TigerSwitch 10/100/1000 Gigabit Ethernet Switch ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ 12 auto-MDI/MDI-X 10/100/1000BASE-T ports 4 ports shared with 4 SFP transceiver slots Non-blocking switching architecture Support for a redundant power unit Spanning Tree Protocol, Rapid STP, and Multiple STP Up to six LACP or static 8-port trunks Layer 2/3/4 CoS support through 8 priority queues Layer 3/4 traffic priority with IP Precedence and IP DSCP Full support for VLANs with GVRP IGMP multicast filtering and snooping Support for
TigerSwitch 10/100/1000 Management Guide From SMC’s Tiger line of feature-rich workgroup LAN solutions 38 Tesla Irvine, CA 92618 Phone: (949) 679-8000 May 2005 Pub.
Information furnished by SMC Networks, Inc. (SMC) is believed to be accurate and reliable. However, no responsibility is assumed by SMC for its use, nor for any infringements of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent or patent rights of SMC. SMC reserves the right to change specifications at any time without notice. Copyright © 2005 by SMC Networks, Inc. 38 Tesla Irvine, CA 92618 All rights reserved.
LIMITED WARRANTY Limited Warranty Statement: SMC Networks, Inc. (“SMC”) warrants its products to be free from defects in workmanship and materials, under normal use and service, for the applicable warranty term. All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized Reseller. SMC may, at its own discretion, repair or replace any product not operating as warranted with a similar or functionally equivalent product, during the applicable warranty term.
LIMITED WARRANTY WARRANTIES EXCLUSIVE: IF AN SMC PRODUCT DOES NOT OPERATE AS WARRANTED ABOVE, CUSTOMER’S SOLE REMEDY SHALL BE REPAIR OR REPLACEMENT OF THE PRODUCT IN QUESTION, AT SMC’S OPTION. THE FOREGOING WARRANTIES AND REMEDIES ARE EXCLUSIVE AND ARE IN LIEU OF ALL OTHER WARRANTIES OR CONDITIONS, EXPRESS OR IMPLIED, EITHER IN FACT OR BY OPERATION OF LAW, STATUTORY OR OTHERWISE, INCLUDING WARRANTIES OR CONDITIONS OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
CONTENTS 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-1 Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Description of Software Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 System Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7 2 Initial Configuration . . . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS Setting the Switch’s IP Address . . . . . . . . . . . . . . . . . . . . . . . . Manual Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using DHCP/BOOTP . . . . . . . . . . . . . . . . . . . . . . . . . . . Managing Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Downloading System Software from a Server . . . . . . . . . . Saving or Restoring Configuration Settings . . . . . . . . . . . . . . . Downloading Configuration Settings from a Server . .
CONTENTS Configuring a MAC ACL Mask . . . . . . . . . . . . . . . . . . . . . 3-73 Binding a Port to an Access Control List . . . . . . . . . . . . . . . . . 3-75 Filtering IP Addresses for Management Access . . . . . . . . . . . . 3-77 Port Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-79 Displaying Connection Status . . . . . . . . . . . . . . . . . . . . . . . . . . 3-79 Configuring Interface Connections . . . . . . . . . . . . . . . . . . . . . .
CONTENTS Adding Static Members to VLANs (VLAN Index) . . . . Adding Static Members to VLANs (Port Index) . . . . . . Configuring VLAN Behavior for Interfaces . . . . . . . . . . Configuring Private VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . Enabling Private VLANs . . . . . . . . . . . . . . . . . . . . . . . . . Configuring Uplink and Downlink Ports . . . . . . . . . . . . Configuring Protocol-Based VLANs . . . . . . . . . . . . . . . . . . . Configuring Protocol Groups . . . . . . . . . . .
CONTENTS 4 Command Line Interface . . . . . . . . . . . . . . . . . . . . . . 4-1 Using the Command Line Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 Accessing the CLI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 Console Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-1 Telnet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Entering Commands . . . . . . . . . . . . . . . . . .
CONTENTS reload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . end . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . exit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . quit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . System Management Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS clear logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-62 show logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-63 SMTP Alert Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-65 logging sendmail host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-66 logging sendmail level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-67 logging sendmail source-email . . . . . . . . . . . . . . . .
CONTENTS radius-server key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-97 radius-server retransmit . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-97 radius-server timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-98 show radius-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-98 TACACS+ Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-99 tacacs-server host . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS match access-list ip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-133 show marking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-134 MAC ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-135 access-list mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-136 permit, deny (MAC ACL) . . . . . . . . . . . . . . . . . . . . . . . . . 4-137 show mac access-list . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . speed-duplex . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . negotiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . capabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . flowcontrol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . combo-forced-mode . . . . . . . . . . .
CONTENTS spanning-tree priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-212 spanning-tree pathcost method . . . . . . . . . . . . . . . . . . . . . . . . 4-213 spanning-tree transmission-limit . . . . . . . . . . . . . . . . . . . . . . . 4-214 spanning-tree mst configuration . . . . . . . . . . . . . . . . . . . . . . . 4-214 mst vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-215 mst priority . . . . . . . . . . . . . . . . . . . . . .
CONTENTS show protocol-vlan protocol-group . . . . . . . . . . . . . . . . . show interfaces protocol-vlan protocol-group . . . . . . . . Configuring Private VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . pvlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . show pvlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . GVRP and Bridge Extension Commands . . . . . . . . . . . . . . . . . . . . . bridge-ext gvrp . . . . . . . . . . . . . . . .
CONTENTS show mac-address-table multicast . . . . . . . . . . . . . . . . . . 4-274 IGMP Query Commands (Layer 2) . . . . . . . . . . . . . . . . . . . . . 4-275 ip igmp snooping querier . . . . . . . . . . . . . . . . . . . . . . . . . 4-276 ip igmp snooping query-count . . . . . . . . . . . . . . . . . . . . . 4-276 ip igmp snooping query-interval . . . . . . . . . . . . . . . . . . . . 4-277 ip igmp snooping query-max-response-time . . . . . . . . . . 4-278 ip igmp snooping router-port-expire-time . . .
TABLES Table 1-1 Table 1-1 Table 3-1 Table 3-2 Table 3-3 Table 3-4 Table 3-5 Table 3-6 Table 3-7 Table 3-8 Table 3-9 Table 3-10 Table 3-11 Table 3-12 Table 3-13 Table 4-1 Table 4-2 Table 4-3 Table 4-4 Table 4-5 Table 4-6 Table 4-7 Table 4-8 Table 4-9 Table 4-10 Table 4-11 Table 4-12 Table 4-13 Table 4-14 Table 4-15 Table 4-16 Table 4-17 Table 4-18 xvi Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 System Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . .
TABLES Table 4-19 Table 4-20 Table 4-21 Table 4-22 Table 4-23 Table 4-24 Table 4-25 Table 4-26 Table 4-27 Table 4-28 Table 4-29 Table 4-30 Table 4-31 Table 4-32 Table 4-33 Table 4-34 Table 4-35 Table 4-36 Table 4-37 Table 4-38 Table 4-39 Table 4-40 Table 4-41 Table 4-42 Table 4-43 Table 4-44 Table 4-45 Table 4-46 Table 4-47 Table 4-48 Table 4-49 Table 4-50 Table 4-51 Table 4-52 Table 4-53 Table 4-54 Table 4-55 show logging trap - display description . . . . . . . . . . . . . . 4-65 SMTP Alert Commands . .
TABLES Table 4-56 Table 4-57 Table 4-58 Table 4-59 Table 4-60 Table 4-61 Table 4-62 Table 4-63 Table 4-64 Table 4-65 Table 4-66 Table 4-67 Table 4-68 Table 4-69 Table B-1 xviii Protocol-based VLAN Commands . . . . . . . . . . . . . . . . 4-242 Private VLAN Commands . . . . . . . . . . . . . . . . . . . . . . 4-247 GVRP and Bridge Extension Commands . . . . . . . . . . 4-249 Priority Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-254 Priority Commands (Layer 2) . . . . . . . . . . . . .
TABLES xix
FIGURES Figure 3-1 Figure 3-2 Figure 3-3 Figure 3-4 Figure 3-5 Figure 3-6 Figure 3-7 Figure 3-8 Figure 3-9 Figure 3-10 Figure 3-11 Figure 3-12 Figure 3-13 Figure 3-14 Figure 3-15 Figure 3-16 Figure 3-17 Figure 3-18 Figure 3-19 Figure 3-20 Figure 3-21 Figure 3-22 Figure 3-23 Figure 3-24 Figure 3-25 Figure 3-26 Figure 3-27 Figure 3-28 Figure 3-29 Figure 3-30 Figure 3-31 Figure 3-32 Figure 3-33 xx Homepage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 Panel Display . . . . . .
FIGURES Figure 3-34 Figure 3-35 Figure 3-36 Figure 3-37 Figure 3-38 Figure 3-39 Figure 3-40 Figure 3-41 Figure 3-42 Figure 3-43 Figure 3-44 Figure 3-45 Figure 3-46 Figure 3-47 Figure 3-48 Figure 3-49 Figure 3-50 Figure 3-51 Figure 3-52 Figure 3-53 Figure 3-54 Figure 3-55 Figure 3-56 Figure 3-57 Figure 3-58 Figure 3-59 Figure 3-60 Figure 3-61 Figure 3-62 Figure 3-63 Figure 3-64 Figure 3-65 Figure 3-66 Figure 3-67 Figure 3-68 Figure 3-69 Figure 3-70 ACL Port Binding . . . . . . . . . . . . . . . . . . . . .
FIGURES Figure 3-71 Figure 3-72 Figure 3-73 Figure 3-74 Figure 3-75 Figure 3-76 Figure 3-77 Figure 3-78 Figure 3-79 Figure 3-80 Figure 3-81 Figure 3-82 Figure 3-83 Figure 3-84 Figure 3-85 Figure 3-86 Figure 3-87 Figure 3-88 xxii Traffic Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Queue Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Queue Scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IP Precedence/DSCP Priority Status . . . . . . .
CHAPTER 1 INTRODUCTION This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch. However, there are many options that you should configure to maximize the switch’s performance for your particular network environment.
INTRODUCTION Table 1-1 Key Features Feature Description Broadcast Storm Control Supported Static Address Up to 16K MAC addresses in the forwarding table IEEE 802.1D Bridge Supports dynamic data switching and addresses learning Store-and-Forward Supported to ensure wire-speed switching while eliminating Switching bad frames Spanning Tree Protocol Supports standard STP, Rapid Spanning Tree Protocol (RSTP), and Multiple Spanning Trees (MSTP) Virtual LANs Up to 255 using IEEE 802.
DESCRIPTION OF SOFTWARE FEATURES Authentication – This switch authenticates management access via the console port, Telnet or web browser. User names and passwords can be configured locally or can be verified via a remote authentication server (i.e., RADIUS or TACACS+). Port-based authentication is also supported via the IEEE 802.1X protocol. This protocol uses the Extensible Authentication Protocol over LANs (EAPOL) to request a user name and password from the 802.
INTRODUCTION Port Mirroring – The switch can unobtrusively mirror traffic from any port to a monitor port. You can then attach a protocol analyzer or RMON probe to this port to perform traffic analysis and verify connection integrity. Port Trunking – Ports can be combined into an aggregate connection. Trunks can be manually set up or dynamically configured using IEEE 802.3ad Link Aggregation Control Protocol (LACP).
DESCRIPTION OF SOFTWARE FEATURES To avoid dropping frames on congested ports, the switch provides 1 MB for frame buffering. This buffer can queue packets awaiting transmission on congested networks. Spanning Tree Protocol – The switch supports these spanning tree protocols: Spanning Tree Protocol (STP, IEEE 802.1D) – This protocol adds a level of fault tolerance by allowing two or more redundant connections to be created between a pair of LAN segments.
INTRODUCTION Virtual LANs – The switch supports up to 255 VLANs. A Virtual LAN is a collection of network nodes that share the same collision domain regardless of their physical location or connection point in the network. The switch supports tagged VLANs based on the IEEE 802.1Q standard. Members of VLAN groups can be dynamically learned via GVRP, or ports can be manually assigned to a specific set of VLANs. This allows the switch to restrict traffic to the VLAN groups to which a user has been assigned.
SYSTEM DEFAULTS System Defaults The switch’s system defaults are provided in the configuration file “Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as the startup configuration file (page 3-25). The following table lists some of the basic system defaults.
INTRODUCTION Function Port Configuration Table 1-2 System Defaults (Continued) Parameter Default Admin Status Enabled Auto-negotiation Enabled Flow Control Disabled Port Capability 1000BASE-T – (10 Mbps half duplex) (10 Mbps full duplex) (100 Mbps half duplex) (100 Mbps full duplex) (1000 Mbps full duplex) (Full-duplex flow control) (disabled) (Symmetric flow control) (disabled) 1000BASE-SX/LX/LH – Rate Limiting Port Trunking Broadcast Storm Protection Spanning Tree Protocol Address Table 1-8 Input an
SYSTEM DEFAULTS Table 1-2 System Defaults (Continued) Function Parameter Default Virtual LANs Default VLAN 1 PVID 1 Acceptable Frame Type All Ingress Filtering Disabled Switchport Mode (Egress Hybrid: tagged/untagged Mode) frames GVRP (global) Disabled GVRP (port interface) Disabled Traffic Ingress Port Priority 0 Prioritization Weighted Round Robin Queue: 0 1 2 3 4 5 6 7 Priority: 2 0 1 3 4 5 6 7 IP Precedence Priority Disabled IP DSCP Priority Disabled IP Settings IP Address 0.0.0.0 Subnet Mask 255.0.0.
INTRODUCTION 1-10
CHAPTER 2 INITIAL CONFIGURATION Connecting to the Switch Configuration Options The switch includes a built-in network management agent. The agent offers a variety of management options, including SNMP, RMON and a Web-based interface. A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI). Note: The IP address for this switch is unassigned by default. To change this address, see “Setting an IP Address” on page 2-6.
INITIAL CONFIGURATION The switch’s Web interface, CLI configuration program, and SNMP agent allow you to perform the following management functions: • Set user names and passwords for up to 16 users • • • • • Set an IP interface for a management VLAN Configure SNMP parameters Enable/disable any port Set the speed/duplex mode for any port Configure the bandwidth of any port by limiting input or output rates • • • • • • • • • • • Configure up to 255 IEEE 802.
CONNECTING TO THE SWITCH To connect a terminal to the console port, complete the following steps: 1. Connect the console cable to the serial port on a terminal, or a PC running terminal emulation software, and tighten the captive retaining screws on the DB-9 connector. 2. Connect the other end of the cable to the RS-232 serial port on the switch. 3. Make sure the terminal emulation software is set as follows: • • • • • • Select the appropriate serial port (COM port 1 or COM port 2).
INITIAL CONFIGURATION Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you must first configure it with a valid IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol. The IP address for this switch is unassigned by default. To manually configure this address or enable dynamic address assignment via DHCP or BOOTP, see “Setting an IP Address” on page 2-6. Note: This switch supports four concurrent Telnet sessions.
BASIC CONFIGURATION Access to both CLI levels are controlled by user names and passwords. The switch has a default user name and password for each level. To log into the CLI at the Privileged Exec level using the default user name and password, perform these steps: 1. To initiate your console connection, press . The “User Access Verification” procedure starts. 2. At the Username prompt, enter “admin.” 3. At the Password prompt, also enter “admin.
INITIAL CONFIGURATION Type “username admin password 0 password,” for the Privileged Exec level, where password is your new password. Press . Username: admin Password: CLI session with the SMC8612T2 is opened. To end the CLI session, enter [Exit].
BASIC CONFIGURATION Before you can assign an IP address to the switch, you must obtain the following information from your network administrator: • • • IP address for the switch Default gateway for the network Network mask for this network To assign an IP address to the switch, complete the following steps: 1. From the Privileged Exec level global configuration mode prompt, type “interface vlan 1” to access the interface-configuration mode. Press . 2.
INITIAL CONFIGURATION If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the switch will start broadcasting service requests as soon as it is powered on. To automatically configure the switch by communicating with BOOTP or DHCP address allocation servers on the network, complete the following steps: 1. From the Global Configuration mode prompt, type “interface vlan 1” to access the interface-configuration mode. Press . 2.
BASIC CONFIGURATION 6. Then save your configuration changes by typing “copy running-config startup-config.” Enter the startup file name and press . Console(config)#interface vlan 1 Console(config-if)#ip address dhcp Console(config-if)#end Console#ip dhcp restart client Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: dhcp. Console#copy running-config startup-config Startup configuration file name []: startup \Write to FLASH Programming.
INITIAL CONFIGURATION The default strings are: • public - with read-only access. Authorized management stations are only able to retrieve MIB objects. • private - with read-write access. Authorized management stations are able to both retrieve and modify MIB objects. Note: If you do not intend to utilize SNMP, we recommend that you delete both of the default community strings. If there are no community strings, then SNMP management access to the switch is disabled.
BASIC CONFIGURATION Trap Receivers You can also specify SNMP stations that are to receive traps from the switch. To configure a trap receiver, complete the following steps: 1. From the Privileged Exec level global configuration mode prompt, type “snmp-server host host-address community-string,” where “host-address” is the IP address for the trap receiver and “community-string” is the string associated with that host. Press . 2.
INITIAL CONFIGURATION Managing System Files The switch’s flash memory supports three types of system files that can be managed by the CLI program, Web interface, or SNMP. The switch’s file system allows files to be uploaded and downloaded, copied, deleted, and set as a start-up file. The three types of files are: • Configuration — This file stores system configuration information and is created when configuration settings are saved.
MANAGING SYSTEM FILES Note that configuration files should be downloaded using a file name that reflects the contents or usage of the file settings. If you download directly to the running-config, the system will reboot, and the settings will have to be copied from the running-config to a permanent file.
INITIAL CONFIGURATION 2-14
CHAPTER 3 CONFIGURING THE SWITCH Using the Web Interface This switch provides an embedded HTTP Web agent. Using a Web browser you can configure the switch and view statistics to monitor network activity. The Web agent can be accessed by any computer on the network using a standard Web browser (Internet Explorer 5.0 or above, or Netscape Navigator 6.2 or above). Note: You can also use the Command Line Interface (CLI) to manage the switch over a serial connection to the console port or via Telnet.
CONFIGURING THE SWITCH Notes: 1. You are allowed three attempts to enter the correct password; on the third failed attempt the current connection is terminated. 2. If you log into the Web interface as guest (Normal Exec level), you can view the configuration settings or change the guest password. If you log in as “admin” (Privileged Exec level), you can change the settings on any page. 3.
NAVIGATING THE WEB BROWSER INTERFACE Navigating the Web Browser Interface To access the web-browser interface you must first enter a user name and password. The administrator has Read/Write access to all configuration parameters and statistics. The default user name and password for the administrator is “admin.” Home Page When your web browser connects with the switch’s web agent, the home page is displayed as shown below.
CONFIGURING THE SWITCH Configuration Options Configurable parameters have a dialog box or a drop-down list. Once a configuration change has been made on a page, be sure to click on the “Apply” button to confirm the new setting. The following table summarizes the web page configuration buttons. Table 3-1 Configuration Options Button Action Revert Cancels specified values and restores current values prior to pressing “Apply.” help Links directly to webhelp. Apply Sets specified values to the system.
NAVIGATING THE WEB BROWSER INTERFACE Main Menu Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program.
CONFIGURING THE SWITCH Table 3-2 Main Menu (Continued) Menu Description SSH 3-41 Settings Configures Secure Shell server settings 3-46 Host-Key Settings Generates the host key pair (public and private) 3-44 Port Security Configures per port security, including status, response for security breach, and maximum allowed MAC addresses 3-48 802.
NAVIGATING THE WEB BROWSER INTERFACE Table 3-2 Main Menu (Continued) Menu Description LACP Page 3-89 Configuration Allows ports to dynamically join trunks 3-89 Aggregation Port Configures system priority, admin key, and port priority 3-91 Port Counters Information Displays statistics for LACP protocol messages 3-94 Port Internal Information Displays settings and operational state for local side 3-96 Port Neighbors Information Displays settings and operational state for remote side 3-99 Po
CONFIGURING THE SWITCH Table 3-2 Main Menu (Continued) Menu Address Aging Description Sets timeout for dynamically learned entries Spanning Tree Page 3-115 3-116 STA Information Displays STA values used for the bridge 3-118 Configuration Configures global bridge settings for STA, RSTP and MSTP 3-122 Port Information Displays individual port settings for STA 3-127 Trunk Information Displays individual trunk settings for STA 3-127 Port Configuration Configures individual port settings for STA
NAVIGATING THE WEB BROWSER INTERFACE Table 3-2 Main Menu (Continued) Menu Description VLAN Page 3-142 802.
CONFIGURING THE SWITCH Table 3-2 Main Menu (Continued) Menu Description Traffic Classes Status Enables/disables traffic class priorities (not implemented) Queue Mode Sets queue mode to strict priority or Weighted Round-Robin 3-168 Queue Scheduling Configures Weighted Round Robin queueing 3-169 IP Precedence/ DSCP Priority Status Globally selects IP Precedence or DSCP Priority, or disables both.
NAVIGATING THE WEB BROWSER INTERFACE Table 3-2 Main Menu (Continued) Menu Description Page IP Multicast Registration Displays all multicast groups active on this Table switch, including multicast IP addresses and VLAN ID 3-188 IGMP Member Port Table Indicates multicast addresses associated with the selected VLAN 3-189 General Configuration Enables DNS; configures domain name and domain list; and specifies IP address of name servers for dynamic lookup 3-191 Static Host Table Configures static ent
CONFIGURING THE SWITCH Basic Configuration Displaying System Information You can easily identify the system by displaying the device name, location and contact information. Field Attributes • System Name – Name assigned to the switch system. • Object ID – MIB II object ID for switch’s network management subsystem. • Location – Specifies the system location. • Contact – Administrator responsible for the system. • System Up Time – Length of time the management agent has been up.
BASIC CONFIGURATION Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that allows access to the Command Line Interface via Telnet.) Figure 3-3 System Information CLI – Specify the hostname, location and contact information.
CONFIGURING THE SWITCH Displaying Switch Hardware/Software Versions Use the Switch Information page to display hardware/firmware version numbers for the main board and management software, as well as the power status of the system. Field Attributes Main Board • Serial Number – The serial number of the switch. • Number of Ports – Number of built-in RJ-45 ports and expansion ports. • Hardware Version – Hardware version of the main board.
BASIC CONFIGURATION Web – Click System, Switch Information. Figure 3-4 Switch Information CLI – Use the following command to display version information. Console#show version Unit1 Serial number Hardware version Number of ports Main power status Redundant power status Agent(master) Unit id Loader version Boot rom version Operation code version Console# 4-83 :S505008850 :R01A :12 :up :not present :1 :2.2.0.3 :2.1.0.4 :1.4.0.
CONFIGURING THE SWITCH Displaying Bridge Extension Capabilities The Bridge MIB includes extensions for managed devices that support Multicast Filtering, Traffic Classes, and Virtual LANs. You can access these extensions to display default settings for the key variables. Field Attributes 3-16 • Extended Multicast Filtering Services – This switch does not support the filtering of individual multicast addresses based on GMRP (GARP Multicast Registration Protocol).
BASIC CONFIGURATION Web – Click System, Bridge Extension Configuration. Figure 3-5 Bridge Extension Configuration CLI – Enter the following command.
CONFIGURING THE SWITCH You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods. Anything outside this format will not be accepted by the CLI program. Command Attributes 3-18 • Management VLAN – ID of the configured VLAN (1-4094, no leading zeroes). By default, all ports on the switch are members of VLAN 1.
BASIC CONFIGURATION Manual Configuration Web – Click System, IP Configuration. Select the VLAN through which the management station is attached, set the IP Address Mode to “Static,” enter the IP address, subnet mask and gateway, then click Apply. Figure 3-6 Manual IP Configuration CLI – Specify the management interface, IP address and default gateway. Console#config Console(config)#interface vlan 1 Console(config-if)#ip address 10.1.0.254 255.255.255.
CONFIGURING THE SWITCH Using DHCP/BOOTP If your network provides DHCP/BOOTP services, you can configure the switch to be dynamically configured by these services. Web – Click System, IP Configuration. Specify the VLAN to which the management station is attached, set the IP Address Mode to DHCP or BOOTP. Click Apply to save your changes. Then click Restart DHCP to immediately request a new address. Note that the switch will also broadcast a request for IP configuration settings on each power reset.
BASIC CONFIGURATION Renewing DCHP – DHCP may lease addresses to clients indefinitely or for a specific period of time. If the address expires or the switch is moved to another network segment, you will lose management access to the switch. In this case, you can reboot the switch or submit a client request to restart DHCP service via the CLI. Web – If the address assigned by DHCP is no longer functioning, you will not be able to renew the IP settings via the web interface.
CONFIGURING THE SWITCH Managing Firmware You can upload/download firmware to or from a TFTP server. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation. You can also set the switch to use new firmware without overwriting the previous version. Note: Runtime code can also be upgraded by using Batch Upgrade. Batch Upgrade can discover switches on local, or other networks.
BASIC CONFIGURATION Web – Click System, File, Firmware. Enter the IP address of the TFTP server, enter the file name of the software to download, select a file on the switch to overwrite or specify a new file name, then click Transfer from Server. To start the new firmware, reboot the system via the System/Reset menu.
CONFIGURING THE SWITCH CLI – Enter the IP address of the TFTP server, select “config” or “opcode” file type, then enter the source and destination file names, set the new file to start up the system, and then restart the switch. . Console#copy tftp file TFTP server ip address: 10.1.0.19 Choose file type: 1. config: 2. opcode: <1-2>: 2 Source file name: v1000-18.bix Destination file name: V1.0 \Write to FLASH Programming. -Write to FLASH finish. Success. Console#config Console(config)#boot system opcode:V1.
BASIC CONFIGURATION Downloading Configuration Settings from a Server You can download the configuration file under a new file name and then set it as the startup file, or you can specify the current startup configuration file as the destination file to directly replace it. Note that the file “Factory_Default_Config.cfg” can be copied to the TFTP server, but cannot be used as the destination on the switch. Web – Click System, File, Configuration.
CONFIGURING THE SWITCH CLI – Enter the IP address of the TFTP server, specify the source file on the server, set the startup file name on the switch, and then restart the switch . Console#copy tftp startup-config TFTP server ip address: 192.168.1.19 Source configuration file name: config-1 Startup configuration file name [] : startup \Write to FLASH Programming. -Write to FLASH finish. Success.
BASIC CONFIGURATION Setting the System Clock Simple Network Time Protocol (SNTP) allows the switch to set its internal clock based on periodic updates from a time server (SNTP or NTP). Maintaining an accurate time on the switch enables the system log to record meaningful dates and times for event entries. You can also manually set the clock using the CLI. (See “calendar set” on page 4-75.) If the clock is not set, the switch will only record the time from the factory default set at the last bootup.
CONFIGURING THE SWITCH Web – Select SNTP, Configuration. Modify any of the required parameters, and click Apply. Figure 3-13 SNTP Configuration CLI – This example configures the switch to operate as an SNTP client and then displays the current time and settings. Console(config)#sntp client 4-73 Console(config)#sntp poll 16 4-72 Console(config)#sntp server 10.1.0.19 137.82.140.80 128.250.36.
BASIC CONFIGURATION • Minutes (0-59) – The number of minutes before/after UTC. • Direction – Configures the time zone to be before (east) or after (west) UTC. Web – Select SNTP, Clock Time Zone. Set the offset for your time zone relative to the UTC, and click Apply. Figure 3-14 Clock Time Zone CLI - This example shows how to set the time zone for the system clock.
CONFIGURING THE SWITCH Simple Network Management Protocol Simple Network Management Protocol (SNMP) is a communication protocol designed specifically for managing devices on a network. Equipment commonly managed with SNMP includes switches, routers and host computers. SNMP is typically used to configure these devices for proper operation in a network environment, as well as to monitor them to evaluate performance or detect potential problems.
SIMPLE NETWORK MANAGEMENT PROTOCOL • Access Mode - Read-Only – Specifies read-only access. Authorized management stations are only able to retrieve MIB objects. - Read/Write – Specifies read-write access. Authorized management stations are able to both retrieve and modify MIB objects. Web – Click SNMP, Configuration. Add new community strings as required, select the access rights from the Access Mode drop-down list, then click Add.
CONFIGURING THE SWITCH Command Attributes • Trap Manager Capability – This switch supports up to five trap managers. • Trap Manager IP Address – Internet address of the host (the targeted recipient). • Trap Manager Community String – Community string sent with the notification operation. (Range: 1-32 characters, case sensitive) Trap Version – Specifies whether to send notifications as SNMP v1 or v2c traps. (The default is version 1.
USER AUTHENTICATION User Authentication You can restrict management access to this switch using the following options: • • • • • • • Passwords – Manually configure access rights on the switch for specified users. Authentication Settings – Use remote authentication to configure access rights. HTTPS Settings – Provide a secure web connection. SSH Settings – Provide a secure shell (for secure Telnet access). Port Security – Configure secure addresses for individual ports. 802.1X – Use IEEE 802.
CONFIGURING THE SWITCH • Password – Specifies the user password. (Range: 0-8 characters plain text, case sensitive) Web – Click Security, Passwords. To change the password for the curr9ent user, enter the old password, the new password, confirm it by entering it again, then click Apply. Figure 3-17 Configuring the Logon Password CLI – Assign a user name to access-level 15 (i.e., administrator), then specify the password.
USER AUTHENTICATION Remote Authentication Dial-in User Service (RADIUS) and Terminal Access Controller Access Control System Plus (TACACS+) are logon authentication protocols that use software running on a central server to control access to RADIUS-aware or TACACS -aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user that requires management access to the switch. RADIUS uses UDP while TACACS+ uses TCP.
CONFIGURING THE SWITCH Command Attributes • Authentication – Select the authentication, or authentication sequence required: - Local – User authentication is performed only locally by the switch. - Radius – User authentication is performed using a RADIUS server only. - TACACS – User authentication is performed using a TACACS+ server only. • - [authentication sequence] – User authentication is performed by up to three authentication methods in the indicated sequence.
USER AUTHENTICATION • TACACS Settings - Server IP Address – Address of the TACACS+ server. (Default: 10.11.12.13) - Server Port Number – Network (TCP) port of TACACS+ server used for authentication messages. (Range: 1-65535; Default: 49) - Secret Text String – Encryption key used to authenticate logon access for client. Do not use blank spaces in the string. (Maximum length: 20 characters) Note: The local switch user database has to be set up by manually entering user names and passwords using the CLI.
CONFIGURING THE SWITCH CLI – Specify all the required parameters to enable logon authentication. Console(config)#authentication login radius Console(config)#radius-server host 192.168.1.25 Console(config)#radius-server port 181 Console(config)#radius-server key green Console(config)#radius-server retransmit 5 Console(config)#radius-server timeout 10 Console(config)#end Console#show radius-server Remote radius server configuration: Server IP address: 192.168.1.
USER AUTHENTICATION • • - The client and server negotiate a set of security protocols to use for the connection. - The client and server generate session keys for encrypting and decrypting data. The client and server establish a secure encrypted connection. A padlock icon should appear in the status bar for Internet Explorer 5.x or above and Netscape Navigator 6.2 or above.
CONFIGURING THE SWITCH Web – Click Security, HTTPS Settings. Enable HTTPS and specify the port number, then click Apply. Figure 3-19 HTTPS Settings CLI – This example enables the HTTP secure server and modifies the port number.
USER AUTHENTICATION When you have obtained these, place them on your TFTP server, and use the following command at the switch's command-line interface to replace the default (unrecognized) certificate with an authorized one: Console#copy tftp https-certificate TFTP server ip address: Source certificate file name: Source private file name: Private password: 4-86 Note: The switch must be reset for the new certific
CONFIGURING THE SWITCH Command Usage The SSH server on this switch supports both password and public key authentication. If password authentication is specified by the SSH client, then the password can be authenticated either locally or via a RADIUS or TACACS+ remote authentication server, as specified on the Authentication Settings page (page 3-34).
USER AUTHENTICATION public key files based on standard UNIX format as shown in the following example for an RSA Version 1 key: 1024 35 1341081685609893921040944920155425347631641921872958921143173880 05553616163105177594083868631109291232226828519254374603100937187721199696317 81366277414168985132049117204830339254324101637997592371449011938006090253948 40848271781943722884025331159521348610229029789827213532671316294325328189150 45306393916643 steve@192.168.1.19 4.
CONFIGURING THE SWITCH 2. The SSH server supports up to four client sessions. The maximum number of client sessions includes both current Telnet sessions and SSH sessions. Generating the Host Key Pair A host public/private key pair is used to provide secure communications between an SSH client and the switch. After generating this key pair, you must provide the host public key to SSH clients and import the client’s public key to the switch as described in the proceeding section (Command Usage).
USER AUTHENTICATION Web – Click Security, SSH, Host-Key Settings. Select the host-key type from the drop-down box, select the option to save the host key from memory to flash (if required) prior to generating the key, and then click Generate.
CONFIGURING THE SWITCH CLI – This example generates a host-key pair using both the RSA and DSA algorithms, stores the keys to flash memory, and then displays the host’s public keys.
USER AUTHENTICATION • SSH Authentication Retries – Specifies the number of authentication attempts that a client is allowed before authentication fails and the client has to restart the authentication process. (Range: 1-5 times; Default: 3) • SSH Server-Key Size – Specifies the SSH server key size. (Range: 512-896 bits) - The server key is a private key that is never shared outside the switch. - The host key is shared with the SSH client, and is fixed at 1024 bits. Web – Click Security, SSH, Settings.
CONFIGURING THE SWITCH CLI – This example enables SSH, sets the authentication parameters, and displays the current configuration. It shows that the administrator has made a connection via SHH, and then disables this connection. Console(config)#ip ssh server Console(config)#ip ssh timeout 100 Console(config)#ip ssh authentication-retries 3 Console(config)#ip ssh server-key size 512 Console(config)#end Console#show ip ssh SSH Enabled - version 2.
USER AUTHENTICATION already in the address table will be retained and will not age out. Any other device that attempts to use the port will be prevented from accessing the switch. Command Usage • • A secure port has the following restrictions: - It cannot use port monitoring. - It cannot be a multi-VLAN port. - It cannot be used as a member of a static or dynamic trunk. - It should not be connected to a network interconnection device.
CONFIGURING THE SWITCH Web – Click Security, Port Security. Set the action to take when an invalid address is detected on a port, mark the checkbox in the Status column to enable security for a port, set the maximum number of MAC addresses allowed on a port, and click Apply. Figure 3-22 Configuring Port Security CLI – This example sets the command mode to Port 5, sets the port security action to send a trap and disable the port, and then enables port security for the switch.
USER AUTHENTICATION Configuring 802.1X Port Authentication Network switches can provide open and easy access to network resources by simply attaching a client PC. Although this automatic configuration and access is a desirable feature, it also allows unauthorized personnel to easily intrude and possibly gain access to sensitive network data. The IEEE 802.
CONFIGURING THE SWITCH 802.1x client RADIUS server 1. Client attempts to access a switch port. 2. Switch sends client an identity request. 3. Client sends back identity information. 4. Switch forwards this to authentication server. 5. Authentication server challenges client. 6. Client responds with proper credentials. 7. Authentication server approves access. 8. Switch grants client access to this port. The operation of 802.
USER AUTHENTICATION Command Attributes • 802.1X System Authentication Control – The global setting for 802.1X. Web – Click Security, 802.1X, Information. Figure 3-23 802.1X Global Information CLI – This example shows the default global settings for 802.1X. Console#show dot1x Global 802.1X Parameters system-auth-control: enable 4-111 802.1X Port Summary Port Name Status 1/1 disabled 1/2 disabled . . .
CONFIGURING THE SWITCH Configuring 802.1X Global Settings The 802.1X protocol includes port authentication. The 802.1X protocol must be enabled globally for the switch system before port settings are active. Command Attributes • 802.1X System Authentication Control – Sets the global setting for 802.1X. (default: Enabled) Web – Select Security, 802.1X, Configuration. Enable dot1X globally for the switch and click Apply. Figure 3-24 802.1X Configuration CLI – This example enables 802.
USER AUTHENTICATION Command Attributes • Status – Indicates if authentication is enabled or disabled on the port. • Operation Mode – Allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. (Range: Single-Host, Multi-Host; Default: Single-Host) • Max Count – The maximum number of hosts that can connect to a port when the Multi-Host operation mode is selected.
CONFIGURING THE SWITCH • Authorized – • - Yes – Connected client is authorized. - No – Connected client is not authorized. - Blank – Displays nothing when dot1x is disabled on a port. Supplicant – Indicates the MAC address of a connected client. • Trunk – Indicates if the port is configured as a trunk port. Web – Click Security, 802.1X, Port Configuration. Modify the parameters required, and click Apply. Figure 3-25 802.
USER AUTHENTICATION CLI – This example sets the authentication mode to enable 802.1X on port 2, and allows up to ten clients to connect to this port.
CONFIGURING THE SWITCH Displaying 802.1X Statistics This switch can display statistics for dot1X protocol exchanges for any port. Table 3-4 802.1X Statistics 3-58 Parameter Description Rx EXPOL Start The number of EAPOL Start frames that have been received by this Authenticator. Rx EAPOL Logoff The number of EAPOL Logoff frames that have been received by this Authenticator.
USER AUTHENTICATION Web – Select Security, 802.1X, Statistics. Select the required port and then click Query. Click Refresh to update the statistics. Figure 3-26 802.1X Port Statistics CLI – This example displays the 802.1X statistics for port 4.
CONFIGURING THE SWITCH Access Control Lists Access Control Lists (ACL) provide packet filtering for IP frames (based on address, protocol, Layer 4 protocol port number or TCP control code) or any frames (based on MAC address or Ethernet type). To filter incoming packets, first create an access list, add the required rules, specify a mask to modify the precedence in which the rules are checked, and then bind the list to a specific port.
ACCESS CONTROL LISTS The order in which active ACLs are checked is as follows: 1. 2. 3. 4. 5. User-defined rules in the Egress MAC ACL for egress ports. User-defined rules in the Egress IP ACL for egress ports. User-defined rules in the Ingress MAC ACL for ingress ports. User-defined rules in the Ingress IP ACL for ingress ports. Explicit default rule (permit any any) in the ingress IP ACL for ingress ports. 6. Explicit default rule (permit any any) in the ingress MAC ACL for ingress ports. 7.
CONFIGURING THE SWITCH Web – Click Security, ACL, Configuration. Enter an ACL name in the Name field, select the list type (IP Standard, IP Extended, or MAC), and click Add to open the configuration page for the new list. Figure 3-27 Selecting ACL Type CLI – This example creates a standard IP ACL named bill.
ACCESS CONTROL LISTS Web – Specify the action (i.e., Permit or Deny). Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range. Then click Add. Figure 3-28 ACL Configuration - Standard IP CLI – This example configures one permit rule for the specific address 10.1.1.21 and another rule for the address range 168.92.16.x – 168.92.31.x using a bitmask. Console(config-std-acl)#permit host 10.1.1.
CONFIGURING THE SWITCH • Src/Dst Address – Source or destination IP address. • Src/Dst SubMask – Subnet mask for source or destination address. (See the description for SubMask on page 3-62.) • Service Type – Packet priority settings based on the following criteria: - Precedence – IP precedence level. (Range: 0-8) - TOS – Type of Service level. (Range: 0-16) - DSCP – DSCP priority level.
ACCESS CONTROL LISTS For example, use the code value and mask below to catch packets with the following flags set: - SYN flag valid, use control-code 2, control bitmask 2 Both SYN and ACK valid, use control-code 18, control bitmask 18 SYN valid and ACK invalid, use control-code 2, control bitmask 18 Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address.
CONFIGURING THE SWITCH CLI – This example adds three rules: 1. Accept any incoming packets if the source address is in subnet 10.7.1.x. For example, if the rule is matched; i.e., the rule (10.7.1.0 & 255.255.255.0) equals the masked address (10.7.1.2 & 255.255.255.0), the packet passes through. 2. Allow TCP packets from class C addresses 192.168.1.0 to any destination address when set for destination TCP port 80 (i.e., HTTP). 3. Permit all TCP packets from class C addresses 192.168.1.
ACCESS CONTROL LISTS • Ethernet Type – This option can only be used to filter Ethernet II formatted packets. (Range: 600-fff hex.) A detailed listing of Ethernet protocol types can be found in RFC 1060. A few of the more common types include 0800 (IP), 0806 (ARP), 8137 (IPX). • Ethernet Type Mask – Protocol bitmask. (Range: 600-fff hex.) • Packet Format – This attribute includes the following packet types: - Any – Any Ethernet packet type. - Untagged-eth2 – Untagged Ethernet II packets. - Untagged-802.
CONFIGURING THE SWITCH Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or MAC). If you select “Host,” enter a specific address (e.g., 11-22-33-44-55-66). If you select “MAC,” enter a base address and a hexidecimal bitmask for an address range. Set any other required criteria, such as VID, Ethernet type, or packet format. Then click Add.
ACCESS CONTROL LISTS Configuring ACL Masks You must specify masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/filter packets matching the permit/deny rules specified in an ingress ACL. You must also configure up to seven user-defined masks for an ingress or egress ACL. A mask must be bound exclusively to one of the basic ACL types (i.e.
CONFIGURING THE SWITCH Web – Click Security, ACL, Mask Configuration. Click Edit for one of the basic mask types to open the configuration page. Figure 3-31 Selecting ACL Mask Types CLI – This example creates an IP ingress mask, and then adds two rules. Each rule is checked in order of precedence to look for a match in the ACL entries. The first entry matching a mask is applied to the inbound packet.
ACCESS CONTROL LISTS Command Attributes • Src/Dst IP – Specifies the source or destination IP address. Use “Any” to match any address, “Host” to specify a host address (not a subnet), or “IP” to specify a range of addresses. (Options: Any, Host, IP; Default: Any) • Src/Dst IP Bitmask – Source or destination address of rule must match this bitmask. (See the description for SubMask on page 3-62.) • Protocol Bitmask – Check the protocol field.
CONFIGURING THE SWITCH Web – Configure the mask to match the required rules in the IP ingress or egress ACLs. Set the mask to check for any source or destination address, a specific host address, or an address range. Include other criteria to search for in the rules, such as a protocol type or one of the service types. Or use a bitmask to search for specific protocol port(s) or TCP control code(s). Then click Add.
ACCESS CONTROL LISTS CLI – This shows that the entries in the mask override the precedence in which the rules are entered into the ACL. In the following example, packets with the source address 10.1.1.1 are dropped because the “deny 10.1.1.1 255.255.255.255” rule has the higher precedence according the “mask host any” entry. Console(config)#access-list ip standard A2 Console(config-std-acl)#permit 10.1.1.0 255.255.255.0 Console(config-std-acl)#deny 10.1.1.1 255.255.255.
CONFIGURING THE SWITCH Web – Configure the mask to match the required rules in the MAC ingress or egress ACLs. Set the mask to check for any source or destination address, a host address, or an address range. Use a bitmask to search for specific VLAN ID(s) or Ethernet type(s). Or check for rules where a packet format was specified. Then click Add.
ACCESS CONTROL LISTS CLI – This example shows how to create an Ingress MAC ACL and bind it to a port. You can then see that the order of the rules have been changed by the mask.
CONFIGURING THE SWITCH • • When an ACL is bound to an interface as an egress filter, all entries in the ACL must be deny rules. Otherwise, the bind operation will fail. The switch does not support the explicit “deny any any” rule for the egress IP ACL or the egress MAC ACLs. If these rules are included in ACL, and you attempt to bind the ACL to an interface for egress checking, the bind operation will fail. Command Attributes • Port – Fixed port or SFP module.
ACCESS CONTROL LISTS CLI – This examples assigns an IP and MAC ingress ACL to port 1, and an IP ingress ACL to port 2.
CONFIGURING THE SWITCH Command Attributes • Web IP Filter – Configures IP address(es) for the web group. • SNMP IP Filter – Configures IP address(es) for the SNMP group. • Telnet IP Filter – Configures IP address(es) for the Telnet group. • IP Filter List – IP address which are allowed management access to this interface. • Start IP Address – A single IP address, or the starting address of a range. • End IP Address – The end address of a range. Web – Click Security, IP Filter.
PORT CONFIGURATION CLI – This example restricts management access for Telnet clients. Console(config)#management telnet-client 192.168.1.19 4-38 Console(config)#management telnet-client 192.168.1.25 192.168.1.
CONFIGURING THE SWITCH • Forced Mode3 – Shows the forced/preferred port type to use for combination ports 9-12. (Copper-Forced, Copper-Preferred-Auto, SFP-Forced, SFP-Preferred-Auto) • Trunk Member3 – Shows if port is a trunk member. • Creation4 – Shows if a trunk is manually configured or dynamically set via LACP. Web – Click Port, Port Information or Trunk Information. Figure 3-36 Port - Port Information Field Attributes (CLI) Basic information: • Port type – Indicates the port type.
PORT CONFIGURATION • Speed-duplex – Shows the current speed and duplex mode. (Auto, or fixed choice) • Capabilities – Specifies the capabilities to be advertised for a port during auto-negotiation. (To access this item on the web, see “Configuring Interface Connections” on page 3-48.) The following capabilities are supported.
CONFIGURING THE SWITCH Current status: • Link Status – Indicates if the link is up or down. • Operation speed-duplex – Shows the current speed and duplex mode. • Flow control type – Indicates the type of flow control currently in use. (IEEE 802.3x, Back-Pressure or none) CLI – This example shows the connection status for Port 5.
PORT CONFIGURATION Configuring Interface Connections You can use the Port Configuration or Trunk Configuration page to enable/disable an interface, set auto-negotiation and the interface capabilities to advertise, or manually fix the speed, duplex mode, and flow control. Command Attributes • Name – Allows you to label an interface. (Range: 1-64 characters) • Admin – Allows you to manually disable an interface. You can disable an interface due to abnormal behavior (e.g.
CONFIGURING THE SWITCH • • - FC - Supports flow control - Flow control can eliminate frame loss by “blocking” traffic from end stations or segments connected directly to the switch when its buffers fill. When enabled, back pressure is used for half-duplex operation and IEEE 802.3x for full-duplex operation. (Avoid using flow control on a port connected to a hub unless it is actually required to solve a problem.
PORT CONFIGURATION Web – Click Port, Port Configuration or Trunk Configuration. Modify the required interface settings, and click Apply. Figure 3-37 Port - Port Configuration CLI – Select the interface, and then enter the required settings. Console(config)#interface ethernet 1/8 Console(config-if)#description RD SW#13 Console(config-if)#shutdown . Console(config-if)#no shutdown Console(config-if)#no negotiation Console(config-if)#speed-duplex 100half Console(config-if)#flowcontrol .
CONFIGURING THE SWITCH The switch supports both static trunking and dynamic Link Aggregation Control Protocol (LACP). Static trunks have to be manually configured at both ends of the link, and the switches must comply with the Cisco EtherChannel standard. On the other hand, LACP configured ports can automatically negotiate a trunked link with LACP-configured ports on another device.
PORT CONFIGURATION Statically Configuring a Trunk Command Usage • When configuring static trunks, you may not be able to link switches of different types, depending on the manufacturer’s implementation. However, note that the static trunks on this switch are Cisco EtherChannel compatible.
CONFIGURING THE SWITCH Web – Click Port, Trunk Membership. Enter a trunk ID of 1-6 in the Trunk field, select any of the switch ports from the scroll-down port list, and click Add. After you have completed adding ports to the member list, click Apply.
PORT CONFIGURATION CLI – This example creates trunk 2 with ports 1 and 2. Just connect these ports to two static trunk ports on another switch to form a trunk.
CONFIGURING THE SWITCH • If more than four ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails. • All ports on both ends of an LACP trunk must be configured for full duplex, either by forced mode or auto-negotiation. Web – Click Port, LACP, Configuration. Select any of the switch ports from the scroll-down port list and click Add.
PORT CONFIGURATION CLI – The following example enables LACP for ports 1 to 6. Just connect these ports to LACP-enabled trunk ports on another switch to form a trunk. Console(config)#interface ethernet 1/1 4-168 Console(config-if)#lacp 4-188 Console(config-if)#exit . . .
CONFIGURING THE SWITCH Note: If the port channel admin key (lacp admin key, page 4-193) is not set (through the CLI) when a channel group is formed (i.e., it has a null value of 0), this key is set to the same value as the port admin key used by the interfaces that joined the group (lacp admin key, as described in this section and on page 4-192). Command Attributes Set Port Actor – This menu sets the local side of an aggregate link; i.e., the ports on this switch. • Port – Port number.
PORT CONFIGURATION Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and Port Priority for the Port Actor. You can optionally configure these settings for the Port Partner. (Be aware that these settings only affect the administrative state of the partner, and will not take effect until the next time an aggregate link is formed with this device.) After you have completed setting the port LACP parameters, click Apply.
CONFIGURING THE SWITCH CLI – The following example configures LACP parameters for ports 1-6. Ports 1-4 are used as active members of the LAG; ports 5 and 6 are set to backup mode. Console(config)#interface ethernet 1/1 4-168 Console(config-if)#lacp actor system-priority 3 4-191 Console(config-if)#lacp actor admin-key 120 4-192 Console(config-if)#lacp actor port-priority 128 4-194 Console(config-if)#exit . . .
PORT CONFIGURATION Table 3-5 LACP Port Counters (Continued) Field Description LACPDUs Unknown Number of frames received that either (1) Carry the Slow Pkts Protocols Ethernet Type value, but contain an unknown PDU, or (2) are addressed to the Slow Protocols group MAC Address, but do not carry the Slow Protocols Ethernet Type. LACPDUs Illegal Pkts Number of frames that carry the Slow Protocols Ethernet Type value, but contain a badly formed PDU or an illegal value of Protocol Subtype.
CONFIGURING THE SWITCH CLI – The following example displays LACP counters for port channel 1. Console#show lacp 1 counters 4-195 Port Channel: 1 ------------------------------------------------------------------Eth 1/ 1 ------------------------------------------------------------------LACPDUs Sent : 21 LACPDUs Received : 21 Marker Sent : 0 Marker Received : 0 LACPDUs Unknown Pkts : 0 LACPDUs Illegal Pkts : 0 . . .
PORT CONFIGURATION Table 3-6 LACP Internal Configuration Information (Continued) Field Description Admin State, Administrative or operational values of the actor’s state parameters: Oper State • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner. • Distributing – If false, distribution of outgoing frames on this link is disabled; i.e.
CONFIGURING THE SWITCH Web – Click Port, LACP, Port Internal Information. Select a port channel to display the corresponding information. Figure 3-42 LACP - Port Internal Information CLI – The following example displays the LACP configuration settings and operational state for the local side of port channel 1.
PORT CONFIGURATION Displaying LACP Settings and Status for the Remote Side You can display configuration settings and the operational state for the remote side of an link aggregation. Table 3-7 LACP Neighbor Configuration Information Field Description Partner Admin System ID LAG partner’s system ID assigned by the user. Partner Oper System ID LAG partner’s system ID assigned by the LACP protocol. Partner Admin Port Number Current administrative value of the port number for the protocol Partner.
CONFIGURING THE SWITCH Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-43 LACP - Port Neighbors Information CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1.
PORT CONFIGURATION Setting Broadcast Storm Thresholds Broadcast storms may occur when a device on your network is malfunctioning, or if application programs are not well designed or properly configured. If there is too much broadcast traffic on your network, performance can be severely degraded or everything can come to complete halt. You can protect your network from broadcast storms by setting a threshold for broadcast traffic for each port.
CONFIGURING THE SWITCH Web – Click Port, Port Broadcast Control or Trunk Broadcast Control. Check the Enabled box for any interface, set the threshold, and click Apply. Figure 3-44 Port Broadcast Control CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 600 packets per second for port 2.
PORT CONFIGURATION Configuring Port Mirroring You can mirror traffic from any source port to a target port for real-time analysis. You can then attach a logic analyzer or RMON probe to the target port and study the traffic crossing the source port in a completely unobtrusive manner. Source port(s) Single target port Command Usage • Monitor port speed should match or exceed source port speed, otherwise traffic may be dropped from the monitor port.
CONFIGURING THE SWITCH Web – Click Port, Mirror Port Configuration. Specify the source port, the traffic type to be mirrored, and the monitor port, then click Add. Figure 3-45 Mirror Port Configuration CLI – Use the interface command to select the monitor port, then use the port monitor command to specify the source port. Note that default mirroring under the CLI is for both received and transmitted packets.
PORT CONFIGURATION Command Attribute Rate Limit – Sets the output rate limit for an interface. - Default Status – Disabled - Default Rate – 1000 Mbps - Range – 1 - 1000 Mbps Web - Click Rate Limit, Input/Output Port/Trunk Configuration. Set the Input Rate Limit Status or Output Rate Limit Status, then set the rate limit for the individual interfaces, and click Apply. Figure 3-46 Rate Limit Configuration CLI - This example sets the rate limit for input and output traffic passing through port 1 to 600 Mbps.
CONFIGURING THE SWITCH Showing Port Statistics You can display standard statistics on network traffic from the Interfaces Group and Ethernet-like MIBs, as well as a detailed breakdown of traffic based on the RMON MIB. Interfaces and Ethernet-like statistics display errors on the traffic passing through each port. This information can be used to identify potential problems with the switch (such as a faulty port or unusually heavy loading).
PORT CONFIGURATION Table 3-8 Port Statistics (Continued) Parameter Description Received Unknown Packets The number of packets received via the interface which were discarded because of an unknown or unsupported protocol. Received Errors The number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. Transmit Octets The total number of octets transmitted out of the interface, including framing characters.
CONFIGURING THE SWITCH Table 3-8 Port Statistics (Continued) Parameter Description FCS Errors A count of frames received on a particular interface that are an integral number of octets in length but do not pass the FCS check. This count does not include frames received with frame-too-long or frame-too-short error. Excessive Collisions A count of frames for which transmission on a particular interface fails due to excessive collisions.
PORT CONFIGURATION Table 3-8 Port Statistics (Continued) Parameter Description RMON Statistics Drop Events The total number of events in which packets were dropped due to lack of resources. Jabbers The total number of frames received that were longer than 1518 octets (excluding framing bits, but including FCS octets), and had either an FCS or alignment error. Received Bytes Total number of bytes of data received on the network.
CONFIGURING THE SWITCH Table 3-8 Port Statistics (Continued) Parameter Description 64 Bytes Frames The total number of frames (including bad packets) received and transmitted that were 64 octets in length (excluding framing bits but including FCS octets).
PORT CONFIGURATION Figure 3-48 Port Statistics (Continued) 3-111
CONFIGURING THE SWITCH CLI – This example shows statistics for port 11.
ADDRESS TABLE SETTINGS Command Attributes • Static Address Counts5 – The number of manually configured addresses. • Current Static Address Table – Lists all the static addresses. • Interface – Port or trunk associated with the device assigned a static address. • MAC Address – Physical address of a device mapped to this interface. • VLAN – ID of configured VLAN (1-4094). • Permanent – Assignment is permanent. • Delete on Reset – Assignment lasts until the switch is reset.
CONFIGURING THE SWITCH Displaying the Address Table The Dynamic Address Table contains the MAC addresses learned by monitoring the source address for traffic entering the switch. When the destination address for inbound traffic is found in the database, the packets intended for that address are forwarded directly to the associated port. Otherwise, the traffic is flooded to all ports. Command Attributes 3-114 • Interface – Indicates a port or trunk.
ADDRESS TABLE SETTINGS Web – Click Address Table, Dynamic Addresses. Specify the search type (i.e., mark the Interface, MAC Address, or VLAN checkbox), select the method of sorting the displayed addresses, and then click Query. Figure 3-50 Dynamic Addresses CLI – This example also displays the address table entries for port 1.
CONFIGURING THE SWITCH • Aging Time – The time after which a learned entry is discarded. (Range: 10-1000000 seconds; Default: 300 seconds) Web – Click Address Table, Address Aging. Specify the new aging time, click Apply. Figure 3-51 Address Aging CLI – This example sets the aging time to 400 seconds.
SPANNING TREE ALGORITHM CONFIGURATION STA uses a distributed algorithm to select a bridging device (STA-compliant switch, bridge or router) that serves as the root of the spanning tree network. It selects a root port on each bridging device (except for the root device) which incurs the lowest path cost when forwarding a packet from that device to the root device. It selects a designated bridging device from each LAN which incurs the lowest path cost when forwarding a packet from that LAN to the root device.
CONFIGURING THE SWITCH When using STP or RSTP, it may be difficult to maintain a stable path between all VLAN members. Frequent changes in the tree structure can easily isolate some of the group members. MSTP (an extension of RSTP) is designed to support independent spanning trees based on VLAN groups. Once you specify the VLANs to include in a Multiple Spanning Tree Instance (MSTI), the protocol will automatically build an MSTI tree to maintain connectivity among each of the VLANs.
SPANNING TREE ALGORITHM CONFIGURATION • Forward Delay – The maximum time (in seconds) the root device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a discarding state; otherwise, temporary data loops might result.
CONFIGURING THE SWITCH 3-120 • Root Hello Time – Interval (in seconds) at which this device transmits a configuration message. • Root Maximum Age – The maximum time (in seconds) this device can wait without receiving a configuration message before attempting to reconfigure. All device ports (except for designated ports) should receive configuration messages at regular intervals.
SPANNING TREE ALGORITHM CONFIGURATION Web – Click Spanning Tree, STA, Information. Figure 3-52 STA Information CLI – This command displays global STA settings, followed by settings for each port. Console#show spanning-tree 4-228 Spanning-tree information --------------------------------------------------------------Spanning tree mode :MSTP Spanning tree enable/disable :enable Instance :0 Vlans configuration :1-4094 Priority :32768 Bridge Hello Time (sec.) :2 Bridge Max Age (sec.
CONFIGURING THE SWITCH Configuring Global Settings Global settings apply to the entire switch. Command Usage • Spanning Tree Algorithm6 Uses RSTP for the internal state machine, but sends only 802.1D BPDUs. This creates one spanning tree instance for the entire network. If multiple VLANs are implemented on a network, the path between specific VLAN members may be inadvertently disabled to prevent network loops, thus isolating group members.
SPANNING TREE ALGORITHM CONFIGURATION • Multiple Spanning Tree Protocol - To allow multiple spanning trees to operate over the network, you must configure a related set of bridges with the same MSTP configuration, allowing them to participate in a specific set of spanning tree instances. - A spanning tree instance can exist only on bridges that have compatible VLAN instance assignments. - Be careful when switching between spanning tree modes.
CONFIGURING THE SWITCH Root Device Configuration • Hello Time – Interval (in seconds) at which the root device transmits a configuration message. - Default: 2 - Minimum: 1 - Maximum: The lower of 10 or [(Max. Message Age / 2) -1] • Maximum Age – The maximum time (in seconds) a device can wait without receiving a configuration message before attempting to reconfigure. All device ports (except for designated ports) should receive configuration messages at regular intervals.
SPANNING TREE ALGORITHM CONFIGURATION Configuration Settings for RSTP The following attributes apply to both RSTP and MSTP: • Path Cost Method – The path cost is used to determine the best path between devices. The path cost method is used to determine the range of values that can be assigned to each interface. - Long: Specifies 32-bit based values that range from 1-200,000,000. (This is the default.) - Short: Specifies 16-bit based values that range from 1-65535.
CONFIGURING THE SWITCH Web – Click Spanning Tree, STA, Configuration. Modify the required attributes, and click Apply. Figure 3-53 STA Configuration CLI – This example enables Spanning Tree Protocol, sets the mode to MST, and then configures the STA and MSTP parameters.
SPANNING TREE ALGORITHM CONFIGURATION Displaying Interface Settings The STA Port Information and STA Trunk Information pages display the current status of ports and trunks in the Spanning Tree. Field Attributes • Spanning Tree – Shows if STA has been enabled on this interface. • STA Status – Displays current state of this port within the Spanning Tree: - Discarding - Port receives STA configuration messages, but does not forward packets.
CONFIGURING THE SWITCH • Designated Port – The port priority and number of the port on the designated bridging device through which this switch must communicate with the root of the Spanning Tree. • Oper Link Type – The operational point-to-point status of the LAN segment attached to this interface. This parameter is determined by manual configuration or by auto-detection, as described for Admin Link Type in STA Port Configuration on page 3-131.
SPANNING TREE ALGORITHM CONFIGURATION R A x Backup port receives more useful BPDUs from the same bridge and is therefore not selected as the designated port. R D B Trunk Member – Indicates if a port is a member of a trunk. (STA Port Information only) These additional parameters are only displayed for the CLI: • Admin status – Shows if this interface is enabled. • External path cost – The path cost for the IST. This parameter is used by the STA to determine the best path between devices.
CONFIGURING THE SWITCH • Admin Edge Port – You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.
SPANNING TREE ALGORITHM CONFIGURATION CLI – This example shows the STA attributes for port 5. Console#show spanning-tree ethernet 1/5 4-228 Eth 1/ 5 information -------------------------------------------------------------Admin status : enable Role : disable State : discarding External path cost : 10000 Internal path cost : 10000 Priority : 128 Designated cost : 200000 Designated port : 128.5 Designated root : 61440.0.0000E9313131 Designated bridge : 61440.0.
CONFIGURING THE SWITCH Command Attributes The following attributes are read-only and cannot be changed: • • STA State – Displays current state of this port within the Spanning Tree. (See Displaying Interface Settings on page 3-127 for additional information.) - Discarding - Port receives STA configuration messages, but does not forward packets. - Learning - Port has transmitted configuration messages for an interval set by the Forward Delay parameter without receiving contradictory information.
SPANNING TREE ALGORITHM CONFIGURATION • • • Path Cost – This parameter is used by the STP to determine the best path between devices. Therefore, lower values should be assigned to ports attached to faster media, and higher values assigned to ports with slower media. (Path cost takes precedence over port priority.) Note that when the Path Cost Method is set to short (page 3-63), the maximum path cost is 65,535.
CONFIGURING THE SWITCH • Migration – If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the Protocol Migration button to manually re-check the appropriate BPDU format (RSTP or STP-compatible) to send on the selected interfaces. (Default: Disabled) Web – Click Spanning Tree, STA, Port Configuration or Trunk Configuration.
SPANNING TREE ALGORITHM CONFIGURATION By default all VLANs are assigned to the Internal Spanning Tree (MST Instance 0) that connects all bridges and LANs within the MST region. This switch supports up to 65 instances. You should try to group VLANs which cover the same general area of your network. However, remember that you must configure all bridges within the same MSTI Region (page 3-125) with the same set of instances, and the same instance (on each bridge) with the same set of VLANs.
CONFIGURING THE SWITCH • VLAN ID – VLAN to assign to this selected MST instance. (Range: 1-4094) The other global attributes are described under “Displaying Global Settings,” page 3-122. The attributes displayed by the CLI for individual interfaces are described under “Displaying Interface Settings,” page 3-127. Web – Click Spanning Tree, MSTP, VLAN Configuration. Select an instance identifier from the list, set the instance priority, and click Apply.
SPANNING TREE ALGORITHM CONFIGURATION CLI – This displays STA settings for instance 1, followed by settings for each port. Console#show spanning-tree mst 2 4-228 Spanning-tree information --------------------------------------------------------------Spanning tree mode :MSTP Spanning tree enable/disable :enable Instance :2 Vlans configuration :2 Priority :4096 Bridge Hello Time (sec.) :2 Bridge Max Age (sec.) :20 Bridge Forward Delay (sec.) :15 Root Hello Time (sec.) :2 Root Max Age (sec.
CONFIGURING THE SWITCH CLI – This example sets the priority for MSTI 1, and adds VLANs 1-5 to this MSTI. Console(config)#spanning-tree mst configuration Console(config-mst)#mst 1 priority 4096 Console(config-mstp)#mst 1 vlan 1-5 Console(config-mst)# 4-214 4-216 4-215 Displaying Interface Settings for MSTP The MSTP Port Information and MSTP Trunk Information pages display the current status of ports and trunks in the selected MST instance.
SPANNING TREE ALGORITHM CONFIGURATION CLI – This displays STA settings for instance 0, followed by settings for each port. The settings for instance 0 are global settings that apply to the IST (page 3-118), the settings for other instances only apply to the local spanning tree.
CONFIGURING THE SWITCH Configuring Interface Settings for MSTP You can configure the STA interface settings for an MST Instance using the MSTP Port Configuration and MSTP Trunk Configuration pages. Field Attributes The following attributes are read-only and cannot be changed: • • STA State – Displays current state of this port within the Spanning Tree. (See Displaying Interface Settings on page 3-127 for additional information.
SPANNING TREE ALGORITHM CONFIGURATION • MST Path Cost – This parameter is used by the MSTP to determine the best path between devices. Therefore, lower values should be assigned to ports attached to faster media, and higher values assigned to ports with slower media. (Path cost takes precedence over port priority.) Note that when the Path Cost Method is set to short (page 3-63), the maximum path cost is 65,535.
CONFIGURING THE SWITCH CLI – This example sets the MSTP attributes for port 4. Console(config)#interface ethernet 1/4 Console(config-if)#spanning-tree mst 1 port-priority 0 Console(config-if)#spanning-tree mst 1 cost 50 Console(config-if) 4-168 4-226 4-225 VLAN Configuration IEEE 802.1Q VLANs In large networks, routers are used to isolate broadcast traffic for each subnet into separate domains.
VLAN CONFIGURATION This switch supports the following VLAN features: • • • • • • Up to 255 VLANs based on the IEEE 802.
CONFIGURING THE SWITCH tagged frames VA VA VA: VLAN Aware VU: VLAN Unaware tagged frames VA untagged frames VA VU VLAN Classification – When the switch receives a frame, it classifies the frame in one of two ways. If the frame is untagged, the switch assigns the frame to an associated VLAN (based on the default VLAN ID of the receiving port). But if the frame is tagged, the switch uses the tagged VLAN ID to identify the port broadcast domain of the frame.
VLAN CONFIGURATION Automatic VLAN Registration – GVRP (GARP VLAN Registration Protocol) defines a system whereby the switch can automatically learn the VLANs to which each end station should be assigned. If an end station (or its network adapter) supports the IEEE 802.1Q VLAN protocol, it can be configured to broadcast a message to your network indicating the VLAN groups it wants to join.
CONFIGURING THE SWITCH Port-based VLAN 2 1 9 10 11 3 4 5 13 12 6 15 16 14 7 8 18 19 Forwarding Tagged/Untagged Frames If you want to create a small port-based VLAN for devices attached directly to a single switch, you can assign ports to the same untagged VLAN. However, to participate in a VLAN group that crosses several switches, you should create a VLAN for that group and enable tagging on all ports. Ports can be assigned to multiple tagged or untagged VLANs.
VLAN CONFIGURATION Enabling or Disabling GVRP (Global Setting) GARP VLAN Registration Protocol (GVRP) defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. VLANs are dynamically configured based on join messages issued by host devices and propagated throughout the network. GVRP must be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. (Default: Disabled) Web – Click VLAN, 802.
CONFIGURING THE SWITCH • Maximum Number of Supported VLANs – Maximum number of VLANs that can be configured on this switch. Web – Click VLAN, 802.1Q VLAN, Basic Information. Figure 3-60 VLAN Basic Information CLI – Enter the following command.
VLAN CONFIGURATION • Status – Shows how this VLAN was added to the switch. - Dynamic GVRP: Automatically learned via GVRP. - Permanent: Added as a static entry. • • Egress Ports – Shows all the VLAN port members. Untagged Ports – Shows the untagged VLAN port members. Web – Click VLAN, 802.1Q VLAN, Current Table. Select any ID from the scroll-down list. Figure 3-61 VLAN Current Table Command Attributes (CLI) • VLAN – ID of configured VLAN (1-4094, no leading zeroes).
CONFIGURING THE SWITCH CLI – Current VLAN information can be displayed with the following command. Console#show vlan id 1 4-241 VLAN Type Name Status Ports/Channel groups ---- ------- ----------- ----------------------------------------1 Static DefaultVlan Active Eth1/1 Eth1/2 Eth1/3 Eth1/4 Eth1/5 Eth1/6 Eth1/7 Eth1/8 Eth1/9 Eth1/10 Eth1/11 Eth1/12 Console# Creating VLANs Use the VLAN Static List to create or remove VLAN groups.
VLAN CONFIGURATION • Remove – Removes a VLAN group from the current list. If any port is assigned to this group as untagged, it will be reassigned to VLAN group 1 as untagged. Web – Click VLAN, 802.1Q VLAN, Static List. To create a new VLAN, enter the VLAN ID and VLAN name, mark the Enable checkbox to activate the VLAN, and then click Add. Figure 3-62 Creating Virtual LANs CLI – This example creates a new VLAN.
CONFIGURING THE SWITCH Adding Static Members to VLANs (VLAN Index) Use the VLAN Static Table to configure port members for the selected VLAN index. Assign ports as tagged if they are connected to 802.1Q VLAN compliant devices, or untagged they are not connected to any VLAN-aware devices. Or configure a port as forbidden to prevent the switch from automatically adding it to a VLAN via the GVRP protocol. Notes: 1.
VLAN CONFIGURATION • Membership Type – Select VLAN membership for each interface by marking the appropriate radio button for a port or trunk: - Tagged: Interface is a member of the VLAN. All packets transmitted by the port will be tagged, that is, carry a tag and therefore carry VLAN or CoS information. - Untagged: Interface is a member of the VLAN. All packets transmitted by the port will be untagged, that is, not carry a tag and therefore not carry VLAN or CoS information.
CONFIGURING THE SWITCH CLI – The following example adds tagged and untagged ports to VLAN 2.
VLAN CONFIGURATION Web – Open VLAN, 802.1Q VLAN, Static Membership. Select an interface from the scroll-down box (Port or Trunk). Click Query to display membership information for the interface. Select a VLAN ID, and then click Add to add the interface as a tagged member, or click Remove to remove the interface. After configuring VLAN membership for each interface, click Apply.
CONFIGURING THE SWITCH • GARP – Group Address Registration Protocol is used by GVRP to register or deregister client attributes for client services within a bridged LAN. The default values for the GARP timers are independent of the media access method or data rate. These values should not be changed unless you are experiencing difficulties with GVRP registration/deregistration. Command Attributes • PVID – VLAN ID assigned to untagged frames received on the interface.
VLAN CONFIGURATION • GVRP Status – Enables/disables GVRP for the interface. GVRP must be globally enabled for the switch before this setting can take effect. (See “Displaying Bridge Extension Capabilities” on page 3-16.) When disabled, any GVRP packets received on this port will be discarded and no GVRP registrations will be propagated from other ports. (Default: Disabled) • GARP Join Timer9 – The interval between transmitting requests/ queries to participate in a VLAN group.
CONFIGURING THE SWITCH • Trunk Member – Indicates if a port is a member of a trunk. To add a trunk to the selected VLAN, use the last table on the VLAN Static Table page. Web – Click VLAN, 802.1Q VLAN, Port Configuration or VLAN Trunk Configuration. Fill in the required settings for each interface, click Apply.
VLAN CONFIGURATION Configuring Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN. Data traffic on downlink ports can only be forwarded to, and from, uplink ports. (Note that private VLANs and normal VLANs can exist simultaneously within the same switch.) Uplink Ports Primary VLAN (promiscuous ports) x Downlink Ports Secondary VLAN (private ports) Enabling Private VLANs Use the Private VLAN Status page to enable/disable the Private VLAN function.
CONFIGURING THE SWITCH Configuring Uplink and Downlink Ports Use the Private VLAN Link Status page to set ports as downlink or uplink ports. Ports designated as downlink ports can not communicate with any other ports on the switch except for the uplink ports. Uplink ports can communicate with any other ports on the switch and with any designated downlink ports. Web – Click VLAN, Private VLAN, Link Status. Mark the ports that will serve as uplinks and downlinks for the private VLAN, then click Apply.
VLAN CONFIGURATION Configuring Protocol-Based VLANs The network devices required to support multiple protocols cannot be easily grouped into a common VLAN. This may require non-standard devices to pass traffic between different VLANs in order to encompass all the devices participating in a specific protocol. This kind of configuration deprives users of the basic benefits of VLANs, including security and easy accessibility.
CONFIGURING THE SWITCH • Protocol Type – The only option for the LLC_other frame type is IPX_raw. The options for all other frames types include: IP, ARP, RARP. Web – Click VLAN, Protocol VLAN, Configuration. Enter a protocol group ID, frame type and protocol type, then click Apply. Figure 3-68 Protocol VLAN Configuration CLI – The following creates protocol group 1, and then specifies Ethernet frames with IP and ARP protocol types.
VLAN CONFIGURATION • When a frame enters a port that has been assigned to a protocol VLAN, it is processed in the following manner: - If the frame is tagged, it will be processed according to the standard rules applied to tagged frames. - If the frame is untagged and the protocol type matches, the frame is forwarded to the appropriate VLAN. - If the frame is untagged but the protocol type does not match, the frame is forwarded to the default VLAN for this interface.
CONFIGURING THE SWITCH CLI – The following maps the traffic entering Port 1 which matches the protocol type specified in protocol group 1 to VLAN 3. Console(config)#interface ethernet 1/1 Console(config-if)#protocol-vlan protocol-group 1 vlan 3 Console(config-if)# 4-244 Class of Service Configuration Class of Service (CoS) allows you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion.
CLASS OF SERVICE CONFIGURATION Command Attributes • Default Priority10 – The priority that is assigned to untagged frames received on the specified interface. (Range: 0 - 7, Default: 0) • Number of Egress Traffic Classes – The number of queue buffers provided for each port. Web – Click Priority, Default Port Priority or Default Trunk Priority. Modify the default priority for any interface, then click Apply. Figure 3-70 Default Port Priority CLI – This example assigns a default priority of 5 to port 3.
CONFIGURING THE SWITCH Mapping CoS Values to Egress Queues This switch processes Class of Service (CoS) priority tagged traffic by using eight priority queues for each port, with service schedules based on strict or Weighted Round Robin (WRR). Up to eight separate traffic priorities are defined in IEEE 802.1p. The default priority levels are assigned according to recommendations in the IEEE 802.1p standard as shown in the following table.
CLASS OF SERVICE CONFIGURATION Web – Click Priority, Traffic Classes. Assign priorities to the traffic classes (i.e., output queues), then click Apply. Figure 3-71 Traffic Classes CLI – The following example shows how to change the CoS assignments to a one-to-one mapping.
CONFIGURING THE SWITCH Selecting the Queue Mode You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue. WRR uses a predefined relative weight for each queue that determines the percentage of service time the switch services each queue before moving on to the next queue.
CLASS OF SERVICE CONFIGURATION Setting the Service Weight for Traffic Classes This switch uses the Weighted Round Robin (WRR) algorithm to determine the frequency at which it services each priority queue. As described in “Mapping CoS Values to Egress Queues” on page 3-166, the traffic classes are mapped to one of the eight egress queues provided for each port. You can assign a weight to each of these queues (and thereby to the corresponding traffic priorities).
CONFIGURING THE SWITCH CLI – The following example shows how to assign WRR weights to each of the priority queues. Console(config)#interface ethernet 1/1 Console(config-if)#queue bandwidth 1 3 5 7 9 11 13 15 Console(config-if)#end Console#show queue bandwidth Information of Eth 1/1 Queue ID Weight -------- -----0 1 1 3 2 5 3 7 4 9 5 11 6 13 7 15 Information of Eth 1/2 Queue ID Weight . . .
CLASS OF SERVICE CONFIGURATION Selecting IP Precedence/DSCP Priority The switch allows you to choose between using IP Precedence or DSCP priority. Select one of the methods or disable this feature. Command Attributes • Disabled – Disables both priority services. (This is the default setting.) • IP Precedence – Maps layer 3/4 priorities using IP Precedence. • IP DSCP – Maps layer 3/4 priorities using Differentiated Services Code Point Mapping. Web – Click Priority, IP Precedence/DSCP Priority Status.
CONFIGURING THE SWITCH Mapping IP Precedence The Type of Service (ToS) octet in the IPv4 header includes three precedence bits defining eight different priority levels ranging from highest priority for network control packets to lowest priority for routine traffic. The default IP Precedence values are mapped one-to-one to Class of Service values (i.e., Precedence value 0 maps to CoS value 0, and so forth). Bits 6 and 7 are used for network control, and the other bits for various application types.
CLASS OF SERVICE CONFIGURATION Web – Click Priority, IP Precedence Priority. Select an entry from the IP Precedence Priority Table, enter a value in the Class of Service Value field, and then click Apply. Figure 3-75 IP Precedence Priority CLI – The following example globally enables IP Precedence service on the switch, maps IP Precedence value 1 to CoS value 0 (on port 1), and then displays the IP Precedence settings.
CONFIGURING THE SWITCH Mapping DSCP Priority The DSCP is six bits wide, allowing coding for up to 64 different forwarding behaviors. The DSCP replaces the ToS bits, but it retains backward compatibility with the three precedence bits so that non-DSCP compliant, ToS-enabled devices, will not conflict with the DSCP mapping. Based on network policies, different kinds of traffic can be marked for different kinds of forwarding. The DSCP default values are defined in the following table.
CLASS OF SERVICE CONFIGURATION Web – Click Priority, IP DSCP Priority. Select an entry from the DSCP table, enter a value in the Class of Service Value field, then click Apply. Figure 3-76 IP DSCP Priority CLI – The following example globally enables DSCP Priority service on the switch, maps DSCP value 0 to CoS value 1 (on port 1), and then displays the DSCP Priority settings.
CONFIGURING THE SWITCH Mapping IP Port Priority You can also map network applications to Class of Service values based on the IP port number (i.e., TCP/UDP port number) in the frame header. Some of the more common TCP service ports include: HTTP: 80, FTP: 21, Telnet: 23 and POP3: 110. Command Attributes • • • • IP Port Priority Status – Enables or disables the IP port priority. IP Port Priority Table – Shows the IP port to CoS map. IP Port Number (TCP/UDP) – Set a new IP port number.
CLASS OF SERVICE CONFIGURATION Click Priority, IP Port Priority. Enter the port number for a network application in the IP Port Number box and the new CoS value in the Class of Service box, and then click Apply. Figure 3-78 IP Port Priority CLI – The following example globally enables IP Port Priority service on the switch, maps HTTP traffic (on port 1) to CoS value 0, and then displays the IP Port Priority settings.
CONFIGURING THE SWITCH Mapping CoS Values to ACLs Use the ACL CoS Mapping page to set the output queue for packets matching an ACL rule as shown in the following table. Note that the specified CoS value is only used to map the matching packet to an output queue; it is not written to the packet itself. For information on mapping the CoS values to output queues, see page 3-166.
CLASS OF SERVICE CONFIGURATION Web – Click Priority, ACL CoS Priority. Enable mapping for any port, select an ACL from the scroll-down list, then click Apply. Figure 3-79 ACL CoS Priority CLI – This example assigns a CoS value of zero to packets matching rules within the specified ACL on port 12.
CONFIGURING THE SWITCH Command Usage • You must configure an ACL mask before you can change priorities based on a rule. • Traffic priorities may be included in the IEEE 802.1p priority tag. This tag is also incorporated as part of the overall IEEE 802.1Q VLAN tag. The 802.1p priority may be set for either Layer 2 or IP frames. • The IP frame header also includes priority bits in the Type of Service (ToS) octet.
CLASS OF SERVICE CONFIGURATION Web – Click Priority, ACL Marker. Select a port and an ACL rule. To specify a ToS priority, mark the Precedence/DSCP check box, select Precedence or DSCP from the scroll-down box, and enter a priority. To specify an 802.1p priority, mark the 802.1p Priority check box, and enter a priority. Then click Add. Figure 3-80 Changing Priorities Based on ACL Rules CLI – This example changes the DSCP priority for packets matching an IP ACL rule, and the 802.
CONFIGURING THE SWITCH Multicast Filtering Multicasting is used to support real-time applications such as videoconferencing or streaming audio. A multicast server does not have to establish a separate connection with each client. It merely broadcasts its service to the network, and any hosts that want to receive the multicast register with their local multicast switch/router.
MULTICAST FILTERING Layer 2 IGMP (Snooping and Query) IGMP Snooping and Query — If multicast routing is not supported on other switches in your network, you can use IGMP Snooping and Query (page 3-183) to monitor IGMP service requests passing between multicast clients and servers, and dynamically configure the switch ports which need to forward multicast traffic. Static IGMP Router Interface — If IGMP snooping cannot locate the IGMP querier, you can manually designate a known IGMP querier (i.e.
CONFIGURING THE SWITCH • IGMP Querier — A router, or multicast-enabled switch, can periodically ask their hosts if they want to receive multicast traffic. If there is more than one router/switch on the LAN performing IP multicasting, one of these devices is elected “querier” and assumes the role of querying the LAN for group members. It then propagates the service requests on to any upstream multicast switch/router to ensure that it will continue to receive the multicast service.
MULTICAST FILTERING • IGMP Version — Sets the protocol version for compatibility with other devices on the network. (Range: 1-2; Default: 2) Notes: 1. All systems on the subnet must support the same version. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Timeout. Web – Click IGMP Snooping, IGMP Configuration. Adjust the IGMP settings as required, and then click Apply. (The default settings are shown below.
CONFIGURING THE SWITCH Displaying Interfaces Attached to a Multicast Router Multicast routers that are attached to ports on the switch use information obtained from IGMP, along with a multicast routing protocol such as DVMRP or PIM, to support IP multicasting across the Internet. These routers may be dynamically discovered by the switch or statically assigned to an interface on the switch.
MULTICAST FILTERING CLI – This example shows that Port 11 has been statically configured as a port attached to a multicast router. Console#show ip igmp snooping mrouter vlan 1 VLAN M'cast Router Port Type ---- ------------------ ------1 Eth 1/11 Static Console# 4-281 Specifying Static Interfaces for a Multicast Router Depending on your network connections, IGMP snooping may not always be able to locate the IGMP querier.
CONFIGURING THE SWITCH Web – Click IGMP Snooping, Static Multicast Router Port Configuration. Specify the interfaces attached to a multicast router, indicate the VLAN which will forward all the corresponding multicast traffic, and then click Add. After you have finished adding interfaces to the list, click Apply. Figure 3-83 Static Multicast Router Port Configuration CLI – This example configures port 11 as a multicast router port within VLAN 1.
MULTICAST FILTERING Web – Click IGMP Snooping, IP Multicast Registration Table. Select a VLAN ID and the IP address for a multicast service from the scroll-down lists. The switch will display all the interfaces that are propagating this multicast service. Figure 3-84 IP Multicast Registration Table CLI – This example displays all the known multicast services supported on VLAN 1, along with the ports propagating the corresponding services.
CONFIGURING THE SWITCH Command Usage • Static multicast addresses are never aged out. • When a multicast address is assigned to an interface in a specific VLAN, the corresponding traffic can only be forwarded to ports within that VLAN. Command Attribute • Interface – Activates the Port or Trunk scroll down list. • VLAN ID – Selects the VLAN to propagate all multicast traffic coming from the attached multicast router/switch. • Multicast IP – The IP address for a specific multicast service.
CONFIGURING DOMAIN NAME SERVICE CLI – This example assigns a multicast address to VLAN 1, and then displays all the known multicast services supported on VLAN 1. Console(config)#ip igmp snooping vlan 1 static 224.1.1.12 ethernet 1/12 Console(config)#exit Console#show mac-address-table multicast vlan 1 VLAN M'cast IP addr. Member ports Type ---- --------------- ------------ ------1 224.1.1.12 Eth1/12 User 1 224.1.2.
CONFIGURING THE SWITCH • When an incomplete host name is received by the DNS server on this switch and a domain name list has been specified, the switch will work through the domain list, appending each domain name in the list to the host name, and checking with the specified name servers for a match. • When more than one name server is specified, the servers are queried in the specified sequence until a response is received, or the end of the list is reached with no response.
CONFIGURING DOMAIN NAME SERVICE Web – Select DNS, General Configuration. Set the default domain name or list of domain names, specify one or more name servers to use to use for address resolution, enable domain lookup status, and click Apply.
CONFIGURING THE SWITCH CLI - This example sets a default domain name and a domain list. However, remember that if a domain list is specified, the default domain name is not used. Console(config)#ip domain-name sample.com Console(config)#ip domain-list sample.com.uk Console(config)#ip domain-list sample.com.jp Console(config)#ip name-server 192.168.1.55 10.1.0.55 Console(config)#ip domain-lookup Console(config)#exit Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: sample.
CONFIGURING DOMAIN NAME SERVICE Field Attributes • Host Name – Name of a host device that is mapped to one or more IP addresses. (Range: 1-64 characters) • IP Address – Internet address(es) associated with a host name. (Range: 1-8 addresses) • Alias – Displays the host names that are mapped to the same address(es) as a previously configured entry. Web – Select DNS, Static Host Table. Enter a host name and one or more corresponding addresses, then click Apply.
CONFIGURING THE SWITCH CLI - This example maps two address to a host name, and then configures an alias host name for the same addresses. Console(config)#ip host rd5 192.168.1.55 10.1.0.55 Console(config)#ip host rd6 10.1.0.55 Console(config)#exit Console#show host 4-158 4-164 Hostname rd5 Inet address 192.168.1.55 10.1.0.55 Alias 1.rd6 Console# Displaying the DNS Cache You can display entries in the DNS cache that have been learned via the designated name servers.
CONFIGURING DOMAIN NAME SERVICE Web – Select DNS, Cache. Figure 3-88 DNS Cache CLI - This example displays all the resource records learned from the designated name servers. Console#show dns cache NO FLAG TYPE 0 4 CNAME 1 4 CNAME 2 4 CNAME 3 4 CNAME 4 4 CNAME 5 4 ALIAS 6 4 CNAME 7 4 ALIAS 8 4 CNAME 9 4 ALIAS 10 4 CNAME Console# IP 207.46.134.222 207.46.134.190 207.46.134.155 207.46.249.222 207.46.249.27 POINTER TO:4 207.46.68.27 POINTER TO:6 65.54.131.192 POINTER TO:8 165.193.72.
CONFIGURING THE SWITCH 3-198
CHAPTER 4 COMMAND LINE INTERFACE This chapter describes how to use the Command Line Interface (CLI). Using the Command Line Interface Accessing the CLI When accessing the management interface for the switch over a direct connection to the server’s console port, or via a Telnet connection, the switch can be managed by entering command keywords and parameters at the prompt. Using the switch's command-line interface (CLI) is very similar to entering commands on a UNIX system.
COMMAND LINE INTERFACE 3. When finished, exit the session with the “quit” or “exit” command. After connecting to the system through the console port, the login screen displays: User Access Verification Username: admin Password: CLI session with the SMC8612T2 is opened. To end the CLI session, enter [Exit]. Console# Telnet Connection Telnet operates over the IP transport protocol.
USING THE COMMAND LINE INTERFACE After you configure the switch with an IP address, you can open a Telnet session by performing these steps: 1. From the remote host, enter the Telnet command and the IP address of the device you want to access. 2. At the prompt, enter the user name and system password. The CLI will display the “Vty-0#” prompt for the administrator to show that you are using privileged access mode (i.e.
COMMAND LINE INTERFACE Entering Commands This section describes how to enter CLI commands. Keywords and Arguments A CLI command is a series of keywords and arguments. Keywords identify a command, and arguments specify configuration parameters. For example, in the command “show interfaces status ethernet 1/5,” show interfaces and status are keywords, ethernet is an argument that specifies the interface type, and 1/5 specifies the unit/port.
ENTERING COMMANDS Command Completion If you terminate input with a Tab key, the CLI will print the remaining characters of a partial keyword up to the point of ambiguity. In the “logging history” example, typing log followed by a tab will result in printing the command up to “logging.” Getting Help on Commands You can display a brief description of the help system by entering the help command. You can also display command syntax by using the “?” character to list keywords or parameters.
COMMAND LINE INTERFACE Showing Commands If you enter a “?” at the command prompt, the system will display the first level of keywords for the current command class (Normal Exec or Privileged Exec) or configuration class (Global, ACL, Interface, Line, VLAN Database, or MSTP). You can also display a list of valid keywords for a specific command.
ENTERING COMMANDS The command “show interfaces ?” will display the following information: Console#show interfaces ? counters Information of interfaces counters protocol-vlan Protocol-vlan information status Information of interfaces status switchport Information of interfaces switchport Console#show interfaces Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided.
COMMAND LINE INTERFACE Understanding Command Modes The command set is divided into Exec and Configuration classes. Exec commands generally display information on system status or clear statistical counters. Configuration commands, on the other hand, modify interface parameters or enable certain switching functions. These classes are further divided into different modes. Available commands depend on the selected mode.
ENTERING COMMANDS You can also enter Privileged Exec mode from within Normal Exec mode, by entering the enable command, followed by the privileged level password “super” (page 4-36). To enter Privileged Exec mode, enter the following user names and passwords: Username: admin Password: [admin login password] CLI session with the SMC8612T2 is opened. To end the CLI session, enter [Exit]. Console# Username: guest Password: [guest login password] CLI session with the SMC8612T2 is opened.
COMMAND LINE INTERFACE • Interface Configuration - These commands modify the port configuration such as speed-duplex and negotiation. • Line Configuration - These commands modify the console port and Telnet configuration, and include command such as parity and databits. • VLAN Configuration - Includes the command to create VLAN groups. • Multiple Spanning Tree Configuration - These commands configure settings for the selected multiple spanning tree instance.
ENTERING COMMANDS Table 4-2 Configuration Commands (Continued) Mode Command Prompt Page VLAN vlan database Console(config-vlan) 4-231 MSTP spanning-tree mst-configuration Console(config-mstp)# 4-214 For example, you can use the following commands to enter interface configuration mode, and then return to Privileged Exec mode. Console(config)#interface ethernet 1/5 . . . Console(config-if)#exit Console(config)# Command Line Processing Commands are not case sensitive.
COMMAND LINE INTERFACE Table 4-3 Keystroke Commands (Continued) Keystroke Function Ctrl-R Repeats current command line on a new line. Ctrl-U Deletes from the cursor to the beginning of the line. Ctrl-W Deletes the last word typed. Esc-B Moves the cursor back one word. Esc-D Deletes from the cursor to the end of the word. Esc-F Moves the cursor forward one word. Delete key or backspace key Erases a mistake when entering a command.
COMMAND GROUPS Table 4-4 Command Group Index (Continued) Command Group Description Page SNMP Activates authentication failure traps; configures community access strings, and trap managers; also configures IP address filtering 4-149 Interface Configures the connection parameters for all Ethernet ports, aggregated links, and VLANs 4-167 Mirror Port Mirrors data to another port for analysis without affecting the data passing through or the performance of the monitored port 4-182 Rate Limiting Cont
COMMAND LINE INTERFACE The access mode shown in the following tables is indicated by these abbreviations: NE (Normal Exec) PE (Privileged Exec) GC (Global Configuration) ACL (Access Control List Configuration) IC (Interface Configuration) LC (Line Configuration) VC (VLAN Database Configuration) MST (Multiple Spanning Tree) Line Commands You can access the onboard configuration program by attaching a VT100 compatible device to the server’s serial port.
LINE COMMANDS Table 4-5 Line Command Syntax (Continued) Command Function Mode Page stopbits* Sets the number of the stop bits transmitted per LC byte 4-24 disconnect Terminates a line connection PE 4-24 show line Displays a terminal line's parameters NE, PE 4-25 * These commands only apply to the serial port. line This command identifies a specific line for configuration, and to process subsequent line configuration commands. Syntax line {console | vty} • console - Console terminal line.
COMMAND LINE INTERFACE Related Commands show line (4-25) show users (4-83) login This command enables password checking at login. Use the no form to disable password checking and allow connections without a password. Syntax login [local] no login local - Selects local password checking. Authentication is based on the user name specified with the username command.
LINE COMMANDS • This command controls login authentication via the switch itself. To configure user names and passwords for remote authentication servers, you must use the RADIUS or TACACS software installed on those servers. Example Console(config-line)#login local Console(config-line)# Related Commands username (4-35) password (4-17) password This command specifies the password for a line. Use the no form to remove the password.
COMMAND LINE INTERFACE • The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords.
LINE COMMANDS Example To set the timeout to two minutes, enter this command: Console(config-line)#exec-timeout 120 Console(config-line)# password-thresh This command sets the password intrusion threshold which limits the number of failed logon attempts. Use the no form to remove the threshold value. Syntax password-thresh [threshold] no password-thresh threshold - The number of allowed password attempts. (Range: 1-120; 0: no threshold) Default Setting The default value is three attempts.
COMMAND LINE INTERFACE Related Commands silent-time (4-20) silent-time This command sets the amount of time the management console is inaccessible after the number of unsuccessful logon attempts exceeds the threshold set by the password-thresh command. Use the no form to remove the silent time value. Syntax silent-time [seconds] no silent-time seconds - The number of seconds to disable console response. (Range: 0-65535; 0: no silent-time) Default Setting The default value is no silent-time.
LINE COMMANDS databits This command sets the number of data bits per character that are interpreted and generated by the console port. Use the no form to restore the default value. Syntax databits {7 | 8} no databits • 7 - Seven data bits per character. • 8 - Eight data bits per character. Default Setting 8 data bits per character Command Mode Line Configuration Command Usage The databits command can be used to mask the high bit on input from devices that generate 7 data bits with parity.
COMMAND LINE INTERFACE parity This command defines the generation of a parity bit. Use the no form to restore the default setting. Syntax parity {none | even | odd} no parity • none - No parity • even - Even parity • odd - Odd parity Default Setting No parity Command Mode Line Configuration Command Usage Communication protocols provided by devices such as terminals and modems often require a specific parity bit setting.
LINE COMMANDS speed This command sets the terminal line’s baud rate. This command sets both the transmit (to terminal) and receive (from terminal) speeds. Use the no form to restore the default setting. Syntax speed bps no speed bps - Baud rate in bits per second. (Options: 9600, 19200, 38400, 57600, 115200 bps, or auto) Default Setting auto Command Mode Line Configuration Command Usage Set the speed to match the baud rate of the device connected to the serial port.
COMMAND LINE INTERFACE stopbits This command sets the number of the stop bits transmitted per byte. Use the no form to restore the default setting. Syntax stopbits {1 | 2} • 1 - One stop bit • 2 - Two stop bits Default Setting 1 stop bit Command Mode Line Configuration Example To specify 2 stop bits, enter this command: Console(config-line)#stopbits 2 Console(config-line)# disconnect Use this command to terminate an SSH, Telnet, or console connection.
LINE COMMANDS Example Console#disconnect 1 Console# Related Commands show ssh (4-55) show users (4-83) show line This command displays the terminal line’s parameters. Syntax show line [console | vty] • console - Console terminal line. • vty - Virtual terminal for remote console access (i.e., Telnet).
COMMAND LINE INTERFACE General Commands Table 4-6 General Commands Command Function Mode enable Activates privileged mode NE Page 4-26 disable Returns to normal mode from privileged mode PE 4-27 configure Activates global configuration mode PE 4-28 show history Shows the command history buffer NE, PE 4-28 reload Restarts the system PE 4-29 end Returns to Privileged Exec mode any config.
GENERAL COMMANDS Command Mode Normal Exec Command Usage • “super” is the default password required to change the command mode from Normal Exec to Privileged Exec. (To set this password, see the enable password command on page 4-36.) • The “#” character is appended to the end of the prompt to indicate that the system is in privileged access mode.
COMMAND LINE INTERFACE Example Console#disable Console> Related Commands enable (4-26) configure This command activates Global Configuration mode. You must enter this mode to modify any settings on the switch. You must also enter Global Configuration mode prior to enabling some of the other configuration modes, including Interface Configuration, Line Configuration, VLAN Database Configuration, and Multiple Spanning Tree Configuration. (See “Understanding Command Modes” on page 4-8.
GENERAL COMMANDS Command Mode Normal Exec, Privileged Exec Command Usage The history buffer size is fixed at 10 Execution commands and 10 Configuration commands.
COMMAND LINE INTERFACE Default Setting None Command Mode Privileged Exec Command Usage This command resets the entire system. Example This example shows how to reset the switch: Console#reload System will be restarted, continue ? y end This command returns to Privileged Exec mode. Default Setting None Command Mode Global Configuration, Interface Configuration, Line Configuration, VLAN Database Configuration, and Multiple Spanning Tree Configuration.
GENERAL COMMANDS exit This command returns to the previous configuration mode or exit the configuration program. Default Setting None Command Mode Any Example This example shows how to return to the Privileged Exec mode from the Global Configuration mode, and then quit the CLI session: Console(config)#exit Console#exit Press ENTER to start session User Access Verification Username: quit This command exits the configuration program.
COMMAND LINE INTERFACE Example This example shows how to quit a CLI session: Console#quit Press ENTER to start session User Access Verification Username: System Management Commands These commands are used to control system logs, passwords, user names, browser configuration options, and display or configure a variety of other system information.
SYSTEM MANAGEMENT COMMANDS Device Designation Commands Table 4-8 Device Designation Commands Command Function prompt Customizes the prompt used in PE and NE GC mode Mode Page 4-33 hostname Specifies the host name for the switch GC 4-34 snmp-server contact Sets the system contact string GC 4-151 snmp-server location Sets the system location string GC 4-151 prompt This command customizes the CLI prompt. Use the no form to restore the default prompt.
COMMAND LINE INTERFACE hostname This command specifies or modifies the host name for this device. Use the no form to restore the default host name. Syntax hostname name no hostname name - The name of this host. (Maximum length: 255 characters) Default Setting None Command Mode Global Configuration Example Console(config)#hostname RD#1 Console(config)# User Access Commands The basic commands required for management access are listed in this section.
SYSTEM MANAGEMENT COMMANDS username This command adds named users, requires authentication at login, specifies or changes a user's password (or specify that no password is required), or specifies or changes a user's access level. Use the no form to remove a user name. Syntax username name {access-level level | no password | password {0 | 7} password} no username name • name - The name of the user. (Maximum length: 8 characters, case sensitive.
COMMAND LINE INTERFACE Command Usage The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords. Example This example shows how the set the access level and password for a user.
SYSTEM MANAGEMENT COMMANDS Command Usage • You cannot set a null password. You will have to enter a password to change the command mode from Normal Exec to Privileged Exec with the enable command (page 4-26). • The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server.
COMMAND LINE INTERFACE management This command specifies the client IP addresses that are allowed management access to the switch through various protocols. Use the no form to restore the default setting. Syntax [no] management {all-client | http-client | snmp-client | telnet-client} start-address [end-address] • all-client - Adds IP address(es) to the SNMP, Web and Telnet groups. • http-client - Adds IP address(es) to the Web group. • snmp-client - Adds IP address(es) to the SNMP group.
SYSTEM MANAGEMENT COMMANDS • You cannot delete an individual address from a specified range. You must delete the entire range, and reenter the addresses. • You can delete an address range just by specifying the start address, or by specifying both the start address and end address. Example This example restricts management access to the indicated addresses. Console(config)#management all-client 192.168.1.19 Console(config)#management all-client 192.168.1.25 192.168.1.
COMMAND LINE INTERFACE Example Console#show management all-client Management Ip Filter Http-Client: Start ip address End ip address ----------------------------------------------1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 Snmp-Client: Start ip address End ip address ----------------------------------------------1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 Telnet-Client: Start ip address End ip address ----------------------------------------------1. 192.168.1.19 192.168.1.19 2.
SYSTEM MANAGEMENT COMMANDS ip http port This command specifies the TCP port number used by the Web browser interface. Use the no form to use the default port. Syntax ip http port port-number no ip http port port-number - The TCP port to be used by the browser interface.
COMMAND LINE INTERFACE Example Console(config)#ip http server Console(config)# Related Commands ip http port (4-41) copy tftp https-certificate (4-86) ip http secure-server This command enables the secure hypertext transfer protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s Web interface. Use the no form to disable this function.
SYSTEM MANAGEMENT COMMANDS • When you start HTTPS, the connection is established in this way: - The client authenticates the server using the server’s digital certificate. - The client and server negotiate a set of security protocols to use for the connection. - The client and server generate session keys for encrypting and decrypting data. • The client and server establish a secure encrypted connection. • A padlock icon should appear in the status bar for Internet Explorer 5.x and Netscape Navigator 6.
COMMAND LINE INTERFACE ip http secure-port This command specifies the UDP port number used for HTTPS/SSL connection to the switch’s Web interface. Use the no form to restore the default port. Syntax ip http secure-port port_number no ip http secure-port port_number – The UDP port used for HTTPS/SSL. (Range: 1-65535) Default Setting 443 Command Mode Global Configuration Command Usage • You cannot configure the HTTP and HTTPS servers to use the same port.
SYSTEM MANAGEMENT COMMANDS Secure Shell Commands The Berkley-standard includes remote access tools originally designed for Unix systems. Some of these tools have also been implemented for Microsoft Windows and other environments. These tools, including commands such as rlogin (remote login), rsh (remote shell), and rcp (remote copy), are not secure from hostile attacks. The Secure Shell (SSH) includes server/client applications intended as a secure replacement for the older Berkley remote access tools.
COMMAND LINE INTERFACE Table 4-14 Secure Shell Commands (Continued) Command Function Mode Page ip ssh crypto zeroize Clear the host key from RAM PE 4-53 ip ssh save host-key Saves the host key from RAM to flash memory PE 4-54 disconnect Terminates a line connection PE 4-24 show ip ssh Displays the status of the SSH server and the configured values for authentication timeout and retries PE 4-54 show ssh Displays the status of current SSH sessions PE 4-55 show public-key Shows the public
SYSTEM MANAGEMENT COMMANDS 2. Provide Host Public Key to Clients – Many SSH client programs automatically import the host public key during the initial connection setup with the switch. Otherwise, you need to manually create a known hosts file on the management station and place the host public key in it. An entry for a public key in the known hosts file would appear similar to the following example: 10.1.0.
COMMAND LINE INTERFACE 9. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. 10. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch. 11. The switch compares the decrypted bytes to the original bytes it sent. If the two sets match, this means that the client's private key corresponds to an authorized public key, and the client is authenticated.
SYSTEM MANAGEMENT COMMANDS Example Console#ip ssh crypto host-key generate dsa Console#configure Console(config)#ip ssh server Console(config)# Related Commands ip ssh crypto host-key generate (4-52) show ssh (4-55) ip ssh timeout Use this command to configure the timeout for the SSH server. Use the no form to restore the default setting. Syntax ip ssh timeout seconds no ip ssh timeout seconds – The timeout for client response during SSH negotiation.
COMMAND LINE INTERFACE Related Commands exec-timeout (4-18) show ip ssh (4-54) ip ssh authentication-retries Use this command to configure the number of times the SSH server attempts to reauthenticate a user. Use the no form to restore the default setting. Syntax ip ssh authentication-retries count no ip ssh authentication-retries count – The number of authentication attempts permitted after which the interface is reset.
SYSTEM MANAGEMENT COMMANDS ip ssh server-key size Use this command to set the SSH server key size. Use the no form to restore the default setting. Syntax ip ssh server-key size key-size no ip ssh server-key size key-size – The size of server key. (Range: 512-896 bits) Default Setting 768 bits Command Mode Global Configuration Command Usage • The server key is a private key that is never shared outside the switch. • The host key is shared with the SSH client, and is fixed at 1024 bits.
COMMAND LINE INTERFACE Command Mode Privileged Exec Example Console#delete public-key admin dsa Console# ip ssh crypto host-key generate Use this command to generate the host key pair (i.e., public and private). Syntax ip ssh crypto host-key generate [dsa | rsa] • dsa – DSA key type. • rsa – RSA key type. Default Setting Generates both the DSA and RSA key pairs. Command Mode Privileged Exec Command Usage • This command stores the host key pair in memory (i.e., RAM).
SYSTEM MANAGEMENT COMMANDS Related Commands ip ssh crypto zeroize (4-53) ip ssh save host-key (4-54) ip ssh crypto zeroize Use this command to clear the host key from memory (i.e. RAM). Syntax ip ssh crypto zeroize [dsa | rsa] • dsa – DSA key type. • rsa – RSA key type. Default Setting Clears both the DSA and RSA key. Command Mode Privileged Exec Command Usage • This command clears the host key from volatile memory (RAM). Use the no ip ssh save host-key command to clear the host key from flash memory.
COMMAND LINE INTERFACE ip ssh save host-key Use this command to save host key from RAM to flash memory. Syntax ip ssh save host-key [dsa | rsa] • dsa – DSA key type. • rsa – RSA key type. Default Setting Saves both the DSA and RSA key. Command Mode Privileged Exec Example Console#ip ssh save host-key dsa Console# Related Commands ip ssh crypto host-key generate (4-52) show ip ssh Use this command to display the connection settings used when authenticating client access to the SSH server.
SYSTEM MANAGEMENT COMMANDS show ssh Use this command to display the current SSH server connections. Command Mode Privileged Exec Example Console#show ssh Connection Version State 0 2.0 Session-Started Username Encryption admin ctos aes128-cbc-hmac-md5 stoc aes128-cbc-hmac-md5 Console# Table 4-15 SSH Information Field Description Session The session number. (Range: 0-3) Version The Secure Shell version number. State The authentication negotiation state.
COMMAND LINE INTERFACE Table 4-15 SSH Information (Continued) Field Description Encryption The encryption method is automatically negotiated between the client and server. Options for SSHv1.5 include: DES, 3DES Options for SSHv2.
SYSTEM MANAGEMENT COMMANDS Default Setting Shows all public keys. Command Mode Privileged Exec Command Usage • If no parameters are entered, all keys are displayed. If the user keyword is entered, but no user name is specified, then the public keys for all users are displayed. • When an RSA key is displayed, the first field indicates the size of the host key (e.g., 1024), the second field is the encoded public exponent (e.g., 35), and the last string is the encoded modulus.
COMMAND LINE INTERFACE Event Logging Commands Table 4-16 Event Logging Commands Command Function logging on Controls logging of error messages Mode Page GC 4-58 logging history Limits syslog messages saved to switch memory based on severity GC 4-59 logging host Adds a syslog server host IP address that will GC receive logging messages 4-60 logging facility Sets the facility type for remote logging of syslog messages GC 4-61 logging trap Limits syslog messages saved to a remote server based
SYSTEM MANAGEMENT COMMANDS Example Console(config)#logging on Console(config)# Related Commands logging history (4-59) clear logging (4-62) logging history This command limits syslog messages saved to switch memory based on severity. The no form returns the logging of syslog messages to the default level. Syntax logging history {flash | ram} level no logging history {flash | ram} • flash - Event history stored in flash memory (i.e., permanent memory). • ram - Event history stored in temporary RAM (i.e.
COMMAND LINE INTERFACE Table 4-17 Logging Levels (Continued) Name Level Description critical 2 Critical conditions (e.g., memory allocation, or free memory error - resource exhausted) alerts 1 Immediate action needed emergencies 0 System unusable * There are only Level 2, 5 and 6 error messages for the current firmware release.
SYSTEM MANAGEMENT COMMANDS Command Mode Global Configuration Command Usage • By using this command more than once you can build up a list of host IP addresses. • The maximum number of host IP addresses allowed is five. Example Console(config)#logging host 10.1.0.3 Console(config)# logging facility This command sets the facility type for remote logging of syslog messages. Use the no form to return the type to the default.
COMMAND LINE INTERFACE logging trap This command enables the logging of system messages to a remote server, or limits the syslog messages saved to a remote server based on severity. Use this command without a specified level to enable remote logging. Use the no form to disable remote logging. Syntax logging trap [level] no logging trap level - One of the level arguments listed below. Messages sent include the selected level up through level 0. (Refer to the table on page 4-59.
SYSTEM MANAGEMENT COMMANDS Command Mode Privileged Exec Example Console#clear logging Console# Related Commands show logging (4-63) show logging This command displays the logging configuration, along with any system and event messages stored in memory. Syntax show logging {flash | ram | sendmail | trap} • flash - Event history stored in flash memory (i.e., permanent memory). • ram - Event history stored in temporary RAM (i.e., memory flushed on power reset).
COMMAND LINE INTERFACE Example The following example shows that system logging is enabled, the message level for flash memory is “errors” (i.e., default level 3 - 0), the message level for RAM is “debugging” (i.e., default level 7 - 0), and lists one sample error Console#show logging flash Syslog logging: Enable History logging in FLASH: level errors [0] 0:0:5 1/1/1 "PRI_MGR_InitDefault function fails." level: 3, module: 13, function: 0, and event no.
SYSTEM MANAGEMENT COMMANDS Table 4-19 show logging trap - display description Field Description Syslog logging Shows if system logging has been enabled via the logging on command. REMOTELOG status Shows if remote logging has been enabled via the logging trap command. REMOTELOG facility type The facility type for remote logging of syslog messages as specified in the logging facility command.
COMMAND LINE INTERFACE logging sendmail host This command specifies SMTP servers that will be sent alert messages. Use the no form to remove an SMTP server. Syntax [no] logging sendmail host ip_address ip_address - IP address of an SMTP server that will be sent alert messages for event handling. Default Setting None Command Mode Global Configuration Command Usage • You can specify up to three SMTP servers for event handing. However, you must enter a separate command to specify each server.
SYSTEM MANAGEMENT COMMANDS logging sendmail level This command sets the severity threshold used to trigger alert messages. Syntax logging sendmail level level level - One of the system message levels (page 4-59). Messages sent include the selected level down to level 0. (Range: 0-7; Default: 7) Default Setting Level 7 Command Mode Global Configuration Command Usage The specified level indicates an event threshold. All events at this level or higher will be sent to the configured email recipients.
COMMAND LINE INTERFACE Default Setting None Command Mode Global Configuration Command Usage You may use an symbolic email address that identifies the switch, or the address of an administrator responsible for the switch. Example This example will send email alerts for system errors from level 3 through 0. Console(config)#logging sendmail source-email bill@this-company.com Console(config)# logging sendmail destination-email This command specifies the email recipients of alert messages.
SYSTEM MANAGEMENT COMMANDS Example Console(config)#logging sendmail destination-email ted@this-company.com Console(config)# logging sendmail This command enables SMTP event handling. Use the no form to disable this function. Syntax [no] logging sendmail Default Setting Disabled Command Mode Global Configuration Example Console(config)#logging sendmail Console(config)# show logging sendmail This command displays the settings for the SMTP event handler.
COMMAND LINE INTERFACE Example Console#show logging sendmail SMTP servers ----------------------------------------------1. 192.168.1.19 Active SMTP server: 192.168.1.19 SMTP minimum severity level: 3 SMTP destination email addresses ----------------------------------------------1. ted@this-company.com SMTP source email address: bill@this-company.com SMTP status: Enable Console# Time Commands The system clock can be dynamically set by polling a set of specified time servers (NTP or SNTP).
SYSTEM MANAGEMENT COMMANDS sntp server This command sets the IP address of the servers to which SNTP time requests are issued. Use the this command with no arguments to clear all time servers from the current list. Syntax sntp server [ip1 [ip2 [ip3]]] ip - IP address of an time server (NTP or SNTP). (Range: 1 - 3 addresses) Default Setting None Command Mode Global Configuration Command Usage This command specifies time servers from which the switch will poll for time updates when set to SNTP client mode.
COMMAND LINE INTERFACE sntp poll This command sets the interval between sending time requests when the switch is set to SNTP client mode. Use the no form to restore to the default. Syntax sntp poll seconds no sntp poll seconds - Interval between time requests.
SYSTEM MANAGEMENT COMMANDS Command Usage • The time acquired from time servers is used to record accurate dates and times for log events. Without SNTP, the switch only records the time starting from the factory default set at the last bootup (e.g., 00:00:00, Jan. 1, 2001). • This command enables client time requests to time servers specified via the sntp servers command. It issues time synchronization requests based on the interval set via the sntp poll command.
COMMAND LINE INTERFACE Command Mode Normal Exec, Privileged Exec Command Usage This command displays the current time, the poll interval used for sending time synchronization requests (when the switch is set to SNTP client mode), and the current SNTP mode (i.e., client or broadcast). Example Console#show sntp Current time: Jan 1 02:02:27 2005 Poll interval: 60 Current mode: unicast SNTP status : Enabled SNTP server 10.1.0.19 0.0.0.0 0.0.0.0 Current server: 10.1.0.
SYSTEM MANAGEMENT COMMANDS Command Usage This command sets the local time zone relative to the Coordinated Universal Time (UTC, formerly Greenwich Mean Time or GMT), based on the earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC.
COMMAND LINE INTERFACE Example This example shows how to set the system clock to 15:12:34, February 1st, 2005. Console#calendar set 15 12 34 1 February 2005 Console# show calendar This command displays the system clock.
SYSTEM MANAGEMENT COMMANDS System Status Commands Table 4-22 System Status Commands Command Function Mode Page show startup-config Displays the contents of the configuration file PE (stored in flash memory) that is used to start up the system 4-77 show running-config Displays the configuration data currently in use PE 4-79 show system Displays system information NE, PE 4-82 show users Shows all active console and Telnet sessions, NE, including user name, idle time, and IP address PE of Telnet
COMMAND LINE INTERFACE Command Usage • Use this command in conjunction with the show running-config command to compare the information in running memory to the information stored in non-volatile memory. • This command displays settings for key command modes. Each mode group is separated by “!” symbols, and includes the configuration mode command, and corresponding commands.
SYSTEM MANAGEMENT COMMANDS Example Console#show startup-config building startup-config, please wait.....
COMMAND LINE INTERFACE Command Usage • Use this command in conjunction with the show startup-config command to compare the information in running memory to the information stored in non-volatile memory. • This command displays settings for key command modes. Each mode group is separated by “!” symbols, and includes the configuration mode command, and corresponding commands.
SYSTEM MANAGEMENT COMMANDS Example Console#show running-config building running-config, please wait..... ! sntp server 0.0.0.0 0.0.0.0 0.0.0.
COMMAND LINE INTERFACE show system This command displays system information. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage • For a description of the items shown by this command, refer to “Displaying System Information” on page 3-12. • The POST results should all display “PASS.” If any POST test indicates “FAIL,” contact your distributor for assistance. Example Console#show system System description: SMC Networks SMC8612T2 System OID string: 1.3.6.1.4.1.202.20.
SYSTEM MANAGEMENT COMMANDS show users Shows all active console and Telnet sessions, including user name, idle time, and IP address of Telnet client. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The session used to execute this command is indicated by a “*” symbol next to the Line (i.e., session) index number.
COMMAND LINE INTERFACE Command Usage See “Displaying Switch Hardware/Software Versions” on page 3-14 for detailed information on the items displayed by this command. Example Console#show version Unit1 Serial number Hardware version Number of ports Main power status Redundant power status Agent(master) Unit id Loader version Boot rom version Operation code version Console# : : :12 :up :not present :1 :2.2.0.3 :2.1.0.4 :1.4.0.
FLASH/FILE COMMANDS Command Usage • This switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields. • To use jumbo frames, both the source and destination end nodes (such as a computer or server) must support this feature.
COMMAND LINE INTERFACE copy This command moves (upload/download) a code image or configuration file between the switch’s flash memory and a TFTP server. When you save the system code or configuration settings to a file on a TFTP server, that file can later be downloaded to the switch to restore system operation. The success of the file transfer depends on the accessibility of the TFTP server and the quality of the network connection.
FLASH/FILE COMMANDS Command Usage • The system prompts for data required to complete the copy command. • The destination file name should not contain slashes (\ or /), the leading letter of the file name should not be a period (.), and the maximum length for file names on the TFTP server is 127 characters or 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”) • Due to the size limit of the flash memory, the switch supports only two operation code files.
COMMAND LINE INTERFACE Example The following example shows how to upload the configuration settings to a file on the TFTP server: Console#copy file tftp Choose file type: 1. config: 2. opcode: <1-2>: 1 Source file name: startup TFTP server ip address: 10.1.0.99 Destination file name: startup.01 TFTP completed. Success. Console# The following example shows how to copy the running configuration to a startup file. Console#copy running-config file destination file name: startup Write to FLASH Programming.
FLASH/FILE COMMANDS This example shows how to copy a secure-site certificate from an TFTP server. It then reboots the switch to activate the certificate: Console#copy tftp https-certificate TFTP server ip address: 10.1.0.19 Source certificate file name: SS-certificate Source private file name: SS-private Private password: ******** Success. Console#reload System will be restarted, continue ? y This example shows how to copy a public-key used by SSH from an TFTP server.
COMMAND LINE INTERFACE Command Usage • If the file type is used for system startup, then this file cannot be deleted. • “Factory_Default_Config.cfg” cannot be deleted. Example This example shows how to delete the test2.cfg configuration file from flash memory. Console#delete test2.cfg Console# Related Commands dir (4-90) delete public-key (4-51) dir This command displays a list of files in flash memory.
FLASH/FILE COMMANDS Command Usage • If you enter the command dir without any parameters, the system displays all files. • File information is shown below: Table 4-25 File Directory Information Column Heading Description file name The name of the file. file type File types: Boot-Rom, Operation Code, and Config file. startup Shows if this file is used when the system is started. size The length of the file in bytes. Example The following example shows how to display all file information.
COMMAND LINE INTERFACE Example This example shows the information displayed by the whichboot command. See the table under the dir command for a description of the file information displayed by this command. Console#whichboot file name file type startup size (byte) ----------------- -------------- ------- ----------diag_0060 Boot-Rom image Y 111360 run_0200 Operation Code Y 1083008 startup Config File Y 2710 Console# boot system This command specifies the image used to start up the system.
AUTHENTICATION COMMANDS Example Console(config)#boot system config: startup Console(config)# Related Commands dir (4-90) whichboot (4-91) Authentication Commands You can configure this switch to authenticate users logging into the system for management access using local or RADIUS authentication methods. You can also enable port-based authentication for network client access using IEEE 802.1X.
COMMAND LINE INTERFACE authentication login This command defines the login authentication method and precedence. Use the no form to restore the default. Syntax authentication login {[local] [radius] [tacacs]} no authentication login • local - Use local password. • radius - Use RADIUS server password. • tacacs - Use TACACS server password. Default Setting Local Command Mode Global Configuration Command Usage • RADIUS uses UDP while TACACS+ uses TCP.
AUTHENTICATION COMMANDS Example Console(config)#authentication login radius Console(config)# Related Commands username - for setting the local user names and passwords (4-35) RADIUS Client Remote Authentication Dial-in User Service (RADIUS) is a logon authentication protocol that uses software running on a central server to control access to RADIUS-aware devices on the network.
COMMAND LINE INTERFACE Default Setting 10.1.0.1 Command Mode Global Configuration Example Console(config)#radius-server host 192.168.1.25 Console(config)# radius-server port This command sets the RADIUS server network port. Use the no form to restore the default. Syntax radius-server port port_number no radius-server port port_number - RADIUS server UDP port used for authentication messages.
AUTHENTICATION COMMANDS radius-server key This command sets the RADIUS encryption key. Use the no form to restore the default. Syntax radius-server key key_string no radius-server key key_string - Encryption key used to authenticate logon access for client. Do not use blank spaces in the string.
COMMAND LINE INTERFACE Command Mode Global Configuration Example Console(config)#radius-server retransmit 5 Console(config)# radius-server timeout This command sets the interval between transmitting authentication requests to the RADIUS server. Use the no form to restore the default. Syntax radius-server timeout number_of_seconds no radius-server timeout number_of_seconds - Number of seconds the switch waits for a reply before resending a request.
AUTHENTICATION COMMANDS Example Console#show radius-server Remote radius server configuration: Server IP address: 192.168.1.25 Communication key with radius server: green Server port number: 181 Retransmit times: 5 Request timeout: 10 Console# TACACS+ Client Terminal Access Controller Access Control System (TACACS+) is a logon authentication protocol that uses software running on a central server to control access to TACACS-aware devices on the network.
COMMAND LINE INTERFACE Default Setting 10.11.12.13 Command Mode Global Configuration Example Console(config)#tacacs-server host 192.168.1.26 Console(config)# tacacs-server port This command specifies the TACACS+ server network port. Use the no form to restore the default. Syntax tacacs-server port port_number no tacacs-server port port_number - TACACS+ server TCP port used for authentication messages.
AUTHENTICATION COMMANDS tacacs-server key This command sets the TACACS+ encryption key. Use the no form to restore the default. Syntax tacacs-server key key_string no tacacs-server key key_string - Encryption key used to authenticate logon access for the client. Do not use blank spaces in the string.
COMMAND LINE INTERFACE Port Security Commands These commands can be used to disable the learning function or manually specify secure addresses for a port. You may want to leave port security off for an initial training period (i.e., enable the learning function) to register all the current VLAN members on the selected port, and then enable port security to ensure that the port will drop any incoming frames with a source MAC address that is unknown or has been previously learned from another port.
AUTHENTICATION COMMANDS Default Setting Status: Disabled Action: None Maximum Addresses: 0 Command Mode Interface Configuration (Ethernet) Command Usage • If you enable port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table will be accepted.
COMMAND LINE INTERFACE Related Commands shutdown (4-174) mac-address-table static (4-201) show mac-address-table (4-203) 802.1X Port Authentication The switch supports IEEE 802.1X (dot1X) port-based access control that prevents unauthorized access to the network by requiring users to first submit credentials for authentication. Client authentication is controlled centrally by a RADIUS server using EAP (Extensible Authentication Protocol). Table 4-31 802.
AUTHENTICATION COMMANDS Table 4-31 802.1X Port Authentication Commands (Continued) Command Function Mode Page dot1x timeout re-authperiod Sets the time period after which a connected client must be re-authenticated IC 4-110 dot1x timeout tx-period Sets the time period during an authentication session that the switch waits before re-transmitting an EAP packet IC 4-111 show dot1x PE 4-111 Shows all dot1x related information dot1x system-auth-control This command enables IEEE 802.
COMMAND LINE INTERFACE Default Setting RADIUS Command Mode Global Configuration Example Console(config)#authentication dot1x default radius Console(config)# dot1x default This command sets all configurable dot1x global and port settings to their default values.
AUTHENTICATION COMMANDS Default 2 Command Mode Interface Configuration Example Console(config)#interface ethernet 1/2 Console(config-if)#dot1x max-req 2 Console(config-if)# dot1x port-control This command sets the dot1x mode on a port interface. Use the no form to restore the default. Syntax dot1x port-control {auto | force-authorized | force-unauthorized} no dot1x port-control • auto – Requires a dot1x-aware connected client to be authorized by the RADIUS server.
COMMAND LINE INTERFACE dot1x operation-mode This command allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. Use the no form with no keywords to restore the default to single host. Use the no form with the multi-host max-count keywords to restore the default maximum count. Syntax dot1x operation-mode {single-host | multi-host [max-count count]} no dot1x operation-mode [multi-host max-count] • • • • single-host – Allows only a single host to connect to this port.
AUTHENTICATION COMMANDS Command Mode Privileged Exec Example Console#dot1x re-authenticate Console# dot1x re-authentication This command enables periodic re-authentication globally for all ports. Use the no form to disable re-authentication.
COMMAND LINE INTERFACE Command Mode Interface Configuration Example Console(config)#interface eth 1/2 Console(config-if)#dot1x timeout quiet-period 350 Console(config-if)# dot1x timeout re-authperiod This command sets the time period after which a connected client must be re-authenticated. Syntax dot1x timeout re-authperiod seconds no dot1x timeout re-authperiod seconds - The number of seconds.
AUTHENTICATION COMMANDS dot1x timeout tx-period This command sets the time that the switch waits during an authentication session before re-transmitting an EAP packet. Use the no form to reset to the default value. Syntax dot1x timeout tx-period seconds no dot1x timeout tx-period seconds - The number of seconds.
COMMAND LINE INTERFACE Command Usage This command displays the following information: • Global 802.1X Parameters – Shows whether or not 802.1X port authentication is globally enabled on the switch. • 802.1X Port Summary – Displays the port access control parameters for each interface that has enabled 802.1X, including the following items: - Status– Administrative state for port access control. - Operation Mode–Allows single or multiple hosts (page 4-108). - Mode– Dot1x port control mode (page 4-107).
AUTHENTICATION COMMANDS - State – Current state (including initialize, disconnected, connecting, authenticating, authenticated, aborting, held, force_authorized, force_unauthorized). - Reauth Count – Number of times connecting state is re-entered. • Backend State Machine - State – Current state (including request, response, success, fail, timeout, idle, initialize). - Request Count – Number of EAP Request packets sent to the Supplicant without receiving a response.
COMMAND LINE INTERFACE Example Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name 1/1 1/2 . . . 1/11 1/12 Status disabled disabled Operation Mode Single-Host Single-Host disabled enabled Single-Host Single-Host 802.1X Port Details 802.1X is disabled on port 1/1 . . . 802.
ACCESS CONTROL LIST COMMANDS Access Control List Commands Access Control Lists (ACL) provide packet filtering for IP frames (based on address, protocol, Layer 4 protocol port number or TCP control code) or any frames (based on MAC address or Ethernet type). To filter packets, first create an access list, add the required rules, specify a mask to modify the precedence in which the rules are checked, and then bind the list to a specific port.
COMMAND LINE INTERFACE The following restrictions apply to ACLs: • This switch supports ACLs for both ingress and egress filtering. However, you can only bind one IP ACL and one MAC ACL to any port for ingress filtering, and one IP ACL and one MAC ACL to any port for egress filtering. In other words, only four ACLs can be bound to an interface – Ingress IP ACL, Egress IP ACL, Ingress MAC ACL and Egress MAC ACL.
ACCESS CONTROL LIST COMMANDS Masks for Access Control Lists You can specify optional masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/filter packets matching the permit/deny rules specified in an ingress ACL. You can also configure up to seven user-defined masks for an ACL. A mask must be bound exclusively to one of the basic ACL types (i.e.
COMMAND LINE INTERFACE Table 4-33 IP ACL Commands (Continued) Command Function Mode Page access-list ip mask-precedence Accesses the IP Mask mode used to configure access control mask GC 4-124 mask Sets a precedence mask for the ACL rules IP-Mask 4-125 show access-list ip mask-precedence Shows the ingress or egress rule masks PE for IP ACLs ip access-group Adds a port to an IP ACL IC 4-129 show ip access-group Shows port assignments for IP ACLs PE 4-129 map access-list ip Sets the CoS
ACCESS CONTROL LIST COMMANDS Default Setting None Command Mode Global Configuration Command Usage • An egress ACL must contain all deny rules. • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To create an ACL, you must add at least one rule to the list. • To remove a rule, use the no permit or no deny command followed by the exact text of a previously configured rule. • An ACL can contain up to 32 rules.
COMMAND LINE INTERFACE Default Setting None Command Mode Standard ACL Command Usage • New rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match” and 0 bits to indicate “ignore.” The bitmask is bitwise ANDed with the specified source IP address, and then compared with the address for each IP packet entering the port(s) to which this ACL has been assigned.
ACCESS CONTROL LIST COMMANDS permit, deny (Extended ACL) This command adds a rule to an Extended IP ACL. The rule sets a filter condition for packets with specific source or destination IP addresses, protocol types, source or destination protocol ports, or TCP control codes. Use the no form to remove a rule.
COMMAND LINE INTERFACE • control-flags – Decimal number (representing a bit string) that specifies flag bits in byte 14 of the TCP header. (Range: 0-63) • flag-bitmask – Decimal number representing the code bits to match. Default Setting None Command Mode Extended ACL Command Usage • All new rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period.
ACCESS CONTROL LIST COMMANDS Example This example accepts any incoming packets if the source address is within subnet 10.7.1.x. For example, if the rule is matched; i.e., the rule (10.7.1.0 & 255.255.255.0) equals the masked address (10.7.1.2 & 255.255.255.0), the packet passes through. Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any Console(config-ext-acl)# This allows TCP packets from class C addresses 192.168.1.0 to any destination address when set for destination TCP port 80 (i.e., HTTP).
COMMAND LINE INTERFACE Example Console#show ip access-list standard IP standard access-list david: permit host 10.1.1.21 permit 168.92.0.0 0.0.15.255 Console# Related Commands permit, deny 4-119 ip access-group (4-129) access-list ip mask-precedence This command accesses the IP Mask mode used to configure access control masks. Use the no form to delete the mask table. Syntax [no] access-list ip mask-precedence {in | out} • in – Ingress mask for ingress ACLs. • out – Egress mask for egress ACLs.
ACCESS CONTROL LIST COMMANDS Example Console(config)#access-list ip mask-precedence in Console(config-ip-mask-acl)# Related Commands mask (IP ACL) (4-125) ip access-group (4-129) mask (IP ACL) This command defines a mask for IP ACLs. This mask defines the fields to check in the IP header. Use the no form to remove a mask.
COMMAND LINE INTERFACE Command Mode IP Mask Command Usage • Packets crossing a port are checked against all the rules in the ACL until a match is found. The order in which these packets are checked is determined by the mask, and not the order in which the ACL rules were entered. • First create the required ACLs and ingress or egress masks before mapping an ACL to an interface. • If you enter dscp, you cannot enter tos or precedence. You can enter both tos and precedence without dscp.
ACCESS CONTROL LIST COMMANDS This shows how to create a standard ACL with an ingress mask to deny access to the IP host 171.69.198.102, and permit access to any others. Console(config)#access-list ip standard A2 Console(config-std-acl)#permit any Console(config-std-acl)#deny host 171.69.198.102 Console(config-std-acl)#end Console#show access-list IP standard access-list A2: permit 10.1.1.0 255.255.255.0 deny host 10.1.1.1 permit any deny host 171.69.198.
COMMAND LINE INTERFACE This is a more comprehensive example. It denies any TCP packets in which the SYN bit is ON, and permits all other packets. It then sets the ingress mask to check the deny rule first, and finally binds port 1 to this ACL. Note that once the ACL is bound to an interface (i.e., the ACL is active), the order in which the rules are displayed is determined by the associated mask.
ACCESS CONTROL LIST COMMANDS Command Mode Privileged Exec Example Console#show access-list ip mask-precedence IP ingress mask ACL: mask host any mask 255.255.255.0 any Console# Related Commands mask (IP ACL) (4-125) ip access-group This command binds a port to an IP ACL. Use the no form to remove the port. Syntax [no] ip access-group acl_name {in | out} • acl_name – Name of the ACL. (Maximum length: 16 characters) • in – Indicates that this list applies to ingress packets.
COMMAND LINE INTERFACE Example Console(config)#int eth 1/11 Console(config-if)#ip access-group david in Console(config-if)# Related Commands show ip access-list (4-123) show ip access-group This command shows the ports assigned to IP ACLs. Command Mode Privileged Exec Example Console#show ip access-group Interface ethernet 1/11 IP access-list david in Console# Related Commands ip access-group (4-129) map access-list ip This command sets the output queue for packets matching an ACL rule.
ACCESS CONTROL LIST COMMANDS Default Setting None Command Mode Interface Configuration (Ethernet) Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown in the following table. For information on mapping the CoS values to output queues, see queue cos-map on 4-259.
COMMAND LINE INTERFACE show map access-list ip This command shows the CoS value mapped to an IP ACL for the current interface. (The CoS value determines the output queue for packets matching an ACL rule.) Syntax show map access-list ip [interface] interface ethernet unit/port • unit - This is device 1. • port - Port number.
ACCESS CONTROL LIST COMMANDS match access-list ip This command changes the IEEE 802.1p priority, IP Precedence, or DSCP Priority of a frame matching the defined ACL rule. (This feature is commonly referred to as ACL packet marking.) Use the no form to remove the ACL marker. Syntax match access-list ip acl_name [set priority priority] {set tos tos_value | set dscp dscp_value} no match access-list ip acl_name • acl_name – Name of the ACL.
COMMAND LINE INTERFACE Example Console(config)#interface ethernet 1/12 Console(config-if)#match access-list ip bill set dscp 0 Console(config-if)# Related Commands show marking (4-134) show marking This command displays the current configuration for packet marking.
ACCESS CONTROL LIST COMMANDS MAC ACLs Table 4-35 MAC ACL Commands Command Function Mode Page access-list mac Creates a MAC ACL and enters configuration mode GC 4-136 permit, deny Filters packets matching a specified MAC-ACL source and destination address, packet format, and Ethernet type 4-137 show mac access-list Displays the rules for configured MAC ACLs PE 4-139 access-list mac mask-precedence Accesses the mode for configuring access control masks GC 4-139 mask Sets a precedence mask f
COMMAND LINE INTERFACE access-list mac This command adds a MAC access list and enters MAC ACL configuration mode. Use the no form to remove the specified ACL. Syntax [no] access-list mac acl_name acl_name – Name of the ACL. (Maximum length: 16 characters) Default Setting None Command Mode Global Configuration Command Usage • An egress ACL must contain all deny rules.
ACCESS CONTROL LIST COMMANDS permit, deny (MAC ACL) This command adds a rule to a MAC ACL. The rule filters packets matching a specified MAC source or destination address (i.e., physical layer address), or Ethernet protocol type. Use the no form to remove a rule. Syntax [no] {permit | deny} {any | host source | source address-bitmask} {any | host destination | destination address-bitmask} [vid vid vid-bitmask] [ethertype protocol [protocol-bitmask]] Note:- The default is for Ethernet II packets.
COMMAND LINE INTERFACE • address-bitmask17 – Bitmask for MAC address (in hexidecimal format). • vid – VLAN ID. (Range: 1-4095) • vid-bitmask17 – VLAN bitmask. (Range: 1-4095) • protocol – A specific Ethernet protocol number. (Range: 600-fff hex.) • protocol-bitmask17 – Protocol bitmask. (Range: 600-fff hex.) Default Setting None Command Mode MAC ACL Command Usage • New rules are added to the end of the list. • The ethertype option can only be used to filter Ethernet II formatted packets.
ACCESS CONTROL LIST COMMANDS show mac access-list This command displays the rules for configured MAC ACLs. Syntax show mac access-list [acl_name] acl_name – Name of the ACL.
COMMAND LINE INTERFACE Command Usage • You must configure a mask for an ACL rule before you can bind it to a port or set the queue or frame priorities associated with the rule. • A mask can only be used by all ingress ACLs or all egress ACLs. • The precedence of the ACL rules applied to a packet is not determined by order of the rules, but instead by the order of the masks; i.e., the first mask that matches a rule will determine the rule that is applied to a packet.
ACCESS CONTROL LIST COMMANDS • vid-bitmask – VLAN ID of rule must match this bitmask. • ethertype – Check the Ethernet type field. • ethertype-bitmask – Ethernet type of rule must match this bitmask. Default Setting None Command Mode MAC Mask Command Usage • Up to seven masks can be assigned to an ingress or egress ACL. • Packets crossing a port are checked against all the rules in the ACL until a match is found.
COMMAND LINE INTERFACE Example This example shows how to create an Ingress MAC ACL and bind it to a port. You can then see that the order of the rules have been changed by the mask.
ACCESS CONTROL LIST COMMANDS This example creates an Egress MAC ACL. Console(config)#access-list mac M5 Console(config-mac-acl)#deny tagged-802.3 host 00-11-11-11-11-11 any Console(config-mac-acl)#deny tagged-eth2 00-11-11-11-11-11 ff-ff-ff-ff-ff-ff any vid 3 ethertype 0806 Console(config-mac-acl)#end Console#show access-list MAC access-list M5: deny tagged-802.
COMMAND LINE INTERFACE Related Commands mask (MAC ACL) (4-140) mac access-group This command binds a port to a MAC ACL. Use the no form to remove the port. Syntax mac access-group acl_name {in | out} • acl_name – Name of the ACL. (Maximum length: 16 characters) • in – Indicates that this list applies to ingress packets. • out – Indicates that this list applies to egress packets. Default Setting None Command Mode Interface Configuration (Ethernet) Command Usage • A port can only be bound to one ACL.
ACCESS CONTROL LIST COMMANDS show mac access-group This command shows the ports assigned to MAC ACLs. Command Mode Privileged Exec Example Console#show mac access-group Interface ethernet 1/5 MAC access-list M5 out Console# Related Commands mac access-group (4-144) map access-list mac This command sets the output queue for packets matching an ACL rule. The specified CoS value is only used to map the matching packet to an output queue; it is not written to the packet itself.
COMMAND LINE INTERFACE Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown below.
ACCESS CONTROL LIST COMMANDS Example Console#show map access-list mac Access-list to COS of Eth 1/5 Access-list M5 cos 0 Console# Related Commands map access-list mac (4-145) match access-list mac This command changes the IEEE 802.1p priority of a Layer 2 frame matching the defined ACL rule. (This feature is commonly referred to as ACL packet marking.) Use the no form to remove the ACL marker.
COMMAND LINE INTERFACE Related Commands show marking (4-134) ACL Information Table 4-37 ACL Information Command Function Mode Page show access-list Shows all ACLs and associated rules PE 4-148 show access-group Shows the ACLs assigned to each port PE 4-149 show access-list This command shows all ACLs and associated rules, as well as all the user-defined masks. Command Mode Privileged Exec Command Usage Once the ACL is bound to an interface (i.e.
SNMP COMMANDS show access-group This command shows the port assignments of ACLs. Command Mode Privileged Executive Example Console#show access-group Interface ethernet 1/11 IP standard access-list david MAC access-list jerry Console# SNMP Commands Control access to this switch from management stations using the Simple Network Management Protocol (SNMP), as well as the error types sent to trap managers.
COMMAND LINE INTERFACE snmp-server community This command defines the community access string for the Simple Network Management Protocol. Use the no form to remove the specified community string. Syntax snmp-server community string [ro|rw] no snmp-server community string • string - Community string that acts like a password and permits access to the SNMP protocol. (Maximum length: 32 characters, case sensitive; Maximum number of strings: 5) • ro - Specifies read-only access.
SNMP COMMANDS snmp-server contact This command sets the system contact string. Use the no form to remove the system contact information. Syntax snmp-server contact string no snmp-server contact string - String that describes the system contact information.
COMMAND LINE INTERFACE Command Mode Global Configuration Example Console(config)#snmp-server location WC-19 Console(config)# Related Commands snmp-server contact (4-151) snmp-server host This command specifies the recipient of a Simple Network Management Protocol notification operation. Use the no form to remove the specified host. Syntax snmp-server host host-addr community-string [version {1 | 2c}] no snmp-server host host-addr • host-addr - Internet address of the host (the targeted recipient).
SNMP COMMANDS Command Usage • If you do not enter an snmp-server host command, no notifications are sent. In order to configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. In order to enable multiple hosts, you must issue a separate snmp-server host command for each host. • The snmp-server host command is used in conjunction with the snmp-server enable traps command.
COMMAND LINE INTERFACE snmp-server enable traps This command enables this device to send Simple Network Management Protocol traps (SNMP notifications). Use the no form to disable SNMP notifications. Syntax [no] snmp-server enable traps [authentication | link-up-down] • authentication - Keyword to issue authentication failure traps. • link-up-down - Keyword to issue link-up or link-down traps. Default Setting Issue authentication and link-up-down traps.
SNMP COMMANDS Related Commands snmp-server host (4-152) show snmp This command checks the status of SNMP communications. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage This command provides information on the community access strings, counter information for SNMP input and output protocol data units, and whether or not SNMP logging has been enabled with the snmp enable traps command.
COMMAND LINE INTERFACE Example Console#show snmp System Contact: Paul System Location: WC-19 SNMP traps: Authentication: enable Link-up-down: enable SNMP communities: 1. alpha, and the privilege is read-write 2. private, and the privilege is read-write 3.
DNS COMMANDS DNS Commands These commands are used to configure Domain Naming System (DNS) services. You can manually configure entries in the DNS domain name to IP address mapping table, configure default domain names, or specify one or more name servers to use for domain name to address translation.
COMMAND LINE INTERFACE ip host This command creates a static entry in the DNS table that maps a host name to an IP address. Use the no form to remove an entry. Syntax [no] ip host name address1 [address2 … address8] • name - Name of the host. (Range: 1-64 characters) • address1 - Corresponding IP address. • address2 … address8 - Additional corresponding IP addresses.
DNS COMMANDS clear host This command deletes entries from the DNS table. Syntax clear host {name | *} • name - Name of the host. (Range: 1-64 characters) • * - Removes all entries. Default Setting None Command Mode Privileged Exec Example This example clears all static entries from the DNS table. Console(config)#clear host * Console(config)# ip domain-name This command defines the default domain name appended to incomplete host names (i.e.
COMMAND LINE INTERFACE Command Mode Global Configuration Example Console(config)#ip domain-name sample.com Console(config)#end Console#show dns Domain Lookup Status: DNS disabled Default Domain Name: sample.com Domain Name List: Name Server List: Console# Related Commands ip domain-list (4-160) ip name-server (4-162) ip domain-lookup (4-163) ip domain-list This command defines a list of domain names that can be appended to incomplete host names (i.e.
DNS COMMANDS Command Usage • Domain names are added to the end of the list one at a time. • When an incomplete host name is received by the DNS server on this switch, it will work through the domain list, appending each domain name in the list to the host name, and checking with the specified name servers for a match. • If there is no domain list, the domain name specified with the ip domain-name command is used. If there is a domain list, the default domain name is not used.
COMMAND LINE INTERFACE ip name-server This command specifies the address of one or more domain name servers to use for name-to-address resolution. Use the no form to remove a name server from this list. Syntax [no] ip name-server server-address1 [server-address2 … server-address6] • server-address1 - IP address of domain-name server. • server-address2 … server-address6 - IP address of additional domain-name servers.
DNS COMMANDS Related Commands ip domain-name (4-159) ip domain-lookup (4-163) ip domain-lookup This command enables DNS host name-to-address translation. Use the no form to disable DNS. Syntax [no] ip domain-lookup Default Setting Disabled Command Mode Global Configuration Command Usage • At least one name server must be specified before you can enable DNS. • If all name servers are deleted, DNS will automatically be disabled. Example This example enables DNS and then displays the configuration.
COMMAND LINE INTERFACE Related Commands ip domain-name (4-159) ip name-server (4-162) show hosts This command displays the static host name-to-address mapping table. Command Mode Privileged Exec Example Note that a host name will be displayed as an alias if it is mapped to the same address(es) as a previously configured entry. Console#show hosts Hostname rd5 Inet address 10.1.0.55 192.168.1.
DNS COMMANDS show dns This command displays the configuration of the DNS server. Command Mode Privileged Exec Example Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: sample.com Domain Name List: sample.com.jp sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# show dns cache This command displays entries in the DNS cache.
COMMAND LINE INTERFACE Table 4-40 Show DNS Cache Field Description Field Description NO The entry number for each resource record. FLAG The flag is always “4” indicating a cache entry and therefore unreliable. TYPE This field includes CNAME which specifies the canonical or primary name for the owner, and ALIAS which specifies multiple domain names which are mapped to the same IP address as an existing entry. IP The IP address associated with this record.
INTERFACE COMMANDS Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN.
COMMAND LINE INTERFACE interface This command configures an interface type and enter interface configuration mode. Use the no form to remove a trunk. Syntax interface interface no interface port-channel channel-id • interface - ethernet unit/port - unit - This is device 1. - port - Port number.
INTERFACE COMMANDS Command Mode Interface Configuration (Ethernet, Port Channel) Example The following example adds a description to port 12. Console(config)#interface ethernet 1/12 Console(config-if)#description RD-SW#3 Console(config-if)# speed-duplex This command configures the speed and duplex mode of a given interface when autonegotiation is disabled. Use the no form to restore the default.
COMMAND LINE INTERFACE To set the speed/duplex mode under auto-negotiation, the required mode must be specified in the capabilities list for an interface. Example The following example configures port 5 to 100 Mbps, half-duplex operation. Console(config)#interface ethernet 1/5 Console(config-if)#speed-duplex 100half Console(config-if)#no negotiation Console(config-if)# Related Commands negotiation (4 -170) capabilities (4 -171) negotiation This command enables autonegotiation for a given interface.
INTERFACE COMMANDS Example The following example configures port 11 to use autonegotiation. Console(config)#interface ethernet 1/11 Console(config-if)#negotiation Console(config-if)# Related Commands capabilities (4 -171) speed-duplex (4 -169) capabilities This command advertises the port capabilities of a given interface during autonegotiation. Use the no form with parameters to remove an advertised capability, or the no form without parameters to restore the default values.
COMMAND LINE INTERFACE Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage When auto-negotiation is enabled with the negotiation command, the switch will negotiate the best settings for a link based on the capabilites command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands. Example The following example configures Ethernet port 5 capabilities to 100half, 100full and flow control.
INTERFACE COMMANDS Command Usage • Flow control can eliminate frame loss by “blocking” traffic from end stations or segments connected directly to the switch when its buffers fill. When enabled, back pressure is used for half-duplex operation and IEEE 802.3x for full-duplex operation. • To force flow control on or off (with the flowcontrol or no flowcontrol command), use the no negotiation command to disable auto-negotiation on the selected interface.
COMMAND LINE INTERFACE combo-forced-mode This command forces the port type selected for combination ports 21 - 24. Use the no form to restore the default mode. Syntax combo-forced-mode mode no combo-forced-mode mode • copper-forced - Always uses the built-in RJ-45 port. • copper-preferred-auto - Uses the built-in RJ-45 port if both combination types are functioning and the RJ-45 port has a valid link. • sfp-forced - Always uses the SFP port (even if a module is not installed).
INTERFACE COMMANDS Default Setting All interfaces are enabled. Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage This command allows you to disable a port due to abnormal behavior (e.g., excessive collisions), and then reenable it after the problem has been resolved. You may also want to disable a port for security reasons. Example The following example disables port 5.
COMMAND LINE INTERFACE • This command can enable or disable broadcast storm control for the selected interface. However, the specified threshold value applies to all ports on the switch. Example The following shows how to configure broadcast storm control at 600 packets per second: Console(config)#interface ethernet 1/5 Console(config-if)#switchport broadcast packet-rate 600 Console(config-if)# clear counters This command clears statistics on an interface.
INTERFACE COMMANDS Example The following example clears statistics on port 5. Console#clear counters ethernet 1/5 Console# show interfaces status This command displays the status for an interface. Syntax show interfaces status [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) • vlan vlan-id (Range: 1-4094) Default Setting Shows the status for all interfaces.
COMMAND LINE INTERFACE Example Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: 1000T Mac address: 00-00-AB-CD-00-01 Configuration: Name: Port admin: Up Speed-duplex: Auto Capabilities: 10half, 10full, 100half, 100full, 1000full, Broadcast storm: Enabled Broadcast storm limit: 500 packets/second Flow control: Disabled Lacp: Disabled Port security: Disabled Max MAC count: 0 Port security action: None Combo forced mode: None Current status: Link status: Up Port
INTERFACE COMMANDS Command Mode Normal Exec, Privileged Exec Command Usage If no interface is specified, information on all interfaces is displayed. For a description of the items displayed by this command, see “Showing Port Statistics” on page 3-106.
COMMAND LINE INTERFACE show interfaces switchport This command displays the administrative and operational status of the specified interfaces. Syntax show interfaces switchport [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) • vlan vlan-id (Range: 1-4094) Default Setting Shows all interfaces. Command Mode Normal Exec, Privileged Exec Command Usage If no interface is specified, information on all interfaces is displayed.
INTERFACE COMMANDS Table 4-42 show interfaces switchport - display description Field Description Broadcast threshold Shows if broadcast storm suppression is enabled or disabled; if enabled it also shows the threshold level (page 4-175). Lacp status Shows if Link Aggregation Control Protocol has been enabled or disabled (page 4-188). Ingress/Egress rate limit Shows if rate limiting is enabled, and the current rate limit. (4-185).
COMMAND LINE INTERFACE Mirror Port Commands This section describes how to mirror traffic from a source port to a target port. Table 4-43 Mirror Port Commands Command Function port monitor Configures a mirror session show port monitor Shows the configuration for a mirror port Mode Page IC 4-182 PE 4-183 port monitor This command configures a mirror session. Use the no form to clear a mirror session.
MIRROR PORT COMMANDS Command Usage • You can mirror traffic from any source port to a destination port for real-time analysis. You can then attach a logic analyzer or RMON probe to the destination port and study the traffic crossing the source port in a completely unobtrusive manner. • The destination port is set by specifying an Ethernet interface. • The mirror port and monitor port speeds should match, otherwise traffic may be dropped from the monitor port.
COMMAND LINE INTERFACE Example The following shows mirroring configured from port 6 to port 11.
RATE LIMIT COMMANDS rate-limit This command defines the rate limit for a specific interface. Use this command without specifying a rate to restore the default rate. Use the no form to restore the default status of disabled. Syntax rate-limit {input | output} [rate] no rate-limit {input | output} • input – Input rate • output – Output rate • rate – Maximum value in Mbps.
COMMAND LINE INTERFACE Link Aggregation Commands Ports can be statically grouped into an aggregate link (i.e., trunk) to increase the bandwidth of a network connection or to ensure fault recovery. Or you can use the Link Aggregation Control Protocol (LACP) to automatically negotiate a trunk link between this switch and another network device. For static trunks, the switches have to comply with the Cisco EtherChannel standard. For dynamic trunks, the switches have to comply with LACP.
LINK AGGREGATION COMMANDS Guidelines for Creating Trunks General Guidelines • Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • A trunk can have up to eight ports. • The ports at both ends of a connection must be configured as trunk ports. • All ports in a trunk must be configured in an identical manner, including communication mode (i.e., speed, duplex mode and flow control), VLAN assignments, and CoS settings.
COMMAND LINE INTERFACE channel-group This command adds a port to a trunk. Use the no form to remove a port from a trunk. Syntax channel-group channel-id no channel-group channel-id - Trunk index (Range: 1-6) Default Setting The current port will be added to this trunk. Command Mode Interface Configuration (Ethernet) Command Usage • When configuring static trunks, the switches must comply with the Cisco EtherChannel standard. • Use no channel-group to remove a port group from a trunk.
LINK AGGREGATION COMMANDS Command Mode Interface Configuration (Ethernet) Command Usage • The ports on both ends of an LACP trunk must be configured for full duplex, either by forced mode or auto-negotiation. • A trunk formed with another switch using LACP will automatically be assigned the next available port-channel ID. • If the target switch has also enabled LACP on the connected ports, the trunk will be activated automatically.
COMMAND LINE INTERFACE Example The following shows LACP enabled on ports 10-12. Because LACP has also been enabled on the ports at the other end of the links, the show interfaces status port-channel 1 command shows that Trunk1 has been established.
LINK AGGREGATION COMMANDS lacp system-priority This command configures a port's LACP system priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} system-priority priority no lacp {actor | partner} system-priority • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. • priority - This priority is used to determine link aggregation group (LAG) membership, and to identify this device to other switches during LAG negotiations.
COMMAND LINE INTERFACE lacp admin-key (Ethernet Interface) This command configures a port's LACP administration key. Use the no form to restore the default setting. Syntax lacp {actor | partner} admin-key key [no] lacp {actor | partner} admin-key • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. • key - The port admin key must be set to the same value for ports that belong to the same link aggregation group (LAG).
LINK AGGREGATION COMMANDS lacp admin-key (Port Channel) This command configures a port channel's LACP administration key string. Use the no form to restore the default setting. Syntax lacp admin-key key [no] lacp admin-key key - The port channel admin key is used to identify a specific link aggregation group (LAG) during local LACP setup on this switch.
COMMAND LINE INTERFACE lacp port-priority This command configures LACP port priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} port-priority priority no lacp {actor | partner} port-priority • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. • priority - LACP port priority is used to select a backup link.
LINK AGGREGATION COMMANDS show lacp This command displays LACP information. Syntax show lacp [port-channel] {counters | internal | neighbors | sys-id} • port-channel - Local identifier for a link aggregation group. (Range: 1-6) • counters - Statistics for LACP protocol messages. • internal - Configuration settings and operational state for local side. • neighbors - Configuration settings and operational state for remote side. • sys-id - Summary of system priority and MAC address for all channel groups.
COMMAND LINE INTERFACE Table 4-46 show lacp counters - display description Field Description LACPDUs Sent Number of valid LACPDUs transmitted from this channel group. LACPDUs Received Number of valid LACPDUs received on this channel group. Marker Sent Number of valid Marker PDUs transmitted from this channel group. Marker Received Number of valid Marker PDUs received by this channel group.
LINK AGGREGATION COMMANDS Table 4-47 show lacp internal - display description Field Description Oper Key Current operational value of the key for the aggregation port. Admin Key Current administrative value of the key for the aggregation port. LACPDUs Internal Number of seconds before invalidating received LACPDU information. LACP System Priority LACP system priority assigned to this port channel. LACP Port Priority LACP port priority assigned to this interface within the channel group.
COMMAND LINE INTERFACE Table 4-47 show lacp internal - display description (Continued) Field Description Admin State, Administrative or operational values of the actor’s state parameters: Oper State • Expired – The actor’s receive machine is in the expired state. • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner. • Distributing – If false, distribution of outgoing frames on this link is disabled; i.e.
LINK AGGREGATION COMMANDS Console#show lacp 1 neighbors Port Channel 1 neighbors ------------------------------------------------------------------Eth 1/1 ------------------------------------------------------------------Partner Admin System ID : 32768, 00-00-00-00-00-00 Partner Oper System ID : 32768, 00-00-00-00-00-01 Partner Admin Port Number : 1 Partner Oper Port Number : 1 Port Admin Priority : 32768 Port Oper Priority : 32768 Admin Key : 0 Oper Key : 4 Admin State : defaulted, distributing, collecting
COMMAND LINE INTERFACE Table 4-48 show lacp neighbors - display description (Continued) Field Description Admin State Administrative values of the partner’s state parameters. (See preceding table.) Oper State Operational values of the partner’s state parameters. (See preceding table.
ADDRESS TABLE COMMANDS Table 4-50 Address Table Commands (Continued) Command Function Mode Page show mac-address-table Displays entries in the bridge-forwarding database PE 4-203 mac-address-table aging-time Sets the aging time of the address GC table 4-204 show mac-address-table aging-time 4-204 Shows the aging time for the address table PE mac-address-table static This command maps a static address to a destination port in a VLAN. Use the no form to remove an address.
COMMAND LINE INTERFACE Command Usage The static address for a host device can be assigned to a specific port within a specific VLAN. Use this command to add static addresses to the MAC Address Table. Static addresses have the following characteristics: • Static addresses will not be removed from the address table when a given interface link is down. • Static addresses are bound to the assigned interface and will not be moved.
ADDRESS TABLE COMMANDS show mac-address-table This command shows classes of entries in the bridge-forwarding database. Syntax show mac-address-table [address mac-address [mask]] [interface interface] [vlan vlan-id] [sort {address | vlan | interface}] • mac-address - MAC address. • mask - Bits to match in the address. • interface - ethernet unit/port - unit - This is device 1. - port - Port number.
COMMAND LINE INTERFACE Example Console#show mac-address-table Interface Mac Address Vlan --------- ----------------- ---Eth 1/ 1 00-00-00-00-00-17 1 Eth 1/ 2 00-E0-29-94-34-DE 1 Console# Type ----------------Learned Delete-on-reset mac-address-table aging-time This command sets the aging time for entries in the address table. Use the no form to restore the default aging time. Syntax mac-address-table aging-time seconds no mac-address-table aging-time seconds - Aging time.
SPANNING TREE COMMANDS Command Mode Privileged Exec Example Console#show mac-address-table aging-time Aging time: 300 sec. Console# Spanning Tree Commands This section includes commands that configure the Spanning Tree Algorithm (STA) globally for the switch, and commands that configure STA for the selected interface.
COMMAND LINE INTERFACE Table 4-51 Spanning Tree Commands (Continued) Command Function Mode Page name Configures the name for the multiple spanning tree MST 4-217 revision Configures the revision number for the MST multiple spanning tree 4-218 max-hops Configures the maximum number of hops allowed in the region before a BPDU is discarded 4-218 spanning-tree spanning-disabled Disables spanning tree for an interface IC 4-219 spanning-tree cost Configures the spanning tree path cost IC of an in
SPANNING TREE COMMANDS spanning-tree This command enables the Spanning Tree Algorithm globally for the switch. Use the no form to disable it. Syntax [no] spanning-tree Default Setting Spanning tree is enabled. Command Mode Global Configuration Command Usage The Spanning Tree Algorithm (STA) can be used to detect and disable network loops, and to provide backup links between switches, bridges or routers.
COMMAND LINE INTERFACE spanning-tree mode This command selects the spanning tree mode for this switch. Use the no form to restore the default. Syntax spanning-tree mode {stp | rstp | mstp} no spanning-tree mode • stp - Spanning Tree Protocol (IEEE 802.1D) • rstp - Rapid Spanning Tree Protocol (IEEE 802.1w) • mstp - Multiple Spanning Tree (IEEE 802.1s) Default Setting rstp Command Mode Global Configuration Command Usage • Spanning Tree Protocol Uses RSTP for the internal state machine, but sends only 802.
SPANNING TREE COMMANDS • Rapid Spanning Tree Protocol RSTP supports connections to either STP or RSTP nodes by monitoring the incoming protocol messages and dynamically adjusting the type of protocol messages the RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU after a port’s migration delay timer expires, the switch assumes that it is connected to an 802.1D bridge and starts using only 802.1D BPDUs. - RSTP Mode – If RSTP is using 802.
COMMAND LINE INTERFACE spanning-tree forward-time This command configures the spanning tree bridge forward time globally for this switch. Use the no form to restore the default. Syntax spanning-tree forward-time seconds no spanning-tree forward-time seconds - Time in seconds. (Range: 4 - 30 seconds) The minimum value is the higher of 4 or [(max-age / 2) +1].
SPANNING TREE COMMANDS spanning-tree hello-time This command configures the spanning tree bridge hello time globally for this switch. Use the no form to restore the default. Syntax spanning-tree hello-time time no spanning-tree hello-time time - Time in seconds. (Range: 1-10 seconds). The maximum value is the lower of 10 or [(max-age / 2) -1].
COMMAND LINE INTERFACE Command Mode Global Configuration Command Usage This command sets the maximum time (in seconds) a device can wait without receiving a configuration message before attempting to reconfigure. All device ports (except for designated ports) should receive configuration messages at regular intervals. Any port that ages out STA information (provided in the last configuration message) becomes the designated port for the attached LAN.
SPANNING TREE COMMANDS Command Usage Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device. Example Console(config)#spanning-tree priority 4096 Console(config)# spanning-tree pathcost method This command configures the path cost method used for Rapid Spanning Tree and Multiple Spanning Tree.
COMMAND LINE INTERFACE spanning-tree transmission-limit This command configures the minimum interval between the transmission of consecutive RSTP/MSTP BPDUs. Use the no form to restore the default. Syntax spanning-tree transmission-limit count no spanning-tree transmission-limit count - The transmission limit in seconds. (Range: 1-10) Default Setting 3 Command Mode Global Configuration Command Usage This command limits the maximum transmission rate for BPDUs.
SPANNING TREE COMMANDS Related Commands mst vlan (4 -215) mst priority (4 -216) name (4 -217) revision (4 -218) max-hops (4 -218) mst vlan This command adds VLANs to a spanning tree instance. Use the no form to remove the specified VLANs. Using the no form without any VLAN parameters to remove all VLANs. Syntax [no] mst instance_id vlan vlan-range • instance_id - Instance identifier of the spanning tree. (Range: 0-4094) • vlan-range - Range of VLANs.
COMMAND LINE INTERFACE Region (page 4-217) with the same set of instances, and the same instance (on each bridge) with the same set of VLANs. Also, note that RSTP treats each MSTI region as a single node, connecting all regions to the Common Spanning Tree. Example Console(config-mstp)#mst 1 vlan 2-5 Console(config-mstp)# mst priority This command configures the priority of a spanning tree instance. Use the no form to restore the default.
SPANNING TREE COMMANDS • You can set this switch to act as the MSTI root device by specifying a priority of 0, or as the MSTI alternate device by specifying a priority of 16384. Example Console(config-mstp)#mst 1 priority 4096 Console(config-mstp)# name This command configures the name for the multiple spanning tree region in which this switch is located. Use the no form to clear the name. Syntax name name name - Name of the spanning tree.
COMMAND LINE INTERFACE revision This command configures the revision number for this multiple spanning tree configuration of this switch. Use the no form to restore the default. Syntax revision number number - Revision number of the spanning tree. (Range: 0-65535) Default Setting 0 Command Mode MST Configuration Command Usage The MST region name (page 4-217) and revision number are used to designate a unique MST region. A bridge (i.e.
SPANNING TREE COMMANDS Default Setting 20 Command Mode MST Configuration Command Usage A MSTI region is treated as a single node by the STP and RSTP protocols. Therefore, the message age for BPDUs inside a MSTI region is never changed. However, each spanning tree instance within a region, and the internal spanning tree (IST) that connects these instances use a hop count to specify the maximum number of bridges that will propagate a BPDU.
COMMAND LINE INTERFACE Example This example disables the spanning tree algorithm for port 5. Console(config)#interface ethernet 1/5 Console(config-if)#spanning-tree spanning-disabled Console(config-if)# spanning-tree cost This command configures the spanning tree path cost for the specified interface. Use the no form to restore the default. Syntax spanning-tree cost cost no spanning-tree cost cost cost - The path cost for the port.
SPANNING TREE COMMANDS • When the spanning-tree pathcost method (page -213) is set to short, the maximum value for path cost is 65,535. Example Console(config)#interface ethernet 1/5 Console(config-if)#spanning-tree cost 50 Console(config-if)# spanning-tree port-priority This command configures the priority for the specified interface. Use the no form to restore the default. Syntax spanning-tree port-priority priority no spanning-tree port-priority priority priority - The priority for a port.
COMMAND LINE INTERFACE spanning-tree edge-port This command specifies an interface as an edge port. Use the no form to restore the default. Syntax [no] spanning-tree edge-port Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node.
SPANNING TREE COMMANDS spanning-tree portfast This command sets an interface to fast forwarding. Use the no form to disable fast forwarding. Syntax [no] spanning-tree portfast Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command is used to enable/disable the fast spanning-tree mode for the selected port. In this mode, ports skip the Discarding and Learning states, and proceed straight to Forwarding.
COMMAND LINE INTERFACE spanning-tree link-type This command configures the link type for Rapid Spanning Tree and Multiple Spanning Tree. Use the no form to restore the default. Syntax spanning-tree link-type {auto | point-to-point | shared} no spanning-tree link-type • auto - Automatically derived from the duplex mode setting. • point-to-point - Point-to-point link. • shared - Shared medium.
SPANNING TREE COMMANDS spanning-tree mst cost This command configures the path cost on a spanning instance in the Multiple Spanning Tree. Use the no form to restore the default. Syntax spanning-tree mst instance_id cost cost no spanning-tree mst instance_id cost • instance_id - Instance identifier of the spanning tree. (Range: 1-4094, no leading zeroes) • cost - Path cost for an interface.
COMMAND LINE INTERFACE Example Console(config)#interface ethernet ethernet 1/5 Console(config-if)#spanning-tree mst 1 cost 50 Console(config-if)# Related Commands spanning-tree mst port-priority (4 -226) spanning-tree mst port-priority This command configures the interface priority on a spanning instance in the Multiple Spanning Tree. Use the no form to restore the default.
SPANNING TREE COMMANDS Related Commands spanning-tree mst cost (4 -225) spanning-tree protocol-migration This command re-checks the appropriate BPDU format to send on the selected interface. Syntax spanning-tree protocol-migration interface • interface - ethernet unit/port - unit - This is device 1. - port - Port number.
COMMAND LINE INTERFACE show spanning-tree This command shows the configuration for the common spanning tree (CST) or for an instance within the multiple spanning tree (MST). Syntax show spanning-tree [interface | mst instance_id] • interface - ethernet unit/port - unit - This is device 1. - port - Port number. - port-channel channel-id (Range: 1-6) • instance_id - Instance identifier of the multiple spanning tree.
SPANNING TREE COMMANDS Example Console#show spanning-tree Spanning-tree information --------------------------------------------------------------Spanning-tree information --------------------------------------------------------------Spanning tree mode :MSTP Spanning tree enable/disable :enable Instance :0 Vlans configuration :1-4094 Priority :32768 Bridge Hello Time (sec.) :2 Bridge Max Age (sec.) :20 Bridge Forward Delay (sec.) :15 Root Hello Time (sec.) :2 Root Max Age (sec.) :20 Root Forward Delay (sec.
COMMAND LINE INTERFACE show spanning-tree mst configuration This command shows the multiple spanning tree configuration.
VLAN COMMANDS VLAN Commands A VLAN is a group of ports that can be located anywhere in the network, but communicate as though they belong to the same physical segment. This section describes commands used to create VLAN groups, add port members, specify how VLAN tagging is used, and enable automatic VLAN registration for the selected interface.
COMMAND LINE INTERFACE vlan database This command enters VLAN database mode. All commands in this mode will take effect immediately. Default Setting None Command Mode Global Configuration Command Usage • Use the VLAN database command mode to add, change, and delete VLANs. After finishing configuration changes, you can display the VLAN settings by entering the show vlan command. • Use the interface vlan command mode to define the port membership mode and add or remove ports from a VLAN.
VLAN COMMANDS vlan This command configures a VLAN. Use the no form to restore the default settings or delete a VLAN. Syntax vlan vlan-id [name vlan-name] media ethernet [state {active | suspend}] no vlan vlan-id [name | state] • vlan-id - ID of configured VLAN. (Range: 1-4094, no leading zeroes) • name - Keyword to be followed by the VLAN name. - vlan-name - ASCII string from 1 to 32 characters. • media ethernet - Ethernet media type. • state - Keyword to be followed by the VLAN state.
COMMAND LINE INTERFACE Related Commands show vlan (4 -241) Configuring VLAN Interfaces Table 4-54 Configuring VLAN Interfaces Command Function interface vlan Enters interface configuration mode for IC a specified VLAN Mode Page 4-234 switchport mode Configures VLAN membership mode for an interface IC 4-235 switchport Configures frame types to be accepted acceptable-frame-types by an interface IC 4-236 switchport ingress-filtering Enables ingress filtering on an interface IC 4-237 switchport
VLAN COMMANDS Command Mode Global Configuration Example The following example shows how to set the interface configuration mode to VLAN 1, and then assign an IP address to the VLAN: Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.254 255.255.255.0 Console(config-if)# Related Commands shutdown (4 -174) switchport mode This command configures the VLAN membership mode for a port. Use the no form to restore the default.
COMMAND LINE INTERFACE Example The following shows how to set the configuration mode to port 1, and then set the switchport mode to hybrid: Console(config)#interface ethernet 1/1 Console(config-if)#switchport mode hybrid Console(config-if)# Related Commands switchport acceptable-frame-types (4 -236) switchport acceptable-frame-types This command configures the acceptable frame types for a port. Use the no form to restore the default.
VLAN COMMANDS Related Commands switchport mode (4 -235) switchport ingress-filtering This command enables ingress filtering for an interface. Use the no form to restore the default. Syntax [no] switchport ingress-filtering Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Ingress filtering only affects tagged frames.
COMMAND LINE INTERFACE switchport native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no form to restore the default. Syntax switchport native vlan vlan-id no switchport native vlan vlan-id - Default VLAN ID for a port.
VLAN COMMANDS switchport allowed vlan This command configures VLAN groups on the selected interface. Use the no form to restore the default. Syntax switchport allowed vlan {add vlan-list [tagged | untagged] | remove vlan-list} no switchport allowed vlan • add vlan-list - List of VLAN identifiers to add. • remove vlan-list - List of VLAN identifiers to remove. • vlan-list - Separate nonconsecutive VLAN identifiers with a comma and no spaces; use a hyphen to designate a range of IDs.
COMMAND LINE INTERFACE • If a VLAN on the forbidden list for an interface is manually added to that interface, the VLAN is automatically removed from the forbidden list for that interface. Example The following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as tagged VLANs for port 1. Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 1,2,5,6 tagged Console(config-if)# switchport forbidden vlan This command configures forbidden VLANs.
VLAN COMMANDS Example The following example shows how to prevent port 1 from being added to VLAN 3.
COMMAND LINE INTERFACE Example The following example shows how to display information for VLAN 1. Console#show VLAN Type ---- ------1 Static vlan id 1 Name Status Ports/Channel groups --------------- --------- ---------------------------------DefaultVlan Active Eth1/ 1 Eth1/ 2 Eth1/ 3 Eth1/ 4 Eth1/5 Eth1/ 6 Eth1/ 7 Eth1/ 8 Eth1/ 9 Eth1/10 Eth1/11 Eth1/12 Console# Configuring Protocol-based VLANs The network devices required to support multiple protocols cannot be easily grouped into a common VLAN.
VLAN COMMANDS To configure protocol-based VLANs, follow these steps: 1. First configure VLAN groups for the protocols you want to use (page -233). Although not mandatory, we suggest configuring a separate VLAN for each major protocol running on your network. Do not add port members at this time. 2. Create a protocol group for each of the protocols you want to assign to a VLAN using the protocol-vlan protocol-group command (General Configuration mode). 3.
COMMAND LINE INTERFACE Example The following creates protocol group 1, and specifies Ethernet frames with IP and ARP protocol types. Console(config)#protocol-vlan protocol-group 1 add frame_type ethernet protocol-type ip Console(config)#protocol-vlan protocol-group 1 add frame_type ethernet protocol-type arp Console(config)# protocol-vlan protocol-group (Configuring Interfaces) This command maps a protocol group to a VLAN for the current interface.
VLAN COMMANDS • When a frame enters a port that has been assigned to a protocol VLAN, it is processed in the following manner: - If the frame is tagged, it will be processed according to the standard rules applied to tagged frames. - If the frame is untagged and the protocol type matches, the frame is forwarded to the appropriate VLAN. - If the frame is untagged but the protocol type does not match, the frame is forwarded to the default VLAN for this interface.
COMMAND LINE INTERFACE Example This shows protocol group 1 configured for IP over Ethernet. Console#show protocol-vlan protocol-group ProtocolGroup ID Frame Type Protocol Type ------------------ ------------- --------------1 ethernet 08 00 Console# show interfaces protocol-vlan protocol-group This command shows the mapping from protocol groups to VLANs for the selected interfaces. Syntax show interfaces protocol-vlan protocol-group [interface] • interface - ethernet unit/port - unit - This is device 1.
VLAN COMMANDS Configuring Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN. This section describes commands used to configure private VlANs. Table 4-57 Private VLAN Commands Command Function Mode Page pvlan Enables and configured private VLANS GC 4-247 show pvlan Displays the configured private VLANS PE 4-248 pvlan This command enables or configures a private VLAN. Use the no form to disable the private VLAN.
COMMAND LINE INTERFACE Example This example enables the private VLAN, and then sets port 12 as the uplink and ports 5-8 as the downlinks. Console(config)#pvlan Console(config)#pvlan up-link ethernet 1/12 down-link ethernet 1/5-8 Console(config)# show pvlan This command displays the configured private VLAN.
GVRP AND BRIDGE EXTENSION COMMANDS GVRP and Bridge Extension Commands GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network. This section describes how to enable GVRP for individual interfaces and globally for the switch, as well as how to display default configuration settings for the Bridge Extension MIB.
COMMAND LINE INTERFACE Command Mode Global Configuration Command Usage GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. This function should be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. Example Console(config)#bridge-ext gvrp Console(config)# show bridge-ext This command shows the configuration for bridge extension commands.
GVRP AND BRIDGE EXTENSION COMMANDS switchport gvrp This command enables GVRP for a port. Use the no form to disable it. Syntax [no] switchport gvrp Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Example Console(config)#interface ethernet 1/1 Console(config-if)#switchport gvrp Console(config-if)# show gvrp configuration This command shows if GVRP is enabled. Syntax show gvrp configuration [interface] interface • ethernet unit/port - unit - This is device 1.
COMMAND LINE INTERFACE garp timer This command sets the values for the join, leave and leaveall timers. Use the no form to restore the timers’ default values. Syntax garp timer {join | leave | leaveall} timer_value no garp timer {join | leave | leaveall} • {join | leave | leaveall} - Which timer to set. • timer_value - Value of timer.
GVRP AND BRIDGE EXTENSION COMMANDS Example Console(config)#interface ethernet 1/1 Console(config-if)#garp timer join 100 Console(config-if)# Related Commands show garp timer (4 -253) show garp timer This command shows the GARP timers for the selected interface. Syntax show garp timer [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) Default Setting Shows all GARP timers.
COMMAND LINE INTERFACE Priority Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with eight priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.
PRIORITY COMMANDS Priority Commands (Layer 2) Table 4-60 Priority Commands (Layer 2) Command Function switchport priority default Sets a port priority for incoming untagged IC frames Mode Page 4-255 queue mode Sets the queue mode to strict priority or Weighted Round-Robin (WRR) GC 4-257 queue bandwidth Assigns round-robin weights to the priority queues GC 4-258 queue cos map Assigns class-of-service values to the priority queues IC 4-259 show queue mode Shows the current queue mode PE 4-
COMMAND LINE INTERFACE Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • The default priority applies for an untagged frame received on a port set to accept all frame types (i.e, receives both untagged and tagged frames). This priority does not apply to IEEE 802.1Q VLAN tagged frames. If the incoming frame is an IEEE 802.1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used.
PRIORITY COMMANDS queue mode This command sets the queue mode to strict priority or Weighted Round-Robin (WRR) for the class of service (CoS) priority queues. Use the no form to restore the default value. Syntax queue mode {strict | wrr} no queue mode • strict - Services the egress queues in sequential order, transmitting all traffic in the higher priority queues before servicing lower priority queues.
COMMAND LINE INTERFACE queue bandwidth This command assigns weighted round-robin (WRR) weights to the eight class of service (CoS) priority queues. Use the no form to restore the default weights. Syntax queue bandwidth weight1...weight8 no queue bandwidth weight1...weight8 - The ratio of weights for queues 0 - 7 determines the weights used by the WRR scheduler. (Range: 1 - 15) Default Setting Weights 1, 2, 4, 6, 8, 10, 12, 14 are assigned to queues 0 - 7 respectively.
PRIORITY COMMANDS queue cos-map This command assigns class of service (CoS) values to the priority queues (i.e., hardware output queues 0 - 7). Use the no form set the CoS map to the default values. Syntax queue cos-map queue_id [cos1 ... cosn] no queue cos-map • queue_id - The ID of the priority queue. Ranges are 0 to 7, where 7 is the highest priority queue. • cos1 .. cosn - The CoS values that are mapped to the queue ID. It is a space-separated list of numbers.
COMMAND LINE INTERFACE Example The following example shows how to change the CoS assignments to a one-to-one mapping.
PRIORITY COMMANDS Command Mode Privileged Exec Example Console#show queue bandwidth Information of Eth 1/1 Queue ID Weight -------- -----0 1 1 2 2 4 3 6 4 8 5 10 6 12 7 14 . . . Console# show queue cos-map This command shows the class of service priority map. Syntax show queue cos-map [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number.
COMMAND LINE INTERFACE Example Console#show queue Information of Eth CoS Value : 0 Priority Queue: 2 Console# cos-map ethernet 1/1 1/1 1 2 3 4 5 6 7 0 1 3 4 5 6 7 Priority Commands (Layer 3 and 4) Table 4-62 Priority Commands (Layer 3 and 4) Command Function Mode Page map ip port Enables TCP/UDP class of service mapping GC 4-262 map ip port Maps TCP/UDP socket to a class of service IC 4-263 map ip precedence Enables IP precedence class of service mapping GC 4-264 map ip precedence Maps IP
PRIORITY COMMANDS Command Mode Global Configuration Command Usage The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. Example The following example shows how to enable TCP/UDP port mapping globally: Console(config)#map ip port Console(config)# map ip port (Interface Configuration) Use this command to set IP port priority (i.e., TCP/UDP port priority). Use the no form to remove a specific setting.
COMMAND LINE INTERFACE Example The following example shows how to map HTTP traffic to CoS value 0: Console(config)#interface ethernet 1/5 Console(config-if)#map ip port 80 cos 0 Console(config-if)# map ip precedence (Global Configuration) This command enables IP precedence mapping (i.e., IP Type of Service). Use the no form to disable IP precedence mapping.
PRIORITY COMMANDS map ip precedence (Interface Configuration) This command sets IP precedence priority (i.e., IP Type of Service priority). Use the no form to restore the default table. Syntax map ip precedence ip-precedence-value cos cos-value no map ip precedence • precedence-value - 3-bit precedence value. (Range: 0-7) • cos-value - Class-of-Service value (Range: 0-7) Default Setting The list below shows the default priority mapping.
COMMAND LINE INTERFACE map ip dscp (Global Configuration) This command enables IP DSCP mapping (i.e., Differentiated Services Code Point mapping). Use the no form to disable IP DSCP mapping. Syntax [no] map ip dscp Default Setting Disabled Command Mode Global Configuration Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • IP Precedence and IP DSCP cannot both be enabled.
PRIORITY COMMANDS Default Setting The DSCP default values are defined in the following table. Note that all the DSCP values that are not specified are mapped to CoS value 0.
COMMAND LINE INTERFACE show map ip port Use this command to show the IP port priority map. Syntax show map ip port [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) Default Setting None Command Mode Privileged Exec Example The following shows that HTTP traffic has been mapped to CoS value 0: Console#show map ip port TCP port mapping status: disabled Port Port no. COS --------- -------- --Eth 1/ 1 80 0 Eth 1/ 2 80 0 . . .
PRIORITY COMMANDS show map ip precedence This command shows the IP precedence priority map. Syntax show map ip precedence [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number.
COMMAND LINE INTERFACE show map ip dscp This command shows the IP DSCP priority map. Syntax show map ip dscp [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) Default Setting None Command Mode Privileged Exec Example Console#show map ip dscp ethernet 1/1 DSCP mapping status: disabled Port DSCP COS --------- ---- --Eth 1/ 1 0 0 Eth 1/ 1 1 0 Eth 1/ 1 2 0 Eth 1/ 1 3 0 . . .
MULTICAST FILTERING COMMANDS Multicast Filtering Commands This switch uses IGMP (Internet Group Management Protocol) to query for any attached hosts that want to receive a specific multicast service. It identifies the ports containing hosts requesting a service and sends data out to those ports only. It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service.
COMMAND LINE INTERFACE ip igmp snooping This command enables IGMP snooping on this switch. Use the no form to disable it. Syntax [no] ip igmp snooping Default Setting Enabled Command Mode Global Configuration Example The following example enables IGMP snooping. Console(config)#ip igmp snooping Console(config)# ip igmp snooping vlan static This command adds a port to a multicast group. Use the no form to remove the port.
MULTICAST FILTERING COMMANDS Command Mode Global Configuration Example The following shows how to statically configure a multicast group on a port. Console(config)#ip igmp snooping vlan 1 static 224.0.0.12 ethernet 1/5 Console(config)# ip igmp snooping version This command configures the IGMP snooping version. Use the no form to restore the default.
COMMAND LINE INTERFACE show ip igmp snooping This command shows the IGMP snooping configuration. Default Setting None Command Mode Privileged Exec Command Usage See “Configuring IGMP Snooping and Query Parameters” on page 3-183 for a description of the displayed items.
MULTICAST FILTERING COMMANDS Command Mode Privileged Exec Command Usage Member types displayed include IGMP or USER, depending on selected options. Example The following shows the multicast entries learned through IGMP snooping for VLAN 1: Console#show mac-address-table multicast vlan 1 igmp-snooping VLAN M'cast IP addr. Member ports Type ---- --------------- ------------ ------1 224.1.2.
COMMAND LINE INTERFACE ip igmp snooping querier This command enables the switch as an IGMP querier. Use the no form to disable it. Syntax [no] ip igmp snooping querier Default Setting Enabled Command Mode Global Configuration Command Usage If enabled, the switch will serve as querier if elected. The querier is responsible for asking hosts if they want to receive multicast traffic.
MULTICAST FILTERING COMMANDS Command Usage The query count defines how long the querier waits for a response from a multicast client before taking action. If a querier has sent a number of queries defined by this command, but a client has not responded, a countdown timer is started using the time defined by ip igmp snooping query-max- response-time. If the countdown finishes, and the client still has not responded, then that client is considered to have left the multicast group.
COMMAND LINE INTERFACE Example The following shows how to configure the query interval to 100 seconds. Console(config)#ip igmp snooping query-interval 100 Console(config)# ip igmp snooping query-max-response-time This command configures the query report delay. Use the no form to restore the default. Syntax ip igmp snooping query-max-response-time seconds no ip igmp snooping query-max-response-time seconds - The report delay advertised in IGMP queries.
MULTICAST FILTERING COMMANDS Related Commands ip igmp snooping version (4 -273) ip igmp snooping query-max-response-time (4 -278) ip igmp snooping router-port-expire-time This command configures the query timeout. Use the no form to restore the default. Syntax ip igmp snooping router-port-expire-time seconds no ip igmp snooping router-port-expire-time seconds - The time the switch waits after the previous querier stops before it considers the router port (i.e.
COMMAND LINE INTERFACE Static Multicast Routing Commands Table 4-68 Static Multicast Routing Commands Command Function Mode Page ip igmp snooping vlan mrouter Adds a multicast router port GC 4-280 show ip igmp snooping Shows multicast router ports mrouter PE 4-281 ip igmp snooping vlan mrouter This command statically configures a multicast router port. Use the no form to remove the configuration.
MULTICAST FILTERING COMMANDS Example The following shows how to configure port 11 as a multicast router port within VLAN 1: Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11 Console(config)# show ip igmp snooping mrouter This command displays information on statically configured and dynamically learned multicast router ports. Syntax show ip igmp snooping mrouter [vlan vlan-id] vlan-id - VLAN ID (Range: 1-4094) Default Setting Displays multicast router ports for all configured VLANs.
COMMAND LINE INTERFACE IP Interface Commands An IP addresses may be used for management access to the switch over your network. The IP address for this switch is obtained via DHCP by default. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server when it is powered on. You may also need to a establish a default gateway between this device and management stations or other devices that exist on another network segment.
IP INTERFACE COMMANDS ip address This command sets the IP address for the currently selected VLAN interface. Use the no form to restore the default IP address. Syntax ip address {ip-address netmask | bootp | dhcp} no ip address • ip-address - IP address • netmask - Network mask for the associated IP subnet. This mask identifies the host address bits used for routing to specific subnets. • bootp - Obtains IP address from BOOTP. • dhcp - Obtains IP address from DHCP.
COMMAND LINE INTERFACE Example In the following example, the device is assigned an address in VLAN 1. Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.5 255.255.255.0 Console(config-if)# Related Commands ip dhcp restart (4 -284) ip dhcp restart This command submits a BOOTP or DHCP client request.
IP INTERFACE COMMANDS Related Commands ip address (4 -283) ip default-gateway This command establishes a static route between this switch and devices that exist on another network segment. Use the no form to remove the static route. Syntax ip default-gateway gateway no ip default-gateway gateway - IP address of the default gateway Default Setting No static route is established.
COMMAND LINE INTERFACE Command Mode Privileged Exec Example Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: User specified. Console# Related Commands show ip redirects (4 -286) show ip redirects This command shows the default gateway configured for this device. Default Setting None Command Mode Privileged Exec Example Console#show ip redirects IP default gateway 10.1.0.
IP INTERFACE COMMANDS ping This command sends ICMP echo request packets to another node on the network. Syntax ping host [size size] [count count] • host - IP address or IP alias of the host. • count - Number of packets to send. (Range: 1-16, default: 5) • size - Number of bytes in a packet. (Range: 32-512, default: 32) The actual packet size will be eight bytes larger than the size specified because the switch adds header information. Default Setting This command has no default for the host.
COMMAND LINE INTERFACE Example Console#ping 10.1.0.9 Type ESC to abort. PING to 10.1.0.9, by 5 32-byte payload ICMP packets, timeout is 5 seconds response time: 10 ms response time: 10 ms response time: 10 ms response time: 10 ms response time: 0 ms Ping statistics for 10.1.0.
APPENDIX A SOFTWARE SPECIFICATIONS Software Features Authentication Local, RADIUS, TACACS, Port (802.1X), HTTPS, SSH, Port Security Access Control Lists IP, MAC (up to 32 lists) DHCP Client Port Configuration 10/100/1000BASE-T Ports 1-12 10/100 Mbps, half/full duplex 1000 Mbps, full duplex SFP Ports 9-12 1000BASE-X: 1000 Mbps, full duplex Flow Control Full Duplex: IEEE 802.
SOFTWARE SPECIFICATIONS Port Trunking Static trunks (Cisco EtherChannel compliant) Dynamic trunks (Link Aggregation Control Protocol) Spanning Tree Protocol Spanning Tree Protocol (STP, IEEE 802.1D) Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s) VLAN Support Up to 255 groups; port-based, protocol-based, or tagged (802.
SOFTWARE SPECIFICATIONS Software Loading TFTP in-band or XModem out-of-band SNMP Management access via MIB database Trap management to specified hosts RMON Groups 1, 2, 3, 9 (Statistics, History, Alarm, Event) Standards IEEE 802.1D Spanning Tree Protocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1v Protocol-based VLANs IEEE 802.1s Multiple Spanning Tree Protocol IEEE 802.1w Rapid Spanning Tree Protocol IEEE 802.1X Port Authentication IEEE 802.3 Ethernet, IEEE 802.
SOFTWARE SPECIFICATIONS SNMPv2 (RFC 1907) SNTP (RFC 2030) SSH (Version 2.0) TFTP (RFC 1350) Management Information Bases Bridge MIB (RFC 1493) Entity MIB (RFC 2737) Ethernet MIB (RFC 2665) Ether-like MIB (RFC 1643) Extended Bridge MIB (RFC 2674) Extensible SNMP Agents MIB (RFC 2742) Forwarding Table MIB (RFC 2096) IGMP MIB (RFC 2933) Interface Group MIB (RFC 2233) Interfaces Evolution MIB (RFC 2863) IP Multicasting related MIBs MAU MIB (RFC 2668) MIB II (RFC 1213) Port Access Entity MIB (IEEE 802.
APPENDIX B TROUBLESHOOTING Table B-1 Troubleshooting Chart Symptom Action Cannot connect using Telnet, Web browser, or SNMP software • Ensure that you have configured the agent with a valid IP address, subnet mask and default gateway. • If you are trying to connect to the agent via the IP address for a tagged VLAN group, your management station must include the appropriate tag in its transmitted frames.
TROUBLESHOOTING B-2
GLOSSARY Access Control List (ACL) ACLs can limit network traffic and restrict access to certain users or devices by checking each packet for certain IP or MAC (i.e., Layer 2) information. Boot Protocol (BOOTP) BOOTP is used to provide bootup information for network devices, including IP address information, the address of the TFTP server that contains the devices system files, and the name of the boot file.
GLOSSARY Extensible Authentication Protocol over LAN (EAPOL) EAPOL is a client authentication protocol used by this switch to verify the network access rights for any device that is plugged into the switch. A user name and password is requested by the switch, and then passed to an authentication server (e.g., RADIUS) for verification. EAPOL is implemented as part of the IEEE 802.1X Port Authentication standard.
GLOSSARY IEEE 802.1Q VLAN Tagging—Defines Ethernet frame tags which carry VLAN information. It allows switches to assign endstations to different virtual LANs, and defines a standard way for VLANs to communicate across switched networks. IEEE 802.1p An IEEE standard for providing quality of service (QoS) in Ethernet networks. The standard uses packet tags that define up to eight traffic classes and allows switches to transmit packets based on the tagged priority value. IEEE 802.
GLOSSARY IGMP Query On each subnetwork, one IGMP-capable device will act as the querier — that is, the device that asks all hosts to report on the IP multicast groups they wish to join or to which they already belong. The elected querier will be the device with the lowest IP address in the subnetwork. Internet Group Management Protocol (IGMP) A protocol through which hosts can register with their local router for multicast services.
GLOSSARY Link Aggregation See Port Trunk. Link Aggregation Control Protocol (LACP) Allows ports to automatically negotiate a trunked link with LACP-configured ports on another device. Management Information Base (MIB) An acronym for Management Information Base. It is a set of database objects that contains information about a specific device.
GLOSSARY Port Trunk Defines a network link aggregation and trunking method which specifies how to create a single high-speed logical link that combines several lower-speed physical links. Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN. Data traffic on downlink ports can only be forwarded to, and from, uplink ports.
GLOSSARY Simple Network Management Protocol (SNMP) The application protocol in the Internet suite of protocols which offers network management services. Simple Network Time Protocol (SNTP) SNTP allows a device to set its internal clock based on periodic updates from a Network Time Protocol (NTP) server. Updates can be requested from a specific NTP server, or can be received via broadcasts sent by NTP servers. Spanning Tree Protocol (STP) A technology that checks your network for any loops.
GLOSSARY User Datagram Protocol (UDP) UDP provides a datagram mode for packet-switched communications. It uses IP as the underlying transport mechanism to provide access to IP-like services. UDP packets are delivered just like IP packets – connection-less datagrams that may be discarded before reaching their targets. UDP is useful when TCP would be too complex, too slow, or just unnecessary.
INDEX Numerics 802.
INDEX E edge port, STA 3-130, 3-133, 4-222 event logging 4-58 F firmware displaying version 3-14, 4-83 upgrading 3-22, 4-86 G GARP VLAN Registration Protocol See GVRP gateway, default 3-18, 4-285 GVRP global setting 3-147, 4-249 interface configuration 3-157, 4-251 H hardware version, displaying 3-14, 4-83 HTTPS 3-38, 4-42 HTTPS, secure server 3-38, 4-42 I IEEE 802.1D 3-116, 4-208 IEEE 802.1s 4-208 IEEE 802.1w 3-116, 4-208 IEEE 802.
INDEX multicast groups 3-188, 4-274 displaying 4-274 static 3-188, 4-272, 4-274 multicast services configuring 3-189, 4-272 displaying 3-188, 4-274 multicast, static router port 3-187, 4-280 P password, line 4-17 passwords 2-5 administrator setting 3-33, 4-35 path cost 3-119, 3-129 method 3-125, 4-213 STA 3-119, 3-129, 4-213 port authentication 4-104 port priority configuring 3-164, 4-254 default ingress 3-164, 4-255 STA 3-129, 4-221 port security, configuring 3-48, 4-102 port, statistics 3-106, 4-178 port
INDEX STA 3-116, 4-205 edge port 3-130, 3-133, 4-222 global settings, configuring 3-122, 4-207–4-214 global settings, displaying 3-118, 4-228 interface settings 3-127, 3-138, 3-140, 4-220–4-227, 4-228 link type 3-130, 3-133, 4-224 path cost 3-119, 3-129, 4-220 path cost method 3-125, 4-213 port priority 3-129, 4-221 protocol migration 3-134, 4-227 transmission limit 3-125, 4-214 standards, IEEE A-3 startup files creating 3-25, 4-86 displaying 3-22, 4-77 setting 3-22, 4-92 static addresses, setting 3-112, 4-
FOR TECHNICAL SUPPORT, CALL: From U.S.A. and Canada (24 hours a day, 7 days a week) (800) SMC-4-YOU; Phn: (949) 679-8000; Fax: (949) 679-1481 From Europe: Contact details can be found on www.smc-europe.com or www.smc.com INTERNET E-mail addresses: techsupport@smc.com european.techsupport@smc-europe.com Driver updates: http://www.smc.com/index.cfm?action=tech_support_drivers_downloads World Wide Web: http://www.smc.com http://www.smc-europe.com FOR LITERATURE OR ADVERTISING RESPONSE, CALL: U.S.A.
