Page 1 Enterasys D-Series ® Ethernet Switches CLI Reference Firmware Version 1.00.01.0005 or Higher P/N 9034394-01...
Page 3 Part Number: 9034394‐01 July 2008 ENTERASYS, ENTERASYS NETWORKS, ENTERASYS SECURE NETWORKS, ENTERASYS NETSIGHT, WEBVIEW, and any logos associated therewith, are trademarks or registered trademarks of Enterasys Networks, Inc. in the United States and other countries. For a complete list of Enterasys trademarks, see http://www.enterasys.com/company/trademarks.aspx. All other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies. Documentation URL: http://www.enterasys.com/support/manuals Documentacion URL: http://www.enterasys.com/support/manuals Dokumentation im Internet: http://www.enterasys.com/support/manuals Version: Information in this guide refers to D-Series firmware version 1.00.01.0005 or higher. If your D-Series firmware version is 1.00.00.0029, please refer to the previous version of this manual. Notice...
Page 4 ENTERASYS NETWORKS, INC. FIRMWARE LICENSE AGREEMENT BEFORE OPENING OR UTILIZING THE ENCLOSED PRODUCT, CAREFULLY READ THIS LICENSE AGREEMENT. This document is an agreement (“Agreement”) between the end user (“You”) and Enterasys Networks, Inc., on behalf of itself and its Affiliates (as hereinafter defined) (“Enterasys”) that sets forth Your rights and obligations with respect to the Enterasys software program/firmware (including any accompanying documentation, hardware or media) (“Program”) in the package and prevails over any additional, conflicting or inconsistent terms and conditions appearing on any purchase order or other document submitted by You. “Affiliate” means any person, partnership, corporation, limited liability company, other form of enterprise that directly or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with the party specified. This Agreement constitutes the entire understanding between the parties, with respect to the subject matter of this Agreement. The Program may be contained in firmware, chips or other media. BY INSTALLING OR OTHERWISE USING THE PROGRAM, YOU REPRESENT THAT YOU ARE AUTHORIZED TO ACCEPT THESE TERMS ON BEHALF OF THE END USER (IF THE END USER IS AN ENTITY ON WHOSE BEHALF YOU ARE AUTHORIZED TO ACT, “YOU” AND “YOUR” SHALL BE DEEMED TO REFER TO SUCH ENTITY) AND THAT YOU AGREE THAT YOU ARE BOUND BY THE TERMS OF THIS AGREEMENT, WHICH INCLUDES, AMONG OTHER PROVISIONS, THE LICENSE, THE DISCLAIMER OF WARRANTY AND THE LIMITATION OF LIABILITY. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT OR ARE NOT AUTHORIZED TO ENTER INTO THIS AGREEMENT, ENTERASYS IS UNWILLING TO LICENSE THE PROGRAM TO YOU AND YOU AGREE TO RETURN THE UNOPENED PRODUCT TO ENTERASYS OR YOUR DEALER, IF ANY, WITHIN TEN (10) DAYS FOLLOWING THE DATE OF RECEIPT FOR A FULL REFUND. IF YOU HAVE ANY QUESTIONS ABOUT THIS AGREEMENT, CONTACT ENTERASYS NETWORKS, LEGAL DEPARTMENT AT (978) 684‐1000. You and Enterasys agree as follows: LICENSE. You have the non‐exclusive and non‐transferable right to use only the one (1) copy of the Program ...
Page 5 If the Program is exported from the United States pursuant to the License Exception TSR under the U.S. Export Administration Regulations, in addition to the restriction on transfer set forth in Section 1 or 2 of this Agreement, You agree not to (i) reexport or release the Program, the source code for the Program or technology to a national of a country in Country Groups D:1 or E:2 (Albania, Armenia, Azerbaijan, Belarus, Cambodia, Cuba, Georgia, Iraq, Kazakhstan, Laos, Libya, Macau, Moldova, Mongolia, North Korea, the People’s Republic of China, Russia, Tajikistan, Turkmenistan, Ukraine, Uzbekistan, Vietnam, or such other countries as may be designated by the United States Government), (ii) export to Country Groups D:1 or E:2 (as defined herein) the direct product of the Program or the technology, if such foreign produced direct product is subject to national security controls as identified on the U.S. Commerce Control List, or (iii) if the direct product of the technology is a complete plant or any major component of a plant, export to Country Groups D:1 or E:2 the direct product of the plant or a major component thereof, if such foreign produced direct product is subject to national security controls as identified on the U.S. Commerce Control List or is subject to State Department controls under the U.S. Munitions List. UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The enclosed Program (i) was developed solely at private expense; (ii) contains “restricted computer software” submitted with restricted rights in accordance with section 52.227‐19 (a) through (d) of the Commercial Computer Software‐Restricted Rights Clause and its successors, and (iii) in all respects is proprietary data belonging to Enterasys and/or its suppliers. For Department of Defense units, the Program is considered commercial computer software in accordance with DFARS section 227.7202‐3 and its successors, and use, duplication, or disclosure by the U.S. Government is subject to restrictions set forth herein. DISCLAIMER OF WARRANTY. EXCEPT FOR THOSE WARRANTIES EXPRESSLY PROVIDED TO YOU IN WRITING BY ENTERASYS, ENTERASYS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON‐INFRINGEMENT WITH RESPECT TO THE PROGRAM. IF IMPLIED WARRANTIES MAY NOT BE DISCLAIMED BY APPLICABLE LAW, THEN ANY IMPLIED WARRANTIES ARE LIMITED IN DURATION TO THIRTY (30) DAYS AFTER DELIVERY OF THE PROGRAM TO YOU. LIMITATION OF LIABILITY. IN NO EVENT SHALL ENTERASYS OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS, PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR RELIANCE DAMAGES, OR OTHER LOSS) ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM, EVEN IF ENTERASYS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS FOREGOING LIMITATION SHALL APPLY REGARDLESS OF THE CAUSE OF ACTION UNDER WHICH DAMAGES ARE SOUGHT. THE CUMULATIVE LIABILITY OF ENTERASYS TO YOU FOR ALL CLAIMS RELATING TO THE PROGRAM, IN CONTRACT, TORT OR OTHERWISE, SHALL NOT EXCEED THE TOTAL AMOUNT OF FEES PAID TO ENTERASYS BY YOU FOR THE RIGHTS GRANTED HEREIN. AUDIT RIGHTS. You hereby acknowledge that the intellectual property rights associated with the Program are of critical value to Enterasys, and, accordingly, You hereby agree to maintain complete books, records and accounts ...
Page 6 10. ENFORCEMENT. You acknowledge and agree that any breach of Sections 2, 4, or 9 of this Agreement by You may cause Enterasys irreparable damage for which recovery of money damages would be inadequate, and that Enterasys may be entitled to seek timely injunctive relief to protect Enterasys’ rights under this Agreement in addition to any and all remedies available at law. 11. ASSIGNMENT. You may not assign, transfer or sublicense this Agreement or any of Your rights or obligations under this Agreement, except that You may assign this Agreement to any person or entity which acquires substantially all of Your stock assets. Enterasys may assign this Agreement in its sole discretion. This Agreement shall be binding upon and inure to the benefit of the parties, their legal representatives, permitted transferees, successors and assigns as permitted by this Agreement. Any attempted assignment, transfer or sublicense in violation of the terms of this Agreement shall be void and a breach of this Agreement. 12. WAIVER. A waiver by Enterasys of a breach of any of the terms and conditions of this Agreement must be in writing and will not be construed as a waiver of any subsequent breach of such term or condition. Enterasys’ failure to enforce a term upon Your breach of such term shall not be construed as a waiver of Your breach or prevent enforcement on any other occasion. 13. SEVERABILITY. In the event any provision of this Agreement is found to be invalid, illegal or unenforceable, the validity, legality and enforceability of any of the remaining provisions shall not in any way be affected or impaired thereby, and that provision shall be reformed, construed and enforced to the maximum extent permissible. Any such invalidity, illegality, or unenforceability in any jurisdiction shall not invalidate or render illegal or unenforceable such provision in any other jurisdiction. 14. TERMINATION. Enterasys may terminate this Agreement immediately upon Your breach of any of the terms and conditions of this Agreement. Upon any such termination, You shall immediately cease all use of the Program and shall return to Enterasys the Program and all copies of the Program.
Page 7: Table Of Contents
Related Documents ... xxii Conventions Used in This Guide ... xxiii Getting Help ... xxiii Chapter 1: Introduction D-Series CLI Overview ... 1-1 Switch Management Methods ... 1-1 Factory Default Settings ... 1-2 Using the Command Line Interface ... 1-5 Starting a CLI Session ...
Page 8 Purpose ... 2-32 Commands ... 2-32 show telnet ... 2-32 set telnet ... 2-33 telnet... 2-33 Managing Switch Configuration and Files ... 2-34 Configuration Persistence Mode ... 2-34 Purpose ... 2-34 Commands ... 2-35 show snmp persistmode ... 2-35 set snmp persistmode ... 2-36 save config ...
Page 9 clear config ... 2-46 Using and Configuring WebView ... 2-47 Purpose ... 2-47 Commands ... 2-47 show webview ... 2-47 set webview ... 2-48 show ssl... 2-48 set ssl ... 2-49 Chapter 3: Activating Licensed Features Clearing, Showing, and Moving Licenses ... 3-1 Commands ...
Page 10 show lldp port local-info ... 5-18 show lldp port remote-info ... 5-20 set lldp tx-interval... 5-22 set lldp hold-multiplier ... 5-22 set lldp trap-interval ... 5-23 set lldp med-fast-repeat ... 5-23 set lldp port status ... 5-24 set lldp port trap... 5-24 set lldp port med-trap...
Page 11 ... 6-34 clear port mirroring ... 6-35 Link Aggregation Control Protocol (LACP) ... 6-36 LACP Operation ... 6-36 LACP Terminology ... 6-37 D-Series Usage Considerations ... 6-37 Commands ... 6-38 show lacp... 6-39 set lacp ... 6-40 set lacp asyspri... 6-41 set lacp aadminkey...
Page 12 set port protected name... 6-52 show port protected name ... 6-52 clear port protected name... 6-53 Chapter 7: SNMP Configuration SNMP Configuration Summary ... 7-1 SNMPv1 and SNMPv2c ... 7-1 SNMPv3 ... 7-2 About SNMP Security Models and Levels ... 7-2 Using SNMP Contexts to Access Specific MIBs ...
Page 13 Purpose ... 7-28 Commands ... 7-29 show newaddrtrap ... 7-29 set newaddrtrap... 7-30 show snmp notify ... 7-30 set snmp notify ... 7-31 clear snmp notify ... 7-32 show snmp notifyfilter ... 7-33 set snmp notifyfilter... 7-34 clear snmp notifyfilter... 7-34 show snmp notifyprofile ...
Page 14 show spantree tctrapsuppress... 8-23 set spantree tctrapsuppress ... 8-23 clear spantree tctrapsuppress ... 8-24 set spantree protomigration ... 8-24 show spantree spanguard ... 8-25 set spantree spanguard ... 8-25 clear spantree spanguard ... 8-26 show spantree spanguardtimeout ... 8-27 set spantree spanguardtimeout ... 8-27 clear spantree spanguardtimeout ...
Page 15 show spantree nonforwardingreason ... 8-53 Chapter 9: 802.1Q VLAN Configuration VLAN Configuration Summary ... 9-1 Port String Syntax Used in the CLI ... 9-1 Creating a Secure Management VLAN ... 9-1 Viewing VLANs ... 9-2 Purpose ... 9-2 Command ... 9-3 show vlan...
Page 16 Command ... 10-2 set diffserv adminmode ... 10-2 Creating Diffserv Classes and Matching Conditions ... 10-3 Purpose ... 10-3 Commands ... 10-3 show diffserv info ... 10-3 show diffserv class ... 10-4 set class create... 10-4 set diffserv class delete ... 10-5 set diffserv class match ...
Page 17 set cos state ... 11-19 show cos state... 11-20 clear cos state ... 11-20 set cos settings... 11-21 clear cos settings ... 11-22 show cos settings ... 11-22 set cos port-config ... 11-23 show cos port-config... 11-24 clear cos port-config ... 11-25 set cos port-resource...
Page 18 14-13 set history ... 14-13 ping... 14-14 show users ... 14-14 disconnect ... 14-15 Managing Switch Network Addresses and Routes ... 14-16 Purpose ... 14-16 Commands ... 14-16 show arp ... 14-16 set arp... 14-17 clear arp... 14-18 traceroute ...
Page 19 Configuring Simple Network Time Protocol (SNTP) ... 14-26 Purpose ... 14-26 Commands ... 14-26 show sntp ... 14-26 set sntp client... 14-28 clear sntp client... 14-28 set sntp server ... 14-29 clear sntp server ... 14-29 set sntp poll-interval... 14-30 clear sntp poll-interval...
Page 20 show rmon filter ... 15-19 set rmon filter ... 15-20 clear rmon filter ... 15-21 Packet Capture Commands ... 15-22 Purpose ... 15-22 Commands ... 15-22 show rmon capture ... 15-22 set rmon capture... 15-23 clear rmon capture... 15-24 Chapter 16: DHCP Server Configuration DHCP Overview ...
Page 21 clear dhcp pool dns-server ... 16-23 set dhcp pool domain-name ... 16-24 clear dhcp pool domain-name ... 16-24 set dhcp pool netbios-name-server ... 16-25 clear dhcp pool netbios-name-server ... 16-25 set dhcp pool netbios-node-type ... 16-26 clear dhcp pool netbios-node-type ... 16-26 set dhcp pool option ...
Page 22 Configuring Multiple Authentication Methods ... 17-33 About Multiple Authentication Types ... 17-33 Configuring Multi-User Authentication (User + IP phone) ... 17-33 Commands ... 17-33 show multiauth... 17-34 set multiauth mode ... 17-35 clear multiauth mode ... 17-35 set multiauth precedence ... 17-36 clear multiauth precedence ...17-36 show multiauth port ...
Page 23 ... 17-74 set ssh ... 17-74 set ssh hostkey... 17-75 Index Figures D-Series Startup Screen... 1-5 Sample CLI Defaults Description... 1-7 Performing a Keyword Lookup ... 1-7 Performing a Partial Keyword Lookup ... 1-7 Scrolling Screen Output... 1-8 Abbreviating a Command ...
Page 24 7-18 show snmp view Output Details ... 7-20 7-19 show snmp targetparams Output Details ... 7-23 7-20 show snmp targetaddr Output Details ... 7-26 7-21 show snmp notify Output Details ... 7-31 7-22 Basic SNMP Trap Configuration... 7-37 8-23 show spantree Output Details ... 8-6 9-24 Command Set for Creating a Secure Management VLAN ...
Page 25: About This Guide
Structure of This Guide The guide is organized as follows: Chapter 1, Introduction, provides an overview of the tasks that can be accomplished using the CLI interface, an overview of local management requirements, an overview of the device’s factory default settings, and information about using the Command Line Interface (CLI). Chapter 2, Basic Configuration, provides how to set basic system properties, how to download a firmware image, how to configure WebView and Telnet, how to manage configuration files, how to set the login password, and how to exit the CLI. Chapter 3, Activating Licensed Features, describes the commands used to activate, show, and clear licensed features. Chapter 4, Configuring System Power and PoE, describes the commands used to manage switches that provide Power over Ethernet. Chapter 5, Discovery Protocol Configuration provides how to configure discovery protocols supported by the device. Chapter 6, Port Configuration, describes how to review and configure console port settings, and how to enable or disable switch ports and configure switch port settings, including port speed, duplex mode, auto‐negotiation, flow control, port mirroring, link aggegation and broadcast suppression. About This Guide Important Notice Enterasys D-Series CLI Reference xxi ® D‐Series switch ...
Page 26: Related Documents
Chapter 10, Differentiated Services Configuration, describes how to display and configure Diffserv parameters. Chapter 11, Policy Classification Configuration, describes how to create, change or remove user roles or profiles based on business‐specific use of network services; how to permit or deny access to specific services by creating and assigning classification rules which map user profiles to frame filtering policies; how to classify frames to a VLAN or Class of Service (CoS); and how to assign or unassign ports to policy profiles so that only ports activated for a profile will be allowed to transmit frames accordingly. Chapter 12, Port Priority and Rate Limiting Configuration, describes how to set the transmit priority of each port and configure a rate limit for a given port and list of priorities. Chapter 13, IGMP Configuration, describes how to configure Internet Group Management Protocol (IGMP) settings for multicast filtering. Chapter 14, Logging and Network Management, describes how to configure Syslog, how to manage general switch settings, how to monitor network events and status,and how to configure SNTP and node aliases. Chapter 15, RMON Configuration, describes how to use RMON (Remote Network Monitoring), which provides comprehensive network fault diagnosis, planning, and performance tuning information and allows for interoperability between SNMP management stations and monitoring agents. Chapter 16, DHCP Server Configuration, describes how to review and configure DHCP server parameters, how to review and configure DHCP address pools, and how to display DHCP server information. Chapter 17, Security Configuration, describes how to configure 802.1X authentication using EAPOL, how to configure RADIUS server, Secure Shell server, MAC authentication, MAC locking, and Port Web Authentication. Related Documents The following Enterasys Networks documents may help you to set up, control, and manage the SecureStack device: • D‐Series Installation Guide(s) •...
Page 27: Conventions Used In This Guide
1-800-872-8440 (toll-free in U.S. and Canada) or 1-978-684-1000 For the Enterasys Networks Support toll-free number in your country: http://www.enterasys.com/support support@enterasys.com To expedite your message, type [SWITCHING] in the subject line. Conventions Used in This Guide...
Page 28 Getting Help Before calling Enterasys Networks, have the following information ready: • Your Enterasys Networks service contract number • A description of the failure • A description of any action(s) already taken to resolve the problem (for example, changing mode switches or rebooting the unit) • The serial and revision numbers of all involved Enterasys Networks products in the network • A description of your network environment (for example, layout, cable type) • Network load and frame size at the time of trouble (if known) • The switch history (for example, have you returned the switch before, is this a recurring problem?) • Any previous Return Material Authorization (RMA) numbers xxiv About This Guide...
Page 29: Chapter 1: Introduction
• Download a new firmware image. • Assign IP address and subnet mask. • Select a default gateway. • Establish and manage Virtual Local Area Networks (VLANs). • Establish and manage policy profiles and classifications. • Establish and manage priority classification. • Configure security protocols, including 802.1X and RADIUS, SSHv2, PWA, MAC locking, and MAC authentication. Switch Management Methods The D‐Series switch can be managed using the following methods: • Locally using a VT type terminal connected to the console port. • Remotely using a VT type terminal connected through a modem. • Remotely using an SNMP management station. • In‐band through a Telnet connection. • In‐band using the Enterasys NetSight Introduction ® management application. Enterasys D-Series CLI Reference 1-1 Refer to page...
Page 30: Factory Default Settings
Factory Default Settings • Remotely using WebView™, Enterasys Networks’ embedded web server application. The Installation Guide for your D‐Series device provides setup instructions for connecting a terminal or modem to the switch. Factory Default Settings The following tables list factory default settings available on the D‐Series switch. Table 1-1 Default Settings for Basic Switch Operation Feature Switch Mode Defaults CDP discovery protocol CDP authentication code CDP hold time CDP interval Cisco discovery protocol Cisco DP hold time...
Page 31 Enabled on all ports. Port advertised ability Maximum ability advertised on all ports. Port broadcast suppression Enabled and set to limit broadcast packets to 14,881 per second on all switch ports. Port duplex mode Set to half duplex, except for 100BASE-FX and 1000BASE-X, which is set to full duplex.
Page 32 Factory Default Settings Table 1-1 Default Settings for Basic Switch Operation (Continued) Feature Spanning Tree edge port administrative status Spanning Tree edge port delay Spanning Tree forward delay Spanning Tree hello interval Spanning Tree ID (SID) Spanning Tree maximum aging time...
Page 33: Using The Command Line Interface
Command Line Interface Enterasys Networks, Inc. 50 Minuteman Rd. Andover, MA 01810-1008 U.S.A. Phone: +1 978 684 1000 E-mail: support@enterasys.com WWW: http://www.enterasys.com (c) Copyright Enterasys Networks, Inc. 2006 Chassis Serial Number: Chassis Firmware Revision: D2(su)-> Connecting Using Telnet Once the D‐Series device has a valid IP address, you can establish a Telnet session from any TCP/ IP based node on the network. For information about setting the switch’s IP address, refer to “set ...
Page 34: Logging In
Using the Command Line Interface Refer to the instructions included with the Telnet application for information about establishing a Telnet session. Logging In By default, the D‐Series switch is configured with three user login accounts—ro for Read‐Only access, rw for Read‐Write access, and admin for super‐user access to all modifiable parameters. The default password is set to a blank string. For information on changing these default settings, refer to “Setting User Accounts and Passwords” on page 3‐2. Using a Default User Account If this is the first time you are logging in to the D‐Series switch, or if the default user accounts have not been administratively changed, proceed as follows: At the login prompt, enter one of the following default user names: – ro for Read‐Only access. – rw for Read‐Write access. – admin for Super User access. Press ENTER. The Password prompt displays. Leave this string blank and press ENTER. The switch information and prompt displays as shown in Figure Using an Administratively Configured User Account If the switch’s default user account settings have been changed, proceed as follows: At the login prompt, enter your administratively‐assigned user name and press ENTER. At the Password prompt, enter your password and press ENTER.
Page 35: Sample Cli Defaults Description
Note: At the end of the lookup display, the system will repeat the command you entered without the SNMP v1/v2c community name configuration SNMP notify configuration SNMP target address configuration SNMP target parameters configuration 1‐4 shows how to use this function for all copy Using the Command Line Interface Enterasys D-Series CLI Reference 1-7...
Page 36: Scrolling Screen Output
00-00-1d-67-68-69 00-00-02-00-00-00 00-00-02-00-00-01 00-00-02-00-00-02 00-00-02-00-00-03 00-00-02-00-00-04 00-00-02-00-00-05 00-00-02-00-00-06 00-00-02-00-00-07 00-00-02-00-00-08 --More-- Abbreviating and Completing Commands The D‐Series switch allows you to abbreviate CLI commands and keywords down to the number of characters that will allow for a unique abbreviation. Figure show netstat command to sh net. Figure 1-6 Abbreviating a Command D2(su)->sh net Active Internet connections (including servers) Proto Recv-Q Send-Q ----- ------ ------ 1-8 Introduction 1‐5 shows how the show mac command indicates that output continues on Port...
Page 37: Basic Line Editing Commands
Pause the CLI process (for scrolling). Ctrl+T Transpose characters. Ctrl+U or Ctrl+X Delete all characters before cursor. Ctrl+W Delete word to the left of cursor. Ctrl+Y Restore the most recently deleted item. Using the Command Line Interface 1‐2 lists some commonly used Enterasys D-Series CLI Reference 1-9...
Page 38 Using the Command Line Interface 1-10 Introduction...
Page 39: Chapter 2: Basic Configuration
[mask ip-mask] [gateway ip-gateway] copy tftp://tftp_server_ip_address/ filename system:image set boot system filename show version Refer to page... 2-28 2-31 2-32 2-34 2-44 2-45 2-47 Refer to page... 2-10 2-40 2-32 2-22 Enterasys D-Series CLI Reference 2-1...
Page 40: Setting User Accounts And Passwords
Configure and enable a RADIUS server. Configure and enable first arrival MAC locking on user ports. Setting User Accounts and Passwords Purpose To change the switch’s default user login and password settings, and to add new user accounts and passwords. Commands For information about... show system login set system login clear system login set password...
Page 41: Show System Login
Number of days user passwords will remain valid before aging out. Configured with set system password aging (page Login user names. Access assigned to this user account: super-user, read-write or read-only. Whether this user account is enabled or disabled. show system login 2-7). 2-6). Enterasys D-Series CLI Reference 2-3...
Page 42: Set System Login
Use this command to create a new user login account, or to disable or enable an existing account. The D‐Series switch supports up to 16 user accounts, including the admin account, which cannot be deleted. Syntax set system login username {super-user | read-write | read-only} {enable | disable} Parameters username super‐user | read‐write | read‐only enable | disable Defaults None. Mode Switch command, super user. Example This example shows how to enable a new user account with the login name “netops” with super user access privileges: D2(su)->set system login netops super-user enable clear system login Use this command to remove a local login user account.
Page 43: Set Password
This example shows how a super‐user would change the Read‐Write password from the system default (blank string): D2(su)->set password rw Please enter new password: ******** Please re-enter new password: ******** Password changed. D2(su)-> This example shows how a user with Read‐Write access would change his password: D2(su)->set password Please enter old password: ******** (Only available to users with super‐user access.) Specifies a system default or a user‐configured login account name. By default, the D‐Series switch provides the following account names: ro for Read‐Only access. rw for Read‐Write access. admin for Super User access. (This access level allows Read‐Write access to all modifiable parameters, including user accounts.) set password Enterasys D-Series CLI Reference 2-5...
Page 44: Set System Password Length
D2(su)-> set system password length Use this command to set the minimum user login password length. Syntax set system password length characters Parameters characters Defaults None. Mode Switch command, super user. Example This example shows how to set the minimum system password length to 8 characters: D2(su)->set system password length 8 set system password aging Use this command to set the number of days user passwords will remain valid before aging out, or to disable user account password aging. Syntax set system password aging {days | disable} Parameters...
Page 45: Set System Password History
Parameters size Defaults None. Mode Switch command, super user. Example This example shows how to configure the system to check the last 10 passwords for duplication D2(su)->set system password history 10 show system lockout Use this command to display settings for locking out users after failed attempts to log in to the system. Syntax show system lockout Parameters None. Defaults None. Mode Switch command, super user. Specifies the number of passwords checked for duplication. Valid values are 0 to 10. set system password history Enterasys D-Series CLI Reference 2-7...
Page 46: Set System Lockout
Example This example shows how to display user lockout settings. In this case, switch defaults have not been changed: D2(su)->show system lockout Lockout attempts: 3 Lockout time: Table 2‐3 provides an explanation of the command output. These settings are configured with the set system lockout command (“set system lockout” on page 2‐8). Table 2-3 show system lockout Output Details Output Field Lockout attempts Lockout time set system lockout Use this command to set the number of failed login attempts before locking out (disabling) a read‐ write or read‐only user account, and the number of minutes to lockout the default admin super user account after maximum login attempts. Once a user account is locked out, it can only be re‐ enabled by a super user with the set system login command (page 2‐4). Syntax set system lockout {[attempts attempts] [time time]} Parameters attempts attempts...
Page 47: Setting Basic Switch Properties
Setting Basic Switch Properties Refer to page... 2-10 2-10 2-11 2-11 2-12 2-12 2-14 2-14 2-15 2-16 2-16 2-17 2-17 2-18 2-18 2-19 2-20 2-20 2-21 2-21 2-22 2-22 2-23 2-24 2-24 2-25 2-26 2-26 2-27 Enterasys D-Series CLI Reference 2-9...
Page 48: Show Ip Address
Use this command to display the system IP address and subnet mask. Syntax show ip address Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the system IP address and subnet mask: D2(su)->show ip address Name ---------------- host set ip address Use this command to set the system IP address, subnet mask and default gateway. Note: The D2 does not support the ability for a user to configure the host's gateway to be a local routed interface IP.
Page 49: Clear Ip Address
Use this command to clear the system IP address. Syntax clear ip address Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the system IP address: D2(rw)->clear ip address show ip protocol Use this command to display the method used to acquire a network IP address for switch management. Syntax show ip protocol Parameters None. Defaults None. clear ip address 10.1.10.1 with a mask of 255.255.128.0: Enterasys D-Series CLI Reference 2-11...
Page 50: Set Ip Protocol
Mode Switch command, read‐only. Example This example shows how to display the method used to acquire a network IP address: D2(su)->show ip protocol System IP address acquisition method: dhcp set ip protocol Use this command to specify the protocol used to acquire a network IP address for switch management. Syntax set ip protocol {bootp | dhcp | none} Parameters bootp dhcp none Defaults None. Mode Switch command, read‐write. Example This example shows how to set the method used to acquire a network IP address to DHCP.
Page 51: Show System Output Details
Name identifying the system. Default of a blank string can be changed with the set system name command PWR1-A Status Operational status for the power supply connected to PWR1-A on the switch. PWR1-B Status Operational status for the power supply connected to PWR1-B on the switch.
Page 52: Show System Hardware
Use this command to display the system’s hardware configuration. Syntax show system hardware Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the system’s hardware configuration. Please note that the information you see displayed may differ from this example. D2(su)->show system hardware SLOT 1 HARDWARE INFORMATION --------------------------- Model: Serial Number: Vendor ID: Base MAC Address: Hardware Version: FirmWare Version:...
Page 53: Show System Enhancedbuffermode
0.00% 0.03% 3.20% 4.80% 0.40% 0.40% 2.00% 2.91% 0.40% 0.22% 0.00% 0.33% 0.00% 0.00% 0.00% 0.02% show system enhancedbuffermode Available (Kb) 97173 8094 5Min 3.48% 0.00% 31.78% 0.01% 5.00% 0.40% 4.48% 0.32% 0.53% 0.03% 0.04% Enterasys D-Series CLI Reference 2-15...
Page 54: Set System Enhancedbuffermode
Mode Switch command, read‐write. Example This example shows how to display enhanced buffer mode status: D2(su)->show system enhancedbuffermode enable Optimized system buffer distribution set system enhancedbuffermode Use this command to enable or disable enhanced buffer mode, which optimizes buffer distribution for non‐stacking single CoS queue operation. Executing this command will reset the switch, so the system prompts you to confirm whether you want to proceed. Syntax set system enhancedbuffermode {enable | disable} Parameters enable | disable Defaults None. Mode Switch command, read‐write. Example This example shows how to enable enhanced buffer mode: D2(su)->set system enhancedbuffermode enable Changes in the enhanced buffer mode will require resetting this unit.
Page 55: Set Time
Use this command to change the time of day on the system clock. Syntax set time [mm/dd/yyyy] [hh:mm:ss] Parameters [mm/dd/yyyy] [hh:mm:ss] Defaults None. Mode Switch command, read‐write. Example This example shows how to set the system clock to 7:50 a.m: D2(su)->set time 7:50:00 show summertime Use this command to display daylight savings time settings. Syntax show summertime Parameters None. Defaults None. Sets the time in: month, day, year and/or 24‐hour format At least one set of time parameters must be entered. set time Enterasys D-Series CLI Reference 2-17...
Page 56: Set Summertime
Mode Switch command, read‐only. Example This example shows how to display daylight savings time settings: D2(su)->show summertime Summertime is disabled and set to '' Start : SUN APR 04 02:00:00 2004 : SUN OCT 31 02:00:00 2004 Offset: 60 minutes (1 hours 0 minutes) Recurring: yes, starting at 2:00 of the first Sunday of April and ending at 2:00...
Page 57: Set Summertime Recurring
[offset_minutes] Parameters start_week start_day start_hr_min end_week end_day end_hr_min offset_minutes Specifies the year to start daylight savings time. Specifies the time of day to start daylight savings time. Format is hh:mm. Specifies the month of the year to end daylight savings time. Specifies the day of the month to end daylight savings time. Specifies the year to end daylight savings time. Specifies the time of day to end daylight savings time. Format is hh:mm. (Optional) Specifies the amount of time in minutes to offset daylight savings time from the non‐daylight savings time system setting. Valid values are 1 ‐ 1440. Specifies the week of the month to restart daylight savings time. Valid values are: first, second, third, fourth, and last. Specifies the day of the week to restart daylight savings time. Specifies the time of day to restart daylight savings time. Format is hh:mm. Specifies the week of the month to end daylight savings time. Specifies the day of the week to end daylight savings time. Specifies the time of day to end daylight savings time. Format is hh:mm. (Optional) Specifies the amount of time in minutes to offset daylight savings time from the non‐daylight savings time system setting. Valid values are 1 ‐ 1440. set summertime recurring Enterasys D-Series CLI Reference 2-19...
Page 58: Clear Summertime
Defaults If an offset is not specified, none will be applied. Mode Switch command, read‐write. Example This example shows how set daylight savings time to recur starting on the first Sunday of April at 2 a.m. and ending the last Sunday of October at 2 a.m. with an offset time of one hour: D2(su)->set summertime recurring first Sunday April 02:00 last Sunday October 02:00 60 clear summertime Use this command to clear the daylight savings time configuration. Syntax clear summertime Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the daylight savings time configuration: D2(su)->clear summertime set prompt Use this command to modify the command prompt.
Page 59: Show Banner Motd
Use this command to set the banner message of the day displayed at session login. Note: Banner message text must be enclosed in beginning and ending double quotation marks. The message itself cannot contain any additional double quotation marks. Syntax set banner motd message show banner motd Enterasys D-Series CLI Reference 2-21...
Page 60: Clear Banner Motd
Parameters message Defaults None. Mode Switch command, read‐write. Example This example shows how to set the message of the day banner to read: “O Knights of Ni, you are just and fair, and we will return with a shrubbery ‐ King Arthur”: D2(rw)->set banner motd "O Knights of Ni, you are just and \n fair, and we will return with a shrubbery \n \t -King Arthur" clear banner motd Use this command to clear the banner message of the day displayed at session login to a blank ...
Page 61: Set System Name
Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display version information. Please note that you may see different information displayed, depending on the type of hardware. D2(su)->show version Copyright (c) 2008 by Enterasys Networks, Inc. Model -------------- D2G124-12P Table 2‐5 provides an explanation of the command output. Table 2-5 show version Output Details Output Field Model Serial # Versions set system name Use this command to configure a name for the system. Syntax...
Page 62: Set System Location
Defaults If string is not specified, the system name will be cleared. Mode Switch command, read‐write. Example This example shows how to set the system name to Information Systems: D2(su)->set system name “Information Systems” set system location Use this command to identify the location of the system. Syntax set system location [string] Parameters string Defaults If string is not specified, the location name will be cleared. Mode Switch command, read‐write. Example This example shows how to set the system location string: D2(su)->set system location “Bldg N32-04 Closet 9” set system contact Use this command to identify a contact person for the system.
Page 63: Set Width
The number of rows of CLI output displayed is set using the set length command as described in “set length” on page 2‐26. Example This example shows how to set the terminal columns to 50: D2(su)->set width 50 (Optional) Specifies a text string that contains the name of the person to contact for system administration. Note: A contact string containing a space in the text must be enclosed in quotes as shown in the example below. Sets the number of terminal columns. Valid values are 50 to 150. (Optional) Makes this setting persistent for all future sessions (written to NV‐RAM). set width Enterasys D-Series CLI Reference 2-25...
Page 64: Set Length
Use this command to set the number of lines the CLI will display. This command is persistent (written to NV‐RAM). Syntax set length screenlength Parameters screenlength Defaults None. Mode Switch command, read‐write. Example This example shows how to set the terminal length to 50: D2(su)->set length 50 show logout Use this command to display the time (in seconds) an idle console or Telnet CLI session will remain connected before timing out. Syntax show logout Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the CLI logout setting: D2(su)->show logout Logout currently set to: 10 minutes.
Page 65: Set Logout
Syntax show console [baud] [bits] [flowcontrol] [parity] [stopbits] Parameters baud bits flowcontrol parity stopbits Defaults If no parameters are specified, all settings will be displayed. Mode Switch command, read‐only. Example This example shows how to display all console settings: D2(su)->show console Baud Flow Sets the number of minutes the system will remain idle before timing out. (Optional) Displays the input/output baud rate. (Optional) Displays the number of bits per character. (Optional) Displays the type of flow control. (Optional) Displays the type of parity. (Optional) Displays the number of stop bits. Bits StopBits Parity set logout Enterasys D-Series CLI Reference 2-27...
Page 66: Set Console Baud
------ ------- 9600 Disable set console baud Use this command to set the console port baud rate. Syntax set console baud rate Parameters rate Defaults None. Mode Switch command, read‐write. Example This example shows how to set the console port baud rate to 19200: D2(su)->set console baud 19200 Downloading a Firmware Image You can upgrade the operational firmware in the D‐Series switch without physically opening the switch or being in the same location. There are two ways to download firmware to the switch: • Via TFTP download. This procedure uses a TFTP server connected to the network and downloads the firmware using the TFTP protocol. For details on how to perform a TFTP download using the copy command, refer to “copy” on page 2‐40. For information on setting TFTP timeout and retry parameters, refer to “set tftp timeout” on page 2‐42 and “set tftp retry” on page 2‐43. •...
Page 67: Downloading From A Tftp Server
10 - Restore Configuration to factory defaults (delete config files) 11 - Set new Boot Code password [Boot Menu] 2 Type 2. The following baud rate selection screen displays: 1 - 1200 2 - 2400 3 - 4800 4 - 9600 5 - 19200 6 - 38400 Downloading a Firmware Image Enterasys D-Series CLI Reference 2-29...
Page 68: Reverting To A Previous Image
Downloading a Firmware Image 7 - 57600 8 - 115200 0 - no change Type 8 to set the switch baud rate to 115200. The following message displays: Setting baud rate to 115200, you must change your terminal baud rate. Set the terminal baud rate to 115200 and press ENTER. From the boot menu options screen, type 4 to load new operational code using XMODEM. When the XMODEM transfer is complete, the following message and header information will display: [Boot Menu] 4 Ready to receive the file with XMODEM/CRC...
Page 69: Reviewing And Selecting A Boot Firmware Image
Use this command to display the firmware image the switch loads at startup. Syntax show boot system Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the switch’s boot firmware image: D2(su)->show boot system Current system image to boot: bootfile Reviewing and Selecting a Boot Firmware Image Refer to page... 2-31 2-32 Enterasys D-Series CLI Reference 2-31...
Page 70: Set Boot System
Use this command to set the firmware image the switch loads at startup. Syntax set boot system filename Parameters filename Defaults None. Mode Switch command, read‐write. Example This example shows how to set the boot firmware image file to “newimage”: D2(su)->set boot system newimage Starting and Configuring Telnet Purpose To enable or disable Telnet, and to start a Telnet session to a remote host. The D‐Series switch allows a total of four inbound and / or outbound Telnet session to run simultaneously. Commands For information about... show telnet set telnet telnet show telnet Use this command to display the status of Telnet on the switch.
Page 71: Set Telnet
D2(su)->set telnet disable all Disconnect all telnet sessions and disable now (y/n)? [n]: y All telnet sessions have been terminated, telnet is now disabled. telnet Use this command to start a Telnet connection to a remote host. The D‐Series switch allows a total of four inbound and / or outbound Telnet session to run simultaneously. Syntax telnet host [port] Enables or disables Telnet services. (Optional) Specifies inbound service (the ability to Telnet to this switch), outbound service (the ability to Telnet to other devices), or all (both inbound and outbound). set telnet Enterasys D-Series CLI Reference 2-33...
Page 72: Managing Switch Configuration And Files
Managing Switch Configuration and Files Parameters host port Defaults If not specified, the default port number 23 will be used. Mode Switch command, read‐write. Example This example shows how to start a Telnet session to a host at 10.21.42.13: D2(su)->telnet 10.21.42.13 Managing Switch Configuration and Files Configuration Persistence Mode The default state of configuration persistence mode is “auto,” which means that when CLI configuration commands are entered, or when a configuration file stored on the switch is executed, the configuration is saved to NVRAM automatically at the following intervals: • On a standalone unit, the configuration is checked every two minutes and saved if there has been a change. • On a stack, the configuration is saved across the stack every 30 minutes if there has been a change. If you want to save a running configuration to NVRAM more often than the automatic intervals, execute the save config command and wait for the system prompt to return. After the prompt returns, the configuration will be persistent. You can change the persistence mode from “auto” to “manual” with the set snmp persistmode command. If the persistence mode is set to “manual,” configuration commands will not be automatically written to NVRAM. Although the configuration commands will actively modify the running configuration, they will not persist across a reset unless the save config command has ...
Page 73: Commands
Syntax show snmp persistmode Parameters None. Defaults None. Mode Switch command, read‐only. Usage By default, the mode is set to “auto save,” which automatically saves configuration changes at specific intervals. If the mode is set to “manual,” configuration commands are never automatically saved. In order to make configuration changes persistent when the mode is manual, the save config command must be issued as described in “Configuration Persistence Mode” on page 2‐34. show snmp persistmode Refer to page... 2-35 2-36 2-36 2-37 2-38 2-38 2-39 2-40 2-41 2-41 2-42 2-42 2-43 2-43 Enterasys D-Series CLI Reference 2-35...
Page 74: Set Snmp Persistmode
Use this command to set the configuration persistence mode, which determines whether user‐ defined configuration changes are saved automatically, or require issuing the save config command. See “Configuration Persistence Mode” on page 2‐34 for more information. Syntax set snmp persistmode {auto | manual} Parameters auto manual Defaults None. Mode Switch command, read‐write. Example This example shows how to set the configuration persistence mode to manual: D2(su)->set snmp persistmode manual save config Use this command to save the running configuration. If applicable, this command will save the configuration to all switch members in a stack. Syntax save config Parameters None. Defaults None.
Page 75: Dir
(Optional) Specifies the file name or directory to list. d2-series_01.00.00.0027 01.00.00.0027 6435840 (bytes) Tue Apr 29 11:19:37 2008 8f93540d9af0cd5605c2d30d9174065a d2-series_01.00.00.0028 (Active) (Boot) 01.00.00.0028 7586816 (bytes) Fri May 2 10:10:26 2008 d26450b99afc0f2b90dc758608642b61 Size 8293 4197 8293 8293 8293 Enterasys D-Series CLI Reference 2-37...
Page 76: Show File
Use this command to display the contents of a file. Syntax show file filename Parameters filename Defaults None. Mode Switch command, read‐only. Example This example shows how to display a text file named “mypolicy” in the configs/ directory. Note that only a portion of the file is shown in this example. D2(rw)->show file configs/mypolicy 3 : #policy 5 : set policy profile 1 name "Check GUEST" pvid-status enable pvid 4095 untagged- vlans 1 7 : set policy profile 2 name "User LABORATORIES" pvid-status enable pvid 680 cos- status enable cos 4 untagged-vlans 680 9 : set policy profile 3 name "Administrator"...
Page 77: Configure
Use 'show config all' to show both default and non-default configurations. begin #***** NON-DEFAULT CONFIGURATION ***** #port set port jumbo disable ge.1.1 configure Use this command to execute a previously downloaded configuration file stored on the switch. Syntax configure filename [append] (Optional) Displays default and non‐default configuration settings. (Optional) Specifies the exact name of one facility for which to show configuration. For example, enter “router” to show only router configuration. (Optional) Specifies that the current configuration will be written to a text file in the configs/ directory. Specifies a filename in the configs/ directory to display. configure Enterasys D-Series CLI Reference 2-39...
Page 78: Copy
Parameters filename append Defaults If append is not specified, the current running configuration will be replaced with the contents of the configuration file, which will require an automated reset of the chassis. Mode Switch command, read‐write. Example This example shows how to execute the “Jan1_2004.cfg” configuration file: D2(su)->configure configs/Jan1_2004.cfg copy Use this command to upload or download an image or a CLI configuration file. Syntax copy source destination Parameters source destination Defaults None. Mode Switch command, read‐write. Examples This example shows how to download an image via TFTP: D2(su)->copy tftp://10.1.192.34/version01000 system:image This example shows how to download a configuration file to the configs directory: D2(su)->copy tftp://10.1.192.1/Jan1_2004.cfg configs/Jan1_2004.cfg 2-40 Basic Configuration Specifies the path and file name of the configuration file to execute. (Optional) Appends the configuration file contents to the current ...
Page 79: Delete
Syntax delete filename Parameters filename Defaults None. Mode Switch command, read‐write. Usage Use the dir command (page 2‐37) to display current image and configuration file names. Example This example shows how to delete the “Jan1_2004.cfg” configuration file: D2(su)->delete configs/Jan1_2004.cfg show tftp settings Use this command to display TFTP settings used by the switch during data transfers using TFTP. Syntax show tftp settings Parameters None. Defaults None. Mode Switch command, read‐only. Usage The TFTP timeout value can be set with the set tftp timeout command. The TFTP retry value can be set with the set tftp retry command. Specifies the local path name to the file. Valid directories are /images and /configs.44. delete Enterasys D-Series CLI Reference 2-41...
Page 80: Set Tftp Timeout
TFTP packet timeout (seconds): 2 TFTP max retry: 5 set tftp timeout Use this command to configure how long TFTP will wait for a reply of either an acknowledgement packet or a data packet during a data transfer. Syntax set tftp timeout seconds Parameters seconds Defaults None. Mode Switch command, read‐write. Example This example sets the timeout period to 4 seconds. D2(rw)->set tftp timeout 4 clear tftp timeout Use this command to reset the TFTP timeout value to the default value of 2 seconds. Syntax clear tftp timeout Parameters None. Defaults None.
Page 81: Set Tftp Retry
Defaults None. Mode Switch command, read‐write. Example This example sets the retry count to 3. D2(rw)->set tftp retry 3 clear tftp retry Use this command to reset the TFTP retry value to the default value of 5 retries. Syntax clear tftp retry Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the retry value to the default of 5 retries. D2(rw)-> clear tftp retry Specifies the number of times a packet will be resent. The valid range is from 1 to 1000. Default value is 5 retries. set tftp retry Enterasys D-Series CLI Reference 2-43...
Page 82: Clearing And Closing The Cli
Clearing and Closing the CLI Purpose To clear the CLI screen or to close your CLI session. Commands For information about... exit cls (clear screen) Use this command to clear the screen for the current CLI session. Syntax Parameters None Defaults None. Mode Switch command, read‐only. Example This example shows how to clear the CLI screen: D2(su)->cls exit Use either of these commands to leave a CLI session. Syntax exit Parameters None. Defaults None. 2-44 Basic Configuration Refer to page...
Page 83: Resetting The Switch
Use this command to reset the switch without losing any user‐defined configuration settings. Syntax reset Parameters None. Defaults None. Mode Switch command, read‐write. Examples This example shows how to reset the system: D2(su)->reset This command will reset all modules and may disconnect your telnet session. Resetting the Switch Refer to page... 2-45 2-46 Enterasys D-Series CLI Reference 2-45...
Page 84: Clear Config
Do you want to continue (y/n) [n]? clear config Use this command to clear the user‐defined configuration parameters. Syntax clear config [all] Parameters all Defaults If all is not specified, stacking configuration parameters will not be cleared. Mode Switch command, read‐write. Usage Executing this command will clear the configuration in both NVRAM and on the memory card, if one is installed on the switch. This command will not clear the IP address of the switch. Use the clear ip address command to clear the IP address. When using the clear config command to clear configuration parameters in a stack, it is important to remember the following: • Use clear config to clear configuration parameters without clearing stack unit IDs. This command WILL NOT clear stack parameters and avoids the process of re‐numbering the stack. • Use clear config all when it is necessary to clear all configuration parameters, including stack unit IDs (if applicable) and switch priority values. • Use the clear ip address command to clear the IP address. Configuration parameters and stacking information can also be cleared on the master unit only by selecting option 10 (restore configuration to factory defaults) from the boot menu on switch ...
Page 85: Using And Configuring Webview
Use this command to display WebView status. Syntax show webview Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display WebView status: D2(rw)->show webview WebView is Enabled. Using and Configuring WebView Refer to page... 2-47 2-48 2-48 2-49 Enterasys D-Series CLI Reference 2-47...
Page 86: Set Webview
Use this command to enable or disable WebView on the switch. Syntax set webview {enable | disable} Parameters enable | disable Defaults None. Mode Switch command, read‐write. Usage It is good practice for security reasons to disable HTTP access on the switch when finished configuring with WebView, and then to only enable WebView on the switch when changes need to be made. Example This example shows how to disable WebView on the switch: D2(rw)->set webview disable show ssl Use this command to display SSL status. Syntax show ssl Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display SSL status: D2(rw)->show ssl...
Page 87: Set Ssl
Use this command to enable or disable the use of WebView over SSL port 443. By default, SSL is disabled on the switch. This command can also be used to reinitialize the hostkey that is used for encryption. Syntax set ssl {enabled | disabled | reinitialize | hostkey reinitialize} Parameters enabled | disabled reinitialize hostkey reinitialize Defaults None. Mode Switch command, read‐write. Example This example shows how to enable SSL: D2(rw)->set ssl enabled Enable or disable the ability to use WebView over SSL. Stops and then restarts the SSL process. Stops SSL, regenerates new keys, and then restarts SSL. set ssl Enterasys D-Series CLI Reference 2-49...
Page 88 set ssl 2-50 Basic Configuration...
Page 89: Chapter 3: Activating Licensed Features
Clearing, Showing, and Moving Licenses Licenses can be displayed, applied, and cleared only with the license commands described in this chapter. General configuration commands such as show config or clear config do not apply to licenses. Once enabled, all licenses are permanent non‐expiring. Commands For information about... set license show license clear license set license Use this command to activate the D‐Series licensed features. Syntax set license feature Parameters feature Defaults None. Mode Switch command, read‐write. Activating Licensed Features The name of the feature being licensed. Refer to page... Enterasys D-Series CLI Reference 3-1...
Page 90: Show License
Usage When you execute the set license command, you will be prompted to accept the license agreement. If you do not accept the license agreement, the licensed feature will not be enabled. Example This example shows how to activate a license on a D‐Series switch. D2(rw)->set license D2Policy Terms of this license may be found at http://www.enterasys.com/support/fla.aspx Do you accept the terms of the applicable policy license (y/n) [n]?y License successfully enabled show license Use this command to display license key information for switches with activated licenses. Syntax show license Parameters None. ...
Page 91 Parameters featureID feature The name of the feature being cleared. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear a licensed feature: D2(rw)->clear license featureId D2Policy clear license Enterasys D-Series CLI Reference 3-3...
Page 92 clear license 3-4 Activating Licensed Features...
Page 93: Chapter 4: Configuring System Power And Poe
Some commands in this section apply only to PoE-equipped D-Series devices. Consult the Installation Guide shipped with your product to determine if it is PoE-equipped. The commands in this chapter allow you to review and set system power and PoE parameters, including the power available to the system, the usage threshold for each module, whether or not SNMP trap messages will be sent when power status changes, and per‐port PoE settings. Commands For information about... show inlinepower set inlinepower threshold set inlinepower trap...
Page 94: Set Inlinepower Threshold
------ auto set inlinepower threshold Use this command to set the power usage thresholdon a specified unit or module. Syntax set inlinepower threshold usage-threshold unit-number Parameters usage‐threshold Defaults None. Mode Switch command, read‐write. Example This example shows how to set the power threshold to 50 on module/unit 1: D2(su)->set inlinepower threshold 50 1 set inlinepower trap Use this command to enable or disable the sending of an SNMP trap message for a unit whenever the status of its ports changes, or whenever the unit’s power usage threshold is crossed. The unit’s power usage threshold must be set using the set inlinepower threshold command as described on page 4‐2. Syntax set inlinepower trap {disable | enable} Parameters disable | enable...
Page 95: Show Port Inlinepower
| low}] [type type]} Parameters port‐string admin off | auto priority critical | high | low type type Defaults None. (Optional) Displays information for specific PoE port(s). .2.1 Admin Oper Priority ----- ---- -------- auto searching Specifies the port(s) on which to configure PoE. Sets the PoE administrative state to off (disabled) or auto (on). Sets the port(s) priority for the PoE allocation algorithm to critical (highest), high or low. Specifies a string describing the type of device connected to a port. show port inlinepower . In this case, the port’s .2.1 Class Power(W) ----- -------- 15.4 Enterasys D-Series CLI Reference 4-3...
Page 96 Mode Switch command, read‐write. Example This example shows how to enable PoE on port fe.3.1 with critical priority: D2(su)->set port inlinepower 4-4 Configuring System Power and PoE .3.1 admin auto priority critical...
Page 97: Configuring Cdp
Commands The commands used to review and configure the CDP discovery protocol are listed below. For information about... show cdp set cdp state set cdp auth set cdp interval set cdp hold-time clear cdp show neighbors Discovery Protocol Configuration Refer to page... 5-13 Refer to page... Enterasys D-Series CLI Reference 5-1...
Page 98: Show Cdp
For details, refer to state” on page 5-3. CDP version number(s) supported by the switch. Minimum time interval (in seconds) at which CDP configuration messages can be set. The default of 180 seconds can be reset with the set cdp hold-time command.
Page 99: Set Cdp State
Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 6-1. Whether CDP is enabled, disabled or auto-enabled on the port. Auto‐enables, disables or enables the CDP protocol on the specified port(s). In auto‐enable mode, which is the default mode for all ports, a port automatically becomes CDP‐enabled upon receiving its first CDP message. (Optional) Enables or disables CDP on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.2 .1.2 set cdp state “set cdp “set Enterasys D-Series CLI Reference 5-3...
Page 100: Set Cdp Auth
Use this command to set a global CDP authentication code. Syntax set cdp auth auth-code Parameters auth‐code Defaults None. Mode Switch command, read‐write. Usage The authentication code value determines a switch’s CDP domain. If two or more switches have the same CDP authentication code, they will be entered into each other’s CDP neighbor tables. If they have different authentication codes, they are in different domains and will not be entered into each other’s CDP neighbor tables. A switch with the default authentication code (16 null characters) will recognize all switches, no matter what their authentication code, and enter them into its CDP neighbor table. Example This example shows how to set the CDP authentication code to 1,2,3,4,5,6,7,8: D2(su)->set cdp auth 1,2,3,4,5,6,7,8: set cdp interval Use this command to set the message interval frequency (in seconds) of the CDP discovery protocol. Syntax set cdp interval frequency...
Page 101: Set Cdp Hold-Time
D2(su)->set cdp hold-time 60 clear cdp Use this command to reset CDP discovery protocol settings to defaults. Syntax clear cdp {[state] [port-state port-string] [interval] [hold-time] [auth-code]} Parameters state port‐state port‐string interval hold‐time auth‐code Defaults At least one optional parameter must be entered. Specifies the hold time value for CDP messages in seconds.Valid values are from 15 to 600. (Optional) Resets the global CDP state to auto‐enabled. (Optional) Resets the port state on specific port(s) to auto‐enabled. (Optional) Resets the message frequency interval to 60 seconds. (Optional) Resets the hold time value to 180 seconds. (Optional) Resets the authentication code to 16 bytes of 00 (00‐00‐00‐ 00‐00‐00‐00‐00). set cdp hold-time Enterasys D-Series CLI Reference 5-5...
Page 102: Show Neighbors
Mode Switch command, read‐write. Example This example shows how to reset the CDP state to auto‐enabled: D2(su)->clear cdp state show neighbors This command displays Neighbor Discovery information for either the CDP or Cisco DP protocols. Syntax show neighbors [port-string] Parameters port‐string Defaults If no port is specified, all Neighbor Discovery information is displayed. Mode Switch command, read‐only. Usage This command displays information discovered by both the CDP and the Cisco DP protocols. Example This example displays Neighbor Discovery information for all ports. D2(su)->show neighbors Port Device ID ------------------------------------------------------------------------------ ge.1.1 00036b8b1587 ge.1.6 0001f496126f ge.1.6 00-01-f4-00-72-fe ge.1.6 00-01-f4-00-70-8a ge.1.6...
Page 103: Configuring Cisco Discovery Protocol
Use this command to display global Cisco discovery protocol information. Syntax show ciscodp Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display global Cisco DP information. D2(su)->show ciscodp CiscoDP :Enabled Timer :5 Holdtime (TTl): 180 Configuring Cisco Discovery Protocol Refer to page... 5-10 5-10 5-12 Enterasys D-Series CLI Reference 5-7...
Page 104: Show Ciscodp Port Info
Number of seconds neighboring devices will hold PDU transmissions from the sending device. Default value of 180 can be changed with the set ciscodp holdtime command. The MAC address of the switch. The time that the last Cisco DP neighbor was discovered. (Optional) Displays Cisco DP information for a specific port. For a detailed ...
Page 105: Set Ciscodp Status
The trust mode of the port. Default of trusted can be changed using the set ciscodp port command. The Class of Service priority value for untrusted traffic. The default of 0 can be changed using the set ciscodp port command. Globally enable only if Cisco DP PDUs are received. Globally disable Cisco discovery protocol. Globally enable Cisco discovery protocol. set ciscodp status Enterasys D-Series CLI Reference 5-9...
Page 106: Set Ciscodp Holdtime
Parameters seconds Defaults None. Mode Switch command, read‐write. Example This example shows how to set the Cisco DP timer to 120 seconds. D2(su)->set ciscodp timer 120 set ciscodp holdtime Use this command to set the time to live (TTL) for Cisco discovery protocol PDUs. This is the amount of time, in seconds, neighboring devices will hold PDU transmissions from the sending device. Syntax set ciscodp holdtime hold-time Parameters hold‐time Defaults None. Mode Switch command, read‐write. Example This example shows how to set Cisco DP hold time to 180 seconds: D2(su)->set ciscodp hold-time 180 set ciscodp port Use this command to set the status, voice VLAN, extended trust mode, and CoS priority for ...
Page 107 Instructs attached phone to overwrite the 802.1p tag of traffic transmitted by the device connected to it with the specified value, when the trust mode of the port is set to untrusted. Value can range from 0 to 7, with 0 indicating the lowest priority. port‐string Specifies the port(s) on which status will be set. Defaults • Status: enabled • Voice VLAN: none • Trust mode: trusted • CoS value: 0 Mode Switch mode, read‐write. Usage The following points describe how the Cisco DP extended trust settings work on the switch. • A Cisco DP port trust status of trusted or untrusted is only meaningful when a Cisco IP phone is connected to a switch port and a PC or other device is connected to the back of the Cisco IP phone. • A Cisco DP port state of trusted or untrusted only affects tagged traffic transmitted by the device connected to the Cisco IP phone. Untagged traffic transmitted by the device connected to the Cisco IP phone is unaffected by this setting. • If the switch port is configured to a Cisco DP trust state of trusted (with the trusted yes parameter of this command), this setting is communicated to the Cisco IP phone instructing it to allow the device connected to it to transmit traffic containing any CoS or Layer 2 802.1p marking. set ciscodp port Enterasys D-Series CLI Reference 5-11...
Page 108: Clear Ciscodp
• If the switch port is configured to a Cisco DP trust state of untrusted (trusted no), this setting is communicated to the Cisco IP phone instructing it to overwrite the 802.1p tag of traffic transmitted by the device connected to it to 0, by default, or to the value specified by the cos parameter of this command. • There is a one‐to‐one correlation between the value set with the cos parameter and the 802.1p value assigned to ingressed traffic by the Cisco IP phone. A value of 0 equates to an 802.1p priority of 0. Therefore, a value of 7 is given the highest priority. Note: The Cisco Discovery Protocol must be globally enabled using the set ciscodp status command before operational status can be set on individual ports. Examples This example shows how to set the Cisco DP port voice VLAN ID to 3 on port fe.1.6 and enable the port operational state. D2(rw)->set ciscodp port status enable vvid 3 This example shows how to set the Cisco DP extended trust mode to untrusted on port fe.1.5 and ...
Page 109: Configuring Link Layer Discovery Protocol And Lldp-Med
Extended and automated power management of Power over Ethernet endpoints • Inventory management, allowing network administrators to track their network devices and to determine their characteristics, such as manufacturer, software and hardware versions, and serial or asset numbers The information sent by an LLDP‐enabled device is extracted and tabulated by its peers. The communication can be done when information changes or on a periodic basis. The information tabulated is aged to ensure that it is kept up to date. Ports can be configured to send this information, receive this information, or both send and receive. Either LLDP or LLDP‐MED, but not both, can be used on an interface between two devices. A switch port uses LLDP‐MED when it detects that an LLDP‐MED‐capable device is connected to it. LLDP information is contained within a Link Layer Discovery Protocol Data Unit (LLDPDU) sent in a single 802.3 Ethernet frame. The information fields in LLDPDU are a sequence of short, variable‐length, information elements known as TLVs — type, length, and value fields where: • Type identifies what kind of information is being sent • Length indicates the length of the information string in octets • Value is the actual information that needs to be sent The LLDP standard specifies that certain TLVs are mandatory in transmitted LLDPDUs, while others are optional. You can configure on a port‐specific basis which optional LLDP and LLDP‐ MED TLVs should be sent in LLDPDUs. Purpose To review and configure LLPD and LLPD‐MED. Commands The commands used to review and configure the CDP discovery protocol are listed below. Configuring Link Layer Discovery Protocol and LLDP-MED .1.5 Enterasys D-Series CLI Reference 5-13...
Page 110: Configuration Tasks
Configuring Link Layer Discovery Protocol and LLDP-MED For information about... show lldp show lldp port status show lldp port trap show lldp port tx-tlv show lldp port location-info show lldp port local-info show lldp port remote-info set lldp tx-interval set lldp hold-multiplier set lldp trap-interval set lldp med-fast-repeat set lldp port status...
Page 111: Show Lldp
[port-string] Parameters port‐string Defaults If port‐string is not specified, LLDP status information will be displayed for all ports. Mode Switch command, read‐only. : 30 : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12; : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12; : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12; : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12; (Optional) Displays LLDP status for one or a range of ports. show lldp Enterasys D-Series CLI Reference 5-15...
Page 112: Show Lldp Port Trap
Use this command to display the ports that are enabled to send an LLDP notification when a remote system change has been detected or an LLDP‐MED notification when a change in the topology has been sensed. Ports are enabled to send LLDP notifications with the set lldp port trap command and to send LLDP‐MED notifications with the set lldp port med‐trap command. Syntax show lldp port trap [port-string] Parameters port‐string Defaults If port‐string is not specified, LLDP port trap information will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display LLDP port trap information for all ports. D2(ro)->show lldp port trap Trap-Enabled Ports MED Trap-Enabled Ports: show lldp port tx-tlv Use this command to display information about which optional TLVs have been configured to be transmitted on ports. Ports are configured to send optional TLVs with the set lldp port tx‐tlv command. Syntax show lldp port tx‐tlv [port‐string] 5-16 Discovery Protocol Configuration : ge.1.1-60;...
Page 113: Show Lldp Port Location-Info
D2(ro)->show lldp port location-info ge.1.1-3 (Optional) Displays information about TLV configuration for one or a range of ports. Sys Mgmt Vlan Pro (Optional) Displays port location information for one or a range of ports. show lldp port location-info MAC PoE Link Max MED MED MED MED Aggr Frame Cap Pol Loc PoE --- --- --- --- Enterasys D-Series CLI Reference 5-17...
Page 114: Show Lldp Port Local-Info
Mgmt Addr : 10.21.64.100 Chassis ID : 00-E0-63-93-74-A5 Sys Name : LLDP PoE test Chassis Sys Desc : Enterasys Networks, Inc. Sys Cap Supported/Enabled Auto-Neg Supported/Enabled Auto-Neg Advertised Operational Speed/Duplex/Type : 100 full tx Max Frame Size (bytes) Vlan Id LAG Supported/Enabled/Id Protocol Id : Spanning Tree v-3 (IEEE802.1s)
Page 115: Show Lldp Port Local-Info Output Details
PoE Device LLDP-MED Extensions Extended Power via MDI TLV. Displayed only when a port has PoE capabilities. Value is the Power Type of the device. On a switch port, the value is Power Sourcing Entity (PSE). : PSE device : primary...
Page 116: Show Lldp Port Remote-Info
Parameters port‐string Defaults If port‐string is not specified, remote system information will be displayed for all ports. Mode Switch command, read‐only. 5-20 Discovery Protocol Configuration What it Displays... LLDP-MED Extensions Extended Power via MDI TLV. Displayed only when a port has PoE capabilities. Value can be primary or backup, indicating whether the PSE is using its primary or backup power source.
Page 117: Show Lldp Port Remote-Info Output Display
Remote Port Id : 00-09-6e-0e-14-3d : bridge,telephone/bridge : yes/yes : 10BASE-T, 10BASE-TFD : 100BASE-TX, 100BASE-TXFD : pause, Spause : 4610D01A : b10d01b2_7.bin : a10d01b2_7.bin : 05GM42004348 : Avaya : 4610 show lldp port remote-info .3.1. The Enterasys D-Series CLI Reference 5-21...
Page 118: Set Lldp Tx-Interval
Use this command to set the time, in seconds, between successive LLDP frame transmissions initiated by changes in the LLDP local system information. Syntax set lldp tx-interval frequency Parameters frequency Defaults None. Mode Switch command, read‐write. Example This example sets the transmit interval to 20 seconds. D2(rw)->set lldp tx-interval 20 set lldp hold-multiplier Use this command to set the time‐to‐live value used in LLDP frames sent by this device. The time‐ to‐live for LLDPDU data is calculated by multiplying the transmit interval by the hold multiplier value. Syntax set lldp hold-multiplier multiplier-val Parameters multiplier‐val Defaults None.
Page 119: Set Lldp Trap-Interval
Switch command, read‐write. Example This example sets the minimum interval between LLDP traps to 10 seconds. D2(rw)->set lldp trap-interval 10 set lldp med-fast-repeat Network connectivity devices transmit only LLDP TLVs in LLDPDUs until they detect that an LLDP‐MED endpoint device has connected to a port. At that point, the network connectivity device starts sending LLDP‐MED TLVs at a fast start rate on that port. Use this command to set the number of successive LLDPDUs (with LLDP‐MED TLVs) to be sent for one complete fast start interval. Syntax set lldp med-fast-repeat count Parameters count Defaults None. Mode Switch command, read‐write. Specifies the minimum time between LLDP trap transmissions, in seconds. The value can range from 5 to 3600 seconds. The default value is 5 seconds. Specifies the number of fast start LLDPDUs to be sent when an LLDP‐MED endpoint device is detected. Value can range from 1 to 10. Default is 3. set lldp trap-interval Enterasys D-Series CLI Reference 5-23...
Page 120: Set Lldp Port Status
{tx-enable | rx-enable | both | disable} port-string Parameters tx‐enable rx‐enable both disable port‐string Defaults None. Mode Switch command, read‐write. Example This example enables both transmitting LLDPDUs and receiving and processing LLDPDUs from remote systems on ports D2(rw)->set lldp port status both ge.1.1-6 set lldp port trap Use this command to enable or disable sending LLDP notifications (traps) when a remote system change is detected. Syntax set lldp port trap {enable | disable} port-string...
Page 121: Set Lldp Port Med-Trap
{[all] | [port-desc] [sys-name] [sys-desc] [sys-cap] [mgmt- addr] [vlan-id] [stp] [lacp] [gvrp] [mac-phy] [poe] [link-aggr] [max-frame] [med- cap] [med-loc] [med-poe]} port-string .1.1 through Enables transmitting LLDP‐MED traps on the specified ports. Disables transmitting LLDP‐MED traps on the specified ports. Specifies the port or range of ports to be affected. set lldp port med-trap .1.6. .1.1 through .1.6. Enterasys D-Series CLI Reference 5-25...
Page 122 set lldp port tx-tlv Parameters port‐desc sys‐name sys‐desc sys‐cap mgmt‐addr vlan‐id lacp gvrp mac‐phy link‐aggr max‐frame med‐cap med‐loc med‐poe port‐string 5-26 Discovery Protocol Configuration Adds all optional TLVs to transmitted LLDPDUs. Port Description optional basic LLDP TLV. Value sent is ifDescr object defined in RFC 2863. System Name optional basic LLDP TLV. Value sent is the administratively assigned name for the system. System Description optional basic LLDP TLV. Value sent is sysDescr object defined in RFC 3418. System Capabilities optional basic LLDP TLV. For a network connectivity device, value sent can be bridge and/or router. Management Address optional basic LLDP TLV. Value sent is IPv4 address of host interface. Port VLAN ID IEEE 802.1 Extensions TLV. Value sent is port VLAN ID (PVID). Spanning Tree information defined by Protocol Identity IEEE 802.1 Extensions TLV. If STP is enabled on the port, value sent includes version of protocol being used. LACP information defined by Protocol Identity IEEE 802.1 ...
Page 123: Clear Lldp
{all | tx-interval | hold-multiplier | trap-interval | med-fast-repeat} Parameters tx‐interval hold‐multiplier trap‐interval med‐fast‐repeat Defaults None. Mode Switch command, read‐write. Example This example returns the transmit interval to the default value of 30 seconds. D2(rw)->clear lldp tx-interval clear lldp port status Use this command to return the port status to the default value of both (both transmitting and processing received LLDPDUs are enabled). .1.1. Returns all LLDP configuration parameters to their default values, including port LLDP configuration parameters. Returns the number of seconds between transmissions of LLDP frames.to the default of 30 seconds. Returns the multiplier to apply to the transmit interval to determine the time‐to‐live value to the default value of 4. Returns the minimum time between LLSP trap transmissions to the default value of 5 seconds. Returns the number of fast start LLDPDUs to be sent when an LLDP‐ MED endpoint device is detected to the default of 3. clear lldp Enterasys D-Series CLI Reference 5-27...
Page 124: Clear Lldp Port Trap
Syntax clear lldp port status port-string Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example returns port processing received LLDPDUs. D2(rw)->clear lldp port status ge.1.1 clear lldp port trap Use this command to return the port LLDP trap setting to the default value of disabled. Syntax clear lldp port trap port-string Parameters port‐string Defaults None. Mode Switch command, read‐write.
Page 125: Clear Lldp Port Tx-Tlv
Specifies the port or range of ports to be affected. .1.1 to the default LLDP‐MED trap state of disabled. Disables all optional TLVs from being transmitted in LLDPDUs. Disables the Port Description optional basic LLDP TLV from being transmitted in LLDPDUs. Disables the System Name optional basic LLDP TLV from being transmitted in LLDPDUs. Disables the System Description optional basic LLDP TLV from being transmitted in LLDPDUs. Disables the System Capabilities optional basic LLDP TLV from being transmitted in LLDPDUs. Disables the Management Address optional basic LLDP TLV from being transmitted in LLDPDUs. Disables the Port VLAN ID IEEE 802.1 Extensions TLV from being transmitted in LLDPDUs. Disables the Spanning Tree information defined by Protocol Identity IEEE 802.1 Extensions TLV from being transmitted in LLDPDUs. Disables the LACP information defined by Protocol Identity IEEE 802.1 Extensions TLV from being transmitted in LLDPDUs. Disables the GVRP information defined by Protocol Identity IEEE 802.1 Extensions TLV from being transmitted in LLDPDUs. Disables the MAC‐PHY Configuration/Status IEEE 802.3 Extensions TLV from being transmitted in LLDPDUs. clear lldp port tx-tlv Enterasys D-Series CLI Reference 5-29...
Page 126 Defaults None. Mode Switch command, read‐write. Example This example disables the management address, MED capability, and MED location identification TLVs from being sent in LLDPDUs by port D2(rw)->clear lldp port tx-tlv mgmt-addr med-cap med-loc ge.1.1 5-30 Discovery Protocol Configuration Disables the Power via MDI IEEE 802.3 Extensions TLV from being transmitted in LLDPDUs. Only valid for PoE‐enabled ports. Disables the Link Aggregation IEEE 802.3 Extensions TLV from being transmitted in LLDPDUs. Disables the Maximum Frame Size IEEE 802.3 Extensions TLV from being transmitted in LLDPDUs. Disables the LLDP‐MED Capabilities TLV from being transmitted in LLDPDUs. Disables the LLDP‐MED Location Identification TLV from being transmitted in LLDPDUs. Disables the LLDP‐MED Extended Power via MDI TLV from being ...
Page 127: Port Configuration Summary
Port Configuration Summary Port String Syntax Used in the CLI Commands requiring a port‐string parameter use the following syntax to designate port type, slot location, and port number: port type.unit_or_slot number.port number Where port type can be: fe for 100‐Mbps Ethernet ge for 1‐Gbps Ethernet tg for 10‐Gbps Ethernet host for the host port vlan for vlan interfaces lag for IEEE802.3 link aggregation ports Where unit_or_slotnumber is 1 for the D2 standalone unit. Where port number depends on the device. The highest valid port number is dependent on the number of ports in the device and the port type. Port Configuration Refer to page... 6-10 6-13 6-15 6-19 6-21 6-30 6-33 6-36 6-50 Enterasys D-Series CLI Reference 6-1...
Page 128: Configuring Sfp Ports For 100Base-Fx
Port Configuration Summary Port Slot/Unit Parameters Used in the CLI The “unit” parameter is often used interchangeably with “module” in the standalone switch CLI to indicate a module slot location. Examples Note: You can use a wildcard (*) to indicate all of an item. For example, fe.3.* would represent all 100Mbps Ethernet (fe) ports in slot 3, and ge.3 * would represent all 1-Gigabit Ethernet (ge) ports in slot 3.
Page 129: Reviewing Port Status
Oper Admin Speed Status Status (bps) Down Oper Admin Speed Status Status (bps) Down 100.0M Reviewing Port Status Duplex Type 1000BASE-SX Duplex Type full 100BASE-FX Refer to page... Enterasys D-Series CLI Reference 6-3...
Page 130: Show Port
Use this command to display whether or not one or more ports are enabled for switching. Syntax show port [port-string] Parameters port‐string Defaults If port‐string is not specified, operational status information for all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display operational status information for fe.3.14: D2(su)->show port Port .3.14 enabled show port status Use this command to display operating and admin status, speed, duplex mode and port type for one or more ports on the device. Syntax show port status [port-string] Parameters port‐string Defaults If port‐string is not specified, status information for all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display status information for fe.3.14: D2(su)->show port status...
Page 131: Show Port Counters
Physical port and interface type. (Optional) Displays counter statistics for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. (Optional) Displays switch or MIB2 statistics. Switch statistics detail performance of the D‐Series device. MIB2 interface statistics detail performance of all network devices. -------- ------- ------------- BaseT RJ45 CLI” on page 6-1. enable” on page 6-7. “set port speed” on page 6-11. “Setting Auto-Negotiation and Enterasys D-Series CLI Reference 6-5 show port counters...
Page 132: Show Port Counters Output Details
In Multicast Pkts In Broadcast Pkts In Discards In Errors Out Octets Out Unicasts Pkts Out Multicast Pkts Out Broadcast Pkts Out Errors 802.1Q Switch Counters ---------------------- Frames Received Frames Transmitted This example shows how to display all fe.3.1 port counter statistics related to traffic through the device. D2(su)->show port counters Port: .3.1 802.1Q Switch Counters...
Page 133: Disabling / Enabling And Naming Ports
Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to disable fe.1.1: D2(su)->set port disable set port enable Use this command to administratively enable one or more ports. Syntax set port enable port-string Specifies the port(s) to disable. For a detailed description of possible port‐ string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.1 Disabling / Enabling and Naming Ports Refer to page... Enterasys D-Series CLI Reference 6-7...
Page 134: Show Port Alias
Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to enable fe.1.3: D2(su)->set port enable show port alias Use this command to display the alias name for one or more ports. Syntax show port alias [port-string] Parameters port‐string Defaults If port‐string is not specified, aliases for all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display alias information for ports 1‐3 on slot 3: D2(rw)->show port alias ge.3.1-3 Port ge.3.1 user Port ge.3.2 user Port ge.3.3 Admin...
Page 135 Parameters port‐string Specifies the port to which an alias will be assigned. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. name (Optional) Assigns an alias name to the port. If the alias name contains spaces, the text string must be surrounded by double quotes. Maximum length is 60 characters. Defaults If name is not specified, the alias assigned to the port will be cleared. Mode Switch command, read‐write. Examples This example shows how to assign the alias “Admin” to D2(rw)->set port alias ge.3.3 Admin This example shows how to clear the alias for D2(rw)->set port alias ge.3.3 .3.3: .3.3: Enterasys D-Series CLI Reference 6-9 set port alias...
Page 136: Setting Speed And Duplex Mode
Use this command to display the default speed setting on one or more ports. Syntax show port speed [port-string] Parameters port‐string Defaults If port‐string is not specified, default speed settings for all ports will display. Mode Switch command, read‐only. Example This example shows how to display the default speed setting for 1‐Gigabit Ethernet port 14 in slot 3: D2(su)->show port speed ge.3.14 default speed is 10 on port ge.3.14. 6-10 Port Configuration (Optional) Displays default speed setting(s) for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Refer to page...
Page 137: Set Port Speed
This example shows how to set fe.3.3 to a port speed of 10 Mbps: D2(su)->set port speed show port duplex Use this command to display the default duplex setting (half or full) for one or more ports. Syntax show port duplex [port-string] Parameters port‐string Defaults If port‐string is not specified, default duplex settings for all ports will be displayed. Mode Switch command, read‐only. Specifies the port(s) for which to a speed value will be set. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Specifies the port speed. Valid values are: 10 Mbps, 100 Mbps, or 1000 Mbps. .3.3 10 (Optional) Displays default duplex setting(s) for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. set port speed Enterasys D-Series CLI Reference 6-11...
Page 138: Set Port Duplex
Use this command to set the default duplex type for one or more ports. This command will only take effect on ports that have auto‐negotiation disabled. Syntax set port duplex port-string {full | half} Parameters port‐string full | half Defaults None. Mode Switch command, read‐write. Example This example shows how to set fe.1.17 to full duplex: D2(su)->set port duplex 6-12 Port Configuration Specifies the port(s) for which duplex type will be set. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Sets the port(s) to full‐duplex or half‐duplex operation. .1.17 full...
Page 139: Enabling / Disabling Jumbo Frame Support
Example This example shows how to display the status of jumbo frame support for D2(su)->show port jumbo ge.1.1 Port Number ------------- --------------- ------------------ ge.1.1 (Optional) Displays the status of jumbo frame support for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Jumbo Status Max Frame Size Enable 9216 Enabling / Disabling Jumbo Frame Support Refer to page... 6-13 6-14 6-14 .1.1: Enterasys D-Series CLI Reference 6-13...
Page 140: Set Port Jumbo
Use this command to enable or disable jumbo frame support on one or more ports. Syntax set port jumbo {enable | disable}[port-string] Parameters enable | disable port‐string Defaults If port‐string is not specified, jumbo frame support will be enabled or disabled on all ports. Mode Switch command, read‐write. Example This example shows how to enable jumbo frame support for Gigabit Ethernet port 14 in slot 3: D2(su)->set port jumbo enable ge.3.14 clear port jumbo Use this command to reset jumbo frame support status to enabled on one or more ports. Syntax clear port jumbo [port-string] Parameters port‐string Defaults If port‐string is not specified, jumbo frame support status will be reset on all ports.
Page 141: Setting Auto-Negotiation And Advertised Ability
Use this command to display the status of auto‐negotiation for one or more ports. Syntax show port negotiation [port-string] Parameters port‐string Defaults If port‐string is not specified, auto‐negotiation status for all ports will be displayed. Mode Switch command, read‐only. (Optional) Displays auto‐negotiation status for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Setting Auto-Negotiation and Advertised Ability Refer to page... 6-15 6-16 6-16 6-17 6-18 Enterasys D-Series CLI Reference 6-15...
Page 142: Set Port Negotiation
Use this command to enable or disable auto‐negotiation on one or more ports. Syntax set port negotiation port-string {enable | disable} Parameters port‐string enable | disable Defaults None. Mode Switch command, read‐write. Example This example shows how to disable auto‐negotiation on 1‐Gigabit Ethernet port 3 in slot 14: D2(su)->set port negotiation ge.3.14 disable show port advertise Use this command to display port capability and advertisement as far as speed and duplex for auto‐negotiation. Syntax show port advertise [port-string] Parameters port‐string Defaults If port‐string is not specified, advertisement for all ports will be displayed.
Page 143: Set Port Advertise
{port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd | pause} Parameters port‐string 10tfd 100tx 100txfd 1000t 1000tfd pause Defaults None. advertised remote advertised remote Select the ports for which to configure advertisements. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Advertise 10BASE‐T half duplex mode. Advertise 10BASE‐T full duplex mode. Advertise 100BASE‐TX half duplex mode. Advertise 100BASE‐TX full duplex mode. Refer to “Configuring SFP Ports for 100BASE‐FX” on page 6‐2 for more information on setting advertised ability for 100 Mb SFP tranceivers. Advertise 1000BASE‐T half duplex mode. Advertise 1000BASE‐T full duplex mode. Advertise PAUSE for full‐duplex links. set port advertise Enterasys D-Series CLI Reference 6-17...
Page 144: Clear Port Advertise
Mode Switch command, read‐write. Example This example shows how to configure port 1 to advertise 1000BASE‐T full duplex: D2(su)->set port advertise ge.1.1 1000tfd clear port advertise Use this command to configure a port to not advertise a specific speed/duplex capability when auto‐negotiating with another port. Syntax clear port advertise {port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd | pause} Parameters port‐string 10tfd 100tx 100txfd 1000t...
Page 145: Setting Flow Control
Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the port flow control state: D2(su)->show flowcontrol Flow control status: enabled set flowcontrol Use this command to enable or disable flow control. Syntax set flowcontrol {enable | disable} Parameters enable | disable Enables or disables flow control settings. Setting Flow Control Refer to page... 6-19 6-19 Enterasys D-Series CLI Reference 6-19...
Page 146 Defaults None. Mode Switch command, read‐write. Example This example shows how to enable flow control: D2(su)->set flowcontrol enable 6-20 Port Configuration...
Page 147: Setting Port Link Traps And Link Flap Detection
Use this command to display whether the port is enabled for generating an SNMP trap message if its link state changes. Syntax show port trap [port-string] Parameters port‐string (Optional) Displays link trap status for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Setting Port Link Traps and Link Flap Detection Refer to page... 6-21 6-22 6-22 6-25 6-25 6-26 6-26 6-27 6-27 6-28 6-28 6-29 Enterasys D-Series CLI Reference 6-21...
Page 148: Set Port Trap
Defaults If port‐string is not specified, the trap status for all ports will be displayed. Mode Switch command, read‐write. Example This example shows how to display link trap status for fe.3.1 through 4: D2(su)->show port trap Link traps enabled on port Link traps enabled on port Link traps enabled on port Link traps enabled on port set port trap Use this command to enable of disable ports for sending SNMP trap messages when their link status changes. Syntax set port trap port-string {enable | disable} Parameters port‐string...
Page 149 Linkflap global state Linkflap port state Linkflap action Linkflap interval Linkflap maximum allowed link downs per 10 seconds Linkflap threshold (number of allowed link down transitions before action is taken) show linkflap Default Condition Disabled Disabled None Enterasys D-Series CLI Reference 6-23...
Page 150: Show Linkflap Parameters Output Details
show linkflap Examples This example shows how to display the global status of the link trap detection function: D2(rw)->show linkflap globalstate Linkflap feature globally disabled This example shows how to display ports disabled by link flap detection due to a violation: D2(rw)->show linkflap downports Ports currently held DOWN for Linkflap violations: None. This example shows how to display the link flap parameters table: D2(rw)->show linkflap parameters Linkflap Port Settable Parameter Table (X means error occurred) Port LF Status -------- --------- ge.1.1 disabled...
Page 151: Set Linkflap Globalstate
Parameters disable | enable port‐string Defaults If port‐string is not specified, all ports are enabled or disabled. What it displays... Time (in seconds) since the last link down event. Number of link flap violations on listed ports since system start. Globally disables or enables the link flap detection function. Disables or enables the link flap detection function. (Optional) Specifies the port or ports on which to disable or enable monitoring. set linkflap globalstate Enterasys D-Series CLI Reference 6-25...
Page 152: Set Linkflap Interval
Mode Switch command, read‐write. Example This example shows how to enable the link trap monitoring on all ports. D2(rw)->set linkflap portstate enable set linkflap interval Use this command to set the time interval (in seconds) for accumulating link down transitions. Syntax set linkflap interval port-string interval-value Parameters port‐string interval‐value Defaults None. Mode Switch command, read‐write. Example This example shows how to set the link flap interval on port fe.1.4 to 1000 seconds. D2(rw)->set linkflap interval set linkflap action Use this command to set reactions to a link flap violation. Syntax set linkflap action port-string {disableInterface | gensyslogentry | gentrap |...
Page 153: Clear Linkflap Action
Defaults If port‐string is not specified, actions will be cleared on all ports. Mode Switch mode, read‐write. Example This example shows how to clear the link flap violation action on port fe.1.4 to generating a Syslog entry. D2(rw)->clear linkflap action set linkflap threshold Use this command to set the link flap action trigger count. Syntax set linkflap threshold port-string threshold-value .1.4 gensyslogentry (Optional) Specifies the port(s) on which to clear the link flap action. Clears the reaction as disabling the interface. Clears the reaction as generating a syslog entry. Clears the reaction as generating an SNMP trap. Clears the reaction as all of the above. .1.4 gensyslogentry clear linkflap action Enterasys D-Series CLI Reference 6-27...
Page 154: Set Linkflap Downtime
Parameters port‐string threshold‐value Defaults None. Mode Switch mode, read‐write. Example This example shows how to set the link flap threshold on port fe.1.4 to 5. D2(rw)->set linkflap threshold set linkflap downtime Use this command to set the time interval (in seconds) one or more ports will be held down after a link flap violation. Syntax set linkflap downtime port-string downtime-value Parameters port‐string downtime‐value Defaults None. Mode Switch mode, read‐write. Example This example shows how to set the link flap downtime on port fe.1.4 to 5000 seconds. D2(rw)->set linkflap downtime clear linkflap down Use this command to toggle link flap disabled ports to operational.
Page 155: Clear Linkflap
{all | stats [port-string] | parameter port-string {threshold | interval | downtime | all} Parameters all | stats parameter threshold | interval | downtime | all port‐string Defaults If port‐string is not specified, settings and/or statistics will be cleared on all ports. Mode Switch mode, read‐write. Example This example shows how to clear all link flap options on port fe.1.4. D2(rw)->clear linkflap all (Optional) Specifies the ports to make operational. .1.4 Clears all options and statistics, or clears only statistics. Clears link flap parameters. Clears link flap threshold, interval, downtime or all parameters. (Optional unless parameter is specified) Specifies the port(s) on which to clear settings. .1.4 clear linkflap Enterasys D-Series CLI Reference 6-29...
Page 156: Configuring Broadcast Suppression
Configuring Broadcast Suppression Configuring Broadcast Suppression Purpose To review and set the broadcast suppression threshold for one or more ports. This feature limits the number of received broadcast frames the switch will accept per port. Broadcast suppression thresholds apply only to broadcast traffic—multicast traffic is not affected. By default, a broadcast suppression threshold of 14881 packets per second (pps) will be used, regardless of actual port speed. Broadcast suppression protects against broadcast storms and ARP sweeps. Commands For information about... show port broadcast set port broadcast clear port broadcast show port broadcast Use this command to display port broadcast suppression thresholds. Syntax show port broadcast [port-string] Parameters port‐string Defaults If port‐string is not specified, broadcast status of all ports will be displayed. Mode Switch command, read‐only.
Page 157: Set Port Broadcast
D2(su)->set port broadcast ge.1.1-5 50 clear port broadcast Use this command to clear the broadcast threshold limit to the default value of 14881 for the selected port. Syntax clear port broadcast port-string threshold Parameters port‐string Select the ports for which to configure broadcast suppression thresholds. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Sets the packets per second threshold on broadcast traffic. Maximum value is • 148810 for Fast Ethernet ports • 1488100 for 1‐Gigabit ports. • 14881000 for 10‐ Gigabit ports Select the ports for which to clear broadcast suppression thresholds. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. set port broadcast Enterasys D-Series CLI Reference 6-31...
Page 158 Defaults None. Mode Switch command, read‐write. Example This example clears the broadcast threshold limit to 14881 pps for ports 1 through 5: D2(su)->clear port broadcast ge.1.1-5 threshold 6-32 Port Configuration...
Page 159: Port Mirroring
Caution: Traffic mirrored to a VLAN may contain control traffic. This may be interpreted by the downstream neighbor as legal control frames. It is recommended that you disable any protocols (such as Spanning Tree) on inter-switch connections that might be affected . Purpose To review and configure port mirroring on the device.
Page 160: Set Port Mirroring
Defaults None. Mode Switch command, read‐only. Example This example shows how to display port mirroring information. In this case, fe.1.4 is configured as a source port and fe.1.11 is a target and mirroring has been enabled between these ports: D2(su)->show port mirroring Port Mirroring ============== Source Port = Target Port = Frames Mirrored = Rx and Tx Port Mirroring status enabled. set port mirroring Use this command to create a new mirroring relationship or to enable or disable an existing mirroring relationship between two ports. Notes: When a port mirror is created, the mirror destination port is removed from VLAN 1’s egress list after a reboot.
Page 161: Clear Port Mirroring
Use this command to clear a port mirroring relationship. Syntax clear port mirroring source destination Parameters source destination Defaults None. Mode Switch command, read‐write. Example This example shows how to clear port mirroring between source port fe.1.4 and target port fe.1.11: D2(su)->clear port mirroring .1.4 .1.11 .1.4 .1.11 Specifies the source port of the mirroring configuration to be cleared. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Specifies the target port of the mirroring configuration to be cleared. .1.4 .1.11 clear port mirroring Enterasys D-Series CLI Reference 6-35...
Page 162: Link Aggregation Control Protocol (Lacp)
Caution: Link aggregation configuration should only be performed by personnel who are knowledgeable about Spanning Tree and Link Aggregation, and fully understand the ramifications of modifications beyond device defaults. Otherwise, the proper operation of the network could be at risk. Using multiple links simultaneously to increase bandwidth is a desirable switch feature, which can be accomplished if both sides agree on a set of ports that are being used as a Link Aggregation Group (LAG). Once a LAG is formed from selected ports, problems with looping can be avoided since the Spanning Tree can treat this LAG as a single port.
Page 163: Lacp Terminology
Value assigned to aggregator ports and physical ports that are candidates for joining a LAG. The LACP implementation on D-Series devices will use this value to form an oper key and will determine which underlying physical ports are capable of aggregating by comparing oper keys.
Page 164: Commands
Link Aggregation Control Protocol (LACP) is, will block redundant paths). For information about building static aggregations, refer to set lacp static (page Each D‐Series module provides six virtual link aggregator ports, which are designated in the CLI as lag.0.1 through lag.0.6. Each LAG can have up to eight associated physical ports. Once underlying physical ports (for example, fe.x.x, or the resulting aggregation will be represented as one LAG with a lag.x.x port designation. LACP determines which underlying physical ports are capable of aggregating by comparing operational keys. Aggregator ports allow only underlying ports with keys matching theirs to join their LAG. LACP uses a system priority value to build a LAG ID, which determines aggregation precedence. If there are two partner devices competing for the same aggregator, LACP compares the LAG IDs for each grouping of ports. The LAG with the lower LAG ID is given precedence and will be allowed to use the aggregator. There are a few cases in which ports will not aggregate: • An underlying physical port is attached to another port on this same switch (loopback). • There is no available aggregator for two or more ports with the same LAG ID. This can happen if there are simply no available aggregators, or if none of the aggregators have a matching admin key and system priority. • 802.1x authentication is enabled using the set eapol command (page would otherwise aggregate are not 802.1X authorized. The LACP implementation on the D‐Series device will allow up to eight physical ports into a LAG. The device with the lowest LAG ID determines which underlying physical ports are allowed into a LAG based on the ports’ LAG port priority. Ports with the lowest LAG port priority values are allowed into the LAG and all other speed groupings go into a standby state. When an existing dynamically created LAG is reduced to one port, the D‐Series removes the LAG from its VLAN and adds the remaining underlying port to the VLAN. For this reason, you should ensure that the LAG and all the ports in the LAG are assigned to the egress list of the desired VLAN. Otherwise, when the LAG is removed, the remaining port may be assigned to the wrong VLAN. The other option is to enable the singleportlag feature as described in “set lacp singleportlag” on page 6‐44. Note: To aggregate, underlying physical ports must be running in full duplex mode and must be of the same operating speed.
Page 165: Show Lacp
System Identifier: System Priority: Admin Key: Oper Key: Attached Ports: Table 6‐11 provides an explanation of the command output. (Optional) Displays LACP information for specific LAG port(s). Valid port designations are lag.0.1 ‐ 6. disabled Actor 00:01:F4:5F:1E:20 00:11:88:11:74:F9 32768 32768 32768 ge.1.1 ge.1.3 show lacp Refer to page... 6-43 6-45 6-46 6-48 . The following table describes the Partner 32768 Enterasys D-Series CLI Reference 6-39...
Page 166: Set Lacp
Remote device participating in LACP negotiation. MAC addresses for actor and partner. System priority value which determines aggregation precedence. Only one LACP system priority can be set on a D-Series device, using either the set lacp asyspri command (page 6-41), or the set port lacp command Port’s assigned key.
Page 167: Set Lacp Asyspri
LAG with the lower LAG ID is given precedence and will be allowed to use the aggregator. Example This example shows how to set the LACP system priority to 1000: D2(su)->set lacp asyspri 1000 set lacp aadminkey Use this command to set the administratively assigned key for one or more aggregator ports. Syntax set lacp aadminkey port-string value Parameters port‐string value Defaults None. Mode Switch command, read‐write. Sets the system priority to be used in creating a LAG (Link Aggregation Group) ID. Valid values are 0 to 65535. Specifies a system priority value. Valid values are 0 to 65535, with precedence given to lower values. Specifies the LAG port(s) on which to assign an admin key. Specifies an admin key value to set. Valid values are 0 to 65535. The default admin key value is 32768. set lacp asyspri Enterasys D-Series CLI Reference 6-41...
Page 168: Clear Lacp
Use this command to clear LACP system priority or admin key settings. Syntax clear lacp {[asyspri] [aadminkey port-string]} Parameters asyspri aadminkey port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the actor admin key for LAG port 6: D2(su)->clear lacp aadminkey lag.0.6 set lacp static Use this command to disable or enable static link aggregation, or to assign one or more underlying physical ports to a Link Aggregation Group (LAG). Syntax set lacp static {disable | enable} | lagportstring [key] port-string Parameters disable | enable lagportstring ...
Page 169: Clear Lacp Static
Note: This key value must be unique. If ports other than the desired underlying physical ports share the same admin key value, aggregation will fail or undesired aggregations will form. Specifies the member port(s) to add to the LAG. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.6 Specifies the LAG aggregator port from which ports will be removed. Specifies the port(s) to remove from the LAG. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.6 clear lacp static Enterasys D-Series CLI Reference 6-43...
Page 170: Set Lacp Singleportlag
Use this command to enable or disable the formation of single port LAGs. Syntax set lacp singleportlag {enable | disable} Parameters disable | enable Defaults None. Mode Switch command, read‐write. Usage When single port LAGs are enabled, Link Aggregration Groups can be formed when only one port is receiving protocol transmissions from a partner. When this setting is disabled, two or more ports are required to form a LAG. This setting has no effect on existing LAGs created with multiple member ports. It also does not prevent previously formed LAGs from coming up after they have gone down, as long as any previous LAG member ports comes up connected to the same switch as before the LAG went down. Example This example enables the formation of single port LAGs: D2(su)->set lacp singleportlag enable clear lacp singleportlag Use this command to reset the single port LAG function back to the default state of disabled. Syntax clear lacp singleportlag Parameters None.
Page 171: Show Port Lacp
• D = Distributing (tx enabled) • C = Collecting (rx enabled) • S = Synchronized (actor and partner agree) • G = Aggregation allowed • S/l = Short/Long LACP timeout • A/p = Active/Passive LACP For more information about these states, refer to set port lacp (page specification. Examples This example shows how to display detailed LACP status information D2(su)-> show port lacp port Displays LACP information for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Displays LACP status in detailed or summary information. Displays LACP counter information. .1.12 status detail show port lacp 6‐46) and the IEEE 802.3 2002 f or port fe.1.12: Enterasys D-Series CLI Reference 6-45...
Page 172: Set Port Lacp
set port lacp Port Instance: ActorPort: ActorSystemPriority: ActorPortPriority: ActorAdminKey: ActorOperKey: ActorAdminState: ActorOperState: ActorSystemID: SelectedAggID: AttachedAggID: MuxState: DebugRxState: This example shows how to display summarized LACP status information for port fe.1.12: D2(su)->show port lacp port Port Aggr .1.12 none This example shows how to display LACP counters for port fe.1.12: D2(su)->show port lacp port Port Instance: LACPDUsRx: LACPDUsTx: IllegalRx: UnknownRx: MarkerPDUsRx: MarkerPDUsTx: MarkerResponsePDUsRx: MarkerResponsePDUsTx: set port lacp Use this command to set link aggregation parameters for one or more ports. These settings will ...
Page 173 Defaults At least one parameter must be entered per port‐string. If enable or disable are not specified, port(s) will be enabled with the LACP parameters entered. Mode Switch command, read‐write. Note: Only one LACP system priority can be set on a D-Series device, using either this command, or the set lacp asyspri command (“set lacp asyspri” on page 6-41). Enterasys D-Series CLI Reference 6-47 set port lacp...
Page 174: Clear Port Lacp
clear port lacp Usage LACP commands and parameters beginning with an “a” (such as aadminkey) set actor values. Corresponding commands and parameters beginning with a “p” (such as padminkey) set corresponding partner values. Actor refers to the local device participating in LACP negotiation, while partner refers to its remote device partner at the other end of the negotiation. Actors and partners maintain current status of the other via LACPDUs containing information about their ports’ LACP status and operational state. Example This example shows how to set the actor admin key to 3555 for port D2(su)->set port lacp ge.3.16 aadminkey 3555 clear port lacp Use this command to clear link aggregation settings for one or more ports. Syntax clear port lacp port port-string {[aadminkey] [aportpri] [asyspri] [aadminstate {lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire | all}] [padminsyspri] [padminsysid] [padminkey] [padminportpri] [padminport] [padminstate {lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire | all}]}...
Page 175 Deletes a partner port from the LACP configuration. padminstate Clears the port’s specific partner admin state, or all partner admin state(s). lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire | all Defaults None. Mode Switch command, read‐write. Usage If you set a port to LACP passive using the command clear port lacp port <port‐string> aadminstate lacpactive, the command clear port lacp port <port‐string> aadminstate lacptimeout will also be added to the configuration. If you unset the first command, it will remove the second command automatically from the configuration file. Example This example shows how to clear all link aggregation parameters for port D2(su)->clear port lacp port ge.3.16 clear port lacp .3.16: Enterasys D-Series CLI Reference 6-49...
Page 176: Configuring Protected Ports
The Protected Port feature is used to prevent ports from forwarding traffic to each other, even when they are on the same VLAN. Ports may be designated as either protected or unprotected. Ports are unprotected by default. Multiple groups of protected ports are supported. Protected Port Operation Ports that are configured to be protected cannot forward traffic to other protected ports in the same group, regardless of having the same VLAN membership. However, protected ports can forward traffic to ports which are unprotected (not listed in any group). Protected ports can also forward traffic to protected ports in a different group, if they are in the same VLAN. Unprotected ports can forward traffic to both protected and unprotected ports. A port may belong to only one group of protected ports. This feature only applies to ports within a switch. It does not apply across multiple switches in a network. Commands For information about... set port protected show port protected clear port protected set port protected name show port protected name clear port protected name set port protected Use this command to specify a port to be protected and assign the port to a group of protected ...
Page 177: Show Port Protected
D2(ro)->show port protected Group id ---------------------- clear port protected Use this command to remove a port or group from protected mode. Syntax clear port protected [port-string] | [group-id] Parameters port‐string group‐id Defaults If no parameters are entered, all protected ports and groups are cleared. .1.1 through (Optional) Specifies the port or ports for which to display information. (Optional) Specifies the id of the group for which to display information. Id can range from 0 to 2. Port ge.1.1 ge.1.2 ge.1.3 (Optional) Specifies the port or ports to remove from protected mode. (Optional) Specifies the id of the group to remove from protected mode. Id can range from 0 to 2. show port protected .1.3 to protected port group 1: Enterasys D-Series CLI Reference 6-51...
Page 178: Set Port Protected Name
Mode Switch command, read‐write. Example This example shows how to clear protected ports D2(rw)->clear port protected ge.1.1-3 set port protected name Use this command to assign a name to a protected port group id. Syntax set port protected name group-id name Parameters group‐id name Defaults None. Mode Switch command, read‐write. Example This example shows how to assign the name “group1” to protected port group 1: D2(rw)->set port protected name 1 group1 show port protected name Use this command to display the name for the group ids specified.
Page 179: Clear Port Protected Name
Group ID ----------------------------- clear port protected name Use this command to clear the name of a protected group. Syntax clear port protected name group-id Parameters group‐id Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the name of protected port group 1: D2(rw)->clear port protected name 1 Group Name group1 Specifies the id of the group for which to clear the name. Id can range from 0 to 2. clear port protected name Enterasys D-Series CLI Reference 6-53...
Page 180 clear port protected name 6-54 Port Configuration...
Page 181: Snmp Configuration Summary
SNMP is an application‐layer protocol that facilitates the exchange of management information between network devices. SNMP enables network administrators to manage network performance, find and solve network problems, and plan for network growth. D‐Series devices support three versions of SNMP: • Version 1 (SNMPv1) — This is the initial implementation of SNMP. Refer to RFC 1157 for a full description of functionality. • Version 2 (SNMPv2c) — The second release of SNMP, described in RFC 1907, has additions and enhancements to data types, counter size, and protocol operations. • Version 3 (SNMPv3) — This is the most recent version of SNMP, and includes significant enhancements to administration and security. SNMPv3 is fully described in RFC 2571, RFC 2572, RFC 2573, RFC 2574, and RFC 2575. SNMPv1 and SNMPv2c The components of SNMPv1 and SNMPv2c network management fall into three categories: • Managed devices (such as a switch). • SNMP agents and MIBs, including SNMP traps, community strings, and Remote Monitoring (RMON) MIBs, which run on managed devices. SNMP Configuration Refer to page... 7-15 7-19 7-22 7-25 7-28 7-37 Enterasys D-Series CLI Reference 7-1...
Page 182: Snmpv3
SNMP Configuration Summary • SNMP network management applications, such as the Enterasys NetSight application, which communicate with agents to get statistics and alerts from the managed devices. SNMPv3 SNMPv3 is an interoperable standards‐based protocol that provides secure access to devices by authenticating and encrypting frames over the network. The advanced security features provided in SNMPv3 are as follows: – Message integrity — Collects data securely without being tampered with or corrupted. – Authentication — Determines the message is from a valid source. – Encryption — Scrambles the contents of a frame to prevent it from being seen by an unauthorized source. Unlike SNMPv1 and SNMPv2c, in SNMPv3, the concept of SNMP agents and SNMP managers no longer apply. These concepts have been combined into an SNMP entity. An SNMP entity consists of an SNMP engine and SNMP applications. An SNMP engine consists of the following four components: • Dispatcher — This component sends and receives messages. • Message processing subsystem — This component accepts outgoing PDUs from the dispatcher and prepares them for transmission by wrapping them in a message header and returning them to the dispatcher. The message processing subsystem also accepts incoming messages from the dispatcher, processes each message header, and returns the enclosed PDU to the dispatcher. • Security subsystem — This component authenticates and encrypts messages. • Access control subsystem — This component determines which users and which operations are allowed access to managed objects. About SNMP Security Models and Levels An SNMP security model is an authentication strategy that is set up for a user and the group in ...
Page 183: Using Snmp Contexts To Access Specific Mibs
Uses a user name match for authentication. Provides authentication based on the HMAC-MD5 or HMAC-SHA algorithms. Provides authentication based on the HMAC-MD5 or HMAC-SHA algorithms. Provides DES 56-bit encryption in addition to authentication based on the CBC- DES (DES-56) standard. Enterasys D-Series CLI Reference 7-3...
Page 184: Commands
Use this command to display the SNMP local engine ID. This is the SNMP v3 engine’s administratively unique identifier. Syntax show snmp engineid Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display SNMP engine properties: D2(su)->show snmp engineid EngineId: 80:00:15:f8:03:00:e0:63:9d:b5:87 Engine Boots Engine Time Max Msg Size Table 7‐13 provides an explanation of the command output. Table 7-13 show snmp engineid Output Details...
Page 185: Show Snmp Counters
--- USM Stats counters: usmStatsUnsupportedSecLevels = 0 usmStatsNotInTimeWindows usmStatsUnknownUserNames = 396601 = 396601 = 403661 = 534 = 290 = 396279 = 32 = 11 = 396601 show snmp counters Enterasys D-Series CLI Reference 7-5...
Page 186: Show Snmp Counters Output Details
show snmp counters usmStatsUnknownEngineIDs usmStatsWrongDigests usmStatsDecryptionErrors Table 7‐14 provides an explanation of the command output. Table 7-14 show snmp counters Output Details Output Field snmpInPkts snmpOutPkts snmpInBadVersions snmpInBadCommunityNames snmpInBadCommunityUses snmpInASNParseErrs snmpInTooBigs snmpInNoSuchNames snmpInBadValues snmpInReadOnlys snmpInGenErrs snmpInTotalReqVars snmpInTotalSetVars snmpInGetRequests snmpInGetNexts snmpInSetRequests snmpInGetResponses snmpInTraps snmpOutTooBigs snmpOutNoSuchNames 7-6 SNMP Configuration What It Displays...
Page 187 Number of packets received by the SNMP engine that were dropped because they did not contain the expected digest value. usmStatsDecriptionErrors Number of packets received by the SNMP engine that were dropped because they could not be decrypted. show snmp counters Enterasys D-Series CLI Reference 7-7...
Page 188: Configuring Snmp Users, Groups, And Communities
Configuring SNMP Users, Groups, and Communities Configuring SNMP Users, Groups, and Communities Purpose To review and configure SNMP users, groups, and v1 and v2 communities. These are defined as follows: • User — A person registered in SNMPv3 to access SNMP management. • Group — A collection of users who share the same SNMP access privileges. • Community — A name used to authenticate SNMPv1 and v2 users. Commands For information about... show snmp user set snmp user clear snmp user show snmp group set snmp group clear snmp group show snmp community set snmp community...
Page 189: Set Snmp User
Type of authentication protocol applied to this user. Whether a privacy protocol is applied when authentication protocol is in use. Whether entry is stored in volatile, nonvolatile or read-only memory. Status of this entry: active, notInService, or notReady. set snmp user Enterasys D-Series CLI Reference 7-9...
Page 190: Clear Snmp User
| sha authpassword privacy privpassword (Optional) Applies encryption and specifies an encryption password. volatile | nonvolatile Defaults If remote is not specified, the user will be registered for the local SNMP engine. If authentication is not specified, no authentication will be applied. If privacy is not specified, no encryption will be applied. If storage type is not specified, nonvolatile will be applied. Mode Switch command, read‐write. Example This example shows how to create a new SNMP user named “netops”. By default, this user will be registered on the local SNMP engine without authentication user will be stored in permanent (nonvolatile) memory: D2(su)->set snmp user netops clear snmp user Use this command to remove a user from the SNMPv3 security‐model list. Syntax clear snmp user user [remote remote] Parameters user remote remote Defaults If remote is not specified, the user will be removed from the local SNMP engine.
Page 191: Show Snmp Group
Security/user name Group name Storage type Row status (Optional) Displays information for a specific SNMP group. (Optional) Displays information about users within the specified group. (Optional) Displays information about groups assigned to a specific security SNMP model. (Optional) Displays SNMP group information for a specified storage type. = SNMPv1 = public = Anyone = nonVolatile = active = SNMPv1 = public.router1 = Anyone = nonVolatile = active show snmp group Enterasys D-Series CLI Reference 7-11...
Page 192: Set Snmp Group
Defaults If storage type is not specified, nonvolatile storage will be applied. Mode Switch command, read‐write. Example This example shows how to create an SNMP group called “anyone”, assign a user named “public” and assign SNMPv3 security to the group: D2(su)->set snmp group anyone user public security-model usm clear snmp group Use this command to clear SNMP group settings globally or for a specific SNMP group and user. Syntax clear snmp group groupname user [security-model {v1 | v2c | usm}] 7-12 SNMP Configuration What It Displays...
Page 193: Show Snmp Community
This example shows how to display information about the SNMP “public” community name. For a description of this output, refer to set snmp community (page 7‐14). D2(su)->show snmp community public --- Configured community strings --- Name Security name Context Transport tag Storage type Status Specifies the SNMP group to be cleared. Specifies the SNMP user to be cleared. (Optional) Clears the settings associated with a specific security model. (Optional) Displays SNMP information for a specific community name. = ********* = public = nonVolatile = active show snmp community Enterasys D-Series CLI Reference 7-13...
Page 194: Set Snmp Community
[transport transport] [volatile | nonvolatile] Parameters community securityname securityname context context transport transport volatile | nonvolatile Defaults If securityname is not specified, the community name will be used. If context is not specified, access will be granted for the default context. If transport tag is not specified, none will be applied. If storage type is not specified, nonvolatile will be applied. Mode Switch command, read‐write. Example This example shows how to set an SNMP community name called “vip” D2(su)->set snmp community vip clear snmp community Use this command to delete an SNMP community name. Syntax clear snmp community name Parameters name 7-14 SNMP Configuration Specifies a community group name. (Optional) Specifies an SNMP security name to associate with this community. (Optional) Specifies a subset of management information this community ...
Page 195: Configuring Snmp Access Rights
[groupname] [security-model {v1 | v2c | usm}] [noauthentication | authentication | privacy] [context context] [volatile | nonvolatile | read-only] Parameters groupname security‐model v1 | v2c | usm noauthentication | authentication | privacy (Optional) Displays access information for a specific SNMPv3 group. (Optional) Displays access information for SNMP security model version 1, 2c or 3 (usm). (Optional) Displays access information for a specific security level. Configuring SNMP Access Rights Refer to page... 7-15 7-17 7-18 Enterasys D-Series CLI Reference 7-15...
Page 196: Show Snmp Access Output Details
Defaults If groupname is not specified, access information for all SNMP groups will be displayed. If security‐model is not specified, access information for all SNMP versions will be displayed. If noauthentication, authentication or privacy are not specified, access information for all security levels will be displayed. If context is not specified, all contexts will be displayed. If volatile, nonvolatile or read‐only are not specified, all entries of all storage types will be displayed. Mode Switch command, read‐only. Example This example shows how to display SNMP access information: D2(su)->show snmp access Group Security model Security level Read View Write View Notify View Context match Storage type Row status Group...
Page 197: Set Snmp Access
Whether access entries for this group are stored in volatile, nonvolatile or read-only memory. Status of this entry: active, notInService, or notReady. Specifies a name for an SNMPv3 group. Specifies SNMP version 1, 2c or 3 (usm). (Optional) Applies SNMP security level as no authentication, authentication (without privacy) or privacy. Privacy specifies that messages sent on behalf of the user are protected from disclosure. (Optional) Sets the context for this access configuration and specifies that the match must be exact (matching the whole context string) or a prefix match only. Context is a subset of management information this SNMP group will be allowed to access. Valid values are full or partial context names. To review all contexts configured for the device, use the show snmp context command as described in “show snmp context” on page 7‐20. (Optional) Specifies a read access view. (Optional) Specifies a write access view. (Optional) Specifies a notify access view. (Optional) Stores associated SNMP entries as temporary or permanent, or read‐only. set snmp access Enterasys D-Series CLI Reference 7-17...
Page 198: Clear Snmp Access
If security level is not specified, no authentication will be applied. If context is not specified, access will be enabled for the default context. If context is specified without a context match, exact match will be applied. If read view is not specified none will be applied. If write view is not specified, none will be applied. If notify view is not specified, none will be applied. If storage type is not specified, entries will be stored as permanent and will be held through device reboot. Mode Switch command, read‐write. Example This example permits the “powergroup” to manage all MIBs via SNMPv3: D2(su)->set snmp access powergroup security-model usm clear snmp access Use this command to clear the SNMP access entry of a specific group, including its set SNMP security‐model, and level of security. Syntax clear snmp access groupname security-model {v1 | v2c | usm} [noauthentication | authentication | privacy] [context context]...
Page 199: Configuring Snmp Mib Views
[viewname] [subtree oid-or-mibobject] [volatile | nonvolatile | read-only] Parameters viewname subtree oid‐or‐mibobject volatile | nonvolatile | read‐only Defaults If no parameters are specified, all SNMP MIB view configuration information will be displayed. Mode Switch command, read‐only. (Optional) Displays information for a specific MIB view. (Optional) Displays information for a specific MIB subtree when viewname is specified. (Optional) Displays entries for a specific storage type. Configuring SNMP MIB Views Refer to page... 7-19 7-20 7-21 7-22 Enterasys D-Series CLI Reference 7-19...
Page 200: Show Snmp Context
show snmp context Example This example shows how to display SNMP MIB view configuration information: D2(su)->show snmp view --- SNMP MIB View information --- View Name Subtree OID Subtree mask View Type Storage type Row status View Name Subtree OID Subtree mask View Type Storage type Row status View Name Subtree OID Subtree mask View Type...
Page 201: Set Snmp View
[volatile | nonvolatile] Parameters viewname viewname Specifies a name for a MIB view. subtree subtree mask mask included | excluded volatile | nonvolatile Defaults If not specified, mask will be set to 255.255.255.255 If not specified, subtree use will be included. If storage type is not specified, nonvolatile (permanent) will be applied. Mode Switch command, read‐write. Example This example shows how to set an SNMP MIB view to “public” with a subtree name of 1.3.6.1 included: D2(su)->set snmp view viewname public subtree 1.3.6.1 included Specifies a MIB subtree name. (Optional) Specifies a bitmask for a subtree. (Optional) Specifies subtree use (default) or no subtree use. (Optional) Specifies the use of temporary or permanent (default) storage. set snmp view Enterasys D-Series CLI Reference 7-21...
Page 202: Clear Snmp View
Use this command to delete an SNMPv3 MIB view. Syntax clear snmp view viewname subtree Parameters viewname subtree Defaults None. Mode Switch command, read‐write. Example This example shows how to delete SNMP MIB view “public”: D2(su)->clear snmp view public 1.3.6.1 Configuring SNMP Target Parameters Purpose To review and configure SNMP target parameters. This controls where and under what circumstances SNMP notifications will be sent. A target parameter entry can be bound to a target IP address allowed to receive SNMP notification messages with the set snmp targetaddr command (“set snmp targetaddr” on page 7‐26). Commands For information about...
Page 203: Show Snmp Targetparams Output Details
Type of security level (auth: security level is set to use authentication protocol, noauth: security level is not set to use authentication protocol, or privacy). Whether entry is stored in volatile, nonvolatile or read-only memory. Status of this entry: active, notInService, or notReady. show snmp targetparams Enterasys D-Series CLI Reference 7-23...
Page 204: Set Snmp Targetparams
| v3 noauthentication | authentication | privacy volatile | nonvolatile Defaults None. If not specified, security level will be set to noauthentication. If not specified, storage type will be set to nonvolatile. Mode Switch command, read‐write. Example This example shows how to set SNMP target parameters named “v1ExampleParams” for a user named “fred” using version 3 security model and message processing, and authentication: D2(su)->set snmp targetparams v1ExampleParams user fred security-model usm message-processing v3 authentication clear snmp targetparams Use this command to clear the SNMP target parameter configuration. Syntax clear snmp targetparams targetParams 7-24 SNMP Configuration Specifies a name identifying parameters used to generate SNMP messages ...
Page 205: Configuring Snmp Target Addresses
Use this command to display SNMP target address information. Syntax show snmp targetaddr [targetAddr] [volatile | nonvolatile | read-only] Parameters targetAddr volatile | nonvolatile | read‐only Defaults If targetAddr is not specified, entries for all target address names will be displayed. Specifies the name of the parameter in the SNMP target parameters table to be cleared. (Optional) Displays information for a specific target address name. (Optional) When target address is specified, displays target address information for a specific storage type. Configuring SNMP Target Addresses Refer to page... 7-25 7-26 7-28 Enterasys D-Series CLI Reference 7-25...
Page 206: Set Snmp Targetaddr
If not specified, entries of all storage types will be displayed for a target address. Mode Switch command, read‐only. Example This example shows how to display SNMP target address information: D2(su)->show snmp targetaddr Target Address Name Tag List IP Address UDP Port# Target Mask Timeout Retry count Parameters Storage type Row status Table 7‐20 provides an explanation of the command output. Table 7-20 show snmp targetaddr Output Details Output Field...
Page 207 “tag 1 tag 2”). volatile | (Optional) Specifies temporary (default), or permanent storage for SNMP nonvolatile entries. Defaults If not specified, udpport will be set to 162. If not specified, mask will be set to 255.255.255.255 If not specified, timeout will be set to 1500. If not specified, number of retries will be set to 3. If taglist is not specified, none will be set. If not specified, storage type will be nonvolatile. Mode Switch command, read‐write. Example This example shows how to configure a trap notification called “TrapSink.” This trap notification will be sent to the workstation 192.168.190.80 (which is target address “tr”). It will use security and authorization criteria contained in a target parameters entry called “v2cExampleParams”. For more information on configuring a basic SNMP trap, refer to “Creating a Basic SNMP Trap Configuration” on page 7‐37: D2(su)->set snmp targetaddr tr 192.168.190.80 param v2cExampleParams taglist TrapSink set snmp targetaddr Enterasys D-Series CLI Reference 7-27...
Page 208: Clear Snmp Targetaddr
Use this command to delete an SNMP target address entry. Syntax clear snmp targetaddr targetAddr Parameters targetAddr Defaults None. Mode Switch command, read‐write. Example This example shows how to clear SNMP target address entry “tr”: D2(su)->clear snmp targetaddr tr Configuring SNMP Notification Parameters About SNMP Notify Filters Profiles indicating which targets should not receive SNMP notification messages are kept in the NotifyFilter table. If this table is empty, meaning that no filtering is associated with any SNMP target, then no filtering will take place. “Traps” or “informs” notifications will be sent to all destinations in the SNMP targetAddrTable that have tags matching those found in the NotifyTable. When the NotifyFilter table contains profile entries, the SNMP agent will find any filter profile name that corresponds to the target parameter name contained in an outgoing notification message. It will then apply the appropriate subtree‐specific filter when generating notification ...
Page 209: Show Newaddrtrap
Usage By default, this function is disabled globally and per port. Example This example displays the status for Gigabit Ethernet ports 1 through 5 in slot 1. D2(ro)->show newaddrtrap ge.1.1-5 New Address Traps Globally disabled Port Enable State --------- ------------ (Optional) Displays the status of the new MAC addresses trap function on specific ports. show newaddrtrap Refer to page... 7-29 7-30 7-30 7-31 7-32 7-33 7-34 7-34 7-35 7-36 7-36 Enterasys D-Series CLI Reference 7-29...
Page 210: Set Newaddrtrap
Use this command to enable or disable SNMP trap messaging, globally or on one or more ports, when new source MAC addresses are detected. Syntax set newaddrtrap [port-string] {enable | disable} Parameters port‐string enable | disable Defaults If port‐string is not specified, the trap function is set globally. Mode Switch mode, read‐write. Usage This command enables and disables sending SNMP trap messages when a new source MAC address is detected by a port. If the port is a CDP port, however, traps for new source MAC addresses will not be sent. The default mode is disabled globally and per port. Example= This example enables the trap function globally and then on Gigabit Ethernet ports 1 through 5 in slot 1. D2(rw)->set newaddrtrap enable D2(rw)->set newaddrtrap ge.1.1-5 enable show snmp notify Use this command to display the SNMP notify configuration, which determines the management targets that will receive SNMP notifications.
Page 211: Set Snmp Notify
Name of the entry in the SNMP notify table. Type of notification: SNMPv1 or v2 trap or SNMPv3 InformRequest message. Whether access entry is stored in volatile, nonvolatile, or read-only memory. Status of this entry: active, notInService, or notReady. set snmp notify Enterasys D-Series CLI Reference 7-31...
Page 212: Clear Snmp Notify
[trap | inform] [volatile | nonvolatile] Parameters notify tag tag trap | inform volatile | nonvolatile Defaults If not specified, message type will be set to trap. If not specified, storage type will be set to nonvolatile. Mode Switch command, read‐write. Example This example shows how to set an SNMP notify configuration with a notify name of “hello” and a notify tag of “world”. Notifications will be sent as trap messages and storage type will automatically default to permanent: D2(su)->set snmp notify hello tag world trap clear snmp notify Use this command to clear an SNMP notify configuration. Syntax clear snmp notify notify Parameters...
Page 213: Show Snmp Notifyfilter
Example This example shows how to display SNMP notify filter information. In this case, the notify profile “pilot1” in subtree 1.3.6 will not receive SNMP notification messages: D2(su)->show snmp notifyfilter --- SNMP notifyFilter information --- Profile Subtree Filter type Storage type Row status (Optional) Displays a specific notify filter. (Optional) Displays a notify filter within a specific subtree. (Optional) Displays notify filter entries of a specific storage type. = pilot1 = 1.3.6 = included = nonVolatile = active show snmp notifyfilter Enterasys D-Series CLI Reference 7-33...
Page 214: Set Snmp Notifyfilter
Defaults If not specified, mask is not set. If not specified, subtree will be included. If storage type is not specified, nonvolatile (permanent) will be applied. Mode Switch command, read‐write. Usage See “About SNMP Notify Filters” on page 7‐28 for more information about notify filters. Example This example shows how to create an SNMP notify filter called “pilot1” with a MIB subtree ID of 1.3.6: D2(su)->set snmp notifyfilter pilot1 subtree 1.3.6 clear snmp notifyfilter Use this command to delete an SNMP notify filter configuration. Syntax clear snmp notifyfilter profile subtree oid-or-mibobject 7-34 SNMP Configuration Specifies an SNMP filter notify name.
Page 215: Show Snmp Notifyprofile
Defaults If no parameters are specified, all notify profile information will be displayed. Mode Switch command, read‐only. Example This example shows how to display SNMP notify information for the profile named “area51”: D2(su)->show snmp notifyprofile area51 --- SNMP notifyProfile information --- Notify Profile TargetParam Storage type Specifies an SNMP filter notify name to delete. Specifies a MIB subtree ID containing the filter to be deleted. (Optional) Displays a specific notify profile. (Optional) Displays entries for a specific target parameter. (Optional) Displays notify filter entries of a specific storage type. = area51 = v3ExampleParams = nonVolatile show snmp notifyprofile Enterasys D-Series CLI Reference 7-35...
Page 216: Set Snmp Notifyprofile
[volatile | nonvolatile] Parameters profile targetparam targetparam volatile | nonvolatile Defaults If storage type is not specified, nonvolatile (permanent) will be applied. Mode Switch command, read‐write. Example This example shows how to create an SNMP notify profile named area51 parameters entry. D2(su)->set snmp notifyprofile area51 targetparam v3ExampleParams clear snmp notifyprofile Use this command to delete an SNMP notify profile configuration. Syntax clear snmp notifyprofile profile targetparam targetparam Parameters profile targetparam ...
Page 217: Creating A Basic Snmp Trap Configuration
Create a new notification entry. Create a target address entry. Creating a Basic SNMP Trap Configuration Use these commands... set snmp community set snmp targetparams show snmp notify set snmp notify set snmp targetaddr Enterasys D-Series CLI Reference 7-37...
Page 218: Example
Creating a Basic SNMP Trap Configuration Example This example shows how to: • Create an SNMP community called mgmt. • Configure a trap notification called TrapSink. This trap notification will be sent with the community name mgmt to the workstation 192.168.190.80 (which is target address tr). It will use security and authorization criteria contained in a target parameters entry called v2cExampleParams. D2(su)->set snmp community mgmt D2(su)->set snmp targetparams v2cExampleParams user mgmt security-model v2c message-processing v2c D2(su)->set snmp notify entry1 tag TrapSink D2(su)->set snmp targetaddr tr 192.168.190.80 param v2cExampleParams taglist TrapSink How SNMP Will Use This Configuration In order to send a trap/notification requested by a MIB code, the SNMP agent requires the ...
Page 219: Chapter 8: Spanning Tree Configuration
Overview: Single, Rapid, and Multiple Spanning Tree Protocols The IEEE 802.1D Spanning Tree Protocol (STP) resolves the problems of physical loops in a network by establishing one primary path between any two devices in a network. Any duplicate paths are barred from use and become standby or blocked paths until the original path fails, at which point they can be brought into service. RSTP The IEEE 802.1w Rapid Spanning Protocol (RSTP), an evolution of 802.1D, can achieve much faster convergence than legacy STP in a properly configured network. RSTP significantly reduces the time to reconfigure the network’s active topology when physical topology or configuration parameter changes occur. It selects one switch as the root of a Spanning Tree‐connected active topology and assigns port roles to individual ports on the switch, depending on whether that port is part of the active topology. RSTP provides rapid connectivity following the failure of a switch, switch port, or a LAN. A new root port and the designated port on the other side of the bridge transition to forwarding through an explicit handshake between them. By default, user ports are configured to rapidly transition to forwarding in RSTP. MSTP The IEEE 802.1s Multiple Spanning Tree Protocol (MSTP) builds upon 802.1D and RSTP by optimizing utilization of redundant links between switches in a network. When redundant links exist between a pair of switches running single STP, one link is forwarding while the others are Spanning Tree Configuration Refer to page... 8-33 8-41 Enterasys D-Series CLI Reference 8-1...
Page 220: Spanning Tree Features
Achieving port changes in short time intervals, which establishes a stable active topology quickly with minimal network disturbance. • Using a minimum amount of communications bandwidth to accomplish the operation of the Spanning Tree Protocol. • Reconfiguring the active topology in a manner that is transparent to stations transmitting and receiving data packets. • Managing the topology in a consistent and reproducible manner through the use of Spanning Tree Protocol parameters. Note: The term “bridge” is used as an equivalent to the term “switch” or “device” in this document. Loop Protect The Loop Protect feature prevents or short circuits loop formation in a network with redundant paths by requiring ports to receive type 2 BPDUs (RSTP/MSTP) on point‐to‐point inter‐switch links (ISLs) before their states are allowed to become forwarding. Further, if a BPDU timeout occurs on a port, its state becomes listening until a BPDU is received. Both upstream and downstream facing ports are protected. When a root or alternate port loses its path to the root bridge due to a message age expiration it takes on the role of designated port. It will not forward traffic until a BPDU is received. When a port is intended to be the designated port in an ISL it constantly proposes and will not forward until a BPDU is received, and will revert to listening if it fails to get a response. This protects against misconfiguration and protocol failure by ...
Page 221: Configuring Spanning Tree Bridge Parameters
There are two operational modes for Loop Protect on a port. If the port is connected to a device known to implement Loop Protect, it uses full functional mode. Otherwise the port operates in limited functional mode. Connection to a Loop Protect switch guarantees that the alternate agreement mechanism is implemented. This means the designated port can rely on receiving a response to its proposal regardless of the role of the connected port, which has two important implications. First, the designated port connected to a non‐root port may transition to forwarding. Second, there is no ambiguity when a timeout happens; a Loop Protect event has occurred. In full functional mode, when a type 2 BPDU is received and the port is designated and point‐to‐ point, the timer is set to 3 times helloTime. In limited functional mode there is the additional requirement that the flags field indicate a root role. If the port is a boundary port the MSTIs for that port follow the CIST, that is, the MSTI port timers are set according to the CIST port timer. If the port is internal to the region then the MSTI port timers are set independently using the particular MSTI message. Message age expiration and the expiration of the Loop Protect timer are both Loop Protect events. A notice level syslog message is produced for each such event. Traps may be configured to report these events as well. A syslog message and trap may be configured for disputed BPDUs. It is also configurable to force the locking of a SID/port for the occurrence of one or more events. When the configured number of events happen within a given window of time, the port is forced into blocking and held there until it is manually unlocked via management. Configuring Spanning Tree Bridge Parameters Purpose To display and set Spanning Tree bridge parameters, including device priorities, hello time, maximum wait time, forward delay, path cost, and topology change trap suppression. Configuring Spanning Tree Bridge Parameters Enterasys D-Series CLI Reference 8-3...
Page 222: Commands
Configuring Spanning Tree Bridge Parameters Commands For information about... show spantree stats set spantree show spantree version set spantree version clear spantree version show spantree bpdu-forwarding set spantree bpdu-forwarding show spantree bridgeprioritymode set spantree bridgeprioritymode clear spantree bridgeprioritymode show spantree mstilist set spantree msti clear spantree msti show spantree mstmap...
Page 223: Show Spantree Stats
If port‐string is not specified, Spanning Tree information for all ports will be displayed. If sid is not specified, information for Spanning Tree 0 will be displayed. If active is not specified information for all ports will be displayed regardless of whether or not they have received BPDUs. Mode Switch command, read‐only. (Optional) Displays information for the specified port(s). For a detailed description of possible port‐‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. (Optional) Displays information for a specific Spanning Tree identifier. If not specified, SID 0 is assumed. (Optional) Displays information for ports that have received STP BPDUs since boot. show spantree stats Refer to page... 8-24 8-25 8-25 8-26 8-27 8-27 8-28 8-28 8-29 8-29 8-30 8-30 8-31 8-31 8-32 Enterasys D-Series CLI Reference 8-5...
Page 224: Show Spantree Output Details
show spantree stats Example This example shows how to display the device’s Spanning Tree configuration: D2(su)->show spantree stats Spanning tree status Spanning tree instance Designated Root MacAddr Designated Root Priority Designated Root Cost Designated Root Port Root Max Age Root Hello Time Root Forward Delay Bridge ID MAC Address Bridge ID Priority Bridge Max Age Bridge Hello Time Bridge Forward Delay...
Page 225: Set Spantree
Amount of time (in days, hours, minutes and seconds) since the last topology change. Maximum number of hops information for a particular Spanning Tree instance may traverse (via relay of BPDUs within the applicable MST region) before being discarded. Globally disables or enables Spanning Tree. set spantree “set spantree fwddelay” on Enterasys D-Series CLI Reference 8-7...
Page 226: Set Spantree Version
Mode Switch command, read‐only. Example This example shows how to display Spanning Tree version information for the device: D2(su)->show spantree version Force Version is mstp set spantree version Use this command to set the version of the Spanning Tree protocol to MSTP (Multiple Spanning Tree Protocol), RSTP (Rapid Spanning Tree Protocol) or to STP 802.1D‐compatible. Syntax set spantree version {mstp | stpcompatible | rstp} Parameters mstp stpcompatible rstp Defaults None. Mode Switch command, read‐write. Usage In most networks, Spanning Tree version should not be changed from its default setting of mstp (Multiple Spanning Tree Protocol) mode. MSTP mode is fully compatible and interoperable with legacy STP 802.1D and Rapid Spanning Tree (RSTP) bridges. Setting the version to stpcompatible ...
Page 227: Show Spantree Bpdu-Forwarding
Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the Spanning Tree BPDU forwarding mode: D2(su)->show spantree bpdu-forwarding BPDU forwarding is disabled. set spantree bpdu-forwarding Use this command to enable or disable Spanning Tree BPDU forwarding. By default BPDU forwarding is disabled. Syntax set spantree bpdu-forwarding {disable | enable} Parameters disable | enable Disables or enables BPDU forwarding;. show spantree bpdu-forwarding Enterasys D-Series CLI Reference 8-9...
Page 228: Show Spantree Bridgeprioritymode
Defaults By default BPDU forwarding is disabled. Mode Switch command, read‐write. Usage The Spanning Tree protocol must be disabled (set spantree disable) for this feature to take effect. Example This example shows how to enable BPDU forwarding: D2(rw)-> set spantree bpdu-forwarding enable show spantree bridgeprioritymode Use this command to display the Spanning Tree bridge priority mode setting. Syntax show spantree bridgeprioritymode Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the Spanning Tree bridge priority mode setting: D2(rw)->show spantree bridgeprioritymode Bridge Priority Mode is set to IEEE802.1t mode.
Page 229: Clear Spantree Bridgeprioritymode
Example This example shows how to set the bridge priority mode to 802.1D: D2(rw)->set spantree bridgeprioritymode 8021d clear spantree bridgeprioritymode Use this command to reset the Spanning Tree bridge priority mode to the default setting of 802.1t. Syntax clear spantree bridgeprioritymode Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the bridge priority mode to 802.1t: D2(rw)->clear spantree bridgeprioritymode Sets the bridge priority mode to use 802.1D (legacy) values, which are 0 ‐ 65535. Sets the bridge priority mode to use 802.1t values, which are 0 to 61440, in increments of 4096. Values will automatically be rounded up or down, depending on the 802.1t value to which the entered value is closest. This is the default bridge priority mode. clear spantree bridgeprioritymode Enterasys D-Series CLI Reference 8-11...
Page 230: Show Spantree Mstilist
Use this command to display a list of Multiple Spanning Tree (MST) instances configured on the device. Syntax show spantree mstilist Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display a list of MST instances. In this case, SID 2 has been configured: D2(su)->show spantree mstilist Configured Multiple Spanning Tree instances: set spantree msti Use this command to create or delete a Multiple Spanning Tree instance. Syntax set spantree msti sid sid {create | delete} Parameters sid sid create | delete...
Page 231: Clear Spantree Msti
D2(su)->clear spantree msti show spantree mstmap Use this command to display the mapping of a filtering database ID (FID) to a Spanning Trees. Since VLANs are mapped to FIDs, this shows to which SID a VLAN is mapped. Syntax show spantree mstmap [fid fid] Parameters fid fid Defaults If fid is not specified, information for all assigned FIDs will be displayed. Mode Switch command, read‐only. Example This example shows how to display SID to FID mapping information for FID 1. In this case, no new mappings have been configured: D2(su)->show spantree mstmap fid 1 FID: SID: (Optional) Deletes a specific multiple Spanning Tree ID. (Optional) Displays information for specific FIDs. clear spantree msti Enterasys D-Series CLI Reference 8-13...
Page 232: Set Spantree Mstmap
GVRP communication is lost, it is recommended that you only create MST maps on statically-created VLANs. Syntax set spantree mstmap fid [sid sid] Parameters fid sid sid Defaults If sid is not specified, FID(s) will be mapped to Spanning Tree 0. Mode Switch command, read‐write. Example This example shows how to map FID 3 to SID 2: D2(su)->set spantree mstmap 3 sid 2 clear spantree mstmap Use this command to map a FID back to SID 0. Syntax clear spantree mstmap fid Parameters Defaults If fid is not specified, all SID to FID mappings will be reset.
Page 233: Show Spantree Vlanlist
D2(su)->show spantree vlanlist 1 The following SIDS are assigned to VLAN 1: 2 16 42 show spantree mstcfgid Use this command to display the MST configuration identifier elements, including format selector, configuration name, revision level, and configuration digest. Syntax show spantree mstcfgid Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the MST configuration identifier elements. In this case, the default revision level of 0, and the default configuration name (a string representing the bridge (Optional) Displays SIDs assigned to specific VLAN(s). 1 using the set spantree mstmap command as described in “set spantree show spantree vlanlist Enterasys D-Series CLI Reference 8-15...
Page 234: Set Spantree Mstcfgid
Configuration Digest: ac:36:17:7f:50:28:3c:d4:b8:38:21:d8:ab:26:de:62 set spantree mstcfgid Use this command to set the MST configuration name and/or revision level. Syntax set spantree mstcfgid {cfgname name | rev level} Parameters cfgname name rev level Defaults None. Mode Switch command, read‐write. Example This example shows how to set the MST configuration name to “mstconfig”: D2(su)->set spantree mstconfigid cfgname mstconfig clear spantree mstcfgid Use this command to reset the MST revision level to a default value of 0, and the configuration name to a default string representing the bridge MAC address. Syntax clear spantree mstcfgid Parameters None.
Page 235: Set Spantree Priority
The device with the highest priority (lowest numerical value) becomes the Spanning Tree root device. If all devices have the same priority, the device with the lowest MAC address will then become the root device. Depending on the bridge priority mode (set with the set spantree bridgeprioritymode command described in “set spantree bridgeprioritymode” on page 8‐10, some priority values may be rounded up or down. Example This example shows how to set the bridge priority to 4096 on SID 1: D2(su)->set spantree priority 4096 1 clear spantree priority Use this command to reset the Spanning Tree priority to the default value of 32768. Syntax clear spantree priority [sid] Parameters Specifies the priority of the bridge. Valid values are from 0 to 61440 (in increments of 4096), with 0 indicating highest priority and 61440 lowest priority. (Optional) Sets the priority on a specific Spanning Tree. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. (Optional) Resets the priority on a specific Spanning Tree. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. set spantree priority Enterasys D-Series CLI Reference 8-17...
Page 236: Set Spantree Hello
Defaults If sid is not specified, priority will be reset on Spanning Tree 0. Mode Switch command, read‐write. Example This example shows how to reset the bridge priority on SID 1: D2(su)->clear spantree priority 1 set spantree hello Use this command to set the device’s Spanning Tree hello time, This is the time interval (in seconds) the device will transmit BPDUs indicating it is active. Syntax set spantree hello interval Parameters interval Defaults None. Mode Switch command, read‐write. Example This example shows how to globally set the Spanning Tree hello time to 10 seconds: D2(su)->set spantree hello 10 clear spantree hello Use this command to reset the Spanning Tree hello time to the default value of 2 seconds. Syntax...
Page 237: Set Spantree Maxage
Parameters agingtime Defaults None. Mode Switch command, read‐write. Usage The bridge maximum aging time is the maximum time (in seconds) a device can wait without receiving a configuration message (bridge “hello”) before attempting to reconfigure. All device ports (except for designated ports) should receive configuration messages at regular intervals. Any port that ages out STP information provided in the last configuration message becomes the designated port for the attached LAN. If it is a root port, a new root port is selected from among the device ports attached to the network. Example This example shows how to set the maximum aging time to 25 seconds: D2(su)->set spantree maxage 25 clear spantree maxage Use this command to reset the maximum aging time for a Spanning Tree to the default value of 20 seconds. Syntax clear spantree maxage Specifies the maximum number of seconds that the system retains the information received from other bridges through STP. Valid values are 6 ‐ set spantree maxage Enterasys D-Series CLI Reference 8-19...
Page 238: Set Spantree Fwddelay
Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to globally reset the maximum aging time: D2(su)->clear spantree maxage set spantree fwddelay Use this command to set the Spanning Tree forward delay. Syntax set spantree fwddelay delay Parameters delay Defaults None. Mode Switch command, read‐write. Usage The forward delay is the maximum time (in seconds) the root device will wait before changing states (i.e., listening to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a blocking state; otherwise, temporary data loops might result. Example This example shows how to globally set the bridge forward delay to 16 seconds: D2(su)->set spantree fwddelay 16 8-20 Spanning Tree Configuration Specifies the number of seconds for the bridge forward delay. Valid values ...
Page 239: Clear Spantree Fwddelay
D2(su)->clear spantree fwddelay show spantree backuproot Use this command to display the backup root status for an MST instance. Syntax show spantree backuproot [sid] Parameters Defaults If a SID is not specified, then status will be shown for Spanning Tree instance 0. Mode Switch command, read‐only. Example This example shows how to display the status of the backup root function on SID 0: D2(rw)->show spantree backuproot Backup root is set to disable on sid 0 (Optional) Display backup root status for a specific Spanning Tree identifier. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. clear spantree fwddelay Enterasys D-Series CLI Reference 8-21...
Page 240: Set Spantree Backuproot
Use this command to enable or disable the Spanning Tree backup root function on the switch. Syntax set spantree backuproot sid {disable | enable} Parameters disable | enable Defaults None. Mode Switch command, read‐write. Usage The Spanning Tree backup root function is disabled by default on the D‐Series. When this feature is enabled and the switch is directly connected to the root bridge, stale Spanning Tree information is prevented from circulating if the root bridge is lost. If the root bridge is lost, the backup root will dynamically lower its bridge priority so that it will be selected as the new root over the lost root bridge. Example This example shows how to enable the backup root function on SID 2: D2(rw)->set spantree backuproot 2 enable clear spantree backuproot Use this command to reset the Spanning Tree backup root function to the default state of disabled. Syntax clear spantree backuproot sid...
Page 241: Show Spantree Tctrapsuppress
Example This example shows how to display the status of topology change trap suppression: D2(rw)->show spantree tctrapsuppress Topology change Trap Suppression is set to enabled set spantree tctrapsuppress Use this command to disable or enable topology change trap suppression on Rapid Spanning Tree edge ports. Syntax set spantree tctrapsuppress {disable | enable} Parameters disable | enable Defaults None. Mode Switch command, read‐write. Disables or enables topology change trap suppression. show spantree tctrapsuppress Enterasys D-Series CLI Reference 8-23...
Page 242: Clear Spantree Tctrapsuppress
Usage By default, RSTP non‐edge (bridge) ports that transition to forwarding or blocking cause the switch to issue a topology change trap. When topology change trap suppression is enabled, which is the device default, edge ports (such as end station PCs) are prevented from sending topology change traps. This is because there is usually no need for network management to monitor edge port STP transition states, such as when PCs are powered on. When topology change trap suppression is disabled, all ports, including edge and bridge ports, will transmit topology change traps. Example This example shows how to allow Rapid Spanning Tree edge ports to transmit topology change traps: D2(rw)->set spantree tctrapsuppress disable clear spantree tctrapsuppress Use this command to clear the status of topology change trap suppression on Rapid Spanning Tree edge ports to the default state of enabled (edge port topology changes do not generate traps). Syntax clear spantree tctrapsuppress Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear topology change trap suppression setting: D2(rw)->clear spantree tctrapsuppress set spantree protomigration Use this command to reset the protocol state migration machine for one or more Spanning Tree ...
Page 243: Show Spantree Spanguard
Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the SpanGuard function status: D2(su)->show spantree spanguard Spanguard is disabled set spantree spanguard Use this command to enable or disable the Spanning Tree SpanGuard function. Syntax set spantree spanguard {enable | disable} Parameters enable | disable Defaults None. Enables or disables the SpanGuard function. show spantree spanguard Enterasys D-Series CLI Reference 8-25...
Page 244: Clear Spantree Spanguard
Mode Switch command, read‐write. Usage SpanGuard is designed to disable, or lock out an “edge” port when an unexpected BPDU is received. The port can be configured to be re‐enabled after a set time period, or only after manual intervention. A port can be defined as an edge (user) port using the set spantree adminedge command, described in “set spantree adminedge” on page 8‐39. A port designated as an edge port is expected to be connected to a workstation or other end‐user type of device, and not to another switch in the network. When Spanguard is enabled, if a non‐loopback BPDU is received on an edge port, the Spanning Tree state of that port will be changed to “blocking” and will no longer forward traffic. The port will remain disabled until the amount of time defined by set spantree spanguardtimeout (“set spantree spanguardtimeout” on page 8‐27) has passed since the last seen BPDU, the port is manually unlocked (set or clear spantree spanguardlock, “clear / set spantree spanguardlock” on page 8‐29), the configuration of the port is changed so it is not longer an edge port, or the SpanGuard function is disabled. SpanGuard is enabled and disabled only on a global basis. By default, SpanGuard is disabled and SpanGuard traps are enabled. Example This example shows how to enable the SpanGuard function: D2(rw)->set spantree spanguard enable clear spantree spanguard Use this command to reset the status of the Spanning Tree SpanGuard function to disabled. Syntax clear spantree spanguard Parameters None.
Page 245: Show Spantree Spanguardtimeout
This example shows how to display the SpanGuard timeout setting: D2(su)->show spantree spanguardtimeout Spanguard timeout: 300 set spantree spanguardtimeout Use this command to set the amount of time (in seconds) an edge port will remain locked by the SpanGuard function. Syntax set spantree spanguardtimeout timeout Parameters timeout Defaults None. Mode Switch command, read‐write. Example This example shows how to set the SpanGuard timeout to 600 seconds: D2(su)->set spantree spanguardtimeout 600 Specifies a timeout value in seconds. Valid values are 0 to 65535. A value of 0 will keep the port locked until manually unlocked. The default value is 300 seconds. show spantree spanguardtimeout Enterasys D-Series CLI Reference 8-27...
Page 246: Clear Spantree Spanguardtimeout
Use this command to reset the Spanning Tree SpanGuard timeout to the default value of 300 seconds. Syntax clear spantree spanguardtimeout Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the SpanGuard timeout to 300 seconds: D2(rw)->clear spantree spanguardtimeout show spantree spanguardlock Use this command to display the SpanGuard lock status of one or more ports. Syntax show spantree spanguardlock [port-string] Parameters port‐string Defaults If no port string is specified, the SpanGuard lock status for all ports is displayed. Mode Switch command, read‐only. Example This example shows how to display the SpanGuard lock status for ...
Page 247: Clear / Set Spantree Spanguardlock
D2(rw)->clear spantree spanguardlock ge.1.16 show spantree spanguardtrapenable Use this command to display the state of the Spanning Tree SpanGuard trap function. Syntax show spantree spanguardtrapenable Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the state of the SpanGuard trap function: D2(ro)->show spantree spanguardtrapenable Spanguard SNMP traps are enabled Specifies port(s) to unlock. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.16: clear / set spantree spanguardlock Enterasys D-Series CLI Reference 8-29...
Page 248: Set Spantree Spanguardtrapenable
Use this command to enable or disable the sending of an SNMP trap message when SpanGuard has locked a port. Syntax set spantree spanguardtrapenable {disable | enable} Parameters disable | enable Defaults None. Mode Switch command, read‐write. Example This example shows how to disable the SpanGuard trap function: D2(su)->set spantree spanguardtrapenable disable clear spantree spanguardtrapenable Use this command to reset the Spanning Tree SpanGuard trap function back to the default state of enabled. Syntax clear spantree spanguardtrapenable Parameters None. Defaults None.
Page 249: Show Spantree Legacypathcost
Legacy Path Cost is disabled. set spantree legacypathcost Use this command to enable or disable legacy (802.1D) path cost values. Syntax set spantree legacypathcost {disable | enable} Parameters disable enable Defaults None. Mode Switch command, read‐write. Usage By default, legacy path cost is disabled. Enabling the device to calculate legacy path costs affects the range of valid values that can be entered in the set spantree adminpathcost command. Example This example shows how to set the default path cost values to 802.1D. D2(rw)->set spantree legacypathcost enable Use 802.1t2001 values to calculate path cost. Use 802.1d1998 values to calculate path cost. show spantree legacypathcost Enterasys D-Series CLI Reference 8-31...
Page 250: Clear Spantree Legacypathcost
Use this command to set the Spanning Tree default value for legacy path cost to 802.1t values. Syntax clear spantree legacypathcost Defaults None. Mode Switch command, read‐write. Example This example clears the legacy path cost to 802.1t values. D2(rw)->clear spantree legacypathcost 8-32 Spanning Tree Configuration...
Page 251: Configuring Spanning Tree Port Parameters
{disable | enable} Parameters port‐string disable | enable Defaults None. Mode Switch command, read‐write. Specifies the port(s) for which to enable or disable Spanning Tree. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Disables or enables Spanning Tree. Configuring Spanning Tree Port Parameters Refer to page... 8-33 8-34 8-34 8-35 8-35 8-36 8-37 8-37 8-38 8-38 8-38 8-39 Enterasys D-Series CLI Reference 8-33...
Page 252: Clear Spantree Portadmin
Example This example shows how to disable Spanning Tree on fe.1.5: D2(rw)->set spantree portadmin clear spantree portadmin Use this command to reset the default Spanning Tree admin status to enable on one or more ports. Syntax clear spantree portadmin port-string Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the default Spanning Tree admin state to enable on fe.1.12: D2(rw)->clear spantree portadmin show spantree portadmin Use this command to display the status of the Spanning Tree algorithm on one or more ports. Syntax show spantree portadmin [port port-string] Parameters port port‐string Defaults If port‐string is not specified, status will be displayed for all ports. Mode Switch command, read‐only.
Page 253: Show Spantree Portpri
D2(su)->show spantree portpri port Port .2.7 has a Port Priority of 128 on SID 0 set spantree portpri Use this command to set a port’s Spanning Tree priority. Syntax set spantree portpri port-string priority [sid sid] (Optional) Specifies the port(s) for which to display Spanning Tree priority. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. (Optional) Displays port priority for a specific Spanning Tree identifier. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. .2.7 show spantree portpri .1.1: Enterasys D-Series CLI Reference 8-35...
Page 254: Clear Spantree Portpri
Parameters port‐string priority sid sid Defaults If sid is not specified, port priority will be set for Spanning Tree 0. Mode Switch command, read‐write. Example This example shows how to set the priority of fe.1.3 to 240 on SID 1 D2(su)->set spantree portpri clear spantree portpri Use this command to reset the bridge priority of a Spanning Tree port to a default value of 128. Syntax clear spantree portpri port-string [sid sid] Parameters port‐string sid sid Defaults If sid is not specified, port priority will be set for Spanning Tree 0. Mode Switch command, read‐write. Example This example shows how to reset the priority of fe.1.3 to 128 on SID 1 D2(su)->clear spantree portpri 8-36 Spanning Tree Configuration Specifies the port(s) for which to set Spanning Tree port priority. For a ...
Page 255: Show Spantree Adminpathcost
Syntax set spantree adminpathcost port-string cost [sid sid] Parameters port‐string cost sid sid Defaults If sid is not specified, admin path cost will be set for Spanning Tree 0. Mode Switch command, read‐write. (Optional) Displays the admin path cost value for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. (Optional) Displays the admin path cost for a specific Spanning Tree identifier. Valid values are 0 ‐ 4094. If not specified, SID 0 will be assumed. .3.4 sid 1 Specifies the port(s) on which to set an admin path cost. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Specifies the port path cost. Va1id values are 0 ‐ 200000000. (Optional) Sets the admin path cost for a specific Spanning Tree identifier. Valid values are 0 ‐ 4094. If not specified, SID 0 will be assumed. show spantree adminpathcost Enterasys D-Series CLI Reference 8-37...
Page 256: Clear Spantree Adminpathcost
D2(su)->set spantree adminpathcost clear spantree adminpathcost Use this command to reset the Spanning Tree default value for port admin path cost to 0. Syntax clear spantree adminpathcost port-string [sid sid] Parameters port‐string sid sid Defaults If sid is not specified, admin path cost will be reset for Spanning Tree 0. Mode Switch command, read‐write. Example This example shows how to reset the admin path cost to 0 for fe.3.2 on SID 1: D2(su)->clear spantree adminpathcost show spantree adminedge Use this command to display the edge port administrative status for a port. Syntax show spantree adminedge [port port-string] Parameters port‐string Defaults If port‐string is not specified edge port administrative status will be displayed for all Spanning Tree ...
Page 257: Set Spantree Adminedge
Defaults None. Mode Switch command, read‐write. Usage The default behavior of the edge port administrative status begins with the value set to false initially after the device is powered up. If a Spanning Tree BDPU is not received on the port within a few seconds, the status setting changes to true. Example This example shows how to set fe.1.11 as an edge port: D2(su)->set spantree adminedge clear spantree adminedge Use this command to reset a Spanning Tree port to non‐edge status. Syntax clear spantree adminedge port-string .3.2 Specifies the edge port. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Enables (true) or disables (false) the specified port as a Spanning Tree edge port. .1.11 true set spantree adminedge Enterasys D-Series CLI Reference 8-39...
Page 258 Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to reset fe.1.11 as a non‐edge port: D2(su)->clear spantree adminedge 8-40 Spanning Tree Configuration Specifies port(s) on which to reset edge port status. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.11...
Page 259: Configuring Spanning Tree Loop Protect Parameters
Configuring Spanning Tree Loop Protect Parameters Refer to page... 8-42 8-42 8-43 8-43 8-44 8-45 8-45 8-46 8-46 8-47 8-47 8-48 8-48 8-49 8-49 8-50 8-50 8-51 8-52 8-52 8-53 Enterasys D-Series CLI Reference 8-41...
Page 260: Set Spantree Lp
{enable | disable} [sid sid] Parameters port‐string enable | disable sid sid Defaults If no SID is specified, SID 0 is assumed. Mode Switch command, read‐write. Usage Loop Protect takes precedence over per port STP enable/disable (portAdmin). Normally portAdmin disabled would cause a port to go immediately to forwarding. If Loop Protect is enabled, that port should go to listening and remain there. Note: The Loop Protect enable/disable settings for an MSTI port should match those for the CIST port. Example This example shows how to enable Loop Protect on fe.2.3: D2(su)->set spantree lp...
Page 261: Clear Spantree Lp
Switch command, read‐write. Example This example shows how to return the Loop Protect state on fe.2.3 to disabled: D2(rw)->clear spantree lp port show spantree lplock Use this command to display the Loop Protect lock status per port and/or per SID. A port can become locked if a configured number of Loop Protect events occur during the configured window of time. See the set spantree lpthreshold and set spantree lpwindow commands. Once a port is forced into blocking (locked), it remains locked until manually unlocked with the clear spantree lplock command. Syntax show spantree lplock [port port-string] [sid sid] .2.3 .2.3 , SI Specifies port(s) for which to clear the Loop Protect feature status. (Optional) Specifies the specific Spanning Tree(s) for which to clear the Loop Protect feature status. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. .2.3 clear spantree lp Enterasys D-Series CLI Reference 8-43...
Page 262: Clear Spantree Lplock
Parameters port‐string sid sid Defaults If no port‐string is specified, status is displayed for all ports. If no SID is specified, SID 0 is assumed. Mode Switch command, read‐only. Example This example shows how to display Loop Protect lock status on fe.1.1: D2(rw)->show spantree lplock port The LoopProtect lock status for port clear spantree lplock Use this command to manually unlock a blocked port and optionally, per SID. The default state is unlocked. Syntax clear spantree lplock port-string [sid sid] Parameters port‐string sid sid Defaults If no SID is specified, SID 0 is assumed. ...
Page 263: Set Spantree Lpcapablepartner
This type of timeout will not be considered a loop protection event. Loop protection is maintained by keeping the port from forwarding but since this is not considered a loop event it will not be factored into locking the port. Example This example shows how to set the Loop Protect capable partner to true for fe.1.1: D2(rw)->set spantree lpcapablepartner show spantree lpcapablepartner Use this command to the Loop Protect capability of a link partner for one or more ports. Syntax show spantree lpcapablepartner [port port-string] Parameters port‐string Specifies port(s) for which to configure a Loop Protect capable link partner. Specifies whether the link partner is capable (true) or not (false). .1.1 true (Optional) Specifies port(s) for which to display Loop Protect capability for its link partner. set spantree lpcapablepartner Enterasys D-Series CLI Reference 8-45...
Page 264: Clear Spantree Lpcapablepartner
Defaults If no port‐string is specified, Loop Protect capability for link partners is displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display the Loop Protect partner capability for fe.1.1: D2(rw)->show spantree lpcapablepartner port Link partner of port clear spantree lpcapablepartner Use this command to reset the Loop Protect capability of port link partners to the default state of false. Syntax clear spantree lpcapablepartner port-string Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the Loop Protect partner capability for fe.1.1: D2(rw)->clear spantree lpcapablepartner set spantree lpthreshold Use this command to set the Loop Protect event threshold.
Page 265: Show Spantree Lpthreshold
Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the current Loop Protect threshold value: D2(rw)->show spantree lpthreshold The Loop Protect event threshold value is 4 clear spantree lpthreshold Use this command to return the Loop Protect event threshold to its default value of 3. Syntax clear spantree lpthreshold Parameters None. show spantree lpthreshold Enterasys D-Series CLI Reference 8-47...
Page 266: Set Spantree Lpwindow
Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the Loop Protect event threshold to the default of 3: D2(rw)->clear spantree lpthreshold set spantree lpwindow Use this command to set the Loop Protect event window value in seconds. Syntax set spantree lpwindow value Parameters value Defaults None. Mode Switch command, read‐write. Usage The Loop Protect Window is a timer value, in seconds, that defines a period during which Loop Protect events are counted. The default value is 180 seconds. If the timer is set to 0, the event counter is not reset until the Loop Protect event threshold is reached. If the threshold is reached, that constitutes a loop protection event. Example This example shows how to set the Loop Protect event window to 120 seconds: D2(rw)->set spantree lpwindow 120 show spantree lpwindow Use this command to display the current Loop Protect event window value.
Page 267: Clear Spantree Lpwindow
Use this command to reset the Loop Protect event window to the default value of 180 seconds. Syntax clear spantree lpwindow Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the Loop Protect event window to the default of 180 seconds: D2(rw)->clear spantree lpwindow set spantree lptrapenable Use this command to enable or disable Loop Protect event notification. Syntax set spantree lptrapenable {enable | disable} Parameters enable | disable Enables or disables the sending of Loop Protect traps. Default is disabled. clear spantree lpwindow Enterasys D-Series CLI Reference 8-49...
Page 268: Show Spantree Lptrapenable
Defaults None. Mode Switch command, read‐write. Usage Loop Protect traps are sent when a Loop Protect event occurs, that is, when a port goes to listening due to not receiving BPDUs. The trap indicates port, SID and loop protection status. Example This example shows how to enable sending of Loop Protect traps: D2(rw)->set spantree lptrapenable enable show spantree lptrapenable Use this command to display the current status of Loop Protect event notification. Syntax show spantree lptrapenable Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the current Loop Protect event notification status: D2(rw)->show spantree lptrapenable The Loop Protect event notification status is enable clear spantree lptrapenable Use this command to return the Loop Protect event notification state to its default state of ...
Page 269: Set Spantree Disputedbpduthreshold
Use this command to set the disputed BPDU threshold, which is the number of disputed BPDUs that must be received on a given port/SID until a disputed BPDU trap is sent. Syntax set spantree disputedbpduthreshold value Parameters value Defaults None. Mode Switch command, read‐write. Usage A disputed BPDU is one in which the flags field indicates a designated role and learning, and the priority vector is worse than that already held by the port. If a disputed BPDU is received the port is forced to the listening state. Refer to the 802.1Q‐2005 standard, IEEE Standard for Local and Metropolitan Area Networks – Virtual Bridged Local Area Networks, for a full description of the dispute mechanism, which prevents looping in cases of one‐way communication. The disputed BPDU threshold is an integer variable that represents the number of disputed BPDUs that must be received on a given port/SID until a disputed BPDU trap is sent and a syslog message is issued. For example, if the threshold is 10, then a trap is issued when 10, 20, 30, and so on, disputed BPDUs have been received. If the value is 0, traps are not sent. The trap indicates port, SID and total Disputed BPDU count. The default is 0. Specifies the number of disputed BPDUs that must be received on a given port/SID to cause a disputed BPDU trap to be sent. A threshold of 0 indicates that traps should not be sent. The default value is 0. set spantree disputedbpduthreshold Enterasys D-Series CLI Reference 8-51...
Page 270: Show Spantree Disputedbpduthreshold
D2(rw)->set spantree disputedbpduthreshold 5 show spantree disputedbpduthreshold Use this command to display the current value of the disputed BPDU threshold. Syntax show spantree disputedbpduthreshold Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the current disputed BPDU threshold: D2(rw)->show spantree disputedbpduthreshold The disputed BPDU threshold value is 0 clear spantree disputedbpduthreshold Use this command to return the disputed BPDU threshold to its default value of 0, meaning that disputed BPDU traps should not be sent. Syntax clear spantree disputedbpduthreshold Parameters None.
Page 271: Show Spantree Nonforwardingreason
Defaults If no port‐string is specified, non‐forwarding reason is displayed for all ports. If no SID is specified, SID 0 is assumed. Mode Switch command, read‐only. Usage Exceptional conditions causing a port to be placed in listening or blocking state include a Loop Protect event, receipt of disputed BPDUs, and loopback detection. Example This example shows how to display the non‐forwarding reason on fe.1.1: D2(rw)->show spantree nonforwardingreason port The non-forwarding reason for port Specifies port(s) for which to display the non‐forwarding reason. (Optional) Specifies the specific Spanning Tree(s) for which to display the non‐forwarding reason. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. .1.1 on SID 0 is None show spantree nonforwardingreason .1.1 Enterasys D-Series CLI Reference 8-53...
Page 272 show spantree nonforwardingreason 8-54 Spanning Tree Configuration...
Page 273: Vlan Configuration Summary
4093. As a default, all ports on the device are assigned to VLAN ID 1, untagged. Port String Syntax Used in the CLI For information on how to designate VLANs and port numbers in the CLI syntax, refer to “Port String Syntax Used in the CLI” on page 6‐1. Creating a Secure Management VLAN By default at startup, there is one VLAN configured on the D‐Series device. It is VLAN ID 1, the DEFAULT VLAN. The default community name, which determines remote access for SNMP management, is set to “public” with read‐write access. 802.1Q VLAN Configuration Enterasys D-Series CLI Reference 9-1 Refer to page... 9-13 9-18 9-20...
Page 274: Viewing Vlans
Step Task Create a new VLAN. Set the PVID for the desired switch port to the VLAN created in Step 1. Add the desired switch port to the egress list for the VLAN created in Step 1. Assign host status to the VLAN.
Page 275: Command
VLAN Type: Default Egress Ports .1.1-10, ge.2.1-4, Forbidden Egress Ports None. Untagged Ports .1.1-10, ge.2.1-4, Table 9‐25 provides an explanation of the command output. (Optional) Displays information related to static VLANs. Static VLANs are manually created using the set vlan command (“set vlan” on page 9‐5), SNMP MIBs, or the WebView management application. The default VLAN, VLAN 1, is always statically configured and can’t be deleted. Only ports that use a specified VLAN as their default VLAN (PVID) will be displayed. (Optional) Displays information for a specific VLAN or range of VLANs. (Optional) Displays VLAN attributes related to one or more ports. (Optional) Displays port information for one or more VLANs. (Optional) Displays port information for one or more ports. NAME: DEFAULT VLAN .3.1-7, .3.1-7, show vlan Refer to page... Enterasys D-Series CLI Reference 9-3...
Page 276: Show Vlan Output Details
show vlan Table 9-25 show vlan Output Details Output Field VLAN NAME Status VLAN Type Egress Ports Forbidden Egress Ports Untagged Ports 9-4 802.1Q VLAN Configuration What It Displays... VLAN ID. Name assigned to the VLAN. Whether it is enabled or disabled. Whether it is permanent (static) or dynamic.
Page 277: Creating And Naming Static Vlans
{create | enable | disable} vlan-list Parameters create | enable | disable vlan‐list Defaults None. Mode Switch command, read‐write. Usage Once a VLAN is created, you can assign it a name using the set vlan name command described in “set vlan name” on page 9‐6. Each VLAN ID must be unique. If a duplicate VLAN ID is entered, the device assumes that the Administrator intends to modify the existing VLAN. Enter the VLAN ID using a unique number between 1 and 4093. The VLAN IDs of 0 and 4094 and higher may not be used for user‐defined VLANs. Examples This example shows how to create VLAN 3: D2(su)->set vlan create 3 Creates, enables or disables VLAN(s). Specifies one or more VLAN IDs to be created, enabled or disabled. Creating and Naming Static VLANs Refer to page... Enterasys D-Series CLI Reference 9-5...
Page 278: Set Vlan Name
Use this command to set or change the ASCII name for a new or existing VLAN. Syntax set vlan name vlan-list vlan-name Parameters vlan‐list vlan‐name Defaults None. Mode Switch command, read‐write. Example This example shows how to set the name for VLAN 7 to green: D2(su)->set vlan name 7 green clear vlan Use this command to remove a static VLAN from the list of VLANs recognized by the device. Syntax clear vlan vlan-list Parameters vlan‐list Defaults None. Mode Switch command, read‐write.
Page 279: Clear Vlan Name
Use this command to remove the name of a VLAN from the VLAN list. Syntax clear vlan name vlan-list Parameters vlan‐list Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the name for VLAN 9: D2(su)->clear vlan name 9 Specifies the VLAN ID of the VLAN(s) for which the name will be cleared. clear vlan name Enterasys D-Series CLI Reference 9-7...
Page 280: Assigning Port Vlan Ids (Pvids) And Ingress Filtering
Use this command to display port VLAN identifier (PVID) information. PVID determines the VLAN to which all untagged frames received on one or more ports will be classified. Syntax show port vlan [port-string] Parameters port‐string Defaults If port ‐string is not specified, port VLAN information for all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display PVIDs assigned to fe.2.1 through 6. In this case, untagged frames received on these ports will be classified to VLAN 1: D2(su)->show port vlan .2.1 is set to 1 .2.2 is set to 1 .2.3 is set to 1 .2.4 is set to 1 9-8 802.1Q VLAN Configuration (Optional) Displays PVID information for specific port(s). For a detailed ...
Page 281: Set Port Vlan
9-9. Syntax clear port vlan port-string Specifies the port(s) for which to configure a VLAN identifier. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Specifies the VLAN ID of the VLAN to which port(s) will be added. (Optional) Adds port(s) to VLANʹs untagged egress list and removes them from other untagged egress lists. set port vlan set port vlan Enterasys D-Series CLI Reference 9-9...
Page 282: Show Port Ingress Filter
Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to reset ports fe.1.3 through 11 to a VLAN ID of 1 (Host VLAN): D2(su)->clear port vlan show port ingress filter Use this command to show all ports that are enabled for port ingress filtering, which limits incoming VLAN ID frames according to a port VLAN egress list. If the VLAN ID specified in the received frame is not on the port’s VLAN egress list, then that frame is dropped and not forwarded. Syntax show port ingress-filter [port-string] Parameters port‐string Defaults If port‐string is not specified, ingress filtering status for all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display the port ingress filter status for ports 10 through 15 in slot 1. In this case, the ports are disabled for ingress filtering: D2(su)->show port ingress-filter...
Page 283: Set Port Ingress Filter
[port-string] Parameters port‐string Defaults If port-string is not specified, frame discard mode will be displayed for all ports. Specifies the port(s) on which to enable of disable ingress filtering. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Disables or enables ingress filtering. .1.3 enable (Optional) Displays the frame discard mode for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. set port ingress filter Enterasys D-Series CLI Reference 9-11...
Page 284: Set Port Discard
Mode Switch command, read‐only. Example This example shows how to display the frame discard mode for fe.2.7. In this case, the port has been set to discard all tagged frames: D2(su)->show port discard Port ------------ .2.7 set port discard Use this command to set the frame discard mode on one or more ports. Syntax set port discard port-string {tagged | untagged | both | none} Parameters port‐string tagged | untagged | both | none Defaults None. Mode Switch command, read‐write. Usage The options are to discard all incoming tagged frames, all incoming untagged frames, neither ...
Page 285: Configuring The Vlan Egress List
Use this command to display the VLAN membership for one or more ports. Syntax show port egress [port-string] Parameters port‐string Defaults If port‐string is not specified, VLAN membership will be displayed for all ports. (Optional) Displays VLAN membership for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Configuring the VLAN Egress List Refer to page... 9-13 9-14 9-15 9-15 9-16 9-17 Enterasys D-Series CLI Reference 9-13...
Page 286: Set Vlan Forbidden
Mode Switch command, read‐write. Example This example shows you how to show VLAN egress information for fe.1.1 through 3. In this case, all three ports are allowed to transmit VLAN 1 frames as tagged and VLAN 10 frames as untagged. Both are static VLANs: D2(su)->show port egress Port Vlan Number ------------------------------------------------------- .1.1 .1.1 .1.2 .1.2 .1.3 .1.3 set vlan forbidden Use this command to prevent one or more ports from participating in a VLAN. This setting instructs the device to ignore dynamic requests (either through GVRP or dynamic egress) for the port to join the VLAN. Syntax set vlan forbidden vlan-id port-string Parameters vlan‐id port‐string Defaults None. Mode Switch command, read‐write.
Page 287: Set Vlan Egress
Specifies the VLAN where a port(s) will be added to the egress list. Specifies one or more ports to add to the VLAN egress list of the specified vlan‐list. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. (Optional) Adds the specified ports as: • untagged — Causes the port(s) to transmit frames without an IEEE 802.1Q header tag. • forbidden — Instructs the device to ignore dynamic requests (either through GVRP or dynamic egress) from the port(s) to join the VLAN and disallows egress on that port. • tagged — Causes the port(s) to transmit 802.1Q tagged frames. .1.5-10 untagged .1.13-15 forbidden .1.2 untagged set vlan egress set vlan egress Enterasys D-Series CLI Reference 9-15...
Page 288: Show Vlan Dynamicegress
Syntax clear vlan egress vlan-list port-string [forbidden] Parameters vlan‐list port‐string forbidden Defaults If forbidden is not specified, tagged and untagged settings will be cleared. Mode Switch command, read‐write. Examples This example shows how to remove fe.3.14 from the egress list of VLAN 9: D2(su)->clear vlan egress 9 This example shows how to remove all Ethernet ports in slot 2 from the egress list of VLAN 4: D2(su)->clear vlan egress 4 show vlan dynamicegress Use this command to display the status of dynamic egress (enabled or disabled) for one or more VLANs. Syntax show vlan dynamicegress [vlan-list] Parameters vlan‐list...
Page 289: Set Vlan Dynamicegress
{enable | disable} Parameters vlan‐list enable | disable Defaults None. Mode Switch command, read‐write. Usage If dynamic egress is enabled for a particular VLAN, when a port receives a frame tagged with that VLAN’s ID, the switch will add the receiving port to that VLAN’s egress list. Dynamic egress is disabled on the D‐Series by default. For example, assume you have 20 AppleTalk users on your network who are mobile users (that is, use different ports every day), but you want to keep the AppleTalk traffic isolated in its own VLAN. You can create an AppleTalk VLAN with a VLAN ID of 55 with a classification rule that all AppleTalk traffic gets tagged with VLAN ID 55. Then, you enable dynamic egress for VLAN 55. Now, when an AppleTalk user plugs into port will tag the packet to VLAN 55 and also add port AppleTalk user to receive AppleTalk traffic. Example This example shows how to enable dynamic egress on VLAN 55: D2(rw)->set vlan dynamicegress 55 enable Specifies the VLANs by ID to enable or disable dynamic egress. Enables or disables dynamic egress. .3.5 and sends an AppleTalk packet, the switch .3.5 to VLAN 55’s egress list, which allows the set vlan dynamicegress Enterasys D-Series CLI Reference 9-17...
Page 290: Setting The Host Vlan
Use this command to display the current host VLAN. Syntax show host vlan Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the host VLAN: D2(su)->show host vlan Host vlan is 7. set host vlan Use this command to assign host status to a VLAN. Syntax set host vlan vlan-id 9-18 802.1Q VLAN Configuration VLAN” on page 9-1 for more information.
Page 291: Clear Host Vlan
D2(su)->set host vlan 7 clear host vlan Use this command to reset the host VLAN to the default setting of 1. Syntax clear host vlan Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the host VLAN to the default setting: D2(su)->clear host vlan Specifies the number of the VLAN to set as the host VLAN. “Creating and Naming Static clear host vlan VLANs” on page 9-5. Enterasys D-Series CLI Reference 9-19...
Page 292: Enabling/Disabling Gvrp (Garp Vlan Registration Protocol)
About GARP VLAN Registration Protocol (GVRP) The following sections describe the device operation when its ports are operating under the Generic Attribute Registration Protocol (GARP) application – GARP VLAN Registration Protocol (GVRP). Overview The purpose of GVRP is to dynamically create VLANs across a switched network. When a VLAN is declared, the information is transmitted out GVRP configured ports on the device in a GARP formatted frame using the GVRP multicast MAC address. A switch that receives this frame, examines the frame, and extracts the VLAN IDs. GVRP then creates the VLANs and adds the receiving port to its tagged member list for the extracted VLAN ID (s). The information is then transmitted out the other GVRP configured ports of the device. Figure how VLAN blue from end station A would be propagated across a switch network. How It Works In Figure 9‐1 on page 9‐21, Switch 4, port 1 is registered as being a member of VLAN Blue and then declares this fact out all its ports (2 and 3) to Switch 1 and Switch 2. These two devices register this in the port egress lists of the ports (Switch 1, port 1 and Switch 2, port 1) that received the frames with the information. Switch 2, which is connected to Switch 3 and Switch 5 declares the same information to those two devices and the port egress list of each port is updated with the new information, accordingly. Configuring a VLAN on an 802.1Q switch creates a static VLAN entry. The entry will always remain registered and will not time out. However, dynamic entries will time‐out and their registrations will be removed from the member list if the end station A is removed. This ensures that, if switches are disconnected or if end stations are removed, the registered information remains accurate. The end result is that the port egress list of a port is updated with information about VLANs that reside on that port, even if the actual station on the VLAN is several hops away. 9-20 802.1Q VLAN Configuration...
Page 293: Purpose
Purpose To dynamically create VLANs across a switched network. The GVRP command set is used to display GVRP configuration information, the current global GVRP state setting, individual port settings (enable or disable) and timer settings. By default, GVRP is enabled globally on the device, but disabled on all ports. Commands For information about... show gvrp show garp timer set gvrp clear gvrp set garp timer Enabling/Disabling GVRP (GARP VLAN Registration Protocol) Enterasys D-Series CLI Reference 9-21 Refer to page... 9-22 9-22 9-23 9-24 9-24...
Page 294: Show Gvrp
Use this command to display GVRP configuration information. Syntax show gvrp [port-string] Parameters port‐string Defaults If port‐string is not specified, GVRP configuration information will be displayed for all ports and the device. Mode Switch command, read‐only. Example This example shows how to display GVRP status for the device and for fw.2.1: D2(su)->show gvrp Global GVRP status is enabled. Port Number ----------- .2.1 show garp timer Use this command to display GARP timer values for one or more ports. Syntax show garp timer [port-string] Parameters port‐string Defaults If port‐string is not specified, GARP timer information will be displayed for all ports.
Page 295: Set Gvrp
“Port String Syntax Used in the CLI” on page 6-1. Join timer setting. Leave timer setting. Leavall timer setting. Disables or enables GVRP on the device. (Optional) Disables or enables GVRP on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. 1000 1000 1000 1000 1000 1000 1000 1000 1000 1000 Enterasys D-Series CLI Reference 9-23 set gvrp...
Page 296: Clear Gvrp
Mode Switch command, read‐write. Examples This example shows how to enable GVRP globally on the device: D2(su)->set gvrp enable This example shows how to disable GVRP globally on the device: D2(su)->set gvrp disable This example shows how to enable GVRP on fe.1.3: D2(su)->set gvrp enable clear gvrp Use this command to clear GVRP status or on one or more ports. Syntax clear gvrp [port-string] Parameters port‐string Defaults If port‐string is not specified, GVRP status will be cleared for all ports. Mode Switch command, read‐write. Example This example shows how to clear GVRP status globally on the device: D2(su)->clear gvrp set garp timer Use this command to adjust the values of the join, leave, and leaveall timers. Syntax set garp timer {[join timer-value] [leave timer-value] [leaveall timer-value]}...
Page 297 Syntax Used in the CLI” on page 6‐1. Defaults None. Mode Switch command, read‐write. Usage The setting of these timers is critical and should only be changed by personnel familiar with the 802.1Q standards documentation, which is not supplied with this device. Examples This example shows how to set the GARP join timer value to 100 centiseconds for all ports: D2(su)->set garp timer join 100 *.*.* This example shows how to set the leave timer value to 300 centiseconds for all ports: D2(su)->set garp timer leave 300 *.*.* This example shows how to set the leaveall timer value to 20000 centiseconds for all ports: D2(su)->set garp timer leaveall 20000 *.*.* set garp timer Enterasys D-Series CLI Reference 9-25...
Page 298 set garp timer 9-26 802.1Q VLAN Configuration...
Page 299: Chapter 10: Differentiated Services Configuration
Differentiated Services Configuration This chapter describes the Differentiated Services (Diffserv) set of commands and how to use them. Note: Diffserv will not be available if a Policy License is activated on the D-Series. When a Policy License is activated, it enables Policy that takes the place of Diffserv. Refer to Activating Licensed Features D‐Series devices support Diffserv policy‐based provisioning of network resources by allowing IT ...
Page 300: Globally Enabling Or Disabling Diffserv
Command For information about... set diffserv adminmode set diffserv adminmode Use this command to globally enable or disable Diffserv on the device. By default, this function is disabled at device startup. Syntax set diffserv adminmode {enable | disable} Parameters enable | disable Defaults None. Mode Switch command, read‐write. Example This example shows how to enable Diffserv: D2(rw)->set diffserv adminmode enable 10-2 Differentiated Services Configuration Enables or disables Diffserv. Refer to page... 10‐2...
Page 301: Creating Diffserv Classes And Matching Conditions
Policy Instance Table Size Current/Max... 0 / 120 Policy Attribute Table Size Current/Max... 0 / 120 Service Table Size Current/Max... 0 / 48 Creating Diffserv Classes and Matching Conditions Refer to page... 10-3 10-4 10-4 10-5 10-5 10-8 Enterasys D-Series CLI Reference 10-3...
Page 302: Show Diffserv Class
Use this command to display information about Diffserv classes. Syntax show diffserv class {summary | detailed classname} Parameters summary detailed classname Displays detailed Diffserv information for a specific class. Defaults None. Mode Switch command, read‐only. Example This example shows how to display a summary of Diffserv class information. In this case, there are two classes configured, named “guest” and “admin”: D2(rw)->show diffserv class summary Class Name ----------------- ------------ ------------------------------- guest admin set class create Use this command to create a new Diffserv class.
Page 303: Set Diffserv Class Delete
| number classname portnumber}] [ipdscp classname dscpval] [ipprecedence classname precedencenumber] [iptos classname tosbits tosmask] [protocol {keyword classname protocol-name | number classname protocol-number}] [refclass {add | remove}{classname refclassname}] [vlan classname vlanid]} Specifies the class name to be deleted. 10‐16), then set diffserv class delete 10‐11). Enterasys D-Series CLI Reference 10-5...
Page 304 set diffserv class match Parameters every classname dstmac | scrmac classname macaddr macmask dstip | srcip classname ipaddr ipmask dstl4port | srcl4port keyword classname keyword | number classname portnumber ipdscp classname dscpval ipprecedence classname precedencenumber iptos classname tosbits tosmask protocol keyword classname protocol‐name | number classname protocol‐ number refclass add | remove classname refclassname vlan classname vlanid 10-6 Differentiated Services Configuration Matches all packets to a specific class. Matches to a specific class based on destination or source MAC address. Matches to a specific class based on destination or source IP address. Matches to a specific class based on destination or source layer 4 port number or keyword. Valid keyword values are: • domain • echo •...
Page 305: Valid Ip Dscp Numeric And Keyword Values
Keyword (Usage) be (best effort) cs0 - cs7 (Class Selector PHB) af11, af12, af13 (Assured Forwarding) af21, af22, af23 (Assured Forwarding) af31, af32, af33 (Assured Forwarding) af41, af42, af43 (Assured Forwarding) ef (Expedited Forwarding) Enterasys D-Series CLI Reference 10-7...
Page 306: Set Diffserv Class Rename
D2(rw)->set diffserv class match dstl4port keyword http http D2(rw)->set diffserv class match protocol keyword http tcp set diffserv class rename Use this command to change the name of a Diffserv class. Syntax set diffserv class rename classname newclassname Parameters classname newclassname Defaults None. Mode Switch command, Read‐Write. 10-8 Differentiated Services Configuration Specifies the class name previously set for this new Diffserv class. Specifies a new class name.
Page 307: Configuring Diffserv Policies And Assigning Classes
{summary | detailed policyname} Parameters summary detailed policyname Defaults None. Mode Switch command. Read‐Only. Displays Diffserv policy summary information. Displays detailed Diffserv information for a specific policy. Configuring Diffserv Policies and Assigning Classes Refer to page... 10-9 10-10 10-10 10-11 10-11 10-12 10-13 10-13 10-14 Enterasys D-Series CLI Reference 10-9...
Page 308: Set Diffserv Policy Create
Use this command to create a new Diffserv policy. Syntax set diffserv policy create policyname {in} Parameters policyname in Defaults None. Mode Switch command, read‐write. Example This example shows how to create a Diffserv policy called “admin” and apply it to incoming packets: D2(rw)->set diffserv policy create admin in set diffserv policy delete Use this command to delete a Diffserv policy. Syntax set diffserv policy delete policyname Parameters...
Page 309: Set Diffserv Policy Class
Class must be added to a policy using this command before policy parameters, such as bandwidth, marking, and policing, can be configured. Example This example shows how to add the “system” class to the “admin” policy: D2(rw)->set diffserv policy class add admin system set diffserv policy mark Use this command to mark all packets for the associated Diffserv traffic stream with a specific IP DSCP or IP precedence value. Syntax set diffserv policy mark {ipdscp | ipprecedence policyname classname value} Adds or removes the specified class. Specifies the policy name to be associated with the class. Specifies a class name to add or remove. set diffserv policy class Enterasys D-Series CLI Reference 10-11...
Page 310: Set Diffserv Policy Police Style Simple
Parameters ipdscp | ipprecedence policyname classname value Defaults None. Mode Switch command, read‐write. Example This example shows how to mark packets matching the “admin” policy in the “system” class for DSCP expedited forwarding precedence: D2(rw)->set diffserv policy mark ipdscp admin system ef set diffserv policy police style simple Use this command to establish the policing style for a Diffserv policy based only on bandwidth for the specified class. Syntax set diffserv policy police style simple policyname classname bandwidth burstsize...
Page 311: Set Diffserv Policy Police Action Conform
Syntax set diffserv policy police action nonconform {drop | send policyname classname} | {markdscp | markprec policyname classname value} Parameters drop | send Specifies whether the policing action for packets conforming to the classification parameters will be to drop or send packets. Specifies the policy name being configured. Specifies a Diffserv class to associate to this policing action. Specifies an IP DHCP or precedence value set with the set diffserv policy mark command (page 10‐11). Specifies whether the policing action for packets not conforming to the classification parameters will be to drop or send packets. set diffserv policy police action conform Enterasys D-Series CLI Reference 10-13...
Page 312: Set Diffserv Policy Rename
Specifies a policing action based on IP DHCP or precedence. value Defaults None. Mode Switch command, read‐write. Example This example shows how to set the policying action to drop for packets not conforming to the Diffserv policy “admin,” class “system.” D2(rw)->set diffserv policy police action nonconform drop admin system set diffserv policy rename Use this command to change the name of a Diffserv policy. Syntax set diffserv policy rename policyname newpolicyname Parameters policyname newpolicyname Defaults None.
Page 313: Commands
Use this command to display Diffserv policy service statistics. Syntax show diffserv service stats {summary | detailed port-string} {in} Displays Diffserv service port summary information. Displays detailed information for a specific port(s). Displays information about incoming traffic. OperStatus Policy Name ---------- ---------------------- admin admin admin show diffserv service info Refer to page... 10-15 10-15 10-16 Enterasys D-Series CLI Reference 10-15...
Page 314: Set Diffserv Service
Parameters summary detailed port‐string Defaults None. Mode Switch command, read‐only. Example This example shows how to display a detailed incoming traffic statistics about service port ge.1.1: D2(rw)->show diffserv service stats detailed ge.1.1 in Interface... ge.1.1 Direction... In Operational Status... Up Policy Name... admin Class Name... system In Discarded Packets... 0 set diffserv service Use this command to add or remove a Diffserv policy to incoming traffic on one or more ports.
Page 315: Diffserv Configuration Examples
D2(rw)-> set diffserv policy class add policyQOS classVOIP D2(rw)->set diffserv policy police style simple policyQOS classVOIP 1000000 128 D2(rw)->set diffserv policy police action nonconform drop policyQOS classVOIP D2(rw)-> set diffserv service add in ge.1.1-10 policyQOS DiffServ Configuration Examples Enterasys D-Series CLI Reference 10-17...
Page 316 DiffServ Configuration Examples 10-18 Differentiated Services Configuration...
Page 317: Chapter 11: Policy Classification Configuration
This chapter describes the Policy Classification set of commands and how to use them. Note: A license is required to enable Policy on the SecureStack B2 and B3 and the D-Series switch. Refer to For information about... Policy Classification Configuration Summary Configuring Policy Profiles Configuring Classification Rules Assigning Ports to Policy Profiles Configuring Policy Class of Service (CoS) Policy Classification Configuration Summary D‐Series devices support policy profile‐based provisioning of network resources by allowing IT ...
Page 318: Commands
Syntax show policy profile {all | profile-index [consecutive-pids] [-verbose]} Parameters all | profile‐index consecutive‐pids ‐verbose Defaults If optional parameters are not specified, summary information will be displayed for the specified index or all indices. Mode Switch command, read‐only. Example This example shows how to display policy information for profile 11: D2(su)->show policy profile 11 Profile Index Profile Name Row Status Port VID Status Port VID Override CoS Status Egress Vlans...
Page 319: Set Policy Profile
VLAN(s) that ports to which the policy profile is assigned can use for untagged egress. Displays the precedence of types of rules. Ports currently assigned to use this policy profile. Port dynamically assigned to use this policy profile. set policy profile Enterasys D-Series CLI Reference 11-3...
Page 320: Clear Policy Profile
| disable cos cos precedence precedence‐list Defaults If optional parameters are not specified, none will be applied. Mode Switch command, read‐write. Example This example shows how to create a policy profile 1 named “netadmin” with PVID override enabled for PVID 10, and Class‐of‐Service override enabled for CoS 5: D2(su)->set policy profile 1 name netadmin pvid-status enable pvid 10 cos-status enable cos 5 clear policy profile Use this command to delete a policy profile entry. Syntax clear policy profile profile-index Parameters profile‐index 11-4 Policy Classification Configuration Specifies an index number for the policy profile. Valid values are 1 ‐ 255.
Page 321 Defaults None. Mode Switch command, read‐write. Example This example shows how to delete policy profile 8: D2(su)->clear policy profile 8 clear policy profile Enterasys D-Series CLI Reference 11-5...
Page 322: Configuring Classification Rules
Configuring Classification Rules Configuring Classification Rules Purpose To review, create, assign, and unassign classification rules to policy profiles. This maps user profiles to protocol‐based frame filtering policies. Note: B3, C3, and G3 devices support profile-based CoS traffic rate limiting only. Policy rules specifying CoS will not rate limit on these devices, or on mixed stacks including B3 or C3 devices. Commands For information about...
Page 323 This example shows how to display policy classification information for administrative rule 1 D2(su)->show policy rule admin-pid 1 |Admin|Rule Type |Rule Data 11‐30 for valid values for each |Mk|PortStr (0x0800) |16|All (0x0801) |16|All (0x0bad) |16|All |16|All |Mk|PortStr show policy rule 11‐30 for |RS|ST|VLAN|CoS |U| | A|NV|fwrd| | A|NV|drop| | A|NV|drop| | A|NV|drop| |RS|ST|dPID|aPID|U| Enterasys D-Series CLI Reference 11-7...
Page 324: Show Policy Capability
show policy capability |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port Table 11‐29 provides an explanation of the command output. Table 11-29 show policy rule Output Details Output Field Rule Type Rule Data PortStr VLAN dPID aPID show policy capability Use this command to display detailed policy classification capabilities supported by your D‐Series device. Syntax show policy capability Parameters None.
Page 325 | X | X | X | | X | X | X | | X | X | X | show policy capability Permit Rules Table | D | | I | | S | Enterasys D-Series CLI Reference 11-9...
Page 326: Set Policy Rule
set policy rule |Ether II packet type |LLC DSAP/SSAP/CTRL |VLAN tag |Replace tci |Port string ============================================================= set policy rule Use this command to assign incoming untagged frames to a specific policy profile and to VLAN or Class‐of‐Service classification rules. This command has two forms of syntax—one to create an admin rule (for policy ID 0), and the other to create a classification rule and attach it to a policy profile. set policy rule admin-profile {vlantag data [mask mask] admin-pid profile-index} [port-string port-string] set policy rule profile-index {ether | icmptype | ipproto | ipdestsocket | ipsourcesocket | iptos | macdest | macsource | tcpdestport | tcpsourceport | udpdestport | udpsourceport} data [mask mask] [vlan vlan] [cos cos] | [drop | forward]...
Page 327: Valid Values For Policy Classification Rules
Table 11-30 Valid Values for Policy Classification Rules Classification Rule Parameter ether 11‐30 for valid values for 11‐30 for valid values for each data value mask bits Type field in Ethernet II packet: 1- 16 1536 - 65535 or 0x600 - 0xFFFF Enterasys D-Series CLI Reference 11-11 set policy rule...
Page 328: Clear Policy Rule
clear policy rule Table 11-30 Valid Values for Policy Classification Rules (Continued) Classification Rule Parameter icmptype ipproto Destination or Source IP Address: ipdestsocket ipsourcesocket iptos Destination or Source MAC: macdest macsource Destination or Source TCP port: tcpdestport tcpsourceport Destination or Source UDP port: udpsourceport udpdestport vlantag...
Page 329 Deletes associated MAC source address classification rule. tcpdestport Deletes associated TCP destination port classification rule. tcpsourceport Deletes associated TCP source port classification rule. udpdestport Deletes associated UDP destination port classification rule. udpsourceport Deletes associated UDP source port classification rule. Defaults When applicable, data and mask must be specified for individual rules to be cleared. Mode Switch command, read‐write. Examples This example shows how to delete Ethernet II Type 1526 classification rule entries associated with policy profile 1 from all ports D2(su)->clear policy rule 1 ether 1526 This example shows how to remove a rule from policy profile 5 that will forward UDP frames from source port 45: D2(su)->clear policy rule 5 udpportsource 45 forward 11‐30 for valid values for each classification type and data Enterasys D-Series CLI Reference 11-13 clear policy rule...
Page 330: Clear Policy All-Rules
Use this command to remove all policy classification rules. Syntax clear policy all-rules Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to remove all administrative and policy index rules: D2(su)->clear policy all-rules 11-14 Policy Classification Configuration...
Page 331: Assigning Ports To Policy Profiles
Assigning Ports to Policy Profiles Note: The D2 switch supports up to eight user policies per port. Purpose To assign and unassign ports to policy profiles. Commands For information about... set policy port clear policy port set policy port Use this command to assign ports to a policy profile. Syntax set policy port port-string profile-index Parameters port‐string...
Page 332: Clear Policy Port
Use this command to remove a policy profile from one or more ports. Syntax clear policy port port-string profile-index Parameters port‐string profile‐index Defaults None. Mode Switch command, read‐write. Example This example shows how to remove policy profile 10 from port 21 in slot 1: D2(rw)->clear policy port fe.1.21 10 11-16 Policy Classification Configuration Specifies the port(s) from which to remove the policy profile. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Specifies the ID of the policy profile (role) to which the port(s) will be added. This value must match the profile‐index value assigned using the set policy profile command (“set policy profile” on page 11‐3) in order for a policy profile to be active on the specified port.
Page 333: Configuring Policy Class Of Service (Cos)
Configuring Policy Class of Service (CoS) Note: It is recommended that you use Enterasys Networks NetSight Policy Manager as an alternative to CLI for configuring policy-based CoS on the switches. The D‐Series supports Class of Service (CoS), which allows you to assign mission‐critical data to a higher priority through the device by delaying less critical traffic during periods of congestion. The higher priority traffic going through the device is serviced first (before lower priority traffic). The Class of Service capability of the device is implemented by a priority queueing mechanism. Class of Service is based on the IEEE 802.1D (802.1p) standard specification, and allows you to define eight priorities (0‐7, with 7 granted highest priority) and up to 8 transmit queues (0‐7) for each port. By default, policy‐based CoS is disabled on the device, and default or user‐assigned port‐based 802.1D (802.1p) settings are used to determine traffic rate limiting. When policy‐based CoS is enabled, the default and user‐assigned policy‐based settings will override port‐based settings ...
Page 334 Configuring Policy Class of Service (CoS) ---------------------------------------------------------------------- Port Group Name Port Group Port Type Assigned Ports ---------------------------------------------------------------------- Port Group Name Port Group Port Type Assigned Ports ---------------------------------------------------------------------- Configure physical inbound rate limiters for each port group. For the user port group (1.0), create an IRL (irl‐index of 1) for 512 kbps. For the uplink port group (2.0), create an IRL (irl‐ index of 1) for 10 megabits per second (10,000 kbps). D2(su)->set cos port-resource irl 1.0 1 unit kbps rate 512 D2(su)->set cos port-resource irl 2.0 1 unit kbps rate 10000 D2(su)->show cos port-resource irl 1.0 1 Group Index Resource Type Unit...
Page 335: Set Cos State
Use this command to enable or disable Class of Service. Syntax set cos state {enable | disable} set cos state Refer to page... 11-19 11-20 11-20 11-21 11-22 11-22 11-23 11-24 11-25 11-26 11-27 11-28 11-28 11-29 11-30 11-31 11-31 11-32 Enterasys D-Series CLI Reference 11-19...
Page 336: Show Cos State
Parameters enable | disable Defaults None. Mode Switch command, read‐write. Example This example shows how to enable Class of Service: D2(rw)->set cos state enable show cos state Use this command to display the Class of Service enable state. Syntax show cos state Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to show the Class of Service enable state: D2(rw)->show cos state Class-of-Service application is enabled clear cos state Use this command to set CoS state back to its default setting of disabled.
Page 337: Set Cos Settings
Parameters cos‐index priority priority tos‐value tos‐value irl‐reference irl‐reference Defaults If no optional parameters are specified, none will be applied. Mode Switch command, read‐write. Usage The CoS settings table takes individual class of service features and displays them as belonging to a CoS entry. Essentially, it is used for CoS feature assignment. Each class of service entry consists of an index, 802.1p priority, an optional ToS value, and an IRL reference. • CoS Index Indexes are unique identifiers for each CoS setting. CoS indexes 0 through 7 are created by default and mapped directly to 802.1p priority for backwards compatibility. These entries cannot be removed, and 802.1p priority values cannot be changed. When CoS is enabled, indexes are assigned. Up to 256 CoS indexes or entries can be configured. • Priority 802.1p priority can be applied per CoS index. For each new CoS index created, the user has the option to assign an 802.1p priority value 0 to 7 for the class of service. CoS indexes 0 through 7 map directly to 802.1p priorities and cannot be changed as they exist for backward compatibility. Specifies a Class of Service entry. Valid values are 0 to 255. Specifies an 802.1d priority value. Valid values are 0 to 7, with 0 being the lowest priority. See Usage section below for more information. (Optional) Specifies a Type of Service value. (Optional) Set the inbound rate limiter associated with this entry. Valid values are 0 to 99. See Usage section below for more information. set cos settings Enterasys D-Series CLI Reference 11-21...
Page 338: Clear Cos Settings
Syntax clear cos settings cos-list {[all] | [priority] [tos-value] [irl-reference]} Parameters cos‐list priority tos‐value irl‐reference Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the priority for CoS entry 8: D2(rw)->clear cos settings 8 priority show cos settings Use this command to display Class of Service parameters. Syntax show cos settings [cos-list] 11-22 Policy Classification Configuration Specifies a Class of Service entry to clear.
Page 339: Set Cos Port-Config
Syntax set cos port-config irl group-type-index [name name] [ports port-list] [append] | [clear] Parameters group‐type‐index name name ports port‐list append clear (Optional) Specifies a Class of Service entry to display. Specifies that this is an inbound rate limiting (IRL) port group. Specifies an inbound rate limiting port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. (Optional) User defined name for the group. (Optional) Ports assigned to the group. All ports must be of the same port type (Fast Ethernet, Gigabit Ethernet). (Optional) Append (add) the ports to the ports that are already in the group. (Optional) Clear the given ports from those assigned to the group. set cos port-config Enterasys D-Series CLI Reference 11-23...
Page 340: Show Cos Port-Config
Defaults None. Mode Switch command, read‐write. Usage CoS IRL port groups are identified by group number and the type of ports in the group, in the form of group#.port‐type. The IRL port group 0.0 exists by default. This default port group cannot be removed and all physical ports in the system are assigned to it. Up to seven additional port groups (1 through 7) can be configured. Currently, only one port type (type 0) is supported. This port type supports 100 limiters. Additional port groups may be created for flexibility. Ports assigned to a new port group must be mutually exclusive from the other port group entries—ports are automatically removed from the default port group—and must be comprised of the same port type as defined by the port group. The creation of additional port groups could be used to combine similar ports by their function for flexibility. For instance, ports associated to users can be added to a port group called “Users” and ports associated to uplink ports can be added to a port group called “Uplink.” Using these port groups, a single class of service can assign different rate limits to each port group. “User” ports can be assigned one rate limit, while “Uplink” ports can be assigned another. DFE supports a maximum of 8 port groups per CoS function (IRL). The command show cos port‐config displays each IRL port group configured by group and type, with the group name and associated (assigned) ports. The command show cos port‐type displays the available inbound rate limiting resources for the port type. Example This example configures two port groups, one for user ports and one for uplink ports and assign ports to the groups. Port group 1.0 will represent user ports, group 2.0 will represent uplink ports. D2(su)->set cos port-config irl 1.0 name Users ports D2(su)->set cos port-config irl 2.0 name Uplink ports show cos port-config Use this command to show inbound rate limiting groups and the assigned ports.
Page 341: Clear Cos Port-Config
{all | group-type-index {[entry] | [name] [ports]}} Parameters group‐type‐index entry name ports :Default :none :Users .1.1-46 :Uplink .1.47-48 Clear an IRL port group configuration. Clear all inbound rate limiting port‐config non‐default entries. Delete a specific port group or group name, or clear the ports from that group. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. Delete this non‐default inbound rate limiter entry. Clear the administratively assigned textual description of this port group entry to its default. Clear the ports assigned to this group to its default. clear cos port-config Enterasys D-Series CLI Reference 11-25...
Page 342: Set Cos Port-Resource
Defaults None. Mode Switch command, read‐write. Usage The default port group 0.0 cannot be deleted. Example This example deletes all Port Groups except for the Default group 0.0: D2(su)->clear cos port-config irl all set cos port-resource Use this command to set the inbound rate limit parameters for a specific IRL resource for a specific port group. Syntax set cos port-resource irl group-type-index irl-index {[unit {kbps}] [rate rate] [type {drop}]} Parameters group‐type‐index irl‐index unit kbps rate rate type drop...
Page 343: Show Cos Port-Resource
Defaults If a port group and IRL index are not specified, the IRL configuration for all resources (0‐99) for all configured port groups will be shown. Mode Switch command, read‐only. Example This example displays the IRL resource index number 1 configuration for group 2.0. D2(su)->show cos port-resource irl 2.0 1 '?' after the rate value indicates an invalid rate value (Optional) Specifies that inbound rate limiting port resources should be displayed. (Optional) Specifies an inbound rate limiting port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. (Optional) Inbound rate limiter resource index configured for the specified port group. Valid values range from 0 to 99. show cos port-resource Enterasys D-Series CLI Reference 11-27...
Page 344: Clear Cos Port-Resource
[type]]} Parameters group‐type‐index irl‐index unit rate type Defaults None. Mode Switch command, read‐write. Example This example clears the data rate to 0 for IRL resource index 1 for group 2.0. D2(su)->clear cos port-resource irl 2.0 1 rate set cos reference Use this command to set the Class of Service inbound rate limiting reference configuration. Syntax set cos reference irl group-type-index reference rate-limit irl-index 11-28 Policy Classification Configuration Rate Rate Limit Type Action...
Page 345: Show Cos Reference
D2(su)->set cos reference irl 1.0 1 rate-limit 1 D2(su)->set cos reference irl 2.0 1 rate-limit 1 show cos reference Use this command to show the Class of Service inbound rate limiting reference configuration. Syntax show cos reference [irl [group-type-index]] Specifies that an IRL reference is being configured. Specifies an inbound rate limiting port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. IRL reference number associated with this entry. Rate limiter (IRL resource index) to bind this reference to. Valid values range from 0 to 99. 11‐21) to rate limiters created in the port resource table (see “set cos show cos reference Enterasys D-Series CLI Reference 11-29...
Page 346: Clear Cos Reference
Parameters group‐type‐index Defaults If irl is not specified, all CoS reference information is displayed. If a specific port group is not specified, information for all port groups is displayed. Mode Switch command, read‐only. Example This example shows the Class of Service IRL references for port group 1.0. Note that not all of the 100 possible references are displayed in this output example. D2(su)->show cos reference irl 1.0 Group Index Reference Type Rate Limiter ----------- --------- ---- ------------ clear cos reference Use this command to clear the Class of Service inbound rate limiting reference configuration. Syntax clear cos reference irl {all | group-type-index reference} Parameters all ...
Page 347: Show Cos Unit
Port Type Type --------- ---- clear cos all-entries Use this command to clear all Class of Service entries except entries 0‐7. Syntax clear cos all-entries Parameters None. Unit: Kbps = Kilobits per second Unit Maximum Rate Minimum Rate ---- ------------ ------------ Kbps 1000000 show cos unit Granularity ----------- Enterasys D-Series CLI Reference 11-31...
Page 348: Show Cos Port-Type
Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the CoS configuration for all entries except entries 0‐7: D2(su)->clear cos all-entries show cos port-type Use this command to display Class of Service port type configurations. Syntax show cos port-type [irl [port-type]] Parameters port‐type Defaults If no parameters are specified, inbound rate limiting information for all port types is displayed. Mode Switch command, read‐only. Usage The D2 implementation provides one default port type (0) for designating available inbound rate limiting resources. Port type 0 includes all ports. The port type 0 description is “D2100 IRL,” which indicates that this port type provides a maximum of 100 inbound rate limiting resources per port group. Example This example shows inbound rate limiting information for port type 0. D2(su)->show cos port-type irl 0...
Page 349: Chapter 12: Port Priority And Rate Limiting Configuration
11-3, CoS-based classification rules will take precedence over priority settings configured with the set port priority command described in this section. Configuring Port Priority Purpose To view or configure port priority characteristics as follows: • Display or change the port default Class‐of Service (CoS) transmit priority (0 through 7) of each port for frames that are received (ingress) without priority information in their tag header. Refer to page... 12-1 12-1 12-4 12-6 12-10 “set Enterasys D-Series CLI Reference 12-1...
Page 350: Show Port Priority
[port-string] Parameters port‐string Defaults If port-string is not specified, priority for all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display the port priority for the fe.2.1 through 5. D2(su)->show port priority .2.1 is set to 0 .2.2 is set to 0 .2.3 is set to 0 .2.4 is set to 0...
Page 351: Clear Port Priority
D2(su)->set port priority clear port priority Use this command to reset the current CoS port priority setting to 0. This will cause all frames received without a priority value in its header to be set to priority 0. Syntax clear port priority port-string Parameters port‐string Defaults None. Mode Switch command, read‐write. Specifies the port for which to set priority. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Specifies a value of 0 to 7 to set the CoS priority for the port entered in the port‐string. Priority value of 0 is the lowest priority. .1.3 6 Specifies the port for which to clear priority. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. clear port priority Enterasys D-Series CLI Reference 12-3...
Page 352: Configuring Priority To Transmit Queue Mapping
Syntax show port priority-queue [port-string] Parameters port‐string Defaults If port-string is not specified, priority queue information for all ports will be displayed. Mode Switch command, read‐only. 12-4 Port Priority and Rate Limiting Configuration .1.11 (Optional) Displays the mapping of priorities to transmit queues for one or more ports. Refer to page... 12-4 12-5 12-6...
Page 353: Set Port Priority-Queue
Defaults None. Mode Switch command, read‐write. Usage Priority to transmit queue mapping on an individual port basis can only be configured on Gigabit Ethernet ports ( Ethernet port ( system. Example This example shows how to set priority 5 frames received on D2(su)->set port priority-queue ge.2.12 5 0 Specifies the port(s) for which to set priority‐to‐queue mappings. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Specifies a value of 0 through 7 (0 is the lowest level) that determines what priority frames will be transmitted on the transmit queue entered in this command. Specifies a value of 0 through 5 (0 is the lowest level) that determines the queue on which to transmit the frames with the port priority entered in this command. .x.x). When you use the set port priority‐queue command to configure a Fast .x.x), the mapping values are applied globally to all Fast Ethernet ports on the set port priority-queue .1.1. In this case, frames with .2.12 to transmit on queue 0. Enterasys D-Series CLI Reference 12-5...
Page 354: Clear Port Priority-Queue
Use this command to reset port priority queue settings back to defaults for one or more ports. Syntax clear port priority-queue port-string Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the priority queue settings on D2(su)->clear port priority-queue ge.2.12 Configuring Quality of Service (QoS) Purpose Eight transmit queues are implemented in the switch hardware for each port. The commands in this section allow you to set the priority mode and weight for each of the available queues (0 through 7) for each physical port on the switch. Priority mode and weight cannot be configured on LAGs, only on the physical ports that make up the LAG. Commands For information about... show port txq...
Page 355: Set Port Txq
Parameters port‐string value0 ‐ value7 Defaults None. Mode Switch command, read‐write. (Optional) Specifies port(s) for which to display QoS settings. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Only physical ports will be displayed. LAG ports have no transmit queue information. Specifies port(s) on which to set queue arbitration values. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Only physical ports can be configured with this command. LAG ports cannot be configured. Specifies percentage to allocate to a specific transmit queue. The values must total 100 percent. set port txq Enterasys D-Series CLI Reference 12-7...
Page 356: Clear Port Txq
--- --- --- --- --- --- --- --- --- ge.1.1 STR SP clear port txq Use this command to clear port transmit queue values back to their default values. Syntax clear port txq port-string Parameters port‐string Defaults By default, transmit queues are defined as follows: Queue Mode Switch command, read‐write. 12-8 Port Priority and Rate Limiting Configuration Clears transmit queue values on specific port(s) back to their default values. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Only physical ports can be configured with this command. LAG ports cannot be configured. Mode Weight Queue Mode Weight...
Page 357 Example This example shows how to clear transmit queue values on .1.1: D2(su)->clear port txq ge.1.1 Enterasys D-Series CLI Reference 12-9...
Page 358: Configuring Port Traffic Rate Limiting
Use this command to show the traffic rate limiting configuration on one or more ports. Syntax show port ratelimit [port-string] Parameters port‐string Defaults If port‐string is not specified, rate limiting information will be displayed for all ports. Mode Switch command, read‐only. 12-10 Port Priority and Rate Limiting Configuration (Optional) Displays rate limiting information for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 4‐1. Refer to page... 12-10 12-12 12-13...
Page 359: Show Port Ratelimit Output Details
Currently rules can only be applied to inbound traffic. 802.1D (802.1p) port priority level. Whether or not this rule is active or disabled. show port ratelimit Priority List Status ----------- -------- disabled disabled disabled disabled disabled disabled disabled disabled CLI” on page 4-1. Enterasys D-Series CLI Reference 12-11...
Page 360: Set Port Ratelimit
Defaults Threshold will be applied to inbound traffic on the port/priority. If index is not specified, settings will be applied to index 1, and will overwrite index 1 for any subsequent rate limits configured. Mode Switch command, read-write. Example This example shows how to: • globally enable rate limiting • configure rate limiting for inbound traffic on port fe.2.1, index 1, priority 5, to a threshold of 125 KBps: D2(rw)->set port ratelimit enable D2(rw)->set port ratelimit fe.2.1 5 125 enable inbound 12-12 Port Priority and Rate Limiting Configuration When entered without a port‐string, globally disables or enables the port ...
Page 361: Clear Port Ratelimit
Use this command to clear rate limiting parameters for one or more ports. Syntax clear port ratelimit port-string [index] Parameters port‐string index Defaults If not specified, all index entries will be reset. Mode Switch command, read‐write. Example This example shows how to clear all rate limiting parameters on port fe.2.1. D2(su)->clear port ratelimit fe.2.1 Specifies the port(s) on which to clear rate limiting. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 4‐1. (Optional) Specifies the associated resource index to be reset. clear port ratelimit Enterasys D-Series CLI Reference 12-13...
Page 362 clear port ratelimit 12-14 Port Priority and Rate Limiting Configuration...
Page 363: Chapter 13: Igmp Configuration
About IP Multicast Group Management The Internet Group Management Protocol (IGMP) runs between hosts and their immediately neighboring multicast device. The protocol’s mechanisms allow a host to inform its local device that it wants to receive transmissions addressed to a specific multicast group. A multicast‐enabled device can periodically ask its hosts if they want to receive multicast traffic. If there is more than one device on the LAN performing IP multicasting, one of these devices is elected “querier” and assumes the responsibility of querying the LAN for group members. Based on the group membership information learned from IGMP, a device can determine which (if any) multicast traffic needs to be forwarded to each of its ports. At Layer‐3, multicast devices use this information, along with a multicast routing protocol, to support IP multicasting across an IP network. IGMP provides the final step in an IP multicast packet delivery service, since it is only concerned with forwarding multicast traffic from the local device to group members on a directly attached subnetwork or LAN segment. This device supports IP multicast group management by passively snooping on the IGMP query and IGMP report packets transferred between IP multicast devices and IP multicast host groups to learn IP multicast group members. The purpose of IP multicast group management is to optimize a switched network’s performance so multicast packets will only be forwarded to those ports containing multicast group hosts or multicast devices instead of flooding to all ports in the subnet (VLAN). About Multicasting Multicasting is used to support real‐time applications such as video conferences or streaming audio. A multicast server does not have to establish a separate connection with each client. It merely broadcasts its service to the network, and any hosts that want to receive the multicast register with their local multicast switch/router. Although this approach reduces the network overhead required by a multicast server, the broadcast traffic must be carefully pruned at every IGMP Configuration Refer to page... 13-1 13-2 Enterasys D-Series CLI Reference 13-1...
Page 364: Show Igmpsnooping
Configuring IGMP at Layer 2 multicast switch/router it passes through to ensure that traffic is only passed to the hosts that subscribed to this service. Configuring IGMP at Layer 2 Purpose To configure IGMP snooping from the switch CLI. Commands For information about... show igmpsnooping set igmpsnooping adminmode set igmpsnooping interfacemode set igmpsnooping groupmembershipinterval set igmpsnooping maxresponse set igmpsnooping mcrtrexpiretime set igmpsnooping add-static set igmpsnooping remove-static...
Page 365: Set Igmpsnooping Adminmode
Usage In order for IGMP snooping to be enabled on one or all ports, it must be globally enabled on the device with this command, and then enabled on a port(s) using the set igmpsnooping interface mode command as described in “set igmpsnooping interfacemode” on page 13‐3. Note: IGMP snooping cannot be controlled via WebView. Example This example shows how to enable IGMP on the system: D2(su)->set igmpsnooping adminmode enable set igmpsnooping interfacemode Use this command to enable or disable IGMP on one or all ports. Syntax set igmpsnooping interfacemode port-string {enable | disable} Enables or disables IGMP snooping on the system. set igmpsnooping adminmode Enterasys D-Series CLI Reference 13-3...
Page 366: Set Igmpsnooping Groupmembershipinterval
Parameters port‐string enable | disable Defaults None. Mode Switch command, read‐write. Usage In order for IGMP snooping to be enabled on one or all ports, it must be globally enabled on the device using the set igmpsnooping adminmode command as described in “set igmpsnooping adminmode” on page 13‐3, and then enabled on a port(s) using this command. Example This example shows how to enable IGMP on port D2(su)->set igmpsnooping interfacemode ge.1.10 enable set igmpsnooping groupmembershipinterval Use this command to configure the IGMP group membership interval time for the system. Syntax set igmpsnooping groupmembershipinterval time Parameters time Defaults None. Mode Switch command, read‐write. Usage The IGMP group membership interval time sets the frequency of host‐query frame transmissions and must be greater than the IGMP maximum response time as described in “set igmpsnooping ...
Page 367: Set Igmpsnooping Maxresponse
None. Mode Switch command, read‐write. Usage This value must be less than the IGMP maximum response time described in “set igmpsnooping groupmembershipinterval” on page 13‐4. Example This example shows how to set the IGMP maximum response time to 100 seconds: D2(su)->set igmpsnooping maxresponse 100 set igmpsnooping mcrtrexpiretime Use this command to configure the IGMP multicast router expiration time for the system. Syntax set igmpsnooping mcrtrexpire time Parameters time Specifies the IGMP maximum query response time. Valid values are 100 ‐ 255 seconds. The default value is 100 seconds. This value works together with the set igmpsnooping groupmembershipinterval command to remove ports from an IGMP group and must be lesser than the group membership interval value. Specifies the IGMP multicast router expiration time. Valid values are 0 ‐ 3600 seconds. A value of 0 will configure the system with an infinite expiration time. The default value is 0. set igmpsnooping maxresponse Enterasys D-Series CLI Reference 13-5...
Page 368: Set Igmpsnooping Add-Static
Defaults None. Mode Switch command, read‐write. Usage This timer is for expiring the switch from the multicast database. If the timer expires, and the only address left is the multicast switch, then the entry will be removed. Example This example shows how to set the IGMP multicast router expiration time to infinity: D2(su)->set igmpsnooping mcrtrexpiretime 0 set igmpsnooping add-static This command creates a new static IGMP entry or adds one or more new ports to an existing entry. Syntax set igmpsnooping add-static group vlan-list [modify] [port-string] Parameters group vlan‐list modify port‐string Defaults If no ports are specified, all ports are added to the entry. If modify is not specified, a new entry is created. Mode Switch command, read‐write. Usage Use this command to create and configure Layer 2 IGMP entries.
Page 369: Set Igmpsnooping Remove-Static
D2(su)->set igmpsnooping remove-static 233.11.22.33 20 ge.1.1 show igmpsnooping static This command displays static IGMP ports for one or more VLANs or IGMP groups. Syntax show igmpsnooping static vlan-list [group group] Parameters vlan‐list group group Defaults If no group is specified, information for all groups is displayed. Mode Switch command, read‐only. Specifies the multicast group IP address of the entry. Specifies the VLANs on which the entry is configured. (Optional) Removes the specified port or ports from an existing entry. (Optional) Specifies the port or ports to remove from the entry. .1.1 from the entry for the multicast group with IP address of Specifies the VLAN for which to display static IGMP ports. (Optional) Specifies the IGMP group for which to display static IGMP ports. set igmpsnooping remove-static Enterasys D-Series CLI Reference 13-7...
Page 370: Show Igmpsnooping Mfdb
= 20 IGMP Port List = ge.1.1 show igmpsnooping mfdb Use this command to display multicast forwarding database (MFDB) information. Syntax show igmpsnooping mfdb [stats] Parameters stats Defaults If stats is not specified, all MFDB table entries will be displayed. Mode Switch command, read‐only. Examples This example shows how to display multicast forwarding database entries: D2(su)->show igmpsnooping mfdb MAC Address ----------------------- 00:14:01:00:5E:02:CD:B0 00:32:01:00:5E:37:96:D0 00:32:01:00:5E:7F:FF:FA This example shows how to display multicast forwarding database statistics: D2(su)->show igmpsnooping mfdb stats Max MFDB Table Entries... 256 Most MFDB Entries Since Last Reset...
Page 371 Defaults None. Mode Switch command, read‐write. Example This example shows how to clear all IGMP snooping entries: D2(su)->clear igmpsnooping Are you sure you want to clear all IGMP snooping entries? (y/n) y IGMP Snooping Entries Cleared. clear igmpsnooping Enterasys D-Series CLI Reference 13-9...
Page 372 clear igmpsnooping 13-10 IGMP Configuration...
Page 373: Configuring System Logging
This chapter describes switch‐related logging and network management commands and how to use them. Note: The commands in this chapter pertain to network management of the D-Series device from the switch CLI only. For information about... Configuring System Logging Monitoring Network Events and Status Managing Switch Network Addresses and Routes Configuring Simple Network Time Protocol (SNTP)
Page 374: Show Logging Server
Use this command to display the Syslog configuration for a particular server. Syntax show logging server [index] Parameters index Defaults If index is not specified, all Syslog server information will be displayed. Mode Switch command, read‐only. Example This example shows how to display Syslog server configuration information: D2(ro)->show logging server IP Address ------------------------------------------------------------------------- 1 132.140.82.111 local4 warning(5) 2 132.140.90.84 Table 14‐32 provides an explanation of the command output. Table 14-32 show logging server Output Details...
Page 375: Set Logging Server
Defaults If ip‐addr is not specified, an entry in the Syslog server table will be created with the specified index number and a message will display indicating that no IP address has been assigned. If not specified, facility, severity and port will be set to defaults configured with the set logging default command (“set logging default” on page 14‐5). If state is not specified, the server will not be enabled or disabled. Mode Switch command, read‐write. Specifies the server table index number for this server. Valid values are 1 ‐ (Optional) Specifies the Syslog message server’s IP address. (Optional) Specifies the server’s facility name. Valid values are: local0 to local7. (Optional) Specifies the severity level at which the server will log messages. Valid values and corresponding levels are: 1 — emergencies (system is unusable) 2 — alerts (immediate action required) 3 — critical conditions 4 — error conditions 5 — warning conditions 6 — notifications (significant conditions) 7 — informational messages 8 — debugging messages (Optional) Specifies a textual string description of this facility/server. (Optional) Specifies the default UDP port the client uses to send to the server. (Optional) Enables or disables this facility/server configuration. set logging server Enterasys D-Series CLI Reference 14-3...
Page 376: Clear Logging Server
D2(su)->set logging server 1 ip-addr 134.141.89.113 facility local4 severity 3 port 514 state enable clear logging server Use this command to remove a server from the Syslog server table. Syntax clear logging server index Parameters index Defaults None. Mode Switch command, read‐write. Example This command shows how to remove the Syslog server with index 1 from the server table: D2(su)->clear logging server 1 show logging default Use this command to display the Syslog server default values. Syntax show logging default Parameters None. Defaults None.
Page 377: Set Logging Default
None. Mode Switch command, read‐write. Example This example shows how to set the Syslog default facility name to local2 and the severity level to 4 (error logging): D2(su)->set logging default facility local2 severity 4 14‐32 on page 14‐2. Facility Severity local4 warning(5) Specifies the default facility name. Valid values are: local0 to local7. Specifies the default logging severity level. Valid values and corresponding levels are: 1 — emergencies (system is unusable) 2 — alerts (immediate action required) 3 — critical conditions 4 — error conditions 5 — warning conditions 6 — notifications (significant conditions) 7 — informational messages 8 — debugging messages Specifies the default UDP port the client uses to send to the server. set logging default Port Enterasys D-Series CLI Reference 14-5...
Page 378: Clear Logging Default
Use this command to reset logging default values. Syntax clear logging default {[facility] [severity] [port]} Parameters facility severity port Defaults At least one optional parameter must be entered. All three optional keywords must be entered to reset all logging values to defaults. Mode Switch command, read‐write. Example This example shows how to reset the Syslog default severity level to 6: D2(su)->clear logging default severity show logging application Use this command to display the severity level of Syslog messages for one or all applications configured for logging on your system. Syntax show logging application [mnemonic | all] Parameters mnemonic Defaults If no parameter is specified, information for all applications will be displayed.
Page 379: Set Logging Application
14‐6. Sample mnemonics and their corresponding applications are listed in Table Note: Mnemonic values are case sensitive and must be typed as they appear in Table 14-34. Sets the logging severity level for all applications. set logging application “set logging application” on page 14-7. 14‐34 on page 14‐8. Enterasys D-Series CLI Reference 14-7...
Page 380: Clear Logging Application
Mnemonic Values for Logging Applications Mnemonic CLIWEB SNMP Driver System Stacking Router Defaults If level is not specified, none will be applied. Mode Switch command, read‐write. Example This example shows how to set the severity level for SNMP to 4 so that error conditions will be logged for that application. D2(rw)->set logging application SNMP level 4 clear logging application Use this command to reset the logging severity level for one or all applications to the default value of 6 (notifications of significant conditions). Syntax clear logging application {mnemonic | all} 14-8 Logging and Network Management (Optional) Specifies the severity level at which the server will log ...
Page 381: Show Logging Local
D2(su)->show logging local Syslog Console Logging enabled Syslog File Logging disabled set logging local Use this command to configure log messages to the console and a persistent file. Syntax set logging local console {enable | disable} file {enable | disable} Resets the severity level for a specific application to 6. Valid mnemonic values and their corresponding applications are listed in Table page 14‐8. Resets the severity level for all applications to 6. show logging local 14‐34 on Enterasys D-Series CLI Reference 14-9...
Page 382: Clear Logging Local
Parameters console enable | disable file enable | disable Defaults None. Mode Switch command, read‐write. Example This command shows how to enable logging to the console and disable logging to a persistent file: D2(su)->set logging local console enable file disable clear logging local Use this command to clear the console and persistent store logging for the local session. Syntax clear logging local Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear local logging: D2(su)->clear logging local show logging buffer Use this command to display the last 256 messages logged. By default, critical failures and user ...
Page 383 Defaults None. Mode Switch command, read‐only. Example This example shows a portion of the information displayed with the show logging buffer command: D2(su)->show logging buffer <165>Sep 4 07:43:09 10.42.71.13 CLI[5]User:rw logged in from 10.2.1.122 (telnet) <165>Sep 4 07:43:24 10.42.71.13 CLI[5]User: debug failed login from 10.4.1.100 (telnet) show logging buffer Enterasys D-Series CLI Reference 14-11...
Page 384: Monitoring Network Events And Status
Monitoring Network Events and Status Monitoring Network Events and Status Purpose To display switch events and command history, to set the size of the history buffer, and to display and disconnect current user sessions. Commands For information about... history show history set history ping show users disconnect history Use this command to display the contents of the command history buffer. The command history buffer includes all the switch commands entered up to a maximum of 100, as specified in the set history command (“set history” on page 14‐13). Syntax history Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the contents of the command history buffer. It shows there are ...
Page 385: Show History
None. Mode Switch command, read‐only. Example This example shows how to display the size of the history buffer: D2(su)->show history History buffer size: 20 set history Use this command to set the size of the history buffer. Syntax set history size [default] Parameters size default Defaults None. Mode Switch command, read‐write. Example This example shows how to set the size of the command history buffer to 30 lines: D2(su)->set history 30 Specifies the size of the history buffer in lines. Valid values are 1 to 100. (Optional) Makes this setting persistent for all future sessions. show history Enterasys D-Series CLI Reference 14-13...
Page 386: Ping
Use this command to send ICMP echo‐request packets to another node on the network from the switch CLI. Syntax ping host Parameters host Defaults None. Mode Switch command, read‐write. Examples This example shows how to ping IP address 134.141.89.29. In this case, this host is alive: D2(su)->ping 134.141.89.29 134.141.89.29 is alive In this example, the host at IP address is not responding: D2(su)->ping 134.141.89.255 no answer from 134.141.89.255 show users Use this command to display information about the active console port or Telnet session(s) logged in to the switch. Syntax show users Parameters None. Defaults None. Mode Switch command, read‐only.
Page 387: Disconnect
-------- ----- -------------------------- * telnet telnet disconnect Use this command to close an active console port or Telnet session from the switch CLI. Syntax disconnect {ip-addr | console} Parameters ip‐addr console Defaults None. Mode Switch command, read‐write. Examples This example shows how to close a Telnet session to host 134.141.192.119: D2(su)->disconnect 134.141.192.119 This example shows how to close the current console session: D2(su)->disconnect console Location 134.141.192.119 134.141.192.18 Specifies the IP address of the Telnet session to be disconnected. This address is displayed in the output shown in “show users” on page 12‐15. Closes an active console port. disconnect Enterasys D-Series CLI Reference 14-15...
Page 388: Managing Switch Network Addresses And Routes
Managing Switch Network Addresses and Routes Managing Switch Network Addresses and Routes Purpose To display or delete switch ARP table entries, and to display MAC address information. Commands For information about... show arp set arp clear arp traceroute show mac show mac agetime set mac agetime clear mac agetime set mac algorithm show mac algorithm...
Page 389: Set Arp
Route status. Possible values and their definitions include: S - manually configured entry (static) P - respond to ARP requests for this entry Specifies the IP address to map to the MAC address and add to the ARP table. Specifies the MAC address to map to the IP address and add to the ARP table. The MAC address can be formatted as xx:xx:xx:xx:xx:xx or xx‐xx‐ xx‐xx‐xx‐xx. Interface host host host host host Enterasys D-Series CLI Reference 14-17 set arp...
Page 390: Clear Arp
Use this command to delete a specific entry or all entries from the switch’s ARP table. Syntax clear arp {ip-address | all} Parameters ip‐address | all Defaults None. Mode Switch command, read‐write. Example This example shows how to delete entry 10.1.10.10 from the ARP table: D2(su)->clear arp 10.1.10.10 traceroute Use this command to display a hop‐by‐hop path through an IP network from the device to a specific destination host. Three UDP or ICMP probes will be transmitted for each hop between the source and the traceroute destination. Syntax traceroute [-w waittime] [-f first-ttl] [-m max-ttl] [-p port] [-q nqueries] [-r] [-d] [-n] [-v] host Parameters ‐w waittime...
Page 391: Show Mac
(Optional) Displays verbose output, including the size and destination of each response. Specifies the host to which the route of an IP packet will be traced. 20.000 ms 40.000 ms 10.000 ms 50.000 ms (Optional) Displays a specific MAC address (if it is known by the device). (Optional) Displays MAC addresses for a specific filter database identifier. (Optional) Displays MAC addresses for specific port(s). (Optional) Displays information related to other, learned, self or mgmt (management) address type. show mac 20.000 ms 20.000 ms 20.000 ms 0.000 ms 20.000 ms Enterasys D-Series CLI Reference 14-19...
Page 392: Show Mac Agetime
Defaults If no parameters are specified, all MAC addresses for the device will be displayed. Mode Switch command, read‐only. Example This example shows how to display MAC address information for D2(su)->show mac port ge.3.1 MAC Address ----------------- ---- ------------- -------- 00-09-6B-0F-13-E6 15 MAC Address ----------------- ---- ------------- ------- ------- --------------------------- 01-01-23-34-45-56 20 Table 14‐36 provides an explanation of the command output. Table 14-36 show mac Output Details Output Field...
Page 393: Set Mac Agetime
Parameters time Defaults None. Mode Switch command, read‐only. Example This example shows how to set the MAC timeout period: D2(su)->set mac agetime 250 clear mac agetime Use this command to reset the timeout period for aging learned MAC entries to the default value of 300 seconds. Syntax clear mac agetime Parameters None. Defaults None. Specifies the timeout period in seconds for aging learned MAC addresses. Valid values are 10 to 1,000,000 seconds. Default value is 300 seconds. set mac agetime Enterasys D-Series CLI Reference 14-21...
Page 394: Set Mac Algorithm
Mode Switch command, read‐only. Example This example shows how to reset the MAC timeout period to the default value of 300 seconds. D2(su)->clear mac agetime set mac algorithm Use this command to set the MAC algorithm mode, which determines the has mechanism used by the device when performing Layer 2 lookups on received frames. Syntax set mac algorithm {mac-crc16-lowerbits | mac-crc16-upperbits | mac-crc32-lowerbits | mac-crc32-upperbits} Parameters mac‐crc16‐lowerbits mac‐crc16‐upperbits mac‐crc32‐lowerbits mac‐crc32‐upperbits Defaults The default MAC algorithm is mac‐crc16‐upperbits. Mode Switch command, read‐write. Usage Each algorithm is optimized for a different spread of MAC addresses. When changing this mode, the switch will display a warning message and prompt you to restart the device. The default MAC algorithm is mac‐crc16‐upperbits. Example This example sets the hashing algorithm to mac‐crc32‐upperbits.
Page 395: Clear Mac Algorithm
Syntax clear mac algorithm Parameters None. Defaults None. Mode Switch command, read‐write. Example This example resets the MAC hashing algorithm to the default value. D2(su)->clear mac algorithm set mac multicast Use this command to define on what ports within a VLAN a multicast address can be dynamically learned on, or on what ports a frame with the specified MAC address can be flooded. Also, use this command to append ports to or clear ports from the egress ports list. Syntax set mac multicast mac-address vlan-id [port-string] [{append | clear} port-string] clear mac algorithm Enterasys D-Series CLI Reference 14-23...
Page 396: Clear Mac Address
Parameters mac‐address vlan‐id port‐string append | clear Defaults If no port‐string is defined, the command will apply to all ports. Mode Switch command, read‐write. Example This example configures multicast MAC address 01‐01‐22‐33‐44‐55 for VLAN 24. D2(su)->set mac multicast 01-01-22-33-44-55 24 clear mac address Use this command to remove a multicast MAC address. Syntax clear mac address mac-address [vlan-id] Parameters mac‐address vlan‐id Defaults If no vlan‐id is specified, the multicast MAC address is cleared from all VLANs. Mode Switch command, read‐write. Example This example clears multicast MAC address 01‐01‐22‐33‐44‐55 from VLAN 24. D2(su)->clear mac multicast 01-01-22-33-44-55 24 14-24 Logging and Network Management Specifies the multicast MAC address. The MAC address can be ...
Page 397: Show Mac Unreserved-Flood
D2(su)->show mac unreserved-flood mac unreserved flood is disabled. set mac unreserved-flood Use this command to enable or disable multicast flood protection. When enabled, this prevents policy profiles requiring a full 10 masks from being loaded. Syntax set mac unreserved-flood {disable | enable} Parameters disable | enable Defaults None. Mode Switch command, read‐write. Usage The following addresses will be forwarded when this function is enabled: 01:80:C2:00:00:11 01:80:C2:00:00:14 01:80:C2:00:00:15 The default state is disabled, and these addresses will not be forwarded. Disables or enables multicast flood protection. show mac unreserved-flood Enterasys D-Series CLI Reference 14-25...
Page 398: Configuring Simple Network Time Protocol (Sntp)
Configuring Simple Network Time Protocol (SNTP) Example This example enables multicast flood protection. D2(su)->set mac unreserved-flood enable Configuring Simple Network Time Protocol (SNTP) Purpose To configure the Simple Network Time Protocol (SNTP), which synchronizes device clocks in a network. Note: A host IP address must be configured on the D2 to support SNTP. Commands For information about... show sntp set sntp client clear sntp client set sntp server...
Page 399: Show Sntp Output Details
Date and time of most recent SNTP request. Status Active Active (“set timezone” on page 14-32). (“set sntp client” on page 14-28). (“set sntp (“set sntp poll-retry” on page 14-31). show sntp poll-interval” on page 14-30). (“set sntp poll-timeout” on page 14-32). Enterasys D-Series CLI Reference 14-27...
Page 400: Set Sntp Client
Status set sntp client Use this command to set the SNTP operation mode. Syntax set sntp client {broadcast | unicast | disable} Parameters broadcast unicast disable Defaults None. Mode Switch command, read‐write. Example This example shows how to enable SNTP in broadcast mode: D2(su)->set sntp client broadcast clear sntp client Use this command to clear the SNTP client’s operational mode. Syntax clear sntp client Parameters None. Defaults None.
Page 401: Set Sntp Server
Defaults If precedence is not specified, 1 will be applied. Mode Switch command, read‐write. Example This example shows how to set the server at IP address 10.21.1.100 as an SNTP server: D2(su)->set sntp server 10.21.1.100 clear sntp server Use this command to remove one or all servers from the SNTP server list. Syntax clear sntp server {ip-address | all} Parameters ip‐address Defaults None. Specifies the SNTP server’s IP address. (Optional) Specifies this SNTP server’s precedence in relation to its peers. Valid values are 1 (highest) to 10 (lowest). Specifies the IP address of a server to remove from the SNTP server list. Removes all servers from the SNTP server list. set sntp server Enterasys D-Series CLI Reference 14-29...
Page 402: Set Sntp Poll-Interval
Mode Switch command, read‐write. Example This example shows how to remove the server at IP address 10.21.1.100 from the SNTP server list: D2(su)->clear sntp server 10.21.1.100 set sntp poll-interval Use this command to set the poll interval between SNTP unicast requests. Syntax set sntp poll-interval interval Parameters interval Defaults None. Mode Switch command, read‐write. Example This example shows how to set the SNTP poll interval to 30 seconds: D2(su)->set sntp poll-interval 30 clear sntp poll-interval Use this command to clear the poll interval between unicast SNTP requests. Syntax clear sntp poll-interval Parameters None.
Page 403: Set Sntp Poll-Retry
Parameters retry Defaults None. Mode Switch command, read‐write. Example This example shows how to set the number of SNTP poll retries to 5: D2(su)->set sntp poll-retry 5 clear sntp poll-retry Use this command to clear the number of poll retries to a unicast SNTP server. Syntax clear sntp poll-retry Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the number of SNTP poll retries: D2(su)->clear sntp poll-retry Specifies the number of retries. Valid values are 0 to 10. set sntp poll-retry Enterasys D-Series CLI Reference 14-31...
Page 404: Set Sntp Poll-Timeout
Use this command to set the poll timeout (in seconds) for a response to a unicast SNTP request. Syntax set sntp poll-timeout timeout Parameters timeout Defaults None. Mode Switch command, read‐write. Example This example shows how to set the SNTP poll timeout to 10 seconds: D2(su)->set sntp poll-timeout 10 clear sntp poll-timeout Use this command to clear the SNTP poll timeout. Syntax clear sntp poll-timeout Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the SNTP poll timeout: D2(su)->clear sntp poll-timeout...
Page 405 Poll Timeout: 5 seconds SNTP Poll Requests: 2681 Last SNTP Update: WED JUL 16 16:35:23 2008 Last SNTP Request: WED JUL 16 16:35:23 2008 Last SNTP Status: Success SNTP-Server Precedence ------------------------------------------- 192.255.255.254 Status Active set timezone Enterasys D-Series CLI Reference 14-33...
Page 406: Configuring Node Aliases
For information about... show nodealias config set nodealias clear nodealias config show nodealias config Use this command to display node alias configuration settings on one or more ports. Syntax show nodealias config [port-string] Parameters port‐string Defaults If port‐string is not specified, node alias configurations will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display node alias configuration settings for ports fe.2.1 through 9: D2(rw)->show nodealias config Port Number ----------- .2.1 .2.2 .2.3 .2.4 .2.5 .2.6 .2.7 .2.8...
Page 407: Set Nodealias
Number of alias entries (out of the maximum amount configured) already used by this port. Whether or not a node alias agent is enabled (default) or disabled on this port. Enables or disables a node alias agent. Set the maximum number of alias entries per ports. Valid range is 0 to 4096. The default value is 32. Specifies the port(s) on which to enable/disable node alias agent or set a maximum number of entries. .1.3 set nodealias Enterasys D-Series CLI Reference 14-35...
Page 408 Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the node alias configuration on fe.1.3 D2(su)->clear nodealias config 14-36 Logging and Network Management Specifies the port(s) on which to reset the node alias configuration. .1.3...
Page 409: Chapter 15: Rmon Configuration
“set rmon packets, CRC errors, page 15-4 oversized and undersized “clear rmon packets, fragments, jabbers, page 15-4 and counters for packets. Enterasys D-Series CLI Reference 15-1 Refer to page... 15-1 15-3 15-6 15-9 15-13 15-17 15-22 ...
Page 410 RMON Monitoring Group Functions Table 15-39 RMON Monitoring Group Functions and Commands (Continued) RMON Group What It Does... History Records periodic statistical samples from a network. Alarm Periodically gathers statistical samples from variables in the probe and compares them with previously configured thresholds.
Page 411: Statistics Group Commands
D2(su)->show rmon stats ge.1.1 Port: ge.1.1 ------------------------------------- Index Owner Data Source Drop Events Collisions Jabbers Broadcast Pkts (Optional) Displays RMON statistics for specific port(s). = monitor = ifIndex.1 Packets Octets 64 Octets 127 Octets Statistics Group Commands Refer to page... 15-3 15-4 15-4 Enterasys D-Series CLI Reference 15-3...
Page 412: Set Rmon Stats
Use this command to configure an RMON statistics entry. Syntax set rmon stats index port-string [owner] Parameters index port‐string owner Defaults If owner is not specified, monitor will be applied. Mode Switch command, read‐write. Example This example shows how to configure RMON statistics entry 2 for D2(rw)->set rmon stats 2 ge.1.20 clear rmon stats Use this command to delete one or more RMON statistics entries. Syntax clear rmon stats {index-list | to-defaults} Parameters index‐list to‐defaults Defaults None.
Page 413 Mode Switch command, read‐write. Example This example shows how to delete RMON statistics entry 2: D2(rw)->clear rmon stats 2 clear rmon stats Enterasys D-Series CLI Reference 15-5...
Page 414: Show Rmon History
Use this command to display RMON history properties and statistics. The RMON history group records periodic statistical samples from a network. Syntax show rmon history [port-string] Parameters port‐string Defaults If port‐string is not specified, information about all RMON history entries will be displayed. Mode Switch command, read‐only. Example This example shows how to display RMON history entries for Gigabit Ethernet port 1 in switch 1. A control entry displays first, followed by actual entries corresponding to the control entry. In this case, the default settings for entry owner, sampling interval, and maximum number of entries. (buckets) have not been changed from their default values. For a description of the types of statistics shown, refer to Table D2(su)->show rmon history ge.1.1 Port: ge.1.1 ------------------------------------- Index 1 Owner Status...
Page 415: Set Rmon History
{index-list | to-defaults} Interval Start: 1 days 0 hours 2 minutes 22 seconds Undersize Pkts Oversize Pkts Fragments Jabbers Collisions Utilization(%) Specifies an index number for this entry. (Optional) Assigns this entry to a specific port. (Optional) Specifies the maximum number of entries to maintain. (Optional) Specifies the sampling interval in seconds. (Optional) Specifies an owner for this entry. .2.1 interval 20 set rmon history Enterasys D-Series CLI Reference 15-7...
Page 416 Parameters index‐list to‐defaults Defaults None. Mode Switch command, read‐write. Example This example shows how to delete RMON history entry 1: D2(rw)->clear rmon history 1 15-8 RMON Configuration Specifies one or more history entries to be deleted, causing them to disappear from any future RMON queries. Resets all history entries to default values. This will cause entries to reappear in RMON queries.
Page 417: Show Rmon Alarm
Table 15‐40 provides an explanation of the command output. (Optional) Displays RMON alarm entries for a specific entry index ID. = Manager = valid = 1.3.6.1.4.1.5624.1.2.29.1.2.1.0 = delta Startup Alarm = 30 Value Falling Threshold Falling Event Index = 0 Alarm Group Commands Refer to page... 15-9 15-10 15-11 15-12 = rising Enterasys D-Series CLI Reference 15-9...
Page 418: Set Rmon Alarm Properties
set rmon alarm properties Table 15-40 show rmon alarm Output Details Output Field Index Owner Status Variable Sample Type Startup Alarm Interval Rising Threshold Falling Threshold Rising Event Index Falling Event Index set rmon alarm properties Use this command to configure an RMON alarm entry, or to create a new alarm entry with an unused alarm index number. Syntax set rmon alarm properties index [interval interval] [object object] [type {absolute | delta}] [startup {rising | falling | either}] [rthresh rthresh] [fthresh fthresh] [revent revent] [fevent fevent] [owner owner] Parameters...
Page 419: Set Rmon Alarm Status
Use this command to enable an RMON alarm entry. An alarm is a notification that a statistical sample of a monitored variable has crossed a configured threshold. Syntax set rmon alarm status index enable (Optional) Specifies the type of alarm generated when this event is first enabled as: • Rising ‐ Sends alarm when an RMON event reaches a maximum threshold condition is reached, for example, more than 30 collisions per second. • Falling ‐ Sends alarm when RMON event falls below a minimum threshold condition, for example when the network is behaving normally again. • Either ‐ Sends alarm when either a rising or falling threshold is reached. (Optional) Specifies a minimum threshold for causing a rising alarm. Specifies a maximum threshold for causing a falling alarm. Specifies the index number of the RMON event to be triggered when the rising threshold is crossed. Specifies the index number of the RMON event to be triggered when the falling threshold is crossed. (Optional) Specifies the name of the entity that configured this alarm entry. set rmon alarm status Enterasys D-Series CLI Reference 15-11...
Page 420: Clear Rmon Alarm
Parameters index enable Defaults None. Mode Switch command, read‐write. Usage An RMON alarm entry can be created using this command, configured using the set rmon alarm properties command (“set rmon alarm properties” on page 15‐10), then enabled using this command. An RMON alarm entry can be created and configured at the same time by specifying an unused index with the set rmon alarm properties command. Example This example shows how to enable RMON alarm entry 3: D2(rw)->set rmon alarm status 3 enable clear rmon alarm Use this command to delete an RMON alarm entry. Syntax clear rmon alarm index Parameters index Defaults None. Mode Switch command, read‐write. Example This example shows how to clear RMON alarm entry 1:...
Page 421: Event Group Commands
Last Time Sent = 0 days 0 hours 0 minutes 37 seconds Table 15‐41 provides an explanation of the command output. (Optional) Displays RMON properties and log entries for a specific entry index ID. = Manager = valid = STP Topology change = log-and-trap = public Event Group Commands Refer to page... 15-13 15-14 15-15 15-15 Enterasys D-Series CLI Reference 15-13...
Page 422: Set Rmon Event Properties
Defaults If description is not specified, none will be applied. If not specified, type none will be applied. If owner is not specified, monitor will be applied. Mode Switch command, read‐write. 15-14 RMON Configuration What It Displays... Index number for this event entry. Text string identifying who configured this entry. Whether this event entry is enabled (valid) or disabled. Text string description of this event.
Page 423: Set Rmon Event Status
Mode Switch command, read‐write. Usage An RMON event entry can be created using this command, configured using the set rmon event properties command (“set rmon event properties” on page 15‐14), then enabled using this command. An RMON event entry can be created and configured at the same time by specifying an unused index with the set rmon event properties command. Example This example shows how to enable RMON event entry 1: D2(rw)->set rmon event status 1 enable clear rmon event Use this command to delete an RMON event entry and any associated log entries. Syntax clear rmon event index Parameters index Specifies an index number for this entry. Maximum number of entries is 100. Maximum value is 65535. Enables this event entry. Specifies the index number of the entry to be cleared. set rmon event status Enterasys D-Series CLI Reference 15-15...
Page 424 Defaults None. Mode Switch command, read‐write. Example This example shows how to clear RMON event 1: D2(rw)->clear rmon event 1 15-16 RMON Configuration...
Page 425: Filter Group Commands
Use this command to display RMON channel entries for one or more ports. Syntax show rmon channel [port-string] Parameters port‐string Defaults If port‐string is not specified, information about all channels will be displayed. Mode Switch command, read‐only. (Optional) Displays RMON channel entries for a specific port(s). Filter Group Commands Refer to page... 15-17 15-18 15-19 15-19 15-20 15-21 Enterasys D-Series CLI Reference 15-17...
Page 426: Set Rmon Channel
Defaults If an action is not specified, packets will be accepted on filter matches. If not specified, control will be set to off. If a description is not specified, none will be applied. If owner is not specified, it will be set to monitor. Mode Switch command, read‐write. 15-18 RMON Configuration .2.12 Channel index= 628 EntryStatus= valid AcceptType OffEventIndex Status 4498 Thu Dec 16 12:57:32 EST 2004 NetSight smith Specifies an index number for this entry. An entry will automatically be created if an unused index number is chosen. Maximum number of entries is 2. Maximum value is 65535. Specifies the port on which traffic will be monitored.
Page 427: Clear Rmon Channel
D2(rw)->clear rmon channel 2 show rmon filter Use this command to display one or more RMON filter entries. Syntax show rmon filter [index index | channel channel] Parameters index index | channel channel Defaults If no options are specified, information for all filter entries will be displayed. Mode Switch command, read‐only. Example This example shows how to display all RMON filter entries and channel information: .2.12 accept failed control on description Specifies the channel entry to be cleared. (Optional) Displays information about a specific filter entry, or about all filters which belong to a specific channel. clear rmon channel Enterasys D-Series CLI Reference 15-19...
Page 428: Set Rmon Filter
set rmon filter D2(rw)->show rmon filter Index= 55508 ---------------------------------------------------------- Data Offset PktStatusMask Owner ----------------------------- Data ff ff ff ff ff ff ----------------------------- DataMask ff ff ff ff ff ff ----------------------------- DataNotMask 00 00 00 00 00 00 set rmon filter Use this command to configure an RMON filter entry.
Page 429: Clear Rmon Filter
D2(rw)->set rmon filter 1 9 offset 30 data 0a154305 dmask ffffffff clear rmon filter Use this command to clear an RMON filter entry. Syntax clear rmon filter {index index | channel channel} Parameters index index | channel channel Defaults None. Mode Switch command, read‐write. Example This example shows how to clear RMON filter entry 1: D2(rw)->clear rmon filter index 1 Clears a specific filter entry, or all entries belonging to a specific channel. clear rmon filter Enterasys D-Series CLI Reference 15-21...
Page 430: Packet Capture Commands
Use this command to display RMON capture entries and associated buffer control entries. Syntax show rmon capture [index [nodata]] Parameters index nodata Defaults If no options are specified, all buffer control entries and associated captured packets will be displayed. Mode Switch command, read‐only. Example This example shows how to display RMON capture entries and associated buffer entries: D2(rw)->show rmon capture Buf.control= 28062 ---------------------------------------------------------- FullStatus Captured packets Download size Max Octet Requested 50000 Start time 15-22 RMON Configuration (Optional) Displays the specified buffer control entry and all captured ...
Page 431: Set Rmon Capture
If slice is not specified, 1518 will be applied. If loadsize is not specified, 100 will be applied. If owner is not specified, it will be set to monitor. monitor Buff.control= 28062 Pkt time 1 days 0 hours 51 minutes 15 seconds Pkt status Specifies a buffer control entry. Specifies the channel to which this capture entry will be applied. (Optional) Specifies the action of the buffer when it is full as: • lock ‐ Packets will cease to be accepted (Optional) Specifies the maximum octets from each packet to be saved in a buffer. Currently, the only value allowed is 1518. (Optional) Specifies the maximum octets from each packet to be downloaded from the buffer. The default is 100. (Optional) Specifies the first octet from each packet that will be retrieved. (Optional) Specifies the requested maximum octets to be saved in this buffer. Currently, the only value accepted is ‐1, which requests as many octets as possible. (Optional) Specifies the name of the entity that configured this entry. set rmon capture Enterasys D-Series CLI Reference 15-23...
Page 432: Clear Rmon Capture
Mode Switch command, read‐write. Example This example shows how to create RMON capture entry 1 to “listen” on channel 628: D2(rw)->set rmon capture 1 628 clear rmon capture Use this command to clears an RMON capture entry. Syntax clear rmon capture index Parameters index Defaults None. Mode Switch command, read‐write. Example This example shows how to clear RMON capture entry 1: D2(rw)->clear rmon capture 1 15-24 RMON Configuration Specifies the capture entry to be cleared.
Page 433: Chapter 16: Dhcp Server Configuration
DHCP Server DHCP server functionality allows the D‐Series switch to provide basic IP configuration information to a client on the network who requests such information using the DHCP protocol. DHCP provides the following mechanisms for IP address allocation by a DHCP server: • Automatic—DHCP server assigns an IP address to a client for a limited period of time (or until the client explicitly relinquishes the address) from a defined pool of IP addresses configured on the server. • Manual—A client’s IP address is assigned by the network administrator, and DHCP is used simply to convey the assigned address to the client. This is managed by means of “static” address pools configured on the server. The amount of time that a particular IP address is valid for a system is called a lease. The D‐Series maintains a lease database which contains information about each assigned IP address, the MAC address to which it is assigned, the lease expiration, and whether the address assignment is dynamic (automatic) or static (manual). The DHCP lease database is stored in flash memory. In addition to assigning IP addresses, the DHCP server can also be configured to assign the following to requesting clients: • Default router(s) • DNS server(s) and domain name • NetBIOS WINS server(s) and node name DHCP Server Configuration Enterasys D-Series CLI Reference 16-1 Refer to page... 16-1 16-3 16-11...
Page 434: Configuring A Dhcp Server
DHCP Overview • Boot file • DHCP options as defined by RFC 2132 Note: A total of 16 address pools, dynamic and/or static, can be configured on the D-Series Configuring a DHCP Server For DHCP to function on D‐Series systems, the system has to “know about” the IP network for which the DHCP pool is to be created. This is done by associating the DHCP address pool with the switch’s host port IP address. The following tasks provide basic DHCP server functionality when the DHCP pool is associated with the system’s host IP address. Configure the system host port IP address with the set ip address command. Once the system’s IP address is configured, the system then “knows” about the configured subnet. For example: set ip address 192.0.0.50 mask 255.255.255.0 Enable DHCP server functionality on the system with the set dhcp enable command.
Page 435: Configuring General Dhcp Server Parameters
Syntax set dhcp {enable | disable} Parameters enable | disable Defaults None. Mode Switch command, read‐write. Enables or disables DHCP server functionality. By default, DHCP server is disabled. Configuring General DHCP Server Parameters Refer to page... 16-3 16-4 16-4 16-5 16-5 16-6 16-7 16-7 16-8 16-8 16-9 16-9 16-10 Enterasys D-Series CLI Reference 16-3...
Page 436: Set Dhcp Bootp
D2(rw)->set dhcp enable set dhcp bootp Use this command to enable or disable automatic address allocation for BOOTP clients. By default, address allocation for BOOTP clients is disabled. Refer to RFC 1534, “Interoperation Between DHCP and BOOTP,” for more information. Syntax set dhcp bootp {enable | disable} Parameters enable | disable Defaults None. Mode Switch command, read‐write. Example This example enables address allocation for BOOTP clients. D2(rw)->set dhcp bootp enable set dhcp conflict logging Use this command to enable conflict logging. By default, conflict logging is enabled. Use the clear dhcp conflict logging command to disable conflict logging. Syntax set dhcp conflict logging Parameters None. Defaults None.
Page 437: Show Dhcp Conflict
{logging | ip-address| *} Parameters logging ip‐address [Optional] Specifies the address for which to display conflict information. Detection Method Detection Time ----------------- --------------- Ping 0 days 19h:01m:23s Ping 0 days 19h:00m:46s Ping 0 days 19h:01m:25s Ping 0 days 19h:01m:26s Disables conflict logging. Clears the conflict information for the specified IP address. Clears the conflict information for all IP addresses. show dhcp conflict Enterasys D-Series CLI Reference 16-5...
Page 438: Set Dhcp Exclude
Defaults None. Mode Switch command, read‐write. Examples This example disables DHCP conflict logging. D2(rw)->clear dhcp conflict logging This example clears the conflict information for the IP address 192.0.0.2. D2(rw)->clear dhcp conflict 192.0.0.2 set dhcp exclude Use this command to configure the IP addresses that the DHCP server should not assign to DHCP clients. Multiple address ranges can be configured but the ranges cannot overlap. Up to 128 non‐ overlapping address ranges can be excluded. Syntax set dhcp exclude low-ipaddr [high-ipaddr] Parameters low‐ipaddr high‐ipaddr Defaults None. Mode Switch command, read‐write. Example This example first configures the address pool named “auto1” with 255 addresses for the Class C network 172,20.28.0, with the set dhcp pool network command. Then, the example limits the ...
Page 439: Clear Dhcp Exclude
D2(rw)->clear dhcp exclude 192.168.1.88 192.168.1.100 set dhcp ping Use this command to configure the number of ping packets the DHCP server sends to an IP address before assigning the address to a requesting client. Syntax set dhcp ping packets number Parameters packets number Defaults None. Mode Switch command, read‐write. Example This example sets the number of ping packets sent to 3. D2(rw)->set dhcp ping packets 3 Specifies the first IP address in the address range to be cleared. (Optional) Specifies the last IP address in the address range to be cleared. Specifies the number of ping packets to be sent. The value of number can be 0, or range from 2 to 10. Entering 0 disables this function. The default value is 2 packets. clear dhcp exclude Enterasys D-Series CLI Reference 16-7...
Page 440: Clear Dhcp Ping
Use this command to reset the number of ping packets sent by the DHCP server back to the default value of 2. Syntax clear dhcp ping packets Parameters None. Defaults None. Mode Switch command, read‐write. Example This example resets the number of ping packets sent back to the default value. D2(rw)->clear dhcp ping packets show dhcp binding Use this command to display binding information for one or all IP addresses. Syntax show dhcp binding [ip-address] Parameters ip‐address Defaults If no IP address is specified, binding information for all addresses is displayed. Mode Read‐only.
Page 441: Clear Dhcp Binding
Use this command to display DHCP server statistics. Syntax show dhcp server statistics Parameters None. Defaults None. Mode Read‐only. Example This example displays server statistics. D2(ro)->show dhcp server statistics Automatic Bindings Expired Bindings Malformed Bindings 00:33:44:56:22:37 infinite 00:33:44:56:22:38 infinite Specifies the IP address for which to clear/delete the DHCP binding. Deletes all address bindings. clear dhcp binding Manual Manual Enterasys D-Series CLI Reference 16-9...
Page 442: Clear Dhcp Server Statistics
DHCP INFORM Messages ---------- DHCP OFFER DHCP ACK DHCP NACK clear dhcp server statistics Use this command to clear all DHCP server counters. Syntax clear dhcp server statistics Parameters None. Defaults None. Mode Switch command, read‐write. Example This example clears all DHCP server counters. D2(rw)->clear dhcp server statistics 16-10 DHCP Server Configuration Received ---------- 3855 Sent ------...
Page 443: Configuring Ip Address Pools
A hardware address and type (Ethernet or IEEE 802) configured in a manual pool is checked only when a client‐identifier is not also configured for the pool and the incoming DHCP request packet does not include a client‐identifier option. Purpose To configure and clear DHCP address pool parameters, and to display address pool configuration information. Note: A total of 16 address pools, dynamic and/or static, can be configured on the D-Series Commands For information about... set dhcp pool clear dhcp pool set dhcp pool network clear dhcp pool network...
Page 444: Set Dhcp Pool
Use this command to create and assign a name to a DHCP server pool of addresses. Up to 16 address pools may be configured on a D‐Series. Note that entering this command is not required to create an address pool before configuring other address pool parameters. Syntax set dhcp pool poolname Parameters poolname Defaults None. Mode Switch command, read‐write. Example This example creates an address pool named “auto1.” D2(rw)->set dhcp pool auto1 16-12 DHCP Server Configuration Specifies the name of the address pool. Pool names may be up to 31 characters in length. Refer to page... 16-20 16-20 16-21 16-21...
Page 445: Clear Dhcp Pool
Use this command to configure the subnet number and mask for an automatic DHCP address pool. Syntax set dhcp pool poolname network number {mask | prefix-length} Parameters poolname number mask prefix‐length Defaults None. Mode Switch command, read‐write. Usage Use this command to configure a set of IP addresses to be assigned by the DHCP server using the specified address pool. In order to limit the scope of the addresses configured with this command, use the set dhcp exclude command on page 16‐6. Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies an IP subnet for the address pool. Specifies the subnet mask in dotted quad notation. Specifies the subnet mask as an integer. clear dhcp pool Enterasys D-Series CLI Reference 16-13...
Page 446: Clear Dhcp Pool Network
D2(rw)->set dhcp exclude 172.20.28.80 172.20.28.100 clear dhcp pool network Use this command to remove the network number and mask of a DHCP server pool of addresses. Syntax clear dhcp pool poolname network Parameters poolname Defaults None. Mode Switch command, read‐write. Example This example deletes the network and mask from the address pool named “auto1.” D2(rw)->clear dhcp pool auto1 network set dhcp pool hardware-address Use this command to configure the MAC address of the DHCP client and create an address pool for manual binding. You can use either this command or the set dhcp pool client‐identifier command to create a manual binding pool, but using both is not recommended. Syntax set dhcp pool poolname hardware-address hw-addr [type]...
Page 447: Clear Dhcp Pool Hardware-Address
Switch command, read‐write. Example This example deletes the client hardware address from the address pool named “manual1.” D2(rw)->clear dhcp pool manual1 hardware-address set dhcp pool host Use this command to configure an IP address and network mask for a manual DHCP binding. Syntax set dhcp pool poolname host ip-address [mask | prefix-length] Parameters poolname ip‐address Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the IP address for manual binding. clear dhcp pool hardware-address Enterasys D-Series CLI Reference 16-15...
Page 448: Clear Dhcp Pool Host
Defaults If a mask or prefix is not specified, the class A, B, or C natural mask will be used. Mode Switch command, read‐write. Example This example shows how to configure the minimum requirements for a manual binding address pool. First, the hardware address of the client’s hardware platform is configured, followed by configuration of the address to be assigned to that client manually. D2(rw)->set dhcp pool manual1 hardware-address 0001.f401.2710 D2(rw)->set dhcp pool manual1 host 15.12.1.99 255.255.248.0 clear dhcp pool host Use this command to remove the host IP address from a manual binding address pool. Syntax clear dhcp pool poolname host Parameters poolname Defaults None.
Page 449: Clear Dhcp Pool Client-Identifier
Use this command to remove the unique identifier of a DHCP client from a manual binding address pool. Syntax clear dhcp pool poolname client-identifier Parameters poolname Defaults None. Mode Switch command, read‐write. Example This example deletes the client identifier from the address pool named “manual1.” D2(rw)->clear dhcp pool manual1 client-identifier Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the unique client identifier for this client. The value must be entered in xx:xx:xx:xx:xx:xx format. Specifies the name of the address pool. Pool names may be up to 31 characters in length. clear dhcp pool client-identifier Enterasys D-Series CLI Reference 16-17...
Page 450: Set Dhcp Pool Client-Name
Syntax set dhcp pool poolname client-name name Parameters poolname name Defaults None. Mode Switch command, read‐write. Example This example configures the client name “appsvr1” to the manual binding pool “manual2.” D2(rw)->set dhcp pool manual2 client-identifier 01:22:33:44:55:66 D2(rw)->set dhcp pool manual2 host 10.12.1.10 255.255.255.0 D2(rw)->set dhcp pool manual2 client-name appsvr1 clear dhcp pool client-name Use this command to delete a DHCP client name from an address pool for manual binding.
Page 451: Set Dhcp Pool Bootfile
D2(rw)->set dhcp pool auto1 bootfile image1.img clear dhcp pool bootfile Use this command to remove a default boot image from the address pool being configured. Syntax clear dhcp pool poolname bootfile Parameters poolname Defaults None. Mode Switch command, read‐write. Example This example removes the boot image filename from address pool named “auto1.” D2(rw)->clear dhcp pool auto1 bootfile Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the boot image file name. Specifies the name of the address pool. Pool names may be up to 31 characters in length. set dhcp pool bootfile Enterasys D-Series CLI Reference 16-19...
Page 452: Set Dhcp Pool Next-Server
Syntax set dhcp pool poolname next-server ip-address Parameters poolname ip‐address Defaults None. Mode Switch command, read‐write. Example This example specifies the file server from which clients being served by address pool “auto1” should download the boot image file “image1.img.” D2(rw)->set dhcp pool auto1 bootfile image1.img D2(rw)->set dhcp pool auto1 next-server 10.1.1.10 clear dhcp pool next-server Use this command to remove the boot image file server from the address pool being configured. Syntax clear dhcp pool poolname next-server...
Page 453: Set Dhcp Pool Lease
D2(rw)->set dhcp pool auto1 lease 0 12 clear dhcp pool lease Use this command to restore the default lease time value of one day for the address pool being configured. Syntax clear dhcp pool poolname lease Parameters poolname Defaults Clears the lease time for this address pool to the default value of one day. Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the number of days an address lease will remain valid. Value can range from 0 to 59. (Optional) When a days value has been assigned, specifies the number of hours an address lease will remain valid. Value can range from 0 to 1439. (Optional) When a days value and an hours value have been assigned, specifies the number of minute an address lease will remain valid. Value can range from 0 to 86399. Specifies that the duration of the lease will be unlimited. Specifies the name of the address pool. Pool names may be up to 31 characters in length. set dhcp pool lease Enterasys D-Series CLI Reference 16-21...
Page 454: Set Dhcp Pool Default-Router
Mode Switch command, read‐write. Example This example restores the default lease duration of one day for address pool “auto1.” D2(rw)->clear dhcp pool auto1 lease set dhcp pool default-router Use this command to specify a default router list for the DHCP clients served by the address pool being configured. Up to 8 default routers can be configured. Syntax set dhcp pool poolname default-router address [address2 ... address8] Parameters poolname address address2 ... address8 Defaults None. Mode Switch command, read‐write. Example This example assigns a default router at 10.10.10.1 to the address pool named “auto1.” D2(rw)->set dhcp pool auto1 default-router 10.10.10.1 clear dhcp pool default-router Use this command to delete the default routers configured for this address pool.
Page 455: Set Dhcp Pool Dns-Server
Switch command, read‐write. Example This example assigns a DNS server at 10.14.10.1 to the address pool “‘auto1.” D2(rw)->set dhcp pool auto1 dns-server 10.14.10.1 clear dhcp pool dns-server Use this command to remove the DNS server list from the address pool being configured. Syntax clear dhcp pool poolname dns-server Parameters poolname Defaults None. Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the IP address of a DNS server. (Optional) Specifies, in order of preference, up to 7 additional DNS server addresses. Specifies the name of the address pool. Pool names may be up to 31 characters in length. set dhcp pool dns-server Enterasys D-Series CLI Reference 16-23...
Page 456: Set Dhcp Pool Domain-Name
Mode Switch command, read‐write. Example This example removes the DNS server list from the address pool “auto1.” D2(rw)->clear dhcp pool auto1 dns-server set dhcp pool domain-name Use this command to specify a domain name to be assigned to DHCP clients served by the address pool being configured. Syntax set dhcp pool poolname domain-name domain Parameters poolname domain Defaults None. Mode Switch command, read‐write. Example This example assigns the “mycompany.com” domain name to the address pool “auto1.” D2(rw)->set dhcp pool auto1 domain-name mycompany.com clear dhcp pool domain-name Use this command to remove the domain name from the address pool being configured.
Page 457: Set Dhcp Pool Netbios-Name-Server
Switch command, read‐write. Example This example assigns a NetBIOS name server at 10.15.10.1 to the address pool being configured. D2(rw)->set dhcp pool auto1 netbios-name-server 10.15.10.1 clear dhcp pool netbios-name-server Use this command to remove the NetBIOS namer server list from the address pool being configured. clear dhcp pool poolname netbios-name-server Parameters poolname Defaults None. Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the IP address of a NetBIOS name server. (Optional) Specifies, in order of preference, up to 7 additional NetBIOS name server addresses. Specifies the name of the address pool. Pool names may be up to 31 characters in length. set dhcp pool netbios-name-server Enterasys D-Series CLI Reference 16-25...
Page 458: Set Dhcp Pool Netbios-Node-Type
Mode Switch command, read‐write. Example This example removes the NetBIOS name server list from the address pool auto1. D2(rw)->clear dhcp pool auto1 netbios-name-server set dhcp pool netbios-node-type Use this command to specify a NetBIOS node (server) type for the DHCP clients served by the address pool being configured. Syntax set dhcp pool poolname netbios-node-type {b-node | h-node | p-node | m-node} Parameters poolname b‐node h‐node p‐node m‐node Defaults None.
Page 459: Set Dhcp Pool Option
Switch command, read‐write. Examples This example configures DHCP option 19, which specifies whether the client should configure its IP layer for packet forwarding. In this case, IP forwarding is enabled with the 01 value. D2(rw)->set dhcp pool auto1 option 19 hex 01 This example configures DHCP option 72, which assigns one or more Web servers for DHCP clients. In this case, two Web server addresses are configured. D2(rw)->set dhcp pool auto1 option 72 ip 168.24.3.252 168.24.3.253 Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the DHCP option code, as defined in RFC 2132. Value can range from 1 to 254. Specifies the data in ASCII format. An ASCII character string containing a space must be enclosed in quotations. Specifies the data in HEX format. Up to 8 HEX strings can be entered. Specifies the data in IP address format. Up to 8 IP addresses can be entered. set dhcp pool option Enterasys D-Series CLI Reference 16-27...
Page 460: Clear Dhcp Pool Option
Use this command to remove a DHCP option from the address pool being configured. Syntax clear dhcp pool poolname option code Parameters poolname code Defaults None. Mode Switch command, read‐write. Example This example removes option 19 from address pool “auto1.” D2(rw)->clear dhcp pool auto1 option 19 show dhcp pool configuration Use this command to display configuration information for one or all address pools. Syntax show dhcp pool configuration {poolname | all} Parameters poolname Defaults None.
Page 461 Hardware Address Hardware Address Type Host Lease Time show dhcp pool configuration 192.0.0.0 255.255.255.0 1 days 0 hrs 0 mins 192.0.0.1 Manual appsvr1 01:00:01:f4:01:27:10 10.1.1.1 255.0.0.0 infinite 19 hex 01 Manual 00:01:f4:01:27:10 ieee802 192.168.10.1 255.255.255.0 infinite Enterasys D-Series CLI Reference 16-29...
Page 462 show dhcp pool configuration 16-30 DHCP Server Configuration...
Page 463: Chapter 17: Security Configuration
• Host Access Control Authentication (HACA) – authenticates user access of Telnet management, console local management and WebView via a central RADIUS Client/Server application. When RADIUS is enabled, this essentially overrides login user accounts. When HACA is active per a valid RADIUS configuration, the user names and passwords used to access the switch via Telnet, SSH, WebView, and COM ports will be validated against the configured RADIUS server. Only in the case of a RADIUS timeout will those credentials be compared against credentials locally configured on the switch. “Configuring RADIUS” on page 17‐3. • SNMP user or community names – allows access to the D‐Series switch via a network SNMP management application. To access the switch, you must enter an SNMP user or community name string. The level of management access is dependent on the associated access policy. For details, refer to Chapter • 802.1X Port Based Network Access Control using EAPOL (Extensible Authentication Protocol) – provides a mechanism via a RADIUS server for administrators to securely authenticate and grant appropriate access to end user devices communicating with D‐Series ports. For details Security Configuration Refer to page... 17-1 17-3 17-11 17-21 17-33 17-45 17-51 17-62 17-74 For details, refer to Enterasys D-Series CLI Reference 17-1...
Page 464: Radius Filter-Id Attribute And Dynamic Policy Profile Assignment
Overview of Security Methods on using CLI commands to configure 802.1X, refer to “Configuring 802.1X Authentication” on page 17‐11. Note: To configure EAP pass-through, which allows client authentication packets to be forwarded through the switch to an upstream device, 802.1X authentication must be globally disabled with the set dot1x command. • MAC Authentication – provides a mechanism for administrators to securely authenticate ...
Page 465: Configuring Radius
• Review the RADIUS client/server configuration on the switch. • Enable or disable the RADIUS client. • Set local and remote login options. • Set primary and secondary server parameters, including IP address, timeout period, authentication realm, and number of user login attempts allowed. • Reset RADIUS server settings to default values. • Configure a RADIUS accounting server. Commands For information about... show radius set radius clear radius show radius accounting Configuring RADIUS Refer to page... 17-4 17-5 17-7 17-7 Enterasys D-Series CLI Reference 17-3...
Page 466: Show Radius
Syntax show radius [status | retries | timeout | server [index | all]] Parameters status retries timeout server index | all Defaults If no parameters are specified, all RADIUS configuration information will be displayed. Mode Switch command, read‐only. Example This example shows how to display RADIUS configuration information: D2(rw)->show radius RADIUS status: RADIUS retries: RADIUS timeout: RADIUS Server -------------- Table 17‐42 provides an explanation of the command output. Table 17-42 show radius Output Details...
Page 467: Set Radius
RADIUS server’s index number, IP address, and UDP authentication port. Realm defines who has to go through the RADIUS server for authentication. • Management-access: This means that anyone trying to access the switch (Telnet, SSH, Local Management) has to authenticate through the RADIUS server.
Page 468 Note: If the management-access or any access realm has been configured, the local “admin” account is disabled for access to the switch using the console, Telnet, or Local Management. Only the network-access realm allows access to the local “admin” account.
Page 469: Clear Radius
D2(su)->clear radius server all This example shows how to reset the RADIUS timeout to the default value of 20 seconds: D2(su)->clear radius timeout show radius accounting Use this command to display the RADIUS accounting configuration. This transmits accounting information between a network access server and a shared accounting server. Syntax show radius accounting [server] | [counter ip-address] | [retries] | [timeout] Resets the maximum number of attempts a user can contact the RADIUS server before timing out to 3. Resets the maximum amount of time to establish contact with the RADIUS server before timing out to 20 seconds. Deletes server settings. For use with the server parameter to clear the server configuration for all servers or a specific RADIUS server as defined by an index. Resets the realm setting for all servers or a specific RADIUS server as defined by an index. clear radius Enterasys D-Series CLI Reference 17-7...
Page 470: Set Radius Accounting
Parameters server counter ip‐address retries timeout Mode Switch command, read‐only. Defaults If no parameters are specified, all RADIUS accounting configuration information will be displayed. Example This example shows how to display RADIUS accounting configuration information. In this case, RADIUS accounting is not currently enabled and global default settings have not been changed. One server has been configured. For details on enabling and configuring RADIUS accounting, refer to “set radius accounting” on page 17‐8: D2(ro)->show radius accounting RADIUS accounting status: RADIUS Acct Server ------------------ set radius accounting Use this command to configure RADIUS accounting. Syntax set radius accounting {[enable | disable] [retries retries] [timeout timeout]...
Page 471: Clear Radius Accounting
{server ip-address | retries | timeout | counter} Parameters server ip‐address retries timeout counter Mode Switch command, read‐write. Sets the maximum amount of time (in seconds) to establish contact with a specified RADIUS accounting server before timing out. Valid timeout values are 1 ‐ 30. Specifies the accounting server’s: • IP address • UDP authentication port (0 ‐ 65535) • server‐secret (Read‐Write password to access this accounting server. Device will prompt for this entry upon creating a server instance, as shown in the example below.) Clears the configuration on one or more accounting servers. Resets the retries to the default value of 3. Resets the timeout to 5 seconds. Clears counters. clear radius accounting Enterasys D-Series CLI Reference 17-9...
Page 472 clear radius accounting Defaults None. Example This example shows how to reset the RADIUS accounting timeout to 5 seconds. D2(su)->clear radius accounting timeout 17-10 Security Configuration...
Page 473: Configuring 802.1X Authentication
Authentication Protocol). 802.1X controls network access by enforcing user authorization on selected ports, which results in allowing or denying network access according to RADIUS server configuration. Note: To configure EAP pass-through, which allows client authentication packets to be forwarded through the switch to an upstream device, 802.1X authentication must be globally disabled with the set dot1x command Commands For information about... show dot1x...
Page 474 If port‐string is not specified, information for all ports will be displayed. Mode Switch command, read‐only. Examples This example shows how to display 802.1X status: D2(su)->show dot1x DOT1X is disabled. This example shows how to display authentication diagnostics information for fe.1.1: D2(su)->show dot1x auth-diag Port : 1 Auth-Diag Enter Connecting: EAP Logoffs While Connecting: Enter Authenticating: Success While Authenticating Timeouts While Authenticating: Fails While Authenticating: ReAuths While Authenticating:...
Page 475: Show Dot1X Auth-Config
Port 1: Quiet period: This example shows how to display all 802.1X authentication configuration settings for D2(ro)->show dot1x auth-config ge.1.1 (Optional) Displays the current value of the controlled Port control parameter for the port. (Optional) Displays the value set for maximum requests currently in use by the backend authentication state machine. (Optional) Displays the value set for quiet period currently in use by the authenticator PAE state machine. (Optional) Displays the state of reauthentication control used by the Reauthentication Timer state machine. (Optional) Displays the value, in seconds, set for the reauthentication period used by the reauthentication timer state machine. (Optional) Displays the server timeout value, in seconds, currently in use by the backend authentication state machine. (Optional) Displays the authentication supplicant timeout value, in seconds, currently in use by the backend authentication state machine. (Optional) Displays the transmission period value, in seconds, currently in use by the authenticator PAE state machine. (Optional) Limits the display of desired information information to specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.1 show dot1x auth-config .1.1 Auto .1.1: Enterasys D-Series CLI Reference 17-13...
Page 476: Set Dot1X
{enable | disable | port {init | reauth} {true | false} [port-string]} Parameters enable | disable port init | reauth true | false port‐string Defaults If no ports are specified, the reinitialization or reauthentication setting will be applied to all ports. Mode Switch command, read‐write. Usage Disabling 802.1X authentication globally, by not entering a specific port‐string value, will enable the EAP pass‐through feature. EAP pass‐through allows client authentication packets to be forwarded unmodified through the switch to an upstream device. Examples This example shows how to enable 802.1X: D2(su)->set dot1x enable This example shows how to reinitialize D2(rw)->set dot1x port init true ge.1.2...
Page 477: Set Dot1X Auth-Config
• forced‐auth – Set port control mode to ForcedAuthorized controlled port control. • forced‐unauth – Set port control mode to ForcedUnauthorized controlled port control. Specifies the maximum number of authentication requests allowed by the backend authentication state machine. Valid values are 1 – 10. Default value is 2. Specifies the time (in seconds) following a failed authentication before another attempt can be made by the authenticator PAE state machine. Valid values are 0 – 65535. Default value is 60 seconds. Enables (true) or disables (false) reauthentication control of the reauthentication timer state machine. Default value is false. Specifies the time lapse (in seconds) between attempts by the reauthentication timer state machine to reauthenticate a port. Valid values are 0 – 65535. Default value is 3600 seconds. Specifies a timeout period (in seconds) for the authentication server, used by the backend authentication state machine. Valid values are 1 – 300. Default value is 30 seconds. Specifies a timeout period (in seconds) for the authentication supplicant used by the backend authentication state machine. Valid values are 1 – 300. Default value is 30 seconds. Specifies the period (in seconds) which passes between authenticator PAE state machine EAP transmissions. Valid values are 0 – 65535. Default value is 30 seconds. (Optional) Limits the configuration of desired settings to specified port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. set dot1x auth-config Enterasys D-Series CLI Reference 17-15...
Page 478: Clear Dot1X Auth-Config
Parameters authcontrolled‐ portcontrol maxreq quietperiod reauthenabled reauthperiod servertimeout supptimeout txperiod port‐string Defaults If no parameters are specified, all authentication parameters will be reset. If port‐string is not specified, parameters will be set on all ports. Mode Switch command, read‐write. Examples This example shows how to reset the 802.1X port control mode to auto on all ports: D2(su)->clear dot1x auth-config authcontrolled-portcontrol This example shows how to reset reauthentication control to disabled on ports fe.1.1‐3: D2(su)->clear dot1x auth-config reauthenabled 17-16 Security Configuration (Optional) Resets the 802.1X port control mode to auto. (Optional) Resets the maximum requests value to 2. (Optional) Resets the quiet period value to 60 seconds. (Optional) Resets the reauthentication control state to disabled (false). (Optional) Resets the reauthentication period value to 3600 seconds. (Optional) Resets the server timeout value to 30 seconds. (Optional) Resets the authentication supplicant timeout value to 30 seconds. (Optional) Resets the transmission period value to 30 seconds.
Page 479: Show Eapol
D2(su)->show eapol EAPOL is disabled. Port Authentication State -------- -------------------- .1.1 Initialize .1.2 Initialize .1.3 Initialize Table 17‐43 provides an explanation of the command output. For details on using the set eapol command to enable the protocol and assign an authentication mode, refer to “set eapol” on page 17‐19. (Optional) Displays EAPOL status for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.1-3 Authentication Mode -------------------- Auto Auto Auto .1.1-3 Enterasys D-Series CLI Reference 17-17 show eapol...
Page 480: Show Eapol Output Details
Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 6-1. Current EAPOL authentication state for each port. Possible internal states for the authenticator (switch) are: • initialize: A port is in the initialize state when: – authentication is disabled, –...
Page 481: Set Eapol
D2(su)->set eapol enable This example shows how to enable EAPOL with forced authorized mode on port fe.1.1: D2(su)->set eapol auth-mode forced-auth clear eapol Use this command to globally clear the EAPOL authentication mode, or to clear settings for one or more ports. Syntax clear eapol [auth-mode] [port-string] Enables or disables EAPOL. Specifies the authentication mode as: • auto ‐ Auto authorization mode. This is the default mode and will forward frames according to the authentication state of the port. For details on this mode, refer to Table • forced‐auth ‐ Forced authorized mode, which disables authentication on the port. • forced‐unauth ‐ Forced unauthorized mode, which filters and discards all frames received on the port. Specifies the port(s) on which to set EAPOL parameters. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.1 set eapol 17‐43. Enterasys D-Series CLI Reference 17-19...
Page 482 Parameters auth‐mode port‐string Defaults If auth‐mode is not specified, all EAPOL settings will be cleared. If port‐string is not specified, settings will be cleared for all ports. Mode Switch command, read‐write. Example This example shows how to clear the EAPOL authentication mode for port D2(su)->clear eapol auth-mode ge.1.3 17-20 Security Configuration (Optional) Globally clears the EAPOL authentication mode. Specifies the port(s) on which to clear EAPOL parameters. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .1.3:...
Page 483: Configuring Mac Authentication
Use this command to display MAC authentication information for one or more ports. Syntax show macauthentication [port-string] Configuring MAC Authentication Refer to page... 17-21 17-23 17-24 17-24 17-25 17-25 17-26 17-26 17-27 17-27 17-28 17-28 17-29 17-29 17-30 17-31 17-31 Enterasys D-Series CLI Reference 17-21...
Page 484: Show Macauthentication Output Details
Parameters port‐string Defaults If port‐string is not specified, MAC authentication information will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display MAC authentication information for D2(su)->show macauthentication ge.2.1-8 MAC authentication: MAC user password: Port username significant bits Port Port State ------- -------- ---------- -------- --------- ----------------- ge.2.1 disabled 3600 ge.2.2 disabled 3600 ge.2.3 disabled 3600 ge.2.4...
Page 485: Show Macauthentication Session
What It Displays... Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 6-1. MAC address associated with the session. show macauthentication session Reauthentications ----------------- disabled Enterasys D-Series CLI Reference 17-23...
Page 486: Set Macauthentication
Table 17-45 show macauthentication session Output Details (Continued) Output Field Duration Reauth Period Reauthentications set macauthentication Use this command to globally enable or disable MAC authentication. Syntax set macauthentication {enable | disable} Parameters enable | disable Mode Switch command, read‐write. Defaults None. Example This example shows how to globally enable MAC authentication: D2(su)->set macauthentication enable set macauthentication password Use this command to set a MAC authentication password. Syntax set macauthentication password password Parameters password Defaults None.
Page 487: Clear Macauthentication Password
None. Mode Switch command, read‐write. Example This example shows how to clear the MAC authentication password: D2(su)->clear macauthentication password set macauthentication port Use this command to enable or disable one or more ports for MAC authentication. Syntax set macauthentication port {enable | disable} port-string Parameters enable | disable port‐string Defaults None. Mode Switch command, read‐write. Enables or disables MAC authentication. Specifies port(s) on which to enable or disable MAC authentication. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. clear macauthentication password Enterasys D-Series CLI Reference 17-25...
Page 488: Set Macauthentication Portinitialize
Usage Enabling port(s) for MAC authentication requires globally enabling MAC authentication on the switch as described in “set macauthentication” on page 17‐24, and then enabling it on a port‐by‐ port basis. By default, MAC authentication is globally disabled and disabled on all ports. Example This example shows how to enable MAC authentication on D2(su)->set macauthentication port enable ge.2.1-5 set macauthentication portinitialize Use this command to force one or more MAC authentication ports to re‐initialize and remove any currently active sessions on those ports. Syntax set macauthentication portinitialize port-string Parameters port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to force D2(su)->set macauthentication portinitialize ge.2.1-5 set macauthentication portquietperiod This sets the number of seconds following a failed authentication before another attempt may be ...
Page 489: Clear Macauthentication Portquietperiod
[port-string] Parameters port‐string Defaults If a port‐string is not specified then all ports will be set to the default port quiet period. Mode Switch command, read‐write. Example This example resets the default quiet period on port 1: D2(su)->clear macauthentication portquietperiod ge.1.1 set macauthentication macinitialize Use this command to force a current MAC authentication session to re‐initialize and remove the session. Syntax set macauthentication macinitialize mac-addr Parameters mac‐addr (Optional) Specifies the ports for which the quiet period is to be reset. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Specifies the MAC address of the session to re‐initialize. clear macauthentication portquietperiod Enterasys D-Series CLI Reference 17-27...
Page 490: Set Macauthentication Reauthentication
Mode Switch command, read‐write. Defaults None. Example This example shows how to force the MAC authentication session for address 00‐60‐97‐b5‐4c‐07 to re‐initialize: D2(su)->set macauthentication macinitialize 00-60-97-b5-4c-07 set macauthentication reauthentication Use this command to enable or disable reauthentication of all currently authenticated MAC addresses on one or more ports. Syntax set macauthentication reauthentication {enable | disable} port-string Parameters enable | disable port‐string Defaults None. Mode Switch command, read‐write. Example This example shows how to enable MAC reauthentication on D2(su)->set macauthentication reauthentication enable ge.4.1-5 set macauthentication portreauthenticate Use this command to force an immediate reauthentication of the currently active sessions on one ...
Page 491: Set Macauthentication Macreauthenticate
Parameters mac‐addr Defaults None. Mode Switch command, read‐write. Example This example shows how to force the MAC authentication session for address 00‐60‐97‐b5‐4c‐07 to reauthenticate: D2(su)->set macauthentication macreauthenticate 00-60-97-b5-4c-07 set macauthentication reauthperiod Use this command to set the MAC reauthentication period (in seconds). This is the time lapse between attempts to reauthenticate any current MAC address authenticated to a port. Syntax set macauthentication reauthperiod time port-string Specifies MAC authentication port(s) to be reauthenticated. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .2.1 though 5 to reauthenticate: Specifies the MAC address of the session to reauthenticate. set macauthentication macreauthenticate Enterasys D-Series CLI Reference 17-29...
Page 492: Clear Macauthentication Reauthperiod
Parameters time port‐string Defaults None. Mode Switch command, read‐write. Usage Changing the Reauth Period with the set macauthentication reauthperiod command does not affect current sessions. New sessions will use the correct period. Example This example shows how to set the MAC reauthentication period to 7200 seconds (2 hours) on .2.1 through 5: D2(su)->set macauthentication reauthperiod 7200 ge.2.1-5 clear macauthentication reauthperiod Use this command to clear the MAC reauthentication period on one or more ports. Syntax clear macauthentication reauthperiod [port-string] Parameters port‐string Defaults If port‐string is not specified, the reauthentication period will be cleared on all ports. Mode Switch command, read‐write. Example This example shows how to globally clear the MAC reauthentication period: D2(su)->clear macauthentication reauthperiod 17-30 Security Configuration Specifies the number of seconds between reauthentication attempts. Valid ...
Page 493: Set Macauthentication Significant-Bits
Usage This command allows you to specify a mask to apply to MAC addresses when authenticating users through a RADIUS server. The most common use of significant bit masks is for authentication of all MAC addresses for a specific vendor. On switches using MAC authentication, the MAC address of a user attempting to log in is sent to the RADIUS server as the user name. If access is denied, and if a significant bit mask has been configured (other than 48) with this command, the switch will apply the mask and resend the masked address to the RADIUS server. For example, if a user with MAC address of 00‐16‐CF‐12‐ 34‐56 is denied access, and a 32 bit mask has been configured, the switch will apply the mask and resend a MAC address of 00‐16‐CF‐12‐00‐00 to the RADIUS server. To use a significant bits mask for authentication of devices by a particular vendor, specify a 24‐bit mask, to mask out everything except the vendor portion of the MAC address. Example This example sets the MAC authentication significant bits mask to 24. D2(su)->set macauthentication significant-bits 24 clear macauthentication significant-bits Use this command to reset the number of significant bits of the MAC address to use for authentication to the default of 48. Syntax clear macauthentication significant-bits Parameters None. Defaults None. Specifies the number of significant bits to be used for authentication. set macauthentication significant-bits Enterasys D-Series CLI Reference 17-31...
Page 494 Mode Switch command, read‐write. Example This example resets the MAC authentication significant bits to 48. D2(su)->clear macauthentication significant-bits 17-32 Security Configuration...
Page 495: Configuring Multiple Authentication Methods
Authentication, there exists two different VLAN‐to‐policy role mappings. The policy role for the IP phone is statically mapped using the VLAN‐to‐policy mapping feature which assigns any packets received with a VLAN tag set to a specific VID (for example, Voice VLAN) to an indicated policy role (for example, IP Phone policy role). Therefore, it is required that IP phone is configured to send VLAN tagged packets to the “Voice” VLAN. The second policy role, for the user, can either be statically configured with the default policy role on the port or dynamically assigned through authentication to the network. When the default policy role is assigned on a port, the VLAN set as the portʹs PVID is mapped to the default policy role. When a policy role is dynamically applied to a port as the result of a successfully authenticated session, the “authenticated VLAN” is mapped to the policy role set in the Filter‐ID returned from the RADIUS server. The “authenticated VLAN” may either be the PVID of the port, if the PVID Override for the policy profile is disabled, or the VLAN specified in the PVID Override if the PVID Override is enabled. Commands For information about... show multiauth set multiauth mode clear multiauth mode Configuring Multiple Authentication Methods Refer to page... 17-34 17-35 17-35 Enterasys D-Series CLI Reference 17-33...
Page 496: Show Multiauth
Use this command to display multiple authentication system configuration. Syntax show multiauth Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display multiple authentication system configuration: D2(rw)->show multiauth Multiple authentication system configuration ------------------------------------------------- Supported types Maximum number of users Current number of users System mode Default precedence...
Page 497: Set Multiauth Mode
Multiauth multi mode requires that MAC, PWA, and 802.1X authentication be enabled globally, and configured appropriately on the desired ports according to their corresponding command sets described in this chapter. Refer to “Configuring 802.1X Authentication” on page 17‐11 and “Configuring MAC Authentication” on page (PWA)” on page 17‐62. Example This example shows how to enable simultaneous multiple authentications: D2(rw)->set multiauth mode multi clear multiauth mode Use this command to clear the system authentication mode. Syntax clear multiauth mode Parameters None. Defaults None. Mode Switch command, read‐write. Allows the system to use multiple authenticators simultaneously (802.1x, PWA, and MAC Authentication) on a port. This is the default mode. User must authenticate using 802.1x authentication before normal traffic (anything other than authentication traffic) can be forwarded. 17‐21 and “Configuring Port Web Authentication set multiauth mode Enterasys D-Series CLI Reference 17-35...
Page 498: Set Multiauth Precedence
This example shows how to clear the system authentication mode: D2(rw)->clear multiauth mode set multiauth precedence Use this command to set the system’s multiple authentication administrative precedence. Syntax set multiauth precedence {[dot1x] [mac] } Parameters dot1x Defaults None. Mode Switch command, read‐write. Usage When a user is successfully authenticated by more than one method at the same time, the precedence of the authentication methods will determine which RADIUS‐returned filter ID will be processed and result in an applied traffic policy profile. Example This example shows how to set precedence for MAC authentication: D2(rw)->set multiauth precedence mac dot1x clear multiauth precedence Use this command to clear the system’s multiple authentication administrative precedence. Syntax clear multiauth precedence Parameters None.
Page 499: Show Multiauth Port
Use this command to set multiple authentication properties for one or more ports. Syntax set multiauth port mode {auth-opt | auth-reqd | force-auth | force-unauth} | numusers numusers port-string (Optional) Displays multiple authentication information for specific port(s). Mode Allowed users users show multiauth port .3.1‐4: Current users Enterasys D-Series CLI Reference 17-37...
Page 500: Clear Multiauth Port
Defaults None. Mode Switch command, read‐write. Examples This example shows how to set the port multiple authentication mode to required on D2(rw)->set multiauth port mode auth-reqd ge.3.14 This example shows how to set the number of users allowed to authenticate on port D2(rw)->set multiauth port numusers 8 ge.3.14 clear multiauth port Use this command to clear multiple authentication properties for one or more ports. Syntax clear multiauth port {mode | numusers} port-string Parameters mode numusers ...
Page 501: Show Multiauth Station
------------ ------------ .1.20 .2.16 show multiauth session Use this command to display multiple authentication session entries. Syntax show multiauth session [all] [agent {dot1x | mac | pwa}] [mac address] [port port-string] (Optional) Displays multiple authentication station entries for specific MAC address(es). (Optional) Displays multiple authentication station entries for specific port(s). Address ------------------------ 00-10-a4-9e-24-87 00-b0-d0-e5-0c-d0 show multiauth station .3.14: .3.14: Enterasys D-Series CLI Reference 17-39...
Page 502: Show Multiauth Idle-Timeout
Parameters agent dot1x | mac | mac address port port‐string Defaults If no options are specified, multiple authentication session entries will be displayed for all sessions, authentication types, MAC addresses, and ports. Mode Switch command, read‐only. Example This example shows how to display multiple authentication session information for port D2(su)->show multiauth session port ge.1.1 __________________________________________ Port Auth status Agent type Server type Policy index Session timeout Idle timeout Termination time | Not Terminated show multiauth idle-timeout Use this command to display the timeout value, in seconds, for an idle session for all ...
Page 503: Set Multiauth Idle-Timeout
Parameters dot1x timeout Defaults If no authentication method is specified, the idle timeout value is set for all authentication methods. Mode Switch mode, read‐write. Usage If you set an idle timeout value, a MAC user whose MAC address has aged out of the forwarding database will be unauthenticated if no traffic has been seen from that address for the specified idle timeout period. A value of zero indicates that no idle timeout will be applied unless an idle timeout value is provided by the authenticating server. For example, if a session is authenticated by a RADIUS server, that server may encode a Idle‐Timeout Attribute in its authentication response. Example This example sets the idle timeout value for all authentication methods to 300 seconds. D2(su)->set multiauth idle-timeout 300 Timeout (sec) (Optional) Specifies the IEEE 802.1X port‐based network access control authentication method for which to set the timeout value. (Optional) Specifies the Enterasys MAC authentication method for which to set the timeout value. (Optional) Specifies the Enterasys Port Web Authentication method for which to set the timeout value. Specifies the timeout value in seconds. The value can range from 0 to 65535. A value of 0 means that no idle timeout will be applied unless an idle timeout value is provided by the authenticating server. set multiauth idle-timeout Enterasys D-Series CLI Reference 17-41...
Page 504: Clear Multiauth Idle-Timeout
Use this command to reset the maximum number of consecutive seconds an authenticated session may be idle before termination of the session to its default value of 0. Syntax clear multiauth idle-timeout [dot1x | mac | pwa] Parameters dot1x Defaults If no authentication method is specified, the idle timeout value is reset to its default value of 0 for all authentication methods. Mode Switch mode, read‐write. Example This example resets the idle timeout value for all authentication methods to 0 seconds. D2(su)->clear multiauth idle-timeout show multiauth session-timeout Use this command to display the session timeout value, in seconds, for all authentication methods. Syntax show multiauth session-timeout Parameters None. Defaults None.
Page 505: Set Multiauth Session-Timeout
[dot1x | mac | pwa] timeout Parameters dot1x timeout Defaults If no authentication method is specified, the session timeout value is set for all authentication methods. Mode Switch mode, read‐write. Usage A value of zero may be superseded by a session timeout value provided by the authenticating server. For example, if a session is authenticated by a RADIUS server, that server may encode a Session‐Timeout Attribute in its authentication response. Example This example sets the session timeout value for the IEEE 802.1X authentication method to 300 seconds. D2(su)->set multiauth session-timeout dot1x 300 Timeout (sec) (Optional) Specifies the IEEE 802.1X port‐based network access control authentication method for which to set the session timeout value. (Optional) Specifies the Enterasys MAC authentication method for which to set the session timeout value. (Optional) Specifies the Enterasys Port Web Authentication method for which to set the session timeout value. Specifies the timeout value in seconds. The value can range from 0 to 65535. A value of 0 means that no session timeout will be applied unless a session timeout value is provided by the authenticating server. set multiauth session-timeout Enterasys D-Series CLI Reference 17-43...
Page 506: Clear Multiauth Session-Timeout
Use this command to reset the maximum number of consecutive seconds an authenticated session may last before termination of the session to its default value of 0. Syntax clear multiauth session-timeout [dot1x | mac | pwa] Parameters dot1x Defaults If no authentication method is specified, the session timeout value is reset to its default value of 0 for all authentication methods. Mode Switch mode, read‐write. Example This example resets the session timeout value for the IEEE 802.1X authentication method to 0 seconds. D2(su)->clear multiauth session-timeout dot1x 17-44 Security Configuration (Optional) Specifies the IEEE 802.1X port‐based network access control authentication method for which to reset the timeout value to its default. (Optional) Specifies the Enterasys MAC authentication method for which to reset the timeout value to its default. (Optional) Specifies the Enterasys Port Web Authentication method for ...
Page 507: Configuring Vlan Authorization (Rfc 3580)
Displays the current policy maptable response setting. When VLAN authorization is enabled (as described in this section) and the policy maptable response is tunnel, you can use the set Configuring VLAN Authorization (RFC 3580) Refer to page... 17-45 17-46 17-47 17-48 17-48 17-49 Enterasys D-Series CLI Reference 17-45...
Page 508: Set Policy Maptable Response
Syntax show policy maptable response Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the current policy maptable response setting: D2(rw)->show policy maptable response policy set policy maptable response Sets the maptable response from the default of policy to tunnel to allow up to VLAN authorized users to be configured per Gigabit port. Syntax set policy maptable response {policy | tunnel} Parameters policy...
Page 509: Set Vlanauthorization
{enable | disable} [port-string] Parameters enable | disable port‐string Defaults VLAN authentication is disabled by default. Mode Switch command, read‐write. Examples This example shows how to enable VLAN authentication for all Gigabit Ethernet ports: D2(rw)-> set vlanauthorization enable ge.*.* This example shows how to disable VLAN authentication for all Gigabit Ethernet ports on switch unit/module 3: D2(rw)-> set vlanauthorization disable ge.3.* Enables or disables vlan authorization/tunnel attributes. (Optional) Specifies which ports to enable or disable the use of VLAN tunnel attributes/authorization. For a detailed description of possible port‐ string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. set vlanauthorization Enterasys D-Series CLI Reference 17-47...
Page 510: Set Vlanauthorization Egress
Controls the modification of the current VLAN egress list of 802.1x authenticated ports for the VLANs returned in the RADIUS authorization filter id string. Syntax set vlanauthorization egress {none | tagged | untagged} port-string Parameters none tagged untagged port‐string Defaults By default, administrative egress is set to untagged. Mode Switch command, read‐write. Example This example shows how to enable the insertion of the RADIUS assigned VLAN to an 802.1q tag for all outbound frames for ports 10 through 15 on unit/module number 3. D2(rw)->set vlanauthorization egress tagged ge.3.10-15 clear vlanauthorization Use this command to return port(s) to the default configuration of VLAN authorization disabled, egress untagged. Syntax clear vlanauthorization [port-string] Parameters port‐string Defaults If no port string is entered, all ports a will be reset to default configuration with VLAN ...
Page 511: Show Vlanauthorization
Port identification Port status as assigned by set vlanauthorization command Port status as assigned by the set vlanauthorization egress command Port operational status of vlanauthorization egress. show vlanauthorization authenticated vlan id mac address ----------------- ------- 17‐47 and “set Enterasys D-Series CLI Reference 17-49...
Page 512 show vlanauthorization Table 17-46 show vlanauthorization Output Details (Continued) Output Field authenticated mac address vlan id 17-50 Security Configuration What It Displays... If authentication has succeeded, displays the MAC address assigned for egress. If authentication has succeeded, displays the assigned VLAN id for ingress.
Page 513: Configuring Mac Locking
Configuring MAC Locking Refer to page... 17-52 17-53 17-54 17-55 17-55 17-56 17-57 17-57 17-58 17-59 17-59 17-60 Enterasys D-Series CLI Reference 17-51...
Page 514: Show Maclock
CLI” on page 6-1. Whether MAC locking is enabled or disabled on the port. MAC locking is globally disabled by default. For details on enabling MAC locking on the switch and on one or more ports, refer to “set maclock enable”...
Page 515: Show Maclock Stations
(Optional) Displays MAC locking information about end stations first connected to MAC locked ports. (Optional) Displays MAC locking information about static (management defined) end stations connected to MAC locked ports. (Optional) Displays end station information for specified port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .2.* MAC Address Status -------------- -------------- ----- active active show maclock stations static” on page 17-57. firstarrival” on page 17-58. State Aging first arrival true static false Enterasys D-Series CLI Reference 17-53...
Page 516: Set Maclock Enable
Use this command to enable MAC locking globally or on one or more ports. Note: MAC locking needs to be enabled globally and on appropriate ports for it to function. Syntax set maclock enable [port‐string] Parameters port‐string Defaults If port‐string is not specified, MAC locking will be enabled globally. Mode Switch command, read‐write. Usage When enabled and configured, MAC locking defines which MAC addresses, as well as how many MAC addresses are permitted to use specific port(s). MAC locking is disabled by default at device startup. Configuring one or more ports for MAC locking requires globally enabling it on the device and then enabling it on the desired ports. Example This example shows how to enable MAC locking on fe.2.3: D2(su)->set maclock enable 17-54 Security Configuration What It Displays...
Page 517: Set Maclock Disable
{create | enable | disable} Parameters mac‐address port‐string create enable | disable Defaults None. (Optional) Disables MAC locking on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .2.3 Specifies the MAC address for which MAC locking will be created, enabled or disabled. Specifies the port on which to create, enable or disable MAC locking for the specified MAC. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Establishes a MAC locking association between the specified MAC address and port. Create automatically enables MAC locking between the specified MAC address and port. Enables or disables MAC locking between the specified MAC address and port. set maclock disable Enterasys D-Series CLI Reference 17-55...
Page 518: Clear Maclock
Mode Switch command, read‐write. Usage Configuring a port for MAC locking requires globally enabling it on the switch first using the set maclock enable command as described in “set maclock enable” on page 17‐54. Static MAC locking a user on multiple ports is not supported. Statically MAC locked addresses will display in the show mac output (as described on page 14‐19) as address type “other” and will not remove them on link down. Example This example shows how to create a MAC locking association between MAC address 0e‐03‐ef‐d8‐ 44‐55 and port D2(rw)->set maclock 0e-03-ef-d8-44-55 ge.3.2 create clear maclock Use this command to remove a static MAC address to port locking entry. Syntax clear maclock mac-address port-string Parameters mac‐address port‐string Defaults None. Mode Switch command, read‐write. Usage The MAC address that is cleared will no longer be able to communicate on the port unless the first arrival limit has been set to a value greater than 0 and this limit has not yet been met. For example, if user B’s MAC is removed from the static MAC address list and the first arrival limit has been set to 0, then user B will not be able to communicate on the port. If user A’s MAC is removed from the static MAC address list and the first arrival limit has been set to 10, but only has ...
Page 519: Set Maclock Static
Example This example shows how to set the maximum number of allowable static MACs to 2 on D2(rw)->set maclock static ge.3.1 2 clear maclock static Use this command to reset the number of static MAC addresses allowed per port to the default value of 20. Syntax clear maclock static port-string Parameters port‐string Defaults None. Specifies the port on which to set the maximum number of static MACs allowed. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Specifies the maximum number of static MAC addresses allowed per port. Valid values are 0 to 20. Specifies the port on which to reset number of static MAC addresses allowed. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. set maclock static .3.1: Enterasys D-Series CLI Reference 17-57...
Page 520: Set Maclock Firstarrival
Mode Switch command, read‐write. Example This example shows how to reset the number of allowable static MACs on fe.2.3: D2(rw)->clear maclock static set maclock firstarrival Use this command to restrict MAC locking on a port to a maximum number of end station addresses first connected to that port. Syntax set maclock firstarrival port-string value Parameters port‐string value Defaults None. Mode Switch command, read‐write. Usage The maclock first arrival count resets when the link goes down. This feature is beneficial if you have roaming users—the first arrival count will be reset every time a user moves to another port, but will still protect against connecting multiple devices on a single port and will protect against MAC address spoofing. Note: Setting a port’s first arrival limit to 0 does not deny the first MAC address learned on the port from passing traffic.
Page 521: Clear Maclock Firstarrival
Use this command to enable or disable the aging of first arrival MAC addresses. When enabled, first arrival MAC addresses that are aged out of the forwarding database will be removed from the associated port MAC lock. Syntax set maclock agefirstarrival port-string {enable | disable} Parameters port‐string enable | disable Defaults None. Mode Switch mode, read‐write. Specifies the port on which to reset the first arrival value. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. .2.3 Specifies the port(s) on which to enable or disable first arrival aging. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Enable or disable first arrival aging. By default, first arrival aging is disabled. clear maclock firstarrival Enterasys D-Series CLI Reference 17-59...
Page 522: Clear Maclock Agefirstarrival
D2(su)-> set maclock agefirstarrival ge.1.1 enable clear maclock agefirstarrival Use this command to reset first arrival aging on one or more ports to its default state of disabled. Syntax clear maclock agefirstarrival port-string Parameters port‐string Defaults None. Mode Switch mode, read‐write. Example This example disables first arrival aging on port D2(su)-> clear maclock agefirstarrival ge.1.1 enable set maclock move Use this command to move all current first arrival MACs to static entries. Syntax set maclock move port-string Parameters port‐string Defaults None.
Page 523: Set Maclock Trap
{enable | disable} Parameters port‐string enable | disable Defaults None. Mode Switch command, read‐write. Usage When enabled, this feature authorizes the switch to send an SNMP trap message if an end station is connected that exceeds the maximum values configured using the set maclock firstarrival and set maclock static commands. Violating MAC addresses are dropped from the device’sfiltering database. Example This example shows how to enable MAC lock trap messaging on fe.2.3: D2(su)->set maclock trap Specifies the port on which MAC lock trap messaging will be enabled or disabled. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. Enables or disables MAC lock trap messaging. .2.3 enable set maclock trap .3.1‐40: Enterasys D-Series CLI Reference 17-61...
Page 524: Configuring Port Web Authentication (Pwa)
Configuring Port Web Authentication (PWA) Configuring Port Web Authentication (PWA) Note: A license is required to enable PWA on the SecureStack B2 and B3, and the D-Series switch. Refer to About PWA PWA provides a way of authenticating users before allowing general access to the network To log on using PWA, the user makes a request through a web browser for the PWA web page or is automatically redirected to this login page after requesting a URL in a browser. Depending upon the authenticated state of the user, a login page or a logout page will display. When a user submits username and password, the switch then authenticates the user via a preconfigured RADIUS server. If the login is successful, then the user will be granted full network access according to the user’s policy configuration on the switch. Note: One user per PWA-configured port can be authenticated on D-Series devices.
Page 525: Show Pwa
Whether PWA protocol is CHAP or PAP. Default setting of PAP can be changed using the set pwa protocol command as described in page 17-67. show pwa Refer to page... 17-72 17-73 .2.1: MaxReq --------- “set pwa” on “set pwa protocol” on Enterasys D-Series CLI Reference 17-63...
Page 526: Set Pwa
17-73. Whether the Enterasys Networks logo will be displayed or hidden at user login. Default state of enabled (displayed) can be changed using the set pwa displaylogo command as described in “set pwa...
Page 527: Show Pwa Banner
D2(su)->show pwa banner Welcome to Enterasys Networks set pwa banner Use this command to configure a string to be displayed as the PWA login banner. Syntax set pwa banner string Parameters string Defaults None. Mode Switch command, read‐write. Example This example shows how to set the PWA login banner to “Welcome to Enterasys Networks”: D2(su)->set pwa banner “Welcome to Enterasys Networks” Specifies the PWA login banner. show pwa banner Enterasys D-Series CLI Reference 17-65...
Page 528: Clear Pwa Banner
Use this command to reset the PWA login banner to a blank string. Syntax clear pwa banner Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the PWA login banner to a blank string D2(su)->clear pwa banner set pwa displaylogo Use this command to set the display options for the Enterasys Networks logo. Syntax set pwa displaylogo {display | hide} Parameters display | hide Defaults None. Mode Switch command, read‐write. Example This example shows how to hide the Enterasys Networks logo: ...
Page 529: Set Pwa Ipaddress
Use this command to set the port web authentication protocol. Syntax set pwa protocol {chap | pap} Parameters chap | pap Defaults None. Mode Switch command, read‐write. Example This example shows how to set a the PWA protocol to CHAP: D2(su)->set pwa protocol chap Specifies a globally unique IP address. This same value must be configured into every authenticating switch in the domain. Sets the PWA protocol to: • CHAP (PPP Challenge Handshake Protocol) ‐ encrypts the username and password between the end‐station and the switch port. • PAP (Password Authentication Protocol‐ does not provide any encryption between the end‐station the switch port. set pwa ipaddress Enterasys D-Series CLI Reference 17-67...
Page 530: Set Pwa Guestname
Use this command to set a guest user name for PWA networking. PWA will use this name to grant network access to guests without established login names and passwords. Syntax set pwa guestname name Parameters name Defaults None. Mode Switch command, read‐write. Example This example shows how to set the PWA guest user name to “guestuser”: D2(su)->set pwa guestname guestuser clear pwa guestname Use this command to clear the PWA guest user name. Syntax clear pwa guestname Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the PWA guest user name...
Page 531: Set Pwa Guestpassword
Guest Password: ********* Retype Guest Password: ********* set pwa gueststatus Use this command to enable or disable guest networking for port web authentication. Syntax set pwa gueststatus {authnone | authradius | disable} Parameters authnone authradius disable Defaults None. Mode Switch command, read‐write. Enables guest networking with no authentication method. Enables guest networking with RADIUS authentication. Upon successful authentication from RADIUS, PWA will apply the policy returned from RADIUS to the PWA port. Disables guest networking. set pwa guestpassword Enterasys D-Series CLI Reference 17-69...
Page 532: Set Pwa Initialize
This example shows how to enable PWA guest networking with RADIUS authentication: D2(su)->set pwa guestnetworking authradius set pwa initialize Use this command to initialize a PWA port to its default unauthenticated state. Syntax set pwa initialize [port-string] Parameters port‐string Defaults If port‐string is not specified, all ports will be initialized. Mode Switch command, read‐write. Example This example shows how to initialize ports D2(su)->set pwa initialize ge.1.5-7 set pwa quietperiod Use this command to set the amount of time a port will remain in the held state after a user unsuccessfully attempts to log on to the network. Syntax set pwa quietperiod time [port-string] Parameters time port‐string 17-70 Security Configuration (Optional) Initializes specific port(s). For a detailed description of possible ...
Page 533: Set Pwa Maxrequest
[port-string] Parameters maxrequests port‐string Defaults If port‐string is not specified, maximum requests will be set for all ports. Mode Switch command, read‐write. Example This example shows how to set the PWA maximum requests to 3 for all ports: D2(su)->set pwa maxrequests 3 set pwa portcontrol This command enables or disables PWA authentication on select ports. Syntax set pwa portcontrol {enable | disable} [port-string] Specifies the maximum number of log on attempts. (Optional) Sets the maximum requests for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 6‐1. set pwa maxrequest .1.5‐7: Enterasys D-Series CLI Reference 17-71...
Page 534: Show Pwa Session
Parameters enable | disable port‐string Defaults If port‐string is not specified, PWA will enabled on all ports. Mode Switch command, read‐write. Example This example shows how to enable PWA on ports 1‐22: D2(su)->set pwa portcontrol enable ge.1.1-22 show pwa session Use this command to display information about current PWA sessions. Syntax show pwa session [port-string] Parameters port‐string Defaults If port‐string is not specified, session information for all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display PWA session information: D2(su)->show pwa session Port -------- ----------------- --------------- ------------- ------------ --------- ge.2.19...
Page 535: Set Pwa Enhancedmode
This command enables PWA URL redirection. The switch intercepts all HTTP packets on port 80 from the end user, and sends the end user a refresh page destined for the PWA IP Address configured. Syntax set pwa enhancedmode {enable | disable} Parameters enable | disable Defaults None. Mode Switch command, read‐write. Example This example shows how to enable PWA enhancedmode: D2(su)->set pwa enhancedmode enable Enables or disables PWA enhancedmode. set pwa enhancedmode Enterasys D-Series CLI Reference 17-73...
Page 536: Configuring Secure Shell (Ssh)
Configuring Secure Shell (SSH) Configuring Secure Shell (SSH) Purpose To review, enable, disable, and configure the Secure Shell (SSH) protocol, which provides secure Telnet. Commands For information about... show ssh status set ssh set ssh hostkey show ssh status Use this command to display the current status of SSH on the switch. Syntax show ssh status Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display SSH status on the switch: D2(su)->show ssh status...
Page 537: Set Ssh Hostkey
None. Mode Switch command, read‐write. Example This example shows how to disable SSH: D2(su)->set ssh disable set ssh hostkey Use this command to set or reinitialize new SSH authentication keys. Syntax set ssh hostkey [reinitialize] Parameters reinitialize Defaults If reinitialize is not specified, the user must supply SSH authentication key values. Mode Switch command, read‐write. Example This example shows how to regenerate SSH keys: D2(su)->set ssh hostkey reinitialize Enables or disables SSH, or reinitializes the SSH server. Reinitializes the SSH server. (Optional) Reinitializes the server host authentication keys. set ssh hostkey Enterasys D-Series CLI Reference 17-75...
Page 538 set ssh hostkey 17-76 Security Configuration...
Page 539 IGMP 13-1 enabling and disabling 13-2 Image File copying 2-40 downloading 2-28 Ingress Filtering 9-8, 9-11 routes, managing in switch mode 14-16 Jumbo Frame Support 6-13 Index Keyword Lookups Line Editing Commands Link Layer Discovery Protocol (LLDP) configuring 5-13 LLDP...
Page 540 17-1 Serial Port downloading upgrades via 2-28 show system utilization cpu 2-14 SNMP access rights 7-15 accessing in router mode enabling on the switch 7-17 MIB views 7-19 notification parameters 7-28 notify filters 7-28 security models and levels statistics target addresses...

Enterasys D-Series Cli Reference Manual

About this Guide

Chapter 1: Introduction

Chapter 2: Basic Configuration

Chapter 3: Activating Licensed Features

Chapter 4: Configuring System Power and Poe

Chapter 5 : Discovery Protocol Configuration

Chapter 6 : Port Configuration

Chapter 7 : SNMP Configuration

Quick Links

Related Manuals for Enterasys D-Series

Summary of Contents for Enterasys D-Series