SMC Networks SMC8748M инструкция обслуживания

T igerStack 10G Gigabit Ether net Switch ◆ 24/48 auto-MDI/MDI-X 10 /100/1000B ASE-T ports ◆ 4 ports shared with 4 SFP transcei ver slots ◆ Non-blocking switching architecture ◆ Support for a redundant po wer unit ◆ Spanning T ree Prot ocol, RSTP , and MSTP ◆ Up to 32 LA CP or static 8-port trunks ◆ Layer 2/3/4 CoS support thro ugh eig[...]

[...]

[...]

38 T esla Irvine, CA 92618 Phone: (949) 679 -8000 T igerStack 10G Management Guide From SMC’ s Tiger line of feature-rich workgroup LAN solutions October 2004 Pub. # 15020004 9000A[...]

Infor mation fur nished by SMC Netw orks , Inc. (SMC) is believed to be accurate and reliable. Ho wever , no re sponsibility is assumed by SMC for its use, nor for any infringements of patents or o ther rights of third parties which may result from its use . N o license is granted by implication or oth- erwise under any patent or patent righ ts of [...]

ii L IMITED W ARRANTY Limited W ar ranty Statement: SMC Net works , Inc. (“SMC”) w ar rants its products to be free from defects in workma nship and materials , under normal use and ser vice, for the applicable warranty ter m. All SMC products car r y a standard 90-day limited warranty from the date of purchase from SMC or its Authoriz ed Resel[...]

L IMITED W AR RANTY iii WARRANTIES EX CLUSIVE: IF AN SMC PRODUCT DOES NOT OPERA TE AS W ARRANTED ABO VE, CUSTOMER’S SOLE REMEDY SHALL BE REP AIR OR REPLA CEMENT OF THE PRODUCT IN Q UESTION, A T SMC’S OPTION . THE FOREGOING W ARRANTIES AND REMEDI ES ARE EX CLUSIVE AND ARE IN LIEU OF ALL OTHER W ARRANTIES OR CONDITIONS , EXPRESS OR IMPLIED , EITH[...]

L IMITED W AR RANTY iv[...]

iii C ONTENTS 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Key Feature s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Description of Software Fea tures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 System Defaults . . . . . . . . . . . .[...]

C ONTENTS iv Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Panel Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Main Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5 Basic Configurat ion . . . . . . . . . . . . . . [...]

C ONTENTS v Configuring Local/Rem ote Logon Authentic ation . . . . . . . . . 3-60 Configuring HT TPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 -65 Replacing the De fault Secure-sit e Certificate . . . . . . . . . . . 3 -66 Configuring the Secu re Shell . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-67 Generatin[...]

C ONTENTS vi Configuring Rate Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-126 Showing Port Statisti cs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-127 Address Table Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-134 Setting Static Addresses . . . . . . . . . . . . . [...]

C ONTENTS vii Selecting IP Precedence/DSCP Priori ty . . . . . . . . . . . . . 3- 193 Mapping IP Prece dence . . . . . . . . . . . . . . . . . . . . . . . . . . 3-193 Mapping DSCP Priority . . . . . . . . . . . . . . . . . . . . . . . . . . 3- 195 Mapping IP Port Priority . . . . . . . . . . . . . . . . . . . . . . . . . 3-197 Mapping CoS Values to[...]

C ONTENTS viii line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4- 14 login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-15 password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 -16 timeout login re spons[...]

C ONTENTS ix ip http secure-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-42 Telnet Server C ommands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-43 ip telnet server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4- 43 ip telnet server port . . . . . . . . . . . . . . . . . . . . . . [...]

C ONTENTS x clock timezone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-73 calendar set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-74 show calendar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 -75 System Status Commands . . . . . . . . . . . . . . . . . . . . . . .[...]

C ONTENTS xi dot1x defaul t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-105 dot1x max-req . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-106 dot1x port-control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-106 dot1x operation-mo de . . . . . . . . . . . . . . . . . . . . . . . . .[...]

C ONTENTS xii ACL Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-144 show access-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-145 show access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-145 SNMP Command s . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

C ONTENTS xiii media-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-179 shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-180 switchport broadcast packet-r ate . . . . . . . . . . . . . . . . . . . . . . . 4-181 clear counters . . . . . . . . . . . . . . . . . . [...]

C ONTENTS xiv mst priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-221 name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-222 revision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-222 max-hops . . . . . . . . . . . . . [...]

C ONTENTS xv GVRP and Bridge Extension Commands . . . . . . . . . . . . . . . . . . . . . 4-254 bridge-ext gvrp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-254 show bridge-ext . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-255 switchport gvrp . . . . . . . . . . . . . . . . . . . . . . . [...]

C ONTENTS xvi ip igmp snooping query-max-response-time . . . . . . . . . . 4-283 ip igmp snooping router-port-expire-time . . . . . . . . . . . . 4-284 Static Multicast Routing Commands . . . . . . . . . . . . . . . . . . . . 4-285 ip igmp snooping vlan mrouter . . . . . . . . . . . . . . . . . . . . 4-285 show ip igmp snooping mrouter . . . . . . [...]

xvii T ABLES Table 1-1 Key Feat ures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Table 1-2 System De faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7 Table 3-1 Web Page Configurat ion Buttons . . . . . . . . . . . . . . . . . . . 3-4 Table 3-2 Main Menu . . . . . . . . . . . . . . . . . . . [...]

T ABLES xviii Table 4-17 Event Logging Commands . . . . . . . . . . . . . . . . . . . . . . . 4-56 Table 4-18 Logging Lev els . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-58 Table 4-19 show logging flash/ram - dis p lay description . . . . . . . . . 4-63 Table 4-20 show logging trap - display descr iption . . . . . . . . . . [...]

T ABLES xix Table 4-54 Address Table Commands . . . . . . . . . . . . . . . . . . . . . . 4-206 Table 4-55 Spanning Tree Commands . . . . . . . . . . . . . . . . . . . . . . 4-210 Table 4-56 VLAN Comm ands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-235 Table 4-57 Editing VLAN Groups . . . . . . . . . . . . . . . . . . . . . . . . .[...]

xx F IGURES Figure 3-1 Home Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 Figure 3-2 Panel Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Figure 3-3 System Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-13 Figure 3-4 Switch Information . . . . . . . . . .[...]

F IGURES xxi Figure 3-34 SSH Server Set tings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-73 Figure 3-35 Port Securit y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-76 Figure 3-36 802.1X Global Information . . . . . . . . . . . . . . . . . . . . . . 3-78 Figure 3-37 802.1X Configuration . . . . . . . . . . .[...]

F IGUR ES xxii Figure 3-71 MSTP Port Con figuration . . . . . . . . . . . . . . . . . . . . . . 3-163 Figure 3-72 Enabling GVRP Statu s . . . . . . . . . . . . . . . . . . . . . . . . . 3-168 Figure 3-73 VLAN Basic Information . . . . . . . . . . . . . . . . . . . . . . . 3-169 Figure 3-74 VLAN Current Table . . . . . . . . . . . . . . . . . . . . [...]

1-1 C HAPTER 1 I NTRODUCTION This switch provides a broad range of featu res for Layer 2 switching. It includes a management agent that allows y ou to configure the feat ures listed in this manual. The default config uration can be used for most of the features provided by this switch. Ho we ver , there are many options that you should configure to[...]

I NTR ODUCTION 1-2 Description of Software Features The switch provides a wide range of adva nced perfor mance enhancing features . Flow control eli minates the loss of pac kets due to bottlenec ks caused by port saturation. Broadcast stor m suppression prevents broadcast traffic stor ms from engulfing the netw ork. P or t-based and protocol-based [...]

D ESCRIPTION OF S OFTWARE F EATURES 1-3 network applications . Some of the management featur es are brief ly described below . Configuration Backup and Restore – Y ou can sav e the current configuration settings to a file on a TFTP ser ver , and later download this file to restore the switch configuration settings. Authentication – This switch [...]

I NTR ODUCTION 1-4 packets when port buffer thresholds are ex ceeded. T he switch supports flow control based on th e IEEE 802.3x standard. Rate Limi ti ng – This feature controls the ma ximum rate for tra ffic transmitted or re ceiv ed on an interf ace. Rate limiting is configured on interfaces at the edge of a netw ork to limit traffic into or [...]

D ESCRIPTION OF S OFTWARE F EATURES 1-5 IEEE 802.1D Bridge – The switch supports IEEE 802.1D transparent bridging . The address table facilitates data switching by learning addresses, and then filtering or forwarding tr affic based on this information. T he address table supports up to 16K addresses . Store-and-Forw ard Switching – The switch c[...]

I NTR ODUCTION 1-6 prevents VLAN members from being segmented from the rest of the g roup (as sometimes occurs with IEEE 802.1D ST A). Vir tua l LA Ns – The switch supports up to 255 VLANs. A Virtual LAN is a collection of netw ork nodes that share the same collision domain regardless of their physical location or connection point in the network.[...]

S YSTEM D EFAULTS 1-7 priorities are mapped to a Class of Service value by the switc h, and the traffic then sent to the corresponding output queue. Multicast Filtering – Specific multicast traffic can be assigned to its own VL A N t o e n s ur e t ha t i t d o e s no t i n terfere with nor mal network traffic and to guarantee real-time delivery [...]

I NTR ODUCTION 1-8 Authentication Priv ileged Exec Level Username “admin” Password “admin” Normal Exec Leve l Username “guest” Password “guest” Enable Privile ged Exec from Normal Exec Level Password “super” RADIUS Authenti cation Di sabled TACACS Authentication Disabled 802.1X Port Authenticat ion Disabled HTTPS Enabled SSH Dis[...]

S YSTEM D EFAULTS 1-9 Port Configuration Admin Status Enable d Auto-negotiat ion Enabled Flow Control Disabled Rate Limiting Input and output limits Disabled Port Trunking Static Trunks None LACP (all ports) Disabled Broadcast Storm Protection Status Enabled (all por ts) Broadcast Limit Rate 500 packets per second Spanning Tree Protocol Status Enab[...]

I NTR ODUCTION 1-10 IP Settings Management VLAN Any VLAN configured with an IP address IP Address 0.0.0.0 Subnet Mask 255.0.0.0 Default Gateway 0.0.0.0 DHCP Client: Enabled DNS Server: Disabled BOOTP Disabled Multicast Filte ring IGMP Snooping Snooping: Enabled Querier: Disable d System Log Status Enabl ed Messages Logged Levels 0-7 (all) Messages [...]

2-1 C HAPTER 2 I NITIAL C ONFIGURATION Connecting to the Switch Configuration Options The switch includes a built-in network management agent. T he agent offers a variety of management options , including SNMP , RMON (Groups 1,2 3, 9) and a W eb-based inte rface . A PC may also be connected directly to the switch for configurat ion and monitoring v[...]

I NITIAL C ONFIGURATION 2-2 The switch’ s W eb interface, CLI conf iguration prog ram, and SNMP agent allow y ou to perfor m the following management functions: • Set user names and passwords • Set an IP interface for the switch • Configure SNMP param eters • Enable/disable any port • Set the speed/duplex mode for any port • Configure[...]

C ONNECTING TO THE S WITCH 2-3 Attach a VT100-compatible terminal, or a PC r unning a ter minal emulation program to the switch. Y ou can use the console cable pro vided with this pac kag e, or use a n ull-mode m cable that complies with the wiring assignments shown in the Installation Guide. T o connect a terminal to the console port, complete the[...]

I NITIAL C ONFIGURATION 2-4 F or a description of how to use the CLI, see “Using the Command Line Interface” on page 4-1. For a list of all the CLI commands and detailed infor mation on using the CLI, refer to “Command Groups” on page 4-11. Remote Connections Prior to accessing the switc h’ s onboa rd agent via a netw ork connection, you [...]

S TACK O PERATIONS 2-5 Stack Operations Up to eight 24-port or 48-por t Gigabit switches can be stack ed tog ether as described in the Ins tallation Guide . One unit in the stack acts as the Maste r for configuration tasks and fir mware upgrade. All of the other units function in Slave mode , but can automa tically take ov er management of the stac[...]

I NITIAL C ONFIGURATION 2-6 • If a unit is removed from the stack, and powered up as a stand-alone unit, it will also retain the orig inal unit number obtained during stacking. Master Backup Unit Once the Master unit finishes booting up , the Slave unit in the stac k with the low est MA C address functions as the primary backup unit. T he stack M[...]

S TACK O PERATIONS 2-7 fails , the stack will be broken in tw o . The Stack Link LED on the unit that is no longer receiving traffic from the next unit up in the stack will begin flashing to indicate that the stack link is brok en. When the stack fa ils , a Master unit is selecte d from the two sta ck segments , either the unit with the Ma ster but[...]

I NITIAL C ONFIGURATION 2-8 Resilient Configuration If a unit in the stac k fails , the unit numbers will not change . This me ans that when you re place a unit in the st ack, the original configuration for the f a i l e d u n i t w i l l b e r e s t o r e d t o t h e r e placement unit. T his applies to both the Master and Slav e units . Renumberi[...]

B ASIC C ONFIGURATION 2-9 3. At the P assword prompt, also enter “admin.” (T he passw ord characters are not displa yed on the console screen.) 4. The session is opened and the CLI displa ys the “Console#” prompt indicating you ha ve access at the Privileged Exec leve l. Setting Passwords Note: If this is your firs t time to log into the CL[...]

I NITIAL C ONFIGURATION 2-10 Setting an IP Address Y ou must establish IP addres s info r mation for the switch to obtain management access through the network. This can be done in either of the following wa ys: Manua l — Y ou have to input the inform ation, including IP address and subnet mask. If your mana gement station is not in the same IP s[...]

B ASIC C ONFIGURATION 2-11 3. T ype “exit” to retur n to the gl obal configuration mo de prompt. Press <Enter>. 4. T o set the IP address of the default gateway for the netw ork to which the switch belongs , ty pe “ip default-g atewa y ga te way , ” where “g atew ay” is the IP address of the default gateway . Press <Enter>. [...]

I NITIAL C ONFIGURATION 2-12 • To obtain IP settings via BOOTP, type “ip address bootp” and press <Enter>. 3. T ype “end” to retur n to the Privileged Exec mode . Press <Enter>. 4. T ype “ip dhcp restart” to begi n broadcasting ser vice requests . Press <Enter>. 5. W ait a few minutes , and then c heck the IP configu[...]

B ASIC C ONFIGURATION 2-13 The switch includes an SNMP agent that supports SNMP version 1, 2c , and 3 clients . T o provide management access for v ersion 1 or 2c clients, you mu st specify a community string . The switch provides a default MIB View (i.e., an SNMPv3 constr uct) for the default “public” comm unity string that provides read acces[...]

I NITIAL C ONFIGURATION 2-14 Note: If you do not intend to support access to SNMP version 1 and 2c clients, we recommend that you delete both of the default community st rings. If there are no community strings, then SNMP management access fr om SNMP v1 and v2c c lients is disabled. Trap Receivers Y ou can also specify SNMP stations that are to rec[...]

B ASIC C ONFIGURATION 2-15 MIB-2 tree branch, and then another view that includes the IEEE 802.1D bridge MIB . It assigns these re spectiv e read and read/writ e views to a g roup called “r&d” and specifies g r oup authentication via MD5 or SHA. In the last step , it assigns a v3 user to this group , indicating that MD5 will be used for aut[...]

I NITIAL C ONFIGURATION 2-16 Managing System Files The switch’ s flash memor y suppor ts thr ee types of system files that can be managed by the CLI program, W eb inte rface, or SNMP . The switch’ s file system allows files to be uploaded and do wnloaded, copied, deleted, and set as a start-up file. The three types of files are: • Configurati[...]

M ANAGING S YSTEM F ILES 2-17 Note that configuration files should be do wnloaded using a file name that reflects the contents or usage of the file settin gs . If you do wnload directly to the r unning-config, the system will reboot, and the settings will hav e to be copied from the r unning-config to a per manent file.[...]

I NITIAL C ONFIGURATION 2-18[...]

3-1 C HAPTER 3 C ONFIGURING THE S WITCH Using the Web Interface T h i s s w i t c h p r o v i d e s a n e m b e d d e d HTTP web agent. Using a web browser you can configure the switch and view statistics to monitor netw ork activity . T he W eb agent can be accessed by any computer on the network using a standard web browser (Internet Explorer 5.0[...]

C ONFIGURING THE S WITCH 3-2 Notes: 1. You are allowed three att empts to enter the correct password; on the third failed attempt the current connection is terminated. 2. If you log into the Web interface as guest (Normal E xec level), you can view the configuration settings or change the guest password. If you log in as “admin” (Privileged Exe[...]

N AVIGATING THE W EB B RO WS ER I NTERFACE 3-3 Navigating the Web Browser Interface T o access the w eb-browser interfac e you must first ent er a user name and password. The administrator has R ead/W rite access to all configuration parameters and statistics . The default user name and passw ord for the administrator is “admin.” Home Page When[...]

C ONFIGURING THE S WITCH 3-4 Configuration Options Configurable parameters hav e a dial og box or a drop-down list. Once a configuration change has been made on a page, be sure to clic k on the Apply button to confir m the new settin g . The following table summarizes the web page configuration buttons . Notes: 1. To ensure proper screen refresh, b[...]

N AVIGATING THE W EB B RO WS ER I NTERFACE 3-5 Main Menu Using the onboard web agent, you can define system pa rameters , manage and control the switc h, and all its ports, or monitor netw ork conditions . The following table briefl y describes the selections available from this prog ram. Table 3-2 Main Menu Menu Description Page System 3-12 System[...]

C ONFIGURING THE S WITCH 3-6 Reset Restarts the switch 3-41 SNTP 3-42 Configuration Configures SNTP client setti ngs, including broadcast mode or a spec ified list of servers 3-42 Clock Time Zone Sets the local ti me zone for the system clock 3-43 SNMP 3-45 Configuration Configures c ommunity strings and related trap functions 3-47 Agent Statu s En[...]

N AVIGATING THE W EB B RO WS ER I NTERFACE 3-7 Configuration Config ures protocol paramete rs 3-79 Port Configuration Sets the auth enti cation mode for individual ports 3-80 Statistics Displays protoc ol statistics fo r the selec ted port 3-83 IP Filter Configures IP a ddresses that are allowed management access 3-85 ACL 3-87 Configuration Configu[...]

C ONFIGURING THE S WITCH 3-8 Port Broadcast Cont rol Sets the broadc ast storm thresh old for each port 3-123 Trunk Broadcast Control Sets the broadcast stor m threshold for each trunk 3-123 Mirror Port Configuration Sets the source and target ports for mirroring 3-125 Rate Limit 3-126 Input Port Configu ration Sets the input ra te limit for each p[...]

N AVIGATING THE W EB B RO WS ER I NTERFACE 3-9 Trunk Configuration Configures indiv idual trunk settings for STA 3-153 MSTP VLAN Configuration Config ures priority and VLAN s for a spanning tree instance 3-156 Port Information Displays port settings for a specified MST instance 3-160 Trunk Infor mation Displays trun k settings for a specif ied MST [...]

C ONFIGURING THE S WITCH 3-10 Private VLAN Status Enab les or disabl es the private VLAN 3-181 Link Status Configures the private VLAN 3-181 Protocol VLAN Configuration Creates a protocol group, specifying the supported protocol s 3-183 Port Configu ration Maps a pr otocol group to a VLAN 3-184 Priority 3-186 Default Port Priority Sets the default [...]

N AVIGATING THE W EB B RO WS ER I NTERFACE 3-11 ACL CoS Priority Sets the CoS value and corresponding output queue f or packets matching an AC L rule 3-199 ACL Marker Change traffic prioriti es for frames matching an ACL rule 3-201 IGMP Snooping 3-201 IGMP Configuration Enables mult icast filtering; configures parameters for multicast query 3-202 M[...]

C ONFIGURING THE S WITCH 3-12 Basic Configuration Displaying System Information Y ou can easily identify the system by displaying the device name, location and contact infor mation. Field Attributes • System Name – Name ass igned to the swit ch system. • Object ID – MIB II object ID for switch’s network management subsystem. • Location [...]

B ASIC C ONFIGURATION 3-13 We b – Click System, System Infor mat ion. Specify the system name , location, and contact infor mation for th e sys tem administrato r, th en click Apply . (This pag e also includes a T elnet button that allows access to the Command Line Interface via T elnet.) Figure 3-3 System Information[...]

C ONFIGURING THE S WITCH 3-14 CLI – Specify the hostname , location and contact infor mation. Displaying Switch Hardware/Software Versions Use the Switch Information pag e to display hardware/firmware version numb er s fo r the main board and management software, as well as the powe r status of the system. Field Attributes Main Board • Serial N[...]

B ASIC C ONFIGURATION 3-15 • Internal Power Status – Displays the status of the internal power supply. Management Softw ar e • EPLD Version – Version number of EEPR OM Programmable Logic Device. • Loader Version – Version number of loader code. • Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code. • Operation Co[...]

C ONFIGURING THE S WITCH 3-16 CLI – Use the following command to display v ersion infor mation. Displaying Bridge Extension Capabilities The Bridg e MIB includes extensions for manag ed devices that support Multicast Filtering, T r affic Classes, an d Vir tual LANs . Y ou can access these extensions to dis play default settings for the key v aria[...]

B ASIC C ONFIGURATION 3-17 • Local VLAN Capable – This switch does not support multiple local bridges outside of the scope of 802.1Q defined VLANs. • GMRP – GARP Multicast Registration Protocol (GMRP) allows network devices to register endsta tions with multicast groups. This switch does not support GMRP; it uses the Internet Group Manageme[...]

C ONFIGURING THE S WITCH 3-18 Setting the Switch’s IP Address This section describes how to config ure an IP interfa ce for management access over the netw ork. The IP addr ess for this switch is obtained via DHCP by default. T o manually configure an address , you need to change the switch’ s default settings (IP addre ss 0.0.0.0 and netmask 2[...]

B ASIC C ONFIGURATION 3-19 • Default Gate way – IP address of the ga teway router between this device and management stations th at exist on other network segments. (Default: 0.0.0.0) • MAC Address – The physical layer address for this switc h. Manual Configuration We b – Click System, IP C onfiguration. Select th e VLAN through which the[...]

C ONFIGURING THE S WITCH 3-20 Using DHCP/BOOTP If your netw ork provides DHCP/BOO TP ser vices, you can configure the switch to be dynamically configured by these services. We b – Click System, IP C onfiguration. Specify th e VLAN to which the management station is at tached, set the IP Address Mode to DHCP or BOOTP . Clic k Apply to save your ch[...]

B ASIC C ONFIGURATION 3-21 CLI – Specify the manag ement interface, and set the IP address mode to DHCP or BOOTP , and then ente r the “ip dhcp restart” command. Rene w ing DC HP – DHCP may lease addresses to clients indefinitely or for a specific period of time. If the address expires or the switch is mov ed to another network segment, you[...]

C ONFIGURING THE S WITCH 3-22 Managing Firmware Y ou can upload/download firmware to or from a TFTP ser ver , or copy files to and from switch units in a stac k. By saving runtim e code to a file on a TFTP ser ver , that file can later be downloaded to the switch to restore operation. Y ou can also set the swit c h to use new fir mware without ov e[...]

B ASIC C ONFIGURATION 3-23 Downloading System So ftware from a Server When downloading r untime co de, y ou can specify the destination file name to replace the cur rent imag e, or first do wnload the file using a different name from the current r unt ime code file, and then set the new file as the startup fi le. We b – Click System, File Managem[...]

C ONFIGURING THE S WITCH 3-24 If you do wnload to a new destination file, go to the File Management, Set Start-Up menu, mark the operation code file used at star tup , and click Apply . T o star t the new fir mware, reboot the system, via the System/R eset menu. Figure 3-9 Setting the Startup Code T o delete a file select System, File Manag ement, [...]

B ASIC C ONFIGURATION 3-25 CLI – T o download new firmware from a TFTP ser ver , enter the IP address of th e TFTP ser ver , select “config” as the fi le type, th en enter the source and destination file names . When the file has finished downloading, set the new file to start up the system, and then res tar t the switc h. T o start the new f[...]

C ONFIGURING THE S WITCH 3-26 - running-config to startup-config – Copies the r unning config to the startup config. - running-config to tftp – Copies the r unning configuration to a TFTP ser ver . - startup-config to file – Copies the startup configuration to a file on the switch. - startup-config to running config – Copies the startup con[...]

B ASIC C ONFIGURATION 3-27 Downloading Configuration Settings from a Server Y ou can download the configuratio n f ile under a new file name and then set it as the s tar tup file, or you can specify the current startup configuration file as the destination file to dire ctly re place it. Note that the file “F actor y_Default_Config .cfg” can be [...]

C ONFIGURING THE S WITCH 3-28 CLI – Enter the IP address of the TFTP server , specify the source file on the ser ver, set the startup fi le name on the switch, and then restar t the switch . T o select another configur ation file as the start-up configuration, use the boot system command and then restart the switc h. Console Port Settings Y ou ca[...]

B ASIC C ONFIGURATION 3-29 • Password Threshold – Sets the password intrusion threshold, which limits the number of failed logon attempts. When the logon attempt threshold is reached, the system interface becomes silent for a specified amount of time (set by the Silent Time parameter) before allowing the next logon attempt. (Rang e: 0 -12 0; D [...]

C ONFIGURING THE S WITCH 3-30 We b – Click System, Line , Console. Specify the console port connection parameters as required, then click Apply . Figure 3-13 Config urin g the Console Port CLI – Enter Line Configuration mode for the console , then specify the connection parameters as required. T o display the cur rent console port settings , us[...]

B ASIC C ONFIGURATION 3-31 Telnet Settings Y ou can access the onboard configuratio n prog ram ov er the netw ork using T elnet (i.e. , a vir tual ter minal). Management access via T elnet can be enabled/disabled and other various para meters set, including t he TCP por t number , timeouts , and a passw ord. Th ese pa rameters ca n be configured vi[...]

C ONFIGURING THE S WITCH 3-32 We b – Click System, Line , T elnet. Spec ify the connection parameters for T elnet access , then clic k Apply . Figure 3-14 Configuring the Telnet Interface CLI – Enter Line Configuration mode for a virtual ter minal, then specify the connection parameters as required. T o display the cur rent vir tual ter minal s[...]

B ASIC C ONFIGURATION 3-33 Configuring Event Logging The switch allows y ou to control the log ging of er ror messages, including the type of events that are recorded in switch memory , log ging to a remote System Log (syslog) ser ver , and displays a list of recent event messages. System Log Configuration The system allows you to enable or disable[...]

C ONFIGURING THE S WITCH 3-34 • RAM Level – Limits log messages saved to the switch’s temporary RAM memory for all leve ls up to th e specified level. For ex ample, if level 7 is speci fied, all messages from leve l 0 to level 7 wi ll be logged to RAM. (Range: 0-7, Def ault: 7) Note: The Flash Level must be equal to or less than the RAM Level[...]

B ASIC C ONFIGURATION 3-35 CLI – Enable system log ging and then specify the level of messages to be log ge d to RAM and flash memor y . Use the show logging comm and to display the current settings . Remote Log Configuratio n The Remote Logs page allows y ou to configure the log ging of messages that are sent to syslog ser vers or ot her managem[...]

C ONFIGURING THE S WITCH 3-36 • Host IP Address – Specifies a new server IP address to add to the Host IP List. We b – Cl ick S yst em , Log , Remo te Log s . T o ad d an I P a ddr ess to t he H ost IP List, type the new IP address in th e Host IP Address bo x, and then click Add. T o delete an IP address , click th e entry in the Host IP Lis[...]

B ASIC C ONFIGURATION 3-37 Displaying Log Messages Use the Logs page to scroll through the log ged system and event messages. The switch can store up to 2048 log en tries in temporar y random access memor y (RAM; i.e., memor y flushed on power reset) and up to 4096 entries in permanent f lash memor y . We b – Click System, Log, Logs . Figure 3-17[...]

C ONFIGURING THE S WITCH 3-38 Command Attributes • Admin Status – Enables/disables the SMTP function. (Default: Enabled) • Email Source Address – Sets the email address used for the “From” field in alert messages. You may us e a symbolic email address that identifies the switch, or the address of an administrator responsible for the swi[...]

B ASIC C ONFIGURATION 3-39 We b – Clic k System, Log, SMTP. Enable SMTP, spec ify a source email address, and select the minimum severity level. To add an IP address to the SMTP Server List, type the new IP ad dress in the SMTP S erver field and cl ic k A dd . To de l et e a n I P ad dr es s, c li ck th e e n tr y i n t h e S MT P S er v er Li st[...]

C ONFIGURING THE S WITCH 3-40 CLI – Enter the IP addres s of at least one SMTP ser ver , set the syslog severity lev el to trig g er an email mess ag e, and specify the switc h (source) and up to five recipient (destination) email addresses. Enable SMTP with the log ging sendmail command to complete the configuration. Use the show log ging sendma[...]

B ASIC C ONFIGURATION 3-41 therefore reme mber to save the current configurati on after renumbering the stack. • For a line topology, the stack is nu mbered from top to bottom, with the first unit (i.e., the unit with no connection on the Up port) in the stack designated as unit 1. For a ring topology, the Master unit taken as the top of the stac[...]

C ONFIGURING THE S WITCH 3-42 Setting the System Clock Simple Netw ork Time Protocol (SNTP) a llows the switch to set its intern al clock based on periodic updates from a time ser ver (SNTP or NTP). Maintaining an accurate time on the switch enables the system log to record meaningful dates and times for event entries . Y ou can also manually set t[...]

B ASIC C ONFIGURATION 3-43 We b – Select SN TP , Config uration. Modify any of the required parameters , and click Apply . Figure 3-21 SNTP Configuration CLI – This example configures the switc h to operate as an SNTP client and then displays the current time and settings . Setting the Time Zone SNTP uses Coordinated Univ ersal Ti me (or UTC , [...]

C ONFIGURING THE S WITCH 3-44 • Minutes (0-59) – The number of minutes before/after UTC. • Direction – Configures the time zone to be before (east) or after (west) UTC. We b – Select SNTP , Clock Time Zone. Set the offset for y our time zone relativ e to the UTC , and click Apply . Figure 3-22 Setting the Time Zone CLI - This example show[...]

S IMPLE N ETWORK M ANAGEMENT P RO T OC OL 3-45 Simple Network Management Protocol Simple Netw ork Manage ment Protoc ol (SNMP) is a communication protocol designed specifically fo r managing devices on a network. Equipment commonly managed with SN MP includes switches, routers and host computers . SNMP is typically used to configure these dev ices [...]

C ONFIGURING THE S WITCH 3-46 Each group also has a defined securi ty access to set of MIB objects for reading and writing, which are known as “views . ” T he switch has a default view (all MIB objects) and default grou ps de fined for security models v1 and v2c. The following table shows the security models and lev els available and the system[...]

S IMPLE N ETWORK M ANAGEMENT P RO T OC OL 3-47 Enabling the SNMP Agent Enables SNMPv3 ser vice for all managem ent clients (i.e., versions 1, 2c, 3). Command Att ributes • SNMP Agent Status – Enables SNMP on the switch. We b – Click SNMP , Agent Status. Enable the SNMP Agent by marking the Enabled checkbo x, and click Apply . Figure 3-23 Enab[...]

C ONFIGURING THE S WITCH 3-48 • Access Mode –Specifies the acce ss rights for the community string: - Read-Only – Authorized management stations are only able to retrieve MIB objects. - Read/Write – Authorized management st ations are able to both retrieve and modify MIB objects. We b – Click SNMP , Configuration. Add new comm unity strin[...]

S IMPLE N ETWORK M ANAGEMENT P RO T OC OL 3-49 Command Attributes • Trap Manager Capability – This switch supports up to five trap managers. • Current – Displays a list of the trap managers currently configured. • Trap Manager IP Address – IP addres s of a ne w management station to receive notification messages. • Trap Manager Commun[...]

C ONFIGURING THE S WITCH 3-50 We b – Click SNMP , Configuration. En ter the IP address and comm unity string for each management station that will recei ve trap me ssages, speci fy the UDP port and SNMP version, and then clic k Add. Select the trap types required using the check box es fo r Authentication and Link-up/do wn traps , and then click [...]

S IMPLE N ETWORK M ANAGEMENT P RO T OC OL 3-51 Setting an Engine ID An SNMPv3 engine is an independent SNMP agent that resides on the switch. This engine protects against me ssage re play , delay , and redirection. The engine ID is also used in combin ation with user passw ords to g enerate the security keys for authenticating and encr y pting SNMP[...]

C ONFIGURING THE S WITCH 3-52 Configuring SNMPv3 Users Each SNMPv3 user is defined b y a uniq ue name. Users must be configured with a specific security level and assigned to a g roup. The SNMPv3 g roup restricts users to a specif ic read and a write view . Command Attr ibutes • User Name – The name of user conne cting to the SNMP agent. (Range[...]

S IMPLE N ETWORK M ANAGEMENT P RO T OC OL 3-53 We b – Click SNMP , SN MPv3, Users . Clic k New to configure a user name. In the New User page, define a name and assign it to a group , then click Add to sav e the configuration and retu r n to the User Name list. T o delete a user, c heck the box next to the user name, then clic k Delete. T o chang[...]

C ONFIGURING THE S WITCH 3-54 CLI – Use the snmp-ser ver user command to configure a new user name and assign it to a g roup. Configuring SNMPv3 Groups An SNMPv3 group sets the access policy for its assigned us ers, restricting them to specific re ad and write views. Y ou can use t he pre-defined default g roups or create new groups to map a set [...]

S IMPLE N ETWORK M ANAGEMENT P RO T OC OL 3-55 We b – Click SNMP , SNMPv3, Groups . Click New to configure a new g roup . In the New Group pag e, define a name, ass ign a security model and level, and then select read and write views . Click Add to sa ve the new g roup and return to the Groups list. T o delete a group, check the bo x next to the [...]

C ONFIGURING THE S WITCH 3-56 CLI – Use the snmp-ser ver group command to configure a new group, specifying the security model and level, and restricting MIB access to defined read and write views. Setting SNMPv3 Views SNMPv3 views are used to re strict user access to specifie d por tions of the MIB tree. The predefined view “defaultview” inc[...]

S IMPLE N ETWORK M ANAGEMENT P RO T OC OL 3-57 We b – Click SNMP , SNMPv3, Views . Click New to configure a new view . In the New View page, define a name and specify OID subtrees in the switch MIB to be included or excluded in the view . Click Back to save the new view and retur n to the SNMPv3 Views list. F or a specific view , click on View OI[...]

C ONFIGURING THE S WITCH 3-58 CLI – Use the snmp-ser ver view command to conf igure a new view . This example view i ncludes the MIB-2 int erfaces table , and the wildc ard mask selects all index entries . User Authentication Y ou can restrict manag eme nt access to this switch using the following options: • User Accounts – Manually configur [...]

U SER A UTHENTICATION 3-59 Configuring User Accounts The guest only has read access for most configuration parameters . Howev er, the administrator has write ac cess for all parameters g overning the onboard agent. Y ou should ther efore assign a new administrator password as soon as possible, an d s tore it in a safe place. The default guest name [...]

C ONFIGURING THE S WITCH 3-60 We b – Clic k Security , User Accounts . T o configure a new user account , enter the user name, access level, and passw ord, then click Apply . T o change the passw ord for a specific user , enter the user name and new password, confirm the password by ente ring it again, then click Apply . Figure 3-30 Configuring t[...]

U SER A UTHENTICATION 3-61 Rem o t e Authentication Dial-in User Ser vice (RADIUS) and T e r minal Access Controller Access Control System Plus ( T AC AC S + ) a r e log on authentication protocols that use softw are r unning on a central ser ver to control access to RADIUS-a w are or T A CA CS -awa re devices on the network. An authentication ser [...]

C ONFIGURING THE S WITCH 3-62 • You can specify up to three authentication methods for any user to indicate the authentication sequence . For exampl e, if you select (1) RADIUS, (2) TACACS and (3) Local, the user name and password on the RADIUS server is verified first. If the RADIUS server is not available, then authentication is attempt ed usin[...]

U SER A UTHENTICATION 3-63 - Number of Server Transmits – Number of times the switch tries to authenticate logon access via the authentication server. (Range: 1-30; Default: 2) - Timeout for a reply – The number of seconds the switch waits for a reply from the RADIU S server before it resends the re quest. (Range: 1-65535; D efault: 5) • TACA[...]

C ONFIGURING THE S WITCH 3-64 We b – Click Secur ity , A uthentication Settings . T o configure local or remote authentication preferences , specify the authen tication sequence (i.e., one to three methods), fill in the parameters for RADIUS or T AC ACS + authentication if selected, and click Apply . Figure 3-31 Authentication Server Settings CLI[...]

U SER A UTHENTICATION 3-65 Configuring HTTPS Y ou can configure the switch to enable the Secure Hypertext T ransfer Protocol (HTTPS) ov er the Secure So cket La yer (SSL), providing secure access (i.e ., an encr ypted connection) to the switc h’ s web inter face. Command Usag e • Both the HTTP and HTTPS service can be enabled independently on t[...]

C ONFIGURING THE S WITCH 3-66 Command Attributes • HTTPS Status – Allows you to enable/disable the HTTPS server feature on the switch. (Default: Enabled) • Change HTTPS Port Number – Specifies the UDP port number used for HTTPS/SSL connection to the switch’s web interface. (Default: Port 443) We b – Click Security , HT TPS Settings . En[...]

U SER A UTHENTICATION 3-67 Note: For maximum security, we recommend you obtain a unique Secure Sockets Layer certificat e at the earliest opportunity. Th is is because the default certificate for the switch is not unique to the hardware you have purchased. When you hav e obtained these, place them on y our TFTP ser ver , and use the following comma[...]

C ONFIGURING THE S WITCH 3-68 Note: The switch supports both SSH Vers ion 1.5 and 2.0. Command Usag e The SSH ser ver on this switch supports both passw ord and public key authentication. If passw ord authentication is specified b y the SSH client, then the password can be a uthenticate d either locally or via a RADIUS or T AC ACS + remote authenti[...]

U SER A UTHENTICATION 3-69 authenticat ed using these k eys . The current fir mware only accepts public key files based on stan dard UNIX for mat as shown in the following example for an RSA V ersion 1 key: 1024 35 13410 81685609893921 0409449201554253 47631641921872 9589211431738 80 0555361616 31051775940838 68631109291232 2268285192543746 0310093[...]

C ONFIGURING THE S WITCH 3-70 2. The SSH server supports up to four client sessions. The maximum number of client se ssions includes both current Telnet sessions and SSH ses sions. Generating the Host Key Pair A host public/pri vate key pair is used to pro vide secure co mmunications between an SSH client and the switch. After ge nerating this key [...]

U SER A UTHENTICATION 3-71 We b – Click Secur ity , SSH, Host-Key Settings . Select the host-key type from the drop-down bo x, select the option to sa ve the host k ey from memor y to f lash (if required ) prior to g enerating the key , and then click Generate. Figure 3-33 SSH Host-Key Settings[...]

C ONFIGURING THE S WITCH 3-72 CLI – This example g enerates a host-key pair using both the RSA and DSA alg orithms , stores the keys to f lash memor y , and then displa ys the host’ s public keys . Configuring the SSH Server The SSH se r ver includes basic settings for authentication. Field Attributes • SSH Server Status – Allows you to ena[...]

U SER A UTHENTICATION 3-73 • SSH Authentication Retries – Spec ifies the number of authentication attempts that a client is allowed before authentication fails and the client has to resta rt the authentication proc ess. (Range: 1-5 times; Default: 3) • SSH Server-Key Size – Specifies the SSH server key size. (Range: 512-896 bits; Default: 7[...]

C ONFIGURING THE S WITCH 3-74 CLI – This example enables SSH, sets the authentication par ameters, and display s the current configuration. It sho ws that the administrator has made a connection via SHH, and then disables this connection. Configuring Port Security P ort security is a feature that allows you to configure a switc h por t with one o[...]

U SER A UTHENTICATION 3-75 already in the address table will be retained and will not ag e out. Any other device that attempts to u se the port will be prevented fr om accessing the switch. Command Usag e • A secure port has the following restrictions: - It cannot use port monitoring. - It cannot be a multi-VLAN port. - It cannot be used as a mem[...]

C ONFIGURING THE S WITCH 3-76 We b – Click Secur ity , P or t Security . Set the action to take when an invalid address is dete cted on a port, mark the checkbo x in the Status column to enable security for a port, set the maximum number of MA C addresses allow ed on a port, and click Apply . Figure 3-35 Port Security CLI – This example sets th[...]

U SER A UTHENTICATION 3-77 ports in a network can be centrally controlled from a server , which means that authorized users can use the same credential s for authentication from any point within the network. This switch uses the Extensible Authentication Protocol ov er LANs (EAPOL) to ex change authentication pr otocol messages with the client, and[...]

C ONFIGURING THE S WITCH 3-78 The operation of 802.1X on the switch requires the following: • The switch must have an IP address assigned. • RADIUS authenti cation must be en abled on the switch and the IP address of the RADIUS server specified. • Each switch port that will be used must be set to dot1x “Auto” mode. • Each client that ne[...]

U SER A UTHENTICATION 3-79 CLI – This example shows the de fault global settings for 802.1 X. Configuring 802.1X Global Settings The 802.1X protocol includes por t au thentication. The 802.1X protocol must be enabled globally for the swit ch system before por t settings are active . Command Attributes • 802.1X System Authentication Control – [...]

C ONFIGURING THE S WITCH 3-80 CLI – This example enables 802.1X globally for the switch. Configuring Port Settings for 802.1X When 802.1X is enabled, you need to configure the parameters for the authentication process that r uns betwee n the client and the switch (i.e ., authenticator), as we ll as the client identity lookup process that r uns be[...]

U SER A UTHENTICATION 3-81 • Max Request – Sets the maximum number of ti mes the switch port will retransmit an EAP request packet to the client before it times out the authentication session. (Range: 1-10; Default 2) •Q u i e t P e r i o d – Sets the time that a sw itch port waits after the Max Request count has been exceeded befo re attem[...]

C ONFIGURING THE S WITCH 3-82 CLI – This example sets the au thentication mode to enab le 802.1X on port 2, and allows up to ten clients to connect to this port. Console(config)#interface ethernet 1/2 4-174 Console(config-if)#dot1x port-control a uto 4-106 Console(config-if)#dot1x re-authenticat ion 4-108 Console(config-if)#dot1x max-req 5 4-106 [...]

U SER A UTHENTICATION 3-83 Displaying 802.1X Statistics This switch can display statistics for dot1x protocol ex changes for any port. Table 3-6 802.1X Statistics Parameter Description Rx EAPOL Start The number of EAPO L Start frames that have been received by this Authenticat or. Rx EAPOL Logoff The number of EA POL Logoff frames that have been re[...]

C ONFIGURING THE S WITCH 3-84 We b – Select Security , 802.1X , Stat istics . Select th e required por t and the n click Query . Click R efresh to update the statistics . Figure 3-39 802.1X Port Statistics CLI – This example displays the 802.1X statistics for por t 4. Console#show dot1x statistics interface ether net 1/4 4-110 Eth 1/4 Rx: EXPOL[...]

U SER A UTHENTICATION 3-85 Filtering IP Addresses for Management Access Y ou can create a list of up to 16 IP addresses or IP address groups that are allow ed manag ement access to the switc h through the W eb interface, SNMP , or T elnet. Command Usag e • The management interfaces are open to all IP addresses by default. Once you add an entry to[...]

C ONFIGURING THE S WITCH 3-86 • Start IP Address – A single IP address, or the starti ng address of a range. • End IP Address – The end address of a range. We b – Click Security , IP Filter . Ente r the IP addresses or range of addresses that are allow ed management access to an interface, and click Add IP Filtering Entr y . Figure 3-40 I[...]

A CCESS C ONTR OL L ISTS 3-87 Access Control Lists Access Control Lists (A CL) provide packet filtering for IP frames (based on address , protocol, Layer 4 protocol por t number or TCP control co de) or any frames ( based on MA C addres s or Ethernet type). To filter incoming packets, first create an acce ss list, add the required r ules, specify a[...]

C ONFIGURING THE S WITCH 3-88 • When an ACL is bound to an inte rface as an egress filter, all entrie s in the ACL must be deny rules. Otherwise, the bind operation will fail. • The switch does not support the explicit “den y any any” rule for the egress IP ACL or the egress MAC ACLs . If these rules are included in ACL, and you attempt to [...]

A CCESS C ONTR OL L ISTS 3-89 We b – Click Security , A CL, Configurat ion. Enter an A CL name in the Name field, select the list type (IP Standard, IP Extended, or MA C), and click Add to open the configuration page for the new list. Figure 3-41 Selecting ACL Type CLI – This example creates a standard IP AC L named bill. Configuring a Standard[...]

C ONFIGURING THE S WITCH 3-90 We b – Specify the action (i.e., P er mit or Deny). S elect the address type (Any , Host, or IP). If you select “Hos t, ” enter a specific address . If you select “IP ,” enter a subnet address an d the mask for an address range. Then click Add. Figure 3-42 ACL Configuration - Standard IP CLI – This example [...]

A CCESS C ONTR OL L ISTS 3-91 • Source/Destination Subnet Mask – Subnet mask for source or destination address. (See the de scription for SubMask on page 3-89.) • Service Type – Packet priori ty settings ba sed on the following criteria: - Pre cedence – IP preced ence level. (Range: 0-8) - TOS – Type of Service level. (Range: 0-16) - DS[...]

C ONFIGURING THE S WITCH 3-92 We b – Specify the action (i.e., P er mit or Deny). Specify the source and/or destination addresses . Select the addr ess type (Any , Host, or IP). If you select “Host, ” enter a specific add ress . If you select “IP ,” enter a subnet address and the mask for an address range . Set any other required criteria[...]

A CCESS C ONTR OL L ISTS 3-93 3. P er mit all TCP packets from cla ss C addresses 192.168.1.0 with the TCP control code set to “SYN . ” Configuring a MAC ACL Command Attributes • Action – An ACL can contain all perm it rules, deny rules, or a combination of both. (Default: Permit rules) • Source/Destination Address Type – Use “Any” [...]

C ONFIGURING THE S WITCH 3-94 • Packet Format – This attribute inc ludes the following pac ket types: - Any – Any Ethernet packet type. - Untagged-eth2 – Untagged Ethernet II packets. - Untagged-802.3 – Untagged Ethernet 802.3 packe ts. - Tagged-eth2 – Tagged Ethernet II packets. - Tagged-802.3 – Tagged Ethernet 802.3 packets. Command[...]

A CCESS C ONTR OL L ISTS 3-95 CLI – This r ule per m its packets from any source MA C address to the destination address 00-e0-29-94-34-d e where the Ethernet type is 0800. Configuring ACL Masks Y ou must specify masks that contro l the order in whic h A CL r ules are check ed. T he switch includes two sy stem default masks that pass/filter packe[...]

C ONFIGURING THE S WITCH 3-96 We b – Click Security , ACL, Mask Conf igur ation. Click Edit for one of the basic mask types to open the configuration page. Figure 3-45 Selecting ACL Mask Types CLI – This example creates an IP ingress mask, and then adds two rules. Each rule is c hecked in order of pr ecedence to look for a match in the ACL entr[...]

A CCESS C ONTR OL L ISTS 3-97 specify a host address (not a subnet) , or “IP” to specify a range of addresses. (Options: Any, Host, IP; Default: Any) • Source/Destination Subnet Mask – Source or de stination address of rule must match this bitmask. (See the description for SubMask on page 3-89.) • Protocol Mask – Check the protocol fiel[...]

C ONFIGURING THE S WITCH 3-98 CLI – This shows that the entries in the mask ov er ride the precedence in which the rules are entered into the A CL. In the following example, packets with the source address 10. 1.1.1 are dropped because the “deny 10.1.1.1 255.255.255.255” r ule has the higher precedence according the “mask host any” entr y[...]

A CCESS C ONTR OL L ISTS 3-99 We b – Configur e the mask to match t he required rules in the MA C ingress or eg ress A CLs . Set the mask to check for any source or destination address, a host address, or an address range. Use a bitmas k to search for specific VLAN ID(s) or Ether net type(s). Or check for rule s where a packet format was specifie[...]

C ONFIGURING THE S WITCH 3-100 CLI – This example shows ho w to create an Ing ress MA C A CL and bind it to a port. You can then see that th e order of the rules have been changed by the mask. Binding a Port to an Access Control List After configuring the Access Control Li sts (A CL), you s hould bind them to the ports that need to filter traffic[...]

A CCESS C ONTR OL L ISTS 3-101 • When an ACL is bound to an inte rface as an egress filter, all entrie s in the ACL must be deny rules. Otherwise, the bind operation will fail. • The switch does not support the explicit “den y any any” rule for the egress IP ACL or the egress MAC ACLs . If these rules are included in an ACL, and you attempt[...]

C ONFIGURING THE S WITCH 3-102 CLI – This examples assigns an IP and MA C ingr ess A C L to port 1, and an IP ing ress A CL to port 2. Port Configuration Displaying Connection Status Y ou can use the P ort Infor mation or T r unk Infor mation pag es to display the current connection status, includ ing link state, speed/duplex mode, flow control, [...]

P ORT C ONFIGURATION 3-103 We b – Click P or t, P ort Infor mation or T r unk Infor mation. Figure 3-49 Port Status Information Field Attributes (CLI) Basic information: • Port type – Indicates the port ty pe. (1000BASE-T or SFP) • MAC address – The physi cal layer addr ess for this port. (To access this item on the web, see “Setting th[...]

C ONFIGURING THE S WITCH 3-104 - 100full - Supports 100 Mbps full-duplex operation - 1000full - Supports 1000 Mbps full-duplex operation •B r o a d c a s t s t o r m – Shows if broadcast storm control is enabled or disabled. • Broadcast storm limit – Shows the broadcast storm threshold. (500 - 262143 packets per second) • Flow control –[...]

P ORT C ONFIGURATION 3-105 CLI – This example shows the connection status f or P or t 5. Configuring Interface Connections Y ou can use the P ort Configuration or T r unk Configuration page to enable/disable an interface, set auto-neg otiation and the interface capabilities to advertise, or manually fix the speed, duplex mode, and flow control. C[...]

C ONFIGURING THE S WITCH 3-106 • Autonegotiation (Port Capabilities) – Allows auto-negotiation to be enabled/disabled. When auto-negotia ti on is enabled, you need to specify the c apabilities to be adve rtised . When auto-negotiation is disabled, you can force the settings fo r speed, mode, and flow control. The following capabi lities are sup[...]

P ORT C ONFIGURATION 3-107 We b – Click P ort, Port Configuration or T r unk Configuration. Modify the required interface settings, and clic k Apply . Figure 3-50 Port - Port Configuration CLI – Select the interface , and then enter the required settings . Creating Trunk Groups Y ou can create multiple links between devices t hat work as one vi[...]

C ONFIGURING THE S WITCH 3-108 The switch supports both static tr unking and dynamic Link Ag g reg ation Control Protocol (LA CP). Static tr unks have to be man ually configured at both ends of the link, and the switches must comply with the Cisco EtherChannel standard. On the other hand, LA CP configured por ts can automatically negotiate a tr unk[...]

P ORT C ONFIGURATION 3-109 • All the ports in a trunk have to be treated as a whole when moved from/to, added or de leted from a VLAN. • STA, VLAN, and IGMP settings can only be made for the entire trunk. Statically Configuring a Trunk Command Usag e • When configuring static trunks, you may not be able to link switches of different types, de[...]

C ONFIGURING THE S WITCH 3-110 We b – Click P or t, T r unk Membership . Enter a tr unk ID of 1-32 in the T r unk fiel d, select any of the switch ports from the scroll-down port list, and click Add. After you have completed adding port s to the member list, click Apply . Figure 3-51 Static Trunk Configuration[...]

P ORT C ONFIGURATION 3-111 CLI – This example creates trunk 2 wi th por ts 9 and 10. J ust connect these ports to two static trunk por ts on another switch to form a tr unk. Enabling LACP on Selected Ports Command Usag e • To avoid creating a loop in the network, be sure you enable LACP before connecting the ports, and also disconnect the ports[...]

C ONFIGURING THE S WITCH 3-112 • A trunk formed with another switch using L ACP will automatically be assigned the next available trunk ID. • If more than eigh t ports attached to the sa me target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails. • All por[...]

P ORT C ONFIGURATION 3-113 CLI – The following example enables LA CP for ports 1 to 6. Just connect these ports to LACP-enabled trunk ports on another switch to for m a tr unk. Configuring LACP Parameters Dynamically Creating a Por t Channel P orts assigned to a common por t channe l must meet the following criteria: • Ports must have the same [...]

C ONFIGURING THE S WITCH 3-114 Note: If the port channel admin key (l acp admin key, page 4-199) is not set (through the CLI) when a channel group is formed (i.e., it has a null value of 0), this key is set to the same value as the port admin key used by the interfaces that joined the group (lacp admin key, as desc ribed in this section and on page[...]

P ORT C ONFIGURATION 3-115 We b – Click P or t, LA CP , Ag g regation P ort. Set the System Priori ty , Admin Key , and Port Priority for t he P or t Actor . Y ou can optionally configure these setti ngs for the P or t P artner . (Be aw are that these s ettings only affect the administrative state of the partne r , and will not take effect until [...]

C ONFIGURING THE S WITCH 3-116 CLI – The following example configures LA CP parameters for ports 1-6. P orts 1-4 are used as acti ve members of the LA G; ports 5 and 6 are set to backup mode . Displaying LACP Port Counters Y ou can display statistics for LA CP protocol messages. Counter Infor mation Console(config)#interface ethernet 1/1 4-174 Co[...]

P ORT C ONFIGURATION 3-117 We b – Click P or t, LA CP , P or t Counters Infor mation. Select a member port to display the cor responding infor mation. Figure 3-54 LACP - Port Counters Information Marker Received Number of valid Marker PDUs rece ived by this ch annel group. LACPDUs Unknown Pkts Number of frames receiv ed that either (1) Carry the [...]

C ONFIGURING THE S WITCH 3-118 CLI – The following example displa ys LA CP counters for port channel 1. Displaying LACP Settings a nd Status for the Local Side Y ou can display configuration settin gs and the operational state for the local side of a link ag g reg ation. Console#show lacp 1 counters 4-201 Channel group : 1 -----------------------[...]

P ORT C ONFIGURATION 3-119 Admin State, Oper State Administrative or operational valu es of the actor’s state parameters: • Expired – The actor’s re ceive machine is in the ex pired state; • Defaulted – The acto r’s receive machine is u sing defaulted operational partner inform ation, administra tively configured for the partner. • [...]

C ONFIGURING THE S WITCH 3-120 We b – Click P or t, LA CP , Port Internal Infor mation. Select a por t channel to display the corresponding infor mation. Figure 3-55 LACP - Port Internal Information CLI – The follo wing example disp lays the LA CP configuration settings and operational state for the local side of port channel 1. Console#show la[...]

P ORT C ONFIGURATION 3-121 Displaying LACP Settings a nd Status for the Remote Side Y ou can display configuration settin gs and the operational state for the remote side of a link ag gr egation. Table 3-9 LACP Nei ghbor Configuration Informati on Field Description Partner Admin System ID LAG partner’s system ID assign ed by the user. Partner Ope[...]

C ONFIGURING THE S WITCH 3-122 We b – Click P or t, LA CP , Port Neighbors Infor mation. Select a port channel to display the corresponding infor mation. Figure 3-56 LACP - Port Neighbors Informat ion CLI – The follo wing example disp lays the LA CP configuration settings and operational state for the remote side of por t channel 1. Console#sho[...]

P ORT C ONFIGURATION 3-123 Setting Broadcast Storm Thresholds Broadcast stor ms may occur when a device on your netw ork is malfunctioning, or if application pr ograms are not well designed or properly configur ed. If there is to o m uch broadcast traffic on your network, performance can be severely degraded or everything can come to complete halt.[...]

C ONFIGURING THE S WITCH 3-124 We b – Click P or t, P ort Broadcast Cont rol or T r unk Broadcast Control. Check the Enabled bo x for any interface, set the threshold, and click Apply . Figure 3-57 Port Broadcast Control CLI – Specify any interfa ce, and then enter the threshold. T he following disables broadcast stor m control fo r port 1, and[...]

P ORT C ONFIGURATION 3-125 Configuring Port Mirroring Y ou can mir ror traffic from any source port to a targ et port for real-time analysis . Y ou can th en attach a logic analyzer or RMON probe to the targ et port and study the traffic crossing the source port in a completely unobtr usiv e manner . Command Usag e • Monitor port speed should mat[...]

C ONFIGURING THE S WITCH 3-126 We b – Click P ort, Mir ror Port Configur ation. Specify the source por t, the traffic type to be mir r ored, and the moni tor port, the n click Add. Figure 3-58 Configuring a Mirr or Port CLI – Use the interface comma nd to select the monitor port, then use the port monit or command to specify the sourc e port. N[...]

P ORT C ONFIGURATION 3-127 Command Attribute Rate Limi t – Sets the outpu t rate limit for an interface. Default Status – Disabled Default Rate – 1000 Mbps Range – 1 - 1000 Mbps We b - Click Rate Limit, Input/ Output P or t/T r unk Configuration. Set the Input Rate Limit Sta tus or Output Rate Limit Status , then set the ra te limit for the[...]

C ONFIGURING THE S WITCH 3-128 unusually heavy loading). RMON statis tics provide access to a broad range of statistics , including a total coun t of different frame types and sizes passing through each port. All values displayed hav e been accumulated since the last system rebo ot, and are shown as counts per second. Statistics are refres hed ever[...]

P ORT C ONFIGURATION 3-129 Transmit Uni cast Packets The total n umber of packets t hat higher-level protocols re quested be transmitted to a subnetwork-unicast address, inc luding those that were discarded or not sent. Transmit Multicast Packets The total nu mber of pack ets that higher-level protocols re quested be transmitted, and whic h were ad[...]

C ONFIGURING THE S WITCH 3-130 Single Collision F rames The number of successfully transm itted frames for which transmis sion is inhi bited by exactl y one collision. Internal MA C Transmit Errors A count of frames for which transmissio n on a particular interface fails due to an internal MAC sublayer transmit error. Multiple Collision Frames A co[...]

P ORT C ONFIGURATION 3-131 Collisions The best estimate of the total n umber of collisions on this Ethernet segment. Received Frame s The total number of frames (bad, broadcast and multicast) received. Broadcast Frame s The total num ber of good fram es received that we re directed to the broadcast addr ess. Note that this does not include multi ca[...]

C ONFIGURING THE S WITCH 3-132 We b – Click P or t, P or t Statistics . Select the required interface, and click Quer y . Y ou can also use the R efresh button at the bottom of the page to update the screen. Figure 3-60 Port Statistics[...]

P ORT C ONFIGURATION 3-133 Figure 3-61 Port Statistics (continued)[...]

C ONFIGURING THE S WITCH 3-134 CLI – This example shows statistics for port 13. Address Table Settings Switches store the addresses for all known devices . T his infor mation is used to pass traffic directly betwee n the inbound and outbound ports . All the addresses learned by monitoring traffic are stored in the dynamic address table. Y ou can [...]

A DDR ESS T ABLE S ETTINGS 3-135 Command Attributes • Static Address Counts 5 – The number of manually configured addresses. • Current Static Address Table – Lists all the static addresses. • Interface – Port or trunk associated with the device assigned a static address. • MAC Address – Physical addre ss of a device mapped to this i[...]

C ONFIGURING THE S WITCH 3-136 Displaying the Address Table The Dynamic Address T able contains the MA C addresses learned by monitoring the source address for tr affic entering the switc h. When the destination address for inbound traf fic is found in the database, the packets intended for that address are forwarded directly to the associated port[...]

A DDR ESS T ABLE S ETTINGS 3-137 We b – Click Address T able, Dynamic Addresses . Specify the search type (i.e ., mark the Interface, MA C Address , or VLAN checkbo x), select the method of sor ting the displayed addresses , and then click Quer y . Figure 3-63 Dynamic Addresses CLI – This example also displays th e address table entries for por[...]

C ONFIGURING THE S WITCH 3-138 • Aging Time – The time after which a learned entry is discarded. (Range: 10-1000000 seconds; Default: 300 seconds) We b – Click Address T able, Address Aging . Specify the new aging time, click Apply . Figure 3-64 Address Aging CLI – This example sets the aging time to 400 seconds . Spanning Tree Algorithm Co[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-139 ST A uses a distributed alg orithm to select a bridging device (STA-compliant switch, bridge or rout er) that serves as the root of the spanning tree network. It selects a root port on eac h bridging device (except for the root device) whic h incurs the lowest path cost when forwarding a pac ket from [...]

C ONFIGURING THE S WITCH 3-140 When using STA or RSTP , it may be di fficult to maintain a stable path between all VLAN members . Frequent changes in the tree str ucture can easily isolate some of the group memb ers . MSTP (an extension of RSTP) is designed to support independent spa nning trees based on VLAN groups . Once you specify the VLANs to [...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-141 • Forward Delay – The maximum time (in seconds) the root device will wait before changing sta tes (i.e., di scarding to learning to forwarding). This delay is required because ever y device must re ceive information about topology changes before it star ts to forward frames. In addition, each port[...]

C ONFIGURING THE S WITCH 3-142 • Root Hello Time – Interval (in seconds) at which this device transmits a configuration messa ge. • Root Maximum Age – The maximum time (in seconds) thi s device can wait without receiving a configuration message be fore att emptin g to reconfigure. All device ports (e xcept for designated ports) should recei[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-143 We b – Click Spann ing T ree, STA, Information. Figure 3-65 STA Information CLI – This command displays global STA settings , followed by settings for each port . Note: The current root port and current r oot cost display as zer o when this device is not connected to the network. Console#show span[...]

C ONFIGURING THE S WITCH 3-144 Configuring Global Settings Global settings apply to the entire switch. Command Usag e • Spanning Tree Algorithm 6 Uses RSTP for the internal state machine, but sends only 802.1D BPDUs. This creates one spanning tree instance for the entire ne twork. If multiple VLANs are implemented on a network, the path between s[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-145 - Be careful when switching between spanning tree modes. Changing modes stops all spanning-tree instances for the previous mode and restarts the sys tem in the new mode, temporaril y disrupting user traffic. Command Attributes Basic Configuration of Global Settings • Spanning Tree State – Enables/[...]

C ONFIGURING THE S WITCH 3-146 • Maximum Age – The maximum time (in se conds) a device can wait without receiving a configuration message before attempting t o reconfigure. All device ports (exc ept for designated ports) should receive configuration messages at re gular intervals. Any port that ages out STA information (provided in the last con[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-147 • Transmission Lim it – The maximum transmission rate for BPDUs is specified by setting the minimu m interval between the transmission of consecutive protocol message s. (Range: 1-10; Default: 3) Configuration Settings for MSTP • Max Instance Numbers – The maximum number of MSTP instances to w[...]

C ONFIGURING THE S WITCH 3-148 We b – Click Spanning T ree, STA, Conf iguration. Modify the required attributes , and click Apply . Figure 3-66 STA Configuration CLI – This example enables Spanning T ree Alg orithm, sets the mode to MST , and then configures the STA and MSTP parameters . Console(config)#spanning-tree 4-212 Console(config)#spann[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-149 Displaying Interface Settings The STA P or t Infor mation and STA T r unk Infor mation pages display the cur rent status of ports and tr unks in the Spanning T ree. Field Attributes • Spanning Tree – Shows if STA has been enabled on this interface. • STA Status – Displays curr ent state of thi[...]

C ONFIGURING THE S WITCH 3-150 • Designated Port – The port priority and number of the port on the designated brid ging device th rough which this switch must communicate with the root of the Spanning Tree. •O p e r P a t h C o s t – The contribution of this port to the path cost of paths towards the spanning tree which include this port. ?[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-151 T r unk Member – Indicates if a por t is a member of a tr unk. (STA P or t Infor mation only) These additional parameters ar e only displa yed for the CLI: • Admin status – Shows if this interface is enabled. • External path cost – The path cost for the IST. This parameter is used by the STA[...]

C ONFIGURING THE S WITCH 3-152 • Admin Edge Port – You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state. Specifying Edge Ports provides quicker c onvergence[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-153 CLI – This example shows the ST A attributes for port 5. Configuring Interface Settings Y ou can configure RSTP and MSTP at tributes for specific interfaces, including port priority , path cost, link type, an d edge por t. Y ou may use a different priority or path cost for ports of the same media ty[...]

C ONFIGURING THE S WITCH 3-154 - Learning - Port has transmitte d configuration messages for an interval set by the Forward Delay par ameter without receiving contradictory information. Port addr ess table is cleared, and the port begins learning addresses. - Forwarding - Port forwards packets, and continues learning addresses. • Trunk – Indica[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-155 •D e f a u l t – - Ethernet – Half duplex: 2,000,00 0; full duplex: 1,000,000; trunk: 500,000 - Fast Ethernet – Half duplex : 200,000; full duplex: 100,000; trunk: 50,000 - Gigabit Ethernet – Full duplex: 10,000; trunk: 5,000 • Admin Link Type – The link type atta ched to this interface.[...]

C ONFIGURING THE S WITCH 3-156 We b – Click Spanning T ree, STA, P or t Configuration or T r unk Configuration. M odify the required attributes , then click Apply . Figure 3-68 STA Port Configuration CLI – This example set s STA att ributes for port 7. Configuring Multiple Spanning Trees MSTP generates a unique spanning tree for each instance .[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-157 (on each bridge) with the same set of VLANs. Also , note that RSTP treats each MSTI region as a single node , connecting all regions to the Common Spanning T ree. T o use multiple spanning trees: 1. Set the spanning tree type to MS TP (ST A Configuration, pag e 3-144). 2. Enter the spanning tree prior[...]

C ONFIGURING THE S WITCH 3-158 We b – Click Spann ing T ree , MSTP , VL AN Configuration. Select an instance identifier from the list, set the instance priority , and click Apply . T o add the VLAN members t o an MSTI instance, enter the insta nce identifier, the VLAN identifier , and c lick Add. Figure 3-69 MSTP VLAN Configuration[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-159 CLI – This d isplays ST A settings for instance 1, followed by settings for each port. Console#show spanning-tree mst 2 4-233 Spanning-tree information ------------------------------------------ --------------------- Spanning tree mode :MSTP Spanning tree enable/disable :enabled Instance :2 Vlans co[...]

C ONFIGURING THE S WITCH 3-160 CLI – This example sets the priority for MSTI 1, and adds VLANs 1-5 to this MSTI. Displaying Interface Settings for MSTP The MSTP Port Infor mation and MSTP T r unk Infor mation pages display the current status of por ts and tr un ks in the selected MST instance. Field Attributes MST Instance ID – Instance identif[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-161 CLI – This d isplays ST A settings for instance 0, followed by settings for each port. T he settings for instance 0 are global settings that apply to the IST (page 3-1 40), the settings for other instances onl y apply to the local spanning tree. Console#show spanning-tree mst 0 4-233 Spanning-tree i[...]

C ONFIGURING THE S WITCH 3-162 Configuring Interface Settings for MSTP Y ou can configure the STA interface settings for an MST Instance using the MSTP P ort Configuration and MSTP T r unk Configuration pages . Field Attributes The following attributes are re ad-only and cannot be changed: • STA State – Displays current state of this port withi[...]

S PANNING T REE A LGORITHM C ONFIGURATION 3-163 • Admin MST Path Cost – This parameter is used by the MSTP to determine the be st path between de vices. Therefore , lower values should be assigned to por ts atta ched to faster me dia, and higher values assigned to ports with slow er medi a. (Path cost takes precedence over port priority.) Note [...]

C ONFIGURING THE S WITCH 3-164 VLAN Configuration IEEE 802.1Q VLANs In large networks , routers are used to isolate broadcast traffic for each subnet into separate domains. This sw itc h provides a similar service at Layer 2 b y using VLANs to organize any g roup of network nodes into separate broadcast domains . VLANs confine broadcast traffic to [...]

VLAN C ONFIGURATION 3-165 • Passing traffic between VLAN-a ware and VLAN-unaware devices • Priority tagging Assigning Ports to VLANs Be for e e na bl in g V LA Ns for th e s wi tch , yo u mu st fir st as si gn each po r t t o the VLAN g roup(s) in which it will participate. By default all ports are assigned to VLAN 1 as untagg ed ports. Add a p[...]

C ONFIGURING THE S WITCH 3-166 Por t O ver la p pi n g – P or t overlapping can be used to allow access to commonly shared netw ork resources am ong different VLAN g roups , such as file ser vers or printers . Note that if you implement VLANs which do not ov erlap , but still need to comm unicate, y ou can connect them b y enabled routing on this[...]

VLAN C ONFIGURATION 3-167 should also deter mine security bou ndarie s in the ne tw ork and disa ble GVRP on the boundar y ports to prevent adv ertisements from being propagated, or forbid those ports from joining restricted VLANs . Note: If you have host devices that do not support GVRP, yo u should configure static or untagged VLANs for the switc[...]

C ONFIGURING THE S WITCH 3-168 receives a tagg ed frame, it will pass this frame onto the VLAN(s) indicated by th e frame tag . Howev er , when this swit ch recei ves an unt ag g ed frame from a VLAN-unaw are device, it first decides where to forward the frame, and then inserts a VLAN tag reflecting the ing ress port’ s default VID . Enabling or [...]

VLAN C ONFIGURATION 3-169 Field Attributes • VLAN Version Number 8 – The VLAN version used by this switch as specified in the IEEE 802.1Q standard. • Maximum VLAN ID – Maximu m VLAN ID recognized by this switch. • Maximum Number of Supported VLANs – Maximum number of VLANs that can be configured on this switch. We b – Click VLAN , 802[...]

C ONFIGURING THE S WITCH 3-170 Command Attributes (W eb) • VLAN ID – ID of configured VLAN (1-4093). • Up Time at Creation – Time this VLAN was created (i.e., System Up Time). • Status – Shows how this VLAN was added to the switch. - Dynamic GVRP : Automatic ally learned via GVRP. - Permanent : Added as a static entry. • Egress Ports [...]

VLAN C ONFIGURATION 3-171 • Status – Shows if this VLAN is enabled or disabled. - Active : VLAN is operational. - Suspend : VLAN is suspended; i.e. , does not pass packets. • Ports / Channel groups – Shows the VLAN interface members. CLI – Current VLAN infor mation can be displayed with the following command. Creating VLANs Use the VLAN S[...]

C ONFIGURING THE S WITCH 3-172 • Status (Web) – Enables or disables the specified VLAN. - Enable : VLAN is operational - Disable : VLAN is sus pended; i.e. , does not pass packets. • State (CLI) – Enables or disables the specified VLA N. - Active : VLAN is operational. - Suspend : VLAN is suspended; i.e. , does not pass packets. • Add –[...]

VLAN C ONFIGURATION 3-173 CLI – This example creates a new VLAN . Adding Static Members to VLANs (VLAN Index) Use the VLAN Static Table to configure port members for the selected VLAN index. Assign ports as tag g ed if they are connected to 802.1Q VLAN compliant devices , or untag ged they are not connected to any VLAN-aware devices . Or configur[...]

C ONFIGURING THE S WITCH 3-174 Command Attributes • VLAN – ID of configured VLAN (1-4093 , no leading zeroes). • Name – Name of the VLAN (1 to 32 characters). • Status – Enables or disables the specified VLAN. - Enable : VLAN is operational. - Disable : VLAN is sus pended; i.e. , does not pass packets. • Port – Port identifier. • [...]

VLAN C ONFIGURATION 3-175 We b – Click VLAN , 802.1Q VLAN , Static T able. Select a VLAN ID from the scroll-down list. Modify the VLAN name and status if required. Select the membership type by marking the a ppropriate radio button in the list of ports or tr unks. Clic k Apply . Figure 3-76 VLAN Static Table - Adding Static Members CLI – The fo[...]

C ONFIGURING THE S WITCH 3-176 • Member – VLANs for which the selected interface is a tagged member. • Non-Member – VLANs for which the selected interface is not a tagged member. We b – Click VLAN , 802.1Q VLAN, Static Membership by P or t. Select an interface from the scroll-down box (P or t or T r unk). Click Query to display membership[...]

VLAN C ONFIGURATION 3-177 Configuring VLAN Behavior for Interfaces Y ou can configure VLAN behavior for specific interfaces, including the default VLAN identifier (PVID), acce pt ed frame types , ing ress filteri ng, GVRP status , and GARP timers. Command Usag e • GVRP – GARP VLAN Registration Protocol defines a way for switches to exchange VLA[...]

C ONFIGURING THE S WITCH 3-178 - If ingress filtering is disabled and a port receives frames tagged for VLANs for which it is not a member , these frames will be flooded to all other ports (except for those VLANs explicitly forbi dden on this port). - If ingress filtering is enabled and a port receives frames tagged for VLANs for which it is not a [...]

VLAN C ONFIGURATION 3-179 • Mode – Indicates VLAN membership m ode for an inter face. (Default: Hybrid) - 1Q Trunk – Specifies a port as an end-point for a VLAN trunk. A trunk is a direct link between tw o switches, so the port transmits tagged frames that identify t he source VLAN. However, note that frames belonging to the port’s defaul t[...]

C ONFIGURING THE S WITCH 3-180 CLI – This example sets por t 3 to ac ce pt only tag g ed frames, assigns PVID 3 as the nativ e VLAN ID , enables GVRP , sets the GARP timers , and then sets the switc hpor t mode to hybrid. Configuring Private VLANs Priv ate VLANs provide port-based secu rity and isolation between ports within the assigned VLAN . D[...]

VLAN C ONFIGURATION 3-181 Enabling Pri vate VLANs Use the Priv ate VLAN Status pag e to enable/disable the Priv ate VLAN function. We b – Click VLAN , Priva te VLAN , Status . Select Enabled, and click Apply . Figure 3-79 Private VLAN Status CLI – This example enables p rivat e VLANs . Configuring Uplink and Downlink Ports Use the Priv ate VLAN[...]

C ONFIGURING THE S WITCH 3-182 We b – Click VLAN , Priv ate VLAN , Link Status . Mark the ports that will ser ve as uplinks and downlinks for the pri vate VLAN , then click Apply . Figure 3-80 Private VLAN Link Status CLI – This configures por ts 3 and 4 as uplinks and ports 5 and 6 as downlinks . Configuring Protocol-Based VLANs The network de[...]

VLAN C ONFIGURATION 3-183 T o av oid these problems , you ca n configure this switc h with protocol-based VLANs that divide the physical netw ork into logical VLAN g roups for eac h required protoc ol. W hen a frame is receiv ed at a port, its VLAN membership can th en be deter mined based on the protocol type being used by the inbound pack ets . C[...]

C ONFIGURING THE S WITCH 3-184 We b – Click VLAN , Protocol VLAN, C onfiguration. Enter a protocol g roup ID , frame type and protocol type, then click Apply . Figure 3-81 Protocol VLAN Configuration CLI – The following creates protocol grou p 1, and then specifies Ether net frames with IP and ARP protocol types . Mapping Protocols to VLANs Map[...]

VLAN C ONFIGURATION 3-185 - If the frame is untagged but the pr otocol type does not match, the frame is forwarded to the defa ult VLAN for this interface. Command Attributes • Interface – Port or trunk identifier. • Protocol Group ID – Group identifier of this protocol group. (Range: 1-2147483647) • VLAN ID – VLAN to which matching pr [...]

C ONFIGURING THE S WITCH 3-186 Class of Service Configuration Class of Ser vice (CoS) allo ws you to specify which data pac kets ha ve g reater precedence when traffic is buffered in the switch due to congestion. Th is switch supports CoS wi th eight priority queues for eac h port. Data packets in a port’ s high-pri ority queue will be transmitte[...]

C LASS OF S ER VICE C ONFIGURATION 3-187 • Number of Egress Traffic Class es – The number of qu eue buffers provided for each port. We b – Click Priority , Default Port Priority or Default T r unk Priority . Modify the default priority for any interface, then clic k Apply . Figure 3-83 Default Port Priority CLI – This example assigns a defa[...]

C ONFIGURING THE S WITCH 3-188 Mapping CoS Values to Egress Queues This switch processes Class of Servic e (CoS) priority tag ged traffic by using eight priority queues for each port, with ser vice schedules based on strict or W e ighted R ound Robin (W RR). Up to eight separate traf fic priorities are defined in IEEE 802.1p . T he default priority[...]

C LASS OF S ER VICE C ONFIGURATION 3-189 Command Attributes • Priority – CoS value. (Range: 0-7, where 7 is the highest priority) • Traffic Class 11 – Output queue buffer. (Range: 0-7, where 7 is the highest CoS priority queue) We b – Click Priority , T raffic Classes . Assi gn priorities to the traffic classes (i.e ., output queues) , th[...]

C ONFIGURING THE S WITCH 3-190 Selecting the Queue Mode Y ou can set the switch to service the queues based on a strict r ule that requires all traffic in a higher priori ty queue to be proc essed before lower priority que ues are serv iced, or use W eighted R ound-Robin (WRR) queuing that specifies a relative w eight of each queue . WRR uses a pre[...]

C LASS OF S ER VICE C ONFIGURATION 3-191 Setting the Service Weight for Traffic Classes This switch uses the W eighted Round R obin (WRR) alg orithm to deter mine the frequency at which it ser vice s each priority queue . As described in “Mapping CoS V alues to Eg ress Queues” on page 3-188, the traffic clas ses are mapped to one of the four eg[...]

C ONFIGURING THE S WITCH 3-192 CLI – The following example sho ws how to assign WRR w eights to each of the priority queues . Layer 3/4 Priority Se ttings Mapping Layer 3/4 Prio rities to CoS Values This switch supports several common methods of prioritizing layer 3/4 traffic to meet application requirements . T raffic priorities can be specified[...]

C LASS OF S ER VICE C ONFIGURATION 3-193 Selecting IP Precedence/DSCP Priority The switch allows you to choose betw een using IP Precedence or DSCP priority. Select one of the me thods or disable this feature. Command Attributes • Disabled – Disables both priority services . (This is the default setting.) • IP Precedence – Maps layer 3/4 pr[...]

C ONFIGURING THE S WITCH 3-194 Ser vice v alues (i.e ., Precedence v alue 0 maps to CoS v alue 0, and so forth). Bits 6 and 7 are used for netw ork cont rol, and the other bits for various application types . T oS bits are de fined in the following table. Command Attributes • IP Precedence Priority Table – Shows the IP Precedence to CoS map. ?[...]

C LASS OF S ER VICE C ONFIGURATION 3-195 CLI – The following example globally enables IP Precedence ser vice on the switch, maps IP Precedence valu e 1 to CoS v alue 0 (on port 1), and then displa ys the IP Precedence settings .* * Mapping specific values for IP Precedence is implemented as an interface configuration command, bu t any changes wil[...]

C ONFIGURING THE S WITCH 3-196 Command Attributes • DSCP Priority Table – Shows the DSCP Priority to CoS map. • Class of Service Value – Maps a CoS value to the selected DSCP Priority value. Note that “0” represents low priority and “7” represent high priority. Note: IP DSCP settings apply to all interfaces. We b – Click Priority [...]

C LASS OF S ER VICE C ONFIGURATION 3-197 Note: Mapping specific values for IP DSCP is implemented as an interface configuration command, but any changes will apply to the all interfaces on the switch. Mapping IP Port Priority Y ou can also map network applications to Class of Service values based on the IP port number (i.e ., TCP/UDP port number) i[...]

C ONFIGURING THE S WITCH 3-198 Figure 3-90 IP Port Priority Status Click Priority , IP P or t Priority . Enter the port number for a network application in the IP P ort Number box and the new CoS v alue in the Class of Ser vice box, and then click Apply . Figure 3-91 IP Port Priority CLI – The following example globally enables IP P ort Priority [...]

C LASS OF S ER VICE C ONFIGURATION 3-199 Note: Mapping specific values for IP Port Priority is implemented a s an interface configuration command, but any changes will apply to the all interfaces on the switch. Mapping CoS Values to ACLs Use the A CL CoS Mapping page to set the output queue for pack ets matching an A CL r ule as shown in the follow[...]

C ONFIGURING THE S WITCH 3-200 We b – Click Priority , A CL CoS Priority . Enable mapping for any port, select an A CL from the scroll-down list, then click Apply . Figure 3-92 ACL CoS Priority CLI – This example assi gns a CoS value of zero to pac kets matching ru les within the specified ACL on port 24. Console(config)#interface ethernet 1/24[...]

M ULTICAST F ILTERING 3-201 Multicast Filtering Multicasting is used to support real-time applications such as videoconf erencing or streaming audio . A multicast ser ver does not hav e to establish a separate connection with each client. It merely broadcasts its ser vice to the netw ork, and any hosts that wa nt to receive the multicast regist er [...]

C ONFIGURING THE S WITCH 3-202 Layer 2 IGMP (Snooping and Query) IGMP Snooping and Query — If multicast routing is not supported on other switches in y our network, y ou can use IGMP Snooping and Query (page 3-202) to monitor IGMP ser vice requests passing between m ulticast clients and ser vers , and dynamically c onfigure the switch ports which[...]

M ULTICAST F ILTERING 3-203 • IGMP Querier — A router, or multicast-enabled switch, can periodically ask their hosts if they wa nt to receive multicast traffic. If there is more than one router/ s witch on the LAN performing IP multicasti ng, one of these devices is elec ted “querier” a nd assumes the role of querying the LAN for grou p mem[...]

C ONFIGURING THE S WITCH 3-204 • IGMP Version — Sets the protocol vers ion for compatibility with other devices on the network. (Range: 1-2; Default: 2) Notes: 1. All systems on the subnet must support the same version. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Timeout. We b – Click IGMP Snoopi[...]

M ULTICAST F ILTERING 3-205 Displaying Interfaces Atta ched t o a Mul ticast R outer Multicast routers that are attached to ports on the switch use infor mation obtained from IGMP , along with a mu lticast routing protocol such as D VMRP or PIM, to support IP multicasting across the Internet. These routers may be dynamically discovered b y the swit[...]

C ONFIGURING THE S WITCH 3-206 CLI – This exam ple shows that P or t 11 ha s been statically configured as a port attached to a m ulticast router . Specifying Static Interfaces for a Multicast Router Depending on your netw ork connections, IGMP s nooping may not always be able to locate the IGMP quer ier . Therefore, if the IGMP quer ier is a kno[...]

M ULTICAST F ILTERING 3-207 We b – Click IGMP Snooping, Static Mult icast Router P ort Configuration. Specify the interfaces attached to a m ulticast router , indicate the VLAN which will forward all the corresponding multicast traffic, an d then click Add. After you ha ve finished adding interfaces to the list, click Apply . Figure 3-95 Static M[...]

C ONFIGURING THE S WITCH 3-208 We b – Click IGMP Snooping, IP Multic ast Registration T able. Select a VLAN ID and the IP address for a multicast ser vice from the scroll-down lists . The switch will display all the in terfaces that are propag ating this multicast ser vice. Figure 3-96 IP Multicast Registration Table CLI – This example displays[...]

M ULTICAST F ILTERING 3-209 Command Usag e • Static multicast addresses are never aged out. • When a multicast address is assigned to an interface in a specific VLAN, the corresponding traffic ca n only be forwarded to ports within that VLAN. Command Attribute • Interface – Activates the Port or Trunk scroll down list. • VLAN ID – Selec[...]

C ONFIGURING THE S WITCH 3-210 CLI – This example assigns a multicast address to VLAN 1, and then displays all the known multicast ser vices supported on VLAN 1. Configuring Domain Name Service The Domain Naming System (DN S) ser vice on this switch allows host names to be mapped to IP addresses using static table entries or b y redirection to ot[...]

C ONFIGURING D OMAIN N AME S ER VICE 3-211 • When an incomplete host name is received by the D NS server on this switch and a domain name list has been specified, the switch will work through the domain list, appending each domain name in the list t o the host name, and checking with the sp ecified name servers for a matc h. • When more than on[...]

C ONFIGURING THE S WITCH 3-212 We b – Select DNS, General Configurati on. Set the default domain name or list of domain names , specify one or more name servers to use to use for address resolution, enable domain lookup status , and click Apply . Figure 3-98 DNS General Configuration[...]

C ONFIGURING D OMAIN N AME S ER VICE 3-213 CLI - This example sets a default domain name and a domain list. How ever , remember that if a domain list is specified, the default domain name is not used. Configuring Static DNS Host to Address Entries Y ou can man ually configure stati c entries in the DNS table that are used to map domain names to IP [...]

C ONFIGURING THE S WITCH 3-214 Field Attributes • Host Name – Name of a host device that is mapped to one or more IP addresses. (Range: 1-64 characters) • IP Address – Internet address(es) associat ed with a host name. (Range: 1- 8 addresses) • Alias – Displays the host names that ar e mapped to the sa me address(es) as a previously con[...]

C ONFIGURING D OMAIN N AME S ER VICE 3-215 CLI - This example maps two address to a host name , and then configures an alias host name for the same addresses . Displaying the DNS Cache Y ou can displa y entries i n the DNS cac he that hav e been learned via the designated name ser vers . Field Attributes •N o – The entry num ber for each resour[...]

C ONFIGURING THE S WITCH 3-216 We b – Select DNS , Cache . Figure 3-100 DNS Cache CLI - This example displays all the resource records lear ned from the designated na me ser vers . Console#show dns cache 4-171 NO FLAG TYPE IP TTL DOMAIN 0 4 CNAME 207.46 .134.222 51 www.microsoft.akadns.n et 1 4 CNAME 207.46 .134.190 51 www.microsoft.akadns.n et 2[...]

4-1 C HAPTER 4 C OMMAND L INE I NTERFACE This chapter describes how to use the Command Line Interface (CLI). Using the Command Line Interface Accessing the CLI When accessing the manag ement interf ace for the switch ov er a direct connection to the ser ver’ s console por t, or via a T elnet connection, the switch can be managed by entering comma[...]

C OMMAND L INE I NTERFACE 4-2 After connecting to the system throug h the console port, the login screen displays: Telnet Connection T elnet ope rates over the IP transpor t protocol. In this environment, y our management station and any network de vice you want to manage over the network m ust hav e a valid IP address . V alid IP addresses consist[...]

E NTERING C OMMANDS 4-3 2. At the prompt, enter the user name and system password. The CLI will display the “Vty- n #” prompt for the administra tor to show that you are using privileged access mode (i.e ., Privileged Ex ec), or “Vty- n >” for the guest to sho w that you ar e using nor mal access mode (i.e ., Nor mal Exec), where n ind i[...]

C OMMAND L INE I NTERFACE 4-4 • To enter multiple commands, enter each command in the required order. For example, to enable Privileged Exec comm and mode, and display the startup c onfiguration, enter: Console> enable Console# show startup-config • To enter commands that require pa rameters, enter the required parameters after the command k[...]

E NTERING C OMMANDS 4-5 Showing Commands If you enter a “?” at the command prompt, the system will display the first level of ke ywords for the current comm and class (Nor mal Exec or Privileged Exec) or configuration cla ss (Global, A CL, Interface, Line, VLAN Database, or MSTP). Y ou can also display a list of v alid keyw ords for a specific [...]

C OMMAND L INE I NTERFACE 4-6 The command “ show interfaces ? ” will display the following informati on: Partial Keyword Lookup If you t er minate a partial keyword with a question mark, alt er nativ es that match the initial letters are pro vided. (Remember not to leave a space between the command and question mark.) F or example “ s? ” sh[...]

E NTERING C OMMANDS 4-7 Understanding Command Modes The command se t is divided into Ex ec and Configuration classes . Exec commands generally display infor mation on system status or clear statistical counters . Configuration commands, on the other hand, modify interface para meters or enable cert ain switc hing functions. These classes are furthe[...]

C OMMAND L INE I NTERFACE 4-8 Privileged Exec mode from within Nor mal Exec mode, by entering the enab le command, followed by the pri vileg ed level passw ord “super” (page 4-36). T o enter Privileged Exec mode, enter the follo wing user names and passwords : Configuration Commands Configuration commands are privilege d level commands used to [...]

E NTERING C OMMANDS 4-9 • Line Configuration - These commands modify the console port and Telnet configuration, and include com mand such as parity and databits . • VLAN Configuration - Includes the command to create VLAN groups. • Multiple Spanning Tree Configur ation - These commands configur e settings for the selected multiple spanning tr[...]

C OMMAND L INE I NTERFACE 4-10 For example, you can use the followi ng commands to enter interface configuration mode, and then retu rn to Privileged Exec mode. Command Line Processing Commands are not case sensitiv e. Y ou can abbreviate commands and parameters as long as they contain e nough le tters to differ entiate them from any other cur rent[...]

C OMMAND G RO U PS 4-11 Command Groups The system commands can be broken do wn into the functional g roups shown belo w . Table 4-4 Command Group Index Command Group Description Page Line Sets communication param e ters for the serial port and Telnet, including b aud rate and console time-out 4-13 General Basic commands for ente ring privileged acc[...]

C OMMAND L INE I NTERFACE 4-12 The acce ss mode shown in the following tables is indicated by these abbreviations: ACL (Access Control List Configuration) GC (Global Configuration) IC (Interface Configuration) LC (Line Configuration) NE (Nor mal Exec) MST (Multiple Spanning T ree) PE (Privileged Exec) VC (VLAN Database Configuration) Address Tabl e[...]

L INE C OMMANDS 4-13 Line Commands Y ou can access the onboard configurat ion program by attaching a VT100 compatible device to the server’ s serial port. These commands are used to set communication parameters for the se rial port or T elnet (i.e., a vir tual ter minal) . Table 4-5 Line Command Syntax Command Function Mode Page line Identifies a[...]

C OMMAND L INE I NTERFACE 4-14 line This command id entifies a specific lin e for configuration, and to process subsequent line configuration commands . Syntax line { console | vty } • console - Console te rminal li ne. • vty - Virtual terminal for remote console access (i.e., Telnet). Default Setting There is no default line. Command Mode Glob[...]

L INE C OMMANDS 4-15 login This command e nables passw ord checking at login. Use the no form to disable password checking and allo w connections without a passw ord. Syntax login [ local ] no login local - Selects local passw ord chec ki ng . Authentication is based on the user name specified with the username command. Default Setting login local [...]

C OMMAND L INE I NTERFACE 4-16 Example Related Commands username (4-34) password (4-16) password This command spec ifies the password for a line. Use the no for m to remov e the password. Syntax passw ord { 0 | 7 } password no pass word •{ 0 | 7 } - 0 means plain password, 7 means encrypted password • password - Character string that specifies [...]

L INE C OMMANDS 4-17 Example Related Commands login (4-15) passw ord-thresh (4-19) timeout login response This command sets the inter val that the system waits for a user to log into the CLI. Use the no for m to restore the default setting . Syntax timeout login response [ seconds ] no timeout login response seconds - Integer that specifies the tim[...]

C OMMAND L INE I NTERFACE 4-18 exec-timeout This command sets the inter val that the system waits until user input is detected. Use the no for m to restore the default. Syntax exec-timeout [ seconds ] no exec-timeout seconds - Integer that specifies the number of seconds . (Range: 0 - 65535 seconds; 0: no timeout) Default Setting CLI: No timeout T [...]

L INE C OMMANDS 4-19 password-thresh This command sets the password intr usion threshold which limits the number of failed logon attempts. Use the no form to remove the threshold val u e. Syntax passw ord-thresh [ thr eshold ] no pass word-thresh thre shold - The number of allowe d password attempts . ( R a n g e :1 - 1 2 0 ;0 :n o t h r e s h o l [...]

C OMMAND L INE I NTERFACE 4-20 silent-time This command sets the amount of time the management console is inaccessible after the number of unsuccessful log on attempts exceeds the threshold set by the pass word-thresh command. Use the no for m to re mo ve t he si le nt t im e va lu e. Syntax silent-time [ seconds ] no silent-time seconds - The numb[...]

L INE C OMMANDS 4-21 Default Setting 8 data bits per character Command Mode Line Configuration Command Usage The databits command can be used to mask the high bit on input from devices that generate 7 data bi ts with parity . If parity is being generated, specify 7 data bits per ch aracter . If no parity is require d, specify 8 data bits per cha ra[...]

C OMMAND L INE I NTERFACE 4-22 Command Usage Communication protocols pro vided by devices such as terminals and modems often require a specific parity bit setting . Example T o specify no parity , enter this command: speed This command sets the ter minal line ’ s baud rate . T his command sets both the transmit (to ter minal) and receive (from te[...]

L INE C OMMANDS 4-23 Example T o specify 57600 bps , enter this command: stopbits This command sets the number of the s top bits transmitted per byte . Use the no for m to restore the defa ult setting . Syntax stopbits { 1 | 2 } • 1 - One stop bit • 2 - Two stop bits Default Setting 1 stop bit Command Mode Line Configuration Example T o specify[...]

C OMMAND L INE I NTERFACE 4-24 Command Usage Specifying session identifier “0” will disconnect the console connection. Specifying any other id entifiers for an activ e session will disconnect an SSH or T elnet connection. Example Related Commands show ssh (4-54) show users (4-81) show line This comm and displays the te r minal li ne’ s parame[...]

G ENERAL C OMMANDS 4-25 Example T o show all lin es, enter this command: General Commands Console#show line Console configuration: Password threshold: 3 times Interactive timeout: Disabled Login timeout: Disabled Silent time: Disabled Baudrate: auto Databits: 8 Parity: none Stopbits: 1 VTY configuration: Password threshold: 3 times Interactive time[...]

C OMMAND L INE I NTERFACE 4-26 enable This command ac tiv ates Privileged Exec mode. In privileged mode, additional commands are a vailable , and certain comm ands display additional infor mation. (See “Und erstanding Command Modes” on page 4-7.) Syntax enable [ le vel ] level - Privilege level to log into the device. The device has tw o predef[...]

G ENERAL C OMMANDS 4-27 disable This command retur ns to Nor mal Exec mode from privileged mode. In nor mal access mode, y ou can only di splay basic information on the switch's configuration or Ethernet statistics . T o gain access to all commands, y ou must use the privileged mode. (See “Understanding Command Modes” on page 4-7.) Default[...]

C OMMAND L INE I NTERFACE 4-28 Example Related Commands end (4-29) show history This command shows the contents of the command histor y buffer. Default Setting None Command Mode Nor mal Exec , Privileged Exec Command Usage The histor y buffer size is fixed at 10 Ex ecution commands and 10 Configuration commands . Example In this example, the sho w [...]

G ENERAL C OMMANDS 4-29 The ! command repeats commands from the Execution command history buffer when y ou are in Normal Exec or Pr ivileged Exec Mode, and commands from the Configuration co mmand h istor y buffer when y ou are in any of the configuration mo des . In this example, the !2 command repeats the second command in the Ex ecution histor y[...]

C OMMAND L INE I NTERFACE 4-30 Command Mode Global Configuration, Interface Conf iguration, Line Configuration, VLAN Database Configuration, and Multiple Spanning T ree Configuration. Example This example shows how to return to the Privileged Exec mode from the Interface Configuration mode: exit This comm and returns to the previous configuration m[...]

S YSTEM M ANAGEMENT C OMMANDS 4-31 Command Mode Nor mal Exec , Privileged Exec Command Usage The quit and exit commands can both exit the configuration program. Example This example shows ho w to quit a CLI session: System Management Commands These commands are use d to control sy stem logs , passwords , user names, browser configuration options , [...]

C OMMAND L INE I NTERFACE 4-32 Device Designation Commands prompt This command customizes the CLI prompt. Use the no for m to restore the default prompt. Syntax prompt string no prompt string - Any alphanumeric string to use for the CLI prompt. (Maximum length: 255 characters) Default Setting Console Command Mode Global Configuration System Status [...]

S YSTEM M ANAGEMENT C OMMANDS 4-33 Example hostname This command spec ifies or modifies th e host name for this d evice. Use t he no for m to restore the defaul t host name. Syntax hostname name no hostname name - The name of this host. (Maximum len gth: 255 characters) Default Setting None Command Mode Global Configuration Example switch renumber [...]

C OMMAND L INE I NTERFACE 4-34 Example This example shows how to renumber all units . User Access Commands The basic comm ands required for management access are listed in this section. This sw itch also includes ot her options for password chec king via the console or a T elnet connection (p age 4-13), user authentication via a remote authenticati[...]

S YSTEM M ANAGEMENT C OMMANDS 4-35 • password password - The au thentication password for the user. (Maximum l ength: 8 char acters plain t ext, 32 encr ypted, case sensitive) Default Setting • The default access level is Normal Exec. • The factory defaults for the user names and passwords are: Command Mode Global Configuration Command Usage [...]

C OMMAND L INE I NTERFACE 4-36 enable password After initially log ging onto the syste m, you should set the Pri vileg ed Exec password. R emember to record it in a safe place . This command controls access to the Privileged Exec lev el from the Nor mal Exec level. Use the no for m to reset the default passw ord. Syntax enable pass word [ lev el le[...]

S YSTEM M ANAGEMENT C OMMANDS 4-37 Related Commands enable (4-26) authentication enable (4-93) IP Filter Commands management This command spec ifies the client IP address es that are al low ed management access to the switch th rough various protocols . Use the no for m to restore the default setting . Syntax [ no ] mana gement { all-client | http-[...]

C OMMAND L INE I NTERFACE 4-38 Command Usage • If anyone tries to access a manageme nt interface on the switch from an invalid address, the switch will re ject the connection, enter an event message in the system log, and se nd a trap message to the trap manager. • IP address can be configured fo r SNMP, web and Telnet access respectively. Each[...]

S YSTEM M ANAGEMENT C OMMANDS 4-39 Command Mode Privileged Exec Example Web Server Commands Console#show management all-client Management IP Filter HTTP-Client: Start IP address End IP address --------------------------------------- -------- 1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 SNMP-Client: Start IP address End IP address -----[...]

C OMMAND L INE I NTERFACE 4-40 ip http port This command spec ifies the TCP port number used by the web bro wser interface. Use the no form to use the default port. Syntax ip http por t port-number no ip http por t port-number - T h e T C P p o r t t o b e u s e d b y t h e b r o w s e r i n t e r f a c e . (Range: 1-65535) Default Setting 80 Comma[...]

S YSTEM M ANAGEMENT C OMMANDS 4-41 Example Related Commands ip http port (4-40) ip http secure-server This command enables the secure hy pert ext transfer protocol (HTTPS) ov er the Secure Soc ket La yer (SSL), pr oviding secu re access (i.e ., an encr ypted connection) to the switch’ s web interface. Use the no form to disable this function. Syn[...]

C OMMAND L INE I NTERFACE 4-42 • The client and server establish a secure encrypted connection. A padlock icon should appear in the status bar for Internet Explorer 5.x and Netscape Navigator 6.2 or later versions. • The following web browsers and operating systems currently support HTTPS: • To specify a secure-site certific ate, see “Repla[...]

S YSTEM M ANAGEMENT C OMMANDS 4-43 Default Setting 443 Command Mode Global Configuration Command Usage • You cannot configure the HTTP an d HTTPS servers to use the same port. • If you change the HTTPS port number , clients attempting to connect to the HTTPS server must specify the port number in the URL, in this format: https:// device : port_[...]

C OMMAND L INE I NTERFACE 4-44 Default Setting Enabled Command Mode Global Configuration Example ip telnet server port This comm and specifies the TCP port number used by the T elnet interface. Use the no form to use the default port. Syntax [ no ] ip telnet ser ver por t [ port-number ] port-number - T h e T C P p o r t t o b e u s e d b y t h e b[...]

S YSTEM M ANAGEMENT C OMMANDS 4-45 The Secure Shell (SSH) includes ser ver /client applications intended as a secure replacement for t he older Berkley remote access tools . SSH can also provide remote management access to this switch as a secure replacem ent for T elnet. When a client contacts the switch via the SSH prot ocol, the switch uses a pu[...]

C OMMAND L INE I NTERFACE 4-46 The SSH ser ver on this switch supports both passw ord and public key authentication. If passw ord authentication is specified b y the SSH client, then the password can be a uthenticate d either locally or via a RADIUS or T AC ACS + remote authentication ser ver , as specified by the authentication login command on pa[...]

S YSTEM M ANAGEMENT C OMMANDS 4-47 10.1.0.54 1024 35 156849954018 6766925933394 6775054617325313 67489083654725 4 1502024559 31998685443583 61651999923329 781766065830956 10 8259132128902 33 7654680172 62725714134287 62941301196195 566782 59566410486 9574278881462 06 5194174677 29848654686157 17739390164779 3559423035774130 98022737087794 545240839[...]

C OMMAND L INE I NTERFACE 4-48 d. The client uses its private k ey to decr ypt the bytes , and sends the decr ypted bytes back to the switc h. e. The switch compares the decrypted bytes to the original bytes it sent. If the tw o sets match, t his means that the client's pri vate k ey cor responds to an authorized public key , and the client is[...]

S YSTEM M ANAGEMENT C OMMANDS 4-49 Example Related Commands ip ssh crypto host-key generate (4-51) show ssh (4-54) ip ssh timeout This command configur es the timeout for the SSH ser ver . Use the no for m to restore the default setting . Syntax ip ssh timeout seconds no ip ssh timeout seconds – The timeout for client resp onse during SSH negotia[...]

C OMMAND L INE I NTERFACE 4-50 ip ssh authentication-retries This command configures the number of times the SSH server attempts to reauthenticate a user . Use the no for m to re store the default set ting . Syntax ip ssh authentication-retries count no ip ssh authentication-retries count – The number of authentication attempts pe r mitted after [...]

S YSTEM M ANAGEMENT C OMMANDS 4-51 Command Usage • The server key is a privat e key that is never shared outside the switch. • The host key is shared with the SS H client, and is fixed at 1024 bits. Example delete public-key This comm and deletes the specified user’ s public key . Syntax delete public-key user name [ dsa | rsa ] • username [...]

C OMMAND L INE I NTERFACE 4-52 Command Mode Privileged Exec Command Usage • This command stores the host key pair in memory (i.e., RAM). Use the ip ssh save host-key command to save the host key pair to flash memory. • Some SSH client programs automati cally add the public key to the known hosts file as part of the c onfiguration process. Other[...]

S YSTEM M ANAGEMENT C OMMANDS 4-53 Command Usage • This command clears the host key fr om volatile memory (RAM). Use the no ip ssh save host-key command to clear the host key from flash memory. • The SSH server must be disabl ed before you can execute this command. Example Related Commands ip ssh crypto host-key generate (4-51) ip ssh sav e hos[...]

C OMMAND L INE I NTERFACE 4-54 show ip ssh This command displays the connection settings used when authenticating client access to the SSH ser ver . Command Mode Privileged Exec Example show ssh This command displ ays the current SSH server connec tions . Command Mode Privileged Exec Example Console#show ip ssh SSH Enabled - version 1.99 Negotiatio[...]

S YSTEM M ANAGEMENT C OMMANDS 4-55 show public-key This command shows the public k ey fo r the specified user or for the host. Syntax show public-k ey [ user [ user name ]| host ] user name – Name of an SSH us er . (Range: 1-8 characters) Default Setting Shows all public k eys. Encryption The en cryption method is au tomatically negotiated betwee[...]

C OMMAND L INE I NTERFACE 4-56 Command Mode Privileged Exec Command Usage • If no parameters are entered, all keys are displayed. If the user keyword is entered, but no user name is spec ified, then the public keys for all users are displayed. • When an RSA key is displayed, the first field indicates the size of the host key (e.g., 1024), the s[...]

S YSTEM M ANAGEMENT C OMMANDS 4-57 logging on This command controls log ging of er ror messag es , sending debug or er ror messages to switch memor y . T he no for m disables the log ging process . Syntax [ no ] logging on Default Setting None Command Mode Global Configuration Command Usage The log g ing process controls error messag es sav ed to s[...]

C OMMAND L INE I NTERFACE 4-58 logging history This command limits syslog messages sav ed to switch memo r y based on severity . The no for m retur ns the log ging of syslog messages to the default level. Syntax log ging histor y { fl a s h | ram } level no log ging histor y { fl as h | ram } • flash - Event history stored in fl ash memory (i.e.,[...]

S YSTEM M ANAGEMENT C OMMANDS 4-59 Command Mode Global Configuration Command Usage The me ssage level specified for f lash memor y must be a higher priority (i.e., numerically low er) than that specified for RAM. Example logging host This comm and adds a syslog ser ver host IP address that will receive log ging messag es . Use the no for m to remov[...]

C OMMAND L INE I NTERFACE 4-60 logging facility This command sets the facili ty type fo r remote log ging of syslog messages . Use the no form to return the type to the default. Syntax [ no ] log ging facility type type - A number that indicates the facility used by the syslog ser ver to dispatch log messag es to an appropriate ser v ice. (Range: 1[...]

S YSTEM M ANAGEMENT C OMMANDS 4-61 logging trap This command enables the log ging of system messages to a remote ser ver , or limits the syslog messages sav ed to a remote ser ver based on severity . Use this command withou t a specified le vel to enable remote log ging . Use the no for m to disable remote log ging. Syntax log ging trap [ level ] n[...]

C OMMAND L INE I NTERFACE 4-62 clear log This command c lears messages from the log buffer . Syntax clear log [ fl as h | ram ] • flash - Event history stored in fl ash memory (i.e., permanent memory). • ram - Event history stored in temporary RAM (i .e., memory flushed on power reset). Default Setting Flash and RAM Command Mode Privileged Exec[...]

S YSTEM M ANAGEMENT C OMMANDS 4-63 Default Setting None Command Mode Privileged Exec Example The following example shows that system logg ing is enabled, the message level for flash memor y is “er rors” (i.e ., default level 3 - 0), and the message level for RAM is “debug ging” (i.e., default lev el 7 - 0). The following example displays se[...]

C OMMAND L INE I NTERFACE 4-64 Related Commands show log ging sendmail (4-69) show log This command di splays the log messages stored in local m emor y . Syntax show log { fl a s h | ram } • flash - Event history stored in fl ash memory (i.e., permanent memory). • ram - Event history stored in temporary RAM (i .e., memory flushed on power reset[...]

S YSTEM M ANAGEMENT C OMMANDS 4-65 Example The following exam ple shows the e vent message stored i n RAM. SMTP Alert Commands These commands config ure SMTP ev ent handling, and forwarding of alert messages to the specified SMTP ser vers and email recipients . Console#show log ram [1] 00:01:30 2001-01-01 "VLAN 1 link-up notification." le[...]

C OMMAND L INE I NTERFACE 4-66 logging sendmail host This command specifies SMTP ser vers t hat will be sent alert messages. Use the no form to remo ve an SMTP ser ver . Syntax [ no ] log ging sendmail host ip_addr ess ip_address - I P a d d r e s s o f a n S M T P s e rv e r t h a t w i l l b e s e n t a l e r t messages for event handling . Defau[...]

S YSTEM M ANAGEMENT C OMMANDS 4-67 logging sendmail level This command sets the severity threshold used to trig ger aler t messages. Syntax log ging sendmail level level level - One of the system message le ve ls (p ag e 4- 58 ). Me ss ag es s e nt include the selected level down to lev el 0. (Rang e: 0-7; Default: 7) Default Setting Level 7 Comman[...]

C OMMAND L INE I NTERFACE 4-68 Command Mode Global Configuration Command Usage Y ou may use an symbolic email address that identifies the switch, or the address of an administrator responsible for the switch. Example This example will send email aler ts for system error s from level 3 through 0 . logging sendmail destination-email This command spec[...]

S YSTEM M ANAGEMENT C OMMANDS 4-69 logging sendmail This command e nables SMTP event handling . Use the no for m to disable this function. Syntax [ no ] logging sendmail Default Setting Enabled Command Mode Global Configuration Example show logging sendmail This comm and displays the settin gs for the SMTP event handler . Command Mode Nor mal Exec [...]

C OMMAND L INE I NTERFACE 4-70 Time Commands The system clock can be dynamically se t by polling a set of specified time ser vers (NTP or SNTP). Maintaining an accura te time on the switch enables the s ystem log to recor d meaningful dates and times for ev ent entries . If the clock is not set, the switch will only record the time from the factor [...]

S YSTEM M ANAGEMENT C OMMANDS 4-71 Command Usage • The time acquired from time servers is used to record accu rate dates and times for log events. Without SNTP, t he switch only record s the time starting from the factory default set at the last bootup (e.g., 00:00:00, Jan. 1, 2001). • This command enables cli ent time requests to time servers [...]

C OMMAND L INE I NTERFACE 4-72 Command Mode Global Configuration Command Usage This command speci fies time ser vers from which the switch will poll for time updates when set to SNTP clie nt mode. The client will poll the time ser vers in the orde r specified unt il a response is re ceiv ed. It issues time synchronization requests ba sed on the int[...]

S YSTEM M ANAGEMENT C OMMANDS 4-73 Related Commands Re lated Commands (4-71) show sntp This command di splays the current ti me and configuration settings for the SNTP client, and indicates whether or not the local time has been properly updated. Command Mode Nor mal Exec , Privileged Exec Command Usage This command displays the cur rent time, the [...]

C OMMAND L INE I NTERFACE 4-74 Default Setting None Command Mode Global Configuration Command Usage This command sets the local time zone relativ e to the Coordinated Univ ersal Time ( UTC, formerly Greenwic h Mean Time or GMT) , based on the earth’ s prime meridian, zero deg rees longitude. T o display a time cor responding to your lo cal ti me,[...]

S YSTEM M ANAGEMENT C OMMANDS 4-75 Default Setting None Command Mode Privileged Exec Example This example shows ho w to set the syst em clock to 15:12:34, F ebr uar y 1st, 2002. show calendar This command displa ys the system cloc k. Default Setting None Command Mode Nor mal Exec , Privileged Exec Example Console#calendar set 15 12 34 1 Februar y 2[...]

C OMMAND L INE I NTERFACE 4-76 System Status Commands show startup-config This command displays the configuration file stored in non-volatile memor y that is used to s tar t up the system. Default Setting None Command Mode Privileged Exec Command Usage • Use this command in conjunction with the show running-config command to compare the inform at[...]

S YSTEM M ANAGEMENT C OMMANDS 4-77 - Users (names and access levels) - VLAN database (VLAN ID, name and state) - VLAN configuration settings for each interface - Multiple spanning tr ee instances (name and interfaces) - IP address configured for the switch - Spanning tree settings - Any configured settings for the console port and Telnet Example Re[...]

C OMMAND L INE I NTERFACE 4-78 Command Mode Privileged Exec Command Usage • Use this command in conjunction with the show startup-config command to compare the inform ation in running memory to the information stored in non-volatile memory. • This command displays settings for key command mod es. Each mode group is separated by “!” symbols,[...]

S YSTEM M ANAGEMENT C OMMANDS 4-79 Example Related Commands show startup-config (4-76) Console#show running-config building running-config, please wait... .. !<stackingDB>0000000000000000</stacking DB> !<stackingMac>01_00-30-f1-df-9c-a0_00</ stackingMac> !<stackingMac>00_00-00-00-00-00-00_00</ stackingMac> !<s[...]

C OMMAND L INE I NTERFACE 4-80 show system This command di splays system infor mation. Default Setting None Command Mode Nor mal Exec , Privileged Exec Command Usage • For a description of the items sh o wn by this command, refer to “Displaying System Info rmation” on page 3-12. • The POST results should all displa y “PASS.” If any POST[...]

S YSTEM M ANAGEMENT C OMMANDS 4-81 show users Shows all activ e console and T elnet se ssions , including user name, idle time, and IP address of T elnet client. Default Setting None Command Mode Nor mal Exec , Privileged Exec Command Usage The session used to execute this command is indicated by a “*” symbol next to the Line (i.e., ses sion) i[...]

C OMMAND L INE I NTERFACE 4-82 Command Mode Nor mal Exec , Privileged Exec Command Usage See “Displaying Switch Hardware/S oftware V ersions” on pag e 3-14 for detailed infor mation on the items displayed by this command. Example Frame Size Commands jumbo fram e This command enables support for jumbo frames . Use the no for m to disable it. Syn[...]

S YSTEM M ANAGEMENT C OMMANDS 4-83 Command Mode Global Configuration Command Usage • This switch provides more efficient throu ghput for large seq uential data transfers by supporting ju mbo frames up to 9216 bytes. Compared t o standard Ethernet fr ames that run only up to 1.5 KB, using jumbo frames significantly reduce s the per-packet overhead[...]

C OMMAND L INE I NTERFACE 4-84 Flash/File Commands These commands are used to manag e the system code or configuration files . copy This comm and moves (upload/download ) a code image or configuration file between the switc h’ s flash memor y and a TFTP ser ver . When you sa ve the system code or configuration settin gs to a file on a TFTP ser ve[...]

F LASH /F ILE C OMMANDS 4-85 • https-certificate - Keyword that allows you to copy the HTTPS secure site certificate. • public-key - Keyword that allows you to copy a SSH key from a TFTP server. (See “Secure Shell Commands” on page 4-44.) • unit - Keyword that allows you to copy to/from a specific unit in the stack. Default Setting None C[...]

C OMMAND L INE I NTERFACE 4-86 Example The following exam ple shows ho w to up load the configuration settings to a file on the TFTP ser ver : The foll owing example shows how to c opy the running configuration to a startup file. The following example shows ho w to download a configuration file: This example sho ws how to copy a secure-site certifi[...]

F LASH /F ILE C OMMANDS 4-87 This example shows how to copy a pub li c - k e y u s e d by S S H f r o m a n T F T P ser ver . Note that public k ey authentication via SSH is only supported for users configured locally on the switch. delete This command de letes a file or image. Syntax delete [ unit :] filename filename - Name of the configuration f[...]

C OMMAND L INE I NTERFACE 4-88 Example This example shows ho w to delete th e test2.cfg configuration file from flash memor y . Related Commands dir (4-88) delete public-key (4-51) dir This command di splays a list of files in flash memor y . Syntax dir [ unit :] [ boot-rom | config | opcode [: filename ]] The type of file or image to display inclu[...]

F LASH /F ILE C OMMANDS 4-89 Command Usage • If you enter the command dir without any parameters, the system displays all files. • A colon (:) is required after the specified unit num ber. • File information is shown below: Example The following example shows ho w to display all file infor mation. whichboot This command displays which files w[...]

C OMMAND L INE I NTERFACE 4-90 Command Mode Privileged Exec Example This example shows the information displa yed by the whichboot command. See the table u nder the dir command for a description of the file infor mation displayed by this command. boot system This command specifies the image used to star t up the system. Syntax boot system [ unit :][...]

A UTHENTICATION C OMMANDS 4-91 Example Related Commands dir (4-88) whichboot (4-89) Authentication Commands Y ou can configur e this switch t o authenticate users log ging into the system for management ac cess using local or remote authentication methods . Y ou can also enable port-based authentica tion for netw ork client access using IEEE 802.1X[...]

C OMMAND L INE I NTERFACE 4-92 authentication login This command defines the login authentication method and precedence . Use the no for m to restore the default. Syntax authentication login {[ local ] [ radius ] [ tacacs ]} no authentication login • local - Use local password. • radius - Use RADIUS server password. • tacacs - Use TACACS serv[...]

A UTHENTICATION C OMMANDS 4-93 Example Related Commands username - for setting the local user names and passwords (4-34) authentication enable This command defines th e authentication met hod and precedence to use when changing from Exec command mode to Privileged Exec command mode with the enable command (see page 4-2 6). Use the no for m to resto[...]

C OMMAND L INE I NTERFACE 4-94 • You can specify three authen ticati on methods in a single command to indicate the authentication sequence . For example, if you enter “ authentication enable radius tacacs local ,” the user na me and password on the RADIUS server is verified first. If the RADIUS server is not a vailable, then aut hentication [...]

A UTHENTICATION C OMMANDS 4-95 radius-server host This command spec ifies primar y and backup RADIUS ser vers and authentication parameters that apply to each server . Use the no for m to restore th e default v alues . Syntax [ no ] radius-ser ver index host { host_ip_addr ess | host_alias } [ auth-por t auth_port ] [ timeout timeout ] [ retra nsmi[...]

C OMMAND L INE I NTERFACE 4-96 radius-server port This command sets the RADIUS ser ver netw ork port. Use the no for m to restore the default. Syntax radius-ser ver por t port_number no radius-ser ver port port_number - RADIUS ser ver UDP port used for authe ntication messages. (Ran g e: 1-65535) Default Setting 1812 Command Mode Global Configurati[...]

A UTHENTICATION C OMMANDS 4-97 Example radius-server retransmit This command sets the number of retries . Use the no for m to re store the default. Syntax radius-ser ver retransmit number_of_retries no radius-ser ver retransmit number_of_retries - Number of times the switch will tr y to authenticate log on access via th e RADIUS ser ver . (Rang e: [...]

C OMMAND L INE I NTERFACE 4-98 Command Mode Global Configuration Example show radius-server This command di splays the current settings for the RADIUS ser ver . Default Setting None Command Mode Privileged Exec Example TACACS+ Client T er minal Acc ess Controller Access Control System (TA CACS+) is a log on authentication protocol that uses soft w [...]

A UTHENTICATION C OMMANDS 4-99 tacacs-server host This command spec ifies the T A CA CS+ ser ve r . Use the no fo r m t o r e s t o r e the default. Syntax tacacs-ser ver host host_ip_address no ta cacs-server h ost host_ip_address - IP addres s of a TA CA CS+ se r ver . Default Setting 10.11.12.13 Command Mode Global Configuration Example Table 4-[...]

C OMMAND L INE I NTERFACE 4-100 tacacs-server port This command spec ifies the T A CA CS+ ser ver network port. Use the no for m to restore the default. Syntax tacacs-ser ver por t port_number no tacacs-ser ver por t port_number - TA CACS+ server TCP por t used for authentication messages. (Ran g e: 1-65535) Default Setting 49 Command Mode Global C[...]

A UTHENTICATION C OMMANDS 4-101 Example show tacacs-server This command di splays the current settings for the TA CACS + ser ver . Default Setting None Command Mode Privileged Exec Example Port Security Commands These commands can be used to enable port security on a por t. When using port security , the switch stops learning new MAC addresses on t[...]

C OMMAND L INE I NTERFACE 4-102 port security This command enables or configur es por t security . Use the no for m without any keyw ords to disable port security . Use the no for m with the appropriate keyw ord to restore the default settings for a response to security violation or for the maxi mum nu mber of allowed addresses . Syntax por t secur[...]

A UTHENTICATION C OMMANDS 4-103 Command Usage • If you enable port security, the switch stops learning new MAC addresses on t he specified po rt wh en it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dy namic or st atic address table will be accepted. • First use the port security max[...]

C OMMAND L INE I NTERFACE 4-104 802.1X Port Authentication The switch supports IEEE 802.1X (dot1x ) por t-based access control that prevents unauthorized access to the netw ork by requiring users to first submit credentials for au thentication. Client authentication is controlled centrally by a RADIUS ser ver using EAP (Extensible A uthentication P[...]

A UTHENTICATION C OMMANDS 4-105 dot1x system-auth-control This command enables IEE E 802.1X por t authentication globally on the switch. Use the no form to restore the default. Syntax [ no ] dot1x system-auth-control Default Setting Disabled Command Mode Global Configuration Example dot1x default This comm and sets all configurable do t1x global an[...]

C OMMAND L INE I NTERFACE 4-106 dot1x max-req This command sets the maximum number of times the switch port will retransmit an EAP request/i dent ity pack et to the clie nt before it times out the authentica tion session. Use the no for m to restore the default. Syntax dot1x max-req count no dot1x max-req count – The maximum number of requests (R[...]

A UTHENTICATION C OMMANDS 4-107 Default force-authorized Command Mode Interface Configuration Example dot1x operation-mode This command allows single or multiple hosts (cli ents) to connect to an 802.1X-authorized port. Use the no for m with no keyw ords to restore the default to single host. Use the no f or m with the multi-host max-count keyw ord[...]

C OMMAND L INE I NTERFACE 4-108 • In “multi-host” mode, only one host connected to a port needs to pass authentication for all other hosts to be gra nted network access. Similarly, a port can beco me unauthorized for all hosts if one attached host fails re-authentication or sends an EAPOL logoff message. Example dot1x re-authenticate This com[...]

A UTHENTICATION C OMMANDS 4-109 Example dot1x timeout quiet-period This co mmand sets the time that a swit ch port waits after the Max Request Count has been exceeded before attemp ting to acquire a new client. Use the no for m to reset the default. Syntax dot1x timeout quiet-period seconds no dot1x timeout quiet-period seconds - T he number of sec[...]

C OMMAND L INE I NTERFACE 4-110 Command Mode Interface Configuration Example dot1x timeout tx-peri od This command sets the time that the switch waits during an authentica tion session before re-transmittin g an EAP packet. Use the no form to re set to the default value . Syntax dot1x timeout tx-period seconds no dot1x timeout tx-period seconds - T[...]

A UTHENTICATION C OMMANDS 4-111 •i n t e r f a c e • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) Command Mode Privileged Exec Command Usage This command displays the following infor mation: • Global 802.1X Parameters – Shows whether or not 802.1X port authentication is globall y enabled on t[...]

C OMMAND L INE I NTERFACE 4-112 - Port-control –Shows the dot1x mode on a port as auto , force-authorized, or force- unauthorized (page 4-106). - Supplicant – MAC address of authorized client. - Current Identifier – The in teger (0-255) used by the Authenticator to identify the current authentication session. • Authentic ator State Mach ine[...]

A UTHENTICATION C OMMANDS 4-113 Example Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status Operation Mode Mode Au thorized 1/1 disabled Single-Host ForceAuthorized n/a 1/2 disabled Single-Host ForceAuthorized n/a . . . 1/25 disabled Single-Host ForceAuthorized yes 1/26 enabled Single-Host Au[...]

C OMMAND L INE I NTERFACE 4-114 Access Control List Commands Access Control Lists (A CL) provide pack et filtering for IP frames (based on address , protocol, Layer 4 proto col por t number or TCP control code) or any frames (based on MAC address or Ethernet type). To filter packets, first create an access list, add the required rules, specify a ma[...]

A CCESS C ONTR OL L IST C OMMANDS 4-115 The following restrictions apply to A CLs: • This switch supports ACLs for both ingress and egress f iltering. However, you can only bind one IP ACL and one MAC ACL to any port for ingress filtering, and one IP ACL and one MAC ACL to any port for egress filtering. In other wo rds, only four ACLs can be boun[...]

C OMMAND L INE I NTERFACE 4-116 Masks for Access Control Lists Y ou must specify optional masks that control the order in which A CL r ules are check ed. T he switch includes two system defa ult masks that pass/ filter packets matc hing the per mit/den y r ules specified in an ingress ACL. Y ou can also configure up to seven user-defined masks for [...]

A CCESS C ONTR OL L IST C OMMANDS 4-117 access-list ip This command adds an IP access list and enters configurat ion mode for standard or extend ed IP AC Ls . Use the no for m to remove the specified AC L . Syntax [ no ] access-list ip { standard | extended } acl_na me • standard – Specifies an ACL that filters packets based on the source IP ad[...]

C OMMAND L INE I NTERFACE 4-118 Default Setting None Command Mode Global Configuration Command Usage • An egress ACL must c ontain all deny rules. • When you create a new ACL or en ter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To cr eate an ACL, you must add at least one r[...]

A CCESS C ONTR OL L IST C OMMANDS 4-119 Default Setting None Command Mode Standard A CL Command Usage • New rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match” and 0 bits to indicate “[...]

C OMMAND L INE I NTERFACE 4-120 permit , deny (Extended ACL) This command adds a r ule to an Extended IP A CL. T he r ule sets a filter condition for packets with specific so urce or destination IP addresses, protocol types , source or destination protocol ports, or TCP control codes. Use the no f o rm to re mo v e a ru le . Syntax [ no ] { per mit[...]

A CCESS C ONTR OL L IST C OMMANDS 4-121 Command Mode Extended A CL Command Usage • All new rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match” and 0 bits to indicate “ignore.” The bi[...]

C OMMAND L INE I NTERFACE 4-122 Example This example accepts any incoming pac kets if the source address is within subnet 10.7.1.x. F or example, if the r ule is matched; i.e., the rule (10.7.1.0 & 255.255.255.0) equals the masked ad dress (10.7.1.2 & 255.255.255.0), the pac ket passes through. This allows TCP pack ets from cl ass C address[...]

A CCESS C ONTR OL L IST C OMMANDS 4-123 Example Related Commands per mit, deny 4-118 ip access-group (4-12 8) access-list ip mask-precedence This command accesses the IP Mask mode used to configure access control masks . Use the no form to delete the mask table . Syntax [ no ] access-list ip mask-precedence { in | out } • in – Ingress mask for [...]

C OMMAND L INE I NTERFACE 4-124 Related Commands mask (IP A CL) (4-124) ip access-g roup (4-128) mask (IP ACL) This command defines a mask for IP ACLs . T his mask defines the fields to check in the IP header. Use the no for m to re mov e a mask. Syntax [ no ] mas k [ protocol ] { any | host | source-bitmask } { any | host | destination-bitmask } [[...]

A CCESS C ONTR OL L IST C OMMANDS 4-125 Command Usage • Packets crossing a port are checke d against all the rules in the ACL until a match is found. The order in which these packets are che cked is determined by the mask, and not the order in which the ACL rules were ente red. • First create the required ACLs an d ingress or egress masks befor[...]

C OMMAND L INE I NTERFACE 4-126 This shows how to create a standard A CL with an ing ress mask to deny access to the IP host 171.69.198.102, and per mit access to any others . This shows how to create an extend ed A CL with an egress mask to drop packets leaving netw ork 171.69.198.0 wh en the Layer 4 source port is 23. Console(config)#access-list [...]

A CCESS C ONTR OL L IST C OMMANDS 4-127 This is a more comprehensiv e exampl e. It denies any TCP pac kets in which the SYN bit is ON , and per mits all other packets . It then sets the ing ress mask to c heck the deny r ule first, and finally binds port 1 to this A CL. Note that once the A C L is bound to an interface (i.e ., the A CL is activ e),[...]

C OMMAND L INE I NTERFACE 4-128 Command Mode Privileged Exec Example Related Commands mask (IP A CL) (4-124) ip access-group This command binds a por t to an IP A CL. Use the no f or m t o r e m ove t h e port. Syntax [ no ] ip access-gr oup acl_name { in | out } • acl_name – Name of the ACL. (Maximum length: 16 characters) • in – Indicates[...]

A CCESS C ONTR OL L IST C OMMANDS 4-129 Example Related Commands show ip access-list (4-122) show ip access-group This command shows the ports assigned to IP A CLs . Command Mode Privileged Exec Example Related Commands ip access-group (4-12 8) map access-list ip This command sets the output queue for pac kets matching an A CL r ule. The specifi ed[...]

C OMMAND L INE I NTERFACE 4-130 Command Mode Interface Configuration (Ethernet) Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown in the following table. For information on mapping the CoS values to output q[...]

A CCESS C ONTR OL L IST C OMMANDS 4-131 Command Mode Privileged Exec Example Related Commands map access-list ip (4-12 9) match access-list ip This command ch ang es the IEEE 802.1 p priority , IP Precedence, or DSCP Priority of a frame matc hing th e defined A CL rule. (This feature is commonly refer red to as ACL pack et marking .) Use the no for[...]

C OMMAND L INE I NTERFACE 4-132 • Traffic priorities m ay be included in the IEEE 802.1p priority tag. This tag is also incorporated as part of the overall IEEE 802.1 Q VLAN tag. To specify this priority , use the se t priority keywords. • The IP fram e header also inc ludes pr iority bits in the Ty pe of Service (ToS) octet. The Type of Servic[...]

A CCESS C ONTR OL L IST C OMMANDS 4-133 MAC ACLs Table 4-36 MAC ACL Commands Command Function Mode Page access-list mac Creates a MAC ACL and enters configuration mo de GC 4-134 permit, deny Filters packets matching a speci fied source and destination address, packet format, an d Ethernet type MAC-ACL 4-135 show mac access-list Displays the rules f[...]

C OMMAND L INE I NTERFACE 4-134 access-list mac This command adds a MA C access list and enters MA C ACL configu ration mode. Use the no form to remov e the specified A CL. Syntax [ no ] access-list mac acl_name acl_name – Name of the A CL. (Maximum length: 16 characters) Default Setting None Command Mode Global Configuration Command Usage • An[...]

A CCESS C ONTR OL L IST C OMMANDS 4-135 permit , deny (MAC ACL) This command adds a r ul e to a MA C ACL. The r ule filters pack ets matching a specified MA C source or dest ination address (i.e., ph ysical layer address), or Ethernet protocol type. Use the no f o rm to re mo v e a rul e . Syntax [ no ] { per mit | deny } { any | host source | sour[...]

C OMMAND L INE I NTERFACE 4-136 • address- bitmask 14 – Bitmask for MAC addre ss (in hexidecimal format). • vid – VLAN ID. (Range: 1-4095) • vid-bitmask 14 – VLAN bitmask. (Range: 1-4095) • protocol – A specific Ethernet protoc ol number. (Range: 600-fff hex.) • protocol - bitmask 14 – Protocol bitmask. (Range: 600-fff hex.) Def[...]

A CCESS C ONTR OL L IST C OMMANDS 4-137 show mac access-list This comm and displays the r u les for configured MAC A CLs . Syntax show mac access-list [ acl_name ] acl_name – Name of the A CL. (Maximum length: 16 characters) Command Mode Privileged Exec Example Related Commands per mit, deny 4-135 mac access-g roup (4-141) access-list mac mask-pr[...]

C OMMAND L INE I NTERFACE 4-138 Command Usage • You must configure a mask for an AC L rule before you can bind it to a port or set the queue or frame priorities associated with the rule. • A mask can only be used by all ingress ACLs or all egress ACLs. • The precedence of the ACL rules app lied to a packet is not determined by order of the ru[...]

A CCESS C ONTR OL L IST C OMMANDS 4-139 • ethertype – Check the Ethernet type field. • ethertype-bitmas k – Ethernet type of rule must match this bitmask. Default Setting None Command Mode MA C Mask Command Usage • Up to seven masks can be assigned to an ingress or egress ACL. • Packets crossing a port are checke d against all the rules[...]

C OMMAND L INE I NTERFACE 4-140 This example creates an Egress MA C A CL. show access-list mac mask-precedence This command shows the ingress or egress r ule masks for MA C A CLs . Syntax show access-list mac mask-precedence [ in | out ] • in – Ingress ma sk precedence for i ngress ACLs. • out – Egress mask precede nce for egress ACLs. Comm[...]

A CCESS C ONTR OL L IST C OMMANDS 4-141 mac access-group This command binds a port to a MA C A CL. Use the no for m to remov e the por t. Syntax mac access-gr oup acl_name { in | out } • acl_name – Name of the ACL. (Maximum length: 16 characters) • in – Indicates that this list applies to ingress packets. • out – Indicates that this lis[...]

C OMMAND L INE I NTERFACE 4-142 Example Related Commands mac access-g roup (4-141) map access-list mac This command sets the output queue for pac kets matching an A CL r ule. The speci fied CoS value is only used to map the matching packet to an output queue; it is not writte n to the pac ket itself . Use the no for m to remov e the CoS mapping . S[...]

A CCESS C ONTR OL L IST C OMMANDS 4-143 Example Related Commands queue cos-map (4-263) show map access-list mac (4-143) show map access-list mac This command shows the CoS v alue mapped to a MA C AC L for the cur rent interface. (The CoS value dete r mines the output queu e for pack ets matching an A CL r ule.) Syntax show map access-list mac [ int[...]

C OMMAND L INE I NTERFACE 4-144 match access-list mac This command changes the IEEE 802.1p priority of a Layer 2 frame matching the defined A CL r ule. (This feature is commonly referred to as A CL pack et marking .) Use the no for m to remov e the AC L marker . Syntax match access-list mac acl_name set priority priority no match access-list mac ac[...]

A CCESS C ONTR OL L IST C OMMANDS 4-145 show access-list This command shows all A CLs and asso ciated r ules, as well as all the user -defined masks . Command Mode Privileged Exec Command Usage Once the A CL is bound t o an interface (i. e., the A CL is active), the order in which the r ules are displayed is deter mined by the associated mask. Exam[...]

C OMMAND L INE I NTERFACE 4-146 SNMP Commands Controls access to this switch from management stations using the Simple Network Management Protoc ol (SNMP), as well as the er ror ty pes sent to trap manag ers . SNMP V ersion 3 also provides secu rity features that co ver messa g e integ rity , authentication, and encr yption; as well as controlling [...]

SNMP C OMMANDS 4-147 snmp-server This command enables the SNMPv3 engine and ser vices for all management clients (i.e., versions 1, 2c , 3). Use the no for m to disable the ser ver . Default Setting Enabled Command Mode Global Configuration Example snmp-server group Adds an SNMP group, mappin g users to views GC 4-158 show snmp group Shows the SNMP[...]

C OMMAND L INE I NTERFACE 4-148 show snmp This com mand can be used to check the status of SNMP communications . Default Setting None Command Mode Nor mal Exec , Privileged Exec Command Usage This command provides infor mation on the community access strings, counter infor mation for SNMP input and output protocol data units , and whether or not SN[...]

SNMP C OMMANDS 4-149 snmp-server commun ity This command defines th e SNMP v1 and v2c comm unity access string . Use the no for m to remove the specified community string . Syntax snmp-ser ver community string [ ro | rw ] no snmp-ser ver community string • string - Community string that acts like a password and permits access to the SNMP protocol[...]

C OMMAND L INE I NTERFACE 4-150 snmp-server c ontact This command sets the system contact string. Use the no form to remove the system contact infor mation. Syntax snmp-ser ver contact string no snmp-server contact string - String that describes the system contact infor mation. (Maximum length: 255 c haracters) Default Setting None Command Mode Glo[...]

SNMP C OMMANDS 4-151 Command Mode Global Configuration Example Related Commands snmp-ser ver contact (4-150) snmp-server hos t This command specifie s the recipien t of a Simple Network Management Protocol notificati on operation. Use the no form to re mov e the specified host. Syntax snmp-ser ver host host-addr community-string [ ve r si o n { 1 |[...]

C OMMAND L INE I NTERFACE 4-152 Default Setting • Host Address: None • SNMP Version: 1 • UDP Port: 162 Command Mode Global Configuration Command Usage • If you do not enter an snmp-server host command, no notifications are sent. In order to configure the switch to send SNMP notifications, you must enter at least one snmp-server host command[...]

SNMP C OMMANDS 4-153 Example Related Commands snmp-ser ver enable traps (4-153) snmp-server e nable traps This comm and enables this device to send Simple Network Management Protocol traps (SNMP not ifications). Use the no for m to disable SNMP notifications . Syntax [ no ] snmp-ser ver enable traps [ authentication | link-up-down ] • authenticat[...]

C OMMAND L INE I NTERFACE 4-154 Example Related Commands snmp-ser ver host (4-151) snmp-server e ngine-id This command configures a n identification str ing for the SNMPv3 engi ne. Use the no for m to restore the default. Syntax snmp-ser ver engine-id local engineid-string no snmp-ser ver engine-id local engineid-string - String identifying the en [...]

SNMP C OMMANDS 4-155 • A local engine ID is automatically generated that is unique to the switch. This is referred to as the de fault engine ID. If the local engine ID is deleted or changed, all SNMP users will be cleared. You will ne ed to reconfigure all exis ting users (page 4-161). Example show snmp engine-id This command shows the SNMP engin[...]

C OMMAND L INE I NTERFACE 4-156 snmp-server view This command adds an SNMP view which controls user access to the MIB . Use the no for m to remov e an SNMP view . Syntax snmp-ser ver view view-name oid-tree { included | excluded } no snmp-ser ver view view-name • view-name - Name of an SNMP vi ew . (Range: 1-64 characters) • oid-tr ee - Object [...]

SNMP C OMMANDS 4-157 This view include s the MIB-2 interfaces table, and the mask selects all index entries . show snmp view This command shows infor mation on the SNMP views . Command Mode Privileged Exec Example Console(config)#snmp-server view ifEntr y.a 1.3.6.1.2.1.2.2.1.1.* included Console(config)# Console#show snmp view View Name: mib-2 Subt[...]

C OMMAND L INE I NTERFACE 4-158 snmp-server g roup This command adds an SNMP g rou p , mapping SNMP users to SNMP views . Use the no for m to re mov e an SN MP g roup . Syntax snmp-ser ver g roup gr oupname { v1 | v2c | v3 { auth | noauth | priv }} [ re ad rea dvi ew ] [ write writeview ] no snmp-server group groupname • groupname - Name of an SN[...]

SNMP C OMMANDS 4-159 Example show snmp group F our default g roups are provided – SNMPv1 read-only access and read/ write access , and SNMPv2c read-o nl y access and read/write access . Command Mode Privileged Exec Console(config)#snmp-server group r&d v 3 auth write daily Console(config)#[...]

C OMMAND L INE I NTERFACE 4-160 Example Console#show snmp group Group Name: r&d Security Model: v3 Read View: mib-2 Write View: 802.1d Notify View: none Storage Type: nonvolatile Row Status: active Group Name: public Security Model: v1 Read View: defaultview Write View: none Notify View: none Storage Type: volatile Row Status: active Group Name[...]

SNMP C OMMANDS 4-161 snmp-server user This command adds a user to an SNMP group , restricting the user to a specific SNMP Read and a W rite View . Use the no for m to remov e a user from an SNMP group . Syntax snmp-ser ver user user name gr oupname { v1 | v2c | v3 [ encr ypted ] [ auth { md5 | sha } auth-password [ priv des56 priv-password ]] no sn[...]

C OMMAND L INE I NTERFACE 4-162 Command Mode Global Configuration Command Usage • T he SNMP engi ne ID is used to compute the authentica tion/privacy digests from the password. You shou ld therefore configure the engine ID with the snmp-server engine-id command before using this configuration command. • SNMP passwords are localized usin g the a[...]

DNS C OMMANDS 4-163 DNS Commands These commands are use d to config ure Domain Na ming System (DNS) ser vices. Y ou can manually configure entries in the DNS domain name to IP address mapping table, configure default domain names , or specify one or more name ser vers to use for domain name to address translation. Note that domain name ser vices wi[...]

C OMMAND L INE I NTERFACE 4-164 ip host This command create s a static entry in the DNS table t hat maps a host name to an IP address . Use the no for m to remove an ent r y . Syntax [ no ] ip host name address1 [ addr ess2 … address8 ] • name - Name of the host. (Range: 1-64 characters) • address1 - Corresponding IP address. • address2 …[...]

DNS C OMMANDS 4-165 Example This example maps two address to a host name . clear host This command deletes entries from the DNS table . Syntax clear host { name | * } • name - Name of the host. (Range: 1-64 characters) • * - Removes all entries. Default Setting None Command Mode Privileged Exec Example This example clears all static entrie s fr[...]

C OMMAND L INE I NTERFACE 4-166 ip domain-name This command de fines the default doma in name appended to incomplete host names (i.e., host names passed from a client that are not formatted with dotted notation). Use the no for m to remov e the cur rent domain name. Syntax ip dom ain-n ame name no ip dom ain-nam e name - Name of the host. Do not in[...]

DNS C OMMANDS 4-167 ip domain-list This command de fines a list of domain names that can be appended to incomplete host names (i.e., host names passed from a client that are not for matted with dotted notation). Us e the no fo r m t o r em ove a n a me fr o m this list. Syntax [ no ] i p doma in-list name name - Name of the host. Do not include the[...]

C OMMAND L INE I NTERFACE 4-168 Example This example adds two domain names to the current list and then displays the list. Related Commands ip domain-name (4-166) ip name-server This command spec ifies the address of one or more domain name servers to use for name-to-address resolution. Use the no for m to r emove a nam e ser ver from this list. Sy[...]

DNS C OMMANDS 4-169 Example This example adds tw o domain-name servers to the list and then di splays the list. Related Commands ip domain-name (4-166) ip domain-lookup (4-169) ip domain-lookup This command enables DNS host name -to-address translation. Use the no for m to disable DNS . Syntax [ no ] i p doma in-loo kup Default Setting Disabled Com[...]

C OMMAND L INE I NTERFACE 4-170 Example This example enables DNS and then displays the configur ation. Related Commands ip domain-name (4-166) ip name-ser ver (4-168) show hosts This comm and displays the static host name-to-address mapping table . Command Mode Privileged Exec Example Note that a host name will be displayed as an alias if it is map[...]

DNS C OMMANDS 4-171 show dns This comm and displays the conf iguration of the DNS ser ver . Command Mode Privileged Exec Example show dns cache This comm and displays entries in the DNS cache. Command Mode Privileged Exec Example Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: sample.com Domain Name List: sample.com.jp sampl[...]

C OMMAND L INE I NTERFACE 4-172 clear dns cache This command c lears all entries in the DNS cache . Command Mode Privileged Exec Example Field Description NO The entry number for each resource record. FLAG The flag i s always “4” indicating a cache entry and th erefore unreliable. TYPE This field includes CN AME which specifie s the canonic al [...]

I NTERFACE C OMMANDS 4-173 Interface Commands These commands are used to display or set communication parameters for an Ethernet por t, ag g reg ated link, or VLAN . Table 4-45 Interface Commands Command Function Mode Page interface Configure s an interface type and enters interface configuration mode GC 4-174 description Adds a description to an i[...]

C OMMAND L INE I NTERFACE 4-174 interface This command c onfigures an interface type and enter interface configuration mode. Use the no for m to remov e a trunk. Syntax interface interface no interface port-channel channel-id • interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-cha[...]

I NTERFACE C OMMANDS 4-175 Command Mode Interface Configuration (Ethernet, Port Channel) Example The following example adds a description to port 24. speed-duplex This command configures the speed an d duplex mode of a given interface when autoneg otiation is disabled. Use the no for m to restore the default. Syntax speed-duplex { 1000 full | 100fu[...]

C OMMAND L INE I NTERFACE 4-176 • When using the negotiation command to enable auto-negotiation, the optimal settings will be de termined by the capabilities command. To set the speed/duplex mod e under auto-negotiation, the req uired mode must be specified in the capabilities list for an interface. Example The following example configures por t [...]

I NTERFACE C OMMANDS 4-177 Example The following example configures por t 11 to use autoneg otiation. Related Commands capabilities (4 -177) speed-duplex (4 -175) capabilities This command advertises the port capab ilities of a giv en interface during autoneg otiation. Use the no f o r m w i t h p a r a m e t e r s t o r e m o v e a n a d v e r t i[...]

C OMMAND L INE I NTERFACE 4-178 Command Usage When auto-neg otiation is enabled with the negotiation command, the switch will negotiate the best settings for a link based on the capabilites command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and fl o w c o n tr o l c ommands . Example The [...]

I NTERFACE C OMMANDS 4-179 • To force flow control on or off (with the flowcontrol or no flowcontrol command ), use the no negotiation command to disable auto-negotiation on the selected interface. • When using the negotiation command to e nable auto- negotiation, the optimal settings will be de termined by the capabilities command. To enable f[...]

C OMMAND L INE I NTERFACE 4-180 Default Setting sfp-preferred-auto Command Mode Interface Configuration (Ethernet) Example This forces the switch to use the bu ilt-in RJ-45 port for the combination port 21. shutdown This com mand disable s an interface. T o restar t a dis abled interface, use the no for m. Syntax [ no ] shutdown Default Setting All[...]

I NTERFACE C OMMANDS 4-181 switchport broadcast packet-rate This command configur es broadcast storm control. Use the no form to disable broadcast stor m control. Syntax switchport broadcast packet-rate rate no switchport broadcast rate - Threshold level as a rate; i.e., pac kets per second. (Range: 500 - 262143) Default Setting Enabled for all por[...]

C OMMAND L INE I NTERFACE 4-182 clear counters This command clear s statistics on an interface . Syntax clear counter s interface interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) Default Setting None Command Mode Privileged Exec Command Usage Statis[...]

I NTERFACE C OMMANDS 4-183 show interfaces status This command displays the status for an interface . Syntax show interfaces s tatus [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) • vlan vlan-id (Range: 1-4093) Default Setting Show[...]

C OMMAND L INE I NTERFACE 4-184 Example show interfaces counters This comm and displays interface statistics . Syntax show interfaces counters [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) Default Setting Shows the counters f or all[...]

I NTERFACE C OMMANDS 4-185 Command Usage If no interface is specified, inform ation on all interfaces is displayed. F or a description of the items displayed b y this command, see “Showing P or t Statistics” on page 3-127. Example Console#show interfaces counters ethernet 1/7 Ethernet 1/7 Iftable stats: Octets input: 30658, Octets output: 19655[...]

C OMMAND L INE I NTERFACE 4-186 show interfaces switchport This comm and displays the administra tive and operational s tatus of the specified interfaces. Syntax show interfaces switchport [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-3[...]

I NTERFACE C OMMANDS 4-187 Table 4-46 show interfaces switchport - display description Field Description Broadcast threshold Shows if broadcast storm su ppression is enabl ed or disabled; if enabled it also shows the threshold level (page 4-181). LACP status Shows if Link Aggregation Control Protocol has been enabled or disabled (page 4-194). Ingre[...]

C OMMAND L INE I NTERFACE 4-188 Mirror Port Commands This section describes how to mir ror tr affic from a source port to a targ et port. port monitor This command configures a mirror session. Use the no for m to clear a mir ror session. Syntax por t monitor interface [ rx | tx | both ] no por t monitor interface • interface - ethernet unit / por[...]

M IR R OR P ORT C OMMANDS 4-189 Command Usage • You can mirror traffic from any so urce port to a destination port for real-time analysis. You can then attach a logic analyzer or RMON probe to the destination port and stud y the traffic crossing the source port in a completely unobtrusive manner. • The destination port is set by sp ecifyi ng an[...]

C OMMAND L INE I NTERFACE 4-190 Example The following shows mirroring configured from port 6 to port 11. Rate Limit Commands This function allows the network ma nager to control the maximum rate for traffic transmitted or receiv ed on an interface . Rate limiting is configured on interfaces at the edge of a netw ork to limit traffic into or out of [...]

R ATE L IMIT C OMMANDS 4-191 rate-limit This comm and defines the rate li mit for a specific interface. Use this command without specifying a ra te to restore the default rate . Use the no for m to restore the default status of disabled. Syntax rate-limit { input | output } [ rate ] no rate-limit { input | output } • input – Input rate • outp[...]

C OMMAND L INE I NTERFACE 4-192 Link Aggregation Commands P orts can be statically g rouped into an agg reg ate link (i.e ., tr unk) to increase the bandwidth of a netw or k connection or to ensure fault recov er y . Or y ou can use the Link Ag g reg ation Control Protocol (LA C P) to automatically negotiate a trunk link between this switch and ano[...]

L INK A GG R E G A T I O N C OMMANDS 4-193 Guidelines for Creating Trunks General Guidelines – • F inish configuring port trunks be fore you connect the corresponding network cables between switch es to avoid creating a loop. • A trunk can have up to 32 ports. • The ports at both ends of a connect ion must be configured as trunk ports. • [...]

C OMMAND L INE I NTERFACE 4-194 channel-group This comm and adds a port t o a tr unk. Use the no for m to remove a port from a tr unk. Syntax channel-gr oup channel-id no channel-group channel-id - T r unk index (Range: 1-32) Default Setting The cur rent por t will be added to this tr unk. Command Mode Interface Configuration (Ethernet) Command Usa[...]

L INK A GG R E G A T I O N C OMMANDS 4-195 Command Mode Interface Configuration (Ethernet) Command Usage • The ports on both ends of an LACP tr unk must be c onfigured for full duplex, either by forced mode or auto-negotiation. • A trunk forme d with another switch using LACP will automatically be assigned the next avai lable port-channel ID. ?[...]

C OMMAND L INE I NTERFACE 4-196 Example The following shows LA CP enabled on ports 10-12. Because LACP has also been enabled on the ports at the other end of the links , the show interfaces status por t-channel 1 command shows that T r unk1 has been established. Console(config)#interface ethernet 1/10 Console(config-if)#lacp Console(config-if)#exit[...]

L INK A GG R E G A T I O N C OMMANDS 4-197 lacp system-priority This command configures a por t's LA CP system prio rity . Use the no for m to restore the default setting . Syntax lacp { actor | par tner } system-pr iority priority no lacp { actor | par tner } system-priority • actor - The local side an aggregate link. • partner - The remo[...]

C OMMAND L INE I NTERFACE 4-198 lacp admin-key (Ethernet Interface) This command configures a port's LAC P administration k ey . Use the no for m to restore the default setting . Syntax lacp { actor | par tner } admin-key key [ no ] lacp { actor | par tner } admin-k ey • actor - The local side an aggregate link. • partner - The remote side[...]

L INK A GG R E G A T I O N C OMMANDS 4-199 lacp admin-key (Port Channel) This command configures a port ch annel's LA CP administration key string . Use the no for m to restore the default setting . Syntax lacp admin-key key [ no ] lacp admin-key key - The port channel admin k ey is used to identify a specific link ag g regation g roup (LAG) d[...]

C OMMAND L INE I NTERFACE 4-200 lacp port-priority This command configur es LA CP port priority . Use the no for m to res tor e the default setting . Syntax lacp { actor | par tner } por t-priority priority no lacp { actor | par tner } por t-priority • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. ?[...]

L INK A GG R E G A T I O N C OMMANDS 4-201 show lacp This command di splays LA CP infor mation. Syntax show lacp [ por t-channel ] { counters | inter nal | neighbors | sys-id } • port-channel - Local identifier for a link aggregation group. (Range: 1-6) • counters - Statistics for LACP protocol messages. • inter nal - Configuration settings a[...]

C OMMAND L INE I NTERFACE 4-202 Table 4-50 show l acp counters - d isplay description Field Description LACPDUs Sent Number of val id LACPDUs transmit ted from this channe l group. LACPDUs Received Number of valid LACPD Us received on this channel group. Marker Sent Number of valid Mark er PDUs transmit ted from this channel group. Marker Received [...]

L INK A GG R E G A T I O N C OMMANDS 4-203 LACPDUs Internal Number of seconds before invalidating rece ived LACPDU information. LACP System Priority LACP system p riority assigned to th is port channel. LACP Port Priority LACP port priority assigned to this interface within the channel group. Admin State, Oper State Administrative or operational va[...]

C OMMAND L INE I NTERFACE 4-204 Console#show lacp 1 neighbors Channel group 1 neighbors --------------------------------------- ---------------------------- Eth 1/1 --------------------------------------- ---------------------------- Partner Admin System ID: 32768, 00- 00-00-00-00-00 Partner Oper System ID: 32768, 00- 01-F4-78-AE-C0 Partner Admin P[...]

L INK A GG R E G A T I O N C OMMANDS 4-205 Console#show lacp 1 sysid Channel group System Priority Sys tem MAC Address --------------------------------------- ---------------------------- 1 32768 00 -30-F1-8F-2C-A7 2 32768 00 -30-F1-8F-2C-A7 3 32768 00 -30-F1-8F-2C-A7 4 32768 00 -30-F1-8F-2C-A7 5 32768 00 -30-F1-8F-2C-A7 6 32768 00 -30-F1-8F-2C-A7 [...]

C OMMAND L INE I NTERFACE 4-206 Address Table Commands These commands are use d to config ure the address table for filtering specified addresses, displa ying cur rent en tries, clearing the table, or setting the aging time. mac-address-table static This command maps a static address to a destination port in a VLAN . Use the no for m to remove an a[...]

A DDR ESS T ABLE C OMMANDS 4-207 • action - delete-on-reset - Assignment lasts until the switch is reset. - permanent - Assignment is permanent. Default Setting No static addresses are defined. Th e default mode is per manent . Command Mode Global Configuration Command Usage The static address for a host device can be assigned to a specific port [...]

C OMMAND L INE I NTERFACE 4-208 Example show mac-address-table This command shows classes of entrie s in the bridge-forwarding database. Syntax show mac-address-table [ address mac-address [ mask ]] [ interface interface ] [ vlan vlan-id ] [ sor t { address | vlan | interface }] • mac-address - MAC address. • mask - Bits to match in the address[...]

A DDR ESS T ABLE C OMMANDS 4-209 example, a mask of 00-00-00-00-00 -00 means an exac t match, and a mask of FF-FF-FF-FF-FF-FF mea ns “any.” • The maximum number of address entries is 8191. Example mac-address-table aging-time This command sets the agi ng time for entries in the address table . Use the no for m to restore the defaul t aging ti[...]

C OMMAND L INE I NTERFACE 4-210 show mac-address-table aging-time This command shows the aging time for entries in the a ddress table. Default Setting None Command Mode Privileged Exec Example Spanning Tree Commands This section i ncludes commands th at configure the Spanning T ree Alg orithm (STA) globally for the switch, and commands that config [...]

S PANNING T RE E C OMMANDS 4-211 spanning-tree mst configuration Accesses MSTP configuration m ode GC 4-219 mst vlan Adds VLANs to a spanning tree instance MST 4-219 mst priority Configures the priorit y of a spanning tree instan ce MST 4-221 name Configures the name for the multiple spanning tree MST 4-222 revision Configures the rev ision number [...]

C OMMAND L INE I NTERFACE 4-212 spanning-tree This command e nables the Spanning T ree Alg orithm globally for the switch. Use the no for m to disable it. Syntax [ no ] spanning-tr ee Default Setting Spanning tree is enabled. Command Mode Global Configuration Command Usage The Spanning Tr ee Alg orithm (STA) ca n be used to detect and disable netwo[...]

S PANNING T RE E C OMMANDS 4-213 spanning-tree mode This command selects the spanning tr ee mode for this swit ch. Use the no for m to restore the default. Syntax spanning-tree mode { stp | rstp | mstp } no spanning-tree mode • stp - Spanning Tree Protocol (IEEE 802.1D) • rstp - Rapid Spanning Tree Protocol (IEEE 802.1w) • mstp - Multiple Spa[...]

C OMMAND L INE I NTERFACE 4-214 - RSTP Mode – If RSTP is using 802.1D BPDUs on a port and receives an RS TP BPDU after the mi gration delay expire s, RSTP restarts the m igration delay ti me r and begins using RSTP BPDUs on that port. • M ultiple Spanning Tree Protocol - To allow multiple spanning trees to operate over the network, you must con[...]

S PANNING T RE E C OMMANDS 4-215 Command Usage This command se ts the maximum time (in seconds) the root device will w a it b e f o r e c h a n gi n g s t a t e s ( i . e . , d i scarding to learning to forwarding). This delay is required because ever y device must receive information about topolog y changes before it starts to forward frames . In [...]

C OMMAND L INE I NTERFACE 4-216 spanning-tree max-age This command configures the spanning tree bridg e maximum age globally for this switch. Use the no for m to restore th e default. Syntax spanning-tree max-a ge seconds no spanning-tree max-ag e seconds - Time in seconds . (Range: 6-40 seconds) The minimum value is the higher of 6 or [2 x (hello-[...]

S PANNING T RE E C OMMANDS 4-217 spanning-tree priority This command configures the spanning tree priority globally for this switch. Use the no form to restore the default. Syntax spanning-tree priority priority no spanning-tree priority priority - Priority of the bridge. (Range: 0 - 65535) (Range – 0-61440, in steps of 4096; Options: 0, 4096, 81[...]

C OMMAND L INE I NTERFACE 4-218 Default Setting Long method Command Mode Global Configuration Command Usage The path cost method is used to deter mine the best path between devices . T herefore, low er values should be assigned to ports attac hed to faster media, and higher values assigned to ports with slower media. Note that path cost (page 4-225[...]

S PANNING T RE E C OMMANDS 4-219 spanning-tree mst configuration Use this command to change to Multiple Spanning T ree (MST) configuration mode. Default Setting • No VLANs are mapped to a ny MST instance. • The region name is set the switch’s MAC address. Command Mode Global Configuration Example Related Commands mst vlan (4 -219) mst priorit[...]

C OMMAND L INE I NTERFACE 4-220 Command Mode MST Configurat ion Command Usage • Use this command to group VLANs into spanning tree instances. MSTP generates a unique spanning tree for each instance. This provides multiple pathways across the network, thereby balancing the traffic load, preventing wide-scale disruption when a bridge node in a sing[...]

S PANNING T RE E C OMMANDS 4-221 mst priority This command configures the priority of a spanning tree instance. Use the no for m to restore the defaul t. Syntax mst instance_id priority priority no mst instance_id priority • instance_id - Instance ident ifier of the spanning tree . (Range: 0-4094) • priority - Priority of the a spanning tree in[...]

C OMMAND L INE I NTERFACE 4-222 name This command configur es the name for the m ultiple sp anning tree region in which this switc h is located. Use the no for m to clear the name . Syntax name name name - Name of the spanning tree . Default Setting Switch’ s MA C address Command Mode MST Configurat ion Command Usage The MST region name and revis[...]

S PANNING T RE E C OMMANDS 4-223 Default Setting 0 Command Mode MST Configurat ion Command Usage The MST region name (pag e 4-222) and revision number are used to designate a unique MST region. A brid ge (i.e., spanning-tree compliant device such as this switc h) can onl y belong to one MST region. And all bridges in the same region must be configu[...]

C OMMAND L INE I NTERFACE 4-224 Command Usage A MSTI region is treated a s a si ngle node by the STP and RSTP protocols . Therefore, the message age for BPDUs inside a MSTI region is ne ve r ch an g e d. H owe ver, ea ch sp anning tree instance within a region, and the internal spanning tree (IST ) that connects these instances use a hop count to s[...]

S PANNING T RE E C OMMANDS 4-225 spanning-tree cost This command configures the spanning tree path cost for the spec ified interface. Use the no form to restore the default. Syntax spanning-tree cost cost no spanning-tree cost cost cost - The path cost for the port. (Range : 1-200,000,000)) The recommended rang e is: - Ethernet: 200,000-20,000,000 [...]

C OMMAND L INE I NTERFACE 4-226 spanning-tree port-priority This command configur es the priority f or the specified interface . Use the no for m to restore the default . Syntax spanning-tree por t-priority priority no spanning-tree por t-priority priority priority - The priority for a por t. (Range: 0-240, in ste ps of 16) Default Setting 128 Comm[...]

S PANNING T RE E C OMMANDS 4-227 Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the [...]

C OMMAND L INE I NTERFACE 4-228 Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Thi s command is used to enable/ dis able the fast spanning-tree mode for the selected port. In this mode, ports skip the Discarding and Learning states, and procee d straight to Forwarding. • Since end-nodes cannot cause forw arding lo[...]

S PANNING T RE E C OMMANDS 4-229 Default Setting auto Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Specify a point-to-point link if th e interface can only be connected to exactly one other br idge, or a shared link if it can be connected to two or more bridges. • When automatic detection is selected , the swit [...]

C OMMAND L INE I NTERFACE 4-230 Default Setting By default, the system automatically detects the spe ed and duplex mode used on eac h port, and configures the path co st according to the v alues shown belo w . P ath cost “0” is us ed to indicate auto-configuration mode. • Ethernet – half duplex: 2,000 ,000; full duplex: 1,000,00 0; trunk: 5[...]

S PANNING T RE E C OMMANDS 4-231 spanning-tree mst port-priority This command confi gures the interfac e priority on a spanning instance in the Multiple Spanning T ree. Use the no for m to restore the default. Syntax spanning-tree mst instance_id por t-priority priority no spanning-tree mst instance_id por t-priority • instance_id - Instance iden[...]

C OMMAND L INE I NTERFACE 4-232 spanning-tree protocol-migration This command re-checks the appropriate BPDU for mat to send on the selected interface. Syntax spanning-tree prot ocol-mig ration interface • interface - ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) - port-channel channel-id (Range: 1-[...]

S PANNING T RE E C OMMANDS 4-233 show spanning-tree This command shows the configurat ion for the common spanning tree (CST) or for an instance within the multiple spanning tree (MST). Syntax show spanning-tree [ interface | mst instance_id ] • interface - ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/4[...]

C OMMAND L INE I NTERFACE 4-234 Example Console#show spanning-tree Spanning-tree information --------------------------------------- ------------------------ Spanning tree mode: MSTP Spanning tree enabled/disabled: enab led Instance: 0 VLANs configuration: 1-40 93 Priority: 3276 8 Bridge Hello Time (sec.): 2 Bridge Max Age (sec.): 20 Bridge Forward[...]

VLAN C OMMANDS 4-235 show spanning-tree mst configuration This command shows the multiple spanning tree configuration. Command Mode Privileged Exec Example VLAN Commands A VLAN is a g roup of ports that can be located an ywhere in the netw ork, but communicate as though they bel ong to the same ph ysical segment. This section describes commands use[...]

C OMMAND L INE I NTERFACE 4-236 Editing VL AN Groups vlan database This comm and enters VLAN database mode. All commands in this mode will take effect immediately . Default Setting None Command Mode Global Configuration Command Usage • U se the VLAN database command mode to add, change, and delete VLANs. After finishing configurat ion cha nges, y[...]

VLAN C OMMANDS 4-237 Example Related Commands s h o w v l a n ( 4 - 2 4 6 ) vlan This command configures a VLAN . Use the no form to restore the default settings or delete a VLAN . Syntax vlan vlan-id [ name vlan-name ] media ether net [ state { active | suspend }] no vlan vlan-id [ name | state ] • vlan-id - ID of configured VLAN. (Range: 1-4094[...]

C OMMAND L INE I NTERFACE 4-238 Example The following example adds a VLAN , using VLAN ID 105 and name RD5. The VLAN is activated by default. Related Commands s h o w v l a n ( 4 - 2 4 6 ) Configuring VLAN Interfaces Console(config)#vlan database Console(config-vlan)#vlan 105 name RD5 media ethernet Console(config-vlan)# Table 4-58 Configuring VLAN[...]

VLAN C OMMANDS 4-239 interface vlan This comm and enters inte rface configuration mode for VLANs , which is used to configure VLAN parame ters for a physical interface. Syntax interface vlan vlan-id vlan-id - ID of the configured VLAN . (Rang e: 1-4093, no leading zeroes) Default Setting None Command Mode Global Configuration Example The following [...]

C OMMAND L INE I NTERFACE 4-240 switchport mode This command configures the VLAN membership mod e for a port. Use the no for m to restore the defa ult. Syntax switchport mode { tr unk | hyb ri d } no switchport mode • trunk - Specifies a port as an end-point for a VLAN trunk. A trunk is a direct link between two switches, so the port transmits ta[...]

VLAN C OMMANDS 4-241 switchport acceptable-frame-types This co mmand configu res the acce ptable frame ty pes for a por t. Use the no for m to restore the defaul t. Syntax switchport acceptable-frame-types { all | ta gg ed } no switchport acceptable-frame-types • all - The port accepts all fram es, tagged or untagged. • tagged - The port only r[...]

C OMMAND L INE I NTERFACE 4-242 switchport ingress-filtering This comm and enables ing ress filtering for an interface. Use the no for m to restore the default. Syntax [ no ] switchpor t ingr ess-filtering Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Ingress filte ring only affects tagged [...]

VLAN C OMMANDS 4-243 switchport native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no for m to restore the default. Syntax switchport nativ e vlan vlan-id no switchport nativ e vlan vlan-id - Default VLAN ID for a port. (Range: 1-4093, no leading zeroes) Default Setting VLAN 1 Command Mode Interface Configurati[...]

C OMMAND L INE I NTERFACE 4-244 switchport allowed vlan This command configur es VLAN grou ps on the selected interface. Use the no for m to restore the defa ult. Syntax switchport allowed vlan { add vlan-list [ tagged | untagged ] | remo v e vlan-list } no switchport allowed vlan • add vlan-list - List of VLAN identifiers to add. • remove vlan[...]

VLAN C OMMANDS 4-245 • If a VLAN on the forbidden list for an interface is manually added to that interface, the VLAN is automatically removed from the forbidden list for that interface. Example The following example shows ho w to add VLANs 1, 2, 5 and 6 to the allowed list as tag g ed VLANs for por t 1. switchport forbidden vlan This command con[...]

C OMMAND L INE I NTERFACE 4-246 Example The following example shows ho w to prevent port 1 from being added to VLAN 3. Displaying VLAN Information show vlan This comm and shows VLAN infor mation. Syntax show vlan [ id vlan-id | name vlan-name ] • id - Keyword to be follo wed by the VLAN ID. • vlan-id - ID of the configured VL AN. (Range: 1-4093[...]

VLAN C OMMANDS 4-247 Example The following example shows ho w to display infor mation for VLAN 1. Configuring Private VLANs Priv ate VLANs provide port-based secu rity and isolation between ports within the assigned VLAN . T his se ction describes commands used to configure priv ate VlANs . pvlan This command enables or config ures a private VLAN .[...]

C OMMAND L INE I NTERFACE 4-248 Command Mode Global Configuration Command Usage • A private VLAN provides port-base d security and isolation between ports within the VLAN. Data traffic on the downlink ports can only be forwarded to, and from, the uplink port. • P rivate VLANs and normal VLANs c an exist simultaneously within the same switch. ?[...]

VLAN C OMMANDS 4-249 Configuring Protocol-based VLANs The network devices required to su pport multiple protocols cannot be easily g rouped into a common VLAN . This may require non-standard devices to pass traffic between differ ent VLANs in order to enc ompass all the devices part icipating in a specific protocol. This kind of configuration depri[...]

C OMMAND L INE I NTERFACE 4-250 3. Then map the protocol for each interface to the appropriate VLAN using the protocol-vlan protocol-g roup command (Interface Configuration mode). protocol-vlan protocol-group (Configuring Groups) This command creates a protocol g rou p , adds specific protocols to a gr ou p . Us e t he no for m to remove a protocol[...]

VLAN C OMMANDS 4-251 protocol-vlan protocol-group (Configuring Interfaces) This command maps a protocol g roup to a VLAN for the cur rent interface. Use the no form to remov e the protocol mapping for this interface. Syntax protocol-vlan protocol-gr oup gr oup-id vlan vlan-id no protocol-vlan protocol-gr oup group-id vlan • group-id - Group ident[...]

C OMMAND L INE I NTERFACE 4-252 Example The following example maps the traffi c entering P ort 1 which matches the protocol type specified in protocol group 1 to VLAN 2. show protocol-vlan protocol -group This command shows the frame and protocol type a ssociated with protocol g roups . Syntax show protocol-vlan protocol-group [ group-id ] group-id[...]

VLAN C OMMANDS 4-253 show interfaces protocol-vlan protocol-group This command shows the mapping from protocol groups to VLANs for the sele cted interfaces . Syntax show interfaces protocol-vlan protocol-g roup [ interface ] • interface - ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) - port-channel [...]

C OMMAND L INE I NTERFACE 4-254 GVRP and Bridge Extension Commands GARP VLAN Registrati on Protocol defines a wa y for switches to ex change VLAN infor mation in orde r to aut omatically reg ister VLAN members on interfaces across the netw or k. This section describes how to enable GVRP for individual interfaces and globally for the switch, as well[...]

GVRP AND B RIDGE E XTENSION C OMMANDS 4-255 Command Mode Global Configuration Command Usage G V R P d e f i n e s a w a y f o r s w i t c h e s t o e x c h a n ge V L A N i n f o rm a t i o n i n order to registe r VLAN members on por ts across the network. This function should be enabled to per m it automatic VLAN regi stration, and to support VLA[...]

C OMMAND L INE I NTERFACE 4-256 switchport gvrp This co mmand enables GVR P for a port. Use the no for m to disable it. Syntax [ no ] s wi tc hp ort gv rp Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Example show gvrp configuration This command shows if GVRP is enabled. Syntax show gvrp configuration [ inte[...]

GVRP AND B RIDGE E XTENSION C OMMANDS 4-257 garp timer This comm and sets the values for the join, leav e and leav eall timers. Use the no for m to restore the timers’ defau lt values . Syntax gar p timer { join | leave | lea veall } ti mer_value no gar p timer { join | leave | leav eall } •{ join | leave | leaveall } - Which timer to set. • [...]

C OMMAND L INE I NTERFACE 4-258 Example Related Commands s h o w g a r p t i m e r ( 4 - 2 5 8 ) show garp timer This comm and shows the GARP timers for the selected interface. Syntax show gar p timer [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id[...]

P RIORITY C OMMANDS 4-259 Priority Commands The com mands described in this section allow you to specify which data packets ha ve greater precede nce when traffic is buffered in the switch due to congestion. T his switch supports CoS with eight priority queues for each port. Data packets in a port’ s hi gh-priority queue will be transm itted befo[...]

C OMMAND L INE I NTERFACE 4-260 Priority Commands (Layer 2) queue mode This command sets the queue mode to strict pri ority or W eighted Round-R obin (WRR) for the class of se r vice (CoS) priority queues . Use the no for m to restore the default value . Syntax queue mode { strict | wr r } no queue mo de • strict - Services the e gress queues in [...]

P RIORITY C OMMANDS 4-261 Default Setting W eighted R ound Robin Command Mode Global Configuration Command Usage Y ou can set the switc h to ser vice the queues based on a strict ru le that requires all traffic in a higher prio rity queue to be processed before lower priority queues are servic ed, or use W eighted R ound-Robin (WRR) queuing that sp[...]

C OMMAND L INE I NTERFACE 4-262 Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • The default priority applies for an untagged frame re ceived on a port set to accept all frame types (i.e, receives both untagged and tagged frames). This priority does not apply to IEEE 80[...]

P RIORITY C OMMANDS 4-263 Default Setting W eights 1, 2, 4, 6, 8, 10, 12, 14 are assigned to queues 0 - 7 respectively . Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage WRR controls bandwidth sharing at the eg ress port by defining scheduling weights . Example This example shows how to assign WRR weights to each of the p[...]

C OMMAND L INE I NTERFACE 4-264 Default Setting This switch suppor ts Class of Ser vice by using eight priority queues , with W e ighted R ound Robin queuing for eac h port. Eight se parate traffic classes are defined in IEEE 802.1p . The default priority levels are assigned according to recommendations in the IEEE 802.1p standard as shown below . [...]

P RIORITY C OMMANDS 4-265 show queue mode This command show s the current queue mode . Default Setting None Command Mode Privileged Exec Example show queue bandwidth This command di splays the weight ed round-robin (WRR) bandwidth allocation for the eight priority queues . Default Setting None Command Mode Privileged Exec Example Console#sh queue m[...]

C OMMAND L INE I NTERFACE 4-266 show queue cos-map This command shows the class of service priority map . Syntax show queue cos-map [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) Default Setting None Command Mode Privileged Exec Exam[...]

P RIORITY C OMMANDS 4-267 Priority Commands (Layer 3 and 4) Table 4-66 Priority Commands (Laye r 3 and 4) Command Function Mode Page map ip port Enables TCP/UDP class of service mapping GC 4-268 map ip port Maps TCP/UDP socket to a class of service IC 4-268 map ip preced ence Enables IP prec edence class of service mapping GC 4-269 map ip precede n[...]

C OMMAND L INE I NTERFACE 4-268 map ip port (Global Configuration) This command enables IP por t mapping (i.e., class of ser vice mapping for TCP/UDP sock ets). Use the no f or m to disable IP port mapping . Syntax [ no ] map ip por t Default Setting Disabled Command Mode Global Configuration Command Usage The precedence for priority mapping is IP [...]

P RIORITY C OMMANDS 4-269 Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • This command sets the IP port priority for all inter faces. Example The following example shows how to map HTTP traffic to CoS va lue[...]

C OMMAND L INE I NTERFACE 4-270 Example The following example shows ho w to enable IP precede nce mapping globally: map ip precedence (Interface Configurat ion) This command sets IP prec edence priority (i .e., IP T ype of Ser vice priority). Use the no form to restore the default table. Syntax map ip precedence ip-precedence-va lue cos cos-value n[...]

P RIORITY C OMMANDS 4-271 Example The following example shows ho w to map IP precedence value 1 to CoS val ue 0 : map ip dscp (Global Configuration) This command e nables IP DSCP mapping (i.e ., Differentiated Ser vices Code P oint mapping). Use the no form to disable IP DSCP mapping . Syntax [ no ] map ip dscp Default Setting Disabled Command Mode[...]

C OMMAND L INE I NTERFACE 4-272 map ip dscp (Interface Configuratio n) This comm and sets IP DSCP priority (i.e., Differentiated Ser vices Code P oint priority). Use the no for m to restore the def ault table. Syntax map ip dscp dscp-value cos cos-v alue no map ip dscp • dscp-value - 8-bit DSCP value. (Range: 0-255) • cos-value - Class-of-Servi[...]

P RIORITY C OMMANDS 4-273 Example The following example shows ho w to map IP DSCP value 1 to CoS val ue 0 . show map ip port Use this command to show the IP port priority map . Syntax show map ip port [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id[...]

C OMMAND L INE I NTERFACE 4-274 show map ip precedence This co mmand shows the IP precedence priori ty map . Syntax show map ip precedence [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) Default Setting None Command Mode Privileged Ex[...]

P RIORITY C OMMANDS 4-275 show map ip dscp This command shows the IP DSCP priority map . Syntax show map ip dscp [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) Default Setting None Command Mode Privileged Exec Example Related Command[...]

C OMMAND L INE I NTERFACE 4-276 Multicast Filtering Commands This switch uses IGMP (Interne t Gr oup Management Protocol) to quer y for any attac hed hosts that w ant to re cei ve a specific multicast servi ce. It identifies the ports containing hosts requesting a ser vice and sends data out to those ports only . It then propagates the ser vice req[...]

M ULTICAST F ILTERING C OMMANDS 4-277 ip igmp snooping This command enables IGMP snooping on this switch. Us e the no for m to disable it. Syntax [ no ] ip igmp snooping Default Setting Enabled Command Mode Global Configuration Example The following example enables IGMP snooping . ip igmp snooping vlan static This command adds a port to a multicast[...]

C OMMAND L INE I NTERFACE 4-278 Command Mode Global Configuration Example The following shows how to statica lly configure a multicast group on a port. ip igmp snooping version This command configures the IG MP snooping version. Use the no for m to restore the default. Syntax ip igmp snooping version { 1 | 2 } no ip igmp snooping v er sion • 1 - [...]

M ULTICAST F ILTERING C OMMANDS 4-279 show ip igmp snooping This command shows the IGMP snooping configuration. Default Setting None Command Mode Privileged Exec Command Usage See “Configuring IGMP Snooping and Quer y P arameters” on page 3-202 for a description of the displa yed items . Example The following shows the cur ren t IGMP snooping c[...]

C OMMAND L INE I NTERFACE 4-280 Command Mode Privileged Exec Command Usage Member types displayed includ e IGMP or USER, depending on selected options. Example The following shows the multicast entries learned through IGMP snooping for VLAN 1: IGMP Query Commands (Layer 2) Console#show mac-address-table multicas t vlan 1 igmp-snooping VLAN M'c[...]

M ULTICAST F ILTERING C OMMANDS 4-281 ip igmp snooping querier This command enables the switch as an IGMP querier. Use the no form to disable it. Syntax [ no ] ip igmp snooping querier Default Setting Enabled Command Mode Global Configuration Command Usage If enabled, the switch will ser ve as querier if elected. The querier is responsible for aski[...]

C OMMAND L INE I NTERFACE 4-282 Command Usage The quer y count defines how long the querier waits for a response from a multicast client before taki ng action. If a querier has sent a number of queries defined by this command, but a client has not responded, a countdown timer is started using the time defined by ip igmp snooping quer y-max- r espon[...]

M ULTICAST F ILTERING C OMMANDS 4-283 ip igmp snooping query-max-response-time This command configur es the query re port delay . Use the no for m to restore the default. Syntax ip igmp snooping quer y-max-response-time seconds no ip igmp snooping quer y-max-response-time seconds - The re port delay advertised in IGMP queries . (Range: 5-25) Defaul[...]

C OMMAND L INE I NTERFACE 4-284 ip igmp snooping router-port-ex pire-time This command configur es the query timeout. Use the no form to restore the default. Syntax ip igmp snooping router-por t-expire-time seconds no ip igmp snooping router-port-expir e-time seconds - The time the switch waits after the previous querier stops before it considers t[...]

M ULTICAST F ILTERING C OMMANDS 4-285 Static Multicast Routing Commands ip igmp snooping vlan mrouter This comm and statically configures a multicast router port. Use the no for m to remov e the configuration. Syntax [ no ] ip igmp snooping vlan vlan-id mrouter interface • vlan-id - VLAN ID (Range: 1-4093) • interface - ethernet unit / port - u[...]

C OMMAND L INE I NTERFACE 4-286 Example The following shows how to configure port 11 as a multicast router port within VLAN 1: show ip igmp snooping mrouter This command di splays inform ati on on statically configured and dynamically lear ned multicast router por ts . Syntax show ip igmp snooping mrouter [ vlan vlan-id ] vlan-id - VLAN ID (Range: [...]

IP I NTERFACE C OMMANDS 4-287 IP Interface Commands An IP addresses ma y be used for ma nagement access to the switch over your netw ork. The IP address for this switc h is obtained via DHCP by default. Y ou can man ually configure a specific IP add ress , or direct the device to obtain an addr ess from a BOOTP or DHCP ser ver when it is pow ered o[...]

C OMMAND L INE I NTERFACE 4-288 ip address This command sets the IP address for t he cur rently sel ected VLAN interface. Use the no form to restore the default IP address. Syntax ip address { ip-addr ess netmask | bootp | dhcp } no ip address • ip-address - IP address • netmask - Network mask for the associated IP subnet. This mask identifies [...]

IP I NTERFACE C OMMANDS 4-289 access to the switch. If you assi gn a n IP a d dr e s s to a n y o t h er VLAN, the new IP address overrides the original IP addres s and this becomes the new management VLAN. Example In the following example , the device is assigned an address in VLAN 1. Related Commands ip dhcp restart (4 -289) ip dhcp restart This [...]

C OMMAND L INE I NTERFACE 4-290 Example In the following example , the device is reassigned the sam e address . Related Commands ip address (4 -288) ip default-gateway This command e stablishes a static ro ute between this switch and devices that exist on another network segment. Use the no for m to remov e the static route. Syntax ip default-gatew[...]

IP I NTERFACE C OMMANDS 4-291 Related Commands show ip redirects (4 -291) show ip interface This comm and displays the se ttings of an IP interface. Default Setting All interfaces Command Mode Privileged Exec Example Related Commands show ip redirects (4 -291) show ip redirects This command shows the default gatewa y configured for thi s device. De[...]

C OMMAND L INE I NTERFACE 4-292 ping This command sends ICMP echo request pack ets to another node on the network. Syntax ping host [ size size ] [ count count ] • host - IP address or IP alias of the host. • size - Number of bytes in a packet. (Range: 32-512, default: 32) The actual packet size will be eight bytes larger than the size specifie[...]

IP I NTERFACE C OMMANDS 4-293 Example Related Commands interface (4 -174) Console#ping 10.1.0.9 Type ESC to abort. PING to 10.1.0.9, by 5 32-byte payload ICMP packets, timeout is 5 seconds response time: 10 ms response time: 10 ms response time: 10 ms response time: 10 ms response time: 0 ms Ping statistics for 10.1.0.9: 5 packets transmitted, 5 pa[...]

C OMMAND L INE I NTERFACE 4-294[...]

A-1 A PPENDI X A S OFTWARE S PECIFICATIONS Software Features Authentication Local, RADIUS , T A CA CS , P or t (802. 1X), HTTPS , SSH, P ort Security Access Control Lists IP , MA C (up to 32 lists) DHCP Client DNS Ser ver Port Configuration 1000B ASE-T: 10/100 Mbps at half/full duplex, 1000 Mbps at full duplex 1000BASE-SX/LX - 1000 Mbps at full dup[...]

S OFTWARE S PECIFICATIONS A-2 Por t T r un k in g Static tr unks (Cisco EtherChannel compliant) Dynamic tr unks (Link Ag g reg ation Control Protocol) Spanning T r ee Protoc ol Spanning T ree Protocol (STP , IEEE 802.1D) Rapid Spanning T ree Prot ocol (RSTP , IEEE 802.1w) Multiple Spanning T ree Prot ocol (MSTP , IEEE 802.1s) VLAN Suppor t Up to 25[...]

S OFTWARE S PECIFICATIONS A-3 Softwa re Loading TFTP in-band or XModem out-of-band SNMP Management access via MIB database T rap manag ement to specified hosts RMON Groups 1, 2, 3, 9 (Statistics , Histor y , Alar m, Event) Standards IEEE 802.1D Spanning T ree Pr otocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1v Pr[...]

S OFTWARE S PECIFICATIONS A-4 SNMPv2 (RFC 2571) SNMPv3 (RFC 3414, RFC 2570, RFC 22 73, RFC 3411 & RFC 3415) SNTP (RFC 2030) SSH (V ersion 2.0) TFTP (RFC 1350) Management Information Bases Bridge MIB (RFC 1493) DNS Resolv er MIB (RFC 1612) Entity MIB (RFC 2737) Ether-lik e MIB (RFC 2665) Extended Bridge MIB (RFC 2674) Extensible SNMP Agents MIB [...]

S OFTWARE S PECIFICATIONS A-5 T rap (RFC 1215) UDP MIB (RFC 2012)[...]

S OFTWARE S PECIFICATIONS A-6[...]

B-1 A PPENDIX B T ROUBLESHOOTING Problems Accessing the Management Interface Table B-1 Troubleshooting Chart Symptom Action Cannot connec t using Telnet, web browser, or SNMP software • Be sure the switc h is powered up. • Check network cabling between the management s tation and the switch. • Check th at you have a valid net work connection [...]

T R OUBLESHOOTING B-2 Cannot connec t using Secure Shell • If you can not connect using SSH, yo u may have exceeded the maximum number of concu rrent Telnet/SSH sessio ns permitted. Try connecting again at a later time. • Be sure the control paramete rs for the SSH server are properly configure d on the switch, and that the SSH client software [...]

U SING S YSTEM L OGS B-3 Using System Logs If a fault does occur, refer to the Installation Guide to ensure that the problem y ou encountered is ac tually caused b y the switc h. If the problem appears to be caused b y the switch, follo w these steps: 1. Enable log ging . 2. Set the er ror messag es repor ted to include all categ ories . 3. De sign[...]

T R OUBLESHOOTING B-4[...]

Glossary-1 G LOSSARY Access Control List (ACL) A CLs can limit network traff ic and re strict access to cer tain users or devices by c hecking eac h packet for certain IP or MA C (i.e., Layer 2) infor mation. Boot Prot ocol (BOOTP) BOOTP is used to pro vide bootup infor m ation for network devices , including IP address infor mation, th e address o[...]

G LOSSAR Y Glossary-2 Extensible Authentication Protocol over LAN (EAPOL) EAPOL is a client authentication protocol used by this switch to v erify the network access rights f or any device t hat is plug g ed into the sw itch. A user name and passw ord is requested by th e switch, and then passed to an authentication ser ver (e.g ., RADIUS) for v er[...]

G LOSSAR Y Glossary-3 IEEE 802.1Q VLAN T ag ging—Defines Et her net frame t ags which carry VLAN infor mation. It allows switches to a ssign endsta tions to different vir tual LANs , and defines a standard way for VLA Ns to communicate across switched netw orks . IEEE 802.1p An IEEE standard for providing quality of ser vice (QoS) in Etherne t ne[...]

G LOSSAR Y Glossary-4 IGMP Query On each subnetw ork, one IGMP-capable device will act as the querier — that is , the device that asks all hosts to repor t on the IP multicast g roups they wish to join or to which they already belong . T he elected querier will be the device with the lo west IP address in the sub network. Internet Group Managemen[...]

G LOSSAR Y Glossary-5 Link Aggregation See Port T runk. Link Ag g regation Control Pr otocol (LA CP) Allows ports to automatically negotiate a tr unked link with LA CP-configured por ts on another device. Management Infor mation Base (MIB) An acronym for Management Infor mati on Base. It is a set of database objects that contains inform at ion abou[...]

G LOSSAR Y Glossary-6 Port Trunk Defines a network link agg regation and tr unking method which specifies how to create a single high-speed logical link that combines several lower -speed physical links. Private VLA Ns Priv ate VLANs provide port-based secu rity and isolation between ports within the assigned VLAN . Data traffic on downlink ports c[...]

G LOSSAR Y Glossary-7 Simple Network Management Protocol (SNMP) The application protocol in the Intern et suite of protocols which offers network management services. Simple Network Ti me Protocol (SNTP) SNTP allows a device to set its internal clock based on periodic updates from a Netw ork Time Protocol (NTP) ser ver . Updates can be requested fr[...]

G LOSSAR Y Glossary-8 User Datagram Protocol (UDP) UDP provides a dat ag ram mode for pa ck et-switched comm unications . It uses IP as the underlying transport mechanism to provide access to I P-like ser vices . UDP packets are delivered ju st like IP packets – connection-less datag rams that may be discarded before reaching their targets . UDP [...]

Index-1 Numerics 802.1X, port authentication 4-104 A acceptable fr ame type 3-17 7 , 4-241 Access Cont rol List See ACL ACL Extend ed IP 3-88 , 4-114 , 4-116 , 4-120 MAC 3-88 , 4-114 , 4-133 , 4-134 – 4-137 Standard IP 3-88 , 4-114 , 4-116 , 4-118 address table 3-134 , 4-206 aging time 3-137 , 4-210 B BOOTP 3-20 , 4-288 BPDU 3-139 broadcast storm[...]

I NDEX Index-2 E edge port, STA 3-152 , 3-155 , 4-226 event logging 4-5 6 F firmware displaying version 3-14 , 4-81 upgrading 3-23 , 4-84 G GARP VLAN Regist ration Protocol See GVRP gateway, default 3-19 , 4-290 GVRP global setting 3-168 , 4-254 interface configuration 3-178 , 4-256 H hardware version, displaying 3-14 , 4-81 HTTPS 3-65 , 4-41 HTTPS[...]

I NDEX Index-3 multicast groups 3-207 , 4-279 displaying 4-279 static 3-207 , 4-277 , 4-279 multicast services configuring 3-208 , 4-277 displaying 3-207 , 4-279 multicast, static router port 3-206 , 4-285 P password, line 4-1 6 passwords 2-9 administrator setting 3-59 , 4-34 path cost 3-141 , 3-151 method 3-14 6 , 4-217 STA 3-141 , 3-151 , 4-217 p[...]

I NDEX Index-4 interface settings 3-149 , 3-160 , 3-162 , 4-225 – 4-232 , 4-233 link type 3-152 , 3-155 , 4-228 path cost 3-141 , 3-151 , 4-225 path cost method 3-146 , 4 -217 port priority 3-151 , 4-226 protocol migration 3-155 , 4-232 transmissi on limit 3-147 , 4-218 standards, IEEE A-3 startup files creating 3-27 , 4-84 displaying 3-23 , 4-76[...]

[...]

38 T esla Irvine, CA 92618 Phone: (949) 679-8 000 FOR TECHNICAL SUPPOR T , CALL: From U.S.A. and Canada (2 4 hours a day , 7 days a week) (800) SMC-4-Y OU; Phn: (949) 679-8000; F ax: (949) 679- 1481 From Europe: Contact details can be found on www .smc-europe.com or www .smc.com INTERNET E-mail addresses: techsupport@smc.com european.techsupp ort@s[...]

38 T esla Irvine, CA 92618 Phone: (949) 679-8 000[...]

-8[...]