TigerStack 10G Gigabit Ethernet Switch ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ ◆ 24/48 auto-MDI/MDI-X 10/100/1000BASE-T ports 4 ports shared with 4 SFP transceiver slots Non-blocking switching architecture Support for a redundant power unit Spanning Tree Protocol, RSTP, and MSTP Up to 32 LACP or static 8-port trunks Layer 2/3/4 CoS support through eight priority queues Layer 3/4 traffic priority with IP Precedence and IP DSCP Full support for VLANs with GVRP IGMP multicast filtering and snooping Support for jumbo frames up
TigerStack 10G Management Guide From SMC’s Tiger line of feature-rich workgroup LAN solutions 38 Tesla Irvine, CA 92618 Phone: (949) 679-8000 October 2004 Pub.
Information furnished by SMC Networks, Inc. (SMC) is believed to be accurate and reliable. However, no responsibility is assumed by SMC for its use, nor for any infringements of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent or patent rights of SMC. SMC reserves the right to change specifications at any time without notice. Copyright © 2004 by SMC Networks, Inc. 38 Tesla Irvine, CA 92618 All rights reserved.
LIMITED WARRANTY Limited Warranty Statement: SMC Networks, Inc. (“SMC”) warrants its products to be free from defects in workmanship and materials, under normal use and service, for the applicable warranty term. All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized Reseller. SMC may, at its own discretion, repair or replace any product not operating as warranted with a similar or functionally equivalent product, during the applicable warranty term.
LIMITED WARRANTY WARRANTIES EXCLUSIVE: IF AN SMC PRODUCT DOES NOT OPERATE AS WARRANTED ABOVE, CUSTOMER’S SOLE REMEDY SHALL BE REPAIR OR REPLACEMENT OF THE PRODUCT IN QUESTION, AT SMC’S OPTION. THE FOREGOING WARRANTIES AND REMEDIES ARE EXCLUSIVE AND ARE IN LIEU OF ALL OTHER WARRANTIES OR CONDITIONS, EXPRESS OR IMPLIED, EITHER IN FACT OR BY OPERATION OF LAW, STATUTORY OR OTHERWISE, INCLUDING WARRANTIES OR CONDITIONS OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
LIMITED WARRANTY iv
CONTENTS 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-1 Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Description of Software Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 System Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7 2 Initial Configuration . . . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Panel Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Main Menu . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-5 Basic Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-12 Displaying System Information . . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS Configuring Local/Remote Logon Authentication . . . . . . . . . 3-60 Configuring HTTPS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-65 Replacing the Default Secure-site Certificate . . . . . . . . . . . 3-66 Configuring the Secure Shell . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-67 Generating the Host Key Pair . . . . . . . . . . . . . . . . . . . . . . 3-70 Configuring the SSH Server . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS Configuring Rate Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Showing Port Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Address Table Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting Static Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Displaying the Address Table . . . . . . . . . . . . . . . . . . . . . . . . . Changing the Aging Time . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS Selecting IP Precedence/DSCP Priority . . . . . . . . . . . . . 3-193 Mapping IP Precedence . . . . . . . . . . . . . . . . . . . . . . . . . . 3-193 Mapping DSCP Priority . . . . . . . . . . . . . . . . . . . . . . . . . . 3-195 Mapping IP Port Priority . . . . . . . . . . . . . . . . . . . . . . . . . 3-197 Mapping CoS Values to ACLs . . . . . . . . . . . . . . . . . . . . . 3-199 Multicast Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . timeout login response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . exec-timeout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . password-thresh . . . . . .
CONTENTS ip http secure-port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-42 Telnet Server Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-43 ip telnet server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-43 ip telnet server port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-44 Secure Shell Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-44 ip ssh server . . . . . . . . . . . . . . . . . . . . .
CONTENTS clock timezone . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-73 calendar set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-74 show calendar . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-75 System Status Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-76 show startup-config . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-76 show running-config . . . . . . . . . . . . . . . . . . . . . .
CONTENTS dot1x default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-105 dot1x max-req . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-106 dot1x port-control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-106 dot1x operation-mode . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-107 dot1x re-authenticate . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-108 dot1x re-authentication . . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS ACL Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . show access-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . show access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . SNMP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . snmp-server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . show snmp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
CONTENTS media-type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-179 shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-180 switchport broadcast packet-rate . . . . . . . . . . . . . . . . . . . . . . . 4-181 clear counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-182 show interfaces status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-183 show interfaces counters . . .
CONTENTS mst priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . revision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . max-hops . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . spanning-tree spanning-disabled . . . . . . . . . . . . . . . . . . . . . . . spanning-tree cost . . . . . . . . . . . . . . .
CONTENTS GVRP and Bridge Extension Commands . . . . . . . . . . . . . . . . . . . . . 4-254 bridge-ext gvrp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-254 show bridge-ext . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-255 switchport gvrp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-256 show gvrp configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-256 garp timer . . . . . . . . . . . . . . . .
CONTENTS ip igmp snooping query-max-response-time . . . . . . . . . . ip igmp snooping router-port-expire-time . . . . . . . . . . . . Static Multicast Routing Commands . . . . . . . . . . . . . . . . . . . . ip igmp snooping vlan mrouter . . . . . . . . . . . . . . . . . . . . show ip igmp snooping mrouter . . . . . . . . . . . . . . . . . . . IP Interface Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Basic IP Configuration . . . . . . . . . . . . . . . . . . . . . . . .
TABLES Table 1-1 Table 1-2 Table 3-1 Table 3-2 Table 3-3 Table 3-4 Table 3-5 Table 3-6 Table 3-7 Table 3-8 Table 3-9 Table 3-10 Table 3-11 Table 3-12 Table 3-13 Table 3-14 Table 3-15 Table 4-1 Table 4-2 Table 4-3 Table 4-4 Table 4-5 Table 4-6 Table 4-7 Table 4-8 Table 4-9 Table 4-10 Table 4-11 Table 4-12 Table 4-13 Table 4-14 Table 4-15 Table 4-16 xvii Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 System Defaults . . . . . . . . . . . . . . . . . . . . . . . . . .
TABLES Table 4-17 Table 4-18 Table 4-19 Table 4-20 Table 4-21 Table 4-22 Table 4-23 Table 4-24 Table 4-25 Table 4-26 Table 4-27 Table 4-28 Table 4-29 Table 4-30 Table 4-31 Table 4-32 Table 4-33 Table 4-34 Table 4-35 Table 4-36 Table 4-37 Table 4-38 Table 4-39 Table 4-40 Table 4-41 Table 4-42 Table 4-43 Table 4-44 Table 4-45 Table 4-46 Table 4-47 Table 4-48 Table 4-49 Table 4-50 Table 4-51 Table 4-52 Table 4-53 xviii Event Logging Commands . . . . . . . . . . . . . . . . . . . . . . . 4-56 Logging Levels .
TABLES Table 4-54 Table 4-55 Table 4-56 Table 4-57 Table 4-58 Table 4-59 Table 4-60 Table 4-61 Table 4-62 Table 4-63 Table 4-64 Table 4-65 Table 4-66 Table 4-67 Table 4-68 Table 4-69 Table 4-70 Table 4-71 Table 4-72 Table 4-73 Table B-1 Address Table Commands . . . . . . . . . . . . . . . . . . . . . . 4-206 Spanning Tree Commands . . . . . . . . . . . . . . . . . . . . . . 4-210 VLAN Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-235 Editing VLAN Groups . . . . . . . . . . . . . . .
FIGURES Figure 3-1 Figure 3-2 Figure 3-3 Figure 3-4 Figure 3-5 Figure 3-6 Figure 3-7 Figure 3-8 Figure 3-9 Figure 3-10 Figure 3-11 Figure 3-12 Figure 3-13 Figure 3-14 Figure 3-15 Figure 3-16 Figure 3-17 Figure 3-18 Figure 3-19 Figure 3-20 Figure 3-21 Figure 3-22 Figure 3-23 Figure 3-24 Figure 3-25 Figure 3-26 Figure 3-27 Figure 3-28 Figure 3-29 Figure 3-30 Figure 3-31 Figure 3-32 Figure 3-33 xx Home Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 Panel Display . . . . . .
FIGURES Figure 3-34 Figure 3-35 Figure 3-36 Figure 3-37 Figure 3-38 Figure 3-39 Figure 3-40 Figure 3-41 Figure 3-42 Figure 3-43 Figure 3-44 Figure 3-45 Figure 3-46 Figure 3-47 Figure 3-48 Figure 3-49 Figure 3-50 Figure 3-51 Figure 3-52 Figure 3-53 Figure 3-54 Figure 3-55 Figure 3-56 Figure 3-57 Figure 3-58 Figure 3-59 Figure 3-60 Figure 3-61 Figure 3-62 Figure 3-63 Figure 3-64 Figure 3-65 Figure 3-66 Figure 3-67 Figure 3-68 Figure 3-69 Figure 3-70 SSH Server Settings . . . . . . . . . . . . . . . . . . . .
FIGURES Figure 3-71 Figure 3-72 Figure 3-73 Figure 3-74 Figure 3-75 Figure 3-76 Figure 3-77 Figure 3-78 Figure 3-79 Figure 3-80 Figure 3-81 Figure 3-82 Figure 3-83 Figure 3-84 Figure 3-85 Figure 3-86 Figure 3-87 Figure 3-88 Figure 3-89 Figure 3-90 Figure 3-91 Figure 3-92 Figure 3-93 Figure 3-94 Figure 3-95 Figure 3-96 Figure 3-97 Figure 3-98 Figure 3-99 Figure 3-100 xxii MSTP Port Configuration . . . . . . . . . . . . . . . . . . . . . . Enabling GVRP Status . . . . . . . . . . . . . . . . . . . . . . . .
CHAPTER 1 INTRODUCTION This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch. However, there are many options that you should configure to maximize the switch’s performance for your particular network environment.
INTRODUCTION Table 1-1 Key Features Feature Description Port Mirroring One or more ports mirrored to single analysis port Port Trunking Supports up to 32 trunks using either static or dynamic trunking (LACP) Broadcast Storm Control Supported Address Table Up to 16K MAC addresses in the forwarding table, 1024 MAC addresses IEEE 802.
DESCRIPTION OF SOFTWARE FEATURES network applications. Some of the management features are briefly described below. Configuration Backup and Restore – You can save the current configuration settings to a file on a TFTP server, and later download this file to restore the switch configuration settings. Authentication – This switch authenticates management access via the console port, Telnet or Web browser.
INTRODUCTION packets when port buffer thresholds are exceeded. The switch supports flow control based on the IEEE 802.3x standard. Rate Limiting – This feature controls the maximum rate for traffic transmitted or received on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic into or out of the network. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped.
DESCRIPTION OF SOFTWARE FEATURES IEEE 802.1D Bridge – The switch supports IEEE 802.1D transparent bridging. The address table facilitates data switching by learning addresses, and then filtering or forwarding traffic based on this information. The address table supports up to 16K addresses. Store-and-Forward Switching – The switch copies each frame into its memory before forwarding them to another port.
INTRODUCTION prevents VLAN members from being segmented from the rest of the group (as sometimes occurs with IEEE 802.1D STA). Virtual LANs – The switch supports up to 255 VLANs. A Virtual LAN is a collection of network nodes that share the same collision domain regardless of their physical location or connection point in the network. The switch supports tagged VLANs based on the IEEE 802.1Q standard.
SYSTEM DEFAULTS priorities are mapped to a Class of Service value by the switch, and the traffic then sent to the corresponding output queue. Multicast Filtering – Specific multicast traffic can be assigned to its own VLAN to ensure that it does not interfere with normal network traffic and to guarantee real-time delivery by setting the required priority level for the designated VLAN. The switch uses IGMP Snooping and Query to manage multicast group registration.
INTRODUCTION Table 1-2 System Defaults Function Authentication Default Username “admin” Password “admin” Normal Exec Level Username “guest” Password “guest” Enable Privileged Exec from Password “super” Normal Exec Level RADIUS Authentication Disabled TACACS Authentication Disabled 802.
SYSTEM DEFAULTS Table 1-2 System Defaults Function Port Configuration Rate Limiting Port Trunking Broadcast Storm Protection Spanning Tree Protocol Address Table Virtual LANs Traffic Prioritization Parameter Admin Status Auto-negotiation Flow Control Input and output limits Static Trunks LACP (all ports) Status Broadcast Limit Rate Status Default Enabled Enabled Disabled Disabled None Disabled Enabled (all ports) 500 packets per second Enabled, RSTP (Defaults: All values based on IEEE 802.
INTRODUCTION Table 1-2 System Defaults Function IP Settings Parameter Management VLAN IP Address Subnet Mask Default Gateway DHCP DNS BOOTP Multicast Filtering IGMP Snooping System Log SMTP Email Alerts SNTP 1-10 Status Messages Logged Messages Logged to Flash Event Handler Clock Synchronization Default Any VLAN configured with an IP address 0.0.0.0 255.0.0.0 0.0.0.
CHAPTER 2 INITIAL CONFIGURATION Connecting to the Switch Configuration Options The switch includes a built-in network management agent. The agent offers a variety of management options, including SNMP, RMON (Groups 1,2 3, 9) and a Web-based interface. A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI). Note: The IP address for this switch is obtained via DHCP by default. To change this address, see “Setting an IP Address” on page 2-10.
INITIAL CONFIGURATION The switch’s Web interface, CLI configuration program, and SNMP agent allow you to perform the following management functions: • Set user names and passwords • • • • • Set an IP interface for the switch Configure SNMP parameters Enable/disable any port Set the speed/duplex mode for any port Configure the bandwidth of any port by limiting input or output rates • Control port access through IEEE 802.
CONNECTING TO THE SWITCH Attach a VT100-compatible terminal, or a PC running a terminal emulation program to the switch. You can use the console cable provided with this package, or use a null-modem cable that complies with the wiring assignments shown in the Installation Guide. To connect a terminal to the console port, complete the following steps: 1.
INITIAL CONFIGURATION For a description of how to use the CLI, see “Using the Command Line Interface” on page 4-1. For a list of all the CLI commands and detailed information on using the CLI, refer to “Command Groups” on page 4-11. Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you must first configure it with a valid IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol.
STACK OPERATIONS Stack Operations Up to eight 24-port or 48-port Gigabit switches can be stacked together as described in the Installation Guide. One unit in the stack acts as the Master for configuration tasks and firmware upgrade. All of the other units function in Slave mode, but can automatically take over management of the stack if the Master unit fails.
INITIAL CONFIGURATION • If a unit is removed from the stack, and powered up as a stand-alone unit, it will also retain the original unit number obtained during stacking. Master Backup Unit Once the Master unit finishes booting up, the Slave unit in the stack with the lowest MAC address functions as the primary backup unit.
STACK OPERATIONS fails, the stack will be broken in two. The Stack Link LED on the unit that is no longer receiving traffic from the next unit up in the stack will begin flashing to indicate that the stack link is broken. When the stack fails, a Master unit is selected from the two stack segments, either the unit with the Master button depressed, or the unit with the lowest MAC address if the Master button is not depressed on any unit. The stack reboots and resumes operations.
INITIAL CONFIGURATION Resilient Configuration If a unit in the stack fails, the unit numbers will not change. This means that when you replace a unit in the stack, the original configuration for the failed unit will be restored to the replacement unit. This applies to both the Master and Slave units. Renumbering the Stack The startup configuration file maps configuration settings to each switch in the stack based on the unit identification number.
BASIC CONFIGURATION 3. At the Password prompt, also enter “admin.” (The password characters are not displayed on the console screen.) 4. The session is opened and the CLI displays the “Console#” prompt indicating you have access at the Privileged Exec level. Setting Passwords Note: If this is your first time to log into the CLI program, you should define new passwords for both default user names using the “username” command, record them and put them in a safe place.
INITIAL CONFIGURATION Setting an IP Address You must establish IP address information for the switch to obtain management access through the network. This can be done in either of the following ways: Manual — You have to input the information, including IP address and subnet mask. If your management station is not in the same IP subnet as the switch, you will also need to specify the default gateway router.
BASIC CONFIGURATION 3. Type “exit” to return to the global configuration mode prompt. Press . 4. To set the IP address of the default gateway for the network to which the switch belongs, type “ip default-gateway gateway,” where “gateway” is the IP address of the default gateway. Press . Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.5 255.255.255.0 Console(config-if)#exit Console(config)#ip default-gateway 192.168.1.
INITIAL CONFIGURATION • To obtain IP settings via BOOTP, type “ip address bootp” and press . 3. Type “end” to return to the Privileged Exec mode. Press . 4. Type “ip dhcp restart” to begin broadcasting service requests. Press . 5. Wait a few minutes, and then check the IP configuration settings by typing the “show ip interface” command. Press . 6. Then save your configuration changes by typing “copy running-config startup-config.” Enter the startup file name and press .
BASIC CONFIGURATION The switch includes an SNMP agent that supports SNMP version 1, 2c, and 3 clients. To provide management access for version 1 or 2c clients, you must specify a community string. The switch provides a default MIB View (i.e., an SNMPv3 construct) for the default “public” community string that provides read access to the entire MIB tree, and a default view for the “private” community string that provides read/write access to the entire MIB tree.
INITIAL CONFIGURATION Console(config)#snmp-server community admin rw Console(config)#snmp-server community private Console(config)# Note: If you do not intend to support access to SNMP version 1 and 2c clients, we recommend that you delete both of the default community strings. If there are no community strings, then SNMP management access from SNMP v1 and v2c clients is disabled. Trap Receivers You can also specify SNMP stations that are to receive traps from the switch.
BASIC CONFIGURATION MIB-2 tree branch, and then another view that includes the IEEE 802.1D bridge MIB. It assigns these respective read and read/write views to a group called “r&d” and specifies group authentication via MD5 or SHA. In the last step, it assigns a v3 user to this group, indicating that MD5 will be used for authentication, provides the password “greenpeace” for authentication, and the password “einstein” for encryption.
INITIAL CONFIGURATION Managing System Files The switch’s flash memory supports three types of system files that can be managed by the CLI program, Web interface, or SNMP. The switch’s file system allows files to be uploaded and downloaded, copied, deleted, and set as a start-up file. The three types of files are: • Configuration — This file stores system configuration information and is created when configuration settings are saved.
MANAGING SYSTEM FILES Note that configuration files should be downloaded using a file name that reflects the contents or usage of the file settings. If you download directly to the running-config, the system will reboot, and the settings will have to be copied from the running-config to a permanent file.
INITIAL CONFIGURATION 2-18
CHAPTER 3 CONFIGURING THE SWITCH Using the Web Interface This switch provides an embedded HTTP web agent. Using a web browser you can configure the switch and view statistics to monitor network activity. The Web agent can be accessed by any computer on the network using a standard web browser (Internet Explorer 5.0 or above, or Netscape Navigator 6.2 or above). Note: You can also use the Command Line Interface (CLI) to manage the switch over a serial connection to the console port or via Telnet.
CONFIGURING THE SWITCH Notes: 1. You are allowed three attempts to enter the correct password; on the third failed attempt the current connection is terminated. 2. If you log into the Web interface as guest (Normal Exec level), you can view the configuration settings or change the guest password. If you log in as “admin” (Privileged Exec level), you can change the settings on any page. 3.
NAVIGATING THE WEB BROWSER INTERFACE Navigating the Web Browser Interface To access the web-browser interface you must first enter a user name and password. The administrator has Read/Write access to all configuration parameters and statistics. The default user name and password for the administrator is “admin.” Home Page When your web browser connects with the switch’s web agent, the home page is displayed as shown below.
CONFIGURING THE SWITCH Configuration Options Configurable parameters have a dialog box or a drop-down list. Once a configuration change has been made on a page, be sure to click on the Apply button to confirm the new setting. The following table summarizes the web page configuration buttons. Table 3-1 Web Page Configuration Buttons Button Action Apply Sets specified values to the system. Revert Cancels specified values and restores current values prior to pressing “Apply” or “Apply Changes.
NAVIGATING THE WEB BROWSER INTERFACE Main Menu Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program.
CONFIGURING THE SWITCH Table 3-2 Main Menu (Continued) Menu Reset Description Restarts the switch 3-41 Configuration Configures SNTP client settings, including broadcast mode or a specified list of servers 3-42 Clock Time Zone Sets the local time zone for the system clock 3-43 SNTP 3-42 SNMP 3-45 Configuration Configures community strings and related trap functions 3-47 Agent Status Enables or disables SNMP 3-47 SNMPv3 3-50 Engine ID Sets the SNMP v3 engine ID 3-51 Users Configures
NAVIGATING THE WEB BROWSER INTERFACE Table 3-2 Main Menu (Continued) Menu Description Page Configuration Configures protocol parameters 3-79 Port Configuration Sets the authentication mode for individual ports 3-80 Statistics Displays protocol statistics for the selected port 3-83 Configures IP addresses that are allowed management access 3-85 IP Filter ACL 3-87 Configuration Configures packet filtering based on IP or MAC addresses 3-87 Mask Configuration Controls the order in which ACL
CONFIGURING THE SWITCH Table 3-2 Main Menu (Continued) Menu Description Page Port Broadcast Control Sets the broadcast storm threshold for each port 3-123 Trunk Broadcast Control Sets the broadcast storm threshold for each trunk 3-123 Mirror Port Configuration Sets the source and target ports for mirroring 3-125 Rate Limit 3-126 Input Port Configuration Sets the input rate limit for each port 3-126 Input Trunk Configuration Sets the input rate limit for each trunk 3-126 Output Port Confi
NAVIGATING THE WEB BROWSER INTERFACE Table 3-2 Main Menu (Continued) Menu Trunk Configuration Description Page Configures individual trunk settings for STA 3-153 VLAN Configuration Configures priority and VLANs for a spanning tree instance 3-156 Port Information Displays port settings for a specified MST instance 3-160 Trunk Information Displays trunk settings for a specified MST instance 3-160 Port Configuration Configures port settings for a specified MST instance 3-162 Trunk Configuratio
CONFIGURING THE SWITCH Table 3-2 Main Menu (Continued) Menu Description Page Private VLAN Status Enables or disables the private VLAN 3-181 Link Status Configures the private VLAN 3-181 Configuration Creates a protocol group, specifying the supported protocols 3-183 Port Configuration Maps a protocol group to a VLAN 3-184 Protocol VLAN Priority 3-10 3-186 Default Port Priority Sets the default priority for each port 3-186 Default Trunk Priority Sets the default priority for each trunk
NAVIGATING THE WEB BROWSER INTERFACE Table 3-2 Main Menu (Continued) Menu Description Page ACL CoS Priority Sets the CoS value and corresponding output queue for packets matching an ACL rule 3-199 ACL Marker Change traffic priorities for frames matching an ACL rule 3-201 IGMP Snooping 3-201 IGMP Configuration Enables multicast filtering; configures parameters for multicast query 3-202 Multicast Router Port Information Displays the ports that are attached to a neighboring multicast router for
CONFIGURING THE SWITCH Basic Configuration Displaying System Information You can easily identify the system by displaying the device name, location and contact information. Field Attributes • System Name – Name assigned to the switch system. • Object ID – MIB II object ID for switch’s network management subsystem. • Location – Specifies the system location. • Contact – Administrator responsible for the system. • System Up Time – Length of time the management agent has been up.
BASIC CONFIGURATION Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that allows access to the Command Line Interface via Telnet.
CONFIGURING THE SWITCH CLI – Specify the hostname, location and contact information. Console(config)#hostname R&D 5 4-33 Console(config)#snmp-server location WC 9 4-150 Console(config)#snmp-server contact Bill 4-150 Console(config)#exit Console#show system 4-80 System description: SMC8748M/SMC8724M System OID string: 1.3.6.1.4.1.202.20.42 System information System Up time: 0 days, 19 hours, 6 minutes, and 1.
BASIC CONFIGURATION • Internal Power Status – Displays the status of the internal power supply. Management Software • EPLD Version – Version number of EEPROM Programmable Logic Device. • Loader Version – Version number of loader code. • Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code. • Operation Code Version – Version number of runtime code. • Role – Shows that this switch is operating as Master or Slave. These additional parameters are displayed for the CLI.
CONFIGURING THE SWITCH CLI – Use the following command to display version information. Console#show version Unit 1 Serial number: Hardware version: EPLD version: Number of ports: Main power status: Redundant power status: Agent (master) Unit ID: Loader version: Boot ROM version: Operation code version: Console# 4-81 A429048179 R01 15.15 48 up not present 1 1.0.1.3 1.0.1.4 1.0.0.
BASIC CONFIGURATION • Local VLAN Capable – This switch does not support multiple local bridges outside of the scope of 802.1Q defined VLANs. • GMRP – GARP Multicast Registration Protocol (GMRP) allows network devices to register endstations with multicast groups. This switch does not support GMRP; it uses the Internet Group Management Protocol (IGMP) to provide automatic multicast filtering. Web – Click System, Bridge Extension.
CONFIGURING THE SWITCH Setting the Switch’s IP Address This section describes how to configure an IP interface for management access over the network. The IP address for this switch is obtained via DHCP by default. To manually configure an address, you need to change the switch’s default settings (IP address 0.0.0.0 and netmask 255.0.0.0) to values that are compatible with your network.
BASIC CONFIGURATION • Default Gateway – IP address of the gateway router between this device and management stations that exist on other network segments. (Default: 0.0.0.0) • MAC Address – The physical layer address for this switch. Manual Configuration Web – Click System, IP Configuration. Select the VLAN through which the management station is attached, set the IP Address Mode to “Static,” enter the IP address, subnet mask and gateway, then click Apply.
CONFIGURING THE SWITCH Using DHCP/BOOTP If your network provides DHCP/BOOTP services, you can configure the switch to be dynamically configured by these services. Web – Click System, IP Configuration. Specify the VLAN to which the management station is attached, set the IP Address Mode to DHCP or BOOTP. Click Apply to save your changes. Then click Restart DHCP to immediately request a new address. Note that the switch will also broadcast a request for IP configuration settings on each power reset.
BASIC CONFIGURATION CLI – Specify the management interface, and set the IP address mode to DHCP or BOOTP, and then enter the “ip dhcp restart” command. Console#config Console(config)#interface vlan 1 4-174 Console(config-if)#ip address dhcp 4-288 Console(config-if)#end Console#ip dhcp restart 4-289 Console#show ip interface 4-291 IP address and netmask: 192.168.1.54 255.255.255.
CONFIGURING THE SWITCH Managing Firmware You can upload/download firmware to or from a TFTP server, or copy files to and from switch units in a stack. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation. You can also set the switch to use new firmware without overwriting the previous version. You must specify the method of file transfer, along with the file type and file names as required.
BASIC CONFIGURATION Downloading System Software from a Server When downloading runtime code, you can specify the destination file name to replace the current image, or first download the file using a different name from the current runtime code file, and then set the new file as the startup file. Web – Click System, File Management, Copy Operation.
CONFIGURING THE SWITCH If you download to a new destination file, go to the File Management, Set Start-Up menu, mark the operation code file used at startup, and click Apply. To start the new firmware, reboot the system, via the System/Reset menu. Figure 3-9 Setting the Startup Code To delete a file select System, File Management, Delete. Select the file name from the given list by checking the tick box and click Apply. Note that the file currently designated as the startup code cannot be deleted.
BASIC CONFIGURATION CLI – To download new firmware from a TFTP server, enter the IP address of the TFTP server, select “config” as the file type, then enter the source and destination file names. When the file has finished downloading, set the new file to start up the system, and then restart the switch. To start the new firmware, enter the “reload” command or reboot the system. . Console#copy tftp file TFTP server ip address: 10.1.0.19 Choose file type: 1. config: 2.
CONFIGURING THE SWITCH • - running-config to startup-config – Copies the running config to the startup config. - running-config to tftp – Copies the running configuration to a TFTP server. - startup-config to file – Copies the startup configuration to a file on the switch. - startup-config to running config – Copies the startup config to the running config. - startup-config to tftp – Copies the startup configuration to a TFTP server. - tftp to file – Copies a file from a TFTP server to the switch.
BASIC CONFIGURATION Downloading Configuration Settings from a Server You can download the configuration file under a new file name and then set it as the startup file, or you can specify the current startup configuration file as the destination file to directly replace it. Note that the file “Factory_Default_Config.cfg” can be copied to the TFTP server, but cannot be used as the destination on the switch. Web – Click System, File Management, Copy Operation.
CONFIGURING THE SWITCH CLI – Enter the IP address of the TFTP server, specify the source file on the server, set the startup file name on the switch, and then restart the switch . Console#copy tftp startup-config TFTP server ip address: 192.168.1.19 Source configuration file name: config-1 Startup configuration file name [] : startup \Write to FLASH Programming. -Write to FLASH finish. Success.
BASIC CONFIGURATION • Password Threshold – Sets the password intrusion threshold, which limits the number of failed logon attempts. When the logon attempt threshold is reached, the system interface becomes silent for a specified amount of time (set by the Silent Time parameter) before allowing the next logon attempt. (Range: 0-120; Default: 3 attempts) • Silent Time – Sets the amount of time the management console is inaccessible after the number of unsuccessful logon attempts has been exceeded.
CONFIGURING THE SWITCH Web – Click System, Line, Console. Specify the console port connection parameters as required, then click Apply. Figure 3-13 Configuring the Console Port CLI – Enter Line Configuration mode for the console, then specify the connection parameters as required. To display the current console port settings, use the show line command from the Normal Exec level.
BASIC CONFIGURATION Telnet Settings You can access the onboard configuration program over the network using Telnet (i.e., a virtual terminal). Management access via Telnet can be enabled/disabled and other various parameters set, including the TCP port number, timeouts, and a password. These parameters can be configured via the Web or CLI interface. Command Attributes • • • • • • • Telnet Status – Enables or disables Telnet access to the switch.
CONFIGURING THE SWITCH Web – Click System, Line, Telnet. Specify the connection parameters for Telnet access, then click Apply. Figure 3-14 Configuring the Telnet Interface CLI – Enter Line Configuration mode for a virtual terminal, then specify the connection parameters as required. To display the current virtual terminal settings, use the show line command from the Normal Exec level.
BASIC CONFIGURATION Configuring Event Logging The switch allows you to control the logging of error messages, including the type of events that are recorded in switch memory, logging to a remote System Log (syslog) server, and displays a list of recent event messages. System Log Configuration The system allows you to enable or disable event logging, and specify which levels are logged to RAM or flash memory.
CONFIGURING THE SWITCH Table 3-3 Logging Levels (Continued) Level Severity Name Description 3 Error Error conditions (e.g., invalid input, default used) 2 Critical Critical conditions (e.g., memory allocation, or free memory error - resource exhausted) 1 Alert Immediate action needed 0 Emergency System unusable * There are only Level 2, 5 and 6 error messages for the current firmware release.
BASIC CONFIGURATION CLI – Enable system logging and then specify the level of messages to be logged to RAM and flash memory. Use the show logging command to display the current settings.
CONFIGURING THE SWITCH • Host IP Address – Specifies a new server IP address to add to the Host IP List. Web – Click System, Log, Remote Logs. To add an IP address to the Host IP List, type the new IP address in the Host IP Address box, and then click Add. To delete an IP address, click the entry in the Host IP List, and then click Remove. Figure 3-16 Remote Logs CLI – Enter the syslog server host IP address, choose the facility type and set the logging trap. Console(config)#logging host 10.1.0.
BASIC CONFIGURATION Displaying Log Messages Use the Logs page to scroll through the logged system and event messages. The switch can store up to 2048 log entries in temporary random access memory (RAM; i.e., memory flushed on power reset) and up to 4096 entries in permanent flash memory. Web – Click System, Log, Logs. Figure 3-17 Displaying Logs CLI – This example shows the event messages stored in RAM.
CONFIGURING THE SWITCH Command Attributes 3-38 • Admin Status – Enables/disables the SMTP function. (Default: Enabled) • Email Source Address – Sets the email address used for the “From” field in alert messages. You may use a symbolic email address that identifies the switch, or the address of an administrator responsible for the switch. • Severity – Sets the syslog severity threshold level (see Table 3-3) used to trigger alert messages.
BASIC CONFIGURATION Web – Click System, Log, SMTP. Enable SMTP, specify a source email address, and select the minimum severity level. To add an IP address to the SMTP Server List, type the new IP address in the SMTP Server field and click Add. To delete an IP address, click the entry in the SMTP Server List and click Remove. Specify up to five email addresses to receive the alert messages, and click Apply.
CONFIGURING THE SWITCH CLI – Enter the IP address of at least one SMTP server, set the syslog severity level to trigger an email message, and specify the switch (source) and up to five recipient (destination) email addresses. Enable SMTP with the logging sendmail command to complete the configuration. Use the show logging sendmail command to display the current SMTP configuration. Console(config)#logging sendmail host 192.168.1.
BASIC CONFIGURATION therefore remember to save the current configuration after renumbering the stack. • For a line topology, the stack is numbered from top to bottom, with the first unit (i.e., the unit with no connection on the Up port) in the stack designated as unit 1. For a ring topology, the Master unit taken as the top of the stack and is numbered as unit 1 and all other units are numbered sequentially down through the ring. Web – Click System, Renumbering.
CONFIGURING THE SWITCH Setting the System Clock Simple Network Time Protocol (SNTP) allows the switch to set its internal clock based on periodic updates from a time server (SNTP or NTP). Maintaining an accurate time on the switch enables the system log to record meaningful dates and times for event entries. You can also manually set the clock using the CLI. (See “calendar set” on page 4-74.) If the clock is not set, the switch will only record the time from the factory default set at the last bootup.
BASIC CONFIGURATION Web – Select SNTP, Configuration. Modify any of the required parameters, and click Apply. Figure 3-21 SNTP Configuration CLI – This example configures the switch to operate as an SNTP client and then displays the current time and settings. Console(config)#sntp client 4-71 Console(config)#sntp poll 16 4-72 Console(config)#sntp server 10.1.0.19 137.82.140.80 128.250.36.
CONFIGURING THE SWITCH • Minutes (0-59) – The number of minutes before/after UTC. • Direction – Configures the time zone to be before (east) or after (west) UTC. Web – Select SNTP, Clock Time Zone. Set the offset for your time zone relative to the UTC, and click Apply. Figure 3-22 Setting the Time Zone CLI - This example shows how to set the time zone for the system clock.
SIMPLE NETWORK MANAGEMENT PROTOCOL Simple Network Management Protocol Simple Network Management Protocol (SNMP) is a communication protocol designed specifically for managing devices on a network. Equipment commonly managed with SNMP includes switches, routers and host computers. SNMP is typically used to configure these devices for proper operation in a network environment, as well as to monitor them to evaluate performance or detect potential problems.
CONFIGURING THE SWITCH Each group also has a defined security access to set of MIB objects for reading and writing, which are known as “views.” The switch has a default view (all MIB objects) and default groups defined for security models v1 and v2c. The following table shows the security models and levels available and the system default settings.
SIMPLE NETWORK MANAGEMENT PROTOCOL Enabling the SNMP Agent Enables SNMPv3 service for all management clients (i.e., versions 1, 2c, 3). Command Attributes • SNMP Agent Status – Enables SNMP on the switch. Web – Click SNMP, Agent Status. Enable the SNMP Agent by marking the Enabled checkbox, and click Apply. Figure 3-23 Enabling the SNMP Agent CLI – The following example enables SNMP on the switch.
CONFIGURING THE SWITCH • Access Mode –Specifies the access rights for the community string: - Read-Only – Authorized management stations are only able to retrieve MIB objects. - Read/Write – Authorized management stations are able to both retrieve and modify MIB objects. Web – Click SNMP, Configuration. Add new community strings as required, select the access rights from the Access Mode drop-down list, then click Add.
SIMPLE NETWORK MANAGEMENT PROTOCOL Command Attributes • Trap Manager Capability – This switch supports up to five trap managers. • Current – Displays a list of the trap managers currently configured. • Trap Manager IP Address – IP address of a new management station to receive notification messages. • Trap Manager Community String – Specifies a valid community string for the new trap manager entry.
CONFIGURING THE SWITCH Web – Click SNMP, Configuration. Enter the IP address and community string for each management station that will receive trap messages, specify the UDP port and SNMP version, and then click Add. Select the trap types required using the check boxes for Authentication and Link-up/down traps, and then click Apply. Figure 3-25 Configuring SNMP Trap Managers CLI – This example adds a trap manager and enables both authentication and link-up, link-down traps.
SIMPLE NETWORK MANAGEMENT PROTOCOL Setting an Engine ID An SNMPv3 engine is an independent SNMP agent that resides on the switch. This engine protects against message replay, delay, and redirection. The engine ID is also used in combination with user passwords to generate the security keys for authenticating and encrypting SNMPv3 packets. A local engine ID is automatically generated that is unique to the switch. This is referred to as the default engine ID.
CONFIGURING THE SWITCH Configuring SNMPv3 Users Each SNMPv3 user is defined by a unique name. Users must be configured with a specific security level and assigned to a group. The SNMPv3 group restricts users to a specific read and a write view. Command Attributes • User Name – The name of user connecting to the SNMP agent. (Range: 1-32 characters) • Group Name – The name of the SNMP group to which the user is assigned. (Range: 1-32 characters) • Model – The user security model; SNMP v1, v2c or v3.
SIMPLE NETWORK MANAGEMENT PROTOCOL Web – Click SNMP, SNMPv3, Users. Click New to configure a user name. In the New User page, define a name and assign it to a group, then click Add to save the configuration and return to the User Name list. To delete a user, check the box next to the user name, then click Delete. To change the assigned group of a user, click Change Group in the Actions column of the users table and select the new group.
CONFIGURING THE SWITCH CLI – Use the snmp-server user command to configure a new user name and assign it to a group.
SIMPLE NETWORK MANAGEMENT PROTOCOL Web – Click SNMP, SNMPv3, Groups. Click New to configure a new group. In the New Group page, define a name, assign a security model and level, and then select read and write views. Click Add to save the new group and return to the Groups list. To delete a group, check the box next to the group name, then click Delete.
CONFIGURING THE SWITCH CLI – Use the snmp-server group command to configure a new group, specifying the security model and level, and restricting MIB access to defined read and write views. Console(config)#snmp-server group v3secure v3 priv read defaultview write defaultview Console(config)#exit Console#show snmp group . . .
SIMPLE NETWORK MANAGEMENT PROTOCOL Web – Click SNMP, SNMPv3, Views. Click New to configure a new view. In the New View page, define a name and specify OID subtrees in the switch MIB to be included or excluded in the view. Click Back to save the new view and return to the SNMPv3 Views list. For a specific view, click on View OID Subtrees to display the current configuration, or click on Edit OID Subtrees to make changes to the view settings.
CONFIGURING THE SWITCH CLI – Use the snmp-server view command to configure a new view. This example view includes the MIB-2 interfaces table, and the wildcard mask selects all index entries. Console(config)#snmp-server view ifEntry.a 1.3.6.1.2.1.2.2.1.1.* included 4-156 Console(config)#exit Console#show snmp view 4-157 View Name: ifEntry.a Subtree OID: 1.3.6.1.2.1.2.2.1.1.* View Type: included Storage Type: nonvolatile Row Status: active View Name: readaccess Subtree OID: 1.3.6.1.
USER AUTHENTICATION Configuring User Accounts The guest only has read access for most configuration parameters. However, the administrator has write access for all parameters governing the onboard agent. You should therefore assign a new administrator password as soon as possible, and store it in a safe place. The default guest name is “guest” with the password “guest.” The default administrator name is “admin” with the password “admin.
CONFIGURING THE SWITCH Web – Click Security, User Accounts. To configure a new user account, enter the user name, access level, and password, then click Apply. To change the password for a specific user, enter the user name and new password, confirm the password by entering it again, then click Apply. Figure 3-30 Configuring the Logon Password CLI – Assign a user name to access-level 15 (i.e., administrator), then specify the password.
USER AUTHENTICATION Remote Authentication Dial-in User console Web Telnet Service (RADIUS) and Terminal 1. Client attempts management access. 2. Switch contacts authentication server. Access Controller 3. Authentication server challenges client. RADIUS/ 4. Client responds with proper password or key. TACACS+ 5. Authentication server approves access. Access Control server 6. Switch grants management access.
CONFIGURING THE SWITCH • You can specify up to three authentication methods for any user to indicate the authentication sequence. For example, if you select (1) RADIUS, (2) TACACS and (3) Local, the user name and password on the RADIUS server is verified first. If the RADIUS server is not available, then authentication is attempted using the TACACS+ server, and finally the local user name and password is checked.
USER AUTHENTICATION - Number of Server Transmits – Number of times the switch tries to authenticate logon access via the authentication server. (Range: 1-30; Default: 2) - Timeout for a reply – The number of seconds the switch waits for a reply from the RADIUS server before it resends the request. (Range: 1-65535; Default: 5) • TACACS Settings - Server IP Address – Address of the TACACS+ server. (Default: 10.11.12.
CONFIGURING THE SWITCH Web – Click Security, Authentication Settings. To configure local or remote authentication preferences, specify the authentication sequence (i.e., one to three methods), fill in the parameters for RADIUS or TACACS+ authentication if selected, and click Apply. Figure 3-31 Authentication Server Settings CLI – Specify all the required parameters to enable logon authentication.
USER AUTHENTICATION Configuring HTTPS You can configure the switch to enable the Secure Hypertext Transfer Protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Command Usage • • • • • Both the HTTP and HTTPS service can be enabled independently on the switch. However, you cannot configure both services to use the same UDP port.
CONFIGURING THE SWITCH Command Attributes • HTTPS Status – Allows you to enable/disable the HTTPS server feature on the switch. (Default: Enabled) • Change HTTPS Port Number – Specifies the UDP port number used for HTTPS/SSL connection to the switch’s web interface. (Default: Port 443) Web – Click Security, HTTPS Settings. Enable HTTPS and specify the port number, then click Apply. Figure 3-32 HTTPS Settings CLI – This example enables the HTTP secure server and modifies the port number.
USER AUTHENTICATION Note: For maximum security, we recommend you obtain a unique Secure Sockets Layer certificate at the earliest opportunity. This is because the default certificate for the switch is not unique to the hardware you have purchased.
CONFIGURING THE SWITCH Note: The switch supports both SSH Version 1.5 and 2.0. Command Usage The SSH server on this switch supports both password and public key authentication. If password authentication is specified by the SSH client, then the password can be authenticated either locally or via a RADIUS or TACACS+ remote authentication server, as specified on the Authentication Settings page (page 3-60).
USER AUTHENTICATION authenticated using these keys.
CONFIGURING THE SWITCH 2. The SSH server supports up to four client sessions. The maximum number of client sessions includes both current Telnet sessions and SSH sessions. Generating the Host Key Pair A host public/private key pair is used to provide secure communications between an SSH client and the switch. After generating this key pair, you must provide the host public key to SSH clients and import the client’s public key to the switch as described in the proceeding section (Command Usage).
USER AUTHENTICATION Web – Click Security, SSH, Host-Key Settings. Select the host-key type from the drop-down box, select the option to save the host key from memory to flash (if required) prior to generating the key, and then click Generate.
CONFIGURING THE SWITCH CLI – This example generates a host-key pair using both the RSA and DSA algorithms, stores the keys to flash memory, and then displays the host’s public keys.
USER AUTHENTICATION • SSH Authentication Retries – Specifies the number of authentication attempts that a client is allowed before authentication fails and the client has to restart the authentication process. (Range: 1-5 times; Default: 3) • SSH Server-Key Size – Specifies the SSH server key size. (Range: 512-896 bits; Default: 768) - The server key is a private key that is never shared outside the switch. - The host key is shared with the SSH client, and is fixed at 1024 bits.
CONFIGURING THE SWITCH CLI – This example enables SSH, sets the authentication parameters, and displays the current configuration. It shows that the administrator has made a connection via SHH, and then disables this connection. Console(config)#ip ssh server Console(config)#ip ssh timeout 100 Console(config)#ip ssh authentication-retries 5 Console(config)#ip ssh server-key size 512 Console(config)#end Console#show ip ssh SSH Enabled - version 2.
USER AUTHENTICATION already in the address table will be retained and will not age out. Any other device that attempts to use the port will be prevented from accessing the switch. Command Usage • • • A secure port has the following restrictions: - It cannot use port monitoring. - It cannot be a multi-VLAN port. - It cannot be used as a member of a static or dynamic trunk. - It should not be connected to a network interconnection device.
CONFIGURING THE SWITCH Web – Click Security, Port Security. Set the action to take when an invalid address is detected on a port, mark the checkbox in the Status column to enable security for a port, set the maximum number of MAC addresses allowed on a port, and click Apply. Figure 3-35 Port Security CLI – This example sets the command mode to Port 5, sets the port security action to send a trap and disable the port, and then enables port security for the switch.
USER AUTHENTICATION ports in a network can be centrally controlled from a server, which means that authorized users can use the same credentials for authentication from any point within the network. This switch uses the Extensible Authentication Protocol over LANs (EAPOL) to exchange authentication protocol messages with the client, and a remote RADIUS authentication server to verify user identity and access rights. When a client (i.e., Supplicant) connects to a switch port, the switch (i.e.
CONFIGURING THE SWITCH The operation of 802.1X on the switch requires the following: • The switch must have an IP address assigned. • RADIUS authentication must be enabled on the switch and the IP address of the RADIUS server specified. • Each switch port that will be used must be set to dot1x “Auto” mode. • Each client that needs to be authenticated must have dot1x client software installed and properly configured. • The RADIUS server and 802.1X client support EAP.
USER AUTHENTICATION CLI – This example shows the default global settings for 802.1X. Console#show dot1x Global 802.1X Parameters system-auth-control: disabled 4-110 802.1X Port Summary Port Name Status 1/1 disabled 1/2 disabled . . . 1/47 1/48 disabled disabled Operation Mode Single-Host Single-Host Single-Host Single-Host Mode Authorized ForceAuthorized yes ForceAuthorized n/a ForceAuthorized ForceAuthorized n/a n/a 802.1X Port Details 802.1X is disabled on port 1/1 . . . 802.
CONFIGURING THE SWITCH CLI – This example enables 802.1X globally for the switch. Console(config)#dot1x system-auth-control Console(config)# 4-108 Configuring Port Settings for 802.1X When 802.1X is enabled, you need to configure the parameters for the authentication process that runs between the client and the switch (i.e., authenticator), as well as the client identity lookup process that runs between the switch and authentication server. These parameters are described in this section.
USER AUTHENTICATION • Max Request – Sets the maximum number of times the switch port will retransmit an EAP request packet to the client before it times out the authentication session. (Range: 1-10; Default 2) • Quiet Period – Sets the time that a switch port waits after the Max Request count has been exceeded before attempting to acquire a new client. (Range: 1-65535 seconds; Default: 60) • Re-authentication Period – Sets the time period after which a connected client must be re-authenticated.
CONFIGURING THE SWITCH CLI – This example sets the authentication mode to enable 802.1X on port 2, and allows up to ten clients to connect to this port.
USER AUTHENTICATION Displaying 802.1X Statistics This switch can display statistics for dot1x protocol exchanges for any port. Table 3-6 802.1X Statistics Parameter Description Rx EAPOL Start The number of EAPOL Start frames that have been received by this Authenticator. Rx EAPOL Logoff The number of EAPOL Logoff frames that have been received by this Authenticator. Rx EAPOL Invalid The number of EAPOL frames that have been received by this Authenticator in which the frame type is not recognized.
CONFIGURING THE SWITCH Web – Select Security, 802.1X, Statistics. Select the required port and then click Query. Click Refresh to update the statistics. Figure 3-39 802.1X Port Statistics CLI – This example displays the 802.1X statistics for port 4.
USER AUTHENTICATION Filtering IP Addresses for Management Access You can create a list of up to 16 IP addresses or IP address groups that are allowed management access to the switch through the Web interface, SNMP, or Telnet. Command Usage • The management interfaces are open to all IP addresses by default. Once you add an entry to a filter list, access to that interface is restricted to the specified addresses.
CONFIGURING THE SWITCH • Start IP Address – A single IP address, or the starting address of a range. • End IP Address – The end address of a range. Web – Click Security, IP Filter. Enter the IP addresses or range of addresses that are allowed management access to an interface, and click Add IP Filtering Entry. Figure 3-40 IP Filter CLI – This example restricts management access for Telnet clients. Console(config)#management telnet-client 192.168.1.19 4-37 Console(config)#management telnet-client 192.
ACCESS CONTROL LISTS Access Control Lists Access Control Lists (ACL) provide packet filtering for IP frames (based on address, protocol, Layer 4 protocol port number or TCP control code) or any frames (based on MAC address or Ethernet type). To filter incoming packets, first create an access list, add the required rules, specify a mask to modify the precedence in which the rules are checked, and then bind the list to a specific port.
CONFIGURING THE SWITCH • • When an ACL is bound to an interface as an egress filter, all entries in the ACL must be deny rules. Otherwise, the bind operation will fail. The switch does not support the explicit “deny any any” rule for the egress IP ACL or the egress MAC ACLs. If these rules are included in ACL, and you attempt to bind the ACL to an interface for egress checking, the bind operation will fail. The order in which active ACLs are checked is as follows: 1. 2. 3. 4. 5.
ACCESS CONTROL LISTS Web – Click Security, ACL, Configuration. Enter an ACL name in the Name field, select the list type (IP Standard, IP Extended, or MAC), and click Add to open the configuration page for the new list. Figure 3-41 Selecting ACL Type CLI – This example creates a standard IP ACL named bill. Console(config)#access-list ip standard david Console(config-std-acl)# 4-117 Configuring a Standard IP ACL Command Attributes • Action – An ACL can contain all permit rules or all deny rules.
CONFIGURING THE SWITCH Web – Specify the action (i.e., Permit or Deny). Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range. Then click Add. Figure 3-42 ACL Configuration - Standard IP CLI – This example configures one permit rule for the specific address 10.1.1.21 and another rule for the address range 168.92.16.x – 168.92.31.x using a bitmask. Console(config-std-acl)#permit host 10.1.1.
ACCESS CONTROL LISTS • Source/Destination Subnet Mask – Subnet mask for source or destination address. (See the description for SubMask on page 3-89.) • Service Type – Packet priority settings based on the following criteria: - Precedence – IP precedence level. (Range: 0-8) - TOS – Type of Service level. (Range: 0-16) - DSCP – DSCP priority level. (Range: 0-64) Protocol – Specifies the protocol type to match as TCP, UDP or Others, where others indicates a specific protocol number (0-255).
CONFIGURING THE SWITCH Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range. Set any other required criteria, such as service type, protocol type, or TCP control code. Then click Add. Figure 3-43 ACL Configuration - Extended IP CLI – This example adds three rules: 1.
ACCESS CONTROL LISTS 3. Permit all TCP packets from class C addresses 192.168.1.0 with the TCP control code set to “SYN.” Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any 4-120 Console(config-ext-acl)#permit 192.168.1.0 255.255.255.0 any destination-port 80 Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any control-flag 2 2 Console(config-ext-acl)# Configuring a MAC ACL Command Attributes • Action – An ACL can contain all permit rules, deny rules, or a combination of both.
CONFIGURING THE SWITCH • Packet Format – This attribute includes the following packet types: - Any – Any Ethernet packet type. - Untagged-eth2 – Untagged Ethernet II packets. - Untagged-802.3 – Untagged Ethernet 802.3 packets. - Tagged-eth2 – Tagged Ethernet II packets. - Tagged-802.3 – Tagged Ethernet 802.3 packets. Command Usage Egress MAC ACLs only work for destination-mac-known packets, not for multicast, broadcast, or destination-mac-unknown packets. Web – Specify the action (i.e., Permit or Deny).
ACCESS CONTROL LISTS CLI – This rule permits packets from any source MAC address to the destination address 00-e0-29-94-34-de where the Ethernet type is 0800. Console(config-mac-acl)#permit any host 00-e0-29-94-34-de ethertype 0800 Console(config-mac-acl)# 4-135 Configuring ACL Masks You must specify masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/filter packets matching the permit/deny rules specified in an ingress ACL.
CONFIGURING THE SWITCH Web – Click Security, ACL, Mask Configuration. Click Edit for one of the basic mask types to open the configuration page. Figure 3-45 Selecting ACL Mask Types CLI – This example creates an IP ingress mask, and then adds two rules. Each rule is checked in order of precedence to look for a match in the ACL entries. The first entry matching a mask is applied to the inbound packet.
ACCESS CONTROL LISTS specify a host address (not a subnet), or “IP” to specify a range of addresses. (Options: Any, Host, IP; Default: Any) • Source/Destination Subnet Mask – Source or destination address of rule must match this bitmask. (See the description for SubMask on page 3-89.) • Protocol Mask – Check the protocol field. • Service Type Mask – Check the rule for the specified priority type.
CONFIGURING THE SWITCH CLI – This shows that the entries in the mask override the precedence in which the rules are entered into the ACL. In the following example, packets with the source address 10.1.1.1 are dropped because the “deny 10.1.1.1 255.255.255.255” rule has the higher precedence according the “mask host any” entry. Console(config)#access-list ip standard A2 Console(config-std-acl)#permit 10.1.1.0 255.255.255.0 Console(config-std-acl)#deny 10.1.1.1 255.255.255.
ACCESS CONTROL LISTS Web – Configure the mask to match the required rules in the MAC ingress or egress ACLs. Set the mask to check for any source or destination address, a host address, or an address range. Use a bitmask to search for specific VLAN ID(s) or Ethernet type(s). Or check for rules where a packet format was specified. Then click Add.
CONFIGURING THE SWITCH CLI – This example shows how to create an Ingress MAC ACL and bind it to a port. You can then see that the order of the rules have been changed by the mask.
ACCESS CONTROL LISTS • • When an ACL is bound to an interface as an egress filter, all entries in the ACL must be deny rules. Otherwise, the bind operation will fail. The switch does not support the explicit “deny any any” rule for the egress IP ACL or the egress MAC ACLs. If these rules are included in an ACL, and you attempt to bind the ACL to an interface for egress checking, the bind operation will fail. Command Attributes • Port – Fixed port or SFP module.
CONFIGURING THE SWITCH CLI – This examples assigns an IP and MAC ingress ACL to port 1, and an IP ingress ACL to port 2.
PORT CONFIGURATION Web – Click Port, Port Information or Trunk Information. Figure 3-49 Port Status Information Field Attributes (CLI) Basic information: • • Port type – Indicates the port type. (1000BASE-T or SFP) MAC address – The physical layer address for this port. (To access this item on the web, see “Setting the Switch’s IP Address” on page 3-18.) Configuration: • Name – Interface label. • Port admin – Shows if the interface is enabled or disabled (i.e., up or down).
CONFIGURING THE SWITCH - 100full - Supports 100 Mbps full-duplex operation - 1000full - Supports 1000 Mbps full-duplex operation • Broadcast storm – Shows if broadcast storm control is enabled or disabled. • Broadcast storm limit – Shows the broadcast storm threshold. (500 - 262143 packets per second) • • • • Flow control – Shows if flow control is enabled or disabled. LACP – Shows if LACP is enabled or disabled. Port Security – Shows if port security is enabled or disabled.
PORT CONFIGURATION CLI – This example shows the connection status for Port 5.
CONFIGURING THE SWITCH • Autonegotiation (Port Capabilities) – Allows auto-negotiation to be enabled/disabled. When auto-negotiation is enabled, you need to specify the capabilities to be advertised. When auto-negotiation is disabled, you can force the settings for speed, mode, and flow control. The following capabilities are supported.
PORT CONFIGURATION Web – Click Port, Port Configuration or Trunk Configuration. Modify the required interface settings, and click Apply. Figure 3-50 Port - Port Configuration CLI – Select the interface, and then enter the required settings. Console(config)#interface ethernet 1/13 Console(config-if)#description RD SW#13 Console(config-if)#shutdown . Console(config-if)#no shutdown Console(config-if)#no negotiation Console(config-if)#speed-duplex 100half Console(config-if)#flowcontrol .
CONFIGURING THE SWITCH The switch supports both static trunking and dynamic Link Aggregation Control Protocol (LACP). Static trunks have to be manually configured at both ends of the link, and the switches must comply with the Cisco EtherChannel standard. On the other hand, LACP configured ports can automatically negotiate a trunked link with LACP-configured ports on another device.
PORT CONFIGURATION • • All the ports in a trunk have to be treated as a whole when moved from/to, added or deleted from a VLAN. STA, VLAN, and IGMP settings can only be made for the entire trunk. Statically Configuring a Trunk Command Usage • When configuring static trunks, you may not be able to link switches of different types, depending on the manufacturer’s implementation. However, note that the static trunks on this switch are Cisco EtherChannel compatible.
CONFIGURING THE SWITCH Web – Click Port, Trunk Membership. Enter a trunk ID of 1-32 in the Trunk field, select any of the switch ports from the scroll-down port list, and click Add. After you have completed adding ports to the member list, click Apply.
PORT CONFIGURATION CLI – This example creates trunk 2 with ports 9 and 10. Just connect these ports to two static trunk ports on another switch to form a trunk.
CONFIGURING THE SWITCH • A trunk formed with another switch using LACP will automatically be assigned the next available trunk ID. • If more than eight ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails. • All ports on both ends of an LACP trunk must be configured for full duplex, either by forced mode or auto-negotiation.
PORT CONFIGURATION CLI – The following example enables LACP for ports 1 to 6. Just connect these ports to LACP-enabled trunk ports on another switch to form a trunk. Console(config)#interface ethernet 1/1 4-174 Console(config-if)#lacp 4-194 Console(config-if)#exit . . .
CONFIGURING THE SWITCH Note: If the port channel admin key (lacp admin key, page 4-199) is not set (through the CLI) when a channel group is formed (i.e., it has a null value of 0), this key is set to the same value as the port admin key used by the interfaces that joined the group (lacp admin key, as described in this section and on page 4-198). Command Attributes Set Port Actor – This menu sets the local side of an aggregate link; i.e., the ports on this switch. • Port – Port number.
PORT CONFIGURATION Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and Port Priority for the Port Actor. You can optionally configure these settings for the Port Partner. (Be aware that these settings only affect the administrative state of the partner, and will not take effect until the next time an aggregate link is formed with this device.) After you have completed setting the port LACP parameters, click Apply.
CONFIGURING THE SWITCH CLI – The following example configures LACP parameters for ports 1-6. Ports 1-4 are used as active members of the LAG; ports 5 and 6 are set to backup mode. Console(config)#interface ethernet 1/1 4-174 Console(config-if)#lacp actor system-priority 3 4-197 Console(config-if)#lacp actor admin-key 1204-198 Console(config-if)#lacp actor port-priority 128 4-200 Console(config-if)#exit . . .
PORT CONFIGURATION Table 3-7 LACP Port Counters (Continued) Field Description Marker Received Number of valid Marker PDUs received by this channel group. LACPDUs Unknown Number of frames received that either (1) Carry the Slow Pkts Protocols Ethernet Type value, but contain an unknown PDU, or (2) are addressed to the Slow Protocols group MAC Address, but do not carry the Slow Protocols Ethernet Type.
CONFIGURING THE SWITCH CLI – The following example displays LACP counters for port channel 1. Console#show lacp 1 counters 4-201 Channel group : 1 ------------------------------------------------------------------Eth 1/ 1 ------------------------------------------------------------------LACPDUs Sent : 21 LACPDUs Received : 21 Marker Sent : 0 Marker Received : 0 LACPDUs Unknown Pkts : 0 LACPDUs Illegal Pkts : 0 . . .
PORT CONFIGURATION Table 3-8 LACP Internal Configuration Information (Continued) Field Description Admin State, Administrative or operational values of the actor’s state parameters: Oper State • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner. • Distributing – If false, distribution of outgoing frames on this link is disabled; i.e.
CONFIGURING THE SWITCH Web – Click Port, LACP, Port Internal Information. Select a port channel to display the corresponding information. Figure 3-55 LACP - Port Internal Information CLI – The following example displays the LACP configuration settings and operational state for the local side of port channel 1.
PORT CONFIGURATION Displaying LACP Settings and Status for the Remote Side You can display configuration settings and the operational state for the remote side of a link aggregation. Table 3-9 LACP Neighbor Configuration Information Field Description Partner Admin System ID LAG partner’s system ID assigned by the user. Partner Oper System ID LAG partner’s system ID assigned by the LACP protocol. Partner Admin Port Number Current administrative value of the port number for the protocol Partner.
CONFIGURING THE SWITCH Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-56 LACP - Port Neighbors Information CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1.
PORT CONFIGURATION Setting Broadcast Storm Thresholds Broadcast storms may occur when a device on your network is malfunctioning, or if application programs are not well designed or properly configured. If there is too much broadcast traffic on your network, performance can be severely degraded or everything can come to complete halt. You can protect your network from broadcast storms by setting a threshold for broadcast traffic for each port.
CONFIGURING THE SWITCH Web – Click Port, Port Broadcast Control or Trunk Broadcast Control. Check the Enabled box for any interface, set the threshold, and click Apply. Figure 3-57 Port Broadcast Control CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 600 packets per second for port 2.
PORT CONFIGURATION Configuring Port Mirroring You can mirror traffic from any source port to a target port for real-time analysis. You can then attach a logic analyzer or RMON probe to the target port and study the traffic crossing the source port in a completely unobtrusive manner. Source port(s) Single target port Command Usage • Monitor port speed should match or exceed source port speed, otherwise traffic may be dropped from the monitor port.
CONFIGURING THE SWITCH Web – Click Port, Mirror Port Configuration. Specify the source port, the traffic type to be mirrored, and the monitor port, then click Add. Figure 3-58 Configuring a Mirror Port CLI – Use the interface command to select the monitor port, then use the port monitor command to specify the source port. Note that default mirroring under the CLI is for both received and transmitted packets.
PORT CONFIGURATION Command Attribute Rate Limit – Sets the output rate limit for an interface. Default Status – Disabled Default Rate – 1000 Mbps Range – 1 - 1000 Mbps Web - Click Rate Limit, Input/Output Port/Trunk Configuration. Set the Input Rate Limit Status or Output Rate Limit Status, then set the rate limit for the individual interfaces, and click Apply. Figure 3-59 Rate Limit Configuration CLI - This example sets the rate limit for input and output traffic passing through port 1 to 600 Mbps.
CONFIGURING THE SWITCH unusually heavy loading). RMON statistics provide access to a broad range of statistics, including a total count of different frame types and sizes passing through each port. All values displayed have been accumulated since the last system reboot, and are shown as counts per second. Statistics are refreshed every 60 seconds by default. Note: RMON groups 2, 3 and 9 can only be accessed using SNMP management software such as SMC EliteView.
PORT CONFIGURATION Table 3-10 Port Statistics (Continued) Parameter Description Transmit Unicast Packets The total number of packets that higher-level protocols requested be transmitted to a subnetwork-unicast address, including those that were discarded or not sent. Transmit Multicast Packets The total number of packets that higher-level protocols requested be transmitted, and which were addressed to a multicast address at this sub-layer, including those that were discarded or not sent.
CONFIGURING THE SWITCH Table 3-10 Port Statistics (Continued) Parameter Description Single Collision Frames The number of successfully transmitted frames for which transmission is inhibited by exactly one collision. Internal MAC Transmit Errors A count of frames for which transmission on a particular interface fails due to an internal MAC sublayer transmit error. Multiple Collision Frames A count of successfully transmitted frames for which transmission is inhibited by more than one collision.
PORT CONFIGURATION Table 3-10 Port Statistics (Continued) Parameter Description Collisions The best estimate of the total number of collisions on this Ethernet segment. Received Frames The total number of frames (bad, broadcast and multicast) received. Broadcast Frames The total number of good frames received that were directed to the broadcast address. Note that this does not include multicast packets.
CONFIGURING THE SWITCH Web – Click Port, Port Statistics. Select the required interface, and click Query. You can also use the Refresh button at the bottom of the page to update the screen.
PORT CONFIGURATION Figure 3-61 Port Statistics (continued) 3-133
CONFIGURING THE SWITCH CLI – This example shows statistics for port 13.
ADDRESS TABLE SETTINGS Command Attributes • Static Address Counts5 – The number of manually configured addresses. • Current Static Address Table – Lists all the static addresses. • Interface – Port or trunk associated with the device assigned a static address. • MAC Address – Physical address of a device mapped to this interface. • VLAN – ID of configured VLAN (1-4093). Web – Click Address Table, Static Addresses. Specify the interface, the MAC address and VLAN, then click Add Static Address.
CONFIGURING THE SWITCH Displaying the Address Table The Dynamic Address Table contains the MAC addresses learned by monitoring the source address for traffic entering the switch. When the destination address for inbound traffic is found in the database, the packets intended for that address are forwarded directly to the associated port. Otherwise, the traffic is flooded to all ports. Command Attributes 3-136 • Interface – Indicates a port or trunk.
ADDRESS TABLE SETTINGS Web – Click Address Table, Dynamic Addresses. Specify the search type (i.e., mark the Interface, MAC Address, or VLAN checkbox), select the method of sorting the displayed addresses, and then click Query. Figure 3-63 Dynamic Addresses CLI – This example also displays the address table entries for port 1.
CONFIGURING THE SWITCH • Aging Time – The time after which a learned entry is discarded. (Range: 10-1000000 seconds; Default: 300 seconds) Web – Click Address Table, Address Aging. Specify the new aging time, click Apply. Figure 3-64 Address Aging CLI – This example sets the aging time to 400 seconds.
SPANNING TREE ALGORITHM CONFIGURATION STA uses a distributed algorithm to select a bridging device (STA-compliant switch, bridge or router) that serves as the root of the spanning tree network. It selects a root port on each bridging device (except for the root device) which incurs the lowest path cost when forwarding a packet from that device to the root device.
CONFIGURING THE SWITCH When using STA or RSTP, it may be difficult to maintain a stable path between all VLAN members. Frequent changes in the tree structure can easily isolate some of the group members. MSTP (an extension of RSTP) is designed to support independent spanning trees based on VLAN groups. Once you specify the VLANs to include in a Multiple Spanning Tree Instance (MSTI), the protocol will automatically build an MSTI tree to maintain connectivity among each of the VLANs.
SPANNING TREE ALGORITHM CONFIGURATION • Forward Delay – The maximum time (in seconds) the root device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a discarding state; otherwise, temporary data loops might result.
CONFIGURING THE SWITCH 3-142 • Root Hello Time – Interval (in seconds) at which this device transmits a configuration message. • Root Maximum Age – The maximum time (in seconds) this device can wait without receiving a configuration message before attempting to reconfigure. All device ports (except for designated ports) should receive configuration messages at regular intervals.
SPANNING TREE ALGORITHM CONFIGURATION Web – Click Spanning Tree, STA, Information. Figure 3-65 STA Information CLI – This command displays global STA settings, followed by settings for each port. Console#show spanning-tree 4-233 Spanning-tree information --------------------------------------------------------------Spanning tree mode :RSTP Spanning tree enable/disable :enabled Instance :0 Vlans configuration :1-4093 Priority :32768 Bridge Hello Time (sec.) :2 Bridge Max Age (sec.
CONFIGURING THE SWITCH Configuring Global Settings Global settings apply to the entire switch. Command Usage • Spanning Tree Algorithm6 Uses RSTP for the internal state machine, but sends only 802.1D BPDUs. This creates one spanning tree instance for the entire network. If multiple VLANs are implemented on a network, the path between specific VLAN members may be inadvertently disabled to prevent network loops, thus isolating group members.
SPANNING TREE ALGORITHM CONFIGURATION - Be careful when switching between spanning tree modes. Changing modes stops all spanning-tree instances for the previous mode and restarts the system in the new mode, temporarily disrupting user traffic. Command Attributes Basic Configuration of Global Settings • • • Spanning Tree State – Enables/disables STA on this switch. (Default: Enabled) Spanning Tree Type – Specifies the type of spanning tree used on this switch: - STA: Spanning Tree Algorithm (IEEE 802.
CONFIGURING THE SWITCH • • Maximum Age – The maximum time (in seconds) a device can wait without receiving a configuration message before attempting to reconfigure. All device ports (except for designated ports) should receive configuration messages at regular intervals. Any port that ages out STA information (provided in the last configuration message) becomes the designated port for the attached LAN. If it is a root port, a new root port is selected from among the device ports attached to the network.
SPANNING TREE ALGORITHM CONFIGURATION • Transmission Limit – The maximum transmission rate for BPDUs is specified by setting the minimum interval between the transmission of consecutive protocol messages. (Range: 1-10; Default: 3) Configuration Settings for MSTP • Max Instance Numbers – The maximum number of MSTP instances to which this switch can be assigned. (Default: 65) • Configuration Digest – An MD5 signature key that contains the VLAN ID to MST ID mapping table.
CONFIGURING THE SWITCH Web – Click Spanning Tree, STA, Configuration. Modify the required attributes, and click Apply. Figure 3-66 STA Configuration CLI – This example enables Spanning Tree Algorithm, sets the mode to MST, and then configures the STA and MSTP parameters.
SPANNING TREE ALGORITHM CONFIGURATION Displaying Interface Settings The STA Port Information and STA Trunk Information pages display the current status of ports and trunks in the Spanning Tree. Field Attributes • Spanning Tree – Shows if STA has been enabled on this interface. • STA Status – Displays current state of this port within the Spanning Tree: - Discarding - Port receives STA configuration messages, but does not forward packets.
CONFIGURING THE SWITCH • Designated Port – The port priority and number of the port on the designated bridging device through which this switch must communicate with the root of the Spanning Tree. • Oper Path Cost – The contribution of this port to the path cost of paths towards the spanning tree which include this port. • Oper Link Type – The operational point-to-point status of the LAN segment attached to this interface.
SPANNING TREE ALGORITHM CONFIGURATION R A x Backup port receives more useful BPDUs from the same bridge and is therefore not selected as the designated port. R D B Trunk Member – Indicates if a port is a member of a trunk. (STA Port Information only) These additional parameters are only displayed for the CLI: • Admin status – Shows if this interface is enabled. • External path cost – The path cost for the IST. This parameter is used by the STA to determine the best path between devices.
CONFIGURING THE SWITCH • Admin Edge Port – You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.
SPANNING TREE ALGORITHM CONFIGURATION CLI – This example shows the STA attributes for port 5. Console#show spanning-tree ethernet 1/5 4-233 Eth 1/ 5 information -------------------------------------------------------------Admin status: enabled Role: disable State: discarding External admin path cost: 10000 Internal admin path cost: 10000 External oper path cost: 10000 Internal oper path cost: 10000 Priority: 128 Designated cost: 0 Designated port: 128.5 Designated root: 4096.0.
CONFIGURING THE SWITCH • - Learning - Port has transmitted configuration messages for an interval set by the Forward Delay parameter without receiving contradictory information. Port address table is cleared, and the port begins learning addresses. - Forwarding - Port forwards packets, and continues learning addresses. Trunk – Indicates if a port is a member of a trunk.
SPANNING TREE ALGORITHM CONFIGURATION • • • • Default – - Ethernet – Half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 - Fast Ethernet – Half duplex: 200,000; full duplex: 100,000; trunk: 50,000 - Gigabit Ethernet – Full duplex: 10,000; trunk: 5,000 Admin Link Type – The link type attached to this interface. - Point-to-Point – A connection to exactly one other bridge. - Shared – A connection to two or more bridges.
CONFIGURING THE SWITCH Web – Click Spanning Tree, STA, Port Configuration or Trunk Configuration. Modify the required attributes, then click Apply. Figure 3-68 STA Port Configuration CLI – This example sets STA attributes for port 7.
SPANNING TREE ALGORITHM CONFIGURATION (on each bridge) with the same set of VLANs. Also, note that RSTP treats each MSTI region as a single node, connecting all regions to the Common Spanning Tree. To use multiple spanning trees: 1. Set the spanning tree type to MSTP (STA Configuration, page 3-144). 2. Enter the spanning tree priority for the selected MST instance (MSTP VLAN Configuration). 3. Add the VLANs that will share this MSTI (MSTP VLAN Configuration).
CONFIGURING THE SWITCH Web – Click Spanning Tree, MSTP, VLAN Configuration. Select an instance identifier from the list, set the instance priority, and click Apply. To add the VLAN members to an MSTI instance, enter the instance identifier, the VLAN identifier, and click Add.
SPANNING TREE ALGORITHM CONFIGURATION CLI – This displays STA settings for instance 1, followed by settings for each port. Console#show spanning-tree mst 2 4-233 Spanning-tree information --------------------------------------------------------------Spanning tree mode :MSTP Spanning tree enable/disable :enabled Instance :2 Vlans configuration :2 Priority :4096 Bridge Hello Time (sec.) :2 Bridge Max Age (sec.) :20 Bridge Forward Delay (sec.) :15 Root Hello Time (sec.) :2 Root Max Age (sec.
CONFIGURING THE SWITCH CLI – This example sets the priority for MSTI 1, and adds VLANs 1-5 to this MSTI. Console(config)#spanning-tree mst configuration Console(config-mstp)#mst 1 priority 4096 Console(config-mstp)#mst 1 vlan 1-5 Console(config-mstp)# 4-219 4-221 4-219 Displaying Interface Settings for MSTP The MSTP Port Information and MSTP Trunk Information pages display the current status of ports and trunks in the selected MST instance.
SPANNING TREE ALGORITHM CONFIGURATION CLI – This displays STA settings for instance 0, followed by settings for each port. The settings for instance 0 are global settings that apply to the IST (page 3-140), the settings for other instances only apply to the local spanning tree.
CONFIGURING THE SWITCH Configuring Interface Settings for MSTP You can configure the STA interface settings for an MST Instance using the MSTP Port Configuration and MSTP Trunk Configuration pages. Field Attributes The following attributes are read-only and cannot be changed: • • STA State – Displays current state of this port within the Spanning Tree. (See Displaying Interface Settings on page 3-149 for additional information.
SPANNING TREE ALGORITHM CONFIGURATION • Admin MST Path Cost – This parameter is used by the MSTP to determine the best path between devices. Therefore, lower values should be assigned to ports attached to faster media, and higher values assigned to ports with slower media. (Path cost takes precedence over port priority.) Note that when the Path Cost Method is set to short (page 3-63), the maximum path cost is 65,535.
CONFIGURING THE SWITCH VLAN Configuration IEEE 802.1Q VLANs In large networks, routers are used to isolate broadcast traffic for each subnet into separate domains. This switch provides a similar service at Layer 2 by using VLANs to organize any group of network nodes into separate broadcast domains. VLANs confine broadcast traffic to the originating group, and can eliminate broadcast storms in large networks. This also provides a more secure and cleaner network environment. An IEEE 802.
VLAN CONFIGURATION • • Passing traffic between VLAN-aware and VLAN-unaware devices Priority tagging Assigning Ports to VLANs Before enabling VLANs for the switch, you must first assign each port to the VLAN group(s) in which it will participate. By default all ports are assigned to VLAN 1 as untagged ports. Add a port as a tagged port if you want it to carry traffic for one or more VLANs, and any intermediate network devices or the host at the other end of the connection supports VLANs.
CONFIGURING THE SWITCH Port Overlapping – Port overlapping can be used to allow access to commonly shared network resources among different VLAN groups, such as file servers or printers. Note that if you implement VLANs which do not overlap, but still need to communicate, you can connect them by enabled routing on this switch. Untagged VLANs – Untagged (or static) VLANs are typically used to reduce broadcast traffic and to increase security.
VLAN CONFIGURATION should also determine security boundaries in the network and disable GVRP on the boundary ports to prevent advertisements from being propagated, or forbid those ports from joining restricted VLANs. Note: If you have host devices that do not support GVRP, you should configure static or untagged VLANs for the switch ports connected to these devices (as described in “Adding Static Members to VLANs (VLAN Index)” on page 3-173).
CONFIGURING THE SWITCH receives a tagged frame, it will pass this frame onto the VLAN(s) indicated by the frame tag. However, when this switch receives an untagged frame from a VLAN-unaware device, it first decides where to forward the frame, and then inserts a VLAN tag reflecting the ingress port’s default VID.
VLAN CONFIGURATION Field Attributes • VLAN Version Number8 – The VLAN version used by this switch as specified in the IEEE 802.1Q standard. • Maximum VLAN ID – Maximum VLAN ID recognized by this switch. • Maximum Number of Supported VLANs – Maximum number of VLANs that can be configured on this switch. Web – Click VLAN, 802.1Q VLAN, Basic Information. Figure 3-73 VLAN Basic Information CLI – Enter the following command.
CONFIGURING THE SWITCH Command Attributes (Web) • • • • • VLAN ID – ID of configured VLAN (1-4093). Up Time at Creation – Time this VLAN was created (i.e., System Up Time). Status – Shows how this VLAN was added to the switch. - Dynamic GVRP: Automatically learned via GVRP. - Permanent: Added as a static entry. Egress Ports – Shows all the VLAN port members. Untagged Ports – Shows the untagged VLAN port members. Web – Click VLAN, 802.1Q VLAN, Current Table. Select any ID from the scroll-down list.
VLAN CONFIGURATION • • Status – Shows if this VLAN is enabled or disabled. - Active: VLAN is operational. - Suspend: VLAN is suspended; i.e., does not pass packets. Ports / Channel groups – Shows the VLAN interface members. CLI – Current VLAN information can be displayed with the following command.
CONFIGURING THE SWITCH • Status (Web) – Enables or disables the specified VLAN. • - Enable: VLAN is operational - Disable: VLAN is suspended; i.e., does not pass packets. State (CLI) – Enables or disables the specified VLAN. • - Active: VLAN is operational. - Suspend: VLAN is suspended; i.e., does not pass packets. Add – Adds a new VLAN group to the current list. • Remove – Removes a VLAN group from the current list.
VLAN CONFIGURATION CLI – This example creates a new VLAN.
CONFIGURING THE SWITCH Command Attributes • VLAN – ID of configured VLAN (1-4093, no leading zeroes). • Name – Name of the VLAN (1 to 32 characters). • Status – Enables or disables the specified VLAN. • - Enable: VLAN is operational. - Disable: VLAN is suspended; i.e., does not pass packets. Port – Port identifier. • Trunk – Trunk identifier.
VLAN CONFIGURATION Web – Click VLAN, 802.1Q VLAN, Static Table. Select a VLAN ID from the scroll-down list. Modify the VLAN name and status if required. Select the membership type by marking the appropriate radio button in the list of ports or trunks. Click Apply. Figure 3-76 VLAN Static Table - Adding Static Members CLI – The following example adds tagged and untagged ports to VLAN 2.
CONFIGURING THE SWITCH • Member – VLANs for which the selected interface is a tagged member. • Non-Member – VLANs for which the selected interface is not a tagged member. Web – Click VLAN, 802.1Q VLAN, Static Membership by Port. Select an interface from the scroll-down box (Port or Trunk). Click Query to display membership information for the interface. Select a VLAN ID, and then click Add to add the interface as a tagged member, or click Remove to remove the interface.
VLAN CONFIGURATION Configuring VLAN Behavior for Interfaces You can configure VLAN behavior for specific interfaces, including the default VLAN identifier (PVID), accepted frame types, ingress filtering, GVRP status, and GARP timers. Command Usage • GVRP – GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network.
CONFIGURING THE SWITCH • - If ingress filtering is disabled and a port receives frames tagged for VLANs for which it is not a member, these frames will be flooded to all other ports (except for those VLANs explicitly forbidden on this port). - If ingress filtering is enabled and a port receives frames tagged for VLANs for which it is not a member, these frames will be discarded. - Ingress filtering does not affect VLAN independent BPDU frames, such as GVRP or STA.
VLAN CONFIGURATION • • Mode – Indicates VLAN membership mode for an interface. (Default: Hybrid) - 1Q Trunk – Specifies a port as an end-point for a VLAN trunk. A trunk is a direct link between two switches, so the port transmits tagged frames that identify the source VLAN. However, note that frames belonging to the port’s default VLAN (i.e., associated with the PVID) are also transmitted as tagged frames. - Hybrid – Specifies a hybrid VLAN interface. The port may transmit tagged or untagged frames.
CONFIGURING THE SWITCH CLI – This example sets port 3 to accept only tagged frames, assigns PVID 3 as the native VLAN ID, enables GVRP, sets the GARP timers, and then sets the switchport mode to hybrid.
VLAN CONFIGURATION Enabling Private VLANs Use the Private VLAN Status page to enable/disable the Private VLAN function. Web – Click VLAN, Private VLAN, Status. Select Enabled, and click Apply. Figure 3-79 Private VLAN Status CLI – This example enables private VLANs. Console(config)#pvlan Console(config)# 4-247 Configuring Uplink and Downlink Ports Use the Private VLAN Link Status page to set ports as downlink or uplink ports.
CONFIGURING THE SWITCH Web – Click VLAN, Private VLAN, Link Status. Mark the ports that will serve as uplinks and downlinks for the private VLAN, then click Apply. Figure 3-80 Private VLAN Link Status CLI – This configures ports 3 and 4 as uplinks and ports 5 and 6 as downlinks.
VLAN CONFIGURATION To avoid these problems, you can configure this switch with protocol-based VLANs that divide the physical network into logical VLAN groups for each required protocol. When a frame is received at a port, its VLAN membership can then be determined based on the protocol type being used by the inbound packets. Command Usage To configure protocol-based VLANs, follow these steps: 1. First configure VLAN groups for the protocols you want to use (page 3-171).
CONFIGURING THE SWITCH Web – Click VLAN, Protocol VLAN, Configuration. Enter a protocol group ID, frame type and protocol type, then click Apply. Figure 3-81 Protocol VLAN Configuration CLI – The following creates protocol group 1, and then specifies Ethernet frames with IP and ARP protocol types.
VLAN CONFIGURATION - If the frame is untagged but the protocol type does not match, the frame is forwarded to the default VLAN for this interface. Command Attributes • Interface – Port or trunk identifier. • Protocol Group ID – Group identifier of this protocol group. (Range: 1-2147483647) • VLAN ID – VLAN to which matching protocol traffic is forwarded. (Range: 1-4093) Web – Click VLAN, Protocol VLAN, Port Configuration.
CONFIGURING THE SWITCH Class of Service Configuration Class of Service (CoS) allows you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with eight priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues. You can set the default priority for each interface, and configure the mapping of frame priority tags to the switch’s priority queues.
CLASS OF SERVICE CONFIGURATION • Number of Egress Traffic Classes – The number of queue buffers provided for each port. Web – Click Priority, Default Port Priority or Default Trunk Priority. Modify the default priority for any interface, then click Apply. Figure 3-83 Default Port Priority CLI – This example assigns a default priority of 5 to port 3.
CONFIGURING THE SWITCH Mapping CoS Values to Egress Queues This switch processes Class of Service (CoS) priority tagged traffic by using eight priority queues for each port, with service schedules based on strict or Weighted Round Robin (WRR). Up to eight separate traffic priorities are defined in IEEE 802.1p. The default priority levels are assigned according to recommendations in the IEEE 802.1p standard as shown in the following table.
CLASS OF SERVICE CONFIGURATION Command Attributes • Priority – CoS value. (Range: 0-7, where 7 is the highest priority) • Traffic Class11 – Output queue buffer. (Range: 0-7, where 7 is the highest CoS priority queue) Web – Click Priority, Traffic Classes. Assign priorities to the traffic classes (i.e., output queues), then click Apply. Figure 3-84 Traffic Classes CLI – The following example shows how to change the CoS assignments to a one-to-one mapping.
CONFIGURING THE SWITCH Selecting the Queue Mode You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue. WRR uses a predefined relative weight for each queue that determines the percentage of service time the switch services each queue before moving on to the next queue.
CLASS OF SERVICE CONFIGURATION Setting the Service Weight for Traffic Classes This switch uses the Weighted Round Robin (WRR) algorithm to determine the frequency at which it services each priority queue. As described in “Mapping CoS Values to Egress Queues” on page 3-188, the traffic classes are mapped to one of the four egress queues provided for each port. You can assign a weight to each of these queues (and thereby to the corresponding traffic priorities).
CONFIGURING THE SWITCH CLI – The following example shows how to assign WRR weights to each of the priority queues. Console(config)#interface ethernet 1/1 Console(config-if)#queue bandwidth 1 3 5 7 9 11 13 15 Console(config-if)#end Console#show queue bandwidth Information of Eth 1/1 Queue ID Weight -------- -----0 1 1 3 2 5 3 7 4 9 5 11 6 13 7 15 Information of Eth 1/2 Queue ID Weight . . .
CLASS OF SERVICE CONFIGURATION Selecting IP Precedence/DSCP Priority The switch allows you to choose between using IP Precedence or DSCP priority. Select one of the methods or disable this feature. Command Attributes • Disabled – Disables both priority services. (This is the default setting.) • IP Precedence – Maps layer 3/4 priorities using IP Precedence. • IP DSCP – Maps layer 3/4 priorities using Differentiated Services Code Point Mapping. Web – Click Priority, IP Precedence/DSCP Priority Status.
CONFIGURING THE SWITCH Service values (i.e., Precedence value 0 maps to CoS value 0, and so forth). Bits 6 and 7 are used for network control, and the other bits for various application types. ToS bits are defined in the following table.
CLASS OF SERVICE CONFIGURATION CLI – The following example globally enables IP Precedence service on the switch, maps IP Precedence value 1 to CoS value 0 (on port 1), and then displays the IP Precedence settings.
CONFIGURING THE SWITCH Table 3-14 Mapping DSCP Priority (Continued) IP DSCP Value CoS Value 18, 20, 22, 24 3 26, 28, 30, 32, 34, 36 4 38, 40, 42 5 48 6 46, 56 7 Command Attributes • DSCP Priority Table – Shows the DSCP Priority to CoS map. • Class of Service Value – Maps a CoS value to the selected DSCP Priority value. Note that “0” represents low priority and “7” represent high priority. Note: IP DSCP settings apply to all interfaces. Web – Click Priority, IP DSCP Priority.
CLASS OF SERVICE CONFIGURATION Console(config)#map ip dscp Console(config)#interface ethernet 1/1 Console(config-if)#map ip dscp 1 cos 0 Console(config-if)#end Console#show map ip dscp ethernet 1/1 DSCP mapping status: disabled 4-271 4-174 4-272 4-275 Port DSCP COS --------- ---- --Eth 1/ 1 0 0 Eth 1/ 1 1 0 Eth 1/ 1 2 0 Eth 1/ 1 3 0 . . .
CONFIGURING THE SWITCH Figure 3-90 IP Port Priority Status Click Priority, IP Port Priority. Enter the port number for a network application in the IP Port Number box and the new CoS value in the Class of Service box, and then click Apply. Figure 3-91 IP Port Priority CLI – The following example globally enables IP Port Priority service on the switch, maps HTTP traffic (on port 1) to CoS value 0, and then displays the IP Port Priority settings.
CLASS OF SERVICE CONFIGURATION Note: Mapping specific values for IP Port Priority is implemented as an interface configuration command, but any changes will apply to the all interfaces on the switch. Mapping CoS Values to ACLs Use the ACL CoS Mapping page to set the output queue for packets matching an ACL rule as shown in the following table. Note that the specified CoS value is only used to map the matching packet to an output queue; it is not written to the packet itself.
CONFIGURING THE SWITCH Web – Click Priority, ACL CoS Priority. Enable mapping for any port, select an ACL from the scroll-down list, then click Apply. Figure 3-92 ACL CoS Priority CLI – This example assigns a CoS value of zero to packets matching rules within the specified ACL on port 24.
MULTICAST FILTERING Multicast Filtering Multicasting is used to support real-time applications such as videoconferencing or streaming audio. A multicast server does not have to establish a separate connection with each client. It merely broadcasts its service to the network, and any hosts that want to receive the multicast register with their local multicast switch/router.
CONFIGURING THE SWITCH Layer 2 IGMP (Snooping and Query) IGMP Snooping and Query — If multicast routing is not supported on other switches in your network, you can use IGMP Snooping and Query (page 3-202) to monitor IGMP service requests passing between multicast clients and servers, and dynamically configure the switch ports which need to forward multicast traffic. Static IGMP Router Interface — If IGMP snooping cannot locate the IGMP querier, you can manually designate a known IGMP querier (i.e.
MULTICAST FILTERING • IGMP Querier — A router, or multicast-enabled switch, can periodically ask their hosts if they want to receive multicast traffic. If there is more than one router/switch on the LAN performing IP multicasting, one of these devices is elected “querier” and assumes the role of querying the LAN for group members. It then propagates the service requests on to any upstream multicast switch/router to ensure that it will continue to receive the multicast service.
CONFIGURING THE SWITCH • IGMP Version — Sets the protocol version for compatibility with other devices on the network. (Range: 1-2; Default: 2) Notes: 1. All systems on the subnet must support the same version. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Timeout. Web – Click IGMP Snooping, IGMP Configuration. Adjust the IGMP settings as required, and then click Apply. (The default settings are shown below.
MULTICAST FILTERING Displaying Interfaces Attached to a Multicast Router Multicast routers that are attached to ports on the switch use information obtained from IGMP, along with a multicast routing protocol such as DVMRP or PIM, to support IP multicasting across the Internet. These routers may be dynamically discovered by the switch or statically assigned to an interface on the switch.
CONFIGURING THE SWITCH CLI – This example shows that Port 11 has been statically configured as a port attached to a multicast router. Console#show ip igmp snooping mrouter vlan 1 VLAN M'cast Router Port Type ---- ------------------ ------1 Eth 1/11 Static Console# 4-286 Specifying Static Interfaces for a Multicast Router Depending on your network connections, IGMP snooping may not always be able to locate the IGMP querier.
MULTICAST FILTERING Web – Click IGMP Snooping, Static Multicast Router Port Configuration. Specify the interfaces attached to a multicast router, indicate the VLAN which will forward all the corresponding multicast traffic, and then click Add. After you have finished adding interfaces to the list, click Apply. Figure 3-95 Static Multicast Router Port Configuration CLI – This example configures port 11 as a multicast router port within VLAN 1.
CONFIGURING THE SWITCH Web – Click IGMP Snooping, IP Multicast Registration Table. Select a VLAN ID and the IP address for a multicast service from the scroll-down lists. The switch will display all the interfaces that are propagating this multicast service. Figure 3-96 IP Multicast Registration Table CLI – This example displays all the known multicast services supported on VLAN 1, along with the ports propagating the corresponding services.
MULTICAST FILTERING Command Usage • Static multicast addresses are never aged out. • When a multicast address is assigned to an interface in a specific VLAN, the corresponding traffic can only be forwarded to ports within that VLAN. Command Attribute • Interface – Activates the Port or Trunk scroll down list. • VLAN ID – Selects the VLAN to propagate all multicast traffic coming from the attached multicast router/switch. • Multicast IP – The IP address for a specific multicast service.
CONFIGURING THE SWITCH CLI – This example assigns a multicast address to VLAN 1, and then displays all the known multicast services supported on VLAN 1. Console(config)#ip igmp snooping vlan 1 static 224.1.1.12 ethernet 1/12 Console(config)#exit Console#show mac-address-table multicast vlan 1 VLAN M'cast IP addr. Member ports Type ---- --------------- ------------ ------1 224.1.1.12 Eth1/12 USER 1 224.1.2.
CONFIGURING DOMAIN NAME SERVICE • When an incomplete host name is received by the DNS server on this switch and a domain name list has been specified, the switch will work through the domain list, appending each domain name in the list to the host name, and checking with the specified name servers for a match. • When more than one name server is specified, the servers are queried in the specified sequence until a response is received, or the end of the list is reached with no response.
CONFIGURING THE SWITCH Web – Select DNS, General Configuration. Set the default domain name or list of domain names, specify one or more name servers to use to use for address resolution, enable domain lookup status, and click Apply.
CONFIGURING DOMAIN NAME SERVICE CLI - This example sets a default domain name and a domain list. However, remember that if a domain list is specified, the default domain name is not used. Console(config)#ip domain-name sample.com Console(config)#ip domain-list sample.com.uk Console(config)#ip domain-list sample.com.jp Console(config)#ip name-server 192.168.1.55 10.1.0.55 Console(config)#ip domain-lookup Console(config)#exit Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: sample.
CONFIGURING THE SWITCH Field Attributes • Host Name – Name of a host device that is mapped to one or more IP addresses. (Range: 1-64 characters) • IP Address – Internet address(es) associated with a host name. (Range: 1-8 addresses) • Alias – Displays the host names that are mapped to the same address(es) as a previously configured entry. Web – Select DNS, Static Host Table. Enter a host name and one or more corresponding addresses, then click Apply.
CONFIGURING DOMAIN NAME SERVICE CLI - This example maps two address to a host name, and then configures an alias host name for the same addresses. Console(config)#ip host rd5 192.168.1.55 10.1.0.55 Console(config)#ip host rd6 10.1.0.55 Console(config)#exit Console#show host 4-164 4-170 Hostname rd5 Inet address 192.168.1.5 10.1.0.55 Alias 1.rd6 Console# Displaying the DNS Cache You can display entries in the DNS cache that have been learned via the designated name servers.
CONFIGURING THE SWITCH Web – Select DNS, Cache. Figure 3-100 DNS Cache CLI - This example displays all the resource records learned from the designated name servers. Console#show dns cache NO FLAG TYPE 0 4 CNAME 1 4 CNAME 2 4 CNAME 3 4 CNAME 4 4 CNAME 5 4 ALIAS 6 4 CNAME 7 4 ALIAS 8 4 CNAME 9 4 ALIAS 10 4 CNAME Console# 3-216 IP 207.46.134.222 207.46.134.190 207.46.134.155 207.46.249.222 207.46.249.27 POINTER TO:4 207.46.68.27 POINTER TO:6 65.54.131.192 POINTER TO:8 165.193.72.
CHAPTER 4 COMMAND LINE INTERFACE This chapter describes how to use the Command Line Interface (CLI). Using the Command Line Interface Accessing the CLI When accessing the management interface for the switch over a direct connection to the server’s console port, or via a Telnet connection, the switch can be managed by entering command keywords and parameters at the prompt. Using the switch's command-line interface (CLI) is very similar to entering commands on a UNIX system.
COMMAND LINE INTERFACE After connecting to the system through the console port, the login screen displays: User Access Verification Username: admin Password: CLI session with the SMC8748M is opened. To end the CLI session, enter [Exit]. Console# Telnet Connection Telnet operates over the IP transport protocol. In this environment, your management station and any network device you want to manage over the network must have a valid IP address.
ENTERING COMMANDS 2. At the prompt, enter the user name and system password. The CLI will display the “Vty-n#” prompt for the administrator to show that you are using privileged access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you are using normal access mode (i.e., Normal Exec), where n indicates the number of the current Telnet session. 3. Enter the necessary commands to complete your desired tasks. 4. When finished, exit the session with the “quit” or “exit” command.
COMMAND LINE INTERFACE • To enter multiple commands, enter each command in the required order. For example, to enable Privileged Exec command mode, and display the startup configuration, enter: Console>enable Console#show startup-config • To enter commands that require parameters, enter the required parameters after the command keyword.
ENTERING COMMANDS Showing Commands If you enter a “?” at the command prompt, the system will display the first level of keywords for the current command class (Normal Exec or Privileged Exec) or configuration class (Global, ACL, Interface, Line, VLAN Database, or MSTP). You can also display a list of valid keywords for a specific command.
COMMAND LINE INTERFACE The command “show interfaces ?” will display the following information: Console#show interfaces ? counters Information of interfaces counters protocol-vlan Protocol-vlan information status Information of interfaces status switchport Information of interfaces switchport Console# Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided. (Remember not to leave a space between the command and question mark.
ENTERING COMMANDS Understanding Command Modes The command set is divided into Exec and Configuration classes. Exec commands generally display information on system status or clear statistical counters. Configuration commands, on the other hand, modify interface parameters or enable certain switching functions. These classes are further divided into different modes. Available commands depend on the selected mode.
COMMAND LINE INTERFACE Privileged Exec mode from within Normal Exec mode, by entering the enable command, followed by the privileged level password “super” (page 4-36). To enter Privileged Exec mode, enter the following user names and passwords: Username: admin Password: [admin login password] CLI session with the SMC8748M is opened. To end the CLI session, enter [Exit]. Console# Username: guest Password: [guest login password] CLI session with the SMC8748M is opened. To end the CLI session, enter [Exit].
ENTERING COMMANDS • Line Configuration - These commands modify the console port and Telnet configuration, and include command such as parity and databits. • VLAN Configuration - Includes the command to create VLAN groups. • Multiple Spanning Tree Configuration - These commands configure settings for the selected multiple spanning tree instance. To enter the Global Configuration mode, enter the command configure in Privileged Exec mode.
COMMAND LINE INTERFACE For example, you can use the following commands to enter interface configuration mode, and then return to Privileged Exec mode. Console(config)#interface ethernet 1/5 . . . Console(config-if)#exit Console(config)# Command Line Processing Commands are not case sensitive. You can abbreviate commands and parameters as long as they contain enough letters to differentiate them from any other currently available commands or parameters.
COMMAND GROUPS Command Groups The system commands can be broken down into the functional groups shown below.
COMMAND LINE INTERFACE Table 4-4 Command Group Index (Continued) Command Group Description Page Address Table Configures the address table for filtering specified addresses, displays current entries, clears the table, or sets the aging time 4-206 Spanning Tree Configures Spanning Tree settings for the switch 4-210 VLANs Configures VLAN settings, and defines port membership for VLAN groups; also enables or configures private VLANs and protocol VLANs 4-235 GVRP and Bridge Extension Configures GVR
LINE COMMANDS Line Commands You can access the onboard configuration program by attaching a VT100 compatible device to the server’s serial port. These commands are used to set communication parameters for the serial port or Telnet (i.e., a virtual terminal).
COMMAND LINE INTERFACE line This command identifies a specific line for configuration, and to process subsequent line configuration commands. Syntax line {console | vty} • console - Console terminal line. • vty - Virtual terminal for remote console access (i.e., Telnet). Default Setting There is no default line. Command Mode Global Configuration Command Usage Telnet is considered a virtual terminal connection and will be shown as “Vty” in screen displays such as show users.
LINE COMMANDS login This command enables password checking at login. Use the no form to disable password checking and allow connections without a password. Syntax login [local] no login local - Selects local password checking. Authentication is based on the user name specified with the username command.
COMMAND LINE INTERFACE Example Console(config-line)#login local Console(config-line)# Related Commands username (4-34) password (4-16) password This command specifies the password for a line. Use the no form to remove the password. Syntax password {0 | 7} password no password • {0 | 7} - 0 means plain password, 7 means encrypted password • password - Character string that specifies the line password.
LINE COMMANDS Example Console(config-line)#password 0 secret Console(config-line)# Related Commands login (4-15) password-thresh (4-19) timeout login response This command sets the interval that the system waits for a user to log into the CLI. Use the no form to restore the default setting. Syntax timeout login response [seconds] no timeout login response seconds - Integer that specifies the timeout interval.
COMMAND LINE INTERFACE exec-timeout This command sets the interval that the system waits until user input is detected. Use the no form to restore the default. Syntax exec-timeout [seconds] no exec-timeout seconds - Integer that specifies the number of seconds.
LINE COMMANDS password-thresh This command sets the password intrusion threshold which limits the number of failed logon attempts. Use the no form to remove the threshold value. Syntax password-thresh [threshold] no password-thresh threshold - The number of allowed password attempts. (Range: 1-120; 0: no threshold) Default Setting The default value is three attempts.
COMMAND LINE INTERFACE silent-time This command sets the amount of time the management console is inaccessible after the number of unsuccessful logon attempts exceeds the threshold set by the password-thresh command. Use the no form to remove the silent time value. Syntax silent-time [seconds] no silent-time seconds - The number of seconds to disable console response. (Range: 0-65535; 0: no silent-time) Default Setting The default value is no silent-time.
LINE COMMANDS Default Setting 8 data bits per character Command Mode Line Configuration Command Usage The databits command can be used to mask the high bit on input from devices that generate 7 data bits with parity. If parity is being generated, specify 7 data bits per character. If no parity is required, specify 8 data bits per character.
COMMAND LINE INTERFACE Command Usage Communication protocols provided by devices such as terminals and modems often require a specific parity bit setting. Example To specify no parity, enter this command: Console(config-line)#parity none Console(config-line)# speed This command sets the terminal line’s baud rate. This command sets both the transmit (to terminal) and receive (from terminal) speeds. Use the no form to restore the default setting. Syntax speed bps no speed bps - Baud rate in bits per second.
LINE COMMANDS Example To specify 57600 bps, enter this command: Console(config-line)#speed 57600 Console(config-line)# stopbits This command sets the number of the stop bits transmitted per byte. Use the no form to restore the default setting.
COMMAND LINE INTERFACE Command Usage Specifying session identifier “0” will disconnect the console connection. Specifying any other identifiers for an active session will disconnect an SSH or Telnet connection. Example Console#disconnect 1 Console# Related Commands show ssh (4-54) show users (4-81) show line This command displays the terminal line’s parameters. Syntax show line [console | vty] • console - Console terminal line. • vty - Virtual terminal for remote console access (i.e., Telnet).
GENERAL COMMANDS Example To show all lines, enter this command: Console#show line Console configuration: Password threshold: 3 times Interactive timeout: Disabled Login timeout: Disabled Silent time: Disabled Baudrate: auto Databits: 8 Parity: none Stopbits: 1 VTY configuration: Password threshold: 3 times Interactive timeout: 600 sec Login timeout: 300 sec Console# General Commands Table 4-6 General Commands Command Function Mode Page enable Activates privileged mode NE 4-26 disable Returns to no
COMMAND LINE INTERFACE enable This command activates Privileged Exec mode. In privileged mode, additional commands are available, and certain commands display additional information. (See “Understanding Command Modes” on page 4-7.) Syntax enable [level] level - Privilege level to log into the device. The device has two predefined privilege levels: 0: Normal Exec, 15: Privileged Exec. Enter level 15 to access Privileged Exec mode.
GENERAL COMMANDS disable This command returns to Normal Exec mode from privileged mode. In normal access mode, you can only display basic information on the switch's configuration or Ethernet statistics. To gain access to all commands, you must use the privileged mode. (See “Understanding Command Modes” on page 4-7.) Default Setting None Command Mode Privileged Exec Command Usage The “>” character is appended to the end of the prompt to indicate that the system is in normal access mode.
COMMAND LINE INTERFACE Example Console#configure Console(config)# Related Commands end (4-29) show history This command shows the contents of the command history buffer. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The history buffer size is fixed at 10 Execution commands and 10 Configuration commands.
GENERAL COMMANDS The ! command repeats commands from the Execution command history buffer when you are in Normal Exec or Privileged Exec Mode, and commands from the Configuration command history buffer when you are in any of the configuration modes. In this example, the !2 command repeats the second command in the Execution history buffer (config). Console#!2 Console#config Console(config)# reload This command restarts the system.
COMMAND LINE INTERFACE Command Mode Global Configuration, Interface Configuration, Line Configuration, VLAN Database Configuration, and Multiple Spanning Tree Configuration. Example This example shows how to return to the Privileged Exec mode from the Interface Configuration mode: Console(config-if)#end Console# exit This command returns to the previous configuration mode or exit the configuration program.
SYSTEM MANAGEMENT COMMANDS Command Mode Normal Exec, Privileged Exec Command Usage The quit and exit commands can both exit the configuration program. Example This example shows how to quit a CLI session: Console#quit Press ENTER to start session User Access Verification Username: System Management Commands These commands are used to control system logs, passwords, user names, browser configuration options, and display or configure a variety of other system information.
COMMAND LINE INTERFACE Table 4-7 System Management Commands (Continued) Command Group Function Page System Status Displays system configuration, active managers, and version information 4-76 Frame Size Enables support for jumbo frames 4-82 Device Designation Commands Table 4-8 Device Designation Commands Command Function Mode Page prompt Customizes the prompt used in PE and NE mode GC 4-32 hostname Specifies the host name for the switch GC 4-33 snmp-server contact Sets the system contac
SYSTEM MANAGEMENT COMMANDS Example Console(config)#prompt RD2 RD2(config)# hostname This command specifies or modifies the host name for this device. Use the no form to restore the default host name. Syntax hostname name no hostname name - The name of this host. (Maximum length: 255 characters) Default Setting None Command Mode Global Configuration Example Console(config)#hostname RD#1 Console(config)# switch renumber This command resets the switch unit identification numbers in the stack.
COMMAND LINE INTERFACE Example This example shows how to renumber all units. Console#switch all renumber Console# User Access Commands The basic commands required for management access are listed in this section. This switch also includes other options for password checking via the console or a Telnet connection (page 4-13), user authentication via a remote authentication server (page 4-91), and host access authentication for specific ports (page 4-104).
SYSTEM MANAGEMENT COMMANDS • password password - The authentication password for the user. (Maximum length: 8 characters plain text, 32 encrypted, case sensitive) Default Setting • The default access level is Normal Exec.
COMMAND LINE INTERFACE enable password After initially logging onto the system, you should set the Privileged Exec password. Remember to record it in a safe place. This command controls access to the Privileged Exec level from the Normal Exec level. Use the no form to reset the default password. Syntax enable password [level level] {0 | 7} password no enable password [level level] • level level - Level 15 for Privileged Exec. (Levels 0-14 are not used.
SYSTEM MANAGEMENT COMMANDS Related Commands enable (4-26) authentication enable (4-93) IP Filter Commands Table 4-11 IP Filter Commands Command Function Mode Page management Configures IP addresses that are allowed management access GC 4-37 PE 4-38 show management Displays the switch to be monitored or configured from a browser management This command specifies the client IP addresses that are allowed management access to the switch through various protocols.
COMMAND LINE INTERFACE Command Usage • If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager. • IP address can be configured for SNMP, web and Telnet access respectively. Each of these groups can include up to five different sets of addresses, either individual addresses or address ranges. • When entering addresses for the same group (i.e.
SYSTEM MANAGEMENT COMMANDS Command Mode Privileged Exec Example Console#show management all-client Management IP Filter HTTP-Client: Start IP address End IP address ----------------------------------------------1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 SNMP-Client: Start IP address End IP address ----------------------------------------------1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.
COMMAND LINE INTERFACE ip http port This command specifies the TCP port number used by the web browser interface. Use the no form to use the default port. Syntax ip http port port-number no ip http port port-number - The TCP port to be used by the browser interface.
SYSTEM MANAGEMENT COMMANDS Example Console(config)#ip http server Console(config)# Related Commands ip http port (4-40) ip http secure-server This command enables the secure hypertext transfer protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Use the no form to disable this function.
COMMAND LINE INTERFACE • The client and server establish a secure encrypted connection. A padlock icon should appear in the status bar for Internet Explorer 5.x and Netscape Navigator 6.2 or later versions. • The following web browsers and operating systems currently support HTTPS: Table 4-13 HTTPS System Support Web Browser Operating System Internet Explorer 5.0 or later Windows 98,Windows NT (with service pack 6a), Windows 2000, Windows XP Netscape Navigator 6.
SYSTEM MANAGEMENT COMMANDS Default Setting 443 Command Mode Global Configuration Command Usage • You cannot configure the HTTP and HTTPS servers to use the same port.
COMMAND LINE INTERFACE Default Setting Enabled Command Mode Global Configuration Example Console(config)#ip telnet server Console(config)# ip telnet server port This command specifies the TCP port number used by the Telnet interface. Use the no form to use the default port. Syntax [no] ip telnet server port [port-number] port-number - The TCP port to be used by the browser interface.
SYSTEM MANAGEMENT COMMANDS The Secure Shell (SSH) includes server/client applications intended as a secure replacement for the older Berkley remote access tools. SSH can also provide remote management access to this switch as a secure replacement for Telnet. When a client contacts the switch via the SSH protocol, the switch uses a public-key that the client must match along with a local user name and password for access authentication.
COMMAND LINE INTERFACE Table 4-15 Secure Shell Commands (Continued) Command Function Mode Page show ip ssh Displays the status of the SSH server and the configured values for authentication timeout and retries PE show ssh Displays the status of current SSH sessions PE 4-54 show public-key Shows the public key for the specified user PE or for the host 4-55 show users Shows SSH users, including privilege level PE and public key type 4-81 4-54 The SSH server on this switch supports both passwor
SYSTEM MANAGEMENT COMMANDS 10.1.0.54 1024 35 15684995401867669259333946775054617325313674890836547254 15020245593199868544358361651999923329781766065830956 10825913212890233 76546801726272571413428762941301196195566782 59566410486957427888146206 519417467729848654686157177393901647793559423035774130980227370877945452408397 1752646358058176716709574804776117 3.
COMMAND LINE INTERFACE d. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch. e. The switch compares the decrypted bytes to the original bytes it sent. If the two sets match, this means that the client's private key corresponds to an authorized public key, and the client is authenticated.
SYSTEM MANAGEMENT COMMANDS Example Console#ip ssh crypto host-key generate dsa Console#configure Console(config)#ip ssh server Console(config)# Related Commands ip ssh crypto host-key generate (4-51) show ssh (4-54) ip ssh timeout This command configures the timeout for the SSH server. Use the no form to restore the default setting. Syntax ip ssh timeout seconds no ip ssh timeout seconds – The timeout for client response during SSH negotiation.
COMMAND LINE INTERFACE ip ssh authentication-retries This command configures the number of times the SSH server attempts to reauthenticate a user. Use the no form to restore the default setting. Syntax ip ssh authentication-retries count no ip ssh authentication-retries count – The number of authentication attempts permitted after which the interface is reset.
SYSTEM MANAGEMENT COMMANDS Command Usage • The server key is a private key that is never shared outside the switch. • The host key is shared with the SSH client, and is fixed at 1024 bits. Example Console(config)#ip ssh server-key size 512 Console(config)# delete public-key This command deletes the specified user’s public key. Syntax delete public-key username [dsa | rsa] • username – Name of an SSH user. (Range: 1-8 characters) • dsa – DSA public key type. • rsa – RSA public key type.
COMMAND LINE INTERFACE Command Mode Privileged Exec Command Usage • This command stores the host key pair in memory (i.e., RAM). Use the ip ssh save host-key command to save the host key pair to flash memory. • Some SSH client programs automatically add the public key to the known hosts file as part of the configuration process. Otherwise, you must manually create a known hosts file and place the host public key in it.
SYSTEM MANAGEMENT COMMANDS Command Usage • This command clears the host key from volatile memory (RAM). Use the no ip ssh save host-key command to clear the host key from flash memory. • The SSH server must be disabled before you can execute this command. Example Console#ip ssh crypto zeroize dsa Console# Related Commands ip ssh crypto host-key generate (4-51) ip ssh save host-key (4-53) no ip ssh server (4-48) ip ssh save host-key This command saves the host key from RAM to flash memory.
COMMAND LINE INTERFACE show ip ssh This command displays the connection settings used when authenticating client access to the SSH server. Command Mode Privileged Exec Example Console#show ip ssh SSH Enabled - version 1.99 Negotiation timeout: 120 secs; Authentication retries: 3 Server key size: 768 bits Console# show ssh This command displays the current SSH server connections. Command Mode Privileged Exec Example Console#show ssh Connection Version State 0 2.
SYSTEM MANAGEMENT COMMANDS Table 4-16 show ssh - display description (Continued) Field Description Encryption The encryption method is automatically negotiated between the client and server. Options for SSHv1.5 include: DES, 3DES Options for SSHv2.
COMMAND LINE INTERFACE Command Mode Privileged Exec Command Usage • If no parameters are entered, all keys are displayed. If the user keyword is entered, but no user name is specified, then the public keys for all users are displayed. • When an RSA key is displayed, the first field indicates the size of the host key (e.g., 1024), the second field is the encoded public exponent (e.g., 35), and the last string is the encoded modulus.
SYSTEM MANAGEMENT COMMANDS Table 4-17 Event Logging Commands (Continued) Command Function Mode Page logging facility Sets the facility type for remote logging of syslog messages GC 4-60 logging trap Limits syslog messages saved to a remote server based on severity GC 4-61 clear log Clears messages from the logging buffer PE 4-62 show logging Displays the state of logging PE 4-62 show log Displays log messages PE 4-64 logging on This command controls logging of error messages, sending
COMMAND LINE INTERFACE logging history This command limits syslog messages saved to switch memory based on severity. The no form returns the logging of syslog messages to the default level. Syntax logging history {flash | ram} level no logging history {flash | ram} • flash - Event history stored in flash memory (i.e., permanent memory). • ram - Event history stored in temporary RAM (i.e., memory flushed on power reset). • level - One of the levels listed below.
SYSTEM MANAGEMENT COMMANDS Command Mode Global Configuration Command Usage The message level specified for flash memory must be a higher priority (i.e., numerically lower) than that specified for RAM. Example Console(config)#logging history ram 0 Console(config)# logging host This command adds a syslog server host IP address that will receive logging messages. Use the no form to remove a syslog server host. Syntax [no] logging host host_ip_address host_ip_address - The IP address of a syslog server.
COMMAND LINE INTERFACE logging facility This command sets the facility type for remote logging of syslog messages. Use the no form to return the type to the default. Syntax [no] logging facility type type - A number that indicates the facility used by the syslog server to dispatch log messages to an appropriate service. (Range: 16-23) Default Setting 23 Command Mode Global Configuration Command Usage The command specifies the facility type tag sent in syslog messages. (See RFC 3164.
SYSTEM MANAGEMENT COMMANDS logging trap This command enables the logging of system messages to a remote server, or limits the syslog messages saved to a remote server based on severity. Use this command without a specified level to enable remote logging. Use the no form to disable remote logging. Syntax logging trap [level] no logging trap level - One of the level arguments listed below. Messages sent include the selected level up through level 0. (Refer to the table on page 4-58.
COMMAND LINE INTERFACE clear log This command clears messages from the log buffer. Syntax clear log [flash | ram] • flash - Event history stored in flash memory (i.e., permanent memory). • ram - Event history stored in temporary RAM (i.e., memory flushed on power reset).
SYSTEM MANAGEMENT COMMANDS Default Setting None Command Mode Privileged Exec Example The following example shows that system logging is enabled, the message level for flash memory is “errors” (i.e., default level 3 - 0), and the message level for RAM is “debugging” (i.e., default level 7 - 0).
COMMAND LINE INTERFACE Table 4-20 show logging trap - display description Field Description Syslog logging Shows if system logging has been enabled via the logging on command. REMOTELOG status Shows if remote logging has been enabled via the logging trap command. REMOTELOG facility type The facility type for remote logging of syslog messages as specified in the logging facility command.
SYSTEM MANAGEMENT COMMANDS Example The following example shows the event message stored in RAM. Console#show log ram [1] 00:01:30 2001-01-01 "VLAN 1 link-up notification." level: 6, module: 5, function: 1, and event no.: 1 [0] 00:01:30 2001-01-01 "Unit 1, Port 1 link-up notification." level: 6, module: 5, function: 1, and event no.: 1 Console# SMTP Alert Commands These commands configure SMTP event handling, and forwarding of alert messages to the specified SMTP servers and email recipients.
COMMAND LINE INTERFACE logging sendmail host This command specifies SMTP servers that will be sent alert messages. Use the no form to remove an SMTP server. Syntax [no] logging sendmail host ip_address ip_address - IP address of an SMTP server that will be sent alert messages for event handling. Default Setting None Command Mode Global Configuration Command Usage • You can specify up to three SMTP servers for event handing. However, you must enter a separate command to specify each server.
SYSTEM MANAGEMENT COMMANDS logging sendmail level This command sets the severity threshold used to trigger alert messages. Syntax logging sendmail level level level - One of the system message levels (page 4-58). Messages sent include the selected level down to level 0. (Range: 0-7; Default: 7) Default Setting Level 7 Command Mode Global Configuration Command Usage The specified level indicates an event threshold. All events at this level or higher will be sent to the configured email recipients.
COMMAND LINE INTERFACE Command Mode Global Configuration Command Usage You may use an symbolic email address that identifies the switch, or the address of an administrator responsible for the switch. Example This example will send email alerts for system errors from level 3 through 0. Console(config)#logging sendmail source-email bill@this-company.com Console(config)# logging sendmail destination-email This command specifies the email recipients of alert messages. Use the no form to remove a recipient.
SYSTEM MANAGEMENT COMMANDS logging sendmail This command enables SMTP event handling. Use the no form to disable this function. Syntax [no] logging sendmail Default Setting Enabled Command Mode Global Configuration Example Console(config)#logging sendmail Console(config)# show logging sendmail This command displays the settings for the SMTP event handler. Command Mode Normal Exec, Privileged Exec Example Console#show logging sendmail SMTP servers ----------------------------------------------192.168.1.
COMMAND LINE INTERFACE Time Commands The system clock can be dynamically set by polling a set of specified time servers (NTP or SNTP). Maintaining an accurate time on the switch enables the system log to record meaningful dates and times for event entries. If the clock is not set, the switch will only record the time from the factory default set at the last bootup.
SYSTEM MANAGEMENT COMMANDS Command Usage • The time acquired from time servers is used to record accurate dates and times for log events. Without SNTP, the switch only records the time starting from the factory default set at the last bootup (e.g., 00:00:00, Jan. 1, 2001). • This command enables client time requests to time servers specified via the sntp servers command. It issues time synchronization requests based on the interval set via the sntp poll command. Example Console(config)#sntp server 10.1.0.
COMMAND LINE INTERFACE Command Mode Global Configuration Command Usage This command specifies time servers from which the switch will poll for time updates when set to SNTP client mode. The client will poll the time servers in the order specified until a response is received. It issues time synchronization requests based on the interval set via the sntp poll command. Example Console(config)#sntp server 10.1.0.
SYSTEM MANAGEMENT COMMANDS Related Commands Related Commands (4-71) show sntp This command displays the current time and configuration settings for the SNTP client, and indicates whether or not the local time has been properly updated. Command Mode Normal Exec, Privileged Exec Command Usage This command displays the current time, the poll interval used for sending time synchronization requests, and the current SNTP mode (i.e., unicast).
COMMAND LINE INTERFACE Default Setting None Command Mode Global Configuration Command Usage This command sets the local time zone relative to the Coordinated Universal Time (UTC, formerly Greenwich Mean Time or GMT), based on the earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC.
SYSTEM MANAGEMENT COMMANDS Default Setting None Command Mode Privileged Exec Example This example shows how to set the system clock to 15:12:34, February 1st, 2002. Console#calendar set 15 12 34 1 February 2002 Console# show calendar This command displays the system clock.
COMMAND LINE INTERFACE System Status Commands Table 4-23 System Status Commands Command Function show startup-config Displays the contents of the configuration file PE (stored in flash memory) that is used to start up the system Mode Page 4-76 show running-config Displays the configuration data currently in use PE 4-77 show system Displays system information NE, PE 4-80 show users Shows all active console and Telnet sessions, NE, including user name, idle time, and IP address PE of Telnet clie
SYSTEM MANAGEMENT COMMANDS - Users (names and access levels) VLAN database (VLAN ID, name and state) VLAN configuration settings for each interface Multiple spanning tree instances (name and interfaces) IP address configured for the switch Spanning tree settings Any configured settings for the console port and Telnet Example Console#show startup-config building startup-config, please wait.....
COMMAND LINE INTERFACE Command Mode Privileged Exec Command Usage • Use this command in conjunction with the show startup-config command to compare the information in running memory to the information stored in non-volatile memory. • This command displays settings for key command modes. Each mode group is separated by “!” symbols, and includes the configuration mode command, and corresponding commands.
SYSTEM MANAGEMENT COMMANDS Example Console#show running-config building running-config, please wait.....
COMMAND LINE INTERFACE show system This command displays system information. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage • For a description of the items shown by this command, refer to “Displaying System Information” on page 3-12. • The POST results should all display “PASS.” If any POST test indicates “FAIL,” contact your distributor for assistance. Example Console#show system System description: SMC8748M/SMC8724M System OID string: 1.3.6.1.4.1.202.20.
SYSTEM MANAGEMENT COMMANDS show users Shows all active console and Telnet sessions, including user name, idle time, and IP address of Telnet client. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The session used to execute this command is indicated by a “*” symbol next to the Line (i.e., session) index number.
COMMAND LINE INTERFACE Command Mode Normal Exec, Privileged Exec Command Usage See “Displaying Switch Hardware/Software Versions” on page 3-14 for detailed information on the items displayed by this command. Example Console#show version Unit 1 Serial number: Hardware version: EPLD version: Number of ports: Main power status: Redundant power status: A429048179 R01 15.15 48 up not present Agent (master) Unit ID: Loader version: Boot ROM version: Operation code version: 1 1.0.1.3 1.0.1.4 1.0.0.
SYSTEM MANAGEMENT COMMANDS Command Mode Global Configuration Command Usage • This switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields. • To use jumbo frames, both the source and destination end nodes (such as a computer or server) must support this feature.
COMMAND LINE INTERFACE Flash/File Commands These commands are used to manage the system code or configuration files.
FLASH/FILE COMMANDS • https-certificate - Keyword that allows you to copy the HTTPS secure site certificate. • public-key - Keyword that allows you to copy a SSH key from a TFTP server. (See “Secure Shell Commands” on page 4-44.) • unit - Keyword that allows you to copy to/from a specific unit in the stack. Default Setting None Command Mode Privileged Exec Command Usage • The system prompts for data required to complete the copy command.
COMMAND LINE INTERFACE Example The following example shows how to upload the configuration settings to a file on the TFTP server: Console#copy file tftp Choose file type: 1. config: 2. opcode: <1-2>: 1 Source file name: startup TFTP server ip address: 10.1.0.99 Destination file name: startup.01 TFTP completed. Success. Console# The following example shows how to copy the running configuration to a startup file. Console#copy running-config file destination file name: startup Write to FLASH Programming.
FLASH/FILE COMMANDS This example shows how to copy a public-key used by SSH from an TFTP server. Note that public key authentication via SSH is only supported for users configured locally on the switch. Console#copy tftp public-key TFTP server IP address: 192.168.1.19 Choose public key type: 1. RSA: 2. DSA: <1-2>: 1 Source file name: steve.pub Username: steve TFTP Download Success. Write to FLASH Programming. Success. Console# delete This command deletes a file or image.
COMMAND LINE INTERFACE Example This example shows how to delete the test2.cfg configuration file from flash memory. Console#delete test2.cfg Console# Related Commands dir (4-88) delete public-key (4-51) dir This command displays a list of files in flash memory. Syntax dir [unit:] [boot-rom | config | opcode [:filename]] The type of file or image to display includes: • • • • boot-rom - Boot ROM (or diagnostic) image file. config - Switch configuration file. opcode - Run-time operation code image file.
FLASH/FILE COMMANDS Command Usage • If you enter the command dir without any parameters, the system displays all files. • A colon (:) is required after the specified unit number. • File information is shown below: Table 4-26 File Directory Information Column Heading Description file name The name of the file. file type File types: Boot-Rom, Operation Code, and Config file. startup Shows if this file is used when the system is started. size The length of the file in bytes.
COMMAND LINE INTERFACE Command Mode Privileged Exec Example This example shows the information displayed by the whichboot command. See the table under the dir command for a description of the file information displayed by this command.
AUTHENTICATION COMMANDS Example Console(config)#boot system config: startup Console(config)# Related Commands dir (4-88) whichboot (4-89) Authentication Commands You can configure this switch to authenticate users logging into the system for management access using local or remote authentication methods. You can also enable port-based authentication for network client access using IEEE 802.1X.
COMMAND LINE INTERFACE authentication login This command defines the login authentication method and precedence. Use the no form to restore the default. Syntax authentication login {[local] [radius] [tacacs]} no authentication login • local - Use local password. • radius - Use RADIUS server password. • tacacs - Use TACACS server password. Default Setting Local Command Mode Global Configuration Command Usage • RADIUS uses UDP while TACACS+ uses TCP.
AUTHENTICATION COMMANDS Example Console(config)#authentication login radius Console(config)# Related Commands username - for setting the local user names and passwords (4-34) authentication enable This command defines the authentication method and precedence to use when changing from Exec command mode to Privileged Exec command mode with the enable command (see page 4-26). Use the no form to restore the default.
COMMAND LINE INTERFACE • You can specify three authentication methods in a single command to indicate the authentication sequence. For example, if you enter “authentication enable radius tacacs local,” the user name and password on the RADIUS server is verified first. If the RADIUS server is not available, then authentication is attempted on the TACACS+ server. If the TACACS+ server is not available, the local user name and password is checked.
AUTHENTICATION COMMANDS radius-server host This command specifies primary and backup RADIUS servers and authentication parameters that apply to each server. Use the no form to restore the default values. Syntax [no] radius-server index host {host_ip_address | host_alias} [auth-port auth_port] [timeout timeout] [retransmit retransmit] [key key] • index - Allows you to specific up to five servers. These servers are queried in sequence until a server responds or the retransmit period expires.
COMMAND LINE INTERFACE radius-server port This command sets the RADIUS server network port. Use the no form to restore the default. Syntax radius-server port port_number no radius-server port port_number - RADIUS server UDP port used for authentication messages. (Range: 1-65535) Default Setting 1812 Command Mode Global Configuration Example Console(config)#radius-server port 181 Console(config)# radius-server key This command sets the RADIUS encryption key. Use the no form to restore the default.
AUTHENTICATION COMMANDS Example Console(config)#radius-server key green Console(config)# radius-server retransmit This command sets the number of retries. Use the no form to restore the default. Syntax radius-server retransmit number_of_retries no radius-server retransmit number_of_retries - Number of times the switch will try to authenticate logon access via the RADIUS server.
COMMAND LINE INTERFACE Command Mode Global Configuration Example Console(config)#radius-server timeout 10 Console(config)# show radius-server This command displays the current settings for the RADIUS server.
AUTHENTICATION COMMANDS Table 4-30 TACACS+ Client Commands Command Function Mode Page tacacs-server host Specifies the TACACS+ server GC 4-99 tacacs-server port Specifies the TACACS+ server network GC port 4-100 tacacs-server key Sets the TACACS+ encryption key GC 4-100 show tacacs-server Shows the current TACACS+ settings GC 4-101 tacacs-server host This command specifies the TACACS+ server. Use the no form to restore the default.
COMMAND LINE INTERFACE tacacs-server port This command specifies the TACACS+ server network port. Use the no form to restore the default. Syntax tacacs-server port port_number no tacacs-server port port_number - TACACS+ server TCP port used for authentication messages. (Range: 1-65535) Default Setting 49 Command Mode Global Configuration Example Console(config)#tacacs-server port 181 Console(config)# tacacs-server key This command sets the TACACS+ encryption key. Use the no form to restore the default.
AUTHENTICATION COMMANDS Example Console(config)#tacacs-server key green Console(config)# show tacacs-server This command displays the current settings for the TACACS+ server. Default Setting None Command Mode Privileged Exec Example Console#show tacacs-server Remote TACACS server configuration: Server IP address: 10.11.12.13 Communication key with TACACS server: ***** Server port number: 49 Console# Port Security Commands These commands can be used to enable port security on a port.
COMMAND LINE INTERFACE Table 4-31 Port Security Commands Command Function Mode Page port security Configures a secure port IC 4-102 mac-address-table static Maps a static address to a port in a VLAN GC 4-206 show mac-address-table Displays entries in the bridge-forwarding database PE 4-208 port security This command enables or configures port security. Use the no form without any keywords to disable port security.
AUTHENTICATION COMMANDS Command Usage • If you enable port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table will be accepted. • First use the port security max-mac-count command to set the number of addresses, and then use the port security command to enable security on the port.
COMMAND LINE INTERFACE 802.1X Port Authentication The switch supports IEEE 802.1X (dot1x) port-based access control that prevents unauthorized access to the network by requiring users to first submit credentials for authentication. Client authentication is controlled centrally by a RADIUS server using EAP (Extensible Authentication Protocol). Table 4-32 802.1X Port Authentication Commands 4-104 Command Function Mode Page dot1x system-auth-control Enables dot1x globally on the switch.
AUTHENTICATION COMMANDS dot1x system-auth-control This command enables IEEE 802.1X port authentication globally on the switch. Use the no form to restore the default. Syntax [no] dot1x system-auth-control Default Setting Disabled Command Mode Global Configuration Example Console(config)#dot1x system-auth-control Console(config)# dot1x default This command sets all configurable dot1x global and port settings to their default values.
COMMAND LINE INTERFACE dot1x max-req This command sets the maximum number of times the switch port will retransmit an EAP request/identity packet to the client before it times out the authentication session. Use the no form to restore the default.
AUTHENTICATION COMMANDS Default force-authorized Command Mode Interface Configuration Example Console(config)#interface eth 1/2 Console(config-if)#dot1x port-control auto Console(config-if)# dot1x operation-mode This command allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. Use the no form with no keywords to restore the default to single host. Use the no form with the multi-host max-count keywords to restore the default maximum count.
COMMAND LINE INTERFACE • In “multi-host” mode, only one host connected to a port needs to pass authentication for all other hosts to be granted network access. Similarly, a port can become unauthorized for all hosts if one attached host fails re-authentication or sends an EAPOL logoff message.
AUTHENTICATION COMMANDS Example Console(config)#interface eth 1/2 Console(config-if)#dot1x re-authentication Console(config-if)# dot1x timeout quiet-period This command sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. Use the no form to reset the default. Syntax dot1x timeout quiet-period seconds no dot1x timeout quiet-period seconds - The number of seconds.
COMMAND LINE INTERFACE Command Mode Interface Configuration Example Console(config)#interface eth 1/2 Console(config-if)#dot1x timeout re-authperiod 300 Console(config-if)# dot1x timeout tx-period This command sets the time that the switch waits during an authentication session before re-transmitting an EAP packet. Use the no form to reset to the default value. Syntax dot1x timeout tx-period seconds no dot1x timeout tx-period seconds - The number of seconds.
AUTHENTICATION COMMANDS • interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) Command Mode Privileged Exec Command Usage This command displays the following information: • Global 802.1X Parameters – Shows whether or not 802.1X port authentication is globally enabled on the switch. • 802.1X Port Summary – Displays the port access control parameters for each interface that has enabled 802.
COMMAND LINE INTERFACE - Port-control –Shows the dot1x mode on a port as auto, force-authorized, or force-unauthorized (page 4-106). - Supplicant – MAC address of authorized client. - Current Identifier – The integer (0-255) used by the Authenticator to identify the current authentication session. • Authenticator State Machine - State – Current state (including initialize, disconnected, connecting, authenticating, authenticated, aborting, held, force_authorized, force_unauthorized).
AUTHENTICATION COMMANDS Example Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name 1/1 1/2 . . . 1/25 1/26 Status disabled disabled disabled enabled Operation Mode Single-Host Single-Host Single-Host Single-Host Mode Authorized ForceAuthorized n/a ForceAuthorized n/a ForceAuthorized Auto yes yes 802.1X Port Details 802.1X is enabled on port 1/1 . . . 802.
COMMAND LINE INTERFACE Access Control List Commands Access Control Lists (ACL) provide packet filtering for IP frames (based on address, protocol, Layer 4 protocol port number or TCP control code) or any frames (based on MAC address or Ethernet type). To filter packets, first create an access list, add the required rules, specify a mask to modify the precedence in which the rules are checked, and then bind the list to a specific port.
ACCESS CONTROL LIST COMMANDS The following restrictions apply to ACLs: • This switch supports ACLs for both ingress and egress filtering. However, you can only bind one IP ACL and one MAC ACL to any port for ingress filtering, and one IP ACL and one MAC ACL to any port for egress filtering. In other words, only four ACLs can be bound to an interface – Ingress IP ACL, Egress IP ACL, Ingress MAC ACL and Egress MAC ACL.
COMMAND LINE INTERFACE Masks for Access Control Lists You must specify optional masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/ filter packets matching the permit/deny rules specified in an ingress ACL. You can also configure up to seven user-defined masks for an ACL. A mask must be bound exclusively to one of the basic ACL types (i.e.
ACCESS CONTROL LIST COMMANDS Table 4-34 IP ACL Commands (Continued) Command Function access-list ip mask-precedence Changes to the IP Mask mode used to GC configure access control masks 4-123 mask Sets a precedence mask for the ACL rules 4-124 show access-list ip mask-precedence Shows the ingress or egress rule masks PE for IP ACLs ip access-group Adds a port to an IP ACL IC 4-128 show ip access-group Shows port assignments for IP ACLs PE 4-128 map access-list ip Sets the CoS value and co
COMMAND LINE INTERFACE Default Setting None Command Mode Global Configuration Command Usage • An egress ACL must contain all deny rules. • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To create an ACL, you must add at least one rule to the list. • To remove a rule, use the no permit or no deny command followed by the exact text of a previously configured rule. • An ACL can contain up to 32 rules.
ACCESS CONTROL LIST COMMANDS Default Setting None Command Mode Standard ACL Command Usage • New rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match” and 0 bits to indicate “ignore.
COMMAND LINE INTERFACE permit, deny (Extended ACL) This command adds a rule to an Extended IP ACL. The rule sets a filter condition for packets with specific source or destination IP addresses, protocol types, source or destination protocol ports, or TCP control codes. Use the no form to remove a rule.
ACCESS CONTROL LIST COMMANDS Command Mode Extended ACL Command Usage • All new rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match” and 0 bits to indicate “ignore.” The bitmask is bitwise ANDed with the specified source IP address, and then compared with the address for each IP packet entering the port(s) to which this ACL has been assigned.
COMMAND LINE INTERFACE Example This example accepts any incoming packets if the source address is within subnet 10.7.1.x. For example, if the rule is matched; i.e., the rule (10.7.1.0 & 255.255.255.0) equals the masked address (10.7.1.2 & 255.255.255.0), the packet passes through. Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any Console(config-ext-acl)# This allows TCP packets from class C addresses 192.168.1.0 to any destination address when set for destination TCP port 80 (i.e., HTTP).
ACCESS CONTROL LIST COMMANDS Example Console#show ip access-list standard IP standard access-list david: permit host 10.1.1.21 permit 168.92.0.0 0.0.15.255 Console# Related Commands permit, deny 4-118 ip access-group (4-128) access-list ip mask-precedence This command accesses the IP Mask mode used to configure access control masks. Use the no form to delete the mask table. Syntax [no] access-list ip mask-precedence {in | out} • in – Ingress mask for ingress ACLs. • out – Egress mask for egress ACLs.
COMMAND LINE INTERFACE Related Commands mask (IP ACL) (4-124) ip access-group (4-128) mask (IP ACL) This command defines a mask for IP ACLs. This mask defines the fields to check in the IP header. Use the no form to remove a mask. Syntax [no] mask [protocol] {any | host | source-bitmask} {any | host | destination-bitmask} [precedence] [tos] [dscp] [source-port [port-bitmask]] [destination-port [port-bitmask]] [control-flag [flag-bitmask]] • • • • • • • • • • • • • protocol – Check the protocol field.
ACCESS CONTROL LIST COMMANDS Command Usage • Packets crossing a port are checked against all the rules in the ACL until a match is found. The order in which these packets are checked is determined by the mask, and not the order in which the ACL rules were entered. • First create the required ACLs and ingress or egress masks before mapping an ACL to an interface. • If you enter dscp, you cannot enter tos or precedence. You can enter both tos and precedence without dscp.
COMMAND LINE INTERFACE This shows how to create a standard ACL with an ingress mask to deny access to the IP host 171.69.198.102, and permit access to any others. Console(config)#access-list ip standard A2 Console(config-std-acl)#permit any Console(config-std-acl)#deny host 171.69.198.102 Console(config-std-acl)#end Console#show access-list IP standard access-list A2: deny host 171.69.198.
ACCESS CONTROL LIST COMMANDS This is a more comprehensive example. It denies any TCP packets in which the SYN bit is ON, and permits all other packets. It then sets the ingress mask to check the deny rule first, and finally binds port 1 to this ACL. Note that once the ACL is bound to an interface (i.e., the ACL is active), the order in which the rules are displayed is determined by the associated mask.
COMMAND LINE INTERFACE Command Mode Privileged Exec Example Console#show access-list ip mask-precedence IP ingress mask ACL: mask host any mask 255.255.255.0 any Console# Related Commands mask (IP ACL) (4-124) ip access-group This command binds a port to an IP ACL. Use the no form to remove the port. Syntax [no] ip access-group acl_name {in | out} • acl_name – Name of the ACL. (Maximum length: 16 characters) • in – Indicates that this list applies to ingress packets.
ACCESS CONTROL LIST COMMANDS Example Console(config)#int eth 1/25 Console(config-if)#ip access-group standard david in Console(config-if)# Related Commands show ip access-list (4-122) show ip access-group This command shows the ports assigned to IP ACLs.
COMMAND LINE INTERFACE Command Mode Interface Configuration (Ethernet) Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown in the following table. For information on mapping the CoS values to output queues, see queue cos-map on 4-263.
ACCESS CONTROL LIST COMMANDS Command Mode Privileged Exec Example Console#show map access-list ip Access-list to COS of Eth 1/24 Access-list ALS1 cos 0 Console# Related Commands map access-list ip (4-129) match access-list ip This command changes the IEEE 802.1p priority, IP Precedence, or DSCP Priority of a frame matching the defined ACL rule. (This feature is commonly referred to as ACL packet marking.) Use the no form to remove the ACL marker.
COMMAND LINE INTERFACE • Traffic priorities may be included in the IEEE 802.1p priority tag. This tag is also incorporated as part of the overall IEEE 802.1Q VLAN tag. To specify this priority, use the set priority keywords. • The IP frame header also includes priority bits in the Type of Service (ToS) octet. The Type of Service octet may contain three bits for IP Precedence or six bits for Differentiated Services Code Point (DSCP) service. To specify the IP precedence priority, use the set tos keywords.
ACCESS CONTROL LIST COMMANDS MAC ACLs Table 4-36 MAC ACL Commands Command Function Mode Page access-list mac Creates a MAC ACL and enters configuration mode GC 4-134 permit, deny Filters packets matching a specified MAC-ACL source and destination address, packet format, and Ethernet type 4-135 show mac access-list Displays the rules for configured MAC ACLs PE 4-137 access-list mac mask-precedence Accesses the mode for configuring access control masks GC 4-137 mask Sets a precedence mask f
COMMAND LINE INTERFACE access-list mac This command adds a MAC access list and enters MAC ACL configuration mode. Use the no form to remove the specified ACL. Syntax [no] access-list mac acl_name acl_name – Name of the ACL. (Maximum length: 16 characters) Default Setting None Command Mode Global Configuration Command Usage • An egress ACL must contain all deny rules.
ACCESS CONTROL LIST COMMANDS permit, deny (MAC ACL) This command adds a rule to a MAC ACL. The rule filters packets matching a specified MAC source or destination address (i.e., physical layer address), or Ethernet protocol type. Use the no form to remove a rule. Syntax [no] {permit | deny} {any | host source | source address-bitmask} {any | host destination | destination address-bitmask} [vid vid vid-bitmask] [ethertype protocol [protocol-bitmask]] Note:- The default is for Ethernet II packets.
COMMAND LINE INTERFACE • address-bitmask14 – Bitmask for MAC address (in hexidecimal format). • vid – VLAN ID. (Range: 1-4095) • vid-bitmask14 – VLAN bitmask. (Range: 1-4095) • protocol – A specific Ethernet protocol number. (Range: 600-fff hex.) • protocol-bitmask14 – Protocol bitmask. (Range: 600-fff hex.) Default Setting None Command Mode MAC ACL Command Usage • New rules are added to the end of the list. • The ethertype option can only be used to filter Ethernet II formatted packets.
ACCESS CONTROL LIST COMMANDS show mac access-list This command displays the rules for configured MAC ACLs. Syntax show mac access-list [acl_name] acl_name – Name of the ACL.
COMMAND LINE INTERFACE Command Usage • You must configure a mask for an ACL rule before you can bind it to a port or set the queue or frame priorities associated with the rule. • A mask can only be used by all ingress ACLs or all egress ACLs. • The precedence of the ACL rules applied to a packet is not determined by order of the rules, but instead by the order of the masks; i.e., the first mask that matches a rule will determine the rule that is applied to a packet.
ACCESS CONTROL LIST COMMANDS • ethertype – Check the Ethernet type field. • ethertype-bitmask – Ethernet type of rule must match this bitmask. Default Setting None Command Mode MAC Mask Command Usage • Up to seven masks can be assigned to an ingress or egress ACL. • Packets crossing a port are checked against all the rules in the ACL until a match is found. The order in which these packets are checked is determined by the mask, and not the order in which the ACL rules were entered.
COMMAND LINE INTERFACE This example creates an Egress MAC ACL. Console(config)#access-list mac M5 Console(config-mac-acl)#deny tagged-802.3 host 00-11-11-11-11-11 any Console(config-mac-acl)#deny tagged-eth2 00-11-11-11-11-11 ff-ff-ff-ff-ff-ff any vid 3 ethertype 0806 Console(config-mac-acl)#end Console#show access-list MAC access-list M5: deny tagged-802.
ACCESS CONTROL LIST COMMANDS mac access-group This command binds a port to a MAC ACL. Use the no form to remove the port. Syntax mac access-group acl_name {in | out} • acl_name – Name of the ACL. (Maximum length: 16 characters) • in – Indicates that this list applies to ingress packets. • out – Indicates that this list applies to egress packets. Default Setting None Command Mode Interface Configuration (Ethernet) Command Usage • A port can only be bound to one ACL.
COMMAND LINE INTERFACE Example Console#show mac access-group Interface ethernet 1/5 MAC access-list M5 out Console# Related Commands mac access-group (4-141) map access-list mac This command sets the output queue for packets matching an ACL rule. The specified CoS value is only used to map the matching packet to an output queue; it is not written to the packet itself. Use the no form to remove the CoS mapping. Syntax [no] map access-list mac acl_name cos cos-value • acl_name – Name of the ACL.
ACCESS CONTROL LIST COMMANDS Example Console(config)#int eth 1/5 Console(config-if)#map access-list mac M5 cos 0 Console(config-if)# Related Commands queue cos-map (4-263) show map access-list mac (4-143) show map access-list mac This command shows the CoS value mapped to a MAC ACL for the current interface. (The CoS value determines the output queue for packets matching an ACL rule.) Syntax show map access-list mac [interface] interface ethernet unit/port • unit - Stack unit.
COMMAND LINE INTERFACE match access-list mac This command changes the IEEE 802.1p priority of a Layer 2 frame matching the defined ACL rule. (This feature is commonly referred to as ACL packet marking.) Use the no form to remove the ACL marker. Syntax match access-list mac acl_name set priority priority no match access-list mac acl_name • acl_name – Name of the ACL. (Maximum length: 16 characters) • priority – Class of Service value in the IEEE 802.1p priority tag.
ACCESS CONTROL LIST COMMANDS show access-list This command shows all ACLs and associated rules, as well as all the user-defined masks. Command Mode Privileged Exec Command Usage Once the ACL is bound to an interface (i.e., the ACL is active), the order in which the rules are displayed is determined by the associated mask. Example Console#show access-list IP standard access-list david: permit host 10.1.1.21 permit 168.92.0.0 0.0.15.255 IP extended access-list bob: permit 10.7.1.1 255.255.255.
COMMAND LINE INTERFACE SNMP Commands Controls access to this switch from management stations using the Simple Network Management Protocol (SNMP), as well as the error types sent to trap managers. SNMP Version 3 also provides security features that cover message integrity, authentication, and encryption; as well as controlling user access to specific areas of the MIB tree.
SNMP COMMANDS Table 4-39 SNMP Commands (Continued) Command Function Mode Page snmp-server group Adds an SNMP group, mapping users to views GC 4-158 show snmp group Shows the SNMP groups PE 4-159 snmp-server user Adds a user to an SNMP group GC 4-161 show snmp user Shows the SNMP users PE 4-162 snmp-server This command enables the SNMPv3 engine and services for all management clients (i.e., versions 1, 2c, 3). Use the no form to disable the server.
COMMAND LINE INTERFACE show snmp This command can be used to check the status of SNMP communications. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage This command provides information on the community access strings, counter information for SNMP input and output protocol data units, and whether or not SNMP logging has been enabled with the snmp-server enable traps command.
SNMP COMMANDS snmp-server community This command defines the SNMP v1 and v2c community access string. Use the no form to remove the specified community string. Syntax snmp-server community string [ro|rw] no snmp-server community string • string - Community string that acts like a password and permits access to the SNMP protocol. (Maximum length: 32 characters, case sensitive; Maximum number of strings: 5) • ro - Specifies read-only access.
COMMAND LINE INTERFACE snmp-server contact This command sets the system contact string. Use the no form to remove the system contact information. Syntax snmp-server contact string no snmp-server contact string - String that describes the system contact information.
SNMP COMMANDS Command Mode Global Configuration Example Console(config)#snmp-server location WC-19 Console(config)# Related Commands snmp-server contact (4-150) snmp-server host This command specifies the recipient of a Simple Network Management Protocol notification operation. Use the no form to remove the specified host.
COMMAND LINE INTERFACE Default Setting • Host Address: None • SNMP Version: 1 • UDP Port: 162 Command Mode Global Configuration Command Usage • If you do not enter an snmp-server host command, no notifications are sent. In order to configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. In order to enable multiple hosts, you must issue a separate snmp-server host command for each host.
SNMP COMMANDS Example Console(config)#snmp-server host 10.1.19.23 batman Console(config)# Related Commands snmp-server enable traps (4-153) snmp-server enable traps This command enables this device to send Simple Network Management Protocol traps (SNMP notifications). Use the no form to disable SNMP notifications. Syntax [no] snmp-server enable traps [authentication | link-up-down] • authentication - Keyword to issue authentication failure traps.
COMMAND LINE INTERFACE Example Console(config)#snmp-server enable traps link-up-down Console(config)# Related Commands snmp-server host (4-151) snmp-server engine-id This command configures an identification string for the SNMPv3 engine. Use the no form to restore the default. Syntax snmp-server engine-id local engineid-string no snmp-server engine-id local engineid-string - String identifying the engine ID.
SNMP COMMANDS • A local engine ID is automatically generated that is unique to the switch. This is referred to as the default engine ID. If the local engine ID is deleted or changed, all SNMP users will be cleared. You will need to reconfigure all existing users (page 4-161). Example Console(config)#snmp-server engine-id local 12345 Console(config)# show snmp engine-id This command shows the SNMP engine ID. Command Mode Privileged Exec Example This example shows the default engine ID.
COMMAND LINE INTERFACE snmp-server view This command adds an SNMP view which controls user access to the MIB. Use the no form to remove an SNMP view. Syntax snmp-server view view-name oid-tree {included | excluded} no snmp-server view view-name • view-name - Name of an SNMP view. (Range: 1-64 characters) • oid-tree - Object identifier of a branch within the MIB tree. Wild cards can be used to mask a specific portion of the OID string. (Refer to the examples.) • included - Defines an included view.
SNMP COMMANDS This view includes the MIB-2 interfaces table, and the mask selects all index entries. Console(config)#snmp-server view ifEntry.a 1.3.6.1.2.1.2.2.1.1.* included Console(config)# show snmp view This command shows information on the SNMP views. Command Mode Privileged Exec Example Console#show snmp view View Name: mib-2 Subtree OID: 1.2.2.3.6.2.
COMMAND LINE INTERFACE snmp-server group This command adds an SNMP group, mapping SNMP users to SNMP views. Use the no form to remove an SNMP group. Syntax snmp-server group groupname {v1 | v2c | v3 {auth | noauth | priv}} [read readview] [write writeview] no snmp-server group groupname • groupname - Name of an SNMP group. (Range: 1-32 characters) • v1 | v2c | v3 - Use SNMP version 1, 2c or 3.
SNMP COMMANDS Example Console(config)#snmp-server group r&d v3 auth write daily Console(config)# show snmp group Four default groups are provided – SNMPv1 read-only access and read/ write access, and SNMPv2c read-only access and read/write access.
COMMAND LINE INTERFACE Example Console#show snmp group Group Name: r&d Security Model: v3 Read View: mib-2 Write View: 802.
SNMP COMMANDS Table 4-42 show snmp group - display description Field Description writeview The associated write view. notifyview The associated notify view. storage-type The storage type for this entry. Row Status The row status of this entry. snmp-server user This command adds a user to an SNMP group, restricting the user to a specific SNMP Read and a Write View. Use the no form to remove a user from an SNMP group.
COMMAND LINE INTERFACE Command Mode Global Configuration Command Usage • The SNMP engine ID is used to compute the authentication/privacy digests from the password. You should therefore configure the engine ID with the snmp-server engine-id command before using this configuration command. • SNMP passwords are localized using the authoritative SNMP engine ID.
DNS COMMANDS Table 4-43 show snmp user - display description Field Description Privacy Protocol The privacy protocol used with SNMPv3. Storage Type The storage type for this entry. Row Status The row status of this entry. DNS Commands These commands are used to configure Domain Naming System (DNS) services.
COMMAND LINE INTERFACE Table 4-44 DNS Commands (Continued) Command Function Mode Page show dns Displays the configuration for DNS services PE 4-171 show dns cache Displays entries in the DNS cache PE 4-171 clear dns cache Clears all entries from the DNS cache PE 4-172 ip host This command creates a static entry in the DNS table that maps a host name to an IP address. Use the no form to remove an entry. Syntax [no] ip host name address1 [address2 … address8] • name - Name of the host.
DNS COMMANDS Example This example maps two address to a host name. Console(config)#ip host rd5 192.168.1.55 10.1.0.55 Console(config)#end Console#show hosts Hostname rd5 Inet address 10.1.0.55 192.168.1.55 Alias Console# clear host This command deletes entries from the DNS table. Syntax clear host {name | *} • name - Name of the host. (Range: 1-64 characters) • * - Removes all entries. Default Setting None Command Mode Privileged Exec Example This example clears all static entries from the DNS table.
COMMAND LINE INTERFACE ip domain-name This command defines the default domain name appended to incomplete host names (i.e., host names passed from a client that are not formatted with dotted notation). Use the no form to remove the current domain name. Syntax ip domain-name name no ip domain-name name - Name of the host. Do not include the initial dot that separates the host name from the domain name.
DNS COMMANDS ip domain-list This command defines a list of domain names that can be appended to incomplete host names (i.e., host names passed from a client that are not formatted with dotted notation). Use the no form to remove a name from this list. Syntax [no] ip domain-list name name - Name of the host. Do not include the initial dot that separates the host name from the domain name.
COMMAND LINE INTERFACE Example This example adds two domain names to the current list and then displays the list. Console(config)#ip domain-list sample.com.jp Console(config)#ip domain-list sample.com.uk Console(config)#end Console#show dns Domain Lookup Status: DNS disabled Default Domain Name: .sample.com Domain Name List: .sample.com.jp .sample.com.
DNS COMMANDS Example This example adds two domain-name servers to the list and then displays the list. Console(config)#ip name-server 192.168.1.55 10.1.0.55 Console(config)#end Console#show dns Domain Lookup Status: DNS disabled Default Domain Name: sample.com Domain Name List: sample.com.jp sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# Related Commands ip domain-name (4-166) ip domain-lookup (4-169) ip domain-lookup This command enables DNS host name-to-address translation.
COMMAND LINE INTERFACE Example This example enables DNS and then displays the configuration. Console(config)#ip domain-lookup Console(config)#end Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: .sample.com Domain Name List: .sample.com.jp .sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# Related Commands ip domain-name (4-166) ip name-server (4-168) show hosts This command displays the static host name-to-address mapping table.
DNS COMMANDS show dns This command displays the configuration of the DNS server. Command Mode Privileged Exec Example Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: sample.com Domain Name List: sample.com.jp sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# show dns cache This command displays entries in the DNS cache. Command Mode Privileged Exec Example Console#show dns cache NO FLAG TYPE IP 0 4 CNAME 10.2.44.96 1 4 CNAME 10.2.44.3 2 4 CNAME 66.218.71.
COMMAND LINE INTERFACE Field Description NO The entry number for each resource record. FLAG The flag is always “4” indicating a cache entry and therefore unreliable. TYPE This field includes CNAME which specifies the canonical or primary name for the owner, and ALIAS which specifies multiple domain names which are mapped to the same IP address as an existing entry. IP The IP address associated with this record. TTL The time to live reported by the name server.
INTERFACE COMMANDS Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN.
COMMAND LINE INTERFACE interface This command configures an interface type and enter interface configuration mode. Use the no form to remove a trunk. Syntax interface interface no interface port-channel channel-id • interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
INTERFACE COMMANDS Command Mode Interface Configuration (Ethernet, Port Channel) Example The following example adds a description to port 24. Console(config)#interface ethernet 1/24 Console(config-if)#description RD-SW#3 Console(config-if)# speed-duplex This command configures the speed and duplex mode of a given interface when autonegotiation is disabled. Use the no form to restore the default.
COMMAND LINE INTERFACE • When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command. To set the speed/duplex mode under auto-negotiation, the required mode must be specified in the capabilities list for an interface. Example The following example configures port 5 to 100 Mbps, half-duplex operation.
INTERFACE COMMANDS Example The following example configures port 11 to use autonegotiation. Console(config)#interface ethernet 1/11 Console(config-if)#negotiation Console(config-if)# Related Commands capabilities (4 -177) speed-duplex (4 -175) capabilities This command advertises the port capabilities of a given interface during autonegotiation. Use the no form with parameters to remove an advertised capability, or the no form without parameters to restore the default values.
COMMAND LINE INTERFACE Command Usage When auto-negotiation is enabled with the negotiation command, the switch will negotiate the best settings for a link based on the capabilites command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands. Example The following example configures Ethernet port 5 capabilities to 100half, 100full and flow control.
INTERFACE COMMANDS • To force flow control on or off (with the flowcontrol or no flowcontrol command), use the no negotiation command to disable auto-negotiation on the selected interface. • When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command.
COMMAND LINE INTERFACE Default Setting sfp-preferred-auto Command Mode Interface Configuration (Ethernet) Example This forces the switch to use the built-in RJ-45 port for the combination port 21. Console(config)#interface ethernet 1/21 Console(config-if)#combo-forced-mode copper-forced Console(config-if)# shutdown This command disables an interface. To restart a disabled interface, use the no form. Syntax [no] shutdown Default Setting All interfaces are enabled.
INTERFACE COMMANDS switchport broadcast packet-rate This command configures broadcast storm control. Use the no form to disable broadcast storm control. Syntax switchport broadcast packet-rate rate no switchport broadcast rate - Threshold level as a rate; i.e., packets per second.
COMMAND LINE INTERFACE clear counters This command clears statistics on an interface. Syntax clear counters interface interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) Default Setting None Command Mode Privileged Exec Command Usage Statistics are only initialized for a power reset. This command sets the base value for displayed statistics to zero for the current management session.
INTERFACE COMMANDS show interfaces status This command displays the status for an interface. Syntax show interfaces status [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) • vlan vlan-id (Range: 1-4093) Default Setting Shows the status for all interfaces. Command Mode Normal Exec, Privileged Exec Command Usage If no interface is specified, information on all interfaces is displayed.
COMMAND LINE INTERFACE Example Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: 1000T Mac address: 00-30-F1-D4-73-A5 Configuration: Name: Port admin: Up Speed-duplex: Auto Capabilities: 10half, 10full, 100half, 100full, 1000full Broadcast storm: Enabled Broadcast storm limit: 500 packets/second Flow control: Disabled LACP: Disabled Port security: Disabled Max MAC count: 0 Port security action: None Media type: None Current status: Link status: Up Port operatio
INTERFACE COMMANDS Command Usage If no interface is specified, information on all interfaces is displayed. For a description of the items displayed by this command, see “Showing Port Statistics” on page 3-127.
COMMAND LINE INTERFACE show interfaces switchport This command displays the administrative and operational status of the specified interfaces. Syntax show interfaces switchport [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) Default Setting Shows all interfaces. Command Mode Normal Exec, Privileged Exec Command Usage If no interface is specified, information on all interfaces is displayed.
INTERFACE COMMANDS Table 4-46 show interfaces switchport - display description Field Description Broadcast threshold Shows if broadcast storm suppression is enabled or disabled; if enabled it also shows the threshold level (page 4-181). LACP status Shows if Link Aggregation Control Protocol has been enabled or disabled (page 4-194). Ingress/Egress rate limit Shows if rate limiting is enabled, and the current rate limit. (page 4-191).
COMMAND LINE INTERFACE Mirror Port Commands This section describes how to mirror traffic from a source port to a target port. Table 4-47 Mirror Port Commands Command Function port monitor Configures a mirror session show port monitor Shows the configuration for a mirror port Mode Page IC 4-188 PE 4-189 port monitor This command configures a mirror session. Use the no form to clear a mirror session.
MIRROR PORT COMMANDS Command Usage • You can mirror traffic from any source port to a destination port for real-time analysis. You can then attach a logic analyzer or RMON probe to the destination port and study the traffic crossing the source port in a completely unobtrusive manner. • The destination port is set by specifying an Ethernet interface. • The mirror port and monitor port speeds should match, otherwise traffic may be dropped from the monitor port.
COMMAND LINE INTERFACE Example The following shows mirroring configured from port 6 to port 11.
RATE LIMIT COMMANDS rate-limit This command defines the rate limit for a specific interface. Use this command without specifying a rate to restore the default rate. Use the no form to restore the default status of disabled. Syntax rate-limit {input | output} [rate] no rate-limit {input | output} • input – Input rate • output – Output rate • rate – Maximum value in Mbps.
COMMAND LINE INTERFACE Link Aggregation Commands Ports can be statically grouped into an aggregate link (i.e., trunk) to increase the bandwidth of a network connection or to ensure fault recovery. Or you can use the Link Aggregation Control Protocol (LACP) to automatically negotiate a trunk link between this switch and another network device. For static trunks, the switches have to comply with the Cisco EtherChannel standard. For dynamic trunks, the switches have to comply with LACP.
LINK AGGREGATION COMMANDS Guidelines for Creating Trunks General Guidelines – • Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • A trunk can have up to 32 ports. • The ports at both ends of a connection must be configured as trunk ports. • All ports in a trunk must be configured in an identical manner, including communication mode (i.e., speed, duplex mode and flow control), VLAN assignments, and CoS settings.
COMMAND LINE INTERFACE channel-group This command adds a port to a trunk. Use the no form to remove a port from a trunk. Syntax channel-group channel-id no channel-group channel-id - Trunk index (Range: 1-32) Default Setting The current port will be added to this trunk. Command Mode Interface Configuration (Ethernet) Command Usage • When configuring static trunks, the switches must comply with the Cisco EtherChannel standard. • Use no channel-group to remove a port group from a trunk.
LINK AGGREGATION COMMANDS Command Mode Interface Configuration (Ethernet) Command Usage • The ports on both ends of an LACP trunk must be configured for full duplex, either by forced mode or auto-negotiation. • A trunk formed with another switch using LACP will automatically be assigned the next available port-channel ID. • If the target switch has also enabled LACP on the connected ports, the trunk will be activated automatically.
COMMAND LINE INTERFACE Example The following shows LACP enabled on ports 10-12. Because LACP has also been enabled on the ports at the other end of the links, the show interfaces status port-channel 1 command shows that Trunk1 has been established.
LINK AGGREGATION COMMANDS lacp system-priority This command configures a port's LACP system priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} system-priority priority no lacp {actor | partner} system-priority • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. • priority - This priority is used to determine link aggregation group (LAG) membership, and to identify this device to other switches during LAG negotiations.
COMMAND LINE INTERFACE lacp admin-key (Ethernet Interface) This command configures a port's LACP administration key. Use the no form to restore the default setting. Syntax lacp {actor | partner} admin-key key [no] lacp {actor | partner} admin-key • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. • key - The port admin key must be set to the same value for ports that belong to the same link aggregation group (LAG).
LINK AGGREGATION COMMANDS lacp admin-key (Port Channel) This command configures a port channel's LACP administration key string. Use the no form to restore the default setting. Syntax lacp admin-key key [no] lacp admin-key key - The port channel admin key is used to identify a specific link aggregation group (LAG) during local LACP setup on this switch.
COMMAND LINE INTERFACE lacp port-priority This command configures LACP port priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} port-priority priority no lacp {actor | partner} port-priority • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. • priority - LACP port priority is used to select a backup link.
LINK AGGREGATION COMMANDS show lacp This command displays LACP information. Syntax show lacp [port-channel] {counters | internal | neighbors | sys-id} • port-channel - Local identifier for a link aggregation group. (Range: 1-6) • counters - Statistics for LACP protocol messages. • internal - Configuration settings and operational state for local side. • neighbors - Configuration settings and operational state for remote side. • sys-id - Summary of system priority and MAC address for all channel groups.
COMMAND LINE INTERFACE Table 4-50 show lacp counters - display description Field Description LACPDUs Sent Number of valid LACPDUs transmitted from this channel group. LACPDUs Received Number of valid LACPDUs received on this channel group. Marker Sent Number of valid Marker PDUs transmitted from this channel group. Marker Received Number of valid Marker PDUs received by this channel group.
LINK AGGREGATION COMMANDS Table 4-51 show lacp internal - display description (Continued) Field Description LACPDUs Internal Number of seconds before invalidating received LACPDU information. LACP System Priority LACP system priority assigned to this port channel. LACP Port Priority LACP port priority assigned to this interface within the channel group.
COMMAND LINE INTERFACE Console#show lacp 1 neighbors Channel group 1 neighbors ------------------------------------------------------------------Eth 1/1 ------------------------------------------------------------------Partner Admin System ID: 32768, 00-00-00-00-00-00 Partner Oper System ID: 32768, 00-01-F4-78-AE-C0 Partner Admin Port Number: 2 Partner Oper Port Number: 2 Port Admin Priority: 32768 Port Oper Priority: 32768 Admin Key: 0 Oper Key: 3 Admin State: defaulted, distributing, collecting, synchroni
LINK AGGREGATION COMMANDS Console#show lacp 1 sysid Channel group System Priority System MAC Address ------------------------------------------------------------------1 32768 00-30-F1-8F-2C-A7 2 32768 00-30-F1-8F-2C-A7 3 32768 00-30-F1-8F-2C-A7 4 32768 00-30-F1-8F-2C-A7 5 32768 00-30-F1-8F-2C-A7 6 32768 00-30-F1-8F-2C-A7 7 32768 00-30-F1-D4-73-A0 8 32768 00-30-F1-D4-73-A0 9 32768 00-30-F1-D4-73-A0 10 32768 00-30-F1-D4-73-A0 11 32768 00-30-F1-D4-73-A0 12 32768 00-30-F1-D4-73-A0 . . .
COMMAND LINE INTERFACE Address Table Commands These commands are used to configure the address table for filtering specified addresses, displaying current entries, clearing the table, or setting the aging time.
ADDRESS TABLE COMMANDS • action - delete-on-reset - Assignment lasts until the switch is reset. - permanent - Assignment is permanent. Default Setting No static addresses are defined. The default mode is permanent. Command Mode Global Configuration Command Usage The static address for a host device can be assigned to a specific port within a specific VLAN. Use this command to add static addresses to the MAC Address Table.
COMMAND LINE INTERFACE Example Console#clear mac-address-table dynamic Console# show mac-address-table This command shows classes of entries in the bridge-forwarding database. Syntax show mac-address-table [address mac-address [mask]] [interface interface] [vlan vlan-id] [sort {address | vlan | interface}] • mac-address - MAC address. • mask - Bits to match in the address. • interface - ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
ADDRESS TABLE COMMANDS example, a mask of 00-00-00-00-00-00 means an exact match, and a mask of FF-FF-FF-FF-FF-FF means “any.” • The maximum number of address entries is 8191. Example Console#show mac-address-table Interface Mac Address Vlan --------- ----------------- ---Eth 1/ 1 00-00-00-00-00-17 1 Eth 1/ 1 00-E0-29-94-34-DE 1 Console# Type ----------------Learned Delete-on-reset mac-address-table aging-time This command sets the aging time for entries in the address table.
COMMAND LINE INTERFACE show mac-address-table aging-time This command shows the aging time for entries in the address table. Default Setting None Command Mode Privileged Exec Example Console#show mac-address-table aging-time Aging time: 300 sec. Console# Spanning Tree Commands This section includes commands that configure the Spanning Tree Algorithm (STA) globally for the switch, and commands that configure STA for the selected interface.
SPANNING TREE COMMANDS Table 4-55 Spanning Tree Commands (Continued) Command Function Mode Page spanning-tree mst configuration Accesses MSTP configuration mode GC 4-219 mst vlan Adds VLANs to a spanning tree instance MST 4-219 mst priority Configures the priority of a spanning tree instance MST 4-221 name Configures the name for the multiple spanning tree MST 4-222 revision Configures the revision number for the MST multiple spanning tree 4-222 max-hops Configures the maximum number
COMMAND LINE INTERFACE Table 4-55 Spanning Tree Commands (Continued) Command Function show spanning-tree Shows spanning tree configuration for PE the common spanning tree (i.e., overall bridge), a selected interface, or an instance within the multiple spanning tree show spanning-tree mst Shows the multiple spanning tree configuration configuration Mode Page PE 4-233 4-235 spanning-tree This command enables the Spanning Tree Algorithm globally for the switch. Use the no form to disable it.
SPANNING TREE COMMANDS spanning-tree mode This command selects the spanning tree mode for this switch. Use the no form to restore the default. Syntax spanning-tree mode {stp | rstp | mstp} no spanning-tree mode • stp - Spanning Tree Protocol (IEEE 802.1D) • rstp - Rapid Spanning Tree Protocol (IEEE 802.1w) • mstp - Multiple Spanning Tree (IEEE 802.1s) Default Setting rstp Command Mode Global Configuration Command Usage • Spanning Tree Protocol Uses RSTP for the internal state machine, but sends only 802.
COMMAND LINE INTERFACE - RSTP Mode – If RSTP is using 802.1D BPDUs on a port and receives an RSTP BPDU after the migration delay expires, RSTP restarts the migration delay timer and begins using RSTP BPDUs on that port. • Multiple Spanning Tree Protocol - To allow multiple spanning trees to operate over the network, you must configure a related set of bridges with the same MSTP configuration, allowing them to participate in a specific set of spanning tree instances.
SPANNING TREE COMMANDS Command Usage This command sets the maximum time (in seconds) the root device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to the discarding state; otherwise, temporary data loops might result.
COMMAND LINE INTERFACE spanning-tree max-age This command configures the spanning tree bridge maximum age globally for this switch. Use the no form to restore the default. Syntax spanning-tree max-age seconds no spanning-tree max-age seconds - Time in seconds. (Range: 6-40 seconds) The minimum value is the higher of 6 or [2 x (hello-time + 1)]. The maximum value is the lower of 40 or [2 x (forward-time - 1)].
SPANNING TREE COMMANDS spanning-tree priority This command configures the spanning tree priority globally for this switch. Use the no form to restore the default. Syntax spanning-tree priority priority no spanning-tree priority priority - Priority of the bridge.
COMMAND LINE INTERFACE Default Setting Long method Command Mode Global Configuration Command Usage The path cost method is used to determine the best path between devices. Therefore, lower values should be assigned to ports attached to faster media, and higher values assigned to ports with slower media. Note that path cost (page 4-225) takes precedence over port priority (page 4-226).
SPANNING TREE COMMANDS spanning-tree mst configuration Use this command to change to Multiple Spanning Tree (MST) configuration mode. Default Setting • No VLANs are mapped to any MST instance. • The region name is set the switch’s MAC address.
COMMAND LINE INTERFACE Command Mode MST Configuration Command Usage • Use this command to group VLANs into spanning tree instances. MSTP generates a unique spanning tree for each instance. This provides multiple pathways across the network, thereby balancing the traffic load, preventing wide-scale disruption when a bridge node in a single instance fails, and allowing for faster convergence of a new topology for the failed instance.
SPANNING TREE COMMANDS mst priority This command configures the priority of a spanning tree instance. Use the no form to restore the default. Syntax mst instance_id priority priority no mst instance_id priority • instance_id - Instance identifier of the spanning tree. (Range: 0-4094) • priority - Priority of the a spanning tree instance.
COMMAND LINE INTERFACE name This command configures the name for the multiple spanning tree region in which this switch is located. Use the no form to clear the name. Syntax name name name - Name of the spanning tree. Default Setting Switch’s MAC address Command Mode MST Configuration Command Usage The MST region name and revision number (page 4-222) are used to designate a unique MST region. A bridge (i.e., spanning-tree compliant device such as this switch) can only belong to one MST region.
SPANNING TREE COMMANDS Default Setting 0 Command Mode MST Configuration Command Usage The MST region name (page 4-222) and revision number are used to designate a unique MST region. A bridge (i.e., spanning-tree compliant device such as this switch) can only belong to one MST region. And all bridges in the same region must be configured with the same MST instances.
COMMAND LINE INTERFACE Command Usage A MSTI region is treated as a single node by the STP and RSTP protocols. Therefore, the message age for BPDUs inside a MSTI region is never changed. However, each spanning tree instance within a region, and the internal spanning tree (IST) that connects these instances use a hop count to specify the maximum number of bridges that will propagate a BPDU. Each bridge decrements the hop count by one before passing on the BPDU.
SPANNING TREE COMMANDS spanning-tree cost This command configures the spanning tree path cost for the specified interface. Use the no form to restore the default. Syntax spanning-tree cost cost no spanning-tree cost cost cost - The path cost for the port.
COMMAND LINE INTERFACE spanning-tree port-priority This command configures the priority for the specified interface. Use the no form to restore the default. Syntax spanning-tree port-priority priority no spanning-tree port-priority priority priority - The priority for a port. (Range: 0-240, in steps of 16) Default Setting 128 Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command defines the priority for the use of a port in the Spanning Tree Algorithm.
SPANNING TREE COMMANDS Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.
COMMAND LINE INTERFACE Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command is used to enable/disable the fast spanning-tree mode for the selected port. In this mode, ports skip the Discarding and Learning states, and proceed straight to Forwarding. • Since end-nodes cannot cause forwarding loops, they can be passed through the spanning tree state changes more quickly than allowed by standard convergence time.
SPANNING TREE COMMANDS Default Setting auto Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Specify a point-to-point link if the interface can only be connected to exactly one other bridge, or a shared link if it can be connected to two or more bridges. • When automatic detection is selected, the switch derives the link type from the duplex mode. A full-duplex interface is considered a point-to-point link, while a half-duplex interface is assumed to be on a shared link.
COMMAND LINE INTERFACE Default Setting By default, the system automatically detects the speed and duplex mode used on each port, and configures the path cost according to the values shown below. Path cost “0” is used to indicate auto-configuration mode.
SPANNING TREE COMMANDS spanning-tree mst port-priority This command configures the interface priority on a spanning instance in the Multiple Spanning Tree. Use the no form to restore the default. Syntax spanning-tree mst instance_id port-priority priority no spanning-tree mst instance_id port-priority • instance_id - Instance identifier of the spanning tree. (Range: 1-4094, no leading zeroes) • priority - Priority for an interface.
COMMAND LINE INTERFACE spanning-tree protocol-migration This command re-checks the appropriate BPDU format to send on the selected interface. Syntax spanning-tree protocol-migration interface • interface - ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
SPANNING TREE COMMANDS show spanning-tree This command shows the configuration for the common spanning tree (CST) or for an instance within the multiple spanning tree (MST). Syntax show spanning-tree [interface | mst instance_id] • interface - ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) - port-channel channel-id (Range: 1-32) • instance_id - Instance identifier of the multiple spanning tree.
COMMAND LINE INTERFACE Example Console#show spanning-tree Spanning-tree information --------------------------------------------------------------Spanning tree mode: MSTP Spanning tree enabled/disabled: enabled Instance: 0 VLANs configuration: 1-4093 Priority: 32768 Bridge Hello Time (sec.): 2 Bridge Max Age (sec.): 20 Bridge Forward Delay (sec.): 15 Root Hello Time (sec.): 2 Root Max Age (sec.): 20 Root Forward Delay (sec.): 15 Max hops: 20 Remaining hops: 20 Designated Root: 32768.0.
VLAN COMMANDS show spanning-tree mst configuration This command shows the multiple spanning tree configuration.
COMMAND LINE INTERFACE Table 4-56 VLAN Commands (Continued) Command Groups Function Page Configuring Private VLANs Configures private VLANs, including uplink and downlink ports 4-247 Configuring Protocol VLANs Configures protocol-based VLANs based on frame type and protocol 4-247 Editing VLAN Groups Table 4-57 Editing VLAN Groups Command Function Mode Page vlan database Enters VLAN database mode to add, change, and delete VLANs GC 4-236 vlan Configures a VLAN, including VID, name and state
VLAN COMMANDS Example Console(config)#vlan database Console(config-vlan)# Related Commands show vlan (4 -246) vlan This command configures a VLAN. Use the no form to restore the default settings or delete a VLAN. Syntax vlan vlan-id [name vlan-name] media ethernet [state {active | suspend}] no vlan vlan-id [name | state] • vlan-id - ID of configured VLAN. (Range: 1-4094, no leading zeroes) • name - Keyword to be followed by the VLAN name. - vlan-name - ASCII string from 1 to 32 characters.
COMMAND LINE INTERFACE Example The following example adds a VLAN, using VLAN ID 105 and name RD5. The VLAN is activated by default.
VLAN COMMANDS interface vlan This command enters interface configuration mode for VLANs, which is used to configure VLAN parameters for a physical interface. Syntax interface vlan vlan-id vlan-id - ID of the configured VLAN.
COMMAND LINE INTERFACE switchport mode This command configures the VLAN membership mode for a port. Use the no form to restore the default. Syntax switchport mode {trunk | hybrid} no switchport mode • trunk - Specifies a port as an end-point for a VLAN trunk. A trunk is a direct link between two switches, so the port transmits tagged frames that identify the source VLAN. Note that frames belonging to the port’s default VLAN (i.e., associated with the PVID) are also transmitted as tagged frames.
VLAN COMMANDS switchport acceptable-frame-types This command configures the acceptable frame types for a port. Use the no form to restore the default. Syntax switchport acceptable-frame-types {all | tagged} no switchport acceptable-frame-types • all - The port accepts all frames, tagged or untagged. • tagged - The port only receives tagged frames.
COMMAND LINE INTERFACE switchport ingress-filtering This command enables ingress filtering for an interface. Use the no form to restore the default. Syntax [no] switchport ingress-filtering Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Ingress filtering only affects tagged frames.
VLAN COMMANDS switchport native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no form to restore the default. Syntax switchport native vlan vlan-id no switchport native vlan vlan-id - Default VLAN ID for a port.
COMMAND LINE INTERFACE switchport allowed vlan This command configures VLAN groups on the selected interface. Use the no form to restore the default. Syntax switchport allowed vlan {add vlan-list [tagged | untagged] | remove vlan-list} no switchport allowed vlan • add vlan-list - List of VLAN identifiers to add. • remove vlan-list - List of VLAN identifiers to remove. • vlan-list - Separate nonconsecutive VLAN identifiers with a comma and no spaces; use a hyphen to designate a range of IDs.
VLAN COMMANDS • If a VLAN on the forbidden list for an interface is manually added to that interface, the VLAN is automatically removed from the forbidden list for that interface. Example The following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as tagged VLANs for port 1. Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 1,2,5,6 tagged Console(config-if)# switchport forbidden vlan This command configures forbidden VLANs.
COMMAND LINE INTERFACE Example The following example shows how to prevent port 1 from being added to VLAN 3.
VLAN COMMANDS Example The following example shows how to display information for VLAN 1.
COMMAND LINE INTERFACE Command Mode Global Configuration Command Usage • A private VLAN provides port-based security and isolation between ports within the VLAN. Data traffic on the downlink ports can only be forwarded to, and from, the uplink port. • Private VLANs and normal VLANs can exist simultaneously within the same switch. • Entering the pvlan command without any parameters enables the private VLAN. Entering no pvlan disables the private VLAN.
VLAN COMMANDS Configuring Protocol-based VLANs The network devices required to support multiple protocols cannot be easily grouped into a common VLAN. This may require non-standard devices to pass traffic between different VLANs in order to encompass all the devices participating in a specific protocol. This kind of configuration deprives users of the basic benefits of VLANs, including security and easy accessibility.
COMMAND LINE INTERFACE 3. Then map the protocol for each interface to the appropriate VLAN using the protocol-vlan protocol-group command (Interface Configuration mode). protocol-vlan protocol-group (Configuring Groups) This command creates a protocol group, adds specific protocols to a group. Use the no form to remove a protocol group.
VLAN COMMANDS protocol-vlan protocol-group (Configuring Interfaces) This command maps a protocol group to a VLAN for the current interface. Use the no form to remove the protocol mapping for this interface. Syntax protocol-vlan protocol-group group-id vlan vlan-id no protocol-vlan protocol-group group-id vlan • group-id - Group identifier of this protocol group. (Range: 1-2147483647) • vlan-id - VLAN to which matching protocol traffic is forwarded.
COMMAND LINE INTERFACE Example The following example maps the traffic entering Port 1 which matches the protocol type specified in protocol group 1 to VLAN 2. Console(config)#interface ethernet 1/1 Console(config-if)#protocol-vlan protocol-group 1 vlan 2 Console(config-if)# show protocol-vlan protocol-group This command shows the frame and protocol type associated with protocol groups. Syntax show protocol-vlan protocol-group [group-id] group-id - Group identifier for a protocol group.
VLAN COMMANDS show interfaces protocol-vlan protocol-group This command shows the mapping from protocol groups to VLANs for the selected interfaces. Syntax show interfaces protocol-vlan protocol-group [interface] • interface - ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) - port-channel channel-id (Range: 1-32) Default Setting The mapping for all interfaces is displayed.
COMMAND LINE INTERFACE GVRP and Bridge Extension Commands GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network. This section describes how to enable GVRP for individual interfaces and globally for the switch, as well as how to display default configuration settings for the Bridge Extension MIB.
GVRP AND BRIDGE EXTENSION COMMANDS Command Mode Global Configuration Command Usage GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. This function should be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. Example Console(config)#bridge-ext gvrp Console(config)# show bridge-ext This command shows the configuration for bridge extension commands.
COMMAND LINE INTERFACE switchport gvrp This command enables GVRP for a port. Use the no form to disable it. Syntax [no] switchport gvrp Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Example Console(config)#interface ethernet 1/1 Console(config-if)#switchport gvrp Console(config-if)# show gvrp configuration This command shows if GVRP is enabled. Syntax show gvrp configuration [interface] interface • ethernet unit/port - unit - Stack unit.
GVRP AND BRIDGE EXTENSION COMMANDS garp timer This command sets the values for the join, leave and leaveall timers. Use the no form to restore the timers’ default values. Syntax garp timer {join | leave | leaveall} timer_value no garp timer {join | leave | leaveall} • {join | leave | leaveall} - Which timer to set. • timer_value - Value of timer.
COMMAND LINE INTERFACE Example Console(config)#interface ethernet 1/1 Console(config-if)#garp timer join 100 Console(config-if)# Related Commands show garp timer (4 -258) show garp timer This command shows the GARP timers for the selected interface. Syntax show garp timer [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) Default Setting Shows all GARP timers.
PRIORITY COMMANDS Priority Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with eight priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.
COMMAND LINE INTERFACE Priority Commands (Layer 2) Table 4-64 Priority Commands (Layer 2) Command Function Mode Page queue mode Sets the queue mode to strict priority or Weighted Round-Robin (WRR) GC switchport priority default Sets a port priority for incoming untagged IC frames 4-260 queue bandwidth Assigns round-robin weights to the priority queues GC 4-262 queue cos map Assigns class-of-service values to the priority queues IC 4-263 show queue mode Shows the current queue mode PE 4-2
PRIORITY COMMANDS Default Setting Weighted Round Robin Command Mode Global Configuration Command Usage You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
COMMAND LINE INTERFACE Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • The default priority applies for an untagged frame received on a port set to accept all frame types (i.e, receives both untagged and tagged frames). This priority does not apply to IEEE 802.1Q VLAN tagged frames. If the incoming frame is an IEEE 802.1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used.
PRIORITY COMMANDS Default Setting Weights 1, 2, 4, 6, 8, 10, 12, 14 are assigned to queues 0 - 7 respectively. Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage WRR controls bandwidth sharing at the egress port by defining scheduling weights. Example This example shows how to assign WRR weights to each of the priority queues for port 5.
COMMAND LINE INTERFACE Default Setting This switch supports Class of Service by using eight priority queues, with Weighted Round Robin queuing for each port. Eight separate traffic classes are defined in IEEE 802.1p. The default priority levels are assigned according to recommendations in the IEEE 802.1p standard as shown below.
PRIORITY COMMANDS show queue mode This command shows the current queue mode. Default Setting None Command Mode Privileged Exec Example Console#sh queue mode Queue mode: strict Console# show queue bandwidth This command displays the weighted round-robin (WRR) bandwidth allocation for the eight priority queues. Default Setting None Command Mode Privileged Exec Example Console#show queue bandwidth Information of Eth 1/1 Queue ID Weight -------- -----0 1 1 2 2 4 3 6 4 8 5 10 6 12 7 14 . . .
COMMAND LINE INTERFACE show queue cos-map This command shows the class of service priority map. Syntax show queue cos-map [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
PRIORITY COMMANDS Priority Commands (Layer 3 and 4) Table 4-66 Priority Commands (Layer 3 and 4) Command Function Mode Page map ip port Enables TCP/UDP class of service mapping GC 4-268 map ip port Maps TCP/UDP socket to a class of service IC 4-268 map ip precedence Enables IP precedence class of service mapping GC 4-269 map ip precedence Maps IP precedence value to a class of service IC 4-270 map ip dscp Enables IP DSCP class of service mapping GC 4-271 map ip dscp Maps IP DSCP valu
COMMAND LINE INTERFACE map ip port (Global Configuration) This command enables IP port mapping (i.e., class of service mapping for TCP/UDP sockets). Use the no form to disable IP port mapping. Syntax [no] map ip port Default Setting Disabled Command Mode Global Configuration Command Usage The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority.
PRIORITY COMMANDS Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • This command sets the IP port priority for all interfaces.
COMMAND LINE INTERFACE Example The following example shows how to enable IP precedence mapping globally: Console(config)#map ip precedence Console(config)# map ip precedence (Interface Configuration) This command sets IP precedence priority (i.e., IP Type of Service priority). Use the no form to restore the default table. Syntax map ip precedence ip-precedence-value cos cos-value no map ip precedence • precedence-value - 3-bit precedence value.
PRIORITY COMMANDS Example The following example shows how to map IP precedence value 1 to CoS value 0: Console(config)#interface ethernet 1/5 Console(config-if)#map ip precedence 1 cos 0 Console(config-if)# map ip dscp (Global Configuration) This command enables IP DSCP mapping (i.e., Differentiated Services Code Point mapping). Use the no form to disable IP DSCP mapping.
COMMAND LINE INTERFACE map ip dscp (Interface Configuration) This command sets IP DSCP priority (i.e., Differentiated Services Code Point priority). Use the no form to restore the default table. Syntax map ip dscp dscp-value cos cos-value no map ip dscp • dscp-value - 8-bit DSCP value. (Range: 0-255) • cos-value - Class-of-Service value (Range: 0-7) Default Setting The DSCP default values are defined in the following table. Note that all the DSCP values that are not specified are mapped to CoS value 0.
PRIORITY COMMANDS Example The following example shows how to map IP DSCP value 1 to CoS value 0. Console(config)#interface ethernet 1/5 Console(config-if)#map ip dscp 1 cos 0 Console(config-if)# show map ip port Use this command to show the IP port priority map. Syntax show map ip port [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
COMMAND LINE INTERFACE show map ip precedence This command shows the IP precedence priority map. Syntax show map ip precedence [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
PRIORITY COMMANDS show map ip dscp This command shows the IP DSCP priority map. Syntax show map ip dscp [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-24/48) • port-channel channel-id (Range: 1-32) Default Setting None Command Mode Privileged Exec Example Console#show map ip dscp ethernet 1/1 DSCP mapping status: disabled Port DSCP COS --------- ---- --Eth 1/ 1 0 0 Eth 1/ 1 1 0 Eth 1/ 1 2 0 Eth 1/ 1 3 0 . . .
COMMAND LINE INTERFACE Multicast Filtering Commands This switch uses IGMP (Internet Group Management Protocol) to query for any attached hosts that want to receive a specific multicast service. It identifies the ports containing hosts requesting a service and sends data out to those ports only. It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service.
MULTICAST FILTERING COMMANDS ip igmp snooping This command enables IGMP snooping on this switch. Use the no form to disable it. Syntax [no] ip igmp snooping Default Setting Enabled Command Mode Global Configuration Example The following example enables IGMP snooping. Console(config)#ip igmp snooping Console(config)# ip igmp snooping vlan static This command adds a port to a multicast group. Use the no form to remove the port.
COMMAND LINE INTERFACE Command Mode Global Configuration Example The following shows how to statically configure a multicast group on a port. Console(config)#ip igmp snooping vlan 1 static 224.0.0.12 ethernet 1/5 Console(config)# ip igmp snooping version This command configures the IGMP snooping version. Use the no form to restore the default.
MULTICAST FILTERING COMMANDS show ip igmp snooping This command shows the IGMP snooping configuration. Default Setting None Command Mode Privileged Exec Command Usage See “Configuring IGMP Snooping and Query Parameters” on page 3-202 for a description of the displayed items.
COMMAND LINE INTERFACE Command Mode Privileged Exec Command Usage Member types displayed include IGMP or USER, depending on selected options. Example The following shows the multicast entries learned through IGMP snooping for VLAN 1: Console#show mac-address-table multicast vlan 1 igmp-snooping VLAN M'cast IP addr. Member ports Type ---- --------------- ------------ ------1 224.1.2.
MULTICAST FILTERING COMMANDS ip igmp snooping querier This command enables the switch as an IGMP querier. Use the no form to disable it. Syntax [no] ip igmp snooping querier Default Setting Enabled Command Mode Global Configuration Command Usage If enabled, the switch will serve as querier if elected. The querier is responsible for asking hosts if they want to receive multicast traffic.
COMMAND LINE INTERFACE Command Usage The query count defines how long the querier waits for a response from a multicast client before taking action. If a querier has sent a number of queries defined by this command, but a client has not responded, a countdown timer is started using the time defined by ip igmp snooping query-max- response-time. If the countdown finishes, and the client still has not responded, then that client is considered to have left the multicast group.
MULTICAST FILTERING COMMANDS ip igmp snooping query-max-response-time This command configures the query report delay. Use the no form to restore the default. Syntax ip igmp snooping query-max-response-time seconds no ip igmp snooping query-max-response-time seconds - The report delay advertised in IGMP queries. (Range: 5-25) Default Setting 10 seconds Command Mode Global Configuration Command Usage • The switch must be using IGMPv2 for this command to take effect.
COMMAND LINE INTERFACE ip igmp snooping router-port-expire-time This command configures the query timeout. Use the no form to restore the default. Syntax ip igmp snooping router-port-expire-time seconds no ip igmp snooping router-port-expire-time seconds - The time the switch waits after the previous querier stops before it considers the router port (i.e., the interface which had been receiving query packets) to have expired.
MULTICAST FILTERING COMMANDS Static Multicast Routing Commands Table 4-72 Static Multicast Routing Commands Command Function Mode Page ip igmp snooping vlan mrouter Adds a multicast router port GC 4-285 show ip igmp snooping Shows multicast router ports mrouter PE 4-286 ip igmp snooping vlan mrouter This command statically configures a multicast router port. Use the no form to remove the configuration.
COMMAND LINE INTERFACE Example The following shows how to configure port 11 as a multicast router port within VLAN 1: Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11 Console(config)# show ip igmp snooping mrouter This command displays information on statically configured and dynamically learned multicast router ports. Syntax show ip igmp snooping mrouter [vlan vlan-id] vlan-id - VLAN ID (Range: 1-4093) Default Setting Displays multicast router ports for all configured VLANs.
IP INTERFACE COMMANDS IP Interface Commands An IP addresses may be used for management access to the switch over your network. The IP address for this switch is obtained via DHCP by default. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server when it is powered on. You may also need to a establish a default gateway between this device and management stations or other devices that exist on another network segment.
COMMAND LINE INTERFACE ip address This command sets the IP address for the currently selected VLAN interface. Use the no form to restore the default IP address. Syntax ip address {ip-address netmask | bootp | dhcp} no ip address • ip-address - IP address • netmask - Network mask for the associated IP subnet. This mask identifies the host address bits used for routing to specific subnets. • bootp - Obtains IP address from BOOTP. • dhcp - Obtains IP address from DHCP.
IP INTERFACE COMMANDS access to the switch. If you assign an IP address to any other VLAN, the new IP address overrides the original IP address and this becomes the new management VLAN. Example In the following example, the device is assigned an address in VLAN 1. Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.5 255.255.255.0 Console(config-if)# Related Commands ip dhcp restart (4 -289) ip dhcp restart This command submits a BOOTP or DHCP client request.
COMMAND LINE INTERFACE Example In the following example, the device is reassigned the same address. Console(config)#interface vlan 1 Console(config-if)#ip address dhcp Console(config-if)#exit Console#ip dhcp restart Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: Dhcp. Console# Related Commands ip address (4 -288) ip default-gateway This command establishes a static route between this switch and devices that exist on another network segment.
IP INTERFACE COMMANDS Related Commands show ip redirects (4 -291) show ip interface This command displays the settings of an IP interface. Default Setting All interfaces Command Mode Privileged Exec Example Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: User specified. Console# Related Commands show ip redirects (4 -291) show ip redirects This command shows the default gateway configured for this device.
COMMAND LINE INTERFACE ping This command sends ICMP echo request packets to another node on the network. Syntax ping host [size size] [count count] • host - IP address or IP alias of the host. • size - Number of bytes in a packet. (Range: 32-512, default: 32) The actual packet size will be eight bytes larger than the size specified because the switch adds header information. • count - Number of packets to send. (Range: 1-16, default: 5) Default Setting This command has no default for the host.
IP INTERFACE COMMANDS Example Console#ping 10.1.0.9 Type ESC to abort. PING to 10.1.0.9, by 5 32-byte payload ICMP packets, timeout is 5 seconds response time: 10 ms response time: 10 ms response time: 10 ms response time: 10 ms response time: 0 ms Ping statistics for 10.1.0.
COMMAND LINE INTERFACE 4-294
APPENDIX A SOFTWARE SPECIFICATIONS Software Features Authentication Local, RADIUS, TACACS, Port (802.1X), HTTPS, SSH, Port Security Access Control Lists IP, MAC (up to 32 lists) DHCP Client DNS Server Port Configuration 1000BASE-T: 10/100 Mbps at half/full duplex, 1000 Mbps at full duplex 1000BASE-SX/LX - 1000 Mbps at full duplex (SFP), 1000BASE-ZX - 1000 Mbps at full duplex (SFP), Flow Control Full Duplex: IEEE 802.
SOFTWARE SPECIFICATIONS Port Trunking Static trunks (Cisco EtherChannel compliant) Dynamic trunks (Link Aggregation Control Protocol) Spanning Tree Protocol Spanning Tree Protocol (STP, IEEE 802.1D) Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s) VLAN Support Up to 255 groups; port-based, protocol-based, or tagged (802.
SOFTWARE SPECIFICATIONS Software Loading TFTP in-band or XModem out-of-band SNMP Management access via MIB database Trap management to specified hosts RMON Groups 1, 2, 3, 9 (Statistics, History, Alarm, Event) Standards IEEE 802.1D Spanning Tree Protocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1v Protocol-based VLANs IEEE 802.1s Multiple Spanning Tree Protocol IEEE 802.1w Rapid Spanning Tree Protocol IEEE 802.1X Port Authentication IEEE 802.3 Ethernet, IEEE 802.
SOFTWARE SPECIFICATIONS SNMPv2 (RFC 2571) SNMPv3 (RFC 3414, RFC 2570, RFC 2273, RFC 3411 & RFC 3415) SNTP (RFC 2030) SSH (Version 2.
SOFTWARE SPECIFICATIONS Trap (RFC 1215) UDP MIB (RFC 2012) A-5
SOFTWARE SPECIFICATIONS A-6
APPENDIX B TROUBLESHOOTING Problems Accessing the Management Interface Table B-1 Troubleshooting Chart Symptom Action Cannot connect using Telnet, web browser, or SNMP software • Be sure the switch is powered up. • Check network cabling between the management station and the switch. • Check that you have a valid network connection to the switch and that the port you are using has not been disabled.
TROUBLESHOOTING Table B-1 Troubleshooting Chart (Continued) Symptom Action Cannot connect using Secure Shell • If you cannot connect using SSH, you may have exceeded the maximum number of concurrent Telnet/SSH sessions permitted. Try connecting again at a later time. • Be sure the control parameters for the SSH server are properly configured on the switch, and that the SSH client software is properly configured on the management station.
USING SYSTEM LOGS Using System Logs If a fault does occur, refer to the Installation Guide to ensure that the problem you encountered is actually caused by the switch. If the problem appears to be caused by the switch, follow these steps: 1. Enable logging. 2. Set the error messages reported to include all categories. 3. Designate the SNMP host that is to receive the error messages. 4. Repeat the sequence of commands or other actions that lead up to the error. 5.
TROUBLESHOOTING B-4
GLOSSARY Access Control List (ACL) ACLs can limit network traffic and restrict access to certain users or devices by checking each packet for certain IP or MAC (i.e., Layer 2) information. Boot Protocol (BOOTP) BOOTP is used to provide bootup information for network devices, including IP address information, the address of the TFTP server that contains the devices system files, and the name of the boot file.
GLOSSARY Extensible Authentication Protocol over LAN (EAPOL) EAPOL is a client authentication protocol used by this switch to verify the network access rights for any device that is plugged into the switch. A user name and password is requested by the switch, and then passed to an authentication server (e.g., RADIUS) for verification. EAPOL is implemented as part of the IEEE 802.1X Port Authentication standard.
GLOSSARY IEEE 802.1Q VLAN Tagging—Defines Ethernet frame tags which carry VLAN information. It allows switches to assign endstations to different virtual LANs, and defines a standard way for VLANs to communicate across switched networks. IEEE 802.1p An IEEE standard for providing quality of service (QoS) in Ethernet networks. The standard uses packet tags that define up to eight traffic classes and allows switches to transmit packets based on the tagged priority value. IEEE 802.
GLOSSARY IGMP Query On each subnetwork, one IGMP-capable device will act as the querier — that is, the device that asks all hosts to report on the IP multicast groups they wish to join or to which they already belong. The elected querier will be the device with the lowest IP address in the subnetwork. Internet Group Management Protocol (IGMP) A protocol through which hosts can register with their local router for multicast services.
GLOSSARY Link Aggregation See Port Trunk. Link Aggregation Control Protocol (LACP) Allows ports to automatically negotiate a trunked link with LACP-configured ports on another device. Management Information Base (MIB) An acronym for Management Information Base. It is a set of database objects that contains information about a specific device.
GLOSSARY Port Trunk Defines a network link aggregation and trunking method which specifies how to create a single high-speed logical link that combines several lower-speed physical links. Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN. Data traffic on downlink ports can only be forwarded to, and from, uplink ports.
GLOSSARY Simple Network Management Protocol (SNMP) The application protocol in the Internet suite of protocols which offers network management services. Simple Network Time Protocol (SNTP) SNTP allows a device to set its internal clock based on periodic updates from a Network Time Protocol (NTP) server. Updates can be requested from a specific NTP server, or can be received via broadcasts sent by NTP servers. Spanning Tree Algorithm (STA) A technology that checks your network for any loops.
GLOSSARY User Datagram Protocol (UDP) UDP provides a datagram mode for packet-switched communications. It uses IP as the underlying transport mechanism to provide access to IP-like services. UDP packets are delivered just like IP packets – connection-less datagrams that may be discarded before reaching their targets. UDP is useful when TCP would be too complex, too slow, or just unnecessary.
INDEX Numerics 802.
INDEX E edge port, STA 3-152, 3-155, 4-226 event logging 4-56 F firmware displaying version 3-14, 4-81 upgrading 3-23, 4-84 G GARP VLAN Registration Protocol See GVRP gateway, default 3-19, 4-290 GVRP global setting 3-168, 4-254 interface configuration 3-178, 4-256 H hardware version, displaying 3-14, 4-81 HTTPS 3-65, 4-41 HTTPS, secure server 3-65, 4-41 I IEEE 802.1D 3-138, 4-213 IEEE 802.1s 4-213 IEEE 802.1w 3-138, 4-213 IEEE 802.
INDEX multicast groups 3-207, 4-279 displaying 4-279 static 3-207, 4-277, 4-279 multicast services configuring 3-208, 4-277 displaying 3-207, 4-279 multicast, static router port 3-206, 4-285 P password, line 4-16 passwords 2-9 administrator setting 3-59, 4-34 path cost 3-141, 3-151 method 3-146, 4-217 STA 3-141, 3-151, 4-217 port authentication 4-104 port priority configuring 3-186, 4-259 default ingress 3-186, 4-261 STA 3-151, 4-226 port security, configuring 3-74, 4-101 port, statistics 3-127, 4-184 port
INDEX interface settings 3-149, 3-160, 3-162, 4-225–4-232, 4-233 link type 3-152, 3-155, 4-228 path cost 3-141, 3-151, 4-225 path cost method 3-146, 4-217 port priority 3-151, 4-226 protocol migration 3-155, 4-232 transmission limit 3-147, 4-218 standards, IEEE A-3 startup files creating 3-27, 4-84 displaying 3-23, 4-76 setting 3-23, 4-90 static addresses, setting 3-134, 4-206 statistics port 3-127, 4-184 STP 3-144, 4-213 STP Also see STA system clock, setting 3-42, 4-70 system software, downloading from se
FOR TECHNICAL SUPPORT, CALL: From U.S.A. and Canada (24 hours a day, 7 days a week) (800) SMC-4-YOU; Phn: (949) 679-8000; Fax: (949) 679-1481 From Europe: Contact details can be found on www.smc-europe.com or www.smc.com INTERNET E-mail addresses: techsupport@smc.com european.techsupport@smc-europe.com Driver updates: http://www.smc.com/index.cfm?action=tech_support_drivers_downloads World Wide Web: http://www.smc.com http://www.smc-europe.com FOR LITERATURE OR ADVERTISING RESPONSE, CALL: U.S.A.
38 Tesla Irvine, CA 92618 Phone: (949) 679-8000
-8
