng Access Cont rol Lists . . . . . . . . . . . . . . . . . . . . . . . 3-77 Setting th e ACL Name and Type . . . . . . . . . . . . . . . . . [...]

C ONTENTS vi Displaying Ba sic VLAN Infor mation . . . . . . . . . . . . . . . 3-148 Displaying C urrent VLAN s . . . . . . . . . . . . . . . . . . . . . . . 3-149 Creating VL ANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-151 Adding Stat ic Members to V LANs (VLAN I ndex) . . . . 3-153 Adding Sta tic Members to VLANs (Por t [...]

C ONTENTS vii Telnet Co nnection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Entering Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4 Keywor ds and Argu ments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4 Minimum Ab breviation . . . . . . . . . . . . . . [...]

C ONTENTS viii quit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-31 System Man agement Com mands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-32 Device Desi gnation Command s . . . . . . . . . . . . . . . . . . . . . . . . 4-33 prompt . . . . . . . . . . . . . . . . . . . . . . . .[...]

C ONTENTS ix clear log ging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-63 show logg ing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-63 show log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-65 SMTP Alert Com mands . . . . . . . . . . . . . . . . . . .[...]

C ONTENTS x RADIUS Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-96 radius-ser ver host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-97 radius-ser ver port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-98 radius-ser ver key . . . . . . . . . . . . . . . . . . . . . . . [...]

C ONTENTS xi MAC ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-127 access-list mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-127 permit , deny (MAC ACL ) . . . . . . . . . . . . . . . . . . . . . . . . . 4-128 show mac a ccess-lis t . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

C ONTENTS xii show rate-lim it . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-161 Link Ag gregation C ommands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-161 channel -group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-163 lacp . . . . . . . . . . . . . . . . . . . . . .[...]

C ONTENTS xiii Configuri ng VLAN Interfa ces . . . . . . . . . . . . . . . . . . . . . . . . . 4-198 interfac e vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-198 switchpor t mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-199 switchport a cceptable-fra me-types . . . . . . . . . . . . . . . . . [...]

C ONTENTS xiv map ip prece dence (I nterface Con figuration) . . . . . . . . . 4-230 map ip dscp (Global Configu ration) . . . . . . . . . . . . . . . . 4-231 map ip dscp (Interface Con figuration) . . . . . . . . . . . . . . . 4-231 show map ip p ort . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-233 show map ip preced ence . . . [...]

C ONTENTS xv A PPEN DICES : A Software Specifications . . . . . . . . . . . . . . . . . . . . . . . . . A-1 Software Fe atures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1 Managem ent Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-2 Standards . . . . . . . . . . [...]

C ONTENTS xvi[...]

xvii T ABLES Table 1-1 Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Table 1-2 System Defa ults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7 Table 3-1 Configur ation Option s . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Table 3-2 Main Menu . . . . . . . . . . . . . .[...]

T ABLES xviii Table 4-21 SMTP Alert Commands . . . . . . . . . . . . . . . . . . . . . . . . . 4-66 Table 4-22 Time Comma nds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-71 Table 4-23 System Stat us Commands . . . . . . . . . . . . . . . . . . . . . . . . 4-77 Table 4-24 Frame Siz e Commands . . . . . . . . . . . . . . . . . . .[...]

T ABL ES xix Table 4-58 Priority C ommands (Lay er 2) . . . . . . . . . . . . . . . . . . . . 4-220 Table 4-59 Default CoS Pr iority Levels . . . . . . . . . . . . . . . . . . . . . . 4-224 Table 4-60 Priority C ommands (Layer 3 and 4) . . . . . . . . . . . . . . . 4-227 Table 4-61 Mapping IP Preceden ce Values . . . . . . . . . . . . . . . . . . .[...]

T ABLES xx[...]

xxi F IGURES Figure 3-1 Ho me Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 Figure 3-2 P anel Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Figure 3-3 S ystem Inform ation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-12 Figure 3-4 S witch Informa tion . . . . . . [...]

F IGU R ES xxii Figure 3-37 ACL Config uration - Exten ded IP . . . . . . . . . . . . . . . . . 3-83 Figure 3-38 ACL Config uration - MAC . . . . . . . . . . . . . . . . . . . . . . . 3-85 Figure 3-39 Binding a Port to an ACL . . . . . . . . . . . . . . . . . . . . . . . . 3-87 Figure 3-40 Displaying Po rt/Trunk Infor mation . . . . . . . . . . . .[...]

F IGU R ES xxiii Figure 3-74 Queue Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-173 Figure 3-75 Configuri ng Queue Schedu ling . . . . . . . . . . . . . . . . . . . 3-174 Figure 3-76 IP Prece dence/DSCP Prio rity Status . . . . . . . . . . . . . . 3-176 Figure 3-77 Mapping I P Precedence Priori ty Values . . . . . . . . [...]

F IGU R ES xxiv[...]

1-1 C HAPTER 1 I NTRODUCTION This sw itch provides a broad range of features for La yer 2 switc hing. It include s a management agent t hat allows you to conf igure the featu res listed in this man u al. The default conf iguration can be used for mos t of the featu res provid ed by t his switc h. How eve r, the re are many options t hat you should [...]

I NTR O DUC TI ON 1-2 Descri ption of Softwa re Featu res Th e switch provide s a wide rang e of a dvanced perfor mance enh ancing featu res. Flow contro l eliminates the loss of packet s due to bott lenecks caused by port sa turation . Broadcas t stor m supp ression pr events broad cast traffic storms from engulfing the n et w ork. P ort -bas ed a[...]

D ESCRIPTION OF S OFTWARE F EAT UR ES 1-3 Configuration Backup and Restore – Y ou can sa ve the cur rent configuration s ettings to a file on a TFTP ser ver , and later download this file to restore the switch configuration s ettings . Authentication – This switc h authen ticates m a nagement access via the console port , T elnet or web browser[...]

I NTR O DUC TI ON 1-4 Rate Limiting – T his feature c ont rols the m aximum r at e for traffic transmi tted or recei ved on an interface . Rate limi ting is conf igured on inte rfaces a t the edge of a netw ork to limit tr affic in to or o ut of the network. T raffic that falls within the rate limit is transmitted, while pac kets that e xceed t h[...]

D ESCRIPTION OF S OFTWARE F EAT UR ES 1-5 Store-and-F orward S witching – The switch copies eac h frame into i ts memor y b efore for warding them to an other por t. T his en sures tha t all frames are a standard E ther net si ze and hav e been v erified for ac curacy with t he cyclic redund ancy chec k (CRC). T his pre vents bad frames from ente[...]

I NTR O DUC TI ON 1-6 switch to res trict tr affic to the VLAN g roups to which a user has be en assigne d. By segme nting your ne twork into VLA Ns , you ca n: • Eliminat e broadcast storms whic h severely degrade pe rformance in a flat ne twork. • Simplify ne twork ma nagement for node changes /moves by r emotely confi g uri ng VLAN membershi[...]

S YSTEM D EFAULTS 1-7 System Defaults The swit c h ’ s system defaults are provided in the config uration file “Factor y_Default_ Config.cfg. ” To reset th e switch de faults, this file should be s et as the startup conf iguration file (page 3-23). The following table lists some of the bas ic system defaults . Table 1-2 System Defaults Functi[...]

I NTR O DUC TI ON 1-8 Web Managem ent HTT P Se rve r Ena bled HTTP Port Number 80 HTTP Secure Server Enabled HTT P Se cure P ort Num ber 443 SNMP Co mmunity String s “pu blic” ( read on ly) “private” (read/write) Traps Authenticat ion traps: enabled Link-up-down events : enabled Port Configuration Adm in Statu s Enabl ed Auto-negotiation En[...]

S YSTEM D EFAULTS 1-9 Virtual LANs Default VLAN 1 PVID 1 Acceptab le Frame Type All Ingress F iltering Disabled Switchport Mod e (Egress Mode) Hybrid: t agged/unta gged frames GVRP (global) Disabled GVRP (port interface) Disabled Traffic Prioritization Ingress Port Priority 0 Weighted Round Robin Q ueue: 0 1 2 3 Weight: 1 2 4 6 IP Precedence Priori[...]

I NTR O DUC TI ON 1-10[...]

2-1 C HAPTER 2 I NITI AL C ONFIGURATI ON Connect ing to the Switch Configuration Opt ions The switc h includes a built-in ne twor k m anagem ent agent. The agent offer s a variety of man ageme nt options, includ ing SNMP , RM ON (Groups 1, 2, 3, 9) and a w eb- based interface . A PC may al so be conn ected directly to the sw itch for configuration [...]

I NI TIA L C ONFIGURATION 2-2 The swi tch’ s web interface , CLI config uration prog ram, and SNMP agent allow you to perf or m the following manageme nt functio ns: • Set us er n ames an d passw ords • Set an IP int erface f or a ma nageme nt VLAN • Con figure SNM P para meter s • Enable/ disable any port • Set the speed/d uplex mode f[...]

C ONNECTING TO THE S WITCH 2-3 Attach a VT100-compatible ter minal, or a PC r unning a ter minal emu lation pro g ram to the switc h. Y ou can use the consol e cable pro vided with this pac kage, or us e a null-m odem cable th at compli es with the w iring assignmen ts shown in th e Installation Guide. T o connect a ter minal t o the conso le port,[...]

I NI TIA L C ONFIGURATION 2-4 F or a descr iption of how to use the CLI, see “Using th e Command Li ne Interface” on page 4-1. F or a list of all the CLI commands and detailed information on usi ng the CLI, refer to “Co mmand Groups” on pa g e 4-12. Remote Connections Prior to accessing th e switch’ s onboa rd agent via a netw ork connect[...]

S TACK O PERATIONS 2-5 Stack Operations Y ou can stack up to eight SMC6224M units , four SMC6248M units, or four uni ts when bo t h s witch ty pes are stac ked togeth er. R efer to the Installation Guide for details on stacking the se units . One unit in the stack acts as the Mast er for configuration tasks and fir mware upgrade. All of the other u[...]

I NI TIA L C ONFIGURATION 2-6 Recovering from Stack Failure or Topology Change Note the follo wing points about r ecovering from a stack c hang e: • When using a “line” to pology, if any link or unit in th e stack fails, the stack will be split int o two separate segmen ts. The new stack se gments will then reboot an d resume normal operation[...]

B ASIC C ONFIGURATION 2-7 Basic Configuratio n Console Connectio n The CLI program provid es tw o differ ent comma nd lev els — normal access level (Nor mal Exec) and privileged access level (Privileged Exec). The commands avail able at the Normal Ex ec level are a limited subs et of those available at the Pri vile ged Exec level and allo w you t[...]

I NI TIA L C ONFIGURATION 2-8 Setting Passwords Note: If th is is your first time to log into the CLI p rogram, you should define new passw o rds for both de fault user nam es using the “usernam e” command, reco rd them and pu t them in a s afe place. P asswor ds can consist o f up to 8 alphan umeric chara cters and are ca se sensitive. T o pre[...]

B ASIC C ONFIGURATION 2-9 Setting an IP Address Y ou must est ablish IP address infor matio n for the stack to obtain manag ement a ccess t hrough t he network. T his can be done in either of the following ways: Manual — Y ou have to input the infor m ation, including IP address and subnet ma sk. If your manag ement s tation is not in the same IP[...]

I NI TIA L C ONFIGURATION 2-10 2. T ype “ip address ip-address netmask , ” where “i p-address” is the swit ch IP addre ss and “net mask” is the n etwork mask for the ne twork. Press <Ente r>. 3. T ype “ex it” to return to the global c onfiguration mode prompt. Press <Ente r>. 4. T o set the I P addre ss of the d efault g[...]

B ASIC C ONFIGURATION 2-11 2. At the interf ace-configu ration mode pr ompt, use on e of the fol lowing commands: • To obtain IP settings vi a DHCP, type “ip addres s dhcp” and press <Ente r>. • To obtai n IP settings via BOOTP, t ype “ip ad dress bootp ” and press <Enter >. 3. T ype “end” to return to the Pri vileged E [...]

I NI TIA L C ONFIGURATION 2-12 When SNM P management stations send request s to the sw itch (ei ther to return in for mation or to set a parameter) , the switch provides the request ed data or set s th e specified para meter . The switch can also be config ured to send in for mation to SNMP man agers (without be ing requeste d by the manag ers) th [...]

B ASIC C ONFIGURATION 2-13 2. T o remove an existing string, simp ly type “no snmp -ser ver comm un ity string , ” where “stri ng” is the c ommunity access strin g to remo ve. Press <Ente r>. Trap Receiver s Y ou can also specify SNMP stations th at are to recei ve trap s from the switc h. T o confi gure a trap receiv er , complete t [...]

I NI TIA L C ONFIGURATION 2-14 2. Enter t he name of the start-up file. Press <Enter>. Managing System Files Th e switch’ s flash me mor y suppor ts three ty pes of system f iles that can be managed b y the CLI pr og ram, w eb interf ace, or SNMP . The s witch’ s file syste m all ows files t o be uploade d and downlo aded, copie d, delete[...]

M ANAGING S YSTEM F ILES 2-15 Due to the size limit of the f lash me mor y , the s witch suppor ts only two operation code files . Howev e r , you can have as many diagnostic code files and configuration file s as av ailable f lash memor y space allows . In the s ystem f lash memory , one file of e ach type m us t b e set as the start-up file. Duri[...]

I NI TIA L C ONFIGURATION 2-16[...]

3-1 C HAPTER 3 C ONFIGURING THE S WITCH Using the We b Interface Th is switch provides a n embedde d HTTP web ag ent. Usin g a web browser you c an config ure the switc h and view st atistics to monitor netw ork acti vity . The web agent can be accesse d by any c omputer on th e netw ork using a st andard web br owser (Inte rne t Explorer 5.0 or ab[...]

C ONFIGURING THE S WI TCH 3-2 Notes: 1. Yo u are allow ed three at tempts to en ter the cor rect passw ord; on th e third failed at tempt the curr ent connec tion is terminate d. 2. If you log into th e web interface as guest (Normal Exec level), you ca n view the co nfiguratio n settings or change the guest password. If you log in as “admin” ([...]

N AVIGATIN G THE W EB B RO WS ER I NTE RFA CE 3-3 Navigati ng the Web Brow ser Int erface T o access the w eb-browser inte rface you mus t first enter a user name and passw ord. The administrator h as Read/W rite access to all conf ig urat i on parameter s and stati stics . The default user name and pa ssword for the administrator is “ admin.” [...]

C ONFIGURING THE S WI TCH 3-4 Configuration Opt ions Configur able param eters hav e a dialog bo x or a dro p-down li st. Once a config uration cha nge has been made on a p age, be su re to click on the Apply bu tton to con fir m the new setting . T he fol lowing table su mmarizes the w eb page confi guration b uttons . Notes: 1. To ensur e prope r[...]

M AIN M ENU 3-5 Main Menu Using t he onboard w eb agent, y ou can define s ystem param eters, manage and control the switch, and all its por ts , o r monitor network condit ions . The following table briefly des cribes the selection s av ailable from this prog ram . Table 3-2 Main Me nu Menu Descrip tion Page System 3-11 System Info rmation Provide[...]

C ONFIGURING THE S WI TCH 3-6 SNTP 3-42 Configuratio n Configures SNTP client se ttings, including broadcast m ode or a specified list of servers 3-4 2 Clock T ime Zone Sets the local time zone for the syste m clock 3-44 SNMP 3-45 Configu ration Config ures community strings and related trap fu nctions 3-4 5 Security 3-48 User Accounts Assigns a n [...]

M AIN M ENU 3-7 IP Filter Sets IP address es of clients allowed manageme nt access via the web, SN MP, and Telnet 3-7 5 Port 3- 88 Port Inform ation D isplays port connection status 3-88 Trunk I nformation Displays trunk connection status 3-88 Port Conf iguration Configur es port connection set tings 3-91 Trunk C onfiguration Configures trun k conn[...]

C ONFIGURING THE S WI TCH 3-8 Output Port Conf iguration Sets the output rate limit for each port 3-114 Output Trunk Con fi gura tion Sets the output rate limit for each trunk 3-114 Port Statistics Lists Ethernet and RMON p ort statistics 3-115 Address Table 3-122 Static Addresses Displays entries for interface, addres s or VLAN 3-122 Dynamic Addre[...]

M AIN M ENU 3-9 Static Membership by Port Configures m embership type for interfaces , including tagg ed, untagged or forbidd en 3-156 Port Conf iguration Spec ifies default PVID and VLAN attribu tes 3-157 Trunk C onfiguration Specifies default trunk VID and VLA N attr ibutes 3-157 Private VLAN 3-160 Information Displays Private VLAN feature inform[...]

C ONFIGURING THE S WI TCH 3-10 Queue Sched uling Config ures Weighted Ro und Robin queu eing 3-174 IP Preceden ce/ DSCP Priority Status Globally se lects IP Precedence or DSCP Priority, or dis ables both. 3-176 IP Precedence Priority Set s IP Type of Service priorit y, mapping the precedence tag to a class-of-s ervice value 3-176 IP DSCP Priority S[...]

B ASIC C ONFIGURATION 3-11 Basic Configuratio n Displaying System Inform ation Y ou can easi ly identify the system b y displa ying the devic e name, loc ation and conta ct infor mation. Field Attribut es • System N ame – Name as signed to th e switch syst em. • Object ID – MI B II object ID for switch’s network ma nagement subsy stem. (S[...]

C ONFIGURING THE S WI TCH 3-12 We b – Click Syste m, Syst em Inf or matio n. Speci fy the system name, location , and contact information for th e system admini strator , then cl ick Apply . (Thi s pag e also inclu des a T el net butt on that allows access to the Command Line Interface via T elnet.) Figure 3-3 System Information[...]

B ASIC C ONFIGURATION 3-13 CLI – Specify the h ostname, location and contact infor mation . Displaying Switch Hardware/Software Versions Use the Switch Infor matio n page to disp lay hardware/firmware version numbe rs for the main board and manag ement software, as well as the pow er status of t he system. Field Attribut es Main Board • Serial [...]

C ONFIGURING THE S WI TCH 3-14 • Internal Power Status – Displays the st atus of the internal powe r supply. Manageme nt Software • Loader Versio n – Version nu mber of lo ader co de. • Boot-RO M Versio n – Version of Power-On Self-Test (POST) and boot code . • Operation Code Version – Versio n number o f runtime co de. • Role –[...]

B ASIC C ONFIGURATION 3-15 CLI – Use the followin g command to display version infor mation. Displaying Bridge Extension Capabilities Th e Bridg e MIB includ es extens ions for mana ged d evices that su ppor t Multicast Filtering , T raffic Classes , and V ir tual LAN s. Y ou can access these exten s io ns to display defau lt settings for th e ke[...]

C ONFIGURING THE S WI TCH 3-16 • Configurable PVID Tagging – This switch a ll ows yo u to override the defau lt Port VLAN ID (PVID used in frame tags) a nd egress statu s (VLAN- Tagged or Unta gged) on each port. (R efer to “VLAN Configuration” on page 3-143.) • Local VLAN Capable – This switch doe s not support multiple local bridges o[...]

B ASIC C ONFIGURATION 3-17 CLI – Enter the following command. Setting the Switch’s IP Address Th is section d escribe s how to config ure an IP in terfac e for mana gement access over th e netwo rk. T he IP ad dress for the st ack is obtain ed via DHCP b y default. T o man ually configure an address , yo u need to ch ange the switch ’ s defau[...]

C ONFIGURING THE S WI TCH 3-18 Requests will be broadcast period ically by the switch for an IP address. (DHCP/B OOT P val ues can include the I P address, subn et mask, and default ga teway.) • IP Address – Address of the VLAN interface that is allo wed manag ement access. Va lid IP addr esses consist o f four numbers , 0 to 255, separated by [...]

B ASIC C ONFIGURATION 3-19 CLI – Specify t he management interf ace, IP addres s and default gatew ay . Usin g DHCP/ BOOT P If you r network p rovides D HCP /BOOTP ser vi ces, you can conf igure the switc h to be dyna mically config ured by th ese ser vices . We b – Click System, IP Configuratio n. Specify the VLAN to which the manag ement st a[...]

C ONFIGURING THE S WI TCH 3-20 CLI – Spec ify the man agement in terface, a nd set the I P address mod e to DHCP or BOOTP , and th en ente r the “ip dhcp re star t” com mand. Renewing DCHP – DHCP may lease addres ses to cli ents in defin itely or for a sp ecific period of time . If the addre ss expires or the switch is mov ed to anothe r ne[...]

B ASIC C ONFIGURATION 3-21 Managing Firmware Y ou can uploa d/downloa d fir mware to or from a TF TP ser ver, or copy files to and from sw itch units in a stack. By saving ru ntime code to a file on a TFTP se r v e r , tha t file can later b e downloaded to the switch to rest ore operat ion. Y ou can als o set the swi tch to use n ew fir mware with[...]

C ONFIGURING THE S WI TCH 3-22 Downloading System Software from a Server When do wnloadin g r untime cod e, yo u can speci fy the desti nation fi l e name to re place t he current image, or firs t download the file using a differe nt name from th e cur rent r untime code file, and t hen set the new file as the star tup file. We b –Cl ick System, [...]

B ASIC C ONFIGURATION 3-23 If you download to a new destinatio n file, go to the System/File/Set Start-Up me n u , mark the operation code file used at star tup , and click Apply . T o st ar t the new fir mware , reboot the system via the System/R eset menu. Figure 3-9 Select Start-Up Operation File T o delete a file select Syst em, File, Delete. S[...]

C ONFIGURING THE S WI TCH 3-24 CLI – T o download new fir mware for m a TF TP ser ver, enter the IP addres s of the TF TP ser ver, select “opcode ” as the fil e type, then e nter the source and d estination file names . W hen the file h as finished downloading, set the new file to star t up the system , and then re star t the switch. T o star[...]

B ASIC C ONFIGURATION 3-25 - runni ng-config to startup- config – Copie s the runni ng config to the start up config . - runni ng-config to tf tp – Copies the running configuration to a TFTP serve r. - startup-c onfig to file – Copies the startup c onfiguration to a file on the s witch. - start up-config to running -config – Cop ies the st [...]

C ONFIGURING THE S WI TCH 3-26 Download ing Configuratio n Settings fro m a Ser ver Y ou can do wnload th e configur ation file un der a new f ile name and then set it as the startup fil e, or y ou can specify the current startup configuration file as the desti nation file to directly re place it. Note t hat the file “Factor y_Def ault_ Config.cf[...]

B ASIC C ONFIGURATION 3-27 If you downloa d to a new f ile name us ing “tftp to s tar tup-conf ig” or “tft p to file, ” the file is automatically set as the star t-up configuration file . T o use the ne w settings , reboot the system via t he System/R eset men u. Note that you ca n also select any configuratio n file as the start-up config [...]

C ONFIGURING THE S WI TCH 3-28 Consol e Port Se ttings Y ou can access the onboard configuration program by attaching a VT100 compa tible device t o th e switch ’ s ser ial console por t. M anagement access throu gh the co nsole po rt is contro lled by various pa rameters, incl uding a password, time outs, and basic com munication se ttings. Thes[...]

B ASIC C ONFIGURATION 3-29 • Speed – Sets th e ter minal lin e’ s ba ud rate for tra nsmit (to t er minal) and receive (from ter mina l). Set the s peed to match th e baud rate of the device connected to the serial port. (Rang e: 9600, 19200, 38400, 57 600, or 115200 baud; Default: 9600 bps) • Stop Bits – Sets the numbe r of the stop b it[...]

C ONFIGURING THE S WI TCH 3-30 CLI – Enter Li ne Configura t ion m ode for the c onsole, then specify t h e connec tion parame ters as requir ed. T o displa y the current conso le port settings, use th e show line command from t he Nor mal Ex ec level . Telnet Settings Y ou can acce ss the on board config uration pro g ram o ver t he netw ork usi[...]

B ASIC C ONFIGURATION 3-31 • Telnet Port Number – Sets the TCP p or t num ber for T elnet on the switch. (Default: 23) • Login Timeout – Se ts the inte r val that the system w aits fo r a user t o log into the CLI. If a login atte mpt is not dete cted with in the timeou t inte rval, the conne ction is ter m inat ed for the ses sion. (Range:[...]

C ONFIGURING THE S WI TCH 3-32 We b – Clic k System, Line , T elnet . Specify the co nnection param eters for T e lnet access, t h en c li c k Apply . Figure 3-14 Enabling Telnet CLI – Enter Line Conf iguration mode fo r a virtual ter minal, then sp ecify the co nnection paramet ers as required. T o disp lay the c ur rent virtual ter minal set [...]

B ASIC C ONFIGURATION 3-33 Configuring Event Log ging The switch allows you to control the log ging of er ror messages, including the ty pe of ev ents that are reco rded in swi tch memory , logging to a remot e System Log (syslog) ser ve r, and di splays a list of re cent eve nt messages . System Log Co nfiguration The syst em allows y ou to ena bl[...]

C ONFIGURING THE S WI TCH 3-34 • RAM Level – Limits log messages save d to the switc h’s temporary RAM memory for all levels up to the spe cified level. For example, if level 7 is sp ecified, all messages from le vel 0 to level 7 will be logged to RAM. (Range: 0-7, Default: 6) Note: The Flas h Level m ust be equ al to o r less th an the RA M [...]

B ASIC C ONFIGURATION 3-35 We b – Click System, Log, System Logs . Specify System Log St atus, set the lev el of ev ent messages to be lo g g ed to RAM and f lash me mor y , then cl ick Apply . Figure 3-15 System Logs CLI – Enable system log gi ng and then specify th e level of messages to be logg ed to RAM and flash memory . Use th e show log [...]

C ONFIGURING THE S WI TCH 3-36 The fac i lit y type is used by the sysl og server to d i sp atch log messag es to an appropri ate service. The attribute specifies the facility type tag se nt in syslog messages. (See RFC 3164.) This type has no effect on the kin d of messages reported by the s witch. Howe ver, it may be us ed by the sy slog server t[...]

B ASIC C ONFIGURATION 3-37 We b – C lick Sy stem , Log, Remote Logs. T o add an IP ad dres s to th e Hos t I P L i st , t y p e t h e n e w I P a d d r e s s i n th e H o s t I P A d d r es s b ox , a n d t h e n c l ic k Add. T o delete an IP add ress, click the en tr y in th e Host IP List, and then click R emove. Figure 3-16 Remote Logs CLI ?[...]

C ONFIGURING THE S WI TCH 3-38 Displaying Log Messages The Log s page allows you to scroll through the lo gg ed syste m and event messages. The switc h can store up to 2048 log entries in temporary random access memor y (RA M; i.e., memory f lushed on power reset) and up to 4096 entries in per manent flash memor y . We b – Click Sys tem, Log, Lo [...]

B ASIC C ONFIGURATION 3-39 Sending Simple Mail Transfer Proto col Alerts T o alert system administra tors of proble ms , the switc h can use SMTP (Simple Mail T ra nsfer Prot ocol) t o send email messages whe n trigg ered by log ging events o f a specified level. T he messages are sent to sp ecified SMTP servers on the netw ork and can be retrieved[...]

C ONFIGURING THE S WI TCH 3-40 We b – Click System, Log, SMTP . Enable SMTP , sp ecify a sour ce email address , and select the minimum sev erity level. T o add an IP address to the SMTP Ser v er List, type the new IP address in the SM T P Server field an d click Add. T o delete an IP address , click the entr y in the SMTP Ser ver List and cli ck[...]

B ASIC C ONFIGURATION 3-41 CLI – Enter the IP address o f at least one SM TP ser v er, set the syslog severity lev e l to trig ger an email messag e, and specify the switch (source) and up to five recipie nt (destina tion) em ail address es . Ena ble SMTP with the logging sendmai l command to co mplete the co nfiguration . Use the show lo gging s[...]

C ONFIGURING THE S WI TCH 3-42 CLI – Use th e reload command to restart the s witch. W hen prompted, confir m tha t you want to reset the switch. Note: When restarting th e system, it will always run the Power-On Self-Test. Setting the System C lock Simple Network Time Protocol (SNTP) allows the switch to set its int ernal cloc k based on periodi[...]

B ASIC C ONFIGURATION 3-43 • SNTP Ser ver – Sets the I P address for up to three ti me servers. Th e switch att empts to upda te the time from the first serve r, if this fails it attempts a n update fr om the next ser ver in the seq uence. We b – Select SNTP , Conf iguration. Modify a ny of the required parameters , an d click A pply . Figure[...]

C ONFIGURING THE S WI TCH 3-44 Setti ng the Time Zone SNTP uses Co ordinated Uni versal T ime (or UTC , for merly Gre enwich Mean T ime, or GMT) based on the tim e at the Ea r th’ s pri me meridian , zero deg rees longitud e. T o display a time cor responding to your local time, you mu st ind icat e the numbe r of ho urs and m inutes your t ime z[...]

S IMP LE N ETWORK M ANAGEME NT P RO TO C OL 3-45 Simple Netw ork Management Protocol Simple Ne twork Manage ment Protoc ol (SNMP) is a communication protoc ol desig ned spec ifically for managing d evices on a network. Equipmen t commonly ma naged with SNMP in cludes switch es, ro uters and h ost compu ters. SNM P is typica lly used to con figu re [...]

C ONFIGURING THE S WI TCH 3-46 • Acce ss Mode - Read-Only – Specifies read-o nly access. Au thorized m anag ement stations are only able to re trieve MIB objects. - Read/Write – Sp ecifies read -write access . Au thorized management stations are able to bo th retrieve and modify MIB ob jects. We b – Clic k SNMP , Config uration. Add new com[...]

S IMP LE N ETWORK M ANAGEME NT P RO TO C OL 3-47 Command Att ributes • Trap Manager Capability – This switch supports up to five trap managers. • Current – Displays a list of th e trap manage rs currentl y configured . • Trap Manager IP Address – IP addre ss of th e host (th e targ eted recip ient). • Trap Manager Community String –[...]

C ONFIGURING THE S WI TCH 3-48 CLI – This example adds a t rap manager and enables bo th authentication and link-up , link-down traps. User Aut henticat ion Y ou can rest rict management access to this switch using the following options: • User Accounts – Manu ally con figur e acces s right s on the sw itch for specified us ers. • Authentic[...]

U SER A UTHENTICATION 3-49 Command Att ributes • Account List – Displays th e current li st of user acco unts and associated acc ess levels. (Defaults: admin, an d guest) • New Account – Displays configuratio n settings for a new ac count. - User Na me – T h e nam e of the user. (Maximum length: 8 characters; maximum number of users: 16) [...]

C ONFIGURING THE S WI TCH 3-50 CLI – Assign a user name to access-lev el 15 (i.e. , administra tor), th en speci fy the passw ord. Configuring L ocal/Remote Logon Aut hentication Use th e Authen tication Settings m enu to res trict mana g ement access based on specif ied user names and pas s w ords . Y ou can manually co nfigure access rights on [...]

U SER A UTHENTICATION 3-51 Command Usage • By default, man agement access i s always checke d against the authen ticatio n da tabase st ored on the l ocal switch . If a remote authen tication s erver is used, you must spec ify the authen tication sequenc e and the corresp onding parameter s for the remote authent ication protocol. Local and r emo[...]

C ONFIGURING THE S WI TCH 3-52 • RADIUS Settings - Global – Provides globally applicable RADIUS settings. - ServerIndex – Spe cifies one of five RA DIUS servers that m ay be configur ed. The swi tch attempts authenticati on using th e listed sequence of servers. The process ends when a server either a pproves or deni es access to a user. - Se[...]

U SER A UTHENTICATION 3-53 We b – Click Secu rity , Authen tication Se ttings . T o config ure local or remot e authentica tion pref erences , specify the authen tication sequence (i.e., one to thr ee methods), fill in the parame ters for RADIUS or T ACA CS+ authenticat ion if selected , and clic k Apply . Figure 3-25 Authentication Settings[...]

C ONFIGURING THE S WI TCH 3-54 CLI – Spec ify all the requi red paramete rs to enable log on a uthentica tion. Configuring H TTPS Y ou can conf igure the switc h to enable the Secure Hypertext T ransfer Proto col (HTTP S) over the Sec ure Socket Laye r (SSL), pr oviding secu re access (i.e ., an encrypted con nection) t o the switc h’ s web i n[...]

U SER A UTHENTICATION 3-55 • When you star t HTTPS, the conn ection is estab lished in th i s w ay: - The cl i ent authentica tes the server using the ser ver’s digital certifi cate. - The clie nt and server nego tiate a set of secur ity protoc ols to use for the co nnection. - The client and server ge nerate session key s for encr ypting a nd [...]

C ONFIGURING THE S WI TCH 3-56 We b – Click Security , H TTPS Settings . Enable HTTPS and specify the por t number, then click Ap ply . Figure 3-26 HTTPS Settings CLI – This example e nables the HTTP secur e ser ver an d modifies the por t numbe r . Replacing t he Default Secure- s ite Cer t ificat e When you log onto the web interface using HT[...]

U SER A UTHENTICATION 3-57 When y ou hav e obtained th ese, place t hem on your T FTP ser ver , and use the foll owing comm and at the swit ch's comman d-line interface t o re pl ace the de fault (unr ecogniz ed) cer tificat e with an authorize d one: Note: The switc h must be r eset for the new cer tificate to be act ivated. To rese t the swi[...]

C ONFIGURING THE S WI TCH 3-58 Command Usage The SSH se r ver on this switc h supports b o th passwo rd and public k ey authen tication. I f passw ord authenti cation is speci fied by t he SSH client, then the password can be au thentica ted either lo cally or via a RADIUS or T ACA CS+ remote authen tication server , as specifi ed on the Authentica[...]

U SER A UTHENTICATION 3-59 3. Import Client’ s Public K e y to the Switch – Use the copy tftp public-k ey command (p age 4-86) to copy a fi le containing t h e publ ic key for all the SSH c lient’ s g ranted ma nag ement ac cess to th e switch. ( Note tha t these clients must be conf igured locally on the switch via the User Accounts pag e as[...]

C ONFIGURING THE S WI TCH 3-60 e. Th e swit ch compar es the de cr ypte d bytes to the origi nal byte s it sent. If the two sets match, t his means th at the client's priv a te key cor responds to an authorized public key , and th e client is authe nticated. Notes: 1. To use SS H with onl y passwo rd authenti cation, the host public key must s[...]

U SER A UTHENTICATION 3-61 the client to select either DES (56-bit) or 3DES (168-bit) for da t a encrypt ion. • Save Host-Key from Memory to Flash – S aves the host key from RAM (i.e., vola tile memory to flas h memo ry. Otherwis e, the host key pair is stored to RAM by default. Note that you must select this item prior to generating the host -[...]

C ONFIGURING THE S WI TCH 3-62 CLI – This example gen erates a host -key pair u s in g both the RSA and DSA al go rithms, stores the ke ys to f lash me mor y , and then display s the host’ s publ ic keys . Configur ing the SSH Server The SSH server inc ludes basic settings for aut henticatio n. Field Attribut es • SSH Se rver St atus – Allo[...]

U SER A UTHENTICATION 3-63 fails an d the clien t has to resta rt the auth enticatio n process. (Range: 1-5 times; D efault: 3) • SSH Server-Key Size – Sp ecifies the SSH se rver key size. (Range: 512-896 bits; Default:768) - The server key is a private key t hat is never share d outside th e switch. - The host key is shared with the SSH client[...]

C ONFIGURING THE S WI TCH 3-64 CLI – T his examp le enable s SSH, sets th e authen tication p arameters, and disp lays the current configur ation. It shows th at the administra tor has made a c onnection v ia SHH, and then disables this connectio n. Configuring P ort Security P ort securit y is a fe at ure th at allo ws you to configure a switch [...]

U SER A UTHENTICATION 3-65 already in the address table wil l be retained and will not ag e out. Any other device that atte mpts to use the por t will be prevented from access ing the switch. Command Usage • A secure port h as the follow ing restricti o ns : - It ca nnot use po rt monitor ing. - It cann ot be a multi-V LAN port. - It ca nnot be u[...]

C ONFIGURING THE S WI TCH 3-66 We b – Click Secu rity , Port Se curity . Se t the action to take when an invalid addr ess is de tected on a por t, mar k the checkbox in the Sta tus colu mn to enable s ecurity for a por t, set the maximu m number of MA C addresses allowed on a port, and click Apply . Figure 3-29 Configuring Port Security CLI – T[...]

U SER A UTHENTICATION 3-67 This sw itch uses the Ex tensible Au thentica tion Protoc ol ov er LANs (EAPOL) to ex change auth enticati on protoc ol m essag es with the client, an d a rem ote RADIUS a uthenti cation ser ver to ver ify user identity and acces s righ ts. W hen a cl ient (i.e ., Suppli cant) connec ts to a switc h port, the swi tch (i.e[...]

C ONFIGURING THE S WI TCH 3-68 • The RADIUS server and 802.1X clien t support EAP. (The switch only suppor ts EAPO L in orde r to pas s the EA P packe ts from the serv er to the client .) • The RADIUS server and clie nt also have to supp ort the same EAP authent ication type – MD 5. (Some clie nts have native s upport in Window s, otherwi se [...]

U SER A UTHENTICATION 3-69 CLI – This example shows the default global setting for 802.1X. Configur ing 802.1X Global Set tings The 802.1X protocol includes port authentic at ion. The 802.1X protocol mus t be enabled globally fo r the switc h system be fore port setting s are activ e. Command Att ributes • 802.1X System Authentication Control ?[...]

C ONFIGURING THE S WI TCH 3-70 CLI – This example enables 802.1X globally for the switch. Configur ing Port Settin gs for 802.1X When 802.1X is enabled, you ne ed to configure the parameters for the authen ticatio n pr ocess that r uns betw een the cl ient and t he switc h (i.e., authen ticator), as well as the client identity l ookup process tha[...]

U SER A UTHENTICATION 3-71 • Max-Req – Sets th e maximum number of times th e switch port will retransmit an EAP request packet to the client before it times out the auth enticati on sess ion. (Ra nge: 1- 10; Defa ult 2) • Quiet Period – Sets the time that a swit ch port waits after the Ma x Request Co unt has been e xceeded befor e attempt[...]

C ONFIGURING THE S WI TCH 3-72 CLI – This example sets the 802.1X parameters on port 2. For a descr iption of th e addit ional fi elds disp layed in th is exampl e, see “ show dot1x” on pag e 4-112. Console(config)#interface ethernet 1/2 4-143 Console(config-if)#dot1x port-control aut o 4-108 Console(config-if)#dot1x re-authenticatio n 4-110 [...]

U SER A UTHENTICATION 3-73 Displaying 802.1X St atistics This sw itch can display statistics for dot1x proto col ex chang es for any por t. Table 3-5 802.1X Statistics Parameter Description Rx EAPOL Start The number of EAPOL Start frames t hat have been received by this A uthenticator. Rx EAPOL Logoff The number of EAPOL Logoff frames that have bee[...]

C ONFIGURING THE S WI TCH 3-74 We b – Select Security , 802.1X , Statistics . Select the require d por t and then click Query . Click R efresh to update the st atistics . Figure 3-33 Displaying 802.1X Port Statistics CLI – This example displays the 802.1X statistics for por t 4. Console #show dot 1x statist ics inter face ethe rnet 1/4 4-112 Et[...]

U SER A UTHENTICATION 3-75 Filte r ing Addre sses for Managemen t Access Y ou create a list o f up to 16 IP addresses or IP address groups that ar e allowed management access to t he switch through the web interface, SNMP , or T elnet. Command Usage • The manage m ent interfaces ar e open to all IP addresses by d efault. Once you add an entry to [...]

C ONFIGURING THE S WI TCH 3-76 • Start IP Address – A single IP addres s , or t he starting add ress of a range. • End IP Address – The en d address o f a range. • Add/Remove Filtering Entry – Ad ds/re moves an I P addr ess fr om the list. We b – Click Security , IP Filter . Enter the IP addresses or rang e of addresses t hat are allo[...]

A CCES S C ONTROL L ISTS 3-77 CLI – This example a llows SNM P access for a specific cli ent. Access Control List s Access Control Lis t s (A CL) provide pac ket fi ltering for I P frames (bas ed on add ress , protoc ol, Layer 4 prot ocol por t number or TCP cont rol code) or any fr ames (based on MAC a ddress or E ther net typ e). To filter inco[...]

C ONFIGURING THE S WI TCH 3-78 Command Usage The foll owing restrictio ns apply t o A CLs: • Each A CL can hav e up to 32 rules. • The m aximum number of AC Ls is 8 8. • However, due to resource res trictions, t h e avera ge number of r ules bound to the port s should not e xceed 20. • This swi tch suppor ts ACLs fo r ingress fi ltering onl[...]

A CCES S C ONTROL L ISTS 3-79 - MAC : MAC ACL m ode that fi lters packet s based on the source or destin at ion MAC address and the Ethernet frame typ e (RFC 1060). We b – Click Security , A CL, Configuration. Ent er an A CL name in the Name field , select th e list type (I P Standard , IP Extende d, or MA C ), and click Add to open the config ur[...]

C ONFIGURING THE S WI TCH 3-80 Configur ing a Standard IP ACL Command Att ributes • Action – An ACL can contain an y combination of permit or deny rules. • Address Type – Spec ifies the sour ce IP address. Use “Any” to incl ude all po ssible addres ses, “Host” to specify a specific hos t address in t he Addres s field, or “IP” t[...]

A CCES S C ONTROL L ISTS 3-81 We b – Specify the act ion (i.e ., P er mit or D eny). Select the address t ype (Any , Host, or I P). If you select “Host, ” enter a speci fic address . If y ou select “IP ,” enter a subn et addr ess and th e mask f or an add ress ran ge. T hen click Add. Figure 3-36 ACL Configuration - Standard IP CLI – Th[...]

C ONFIGURING THE S WI TCH 3-82 to sp ecify a range of addresses wit h the Address an d SubMask fields . (Options: Any, Host, IP; Defa ult: Any) • Source/Destination Address – Source or des t inat ion IP addres s. • Source/Destination Subnet Mask – Sub net mask for source o r desti nation addr ess. (See th e descripti on for Subnet Mask on p[...]

A CCES S C ONTROL L ISTS 3-83 For examp le, use the co de value and mas k belo w to catch pa ckets with the following flags set: - SYN flag valid, use control-code 2, control bitmask 2 - Both SYN a nd ACK valid , use cont rol-cod e 18, cont rol bitm ask 18 - SYN valid and ACK invalid, use c o ntrol-cod e 2, control bitm ask 18 We b – Specify the [...]

C ONFIGURING THE S WI TCH 3-84 3. P er mit all TCP packets from class C addresses 192.168.1.0 with the TCP contro l code set to “SYN . ” Configur ing a MAC ACL Command Att ributes • Action – An ACL can contain an y combination of permit or deny rules. • Source/Destination Address Type – Use “ Any” to include all possible addres ses,[...]

A CCES S C ONTROL L ISTS 3-85 We b – Specify the acti on (i.e ., Permit or Deny) . Spec ify the source an d/or desti nation add resses . Select t he address type (Any , Ho st, or MA C). I f you select “Host,” enter a specific ad dress (e .g., 11-22-33-44-55-66). If y o u select “MA C , ” enter a base address and a hexidecimal bitmask for [...]

C ONFIGURING THE S WI TCH 3-86 Binding a Port t o an Access Control List Afte r configur ing Access Control Lists (A CL), y ou shoul d bind th em to the por ts tha t need to filter traffic. Y o u can assig n one IP a ccess list to any port, but you can o nly assign one MA C access l ist to all the ports on the switch. Command Usage This sw itch onl[...]

A CCES S C ONTROL L ISTS 3-87 We b – Click Security , A CL, P or t Binding . Mark the Enabled field for the port you wa nt to bind to an ACL, s elect the required A CL fr om the drop-down list, then c lic k A pply . Figure 3-39 Binding a Port to an A CL CLI – T his example as s igns an I P and MA C access list to port 1, and an IP access list t[...]

C ONFIGURING THE S WI TCH 3-88 Port Conf iguration Displaying Connection Status Y ou can use the P o rt Inf or matio n or T r un k Infor ma tion pag es to di splay the current c onnection status , includin g link sta te, speed/ duplex mode , flow co ntrol, and aut o-neg oti ation. Field Attribut es (W eb) • Name – Inter face label. • Type –[...]

P ORT C ONFIGURATION 3-89 We b – Click P or t, P or t Infor matio n or T r unk Infor mation. Figure 3-40 Displaying Port/Trunk Information Field Attribut es (CLI) Basic In formatio n: • Port type – Indicates th e port type. (100BASE-TX, 1000BA SE-T, or SFP) • MAC address – The p hysical layer address for this port . (To access this i tem [...]

C ONFIGURING THE S WI TCH 3-90 - 10full - Sup ports 10 Mb ps full-duplex op eration - 100half - Supports 100 M bps half-duplex o p eration - 100full - Suppor t s 100 Mbps full-duplex opera tion - 1000f ull - Supports 1000 Mbps full-duplex operation - Sym - Transm its and rec eives paus e frame s for flow contro l - FC - Suppo rts flow c ontrol • [...]

P ORT C ONFIGURATION 3-91 CLI – This example s hows the co nnection sta t us fo r P or t 5. Configuring I nterface Connections Y ou can use the P ort Configuration or T r unk Configuration pag e to enable/disable an int erface , set a uto-negotia tion and the inte rface capabilities to advert ise, or man ually fix the sp eed, duplex mode, and f l[...]

C ONFIGURING THE S WI TCH 3-92 • Autonegotiation (P ort Capabilities) – Allows auto-negotiat ion to be enabled/disable d. When auto-negotiat ion is enabled, you need to specify t he capabilities to be advertis ed. When auto-neg otiation is disa bled, yo u can fo rce the s etting s for spe ed, mode , and flow control.T he following capabilit ies[...]

P ORT C ONFIGURATION 3-93 We b – Click P ort, Port Configuration o r T r unk Configuration. Mo dify the required interface settings, and c lick Apply . Figure 3-41 Port/Trunk Configuration CLI – Sele ct the inte rface, and the n enter the r equired settings . Creating Trunk Groups Y ou can create m ultiple links between devices that wor k as on[...]

C ONFIGURING THE S WI TCH 3-94 automatically n eg otiate a trunked link with LA CP-configured ports on anoth er device. Y ou can co nfigure any n umber of po r ts on t he switch a s LA CP , as long as they are not alre ady configured as part of a static trunk. If ports on ano ther device are also confi gured as LA CP , the switch a nd the other dev[...]

P ORT C ONFIGURATION 3-95 Static ally Configuring a Trunk Command Usage • When configuring static trunks, you may not be able to link switches o f diff erent types, depending on the manufact urer’s implemen tation. However, note tha t the stat ic trunks on this sw itch are Cisco Ether Channe l compat ible. • To avoi d creat ing a loop in the [...]

C ONFIGURING THE S WI TCH 3-96 We b – Click P or t, T r unk Membership. E n ter a trunk ID of 1-4 in the T runk field, sel ect any of the switch po r ts fro m th e scroll-do wn port list, and cl ick Add. Aft er you ha ve compl eted addin g ports to the member lis t, click Apply . Figure 3-42 Static Trunk Configuration[...]

P ORT C ONFIGURATION 3-97 CLI – This example cre ates tr unk 2 wi th ports 1 and 2. J ust connect th ese por ts to two static tr unk po rts on anothe r switch to for m a tr unk. Enabling LACP on S elected Ports Command Usage • To avoi d creat ing a loop in the networ k, be sur e you en able LA CP befor e conne cting t he port s, and also disco [...]

C ONFIGURING THE S WI TCH 3-98 • A trunk formed with anothe r switch using LACP will automatically be assign ed the next available trunk ID . • If more than eigh t ports a ttached to the same tar get swit ch have LACP enabled, the addition al ports will be placed in standby mode, and will only be enabled if one of the active links fails. • Al[...]

P ORT C ONFIGURATION 3-99 CLI – T he follow ing ex ample enabl es LACP for por ts 1 to 6. Just conn ect these por ts t o LACP-e nabled trunk ports on an other switc h to form a tr unk. Configur ing LACP Parameter s Dynamically Creating a Por t Channel – P or ts assigned to a common por t channel must meet t he following criteria: • Ports mus [...]

C ONFIGURING THE S WI TCH 3-100 Note: If the port channel adm i n k ey (lacp adm in key, page 4-168) is not set (thr ough the C LI) when a channel gr oup is formed (i.e., it has a null value of 0), this key i s s et to the same value as the por t adm in key used by t he interfaces that j oined the group (l acp adm i n key, as described in this sect[...]

P ORT C ONFIGURATION 3-101 We b – Click P or t, LA CP , Ag g reg ation P or t. Set the System Priority , Admin Key , and P or t Priority for the P or t Actor. Y ou can optionally config ure these se ttings for the Port Partner. (Be a wa re that these setti ngs only affect the adminis trative state of the partn er , a nd will not ta ke effect unti[...]

C ONFIGURING THE S WI TCH 3-102 CLI – The followi ng example config ures LA CP parameters fo r por ts 1-4. P orts 1-4 are used as a ctive m embers o f the LA G . Console(config)#interface ethernet 1/1 4-143 Console(config-if)#lacp actor system-prio rity 3 4-166 Console(config-if)#lacp actor admin-key 1 20 4-167 Console(config-if)#lacp actor port-[...]

P ORT C ONFIGURATION 3-103 Displaying LACP Port Co unters Y ou can dis play statis tics for L A CP pr otocol messag es . We b – Click P or t, LA CP , P o rt Counters Infor matio n. Select a member port to dis play the cor respo nding information. Figure 3-45 LACP - Port C ounters Informati o n Table 3-6 LACP Port Counters Field Descript ion LACPD[...]

C ONFIGURING THE S WI TCH 3-104 CLI – The follow ing example dis plays LA CP counters . Displaying LACP Settings and Sta tus for the Lo cal Side Y ou can dis play configuration settings and th e operational state for the local side of an link ag greg ation. Console#show lacp counters 4-170 Port channel : 1 ----------------------------------------[...]

P ORT C ONFIGURATION 3-105 Admi n Sta te, Oper State Administrati ve or operational values of t he actor’s state parameters: • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive ma chine is using defaul ted operational partner information, administratively configured for the partner. • D[...]

C ONFIGURING THE S WI TCH 3-106 We b – Click P or t, LA CP , P o rt Inter nal Infor mation. Select a port channel to disp lay the correspondi ng infor mat i on. Figure 3-46 LACP - Port Internal Information CLI – The follow ing example dis plays th e LA CP configuration settings and op erational sta t e f or the local s ide of port ch annel 1. C[...]

P ORT C ONFIGURATION 3-107 Displaying LACP Settings and Sta tus for the Remote Side Y ou can dis play configuration settings and th e operational state for the remote side of an link agg reg ation. Table 3 -8 LACP Neighbo r Configurati on Information Field Description Partner Admin Syst em ID LAG partn er’s system ID ass igned by the user. Partne[...]

C ONFIGURING THE S WI TCH 3-108 We b – Click P or t, LA CP , P o rt Neighbor s Infor mation. Select a por t channel to display the cor responding info r mation. Figure 3-47 LACP - Port Neighbors Information CLI – The follow ing example dis plays th e LA CP configuration settings and op erational sta t e f or the remote s ide of po r t chan nel [...]

P ORT C ONFIGURATION 3-109 Setting Broadcast Storm Thre sholds Broadc ast stor ms ma y occur when a d evice on yo ur network i s malfunctioning, o r if application prog rams are not well design ed or proper ly configure d. If there i s to o muc h bro adcast tra ffic on your network, per for mance can be severely de g raded or ever ythin g can come [...]

C ONFIGURING THE S WI TCH 3-110 We b – Click P ort, P ort/T r unk Broadcas t Control. Se t the threshol d, mark the Enabl ed field for t h e des ired interface and click App ly . Fig ure 3-4 8 Port B roadc ast Co ntrol[...]

P ORT C ONFIGURATION 3-111 CLI – Sp ecify a ny inter face, and th en ente r the th reshol d. The following disab les broadcas t storm control fo r port 1, and t h en s ets broadc ast suppr ession a t 600 o ctets per sec ond fo r por t 2 (which app lies to all por ts). Configuri ng Port Mirrorin g Y ou can mirror traffi c from any source port to a[...]

C ONFIGURING THE S WI TCH 3-112 Command Att ributes • Mirror S essions – Displays a list of curre nt mirror sessions. • Source Unit – The unit whose port traffic will be monitored. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) • Source Port – The port whose tr affic will be monitored. (Range: 1-26/50) • Type – Allows yo[...]

P ORT C ONFIGURATION 3-113 CLI – U se th e inter face comma nd to select the mo nitor p ort , then use th e port monito r command to s pecify the so urce port and traffic type. Configuring Rate Lim its This f unction allows t he network manag er to cont rol the maximum r ate for traffic transmitted or received on a por t. Rate limitin g is confi [...]

C ONFIGURING THE S WI TCH 3-114 We b – Click P or t, Rate Limit, Granularity . Sele ct the require d rate limit granularity for Fast Ethernet and Gigabit Ethe r net, and click apply . Figure 3-50 Rate Limit Granular i ty Configuration CLI - T his ex ample se ts and d isplays F a st Ethe rn et and Gig abit E ther net granularity . Rate Limit Conf [...]

P ORT C ONFIGURATION 3-115 We b – Click Port, Rate Limit, Input/Out put P ort/ T runk Co nfiguration. Enable th e Rate Limit Sta tus for the required int erfaces, set the Rate Lim it Level, and click Apply . Figure 3-51 Output Rate Limit Port Configuration CLI - This example sets the rate limit le v el for inp ut and output traffic passing throug[...]

C ONFIGURING THE S WI TCH 3-116 Note: RMON groups 2, 3 and 9 can only be accessed using SNMP management software such as SMC EliteView. Table 3-9 Port Statistics Parameter Description Interface Statist ics Received Octets The total number of octets received on the interface, including framing characters. Received Unicast Packets The number of subne[...]

P ORT C ONFIGURATION 3-117 Transmit Multicast Packets The total number of packets that higher- level protocols requested be transmitted, an d w hich we re addres sed to a multicast address at this sub-layer, incl uding those that were discarded or not sent. Transmit Broadcast Packets The total number of packets that higher- level protocols requeste[...]

C ONFIGURING THE S WI TCH 3-118 Multiple Collision Frames A count of succes sfully transmitted frames for which transmission is inh ibited by more than one collision. Carrier Sense Errors The number of times that the carrier se nse condition was lost or never a ss erted when a ttempting to transmit a frame . SQE Test Errors A count of times that th[...]

P ORT C ONFIGURATION 3-119 Multicast Frames The total number of good frames rec eived that were directed to this multicast ad dress. CRC/A lignme nt E rror s The num ber of CRC/alignment errors (FCS or alignment errors). Undersize Frames The total number of fram es received that were le ss than 64 octets long (excluding fra ming bits, but inclu din[...]

C ONFIGURING THE S WI TCH 3-120 We b – Click P or t, P or t Statistics . Select the required interface, and click Quer y . Y ou ca n also u se the Refres h button at the bott om of the pa ge to update th e scre en. Figure 3-52 Port Statistics[...]

P ORT C ONFIGURATION 3-121 CLI – This example show s statist ics for port 13. Console #show i nterfac es cou nters e thernet 1/13 4- 152 Etherne t 1/13 Iftabl e stats : Octets input : 868453, Octets out put: 34921 22 Unica st inpu t: 7315 , Unit cast ou tput: 6 658 Disca rd inpu t: 0, D iscard output : 0 Error input: 0, Err or out put: 0 Unkno wn[...]

C ONFIGURING THE S WI TCH 3-122 Addre ss Tabl e Settin gs Switches sto re the addresses f or all known devices. This infor matio n is used to pass traff ic directly between t he inbound and outbou nd ports . All the add resses learned b y monitorin g traffic are s t ored in the dynami c address t able. Y ou can also m an ually configure stat ic add[...]

A DDR ESS T ABLE S ETTINGS 3-123 We b – Click Address T ab le , Static Addresses . Specify the interface, the MA C address and VLAN , then click Ad d Static Address . Figure 3-53 Configuring a Static Address Tabl e CLI – This example adds an address to the static ad dress table, but sets it to be deleted w hen the switch is reset. Console(confi[...]

C ONFIGURING THE S WI TCH 3-124 Displaying the Address Table The Dynamic Address T able c ontains th e MA C addresses le ar ned b y monit oring the so urce address f or traffic e ntering the s witch. W hen th e destination add ress for inbound traffic is found in th e database, the pack ets intende d for that addr ess are forw arded directl y to th[...]

A DDR ESS T ABLE S ETTINGS 3-125 We b – Clic k Address T able , Dynamic Addresses . Spec ify the searc h type (i.e., mar k the Inte rface, MAC Addres s , or VLAN checkbox), se lect the method of sorting the displ ayed addre sses, and then cli ck Quer y . Figure 3-54 Configuring a Dynamic Ad dress Table CLI – This example a lso displa ys the add[...]

C ONFIGURING THE S WI TCH 3-126 Changing the Agin g Time Y ou can set the a ging time for e ntries in th e dynamic a ddress tab le. Command Att ributes • Aging Status – Enables/d isables the function. • Aging Time – The tim e after which a learned ent ry is discarded . (Range: 10-30000 seconds; Default: 300 seconds) We b – Click Address T[...]

S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-127 Th e spanni ng tree a lgo rithm s suppor ted by this switch incl ude the se ve rs io n s : • S TP – Sp an ning Tree Protocol (IEEE 802.1D) • RSTP – Rapid Sp an ning Tree Protocol (IEEE 802.1w ) ST A uses a dist ributed algorithm to select a bri dging device (STA-complian t switch, brid ge or[...]

C ONFIGURING THE S WI TCH 3-128 that can be us ed when a node or po rt f ails , a nd ret aining the f orwarding data base for ports ins ensitiv e to c hanges in the t ree str ucture when reconfi guration occur s . Displaying Global Settings Y ou can di splay a su mmar y of th e cur rent bridge ST A inform atio n that applies to the en tire switch u[...]

S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-129 • Designated Root – The priority and MAC address of the device in the Spannin g Tree that th is switch has a ccepted as th e root device. - Root Port – The numbe r of the port on th is switch that i s closest to the roo t. Th is swit ch com munica tes wi th the r oot dev ice th rough this por [...]

C ONFIGURING THE S WI TCH 3-130 • Root Forward Delay – The maximum time (i n seconds) th i s d evice will wait befor e changing states ( i .e., d i scar ding to learning to forwardin g). This delay i s required becaus e every device m ust receive information about topology changes before it starts to forward frame s . In ad dition, ea ch port n[...]

S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-131 CLI – T his command displays global STA settings, followe d by settings for ea ch por t. Note: The current root port an d current root co st display as zero when this de vice is not co nnected to the network. Console#show spanning-tree 4-193 Spanning-tree information ------------------------------[...]

C ONFIGURING THE S WI TCH 3-132 Configuring Global Setti ngs Global sett ings apply to the entire switch. Command Usage • Spanning Tree Pro tocol 8 Uses RSTP fo r the internal state machine, but sends only 802.1D BPDUs. • Rapid Spannin g Tree Protoc ol 8 RSTP su pports co nnect ions to eit her STP o r RSTP n odes by monit oring the inc oming pr[...]

S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-133 • Priority – Bridge priority is used in se le cting the root dev ice, root port, and des ignated por t. The devic e with the h ighest prio rity become s the STA root device. However, if all devic es have the same p riority, the device with the lowes t MAC address will then bec ome the root de vi[...]

C ONFIGURING THE S WI TCH 3-134 • Forward Delay – The maximum t ime (in second s) this device will w ait b e f or e c h a n g i n g s t at es ( i . e . , d i sc ar d i n g t o l e a r ni n g t o f o r w a r d in g ) . T h i s delay is required becaus e every device must rece ive information ab out topology c hanges before it s tarts to forward [...]

S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-135 We b – Click Spanning T ree, ST A, Config uration. Modify the required attributes , an d click A pply . Figure 3-57 STA Configura t ion CLI – T his exa mple enable s Spanni ng T ree Protoc ol, set s the mod e to RSTP , and then config ures the ST A and RSTP paramet ers. Console(config)#spanning-[...]

C ONFIGURING THE S WI TCH 3-136 Displaying Interface Setti ngs The ST A P or t Information and ST A T r unk Infor mation pages display the cur rent sta tus of por ts an d tr unks in the S panning Tree. Field Attribut es • Spanning Tree – Shows if STA has be en enabled on this inter face. • STA S tatu s – Displays current state of this port [...]

S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-137 • Designated Port – The por t priorit y and numb er of the port on the designated brid ging device through wh ich this switch must communi cate with the root of the Spanni ng Tree. • Oper Link Type – The operati onal po int-to-po int stat us of the LA N segment a ttached to th is interface. [...]

C ONFIGURING THE S WI TCH 3-138 • Trunk Member – Indicates if a port is a member of a trunk. (STA Port Information o nly) These additio nal parame ters are only display ed for the CLI: • Admin status – Shows if this inte rface is enabled. • Path cost – T h i s p ar a m e t e r i s u s e d by t h e S T A t o d e t e r mi n e t h e b e s [...]

S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-139 • Admi n Edge Port – You can e nable this option if an interface is attache d to a LAN se gment th at is at the end of a bridge d LAN or to an end no de. Since end node s cannot cause forwardi ng loops, they c an pass d irectly thro ugh to the sp anning tree fo rwarding stat e. Specifying Edge P[...]

C ONFIGURING THE S WI TCH 3-140 CLI – This example s hows the ST A attr i but es for port 5. Configuring I nterface Settings Y ou can conf igure RSTP attrib utes for speci fic interfaces , incl uding port prior ity , path cos t, link type , and edge port. Y ou ma y use a diffe rent priorit y or path cost for port s of the same media type to indic[...]

S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-141 contra dictory informat ion. Port addres s table is clea red, and the port begins le arning a ddresses. - Forwarding - Port forwards packets , and continues learni ng addr esses. • Trunk – Indica t es if a port is a member of a trun k. (STA Por t Configuration o nly) Th e follow ing inte rface a[...]

C ONFIGURING THE S WI TCH 3-142 - D e f a u l t – - Ethernet – Half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 - Fast Ethernet – Half duplex: 200,000; full du p lex: 100,000; trunk: 50,000 - Gigabit Ethernet – Full duplex: 10,000; trunk: 5,000 • Admin Link Type – The link type a ttached to this in terface. - Poi nt-to-Po [...]

VLAN C ONFIGURATION 3-143 We b – Click Spa nning T ree, S T A, P or t Configu ration or Trun k Configuration. Modify the requir ed attri b utes , then c lick Appl y . Figure 3-59 STA Port Configuration CLI – T his example sets STA attributes for por t 7. VLAN C onfig uration IEEE 802.1Q VL ANs In la rg e netw orks , router s are used t o isol a[...]

C ONFIGURING THE S WI TCH 3-144 VLANs he lp to simplify network manag ement by allowing you t o mov e device s to a new VLAN without h aving to chang e any physic al conne ctions. VLANs can be easily or ganiz ed to ref lect d epar tmen tal groups (su ch as Mar keting or R&D), usage groups ( such as e- mail), or multicast g roups (used for multi[...]

VLAN C ONFIGURATION 3-145 Note: VL AN-tagged frames can pa ss throu gh VLAN-a ware or VLAN-u naware network interconnect ion devices , but th e VLAN tags sho uld be st ripped of f befo re passin g it on to any e nd-nod e host that does no t support VLAN tagg ing. VLAN Cla ssification – When the sw i tc h receiv es a frame, it clas sifies the fram[...]

C ONFIGURING THE S WI TCH 3-146 Automatic VLAN Registration – GVRP (GARP VLA N R eg istration Protoc ol) defines a system where by the s w it ch can auto maticall y lear n th e VLANs to which each end station should be assigne d. If an end station (or its network a d apter) supports the IEEE 802.1Q VLAN protocol, it can be configu red to broadc a[...]

VLAN C ONFIGURATION 3-147 Forw ar ding T a gged/U nta gged Frames If you wan t to creat e a small por t-bas ed VLAN for devi ces at tached direc tly to a sin gle swi tch, you can a ssign por ts to the sam e untag g ed VLAN . However , to par ticipate in a VLAN g roup that crosses several switch es, y ou should create a VLAN for that group and enabl[...]

C ONFIGURING THE S WI TCH 3-148 Enabl ing or Disa bling GVRP ( G lobal Settin g) GARP VLA N R egist ration Protoc ol (GVRP) defi nes a wa y for switch es to exc hang e VLAN info rm ation in order to reg ister VLAN membe rs on ports acro ss the netw ork. VLANs ar e dynamica lly configured b ased on join messag es iss ued by host de vices and p ropag[...]

VLAN C ONFIGURATION 3-149 • Maximum Number of Supported VLANs – Maximum number of VLANs t hat can be configured on this switch. We b – Click VLAN , 802.1Q VLAN , Basic In formatio n. Figure 3-61 VLAN Basic Information CLI – Enter the following command. Displaying Cur r ent VLANs The VLAN Curren t T able sho ws the current port mem bers of e[...]

C ONFIGURING THE S WI TCH 3-150 • Status – Shows h ow this VL AN was adde d to the swi tch. - Dynamic GVRP : Automatically learned via GVRP. - Permanent : Adde d as a static entry. • Egress Ports – Show s all the VLA N port mem bers. • Untagged Ports – Show s the untagg ed VLAN port me mbers. We b – Click VLAN , 802.1Q VLAN , Cur rent[...]

VLAN C ONFIGURATION 3-151 • Status – Show s if this VLAN is enabled or disabled. - Active : V LAN is operation al. - Suspe nd : VLAN is suspend ed; i.e., does not pa ss packet s. • Ports / Channel groups – Shows the VL AN inter face member s. CLI – Cur rent VLAN infor mat ion can be displayed wit h the following command. Creating VLANs Us[...]

C ONFIGURING THE S WI TCH 3-152 • State (CLI) – Enable s or disab les the speci fied VLAN. - Active : V LAN is operation al. - Suspe nd : VLAN is suspend ed; i.e., does not pa ss packet s. • Add – Adds a new VLAN grou p to the curr ent list. • Remove – R emoves a VLAN gr oup from the curr ent list. If any port is assign ed to this grou [...]

VLAN C ONFIGURATION 3-153 Adding Stati c Members to VLANs (VLAN Index) Use the V LAN Static T able to configure port member s for the select ed VLAN index. Assign por ts as tag ged if they are connected to 802.1Q VLAN com pliant devi ces, o r untag ged they a re not connecte d to any VLAN-a ware devi ces. Or configure a po r t as forbi dden to prev[...]

C ONFIGURING THE S WI TCH 3-154 • Membership Type – Select VLAN membership for each interface by markin g the approp riate radio button fo r a port or tr unk: - Tagged : Interface is a member of th e VLAN. All packet s transmitted by the port will be tagged, th at is, carry a tag and therefo re carry VLAN o r CoS informati on. - Untagg ed : Int[...]

VLAN C ONFIGURATION 3-155 We b – Click VLAN , 802.1Q VLAN , Static T able. Select a VLAN ID from the scrol l-down list. Mod ify the VLAN name a nd status if required . Selec t the membe rship type by markin g the approp riate radio button in the list of por ts or tr unk s . Click Apply . Figure 3-64 Conf iguring a VLA N Static Tabl e CLI – The [...]

C ONFIGURING THE S WI TCH 3-156 Adding Stati c Members to VLANs (Port Index) Use the VLAN S tatic Membership by P ort menu to assi gn VLAN g roups to the select ed int erfa ce as a ta g ge d mem ber . Command Att ributes • Interface – Po rt or tr unk identi fier. • Member – VLANs for which th e selected int erface is a tagged member. • No[...]

VLAN C ONFIGURATION 3-157 Configur ing VLAN Behavior for Interfaces Y ou can config ure VLAN behavior for specific interfaces, including the default V LAN identifier ( PVID), accepted fram e types, ing ress fil t eri ng, GVRP status , and GARP timers . Command Usage • GVRP – GARP VL AN Reg istration P rotocol d efines a way for switch es to exc[...]

C ONFIGURING THE S WI TCH 3-158 - Ingress filte ring only affects tagged frames. - If ingres s filtering i s di sabled and a port receives fram es tagged for VLANs for wh ich it is not a member, these fram es will be flooded to all other ports (exc ept for those VLANs explic itly forbidden on this por t). - If ingres s filtering i s ena bled and a [...]

VLAN C ONFIGURATION 3-159 • Mode – Indicates VLAN membership mod e for an interface. (Default: H ybrid) - 1Q Trunk – Specifies a port as an end-point for a VLAN t runk. A trunk is a direct link between two switches, so the port transmits tagged frames that ide ntify the sour ce VLAN. Note that frames belongi ng to the por t’s default VL AN [...]

C ONFIGURING THE S WI TCH 3-160 CLI – This example s ets port 3 to accept only ta g g ed fra m es , assig ns PVID 3 as the na tiv e VLAN ID , enable s GVRP , sets the GA RP timers, and then sets the swit chport mode to hybrid. Privat e VL ANs Pri vate VLAN s provide por t-ba sed security and isolation between por ts within the a ssigned VLAN. Thi[...]

VLAN C ONFIGURATION 3-161 2. Use the Private VLAN As sociation menu (pag e 3-164) to map the seco ndar y (i.e., communit y) VLAN(s ) to the primar y VL AN . 3. Use the Priv ate VLAN P ort Configur ation menu (pag e 3 -166 ) to set the por t typ e to promisc uous (i.e., having ac cess to all p orts in the primary VLAN ), or host ( i.e., having ac ce[...]

C ONFIGURING THE S WI TCH 3-162 We b – Click VL AN , Private VLAN, Infor mation . Select the d esired por t from the VLAN ID drop-d own men u. Figure 3-67 Private VLAN Information CLI – T hi s ex ample show s the switc h configured with primary VLAN 5 and seco ndar y VLAN 6. P ort 3 has b een configured as a promiscuous port and mapped to VLAN [...]

VLAN C ONFIGURATION 3-163 Configur ing Private VLANs Th e Private VLAN Configura tion pa ge is use d to crea te/remove primar y , community , or isolated VLANs. Command Att ributes • VLAN I D – ID of configured VLAN (1-4094). • Type – The re are t hree typ es of priv ate VLAN s: - Prim ary VLANs – Conveys traffic bet ween promiscuo us por[...]

C ONFIGURING THE S WI TCH 3-164 CLI – This exam ple confi gures VLAN 5 as a pr imary VLAN , and VLAN 6 as a comm unity VLAN and VLAN 7 as an isol ated VLAN . Associating VLANs Eac h communit y VLAN mu st be associat ed with a pr imar y VLAN . Command Att ributes • Primary VLAN ID – ID of primary VLAN (1-4094). • Association – Co mmunity V[...]

VLAN C ONFIGURATION 3-165 CLI – T his examp le as sociat es co mmunity VLANs 6 and 7 wi th prim ar y VLAN 5. Displaying Priva te VLAN I nterface In formation Use the Pri vat e VLAN P or t Info r mation and Pri vate V LAN T r unk Infor mation menus to display the interfaces associat ed with priv ate VLANs. Command Att ributes • Port/Trunk – Th[...]

C ONFIGURING THE S WI TCH 3-166 We b – Cli ck VLAN, P rivate VLAN, Po rt Infor matio n or Tru nk Informa tion. Figure 3-70 Private VLAN Port Information CLI – T hi s ex ample show s the switc h configured with primary VLAN 5 and comm unity VLAN 6. Po r t 3 has be en configured as a promiscuo us po r t an d m a pp e d t o VL AN 5, w hi l e p o r[...]

VLAN C ONFIGURATION 3-167 - Host – The port is a community po rt or an isolat ed port. A commun ity port can commu nicate wi th other po rts in its ow n communi ty VLAN and wi th designat ed promiscu ous port(s). An isolat ed port can o nly communica te with the s ingle desi gnated promis cuous port in the isolat ed VLAN; it cannot commun icate w[...]

C ONFIGURING THE S WI TCH 3-168 We b – Click VLAN, Private V LAN, Port Configuration or Trunk Configuration. Set the PVLAN Port Ty pe for each port that will join a priv ate VLAN. As sign prom iscuous po rts to a p rimary or i solated VL AN. Assign ho st ports to a community or isolated VLAN. After all the ports have been configured, cl ick Apply[...]

C LASS OF S ER VICE C ONFIGURATION 3-169 Class o f Service Configura tion Class of Ser vice (CoS) allows you to sp ecify which data pack e ts hav e greater pr ecedence when traf fic is buff ered in the swit ch due to cong estion . This sw itch suppor ts C oS with four priority qu eues fo r each port. Data pack ets in a por t’ s hig h-priority que[...]

C ONFIGURING THE S WI TCH 3-170 Command Att ributes • Default Priority 11 – The priority that is assigne d to untagge d frames received on the specifie d interface . (Range: 0-7, Default: 0) • Number of Egress Traffic Classes – The number of queue buff ers provided for each port. We b – Click Priori ty , Default Port Priori ty or Default [...]

C LASS OF S ER VICE C ONFIGURATION 3-171 Mapping CoS Val ues to Egress Queues This sw itch processes Class of Ser vice (Co S) priority tag ged traffic b y using four priority queues fo r each port, with service sche dules based on strict or W eighted Round Robin (WRR). Up to e ight sep arate traffi c priorities are defined in IEEE 802.1p. The defau[...]

C ONFIGURING THE S WI TCH 3-172 Command Att ributes • Priority – CoS value. (Range: 0-7, where 7 is the high est priority) • Traffic Class 12 – Output queue buffer . (Range: 0-3, where 3 is the highest CoS priorit y queue) We b – Click Priority , T raffic Classes. T he cur rent mapping of CoS values to output queues is d isplayed. Assign [...]

C LASS OF S ER VICE C ONFIGURATION 3-173 Selecting t he Queue Mode Y ou can set th e switch to ser v ice the qu eues base d on a stric t ru le that require s all traff ic in a higher priority qu eue to be proce ssed before l ower prior ity queues are ser viced, o r use W eighted R ound-R obin (W RR) queuing th at sp ecifies a relativ e weight of e [...]

C ONFIGURING THE S WI TCH 3-174 Setting the Service Weight for Traffic Classes Th is switch u ses the W ei ghted Roun d R o bin (WRR ) alg ori thm to deter mine the frequency at which it ser vices each priority queue. As described in “Mapping CoS V alues to Eg ress Queues ” on page 3-171, the traffic classes are map ped to one o f the four egre[...]

C LASS OF S ER VICE C ONFIGURATION 3-175 CLI – The follow ing example s hows ho w to assign WRR weight s to each of the priority queues . Layer 3/4 Priority Settings Mapping L ayer 3/ 4 Priorities to CoS Values This sw itch suppor ts several common method s of prioritizing layer 3/4 traffic to meet application re quirements . T raffic prioritie s[...]

C ONFIGURING THE S WI TCH 3-176 Selecting IP Preced ence/DSCP Priority The switc h allow s you to choose be tween us ing IP Precedenc e or DSCP prior ity . Select one of the methods or disable this feature . Command Att ributes • Disabled – Disables both prio rity services. (Th is is the default se tting.) • IP Precedence – Maps layer 3/4 p[...]

C LASS OF S ER VICE C ONFIGURATION 3-177 Command Att ributes • IP Precedence Priority Table – Show s the IP Pre cedence to CoS map. • Class of Service Value – Map s a Co S value to the selected IP Preceden ce value. Note t hat “0” repres ents low pri ority and “7 ” repr esent high pr iority. We b – Click Pri ority , IP Prece dence[...]

C ONFIGURING THE S WI TCH 3-178 CLI – The follow ing example g lobally enabl es IP Precedence s er vice on the sw itch, maps IP Precedence v alue 1 to Co S value 0 (o n port 1), and then d isplays t he IP Preceden ce settings . Note: Mapping specific values for IP Precedenc e is implemented as an interface configuration command, bu t any changes [...]

C LASS OF S ER VICE C ONFIGURATION 3-179 Command Att ributes • DSCP Priori t y Table – S hows th e DSCP Pri ority to CoS ma p. • Class of Service Value – Ma ps a CoS value to the selected DSCP Priority va lue. Note that “0” represe nts low pr iority and “7” repre sent high prio rity. Note: IP DS CP settings apply to all interfac es.[...]

C ONFIGURING THE S WI TCH 3-180 CLI – T he following example globally enable s DSCP Priority ser vice on the switch , maps DSCP value 0 to CoS value 1 (on por t 1), and th en displays the DSCP Priority setting s . Note: Mapp ing specific values for IP DSCP is implemented as an interface configuration command, bu t any changes will apply to the al[...]

C LASS OF S ER VICE C ONFIGURATION 3-181 We b – Click Priority , IP P or t Priority St atus . Set IP P o rt Priority Status to Enabl ed. Figure 3-79 IP Port Prio rity Status Click Priority , IP P or t Priority . Ente r the port number for a netw ork application in the IP Port Number bo x and the new CoS value in the Class of Service bo x , a nd t[...]

C ONFIGURING THE S WI TCH 3-182 CLI – T he following example globally enables IP P ort Priority servic e on the s witch, ma ps HTTP traff ic on po rt 5 to CoS valu e 0, a nd then display s all the IP Port P riority sett ings for that p ort. Note: Mapping specific values for IP Port Priority is implemented as an interface configuration command, bu[...]

C LASS OF S ER VICE C ONFIGURATION 3-183 • ACL CoS Priority Mapping – Displa ys the configured info rmation. We b – Click Priority , A CL CoS Priori ty . Enable mapping for any por t, select an ACL from the scroll-down list, the n click Add. Figure 3-81 ACL CoS Priority CLI – This exampl e assigns a CoS v alue of zero to pac kets ma tching [...]

C ONFIGURING THE S WI TCH 3-184 Mult icast Filt ering Multicasting is used to suppor t real-time applications such as videocon ferencing or streaming audio . A multicast s erver does no t have to establish a se parate conne ction wit h each client . It merely broadc asts its se r vice to the ne twork, and any host s that wan t to receiv e the multi[...]

M ULTICAST F ILTE RIN G 3-185 Layer 2 IGMP (Snooping and Query) IGMP Snoopin g and Quer y – If multicast routing is not sup ported on other switches in you r network, you ca n use IG MP Snoo ping and Quer y (page 3-185) to monitor IGMP ser vice requests passin g between mu lt icast clients and se r vers , and dy namically configure th e switch po[...]

C ONFIGURING THE S WI TCH 3-186 multi casting, on e of these devices is elec ted “queri er” and assumes the role of qu erying the L A N fo r group members. It then propa g ates the service requ ests on to any upst ream multicast switc h/router to ensu re that it will contin ue to re ceive the mult icast servi ce. Note: Multicast routers use thi[...]

M ULTICAST F ILTE RIN G 3-187 Notes: 1. All syst ems on the subnet must supp ort th e same ver sion. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Ti meout. We b – Clic k IGMP Snoopin g, IGMP Co nfiguration. Adjust the IGMP settings as required , and then click Ap ply . (T he default settings are shown[...]

C ONFIGURING THE S WI TCH 3-188 Displaying Inte rfaces Attached to a M u lticast Ro uter Multi cast routers t hat are atta ched to p or ts on the switc h use information obtained from IGM P , along with a multicast routing protoco l such as D V MRP or PIM , to supp ort IP multicasting a cross the Inter net. T hese routers may be dynamically discove[...]

M ULTICAST F ILTE RIN G 3-189 CLI – T his example shows that P or t 11 has been static ally configured as a port attached to a multicast router . Specifyin g Static Interfaces f o r a Mult icast Router Depe nding on your network co nnect ions , IGMP sn ooping m ay not always be able t o locate th e IGMP querier . Therefor e, if the IGMP querier i[...]

C ONFIGURING THE S WI TCH 3-190 We b – Click IGMP Snoo ping, Static Mult icast R o uter P or t Configuration. Specify the interfaces at tached to a multicas t router , indicate the VLAN which will forward all the corre sponding multicast traffic, and then click Add. After you hav e finished adding interfaces to the list, clic k Ap ply . Figure 3-[...]

M ULTICAST F ILTE RIN G 3-191 We b – Click IGMP Snooping, IP Multicast R egi stration T able. Select a VLAN ID and the IP ad dress for a multicast ser vice from the scroll-down lists . T he switch will display all the interfaces that are propag ating this multicast ser vice. Figure 3-85 IP Multicast Registration Table CLI – T his example displa[...]

C ONFIGURING THE S WI TCH 3-192 Assigning Ports to Multicast Services Multicast filte ring can be dynamic ally configured using IGMP Snooping and IGMP Quer y messages as de scribed in “ Configuring IGMP snoopi ng and Query Parameter s” on pag e 3-133. F or certain applications that require tighter cont rol, you may need to s tatically conf igur[...]

M ULTICAST F ILTE RIN G 3-193 We b – Clic k IGMP Snoopin g, IGMP Me m ber Port T abl e. Speci fy the interface atta ched to a multicast s er v ice (via an IGMP-enabled switch or multicast rout er), ind icate the VL AN that wil l propaga te the multic ast ser vice, specify the multicast IP address, and click Add. A fter you ha ve completed adding [...]

C ONFIGURING THE S WI TCH 3-194[...]

4-1 C HAPTER 4 C OMMAND L INE I NTERF ACE This ch apter descr ibes how t o use the Com m and Line Interfac e (CLI). Note: Yo u can only access the console interfa ce throug h the Mast er unit in the stack. Using the Com m and Li ne Interface Accessing the CLI When acces sing the man ag ement interface for the switch ove r a direct connec tion to th[...]

C OMMAND L IN E I NTE RFA CE 4-2 3. Whe n finished, ex it the sessio n with the “q uit” or “exit ” command. After c onnecting to the sy stem through the conso le port, the logi n screen displ ays: Telnet Connection T elnet operates o ver t he IP transport proto col. In this e nvironment, your management station and any ne twor k devi ce you[...]

U SIN G THE C OMMAND L INE I NTE RFA CE 4-3 After y ou configure t he switch with an IP addre ss, y ou can open a T elnet session by perfor ming these st eps: 1. Fr om the remote host, e nter the T elnet co m man d and the IP address o f the de vice you want to acces s . 2. At the prompt , enter the user name and sy stem password. The CLI w ill dis[...]

C OMMAND L IN E I NTE RFA CE 4-4 Enteri ng Commands Th is section d escribe s how to enter CLI comma nds . Keywords and Arguments A CLI comm and is a series of ke yword s and arguments . Keyw ords ident ify a command, an d arguments specify con figuration parameter s. F or example , in the c o mmand “show inter faces status ethernet 1/ 5,” show[...]

E NTERING C OMMANDS 4-5 Command Com pletion If you ter minate input with a Ta b ke y , the CLI will print the remaining characters of a par tial keyword up to the point of ambi guity . In th e “logging his tor y” examp le, typi ng log follo wed by a tab will result in printing the comm and up to “ log ging .” Getting Help on Commands Y ou c[...]

C OMMAND L IN E I NTE RFA CE 4-6 Showing Commands If you enter a “?” at the command prompt , the system will display the first lev el of key words for the current comm and class (No r mal Ex ec or Pri vileged Exec) or configurati on class (Gl obal, A CL, Interfac e, Line or VLAN Database ). Y ou can also display a lis t of valid k ey w ords for[...]

E NTERING C OMMANDS 4-7 The co mmand “ show interfaces ? ” will display the following infor mat ion: Partial Keyword Lookup If yo u ter minate a partial keyw ord with a question mark, alter nati ves that match the initial letters are provided. ( R ememb er not to leav e a space betw een the command and que stion mark.) F or exampl e “ s? ” [...]

C OMMAND L IN E I NTE RFA CE 4-8 Understanding Command Modes The command s et is divide d into Ex ec and Confi guration class es. Exec commands ge nerally display infor mation on system stat us or clear statisti cal count ers . Configur ation com mands, on the othe r hand, mo dify inte rface parameters o r enable certain sw i tc hing functio ns. T [...]

E NTERING C OMMANDS 4-9 Pri vileged Exec mode from wi thin Nor mal Ex ec m ode , by enter ing the enab le comman d, followe d by the privileg ed lev el p assw ord “super ” (page 4-36). T o enter Pri vileged Ex ec mode, e nter the follo wing user nam es and passwords: Configura tion Commands Configuration commands are privileged level commands u[...]

C OMMAND L IN E I NTE RFA CE 4-10 • Line Conf igurati on - These co mmands modify the console po rt and Telnet configuration, an d include com m and such as parity and databits . • VLAN Configurat ion - Includes the command t o create VL AN group s. T o e nter the Gl obal Configu ration mode, e nter the c ommand configure in Privileged Exec mod[...]

E NTERING C OMMANDS 4-11 Command Line Pr ocessing Commands are not case sensitiv e. Y o u can abbreviate com mands and para meters as lon g as they conta in enou gh lett ers to d iffere ntiat e them from an y other currently a vailab le commands o r paramete rs. Y ou can use the T ab key to complete par tial commands, or enter a partial command fol[...]

C OMMAND L IN E I NTE RFA CE 4-12 Comman d Groups The syst em commands c an be brok en down i nto the funct ional groups shown below . Table 4-4 Command Groups Command Group Description Page Lin e Sets comm unicat ion pa rame ters for the serial p ort and Telnet, in cluding baud rate and console time-out 4-14 General Basic commands for entering pri[...]

C OMMAND G RO UP S 4-13 The access m ode shown i n the follo wing tables i s i ndicated by these abbr eviations: NE (Nor mal Exec) PE (Privilege d Exec) GC (Global Con figuration) ACL (Access Co ntrol List Co nfigurat ion) IC (Inter face C onfigu ration ) LC (Line Configuration) VC (VLAN Database Configuratio n) Address Tab le Configures the addres[...]

C OMMAND L IN E I NTE RFA CE 4-14 Line Co mmand s Y ou can access the onboard configuration program by attaching a VT100 compa t ibl e device to the s er ver’ s seri al port. These commands are used to set com munication p arameters for the serial po r t or T elnet (i.e ., a virtual ter minal) . Table 4-5 Line Comm ands Comm and Funct ion Mo de P[...]

L INE C OMMANDS 4-15 line This comma n d id entifies a sp ecific line for configuration , and to proces s subse quent line co nfiguratio n comma nds . Syntax line { console | vty } - console - Console terminal lin e. - vty - Virtual terminal fo r remote console acces s (i.e., Telnet). Default Setting There is n o default line. Command Mode Global C[...]

C OMMAND L IN E I NTE RFA CE 4-16 login This command enables pass word c hecking at login. Use the no for m to disable password checking and allow con nection s withou t a password. Syntax login [ local ] no login local - Selec ts local password checking . Authentica tion is based on the user name spec ified with the user name command. Default Sett[...]

L INE C OMMANDS 4-17 Example Related Commands username ( 4-35) password (4-17) password This comma n d sp ecifies the pa ssword for a line . Use the no for m to remove the password . Syntax password { 0 | 7 } password no passw ord -{ 0 | 7 } - 0 mean s plain password, 7 mean s enc rypted password - password - Character string that specifies the lin[...]

C OMMAND L IN E I NTE RFA CE 4-18 configuration file from a TFTP server. Th ere is no need for you to manual ly config ure encrypte d password s. Example Related Commands login (4-16) password-thre sh (4-20) timeout login re sponse This c ommand sets t he inter val that the syst em waits for a user to log in to the CL I. Use t he no for m to rest o[...]

L INE C OMMANDS 4-19 Example T o set the tim eout to t wo m inutes , e nter th is comma nd: Related Commands silent-time ( 4-21) ex ec-timeout (4-14) exec-timeout This c ommand sets the inter val that the syste m waits until user input is detected. Use the no form to restore the default. Syntax exec-timeout [ seconds ] no exec-timeout seconds - In [...]

C OMMAND L IN E I NTE RFA CE 4-20 Example T o set the tim eout to t wo m inutes , e nter th is comma nd: Related Commands silent-time ( 4-21) tim eout login response ( 4-13) password-thr esh This c ommand sets the passw o rd intr usion threshold w hich limits the number of failed lo go n attempts . Us e the no for m to remov e the threshold val u e[...]

L INE C OMMANDS 4-21 Example T o set the password thres hold to five attempts, enter this command: Related Commands silent-time ( 4-21) tim eout login response ( 4-13) silen t-time This c ommand sets th e amount of time the man agement console is inacce ssible after th e number of unsuccessful l og on atte mpts ex ceeds the threshold set by the pas[...]

C OMMAND L IN E I NTE RFA CE 4-22 databits This c ommand se ts the number of dat a bits per chara cter that are inter preted a nd g enerate d by the c onsole port . Use the no for m to re store the de fault value. Syntax databi ts { 7 | 8 } no databits - 7 - Seven data bits per ch aracter. - 8 - Eight dat a bits per cha racter. Default Setting 8 da[...]

L INE C OMMANDS 4-23 parity Th is command defines t he gene ration of a parity bit . Use the no for m to restore the default s etting . Syntax parity { none | even | odd } no parity - none - No parity - even - Even pa rity - odd - Odd parity Default Setting No parity Command Mode Line Configuration Command Usage Communic ation prot ocols pr ovided [...]

C OMMAND L IN E I NTE RFA CE 4-24 Default Setting 9600 Command Mode Line Configuration Command Usage Set the speed to m atch the b aud rate of t he device conn ected to the seria l port. So me baud rates available on devices co nnected to the por t might not be supp or ted. Th e system indi cates if the speed y ou selec t ed is not su ppor ted. Exa[...]

L INE C OMMANDS 4-25 disconnect This command te r minates an SSH, T elnet , or console connecti on. Syntax disconnect s ession-id session- id – The session identifier fo r an SSH, T elnet or console connect ion. (Rang e: 0-4) Command Mode Pri vileged Exec Command Usage Specifying s ession identifier “0” will disconnect t he console connecti o[...]

C OMMAND L IN E I NTE RFA CE 4-26 Example T o show all lines, enter this command: General Comman ds Console#show line Console configuration: Password threshold: 3 times Interactive timeout: Disabled Login timeout: Disabled Silent time: Disabled Baudrate: 9600 Databits: 8 Parity: none Stopbits: 1 VTY configuration: Password threshold: 3 times Intera[...]

G ENERAL C OMMANDS 4-27 enable This c ommand activates Pri v ileged Exec mode. In privileged mode, addition al commands are av ailable, an d cer tain comman ds display addition al infor mation. See “ Under s tandin g Command Modes” on page 4-8. Syntax enab le [ leve l ] leve l - Privil e ge level to log into the device. The device has two prede[...]

C OMMAND L IN E I NTE RFA CE 4-28 disable This comm and returns to Nor mal Ex e c mode from privileged mode. In nor mal access mode , you ca n only displ ay basic in for mation o n the switch's configuration or Ethe rnet statistic s . T o g ain access to all comma nds, you must use t he privi lege d mode. See “ Under stand ing Command Modes?[...]

G ENERAL C OMMANDS 4-29 Example Related Commands end (4-30) show h isto ry This comma nd shows the content s of the comman d history buffer . Default Setting None Command Mode Nor mal Exec , Privileg ed Exec Command Usage The history buffer si ze is fix ed at 10 Execu tion command s and 10 Configur ation comma nds . Example In this exam ple, the sh[...]

C OMMAND L IN E I NTE RFA CE 4-30 The ! comm and repeats comm ands from the Ex ecution co mmand history buffer wh en you are in Nor mal Ex ec or Pri vileged Ex ec Mode, and command s from the Configu ration command his tor y buffer when y ou are in any of the config uration modes . In this example, the !2 command repeats t he second command in th e[...]

G ENERAL C OMMANDS 4-31 Command Mode Global Co nfiguratio n, Inte rface Co nf iguration, Line Co nfiguration, and VLAN Da tabase Conf iguration. Example This examp le shows ho w to return to the Privi leged Exec mode from the Interface Config uration mode: exit This comm and returns to th e previous configuration mode o r exit the config uration pr[...]

C OMMAND L IN E I NTE RFA CE 4-32 Command Mode Nor mal Exec , Privileg ed Exec Command Usage The quit and exit commands c an both exi t the config uration pr og ram. Example This e xample shows h ow to quit a CLI se ssion: System Mana gement Com mands These comman ds are used to control sys tem logs , passw ords , user names , browser configur atio[...]

S YSTE M M ANAGEME NT C OMMANDS 4-33 Device Designation Co mmands prom pt This comma nd customizes t he CLI prompt. Use the no for m to re sto re the def ault prom pt. Syntax prompt string no prompt string - Any a lphanu meric strin g to use fo r the CLI pr ompt. (Maximu m length: 255 ch aracters) Default Setting Consol e Command Mode Global Config[...]

C OMMAND L IN E I NTE RFA CE 4-34 hostnam e This command s pecifies or modi fies the host nam e for this device . Use the no for m to res tore the d efault hos t name. Syntax hostname name no hostname name - T he name of this host. (Maximum le n gth: 255 c h aracter s ) Default Setting None Command Mode Global Configuratio n Example User Access Com[...]

S YSTE M M ANAGEME NT C OMMANDS 4-35 usernam e This comma n d adds named users , req uires authentica tion at log in, specifie s or chang es a user's password (or sp ecify that no password is requ ired), or spec ifies or chang es a us er's ac cess le vel. Use th e no for m to remov e a user name . Syntax user name name { access-lev el le [...]

C OMMAND L IN E I NTE RFA CE 4-36 Command Usage The en crypte d passw ord is required for compatibility with legacy pas sword setting s (i.e ., plain text or encr ypte d) when rea ding the conf iguration file duri ng system bo otup or wh en downlo ading the config uration f ile from a TFT P ser ver . Ther e is no nee d for you to man ually confi g [...]

S YSTE M M ANAGEME NT C OMMANDS 4-37 Command Usage • You cannot set a nu ll password. You will have to enter a p assword to change the command mod e from Normal Exec to Privileged Exec with the enable comman d (page 4-27). • The encrypted password is required for compatibility with legacy passw ord settings (i.e., plai n text or e ncrypted) wh [...]

C OMMAND L IN E I NTE RFA CE 4-38 management This comma n d sp ecifies the cli ent IP address es that are all owed manageme nt access to the switc h through various protocols . Use the no for m to res tore the defau lt setting . Syntax [ no ] m anagement { all-client | http-client | snmp-client | telnet-client } start-address [ end-address ] - all-[...]

S YSTE M M ANAGEME NT C OMMANDS 4-39 • Y ou can delete an address range j ust by specif ying the start add ress, or by specifyin g both the start ad dress and end add ress. Example This exampl e restricts managem ent access to t h e i ndicated addr esses . show management This c ommand displays the client IP addresses that are allowed manageme nt[...]

C OMMAND L IN E I NTE RFA CE 4-40 Example Web Server Commands Console#show management all-client Management IP Filter HTTP-Client: Start IP address End IP address ----------------------------------------- ------ 1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 SNMP-Client: Start IP address End IP address -----------------------------------[...]

S YSTE M M ANAGEME NT C OMMANDS 4-41 ip http port This command specifies the T CP port n umber used b y the web b rowser interface. Use the no form to us e th e defa ult port. Syntax ip http por t port-number no ip http por t por t-nu mber - T h e T C P p o r t t o b e u s e d b y t h e b r o w se r i n t e r f a c e . (Range: 1-65535) Default Sett[...]

C OMMAND L IN E I NTE RFA CE 4-42 Example Related Commands ip http po rt (4-41) ip http secur e-server This comma nd enables t he secure h ypertext transfe r protocol (HTTPS) over the Sec ure Socket Layer (S SL), providing secur e acces s (i.e., an encrypted con nection) to the switch ’ s w eb interf ace. Use t h e no fo r m to disable th is func[...]

S YSTE M M ANAGEME NT C OMMANDS 4-43 • Th e client an d server establ ish a secure encrypted c o nnec tion. A padloc k icon sh ould app ear in the status bar for Intern et Explor er 5.x and Netscape Navigator 6.2 or later versions. • T he followin g web brow sers and op erating sys tems current ly support HTTPS: • To specify a sec ure-site ce[...]

C OMMAND L IN E I NTE RFA CE 4-44 Command Mode Global Configuratio n Command Usage • Y ou cannot con figure the HT TP and HTTPS server s to use t he same port . • I f you change the HT T P S port number, cl ients attemp ting to connec t to the HTTPS se rver mus t specify th e port n umber in the URL, in this for mat: https:// device : port_nu m[...]

S YSTE M M ANAGEME NT C OMMANDS 4-45 Default Setting 23 Command Mode Global Configuratio n Example Related Commands ip telnet ser v er (4-4 5) ip telnet s erver This comm and allows this device to be monitored or configured from T elnet. Use the no for m t o disabl e this functi on. Syntax [ no ] ip telnet server Default Setting Enabl ed Command Mo[...]

C OMMAND L IN E I NTE RFA CE 4-46 Secure Shell Commands The Berkley-stan dard includes remote access tools originally design ed for Unix sys tems . Some of th ese tool s have also bee n implem ented fo r Micros oft Windows a nd other environmen ts . T hese to ols, including comma nds such as rlo g in (rem ote login), rsh (remote shell), and rc p (r[...]

S YSTE M M ANAGEME NT C OMMANDS 4-47 The SSH se r ver on this switc h supports b o th passwo rd and public k ey authen tication. I f passw ord authenti cation is speci fied by t he SSH client, then the password can be au thentica ted either lo cally or via a RADIUS or TA CA CS+ remote authe ntication s er ver , as spe cified by the authentication l[...]

C OMMAND L IN E I NTE RFA CE 4-48 2. Provide Host Public Key to Clients – Many SSH clie nt prog rams automatically impor t the host public key during the initi al connection setup with the switch. Otherwise, you need t o manually create a known hosts f ile on the ma nage ment stat ion and place the host public key in it. An entr y for a public ke[...]

S YSTE M M ANAGEME NT C OMMANDS 4-49 a. The c lient send s its publi c key to the switch. b. The switc h compares t he client's p ublic key to those stor ed in memo r y . c. If a mat ch is fou nd, the switc h uses the p ublic key t o encrypt a random sequenc e of by tes , and sends t his string to the clie nt. d. The client u ses its pri vate [...]

C OMMAND L IN E I NTE RFA CE 4-50 Example Related Commands ip ssh cr yp to host-key ge nerate (4-52) show ssh (4-55) ip ssh timeout This comma n d con figures the ti meout for the SSH ser ver . Use the no for m to res tore the defau lt setting . Syntax ip ssh timeout seconds no ip ssh tim eout seconds – T he timeout f or client respon se during S[...]

S YSTE M M ANAGEME NT C OMMANDS 4-51 ip ssh auth entication-retri es This command c onfigures t he number of times the SSH s er ver att empts to reauth enticate a user. Use the no for m to re store the de fault setti ng . Syntax ip ssh a ut hentication-retries co unt no ip ssh authentication-retries count – T he number of authentication attempts [...]

C OMMAND L IN E I NTE RFA CE 4-52 Command Usage • Th e server key is a priv ate key that is never sha red outside the swit ch. • The host key is shared with the SSH client, a n d is fixed at 1024 bits. Example delete public- key This command deletes the sp ecified user’ s publi c key . Syntax delete public-key username [ dsa | rsa ] -u s e r [...]

S YSTE M M ANAGEME NT C OMMANDS 4-53 Command Mode Pri vileged Exec Command Usage • This comm and stor es the ho st key pair in me mory (i.e. , RAM). Use the ip ssh save ho st-key command to s ave the host key p air to flash memory. • Some SS H clien t progr ams autom atica lly add the pu blic key to the know n hosts file as part of the co nfigu[...]

C OMMAND L IN E I NTE RFA CE 4-54 Command Usage • Th is command cl ears the host key fr om volatile memo ry (RAM). Use the no ip ss h save ho st-ke y command to clear the host key fr om fla s h memory. • Th e SSH server must be d isabled before you can execute this command. Example Related Commands ip ssh cr yp to host-key ge nerate (4-52) ip s[...]

S YSTE M M ANAGEME NT C OMMANDS 4-55 show ip ssh This comma nd displa ys the connect ion settin gs used when authenticating client access to th e SSH ser ver . Command Mode Pri vileged Exec Example show ssh This comma nd displa ys the current S SH ser ver connection s. Command Mode Pri vileged Exec Example Console#show ip ssh SSH Enabled - version [...]

C OMMAND L IN E I NTE RFA CE 4-56 show publ ic-key This comma nd shows the public key for th e specified user or for the host. Syntax show public-k ey [ user [ user na me ]| host ] user name – Name of an SSH user . (Range: 1-8 c haracters) Default Setting Shows all public keys. Encryption The encryption method is automatically negotiated between [...]

S YSTE M M ANAGEME NT C OMMANDS 4-57 Command Mode Pri vileged Exec Command Usage • I f no parameters are ent ered, all keys are displayed. If th e user keyword is ent ered, but no use r name is speci fied, then t he public keys for a ll user s are disp layed. • W hen an RSA key is d isplayed, the first field indicates the size of th e host key [...]

C OMMAND L IN E I NTE RFA CE 4-58 Event Logging Commands loggi ng on This c ommand controls lo g ging of er ror messag es , se nding debug or er ror messag es to switch memor y . T he no form disables the logg in g process . Syntax [ no ] lo gging on Default Setting None Command Mode Global Configuratio n Command Usage The log gin g process c ontro[...]

S YSTE M M ANAGEME NT C OMMANDS 4-59 Example Related Commands log ging h istor y (4-59) clear log ging (4 -63) loggi ng history This c ommand limits syslog messag es saved to swit c h memor y based on severity . T he no for m retur ns the log ging of syslog me ssag es to the defau lt level. Syntax logging hist or y { fla sh | ram } le vel no log gi[...]

C OMMAND L IN E I NTE RFA CE 4-60 Default Setting Flash: errors (lev el 3 - 0) RAM: warnings ( level 6 - 0) Command Mode Global Configuratio n Command Usage The message le v el sp ecified for f lash memor y must be a higher priority (i.e. , numerically low er) than that spec i fied fo r RAM. Example loggi ng host This comm and adds a syslog ser ver[...]

S YSTE M M ANAGEME NT C OMMANDS 4-61 Command Usage • By using this comma nd more than on ce yo u can bu ild up a l ist of host IP add resses. • The maximum number of host IP addresses allowed is five. Example logging facility This c ommand sets the facility type for remote logg ing of syslog mess ages . Use the no for m to retu rn the ty pe to [...]

C OMMAND L IN E I NTE RFA CE 4-62 loggi ng trap This command en ables the logging of syste m messages to a remote s er ver , or li mits the syslog messages save d to a re mote server based on se veri ty . Use this comm and without a specified level to enable re mote log ging. Us e the no for m to disable remote log ging . Syntax loggin g tr ap [ le[...]

S YSTE M M ANAGEME NT C OMMANDS 4-63 clear l ogging This command clears messages from the log buffer . Syntax clear lo gging [ fl as h | ram ] - fla sh - Even t history s tored in flas h memory (i. e., permanent memo ry). - ram - Eve nt history stor ed in temporary RA M (i.e., memor y flushed on power re set). Default Setting Flash and RAM Command [...]

C OMMAND L IN E I NTE RFA CE 4-64 Default Setting None Command Mode Pri vileged Exec Example The following example shows that system log ging is enabled, the messag e level for flash memor y is “er rors” (i.e., default level 3 - 0), the message level for RAM is “infor mational” (i.e., default level 6 - 0). The follo wing exampl e displays s[...]

S YSTE M M ANAGEME NT C OMMANDS 4-65 Related Commands show log ging se ndmail (4-70) show log This comma nd displa ys the syst em and ev ent messages st ored in memo r y . Syntax show log { fl a s h | ram } [ logi n ] [ tail ] - fla sh - Event h istory st ored in flas h memory (i.e. , permanent memo ry). - ram - Eve nt history stor ed in temporary [...]

C OMMAND L IN E I NTE RFA CE 4-66 Command Usage This comman d shows the system and ev ent messages stored in memor y , including the time stamp , message level (page 4-59), p rogram module, func tion, and even t n u mber . Example The follo wing exampl e shows s ample messages st ored in RAM. SMTP Alert Com mands These commands con figure SMTP ev e[...]

S YSTE M M ANAGEME NT C OMMANDS 4-67 loggi ng sendmail host This c ommand specifies SMTP ser vers that will be sent alert messages. Use the no form to remo ve an SM TP server . Syntax [ no ] lo gging sendmail host ip_address ip_address - IP ad d ress of an SMTP ser ver that will b e sent alert mess ages for ev ent ha ndlin g. Default Setting None C[...]

C OMMAND L IN E I NTE RFA CE 4-68 Example loggi ng sendmail level This c ommand se ts the severity thre shold used to trig ge r alert messag es . Syntax loggin g se ndma il le vel le vel leve l - One of the system messag e levels (page 4-59). Me ssages sent include the selected level do wn to le v el 0. (Rang e: 0-7; Default: 7) Default Setting Lev[...]

S YSTE M M ANAGEME NT C OMMANDS 4-69 logging sendmail source-email This command sets the emai l address use d for the “Fro m ” fiel d in alert messages . Use the no form to delete the source email address . Syntax [no] log ging sendmail source-email email-add r ess email-address - The sour ce email addr ess used in al ert messages . (Range: 0-4[...]

C OMMAND L IN E I NTE RFA CE 4-70 Command Mode Global Configuratio n Command Usage Y ou can spec ify up to fiv e recipi ents for alert mess ages. H owev er , you mus t enter a separa te command to sp ecify each recipient. Example loggi ng sendmail This comma nd enables SMT P event h andling . Use the no for m to disable this functio n. Syntax [ no [...]

S YSTE M M ANAGEME NT C OMMANDS 4-71 Example Time Commands The sys tem clock can be dynamically se t b y polling a set of specified time ser vers (NTP or SNTP). M aintaining an accurate tim e on the switch enables the system l og to record m eani ngful dates an d times for ev ent entries . I f the clock is not set, the switch will only re cord the [...]

C OMMAND L IN E I NTE RFA CE 4-72 sntp client This comm and enables SNTP client requests for tim e synchronization from N TP or SNTP t i me ser ver s specified with the sntp servers comma nd. Use the no for m to disab le SNTP client requests . Syntax [ no ] sntp client Default Setting Disabled Command Mode Global Configuratio n Command Usage • Th[...]

S YSTE M M ANAGEME NT C OMMANDS 4-73 sntp server This comma nd sets the IP address of the ser v ers to whi ch SNTP tim e request s are issued. Use the this command with n o arguments to clear all time ser vers from the cur rent lis t. Syntax sntp server [ ip1 [ ip2 [ ip3 ]]] ip - I P a d d r e s s o f a t i m e s e rv e r ( N T P o r S N T P ) . (R[...]

C OMMAND L IN E I NTE RFA CE 4-74 sntp poll This comma nd sets the i nte r val be tween send ing time req uests when the switch is set to SNT P client mode. Use the no for m to re store to th e defau lt. Syntax sntp p o ll se conds no sntp poll seconds - Inter val betw een time requests . (Range: 16-16384 seconds) Default Setting 16 seconds Command[...]

S YSTE M M ANAGEME NT C OMMANDS 4-75 Example clock timezon e This command sets the time z one for the s w itc h’ s internal clock. Syntax clock timezone name hour ho urs minute minutes { before-utc | after-utc } • name - Name of timezone, usually an acronym. (Range: 1-29 character s) • hours - Number of hour s before/after UTC . (Range: 0-12 [...]

C OMMAND L IN E I NTE RFA CE 4-76 Example Related Commands show sntp (4-74) calendar set This comma nd sets the sys tem clock. It may be used if there is no time ser ver on your network, or if you h av e not conf igured the switch to rece ive signals f rom a time s er ver . Syntax calendar set hour min sec { day month y ear | month da y year } • [...]

S YSTE M M ANAGEME NT C OMMANDS 4-77 show cal endar This comma nd displa ys the system clock. Default Setting None Command Mode Nor mal Exec , Privileg ed Exec Example System Status Commands Console#show calendar 15:12:34 April 1 2004 Console# Table 4-23 System Status Comma n ds Command Function Mode Page light unit Displays the unit ID of a switch[...]

C OMMAND L IN E I NTE RFA CE 4-78 light un it This comm and displays the unit ID of a switch using its front- panel LED indicators. Syntax light unit [ unit ] unit - speci fies a u nit in a swit ch s tack t o ligh t the p anel L EDs Default Setting None Command Mode Nor mal Exec , Privileg ed Exec Command Usage The unit I D is displayed using th e [...]

S YSTE M M ANAGEME NT C OMMANDS 4-79 • This command d isplays settin gs for key comman d modes. E ach mode group is separated b y “!” symbols , and incl udes the co nfiguratio n mode command, and corresponding command s. This command displays the following information: - SNMP community strings - Users (names and access levels) - VLAN database[...]

C OMMAND L IN E I NTE RFA CE 4-80 Related Commands show r unning -config (4-80) show runnin g-config This comma nd displays the configur a t ion infor mation cur rently in use. Default Setting None Command Mode Pri vileged Exec Command Usage • Use this comma nd in conjuncti on with the show startup-config command to compare the information in run[...]

S YSTE M M ANAGEME NT C OMMANDS 4-81 Example Console#show running-config building startup-config, please wait..... ! phymap 00-30-f1-ce-2a-20 00-00-00-00-00-0 0 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00 -00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 ! SNTP server 0.0.0.0 0.0.0.0 0.0.0.0 ! clock timezone hours 0 minute 0 after-UT[...]

C OMMAND L IN E I NTE RFA CE 4-82 Related Commands show star tup-config ( 4-78) show system This c ommand displays system infor mat ion. Default Setting None Command Mode Nor mal Exec , Privileg ed Exec Command Usage • F or a descr iption of th e items sh own by th is command, refer to “Displaying Sy stem Information” on page -11. • The POS[...]

S YSTE M M ANAGEME NT C OMMANDS 4-83 show us ers Shows all activ e c onsole and T elnet session s , including use r name, idle time, and IP address of T elne t client. Default Setting None Command Mode Nor mal Exec , Privileg ed Exec Command Usage The session us ed to execu te this comman d is indicated by a “*” symbol next to t he Line (i.e., [...]

C OMMAND L IN E I NTE RFA CE 4-84 Command Mode Nor mal Exec , Privileg ed Exec Command Usage See “Displaying Switch Hardware/S oftware V e rsions” on p age 3 -13 for detailed infor mation on the items d isplayed by this command . Example Frame Size Commands jumbo frame This comma nd enables supp or t for jumbo frames . Use t he no fo rm to disa[...]

F LASH /F ILE C OMMANDS 4-85 Command Mode Global Configuratio n Command Usage • Th is switch provi des more effici ent throughput for large sequ ential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, usin g jumbo frames sign ificantly reduces the per-packet overhead requ[...]

C OMMAND L IN E I NTE RFA CE 4-86 copy Th is command moves (upload/down load) a co de imag e or co nfiguratio n file b etween the sw itch’ s flash mem or y and a TFTP server . When y ou sav e the sys tem code o r configura tion settings to a file on a TFTP se r ver , th at file can later be downloaded to th e switch to resto re system op eration.[...]

F LASH /F ILE C OMMANDS 4-87 Command Mode Pri vileged Exec Command Usage • The syst em pr ompts for data req uired to complet e the c opy command. • T he destin ation fi le name sh ould not contain sla shes ( or /), the leading letter of the file name should not be a period (. ), and the maximum length for file names on the TFTP server is 127 [...]

C OMMAND L IN E I NTE RFA CE 4-88 Example The foll owing example sh ows ho w to upl oad the co nfiguratio n setting s to a file on the TFTP ser ver: Th e following exa mple shows how to copy the ru nning conf iguratio n to a star tup file . Th e following exa mple shows how to down l oad a configuration file: This examp le shows ho w to copy a secu[...]

F LASH /F ILE C OMMANDS 4-89 This exampl e shows ho w to copy a p ublic-key used by SSH from an TFTP server . No te that pu blic k ey authen ticatio n via SSH is only su pported fo r users configured locally on the switch: delete This comm and deletes a file or image. Syntax delete [ unit :] filena me filename - Name of the configuration file or im[...]

C OMMAND L IN E I NTE RFA CE 4-90 Example This e xample shows how to delete the test2.cfg c onfiguration file from flash me mor y for unit 1. Related Commands dir (4-90) delete public-key (4 -52) dir This comm and displays a list of files in flash memor y . Syntax dir [ unit :] {{ boot-rom: | conf ig: | opc ode: } [ : file name ]} The type of file [...]

F LASH /F ILE C OMMANDS 4-91 • File information is shown below: Example The following example shows how to display all file infor mation: whichboot This command displ ays whic h files were bo oted when the syst em po wered up . Syntax whichboot [ uni t ] unit - Stac k unit. (Range – SMC6224M : 1-8, SMC6248M: 1-4, mixed stack: 1-4) Default Setti[...]

C OMMAND L IN E I NTE RFA CE 4-92 Example This examp le shows the infor mation displaye d by the whichboot comma nd. See the t able under th e dir command for a des cription of the file infor mation displayed by this command. boot system This comma nd specifies the image used to st ar t up t he system. Syntax boot system [ unit :] { boot-rom | conf[...]

A UTHE NTI CAT ION C OMMANDS 4-93 Example Related Commands dir (4-90) whichboot (4-91) Authen tication C o mma nds Y ou can co nfigure th is switc h to authen ticate u s er s log ging i nto the s ystem for manag ement acce ss using local or RADIUS authentic ation method s . Y ou can also enable port-based auth entication for n etwork cli ent access[...]

C OMMAND L IN E I NTE RFA CE 4-94 authent ication login This comma nd defines th e login auth enticatio n method and precedence . Use the no form to restore the defaul t . Syntax authentication login {[ loca l ] [ radius ] [ tacacs ]} no authentication login • local - Use l ocal password. • radius - Use RADIUS s erver pas s word. • tacacs - U[...]

A UTHE NTI CAT ION C OMMANDS 4-95 Example Related Commands username - for set ting the local user names and pa ssword s (4-35) authent ication enable This comma nd defines th e authenti cation meth od and prec edence to use when c hanging fro m Exec co mmand mode to Privileged Ex ec command mode with th e ena ble command (see page 4-27). Use the no[...]

C OMMAND L IN E I NTE RFA CE 4-96 • You can s pecify thr ee authe ntication methods in a single command to indica te the au thenticatio n sequence. For example, i f you enter “ authentication enable radius tacacs loc al , ” th e user name and password on th e RAD IUS server is verified first. If the RADIUS server is n ot available , then auth[...]

A UTHE NTI CAT ION C OMMANDS 4-97 radi us-server host This command specifies primary and bac kup RADIUS ser v ers and authen tication p arameters that apply to each server . Use th e no for m to restore the default values. Syntax [ no ] radius-ser ver index host { host_ip_ addr ess | host_ alias } [ auth-por t auth _por t ] [ timeout timeout ] [ re[...]

C OMMAND L IN E I NTE RFA CE 4-98 radi us-server port This command set s the RADIUS server netw ork port. Use the no fo r m to restore the default. Syntax radius-ser v er por t por t_nu mber no radius-server por t por t_nu mber - RADIUS ser ver UDP por t used for authenticatio n messages . (Rang e: 1-65535) Default Setting 1812 Command Mode Global [...]

A UTHE NTI CAT ION C OMMANDS 4-99 Example radi us-server retran smit This comma nd sets the n umber of re tries . Use the no for m to restore the defau lt. Syntax radius-server retransmit number_of _ retries no radius-server retransmit number_ of_r etries - Numb er of times the switch will tr y to authentica te logon a ccess via the RADIUS ser ver [...]

C OMMAND L IN E I NTE RFA CE 4-100 Command Mode Global Configuratio n Example show radius- server This comma nd displa ys the current sett ings for th e RADIUS ser v er . Default Setting None Command Mode Pri vileged Exec Example Console(config)#radius-server timeout 10 Console(config)# Console#show radius-server Remote RADIUS server configuration:[...]

A UTHE NTI CAT ION C OMMANDS 4-101 TACACS+ C lient T er minal Access Controlle r Access Co ntrol System (TA CA CS+ ) is a logon authent ication protoc ol that use s software r u nning on a central se r v e r to control access to T A CA CS-awar e devices on the networ k. An authen tication s er ver cont ains a databas e of multiple user name/passw o[...]

C OMMAND L IN E I NTE RFA CE 4-102 tacacs-server p o rt This comma nd specifies the TA CA CS+ server netw ork port. U s e th e no for m to res tore the default. Syntax tacacs-ser ver port port_number no tacacs-ser ver port por t_nu mber - TA CA C S+ ser ver TCP p ort u sed for auth entication messages . (Rang e: 1-65535) Default Setting 49 Command [...]

A UTHE NTI CAT ION C OMMANDS 4-103 Example show tacacs-ser ver This comma nd displa ys the current set tings for the TA CA CS+ server . Default Setting None Command Mode Pri vileged Exec Example Port Security Commands These comman ds can be used t o enable po r t securi ty on a port. When using po rt sec urity , th e switch sto ps lear ning new M A[...]

C OMMAND L IN E I NTE RFA CE 4-104 port se curity This comma nd enables or co nfigures po r t securi ty . Us e the no for m with out any k eyword s to disa ble port securi ty . Use the no for m with the approp riate ke yword to restor e the default settings f or a respon se to securit y violatio n or for the ma ximum number of allowed addresse s . [...]

A UTHE NTI CAT ION C OMMANDS 4-105 Command Usage • If you ena ble port security, t he switch st ops lear ning ne w MA C addr esses on the s pecified port when i t has reached a configured maxim um numbe r. Only incom ing traffic wit h source add resses already stored in the dynamic or static address table will be accepted. • F irst use the port[...]

C OMMAND L IN E I NTE RFA CE 4-106 802.1X Port Au thentication The switch suppor ts IEEE 802.1X (dot1x) port -based access co n trol that prev ents unautho rized access to the netw ork by requiring users to first submit credentials for authenti cation. Cli ent authenti cation is co ntrolled central ly by a RADI US ser ver u sing EAP (Ex t ens ible [...]

A UTHE NTI CAT ION C OMMANDS 4-107 dot1x s ystem-auth- control This command enables 802.1X port authentication globally o n the switch . Use the no for m to rest o re the default. Syntax [ no ] system-auth-control Default Setting Disabled Command Mode Global Configuratio n Example dot1x defaul t This command s ets all c onfigurab le dot1x glo bal a[...]

C OMMAND L IN E I NTE RFA CE 4-108 Default 2 Command Mode Interf ace Configuratio n Example dot1 x port-c ontr ol This c ommand sets th e dot1x mode on a por t interface. Use the no fo rm to restore th e default . Syntax dot1x por t-control { auto | force-authorized | force-unauthorized } no dot1x por t-control • auto – Require s a dot1x-aw are[...]

A UTHE NTI CAT ION C OMMANDS 4-109 dot1x oper ation-mode This c ommand allows single or multiple host s (clients) t o connect to an 802.1X-authorized port. Us e the no form with no k eyword s to restore the default to single host. Us e the no for m with th e multi-host max-count ke ywords t o restore the d efault maxim um count. Syntax dot1x operat[...]

C OMMAND L IN E I NTE RFA CE 4-110 dot1x re-aut hentic ate This comm and forces re-authentication on all ports or a sp ecific interface. Syntax dot1x re-authenticate [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Po rt numb er. (Ra nge: 1 -26) Command Mode Pr[...]

A UTHE NTI CAT ION C OMMANDS 4-111 dot1x t imeout quiet-perio d This co mmand sets th e time that a switch por t waits after the Max Request Count h as been ex ceeded be fore attempti ng to acquire a new client. Us e the no for m to reset the d efault. Syntax dot1x timeout quiet-period seconds no dot1x timeout quiet-period second s - The number of [...]

C OMMAND L IN E I NTE RFA CE 4-112 Example dot1x t imeout tx-period This c ommand sets the time that an interf ace on the switch wa its during an authen tication ses sion before re-transmitting an EAP packet. Use the no form to rese t to the default value . Syntax dot1x timeout tx-period se conds no dot1x timeout tx-period second s - The number of [...]

A UTHE NTI CAT ION C OMMANDS 4-113 Command Mode Pri vileged Exec Command Usage This c ommand displays the followin g infor mation: • Global 802.1X Parameters – Shows whether or not 802.1X port authenticatio n is globally enabled on the switch . • 802.1X Po rt Summary – Di splays the po rt access contro l para meters for each interf ace, inc[...]

C OMMAND L IN E I NTE RFA CE 4-114 - Max Count – The maximum number of hosts allowed to access this port ( page 4-109). - Port-contr ol – Shows the do t1x mode on a por t as a uto , force-aut horized, or for ce-unauthorized (page 4-10 8). - Su p plicant – MAC address of authorized client . - Curren t Identifier– The integer (0-255) used by [...]

A UTHE NTI CAT ION C OMMANDS 4-115 Example Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status Operation Mode Mode Authorized 1/1 disabled Single-Host ForceAuthorized n/a 1/2 enabled Single-Host auto yes . . . 1/26 disabled Single-Host ForceAuthorized n/a 802.1X Port Details 802.1X is disable[...]

C OMMAND L IN E I NTE RFA CE 4-116 Access Co ntrol List Comm ands Access Control Lis t s ( ACL) provide pac ket fi ltering for I P frames (bas ed on add ress , protoc ol, Layer 4 prot ocol por t number or TCP cont rol code) or any fra m es (b ased on MA C a ddress or Ethernet type) . To filter packets, first cr eate an acces s lis t, add the re qui[...]

A CCES S C ONTROL L IST C OMMANDS 4-117 • This switch s upports ACLs for ingress filt ering only. You can o nly bind one IP ACL to any port and o ne MAC ACL glob ally for ing ress filteri ng. In othe r words, o n ly two ACLs ca n be bound to an inte rface - Ingres s IP ACL and Ingress MAC A CL. The order in wh ich ac t iv e ACLs ar e chec ked is [...]

C OMMAND L IN E I NTE RFA CE 4-118 access-list i p This command adds an IP access list and en t ers configuration mode for stand ard or extende d IP A CLs . Use the no for m to remove the specified AC L . Syntax [ no ] access-lis t i p { st andard | extended } acl_name • standard – Specifies an AC L that filter s packets base d on the source IP[...]

A CCES S C ONTROL L IST C OMMANDS 4-119 Command Usage • When you create a n ew ACL or enter co nfiguratio n mode for an existin g ACL, use th e permit or deny command to add new rules to the bott om of the list. To create a n ACL, you mu st add at l east one rule to the list. • To remove a rule, use the no permit or no deny c ommand followed by[...]

C OMMAND L IN E I NTE RFA CE 4-120 Command Usage • New rules are a ppended to the end of the list. • Address bi tmasks are si milar to a su bnet mask, c ontaining f our integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “m atch” and 0 bit s to indicat e “ignore.” The bitma sk is bitwise AN Ded wi[...]

A CCES S C ONTROL L IST C OMMANDS 4-121 [ precedence pr eceden ce ] [ tos tos ] [ dscp dscp ] [ source-port sp or t [ end ]] [ desti nati on-por t dport [ end ]] [ control-flag control-fla gs fl ag-bit mask ] • prot ocol-num ber – A specific protocol number. (Range: 0-255) • sourc e – Source IP address. • destination – D estination IP a[...]

C OMMAND L IN E I NTE RFA CE 4-122 • Th e control-code b itmask is a deci mal number (rep resenting an equivale nt bit mask ) that is appl ied to the cont rol code. En ter a decim al number, w here the equival ent binary b it “1” means to match a bit and “0” mea ns to ignore a bit. The followin g bits may be specifi ed: 1 (fin ) – Fin i[...]

A CCES S C ONTROL L IST C OMMANDS 4-123 Related Commands access-list ip (4-118) show ip access-list This comm and displays the rules for configured IP A CL s . Syntax show i p access-list { standard | extended } [ acl_n ame ] • standard – Specifies a standard IP ACL. • extended – Specifies an extended IP ACL. • acl_name – Name of the AC[...]

C OMMAND L IN E I NTE RFA CE 4-124 Command Mode Interf ace Configur ation (Eth ernet) Command Usage • A port can only be bo und to one A CL. • If a port is already b ound to an ACL and you bind it to a d ifferent ACL, the switc h will replace the old binding wit h the new one. • Y ou must conf igure a mask f or an ACL rul e before you can bin[...]

A CCES S C ONTROL L IST C OMMANDS 4-125 map access-list ip This comma nd sets the output queue for pack ets matc hing an A CL rule. The specifie d CoS val ue is only used to map the matc hing pac ket to an output qu eue; it is no t written to the pac ket itself . Use t he no for m to remov e the CoS mapp ing . Syntax [ no ] map access-list ip acl_ [...]

C OMMAND L IN E I NTE RFA CE 4-126 show map access-list ip This comma nd shows the CoS v alue mapped t o an IP A CL for t he cur rent inte rface. (The CoS v alue det er mines the o utput queue for packet s matching an A CL r ule.) Syntax show m ap access-list ip [ interfac e ] interface • ethernet unit / port - unit - Sta ck un it. (Range – SMC[...]

A CCES S C ONTROL L IST C OMMANDS 4-127 MAC ACLs access-list mac This command adds a MA C access list and enters MA C ACL configuration mode. Use the no form to remov e the specified A CL. Syntax [ no ] access-list m ac acl_ name acl_ name – Name of the A CL. (Maximum length: 16 c haracters) Default Setting None Command Mode Global Configuratio n[...]

C OMMAND L IN E I NTE RFA CE 4-128 Command Usage • When you create a n ew ACL or enter co nfiguratio n mode for an existin g ACL, use th e permit or deny command to add new rules to the bott om of the list. To create a n ACL, you mu st add at l east one rule to the list. • To remove a rule, use the no permit or no deny c ommand followed by the [...]

A CCES S C ONTROL L IST C OMMANDS 4-129 • address- bitmask 16 – Bitma s k for M AC address (in hexidecimal format). • vid – VLAN ID. (Range: 1-4094) • vid-end – Upper bound of VID range. (Range: 1-4094) • prot ocol – A specific Ethernet protocol number. (Range: 0-65535) • prot ocol-end – Upper bound of protocol range. (Range: 0-[...]

C OMMAND L IN E I NTE RFA CE 4-130 show mac access-list This comm and displays the rules for configured MA C A CLs . Syntax show mac access-lis t [ acl_name ] acl_nam e – Name of the A CL . (Maximu m length: 16 c haracters) Command Mode Pri vileged Exec Example Related Commands per mit, deny 4-128 mac access-group (4-130) mac access-group Th is c[...]

A CCES S C ONTROL L IST C OMMANDS 4-131 Command Usage • A port can only be bo und to one A CL. • If a port is already b ound to an ACL and you bind it to a d ifferent ACL, the switc h will replace the old binding wit h the new one. Example Related Commands show mac access-list (4-130) show mac access-group This co mmand show s the ports assigne[...]

C OMMAND L IN E I NTE RFA CE 4-132 Default Setting None Command Mode Interf ace Configur ation (Eth ernet) Command Usage • Y ou must configure an ACL mask be fore you can map CoS values to the rul e. • A packet matching a rule within the specified ACL is mapped to one of the output queu es as show n below. Example Related Commands queue cos-map[...]

A CCES S C ONTROL L IST C OMMANDS 4-133 Command Mode Pri vileged Exec Example Related Commands map access-list mac (4-131) ACL Infor mation show access-list This command shows all ACLs and associated rules, as well as all the user -defined masks . Command Mode Pri vileged Exec Command Usage Once th e A CL is bound to a n interfa ce (i.e., the A C L[...]

C OMMAND L IN E I NTE RFA CE 4-134 Example show access-group Th is command shows the po rt as signment s of A CLs. Command Mode Pri vileged Execut ive Example Console#show access-list IP standard access-list david: permit host 10.1.1.21 permit 168.92.0.0 255.255.15.0 IP extended access-list bob: permit 10.7.1.1 255.255.255.0 any permit 192.168.1.0 [...]

SNMP C OMMANDS 4-135 SNMP Commands Controls access to this switch from manage ment stations using t he Simple Netw ork Managem ent Protoc ol (SNMP), as well as the error t ypes sent to trap manag ers. snmp-serv er community This comma n d defi nes the comm unity access string for t he Simple Network Man ageme nt Prot ocol. Us e the no form to remov[...]

C OMMAND L IN E I NTE RFA CE 4-136 • rw - Speci fies read/wr ite access. Au thorized m anag ement station s are able to both retrieve and modify MIB objects. Default Setting • public - Read-only access. Authorized managemen t stations are only able to retrieve MIB ob jects. • privat e - R ead/ w rite acces s . Authoriz ed management stations [...]

SNMP C OMMANDS 4-137 Example Related Commands snmp-server locatio n (4-137) snmp-serve r location This comman d sets the system locat ion string . Use the no f o r m to r e move the lo cation string. Syntax snmp-ser v er location text no snmp-ser ver location text - String that desc ribes the syste m location. (Maximu m length : 255 char acters) De[...]

C OMMAND L IN E I NTE RFA CE 4-138 snmp-serv er host This co mmand specif ies the rec ipient of a Simple Ne twor k Management Protoc ol notificat ion operat ion. Use the no for m to remov e the specified host. Syntax snmp-server host host -addr community-string [ ve r s i on { 1 | 2c }] no snmp-ser ver host host- addr • host-addr - Internet ad dr[...]

SNMP C OMMANDS 4-139 enable traps co mmand and t h e snm p-server host comma n d for that host mus t be enable d. • Some notif ication ty pes cann ot be contr olled with t he sn mp-s erve r enable traps command . For exam ple, some notific ation types a re always enabled. • The switch can send SNMP version 1 or version 2c notifications to a hos[...]

C OMMAND L IN E I NTE RFA CE 4-140 Command Usage • If you do no t enter an sn mp-s erv er e nabl e t raps command, no noti fications controlle d by this c ommand are se nt. In or der to confi g ur e this device to send SNMP no tifications , you must enter at least one snmp-server enable traps comma nd. If you en ter the comma nd with no keywords,[...]

SNMP C OMMANDS 4-141 Example Console#show snmp SNMP traps: Authentication: enabled Link-up-down: enabled SNMP communities: 1. private, and the privilege is read- write 2. public, and the privilege is read-o nly 0 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name 0 Illegal operation for community nam e supplied 0 Encoding errors [...]

C OMMAND L IN E I NTE RFA CE 4-142 Interface Commands These comman ds are used to displa y or set comm unication parameters fo r an Ethernet port, a g g regated link, or VLA N . Table 4-40 Interface Commands Command Func tion Mode Pag e interface Configu res an interfa ce type a nd enters interf ace configurat ion mode GC 4-143 descriptio n Adds a [...]

I NTERFACE C OMMANDS 4-143 interface This comma nd configures an interface ty pe and ente r interface config uration m ode. Use the no for m to remov e a tr unk. Syntax interf ace interface no interface port-channel ch annel -id interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1[...]

C OMMAND L IN E I NTE RFA CE 4-144 Default Setting None Command Mode Interf ace Configur ation (Eth er net, P ort Chann el) Example The follo wing example adds a descrip tion to port 24. speed-duplex This command co nfigures the s peed and duplex mod e of a giv en interfa ce when a utonegotiati on is dis abled. Us e the no for m to restore the d ef[...]

I NTERFACE C OMMANDS 4-145 Command Usage • To force operat ion to the s peed and dupl ex mode specifi ed in a speed-duplex co mmand, use the no negotiati o n command to disabl e auto-negotia tion on the selected inte rface. • When usi ng the negot iation command to enable au to-neg otiation , the optimal se ttings will be d etermined by the cap[...]

C OMMAND L IN E I NTE RFA CE 4-146 auto-negotiation is dis abled, you must manually specify the link attribu tes with the speed- duplex and fl owcontrol command s. • I f autoneg otiation is disabled, au to-MDI/MDI -X pin sig nal configuration wi ll also be disabled for the RJ-45 ports. Example The follo wing example confi gures port 1 1 to use au[...]

I NTERFACE C OMMANDS 4-147 Default Setting • 10 0BASE-TX: 10half, 10full, 100half, 100full • 10 00BASE-T: 10half, 10full, 100half, 100full, 1000full • SFP: 1000full Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usage When a uto-negotia tion i s enabled with t he negotiation command , the switch will neg otiate t[...]

C OMMAND L IN E I NTE RFA CE 4-148 Command Mode Interf ace Configur ation (Eth er net, P ort Chann el) Command Usage • Flo w control can eliminate frame loss by “blo cking” traffic from end stat ions or segmen ts conn ected di rectl y to th e switch when it s buffe rs fill. When enabled, back pressure is use d for half -duplex ope ration and [...]

I NTERFACE C OMMANDS 4-149 Default Setting All interfaces are enabled. Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usage Th is command allows you to dis able a por t due to abnor m al behavio r (e.g ., excessiv e collisions), and the n reenable it after the problem has been res o lv ed. Y ou may also want to disab l[...]

C OMMAND L IN E I NTE RFA CE 4-150 • This comman d can enable or disable broadcast s torm control for the selected i nterface. However, the specifie d threshold value applies to all po rts on the s witch. Example The following shows ho w to configure b roadcast storm control at 600 packets pe r secon d: clear counters This comma n d cl ears stati[...]

I NTERFACE C OMMANDS 4-151 Example The follo wing example clears statis tics on port 5. show i nterfaces status This comm and displays the status for an interface. Syntax show i nte rfaces status [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port n[...]

C OMMAND L IN E I NTE RFA CE 4-152 Example show interfaces counters This comm and displays interface statistics . Syntax show interfaces counters [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number. (Range: 1-26/50) • port-channel chann el-[...]

I NTERFACE C OMMANDS 4-153 Command Mode Nor mal Exec , Privileg ed Exec Command Usage If no interface is specified, infor matio n on all interfaces is dis played. F or a descrip tion of the item s display ed by this co m mand, see “Showing P or t Statistics” on pag e 3-115. Example Console#show interfaces counters ethernet 1/7 Ethernet 1/7 Ifta[...]

C OMMAND L IN E I NTE RFA CE 4-154 show i nterfaces switch port This comm and displays the administrative and operational status of the specified in terfaces . Syntax show interfaces s wi tchport [ in terface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port [...]

I NTERFACE C OMMANDS 4-155 Table 4-41 Interfaces Switchport Statistics Field Description Broadcast thre shold Shows if broadc ast stor m sup pression is enabled or dis abled; if enabled it als o shows the threshold level (page 4-149). Lacp status Shows if Li nk Aggregation Cont rol Protocol has been enable d or disabled (pag e 4-164). Ingress/Egres[...]

C OMMAND L IN E I NTE RFA CE 4-156 Mirror Port Commands Th is section d escribe s how to mir ror traf fic from a source port to a targ et por t. port monitor This command con figures a mir ror ses sion. Use the no form to clear a mir ror sess ion. Syntax por t monitor interface [ rx | tx ] no por t monitor interface • interface - ethernet unit / [...]

M IR R OR P ORT C OMMANDS 4-157 • T he dest ination p ort is se t by specif ying an Ethern et interf ace. • T he mirror port and mo nitor port speeds should mat ch, othe rwise traff ic may be dr opped from the monito r port. • Y ou can only create a s ingle mirror se ssion. Example Th e foll owing exam ple co nfigur es the s witch to m ir ror[...]

C OMMAND L IN E I NTE RFA CE 4-158 Example The foll owing shows mirrorin g configured from port 6 to por t 11: Rate Limit Commands This f unction allows t he network manag er to cont rol the maximum r ate for traffic transmitted or receiv e d on an interface . Rate limiting is config ured on inter faces at the edge of a network to limit t raffic in[...]

R ATE L IMIT C OMMANDS 4-159 rate-limit Use this command to de fine the rate li mit lev el for a specific int erface . Use this comm and withou t specifyin g a rate to rest ore the defau lt rate limit level. Use the no for m to r estore t he defa ult stat us of di sabled. Syntax rate-lim it { input | output } level [ rate ] no rate-limit { input | [...]

C OMMAND L IN E I NTE RFA CE 4-160 rate-limit granularit y Use this co m man d to define the rate lim it g ranu larity for the F ast Ethernet por ts , and the Gig abit E ther net por ts . Us e the no for m of this co m mand to rest ore t he defau lt setting. Syntax rate-limit { fastether net | giga bitether net } g ran ularity [ granula rity ] no r[...]

L INK A GG RE G A T I O N C OMMANDS 4-161 show rate-limit Use this command to displ ay the rate limit granularity . Default Setting F ast Ethernet inter face – 3.3 Mbps Gig abit Ether ne t inte rface – 33.3 Mbps Command Mode Pri vileged Exec Command Usage • Fo r Fast Ethernet interfaces, the rate limit granularity is 8 Kbps, 64 Kbps, 51 2 Kbp[...]

C OMMAND L IN E I NTE RFA CE 4-162 Guidelines for Creating Trunks General Guidelines – • Finish conf iguring po rt trunks before you connect the corresp onding network c ables bet ween switch es to avoi d creating a loop. • A trunk can have up to eight ports. • T he port s at both ends of a connec tion mus t be config ured as trunk ports. ?[...]

L INK A GG RE G A T I O N C OMMANDS 4-163 • A ll the ports in a trunk have to b e treated as a whole w hen moved from /to, ad ded or de leted fr om a VLA N via the specif ied port- channel. • STP, VL AN, and IGM P setting s can only b e made for th e entire tr unk via the sp ecified port-chann el. Dynami cally Cre ating a Por t Channe l – P o[...]

C OMMAND L IN E I NTE RFA CE 4-164 Command Usage • Wh en configuring static t runks, the switches must comply with the Cis co Ethe rChann el stand ard. •U s e no channel-group to remove a po rt group from a trunk . •U s e no interfaces port-channel to remove a tr unk from the switch. Example The follo wing example creates trunk 1 and then add[...]

L INK A GG RE G A T I O N C OMMANDS 4-165 Example Th e following shows LA C P enab led on por ts 1 1-13. Bec ause LACP has also bee n enabled on the ports at the o ther end of the links , the show interfaces status por t-channel 1 command shows that T r unk 1 has b een established. Console(config)#interface ethernet 1/11 Console(config-if)#lacp Con[...]

C OMMAND L IN E I NTE RFA CE 4-166 lacp system-priority This comman d configures a port's LA CP syste m priority . Use the no for m to rest ore t he defau lt setting. Syntax lacp { actor | partner } system-priority priority no lacp { actor | par tner } system-priori ty • actor - The local side an aggregate link . • partner - The remote sid[...]

L INK A GG RE G A T I O N C OMMANDS 4-167 lacp admin-key (Ethernet In terface) Th is command configure s a por t's LA C P administ ration key . U se the no for m to res tore the defau lt setting . Syntax lacp { actor | partner } admin-key ke y [ no ] lacp { acto r | par tner } admin-key • actor - The local side an aggregate li nk. • partne[...]

C OMMAND L IN E I NTE RFA CE 4-168 lacp admin-key (Port Channel) This command configures a port c hannel's LA CP admi nistration k ey stri ng . Use the no for m t o restore th e default s etting . Syntax lacp { actor | partner } admin-key ke y [ no ] lacp { acto r | par tner } admin-key key - The por t ch ann el admin k ey is used to identify [...]

L INK A GG RE G A T I O N C OMMANDS 4-169 lacp port-priority This command c onfigures LA CP port priority . Use the no for m t o res to re the de fault settin g . Syntax lacp { actor | partner } por t-priority priority no lacp { actor | par tner } por t-priority • actor - The local side an aggregate li nk. • partner - The remote s i de of an ag[...]

C OMMAND L IN E I NTE RFA CE 4-170 show l acp This c ommand displays LA CP infor mation. Syntax show lacp [ port-channel ] { counters | inter nal | neighbors | sysid } • port-channe l - Local identifier for a link aggregation group. (Range: 1-4) • counters - Sta tistics for LAC P protocol me ssages. • inter nal - Configu ration sett ings an d[...]

L INK A GG RE G A T I O N C OMMANDS 4-171 Example Console#show lacp 1 counters Port channel: 1 ----------------------------------------- -------------------------- Eth 1/ 1 ----------------------------------------- -------------------------- LACPDUs Sent : 21 LACPDUs Received : 21 Marker Sent : 0 Marker Received : 0 LACPDUs Unknown Pkts : 0 LACPDUs[...]

C OMMAND L IN E I NTE RFA CE 4-172 Console#show lacp 1 internal Port channel : 1 ----------------------------------------- -------------------------- Oper Key : 4 Admin Key : 0 Eth 1/1 ----------------------------------------- -------------------------- LACPDUs Internal : 30 sec LACP System Priority : 32768 LACP Port Priority : 32768 Admin Key : 4 [...]

L INK A GG RE G A T I O N C OMMANDS 4-173 Adm in Sta te, Oper S tate Administrat ive or operational valu es of the actor’s state parameters: • Expired – The actor’s receiv e machine is in the expired state ; • Defaulted – The actor’s receive mac hine is using defaulted operationa l partner information, administrative ly configured for[...]

C OMMAND L IN E I NTE RFA CE 4-174 Console#show lacp 1 neighbors Port channel 1 neighbors ----------------------------------------- -------------------------- Eth 1/1 ----------------------------------------- -------------------------- Partner Admin System ID : 32768, 00-00- 00-00-00-00 Partner Oper System ID : 32768, 00-00-0 0-00-00-01 Partner Adm[...]

A DDRESS T ABL E C OMMANDS 4-175 Addre ss Tabl e Comma nds These comma nds are used t o con figure the ad dress table for filtering speci fied addres ses, display ing current entri es, clearing t he table, or setti ng the agin g time. Console#show lacp sysid Port Channel System Priority Syste m MAC Address ----------------------------------------- [...]

C OMMAND L IN E I NTE RFA CE 4-176 mac-add ress-table st atic This c ommand maps a static address to a destination po rt in a V LAN . Use the no for m to remove an address . Syntax mac-address-tabl e static mac-addre ss interface interface vlan vlan-i d [ action ] no mac-address-table sta t ic mac - address vlan vlan-id • mac-address - MAC a ddre[...]

A DDRESS T ABL E C OMMANDS 4-177 • A static addres s cannot be lear ned on another port u ntil the ad dres s is removed with the no form of this command. Example clear mac-address-table dynamic This c ommand remov e s any learne d entries from the forwarding database and cl ears th e tran smit and rece ive counts f or any st atic or syste m confi[...]

C OMMAND L IN E I NTE RFA CE 4-178 • vlan -id - VLAN ID (Range: 1-4094) • sort - Sort by address , vlan or interface. Default Setting None Command Mode Pri vileged Exec Command Usage • The MAC Addres s Table cont ains the MAC ad dresses assoc i ate d with each inter face. Note t hat the Type fiel d may include the following types : - Le arned[...]

A DDRESS T ABL E C OMMANDS 4-179 mac -addres s-tabl e aging -time This co mmand sets the aging time for en tries in the addre ss table. Use the no for m to res tore the de fault aging tim e. Syntax mac-address-tabl e a ging-time seco nds no mac-address-ta ble a ging-time seconds - Aging time. (Range: 10-1000000 seconds; 0 to disable aging) Default [...]

C OMMAND L IN E I NTE RFA CE 4-180 Spanni ng Tree Comma nds This secti on includes co mmands that configure th e Spanning T ree Alg orithm (STA) globally for the switch, and comma nds that config ure ST A for the select ed interface . Table 4-50 Spanning Tree Commands Command Funct ion Mode Pag e spanning-tre e En ables the spanning tree protocol G[...]

S PANNING T REE C OMMANDS 4-181 spanning- tree This comma nd enables t h e Span ning T ree Alg orith m globally for the switch. U se the no fo r m to disable it. Syntax [ no ] spanning-tree Default Setting Spanning tree is enabled. Command Mode Global Configuratio n Command Usage The Spann ing T ree Algorith m (ST A) can be used to detect and disab[...]

C OMMAND L IN E I NTE RFA CE 4-182 spanning- tree mode This comma nd selects th e spanning tree mode for t his switch . Use the no for m to res tore the default. Syntax spanning-tree mode { stp | rst p } no spanning-tree mode • stp - Spanning Tree Protocol (IEEE 802.1D) • rstp - Rap id Spanning Tre e Protocol (IE EE 802.1w) Default Setting rstp[...]

S PANNING T REE C OMMANDS 4-183 spanning-tree for ward-time This comm and configures the spanning tree brid ge forward time globally for this switch. Use the no for m to res tore the defau lt. Syntax spanning-tree for ward -time secon ds no spanning-tree forw ard -time seconds - Time in seconds. (Range: 4 - 30 second s) The mini mum v alue is the h[...]

C OMMAND L IN E I NTE RFA CE 4-184 Default Setting 2 second s Command Mode Global Configuratio n Command Usage Th is command sets the ti me inter v al ( in second s) at which th e root device trans m its a config uration message. Example spanning-tree max-age This comman d configures the spanning t ree bridge maxim um age globall y for this switch.[...]

S PANNING T REE C OMMANDS 4-185 a new root po rt is selec ted from among the devic e port s attached to the network. Example spanning- tree priority This comm and configures the spanning tree priority globally for this switch. U se the no form to restore the d efault. Syntax spanning-tree priority priority no spanning-tree priority priority - Prior[...]

C OMMAND L IN E I NTE RFA CE 4-186 spanning-tree pathcos t method This command configures the path cost metho d used for Rapid Sp anning T ree . Use the no for m to r estore the d efault. Syntax spanning-tree pathcost method { long | short } no spanning-tree pathcost method • lon g - Specifies 32-bit based values that range from 0-200,000,000. ?[...]

S PANNING T REE C OMMANDS 4-187 Default Setting 3 Command Mode Global Configuratio n Command Usage This c ommand limits th e maximum transmission rat e for BPDUs . Example spanning-tree s panning-disabled This comma nd disables the spanni ng tree algorith m for the speci fied interface. Use the no for m to r eenable th e spanni ng tree al gorit hm [...]

C OMMAND L IN E I NTE RFA CE 4-188 spanning-tree cos t This comma n d con figures the sp anning tree p ath cost for t he specified interface. Use the no form to res tore the default. Syntax spanning-tree cost cost no spanning-tree cost cost - The p ath cost for the p or t. (Range: 1-200,000,000)) The recom mended range is : - Ethernet: 200,000-20,0[...]

S PANNING T REE C OMMANDS 4-189 spanning- tree port-priority This command configures the priority for th e specified interfac e. Use th e no for m to res tore the d efault. Syntax spanning-tree por t-priority priority no spanning-tree por t-priority priority - The priority for a port. (Range: 0-240, in ste ps of 16) Default Setting 128 Command Mode[...]

C OMMAND L IN E I NTE RFA CE 4-190 Default Setting Disabled Command Mode Interf ace Configur ation (Eth er net, P ort Chann el) Command Usage • You can enable t his option if an interface is atta ched to a LAN segment t hat is at the en d of a bridge d LAN or to an en d node. Since end node s cannot c ause forwar ding loops, they can p ass direct[...]

S PANNING T REE C OMMANDS 4-191 Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usage • This command is used to enable/ disable the fast sp anning-tree mode for the sele cted port. In this mo de, ports skip the Discarding and Learnin g st ates, and pro ceed straight to Forwarding. • Since end- nodes cannot cause for[...]

C OMMAND L IN E I NTE RFA CE 4-192 Default Setting auto Command Mode Interf ace Configur ation (Eth er net, P ort Chann el) Command Usage • Specify a po int-to-point link if the i nterface can on ly be connect ed to exactly on e other brid ge, or a shared lin k if i t ca n be connected t o two or more brid ges. • When automat ic detecti on is s[...]

S PANNING T REE C OMMANDS 4-193 Command Usage If at any time the switch detects STP BPDUs , in cluding Configuration or T opolog y Change Notific ation BPDUs, it will automatically set th e selected inte rface to forced STP-compatible mo de. How ever, y ou can also use the spanning-tree protocol-mi gration command at any time to manually re -check [...]

C OMMAND L IN E I NTE RFA CE 4-194 • For a desc ription of t he items displ ayed under “S panning-tr ee information,” see “Configuring Global Settings” on page 3-132. For a descripti on of the items displayed for sp ecific interfaces, see “Displaying Interface Settings” on page 3-136. Example Console#show spanning-tree Spanning-tree i[...]

VLAN C OMMANDS 4-195 VLAN Commands A VLAN is a g roup of port s that can be located a nywhere in the network, but co m m unicate as th ough they belo ng to the s ame phys ical segment. This secti on describes commands used to create VLAN g roups , add port members , spe cify how VLA N tagging is use d, and enable aut omatic VLAN reg istration for t[...]

C OMMAND L IN E I NTE RFA CE 4-196 Command Mode Global Configuratio n Command Usage • Use the VLA N database co mmand mode to ad d, change, an d delete VLAN s. After fin ishing co nfigura tion chan ges, you c an display the VLAN se ttings by entering the show vla n comman d. •U s e t h e interface vlan c ommand mod e to define the port membersh[...]

VLAN C OMMANDS 4-197 • state - Keyword to be followed by the VLAN s tate. - active - VLAN is op erational. - suspend - VL AN is suspe nded. Suspen ded VLANs do not pass packets. Default Setting By default only VL AN 1 exists and is ac tiv e. Command Mode VLAN Da tabase Conf iguration Command Usage • no vlan vlan -id dele tes the VL AN. • no v[...]

C OMMAND L IN E I NTE RFA CE 4-198 Configuring V LAN Interfaces interface vlan This comma nd enters inte rface config ura t ion mode for VLANs, whic h is used to configure VLA N par ameters for a physical interface . Syntax interface vlan vlan- id vlan-id - ID of the configure d VLAN . ( Range: 1-4094, no leadin g zero es) Default Setting None Comm[...]

VLAN C OMMANDS 4-199 Example Th e following exa mple shows how to set the in terface configura tion mode to VLAN 1, an d then assign an IP address to the V LAN: Related Commands shutdown (4-148) switc hport m ode This comma nd configures t he VLAN memb ership mode for a p or t. Use the no for m to restore th e default. Syntax swi tc hport m ode { t[...]

C OMMAND L IN E I NTE RFA CE 4-200 Example Th e following shows how to se t the conf iguration mode to p ort 1, and then se t the swit c h por t mode to hybrid: Related Commands switchport acce ptable-frame-types (4-200) switchport accep table-frame-types This comma nd configures t he acceptable fra m e ty pes for a po r t. Use t he no for m to res[...]

VLAN C OMMANDS 4-201 Related Commands switchpor t mode (4-199) switchpor t ingress-filtering This c ommand enables ing ress filt ering for an i nterface. Us e the no for m to restore th e default . Syntax [ no ] sw itchpor t ing ress-filtering Default Setting Disabled Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usag[...]

C OMMAND L IN E I NTE RFA CE 4-202 switc hport na tive vla n This c ommand configu res the PV ID (i.e., default VLA N ID) for a por t. Use the no form to restore the defaul t . Syntax swi tc hport native vlan vlan- id no switchpor t nati ve vlan vlan-id - Default VLAN ID for a por t. (Range: 1-4094, no leading zeroes) Default Setting VLAN 1 Command[...]

VLAN C OMMANDS 4-203 switc hport allow ed vlan This comma n d con figures VLAN g roups on th e selected in terface. Us e the no for m to restore th e default. Syntax swi tc hport allowed vlan { add vl an-l ist [ ta gged | untagged ] | rem ov e vlan-li st } no switchpor t allo wed vlan • add vlan-lis t - List of VLAN ident ifiers to add. • rem o[...]

C OMMAND L IN E I NTE RFA CE 4-204 • If a VLAN on the forbidd en list fo r an int erface is m anually added to that inte rface, the VLA N is automat ically removed fro m the forbidden list for that int erface. Example The following example shows ho w to add VLANs 1, 2, 5 and 6 to the allowed list as tagg ed VLANs for po rt 1: switc hport f orbidd[...]

VLAN C OMMANDS 4-205 Example Th e following example shows how to preve nt por t 1 from be ing add ed to VLAN 3: Displaying VLAN Information show vlan This command s hows VLAN infor mation. Syntax show v lan [ id vl an-id | name vlan- name | pr ivate-vlan p ri v ate-vlan-type ] • id - Keyw ord to be f ollowed by the VLAN ID. - vlan -id - ID o f th[...]

C OMMAND L IN E I NTE RFA CE 4-206 Command Mode Nor mal Exec , Privileg ed Exec Example Th e following example shows how to dis play infor ma tion fo r VLAN 1 : Configuring P rivate VLANs Pri vate VLAN s provide por t-ba sed security and isolation between por ts within the a ssigned VLAN. This switch suppor ts two types of private VLANs: p rimar y/[...]

VLAN C OMMANDS 4-207 This sect ion descri bes command s used to con figure pri vate VLANs . T o configure primary/secondary associated g roups , follo w these steps : 1. Use the pri vate-vlan com mand to des ignate one or more commu nity VLANs and the primary VL AN that will channel traffic outside o f the comm unity groups . 2. Use the pri vate-vl[...]

C OMMAND L IN E I NTE RFA CE 4-208 5. Use the s wi tchpor t pri vate-vlan mapping command to assi gn a por t to a primar y VL AN . 6. Use the sho w vlan priv ate-vlan command to v eri fy yo ur config uration set tings . T o configure isolated VLA Ns, fo llow thes e steps: 1. Use the pri vate-vlan comma n d to de signate an isolated V LAN that will [...]

VLAN C OMMANDS 4-209 Default Setting None Command Mode VLAN Config uration Command Usage • Pr ivate VLAN s are used t o restric t traffic to ports within the sam e communi ty or isol ated VLAN, an d channel tr affic passing outside th e communit y through promiscu ous ports. Wh en using co mmunity VLANs, they must b e mapped to an asso ciated “[...]

C OMMAND L IN E I NTE RFA CE 4-210 private vla n associatio n Use th i s co mmand to ass ociate a prima r y VLAN wi th a secondary (i.e ., comm unity) VLAN . Use the no for m to remove all association s for the specified p rimary VLAN . Syntax pri vate-vlan primar y-vlan-i d association { secondary-vlan-id | add secondary-vlan-id | remo ve secondar[...]

VLAN C OMMANDS 4-211 switc hport mode p rivate- vlan Use this co mmand to set the p riva te VLAN mode for an inte rface. Use the no for m to res tore the d efault set ting . Syntax swi tc hport mode priv ate-vlan { host | promiscuous } no switchpor t mode pri vate-vlan • host – This port t ype can subsequ ently be assigne d to a c ommunity or i[...]

C OMMAND L IN E I NTE RFA CE 4-212 switchport p rivate-vlan host-association Use this co mmand to ass ociate an interfac e with a second ar y VLAN . Use the no for m to remove this ass ociation. Syntax swi tc hport priv ate-vlan host-association secondar y-vlan-id no switchpor t pri vate-vlan host-association secon dar y-vlan-id - ID of secon dar y[...]

VLAN C OMMANDS 4-213 Default Setting None Command Mode Inter face Confi guration (E thern et, P or t Chan nel) Command Usage Host po r ts ass igned to a is olated VLAN cannot pass tr affic betwee n group members , and m ust comm unicate with res ources outsi de of the group via a pro miscuous port. Example switc hport pr ivat e-vlan mappi ng Use th[...]

C OMMAND L IN E I NTE RFA CE 4-214 Example show vlan priv ate- vlan Use th i s co mmand to s how the p riva te VLAN c onfigurati on settings on this switch. Syntax show vlan pr ivate-vlan [ community | isolated | primar y ] • community – Disp lays all communi ty VLANs, along with their associated primary VLAN and assigned ho st interfaces. • [...]

GVRP AND B RIDGE E XTENSION C OMMANDS 4-215 GVRP and Bridg e Extens ion Com mands GARP VLA N Registration P rotocol d efines a way for swit ches to exc hang e VLAN infor mation in orde r t o autom aticall y regis ter VLAN members on interface s across t he netw ork. This secti on describes how to enable GVRP for individual interfaces and globally f[...]

C OMMAND L IN E I NTE RFA CE 4-216 Command Mode Global Configuratio n Command Usage GVRP defines a way for switches to exchange VLAN infor mation in order to register VL AN member s on por ts acro ss the net w o rk. This function sh ould be enab led to per mit automatic VLA N registratio n, and to suppor t VLANs w hich exten d beyond the local swit[...]

GVRP AND B RIDGE E XTENSION C OMMANDS 4-217 switchp ort gvrp This command enables GVRP for a por t. Use th e no for m to disable it. Syntax [ no ] s w it c h p o rt g v rp Default Setting Disabled Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Example show gv rp configura tion This comm and shows if GVRP is enabled. Syntax sho[...]

C OMMAND L IN E I NTE RFA CE 4-218 Example garp t imer This comm and sets the values for the join, leave and leav eall tim ers . Use the no for m to resto re the timers’ d efault values . Syntax gar p timer { join | leave | leavea ll } time r_v a lue no gar p timer { join | lea ve | leav eall } •{ join | leave | le avea ll } - Whi ch timer to s[...]

GVRP AND B RIDGE E XTENSION C OMMANDS 4-219 • Timer values m ust meet the fo llowing rest rictions: - leave >= (2 x join) - leaveall > leave Note: Set GVRP timers on all Layer 2 devices connect ed in the same network to the same valu es. Otherwise , GVRP may not o perate success fully. Example Related Commands show gar p timer (4-219) show [...]

C OMMAND L IN E I NTE RFA CE 4-220 Example Related Commands garp timer (4-218) Priority Commands The com mands described in this se ction allow you to specify which data pack ets hav e g reat er precedence wh en traffic is buffer ed in the swi t c h due to con g esti on. This switc h supports C oS with four p riority queu es for eac h port. Data pa[...]

P RIORITY C OMMANDS 4-221 queue mode This c ommand sets th e queue mode to strict priori ty or W eighte d R ound-R obin (WRR) for the class of ser vice (CoS) prio rity queues . Use the no for m to res tore the d efault value. Syntax queue mode { strict | wrr } no queue mode • strict - Services the egress queues in sequential order, transmitting a[...]

C OMMAND L IN E I NTE RFA CE 4-222 Command Usage Y ou can set t he switch t o ser vice the qu eues based o n a strict rule that requires all t raffic in a higher prio rity queue to be proc essed before lo wer priorit y queues are se r v ic ed, or use W eighted Round-R obin ( W R R ) q u e u i n g t h a t s p e c i f i e s a r e l a t i v e w e i g [...]

P RIORITY C OMMANDS 4-223 frames). This priority does not apply to IEEE 802. 1Q VLAN tagged frames. If the incoming frame is an IEEE 802 .1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used. • T his switch provide s eight prio rity que ues for eac h port. It is conf igured to use We ighted Round Robin, which ca n be vi ewed w it[...]

C OMMAND L IN E I NTE RFA CE 4-224 Command Usage WRR con trols bandw idth sharing at the egress port by defining schedul ing weights. Example This exampl e shows ho w to assign WRR weights to priority queues 1 - 3: Related Commands sho w queue bandw i dt h (4-226) queue cos-map This c ommand assign s class of se r vice (CoS ) v a lues to the prio r[...]

P RIORITY C OMMANDS 4-225 Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usage • CoS values assig ned at the ingre ss port are also used at the egress port. • T his command sets the CoS prio rity for all interfaces. Example The follow ing example sho ws how to map CoS v alues 0, 1 and 2 to egress queue 0, v alue 3 [...]

C OMMAND L IN E I NTE RFA CE 4-226 show queue ban dwidth This comma n d di splays the weighted r ound-robin ( WRR) bandwidth allocatio n for the four prio rity queues. Default Setting None Command Mode Pri vileged Exec Example show queue cos-map This com m a nd shows the class of ser vice p riority map . Syntax show queue cos-map [ interface ] inte[...]

P RIORITY C OMMANDS 4-227 Example Priority Commands (Layer 3 and 4) Console#show queue cos-map ethernet 1/1 Information of Eth 1/1 CoS Value : 0 1 2 3 4 5 6 7 Priority Queue: 0 0 0 1 2 2 3 3 Console# Table 4-60 Priority Commands (Layer 3 and 4) Command Function Mode Page map ip port Enables TC P class of service mapp ing GC 4-228 map ip port Maps T[...]

C OMMAND L IN E I NTE RFA CE 4-228 map ip port (Glob a l Configuration) This comman d enables IP port mapp ing (i.e., class of ser vice mapping fo r TCP/UDP so ckets). Us e the no fo rm t o d is a bl e I P p ort m ap pi ng . Syntax [ no ] m ap ip por t Default Setting Disabled Command Mode Global Configuratio n Command Usage Th e prec eden ce fo r [...]

P RIORITY C OMMANDS 4-229 Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usage • The precedence fo r priority map ping is IP Port, IP Prece dence or IP DSCP , and defa ult swit chport priorit y. • T his command sets the IP p ort priority for all interfaces. Example The follo wing exampl e shows h ow to map H TTP tr[...]

C OMMAND L IN E I NTE RFA CE 4-230 map ip pre cedence (Interface Configuration) This command sets IP precedence prior it y (i.e ., IP T ype of Ser vice prio rity). Use the no form to res tore the default table . Syntax map ip precedence ip-pr ecedence-value cos cos-value no map ip precedence • preced ence-v alue - 3-bit precedence value. (Range: [...]

P RIORITY C OMMANDS 4-231 map ip dscp (Globa l Configuration) This comm and enables IP DSCP mapping (i.e., Differentiated Ser vices Code Point mapping). Us e the no for m to disable IP DSCP mapping . Syntax [ no ] map ip dscp Default Setting Disabled Command Mode Global Configuratio n Command Usage • The precedence fo r priority map ping is IP Po[...]

C OMMAND L IN E I NTE RFA CE 4-232 Default Setting The D SCP default values are defi ned in the fo llowing table. Note tha t all the DSCP values that are not speci fied are mapped to CoS valu e 0. Command Mode Interf ace Configur ation (Eth er net, P ort Chann el) Command Usage • The precedence fo r priority map ping is IP Port, IP Prece dence or[...]

P RIORITY C OMMANDS 4-233 show map ip port Use this command to s how the I P port priority ma p. Syntax show map ip port [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number. (Range: 1-26/50) • port-channel chann el-id (Range: 1-4) Default S[...]

C OMMAND L IN E I NTE RFA CE 4-234 show map ip precedence This comma nd shows the IP prece dence priori ty map . Syntax show map ip precedence [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number. (Range: 1-26/50) • port-channel chann el-id [...]

P RIORITY C OMMANDS 4-235 show map ip dscp This comm and shows the IP DSCP priority map . Syntax show map ip dscp [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number. (Range: 1-26/50) • port-channel chann el-id (Range: 1-4) Default Setting [...]

C OMMAND L IN E I NTE RFA CE 4-236 Mult icast F ilte ring Co mmand s Th is switch uses IGMP (In tern et Group Ma nage ment Prot ocol) to qu er y for any a ttached ho sts that w ant to recei ve a spec ific multi cast ser vice . It ident ifies the po r ts cont aining host s requestin g a se r vice and sends data out to those ports onl y . I t then pr[...]

M ULTICAST F ILTERING C OMMANDS 4-237 ip igmp snooping This c ommand enables IG MP snoopin g on this switch. Use the no for m to dis able it. Syntax [ no ] ip igmp snooping Default Setting Enabl ed Command Mode Global Configuratio n Example The follo wing exam ple enables I GMP snooping . ip igmp sno oping vlan static This comm and adds a port to a[...]

C OMMAND L IN E I NTE RFA CE 4-238 Command Mode Global Configuratio n Example The following shows how to statically configure a multicast g roup on a por t: ip igmp snooping ve rsion This comma nd configures t he IGMP snoop ing vers ion. Use the no for m to restore th e default . Syntax ip igm p snooping version { 1 | 2 } no ip igmp snooping versio[...]

M ULTICAST F ILTERING C OMMANDS 4-239 show ip ig m p snoopi ng Th is command shows the IG MP snoopin g config uration. Default Setting None Command Mode Pri vileged Exec Command Usage See “Conf iguring IGMP Snooping and Q uer y P arameters ” on pag e 3-185 for a d escript ion of th e display ed items. Example Th e following shows the cur rent I[...]

C OMMAND L IN E I NTE RFA CE 4-240 Command Mode Pri vileged Exec Command Usage Membe r types d isplayed include I GMP or USE R, depending on select ed o ptions. Example The following shows the multicast entries lear ned throug h IGMP snoopin g for VLAN 1: IGMP Query Co mmands (Layer 2) Console#show mac-address-table multicast vlan 1 igmp-snooping V[...]

M ULTICAST F ILTERING C OMMANDS 4-241 ip igmp snooping qu erier This command enables the switch as an IGMP querier . Use the no for m to disa ble it. Syntax [ no ] ip igmp snooping querier Default Setting Enabl ed Command Mode Global Configuratio n Command Usa ge If enabled, the switch will ser ve as querier if electe d. The querier is respon sible[...]

C OMMAND L IN E I NTE RFA CE 4-242 Command Usage Th e quer y co unt def ines how long the quer ier waits fo r a respon se from a multicast clie nt befo re takin g action . If a qu erier ha s sent a nu mber of queri es define d by thi s command, but a clie nt has not respond ed, a countd own timer is star ted u sing the time defined by ip igmp snoop[...]

M ULTICAST F ILTERING C OMMANDS 4-243 ip igmp s nooping qu ery-max-respons e-time This comma n d con figures the query report dela y . Use the no form to restore the default. Syntax ip igmp snooping quer y-max-response-time seconds no ip igmp snooping quer y-max-response-time seconds - Th e repo r t dela y advertised in IGMP queri es. (Rang e: 5-25[...]

C OMMAND L IN E I NTE RFA CE 4-244 ip igmp s nooping router -port-expir e-time This comma nd configures the quer y ti meout. Use the no for m to resto re the de fault. Syntax ip igm p snoopin g router- por t-exp ire-time se conds no ip igmp snooping router-por t-expire-time seconds - T he time the switch waits af ter the previous querier stops befo[...]

M ULTICAST F ILTERING C OMMANDS 4-245 Static Multicast Routing Commands ip igmp s nooping vlan mrouter This comm and statically configures a multicast router por t. Use the no for m to remove the c onfiguration . Syntax [ no ] ip igmp snooping vlan vlan-id mrouter interface • vlan -id - VLAN ID (Range: 1-4093) • interface - ethernet unit / port[...]

C OMMAND L IN E I NTE RFA CE 4-246 Example Th e following shows how to configu re por t 11 as a multic ast router port within VLAN 1: show ip ig m p s n oopi ng mrouter This comm and displays infor mation on statically config ured and dynamically lear ned multicast router por ts . Syntax show ip igmp snoo ping mrouter [ vlan vlan- id ] vlan-id - VL[...]

IP I NTERFACE C OMMANDS 4-247 IP Inte rface Commands An IP ad dres ses may be used for manag emen t acce ss to the switch over your ne t w ork. T he IP address for this switch is obtained via DHCP b y default. Y ou can man ually conf igure a specific IP address , or direc t the device to ob tain an address from a BOOTP or DHCP ser ver when it is po[...]

C OMMAND L IN E I NTE RFA CE 4-248 Default Setting DHCP Command Mode Interf ace Configur ation (VLA N) Command Usage • You must assign an IP add ress to this device to gain management access o ver the netw ork. You can manually configure a s pecific IP address, or direct the device to obtain an address from a BOOTP or DHCP server. Valid IP addres[...]

IP I NTERFACE C OMMANDS 4-249 ip default-gateway This c ommand establishes a st atic route between this switch and devices that exis t on another network segment. Use the no for m to r emove t he static r oute. Syntax ip default-gatew ay gate way no ip default-gateway gat e wa y - IP address o f the default g atewa y Default Setting No static route[...]

C OMMAND L IN E I NTE RFA CE 4-250 Command Usage • This comman d issues a BOOTP or DHCP client r equest for any IP interface t hat has been set to BOOTP or D HCP mo de via the ip address comman d. • D HCP requi res th e serv er to re assi gn the clien t’s las t addr ess if available. • If the BOOTP or DH CP ser ver has been moved to a diffe[...]

IP I NTERFACE C OMMANDS 4-251 show ip redirects This comma nd shows the default gatew ay confi g ured for this devi ce. Default Setting None Command Mode Pri vileged Exec Example Related Commands ip default-gateway (4-249) ping Th is comman d sends IC MP echo re quest packets to ano ther no de on the network. Syntax ping host [ size size ] [ count [...]

C OMMAND L IN E I NTE RFA CE 4-252 Command Usage • Us e the pin g command t o see if anoth er site on the netw ork can be reached. • Fo llowing are some results of the ping c o mmand: - Normal respon se - The n ormal respons e occurs in on e to ten seco nds, depe nding on ne twork tra ffic. - Destination does not respond - If the host doe s not[...]

A-1 A PPENDIX A S OFTWARE S PECIFI CATIONS Software Features Authentication Local, RADIUS , TA CA CS , Port (802.1X), HTT PS , SSH, P ort Security Acc ess Con trol L ists IP , MA C (up to 88 lists) DHCP Client Port Config uration 100BASE-TX: 10/100 Mbps , half/full duplex 1000B ASE -T : 10/100 Mbps at half/full duplex, 1000 Mbps at full duplex Flow[...]

S OFTWARE S PECIFICATIONS A-2 Spanning T ree Algorithm Spanning T ree Protocol (STP , IEEE 802.1D) Rapid Spanning T ree Protocol (RSTP , IEEE 802.1w) VLAN Support Up to 255 group s; port-based or tag ged (802.1Q) , GVRP for automa tic VLAN lear ning, private VLANs Class of Ser vice Supports f our level s of priorit y and W eighted Round R obin Q ue[...]

S OFTWARE S PECIFICATIONS A-3 RMON Groups 1, 2, 3, 9 (Statistics, Histor y , Alar m, Event) Standards IEEE 802.1D Spanning T ree Protocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1w Rapid Span n ing T ree Protocol IEEE 802.1X P or t Authentication IEEE 802.3-2002 Ether ne t, Fast Ether net , Gigabit Ether net Full-[...]

S OFTWARE S PECIFICATIONS A-4 Manageme nt Info rmation Bases Bridge MIB (RFC 1493) Entity MIB (RFC 2737) Ether-lik e MIB (RFC 2665) Extended Bridge MIB (RFC 2674) Extensible SNMP Agents MIB (RFC 2742) F orwarding T able MIB ( RFC 2096) IGMP MIB ( RFC 2933) Interface Group MIB (RFC 2233) Interfaces Ev o lution MIB (RFC 2863) IP Multicasting related [...]

B-1 A PPENDIX B T ROUBLESHOOTING Problems Accessing the Man a gement Interface Table B-1 Troubleshooting Ch art Symptom Acti on Cannot con nect using Telnet, web browse r, or SNMP software • Be sur e the switch is pow ered up. • Chec k network cabling betw een the manageme nt station and t he swit ch. • Check that you have a valid network con[...]

T R OUBLESHOOTING B-2 Cannot con nect using Secure Shell • If you can not connect usi ng SSH, you may have exceeded the maximu m number of concurrent Telnet/SSH ses sions permitte d. Try connecting ag ain at a later time. • Be sure the control parameters for the SSH server are properly configured on the switch, and that the SSH client software [...]

U SIN G S YSTEM L OGS B-3 Using System Logs If a fault does occur, refer to the Installa tion Guide to ens ure that the probl em you en count ered is actuall y caus ed by the sw itch. If th e proble m appea rs to be ca used by the switch, follow th ese ste ps: 1. Enable log ging . 2. Set t he error messages reported to incl ude all categories . 3. [...]

T R OUBLESHOOTING B-4[...]

Glossary-1 G LOSSA RY Acc ess Con trol Li st (ACL) A CLs can l imit netw ork tr affic and restr ict access to c er tain us ers or devices b y chec king each p acket for certain IP or MA C (i.e ., Laye r 2) infor mation. Boot Proto col (BOOTP) BOOTP is used to pro vide bootup in for mation f or netw ork devices , including IP address infor mation, t[...]

G LOSSAR Y Glossary-2 Dynamic Ho st Control Protocol (DH CP) Prov ides a framew ork for passing conf i guration infor mation to hosts on a TCP/IP n etwor k. DHCP is bas ed on the Bo otstrap Prot ocol (BOOT P), adding the capabilit y of automatic allo cation of reusable ne twork a dd resses and ad ditional c onfigurati on opt ions . Extensible Authe[...]

G LOSSAR Y Glossary-3 IEEE 802.1D Specifies a g eneral method for the oper ation of MA C bridg es , inc luding the Sp anning Tree Proto col. IEEE 802.1Q VLAN T ag ging—Defines Ethernet frame ta gs which carr y VLAN infor mation. I t allows switch es to assign endstations t o different virtual LANs , and defines a standard wa y for VLANs to co m m[...]

G LOSSAR Y Glossary-4 IGMP Query On each subnetwork, one IGMP-capable device will act as the que rier — that is, the device tha t asks all hosts to repo rt o n the IP multicas t gro ups they wish to join or to which t hey already belong . T he elected querier will be the device with the l owest IP address i n th e subnetwo rk. Internet Group Mana[...]

G LOSSAR Y Glossary-5 Link Aggregation See Por t T r unk. Link Ag g regation Contr ol P rotocol (LACP) Allows por ts to automatically neg otiate a tr unked link with LA CP-conf igured ports on another dev ice. Management Inf or mation Base (MI B) An acrony m for Management Information Base. It is a set of d at abas e objects t h at c ontains inform[...]

G LOSSAR Y Glossary-6 Port Mirror ing A method whe reby data on a targ et p o rt is mirrored to a monit o r po r t for troub leshoot ing with a logic analyze r or RMO N probe. T his allows data on the tar get port to be stud ied unobs tr uctively . Port Trunk Define s a network link ag g re gat ion and tr unk ing method which spec ifies how to crea[...]

G LOSSAR Y Glossary-7 Sim ple Net work M anage ment Pr otocol (SNMP) The appl ication p rotocol in the Inte r net su ite of prot ocols whi ch offe rs network manag ement ser vices. Simple Networ k Time Protocol (SNTP) SNTP allow s a device to s et its int er nal c lock based on period ic updates from a Netw ork Time Prot ocol (NT P) ser ver . Updat[...]

G LOSSAR Y Glossary-8 User Datagra m Protocol (UDP) UDP pro vides a datagram mode for pack et-switc hed comm unications . I t uses IP as the under lying transp or t mec hanism to provide acc ess to IP-li ke ser v ices. UDP packet s are del ivered jus t like IP packets – connec tion- less dat ag rams that may be d iscard ed b efor e reach ing th e[...]

Index-1 Numerics 802.1X, port authen tication 3-66 A acceptab le frame type 3-157 , 4-200 Access Control List See ACL ACL Extended IP 3-78 , 4-11 6 , 4-117 , 4-120 MAC 3-79 , 4-116 , 4- 127 , 4-127 – 4-130 Standard IP 3-78 , 4-116 , 4-117 , 4-119 address table 3 -122 , 4-175 aging time 3-126 , 4-179 B BOOTP 3-19 , 4-247 BPDU 3-127 broadcast st or[...]

I NDE X Index-2 GVRP global setting 4-215 interface configu ration 3-158 , 4-217 GVRP, globa l setting 3-148 H hardware version, displ aying 3-13 , 4-83 HTTPS 3-54 , 4-42 HTTPS, secure server 3-54 , 4-42 I IEEE 802.1D 3-127 , 4-182 IEEE 802.1w 3-127 , 4-182 IEEE 802.1X 3-66 , 4- 106 IGMP groups, dis playing 3-190 , 4-239 Layer 2 3-185 , 4-236 query[...]

I NDEX Index-3 port priority configuring 3-1 69 , 4-220 default ingre ss 3-169 , 4-222 STA 3-138 , 4-189 port security, config uring 3-64 , 4-103 port, statistics 3-115 , 4-152 ports autonegot iation 3- 92 , 4-145 broadcast st orm threshold 3-109 , 4-149 capabilities 3- 92 , 4-146 duplex mode 3-91 , 4-1 44 flow control 3-91 , 4-147 speed 3- 91 , 4-[...]

I NDE X Index-4 setting 3-22 , 4-92 static a ddresses, setting 3-122 , 4-176 statist ics port 3-115 , 4-152 STP 3-132 , 4-182 STP Also see STA system cl ock, setting 3-42 , 4-71 System Logs 3-33 syst em sof tware, d ownl oading from server 3-22 , 4- 86 T TACACS +, lo gon a uthent icati on 3 -50 , 4-101 time, setting 3-42 , 4-7 1 traffic clas s weig[...]

[...]

38 T esla Irvine, CA 92618 Phone: (9 49) 679-8000 FOR TECHNICAL SUPPOR T , CALL: From U.S.A. an d Canada (2 4 hours a day , 7 days a week) (800) SMC-4-YOU; Phn: (949) 679-8000; Fax: (949) 679-1481 Fro m Europe : Contac t deta ils can be foun d on www .smc -europe.c om or w ww .smc.com INTERNET E-mail a d dresses: techsupp ort@smc.c om europea n.tec[...]