Page 1 Enterasys SecureStack ® ™ Stackable Switches Configuration Guide Firmware Version 6.03.xx.xxxx P/N 9034313-07...
Page 3 Notice Enterasys Networks reserves the right to make changes in specifications and other information contained in this document and its web site without prior notice. The reader should in all cases consult Enterasys Networks to determine whether any such changes have been made. The hardware, firmware, or software described in this document is subject to change without notice. IN NO EVENT SHALL ENTERASYS NETWORKS BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS DOCUMENT, WEB SITE, OR THE INFORMATION CONTAINED IN THEM, EVEN IF ENTERASYS NETWORKS HAS BEEN ADVISED OF, KNEW OF, OR SHOULD HAVE KNOWN OF, THE POSSIBILITY OF SUCH DAMAGES. Enterasys Networks, Inc. 50 Minuteman Road Andover, MA 01810 © 2009 Enterasys Networks, Inc. All rights reserved. Part Number: 9034313‐07 June 2009 ENTERASYS, ENTERASYS NETWORKS, ENTERASYS SECURE NETWORKS, SECURESTACK, ENTERASYS SECURESTACK, ENTERASYS NETSIGHT, WEBVIEW, and any logos associated therewith, are trademarks or registered trademarks of Enterasys Networks, Inc. in the United States and other countries. For a complete list of Enterasys trademarks, see http://www.enterasys.com/company/trademarks.aspx. All other product names mentioned in this manual may be trademarks or registered trademarks of their respective companies. Documentation URL: http://www.enterasys.com/support/manuals Documentacion URL: http://www.enterasys.com/support/manuals Dokumentation im Internet: http://www.enterasys.com/support/manuals Version: Information in this guide refers to SecureStack C3 firmware version 6.03.xx.xxxx or higher.
Page 4 Enterasys Networks, Inc. Firmware License Agreement BEFORE OPENING OR UTILIZING THE ENCLOSED PRODUCT, CAREFULLY READ THIS LICENSE AGREEMENT. This document is an agreement (“Agreement”) between the end user (“You”) and Enterasys Networks, Inc., on behalf of itself and its Affiliates (as hereinafter defined) (“Enterasys”) that sets forth Your rights and obligations with respect to the Enterasys software program/firmware (including any accompanying documentation, hardware or media) (“Program”) in the package and prevails over any additional, conflicting or inconsistent terms and conditions appearing on any purchase order or other document submitted by You. “Affiliate” means any person, partnership, corporation, limited liability company, other form of enterprise that directly or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with the party specified. This Agreement constitutes the entire understanding between the parties, with respect to the subject matter of this Agreement. The Program may be contained in firmware, chips or other media. BY INSTALLING OR OTHERWISE USING THE PROGRAM, YOU REPRESENT THAT YOU ARE AUTHORIZED TO ACCEPT THESE TERMS ON BEHALF OF THE END USER (IF THE END USER IS AN ENTITY ON WHOSE BEHALF YOU ARE AUTHORIZED TO ACT, “YOU” AND “YOUR” SHALL BE DEEMED TO REFER TO SUCH ENTITY) AND THAT YOU AGREE THAT YOU ARE BOUND BY THE TERMS OF THIS AGREEMENT, WHICH INCLUDES, AMONG OTHER PROVISIONS, THE LICENSE, THE DISCLAIMER OF WARRANTY AND THE LIMITATION OF LIABILITY. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT OR ARE NOT AUTHORIZED TO ENTER INTO THIS AGREEMENT, ENTERASYS IS UNWILLING TO LICENSE THE PROGRAM TO YOU AND YOU AGREE TO RETURN THE UNOPENED PRODUCT TO ENTERASYS OR YOUR DEALER, IF ANY, WITHIN TEN (10) DAYS FOLLOWING THE DATE OF RECEIPT FOR A FULL REFUND. IF YOU HAVE ANY QUESTIONS ABOUT THIS AGREEMENT, CONTACT ENTERASYS NETWORKS, LEGAL DEPARTMENT AT (978) 684‐1000. You and Enterasys agree as follows: LICENSE. You have the non‐exclusive and non‐transferable right to use only the one (1) copy of the Program ...
Page 5 If the Program is exported from the United States pursuant to the License Exception TSR under the U.S. Export Administration Regulations, in addition to the restriction on transfer set forth in Section 1 or 2 of this Agreement, You agree not to (i) reexport or release the Program, the source code for the Program or technology to a national of a country in Country Groups D:1 or E:2 (Albania, Armenia, Azerbaijan, Belarus, Cambodia, Cuba, Georgia, Iraq, Kazakhstan, Laos, Libya, Macau, Moldova, Mongolia, North Korea, the People’s Republic of China, Russia, Tajikistan, Turkmenistan, Ukraine, Uzbekistan, Vietnam, or such other countries as may be designated by the United States Government), (ii) export to Country Groups D:1 or E:2 (as defined herein) the direct product of the Program or the technology, if such foreign produced direct product is subject to national security controls as identified on the U.S. Commerce Control List, or (iii) if the direct product of the technology is a complete plant or any major component of a plant, export to Country Groups D:1 or E:2 the direct product of the plant or a major component thereof, if such foreign produced direct product is subject to national security controls as identified on the U.S. Commerce Control List or is subject to State Department controls under the U.S. Munitions List. UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The enclosed Program (i) was developed solely at private expense; (ii) contains “restricted computer software” submitted with restricted rights in accordance with section 52.227‐19 (a) through (d) of the Commercial Computer Software‐Restricted Rights Clause and its successors, and (iii) in all respects is proprietary data belonging to Enterasys and/or its suppliers. For Department of Defense units, the Program is considered commercial computer software in accordance with DFARS section 227.7202‐3 and its successors, and use, duplication, or disclosure by the U.S. Government is subject to restrictions set forth herein. DISCLAIMER OF WARRANTY. EXCEPT FOR THOSE WARRANTIES EXPRESSLY PROVIDED TO YOU IN WRITING BY ENTERASYS, ENTERASYS DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON‐INFRINGEMENT WITH RESPECT TO THE PROGRAM. IF IMPLIED WARRANTIES MAY NOT BE DISCLAIMED BY APPLICABLE LAW, THEN ANY IMPLIED WARRANTIES ARE LIMITED IN DURATION TO THIRTY (30) DAYS AFTER DELIVERY OF THE PROGRAM TO YOU. LIMITATION OF LIABILITY. IN NO EVENT SHALL ENTERASYS OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF BUSINESS, PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR RELIANCE DAMAGES, OR OTHER LOSS) ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM, EVEN IF ENTERASYS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THIS FOREGOING LIMITATION SHALL APPLY REGARDLESS OF THE CAUSE OF ACTION UNDER WHICH DAMAGES ARE SOUGHT. THE CUMULATIVE LIABILITY OF ENTERASYS TO YOU FOR ALL CLAIMS RELATING TO THE PROGRAM, IN CONTRACT, TORT OR OTHERWISE, SHALL NOT EXCEED THE TOTAL AMOUNT OF FEES PAID TO ENTERASYS BY YOU FOR THE RIGHTS GRANTED HEREIN. AUDIT RIGHTS. You hereby acknowledge that the intellectual property rights associated with the Program are of critical value to Enterasys, and, accordingly, You hereby agree to maintain complete books, records and accounts ...
Page 6 10. ENFORCEMENT. You acknowledge and agree that any breach of Sections 2, 4, or 9 of this Agreement by You may cause Enterasys irreparable damage for which recovery of money damages would be inadequate, and that Enterasys may be entitled to seek timely injunctive relief to protect Enterasys’ rights under this Agreement in addition to any and all remedies available at law. 11. ASSIGNMENT. You may not assign, transfer or sublicense this Agreement or any of Your rights or obligations under this Agreement, except that You may assign this Agreement to any person or entity which acquires substantially all of Your stock assets. Enterasys may assign this Agreement in its sole discretion. This Agreement shall be binding upon and inure to the benefit of the parties, their legal representatives, permitted transferees, successors and assigns as permitted by this Agreement. Any attempted assignment, transfer or sublicense in violation of the terms of this Agreement shall be void and a breach of this Agreement. 12. WAIVER. A waiver by Enterasys of a breach of any of the terms and conditions of this Agreement must be in writing and will not be construed as a waiver of any subsequent breach of such term or condition. Enterasys’ failure to enforce a term upon Your breach of such term shall not be construed as a waiver of Your breach or prevent enforcement on any other occasion. 13. SEVERABILITY. In the event any provision of this Agreement is found to be invalid, illegal or unenforceable, the validity, legality and enforceability of any of the remaining provisions shall not in any way be affected or impaired thereby, and that provision shall be reformed, construed and enforced to the maximum extent permissible. Any such invalidity, illegality, or unenforceability in any jurisdiction shall not invalidate or render illegal or unenforceable such provision in any other jurisdiction. 14. TERMINATION. Enterasys may terminate this Agreement immediately upon Your breach of any of the terms and conditions of this Agreement. Upon any such termination, You shall immediately cease all use of the Program and shall return to Enterasys the Program and all copies of the Program.
Page 7: Table Of Contents
Navigating the Command Line Interface ....................1-8 Chapter 2: Configuring Switches in a Stack About SecureStack C3 Switch Operation in a Stack ..................2-1 Installing a New Stackable System of Up to Eight Units ................2-2 Installing Previously-Configured Systems in a Stack ..................2-3 Adding a New Unit to an Existing Stack ......................
Page 8 set system password history ......................3-7 show system lockout .......................... 3-7 set system lockout ..........................3-8 Setting Basic Switch Properties ........................3-9 Purpose ..............................3-9 Commands ............................... 3-9 show ip address..........................3-10 set ip address ........................... 3-11 clear ip address ..........................3-11 show ip protocol..........................
Page 9 Managing Switch Configuration and Files ....................3-39 Configuration Persistence Mode ......................3-39 Purpose ..............................3-39 Commands ............................. 3-39 show snmp persistmode ........................3-40 set snmp persistmode ........................3-40 save config ............................3-41 dir..............................3-41 show file............................3-42 show config............................3-43 configure ............................
Page 10 Chapter 5: Configuring System Power and PoE Commands ..............................5-1 show inlinepower ..........................5-1 set inlinepower threshold........................5-2 set inlinepower trap ..........................5-3 set inlinepower detectionmode ......................5-3 show port inlinepower ......................... 5-4 set port inlinepower ..........................5-5 Chapter 6: Discovery Protocol Configuration Configuring CDP .............................
Page 11 clear lldp port trap ..........................6-32 clear lldp port med-trap........................6-33 clear lldp port location-info........................ 6-33 clear lldp port network-policy ......................6-34 clear lldp port tx-tlv ........................... 6-35 Chapter 7: Port Configuration Port Configuration Summary .......................... 7-1 Port String Syntax Used in the CLI ......................7-1 Reviewing Port Status ............................
Page 12 ..........................7-41 Link Aggregation Control Protocol (LACP) ....................7-42 LACP Operation ............................. 7-42 LACP Terminology ..........................7-43 SecureStack C3 Usage Considerations ....................7-43 Commands ............................. 7-44 show lacp............................7-45 set lacp ............................. 7-46 set lacp asyspri..........................7-47 set lacp aadminkey...........................
Page 13 Chapter 8: SNMP Configuration SNMP Configuration Summary ........................8-1 SNMPv1 and SNMPv2c ........................... 8-2 SNMPv3 ..............................8-2 About SNMP Security Models and Levels ....................8-2 Using SNMP Contexts to Access Specific MIBs ..................8-3 Configuration Considerations ........................8-3 Reviewing SNMP Statistics ..........................8-3 Purpose ..............................
Page 14 show snmp notify ..........................8-31 set snmp notify ..........................8-32 clear snmp notify ..........................8-33 show snmp notifyfilter ........................8-33 set snmp notifyfilter........................... 8-34 clear snmp notifyfilter........................8-35 show snmp notifyprofile ........................8-36 set snmp notifyprofile........................8-36 clear snmp notifyprofile........................8-37 Creating a Basic SNMP Trap Configuration ....................
Page 15 set spantree backuproot ........................9-22 clear spantree backuproot ........................ 9-22 show spantree tctrapsuppress......................9-23 set spantree tctrapsuppress ......................9-23 clear spantree tctrapsuppress ......................9-24 set spantree protomigration ......................9-24 show spantree spanguard ........................ 9-25 set spantree spanguard ........................9-25 clear spantree spanguard ......................... 9-26 show spantree spanguardtimeout ....................
Page 16 set spantree lptrapenable ......................... 9-50 show spantree lptrapenable ......................9-51 clear spantree lptrapenable ......................9-51 set spantree disputedbpduthreshold ....................9-52 show spantree disputedbpduthreshold ..................... 9-53 clear spantree disputedbpduthreshold ..................... 9-53 show spantree nonforwardingreason ....................9-54 Chapter 10: 802.1Q VLAN Configuration VLAN Configuration Summary ........................
Page 17 clear gvrp ............................10-24 set garp timer..........................10-24 clear garp timer..........................10-25 Chapter 11: Policy Classification Configuration Policy Classification Configuration Summary ....................11-1 Configuring Policy Profiles ..........................11-2 Purpose ..............................11-2 Commands ............................. 11-2 show policy profile ..........................11-2 set policy profile ..........................11-4 clear policy profile ..........................
Page 18 show port priority ..........................12-2 set port priority..........................12-3 clear port priority..........................12-3 Configuring Priority to Transmit Queue Mapping ..................12-4 Purpose ..............................12-4 Commands ............................. 12-4 show port priority-queue ........................12-4 set port priority-queue........................12-5 clear port priority-queue........................12-6 Configuring Quality of Service (QoS) ......................
Page 19 set logging server ..........................14-3 clear logging server .......................... 14-4 show logging default......................... 14-4 set logging default ..........................14-5 clear logging default ......................... 14-6 show logging application ........................14-6 set logging application ........................14-7 clear logging application ........................14-9 show logging local ..........................14-9 set logging local..........................
Page 20 clear sntp poll-timeout ........................14-35 set timezone ........................... 14-36 show sntp interface......................... 14-37 set sntp interface ..........................14-37 clear sntp interface ......................... 14-38 Configuring Node Aliases ........................... 14-40 Purpose ..............................14-40 Commands ............................14-40 show nodealias config ........................14-40 set nodealias ..........................14-41 clear nodealias config ........................
Page 21 Chapter 16: DHCP Server Configuration DHCP Overview ............................16-1 DHCP Relay Agent ..........................16-1 DHCP Server ............................16-1 Configuring a DHCP Server ........................16-2 Configuring General DHCP Server Parameters ................... 16-3 Purpose ..............................16-3 Commands ............................. 16-3 set dhcp ............................16-4 set dhcp bootp ..........................
Page 22 show dhcp pool configuration ......................16-29 Chapter 17: DHCP Snooping and Dynamic ARP Inspection DHCP Snooping Overview ........................... 17-1 DHCP Message Processing ........................17-1 Building and Maintaining the Database ....................17-2 Rate Limiting ............................17-3 Basic Configuration ..........................17-3 DHCP Snooping Commands ........................17-4 set dhcpsnooping ..........................
Page 23 show interface ..........................19-2 interface............................19-3 show ip interface..........................19-4 ip address ............................19-5 show running-config ......................... 19-6 no shutdown ............................. 19-6 no ip routing............................19-7 Configuring Tunnel Interfaces ........................19-8 Purpose ..............................19-8 Commands ............................. 19-8 interface tunnel ..........................19-8 tunnel source ............................
Page 24 split-horizon poison........................... 20-7 passive-interface ..........................20-8 receive-interface ..........................20-9 redistribute............................20-9 Configuring OSPF ............................20-11 Purpose ..............................20-11 OSPF Configuration Task List and Commands ................... 20-11 router id ............................20-12 router ospf ............................20-13 1583compatibility ..........................20-13 ip ospf enable ..........................20-14 ip ospf areaid ..........................
Page 25 create.............................. 20-43 address............................20-44 priority............................. 20-45 advertise-interval ..........................20-45 preempt ............................20-46 enable............................. 20-47 ip vrrp authentication-key ....................... 20-48 show ip vrrp ............................ 20-48 Configuring PIM-SM ........................... 20-49 Design Considerations ......................... 20-49 Purpose ..............................20-49 Commands ............................20-49 ip pimsm ............................20-50 ip pimsm staticrp..........................
Page 26 ipv6 mtu ............................22-12 Neighbor Cache and Neighbor Discovery Commands ................22-14 clear ipv6 neighbors ........................22-14 ipv6 nd dad attempts ........................22-15 ipv6 nd ns-interval .......................... 22-15 ipv6 nd reachable-time ........................22-16 ipv6 nd other-config-flag ......................... 22-17 ipv6 nd ra-interval ........................... 22-18 ipv6 nd ra-lifetime ...........................
Page 27 show ipv6 dhcp interface ........................ 24-14 show ipv6 dhcp statistics ........................ 24-16 clear ipv6 dhcp statistics......................... 24-17 show ipv6 dhcp pool ........................24-18 show ipv6 dhcp binding ........................24-18 Chapter 25: OSPFv3 Configuration Overview ............................... 25-1 Default Conditions ..........................25-2 Global OSPFv3 Configuration Commands ....................
Page 28 show ipv6 ospf..........................25-29 show ipv6 ospf area........................25-31 show ipv6 ospf abr.......................... 25-32 show ipv6 ospf asbr ........................25-33 show ipv6 ospf database ........................ 25-34 show ipv6 ospf interface ......................... 25-38 show ipv6 ospf interface stats ......................25-40 show ipv6 ospf neighbor......................... 25-42 show ipv6 ospf range........................
Page 29 clear macauthentication portquietperiod..................26-31 set macauthentication macinitialize ....................26-31 set macauthentication reauthentication ..................26-32 set macauthentication portreauthenticate..................26-32 set macauthentication macreauthenticate ..................26-33 set macauthentication reauthperiod ....................26-33 clear macauthentication reauthperiod .................... 26-34 set macauthentication significant-bits ..................... 26-35 clear macauthentication significant-bits ..................26-35 Configuring Multiple Authentication Methods .....................
Page 30 set maclock agefirstarrival ......................26-65 clear maclock agefirstarrival ......................26-66 set maclock move ........................... 26-66 set maclock trap ..........................26-67 Configuring Port Web Authentication (PWA) ....................26-68 About PWA ............................26-68 Purpose ..............................26-68 Commands ............................26-68 show pwa............................26-69 set pwa ............................
Page 31 Appendix A: Policy and Authentication Capacities Policy Capacities ............................A-1 Authentication Capacities ..........................A-2 Index Figures SecureStack C3 Startup Screen......................1-6 Sample CLI Defaults Description......................1-8 Performing a Keyword Lookup ......................1-8 Performing a Partial Keyword Lookup ....................1-9 Scrolling Screen Output........................1-9 Abbreviating a Command .........................
Page 32 show ciscodp port info Output Details ....................6-9 show lldp port local-info Output Details .................... 6-19 show lldp port remote-info Output Display..................6-22 show port status Output Details......................7-4 show port counters Output Details ..................... 7-5 show port cablestatus Output Details ....................7-7 show linkflap parameters Output Details ..................
Page 33 22-1 show ipv6 neighbor Output Details ....................22-25 22-2 show ipv6 route Output Details....................... 22-26 22-3 show ipv6 route preferences Output Details................... 22-27 22-4 show ipv6 summary Output Details ....................22-29 22-5 show ipv6 traffic Output Details ..................... 22-30 24-1 Output of show ipv6 dhcp interface Command................
Page 34 xxxii...
Page 35: About This Guide
• Establish and manage Virtual Local Area Networks (VLANs). • Establish and manage static and dynamically‐assigned policy classifications. • Establish and manage priority classification. • Configure IP routing and routing protocols, including RIP versions 1 and 2, OSPF, DVMRP, IRDP, and VRRP. • Configure IPv6 routing, including OSPFv3. • Configure security protocols, including 802.1X and RADIUS, SSHv2, PWA, MAC locking, and MAC authentication. • Configure access control lists (ACLs). Structure of This Guide The guide is organized as follows: Chapter 1, Introduction, provides an overview of the tasks that can be accomplished using the CLI interface, an overview of local management requirements, an overview of the device’s factory default settings, and information about using the Command Line Interface (CLI). Chapter 2, Configuring Switches in a Stack, provides information about how to configure and manage stacked switches. Chapter 3, Basic Configuration, provides how to set basic system properties, how to download a firmware image, how to configure WebView and Telnet, how to manage configuration files, how to set the login password, and how to exit the CLI. Chapter 4, Activating Licensed Features describes the commands used to enable advanced routing and IPv6 routing licensed features. SecureStack C3 Configuration Guide xxxiii...
Page 36 Structure of This Guide Chapter 5, Configuring System Power and PoE, describes the commands used to review and set system power and PoE parameters on devices that offer Power over Ethernet. Chapter 6, Discovery Protocol Configuration provides how to configure discovery protocols supported by the device. Chapter 7, Port Configuration, describes how to review and configure console port settings, and how to enable or disable switch ports and configure switch port settings, including port speed, duplex mode, auto‐negotiation, flow control, port mirroring, link aggegation and broadcast suppression. Chapter 8, SNMP Configuration, describes how to configure SNMP users and user groups, access rights, target addresses, and notification parameters. Chapter 9, Spanning Tree Configuration, describes how to review and set Spanning Tree bridge parameters for the device, including bridge priority, hello time, maximum aging time and forward delay; and how to review and set Spanning Tree port parameters, including port priority and path costs. Configuring the SpanGuard and Loop Protect functions is also described. Chapter 10, 802.1Q VLAN Configuration, describes how to create static VLANs, select the mode of operation for each port, establish VLAN forwarding (egress) lists, route frames according to VLAN ID, display the current ports and port types associated with a VLAN and protocol, create a secure management VLAN, and configure ports on the device as GVRP‐aware ports. Chapter 11, Policy Classification Configuration, describes how to create, change or remove user roles or profiles based on business‐specific use of network services; how to permit or deny access to specific services by creating and assigning classification rules which map user profiles to frame filtering policies; how to classify frames to a VLAN or Class of Service (CoS); and how to assign or unassign ports to policy profiles so that only ports activated for a profile will be allowed to transmit frames accordingly. Chapter 12, Port Priority Configuration, describes how to set the transmit priority of each port and configure a rate limit for a given port and list of priorities. Chapter 13, IGMP Configuration, describes how to configure Internet Group Management Protocol (IGMP) settings for multicast filtering.
Page 37: Related Documents
Chapter 24, DHCPv6 Configuration, describes the commands used to configure the Dynamic Host Configuration Protocol for IPv6. Chapter 25, OSPFv3 Configuration, describes the commands used to configure the Open Shortest Path First routing protocol for IPv6. Chapter 26, Authentication and Authorization Configuration, describes how to configure 802.1X authentication using EAPOL, how to configure RADIUS server, Secure Shell server, MAC authentication, MAC locking, Port Web Authentication, and IP access control lists (ACLs). Chapter 27, TACACS+ Configuration, provides information about the commands used to configure and monitor TACACS+ (Terminal Access Controller Access‐Control System Plus). Chapter 28 , sFlow Configuration provides information about the commands used to configure and monitor the sFlow system. Appendix A, Policy and Authentication Capacities, lists the policy and authentication capacities of the SecureStack C3 as of the date this document was published. Related Documents The following Enterasys Networks documents may help you to set up, control, and manage the SecureStack device: • Enterasys Firmware Feature Guides • SecureStack C3 Installation Guide(s) • SecureStack Redundant Power System Installation Guide Documents listed above, can be obtained from the World Wide Web in Adobe Acrobat Portable Document Format (PDF) at the following web site: http://www.enterasys.com/support/manuals/ SecureStack C3 Configuration Guide xxxv...
Page 38: Conventions Used In This Guide
Conventions Used in This Guide Conventions Used in This Guide The following conventions are used in the text of this document: Convention Description Bold font Indicates mandatory keywords, parameters or keyboard keys. italic font Indicates complete document titles. Courier font Used for examples of information displayed on the screen. Courier font in italics Indicates a user-supplied value, either required or optional.
Page 39: Getting Help
For additional support related to this switch or document, contact Enterasys Networks using one of the following methods: World Wide Web http://www.enterasys.com/support 1-800-872-8440 (toll-free in U.S. and Canada) or 1-978-684-1000 For the Enterasys Networks Support toll-free number in your country: Phone http://www.enterasys.com/support/contact/ support@enterasys.com Internet mail To expedite your message, type [C-SERIES] in the subject line. To send comments or suggestions concerning this document to the Technical Publications Department: techpubs@enterasys.com...
Page 40 Getting Help xxxviii About This Guide...
Page 41: Chapter 1: Introduction
SecureStack C3 CLI Overview The Enterasys Networks SecureStack C3 CLI interface allows you to perform a variety of network management tasks, including the following: • Use CLI commands to perform network management and switch configuration operations. • Download a new firmware image. • Assign IP address and subnet mask. • Select a default gateway. • Establish and manage Virtual Local Area Networks (VLANs). • Establish and manage policy profiles and classifications. • Establish and manage priority classification. • Configure IPv4 routing and routing protocols. • Configure IPv6 routing and routing protocols, including OSPFv3. • Configure security protocols, including 802.1X and RADIUS, SSHv2, PWA, MAC locking, and MAC authentication. • Configure access control lists (ACLs). Switch Management Methods The SecureStack C3 switch can be managed using the following methods: • Locally using a VT type terminal connected to the console port. • Remotely using a VT type terminal connected through a modem. SecureStack C3 Configuration Guide 1-1...
Page 42: Factory Default Settings
Factory Default Settings • Remotely using an SNMP management station. • In‐band through a Telnet connection. ® • In‐band using the Enterasys NetSight management application. • Remotely using WebView™, Enterasys Networks’ embedded web server application. The Installation Guide for your SecureStack C3 device provides setup instructions for connecting a terminal or modem to the switch. Factory Default Settings The following tables list factory default settings available on the SecureStack C3 switch. Table 1-1 Default Settings for Basic Switch Operation Feature Default Setting Switch Mode Defaults CDP discovery protocol Auto enabled on all ports. CDP authentication code Set to 00-00-00-00-00-00-00-00 CDP hold time...
Page 43 When the client is enabled, set to Challenge. RADIUS retries When the client is enabled, set to 3. RADIUS timeout When the client is enabled, set to 20 seconds. Rate limiting Disabled (globally and on all ports). SecureStack C3 Configuration Guide 1-3...
Page 44: Default Settings For Router Operation
Factory Default Settings Table 1-1 Default Settings for Basic Switch Operation (Continued) Feature Default Setting SNMP Enabled. SNTP Disabled. Spanning Tree Globally enabled and enabled on all ports. Spanning Tree edge port Edge port administrative status begins with the value set to false initially after administrative status the device is powered up.
Page 45 Set to 1 second. Retransmit interval (OSPF) Set to 5 seconds. RIP receive version Set to accept both version 1 and version 2. RIP send version Set to version 1. RIP offset No value applied. SNMP Enabled. SecureStack C3 Configuration Guide 1-5...
Page 46: Using The Command Line Interface
Enterasys SecureStack C3 Command Line Interface Enterasys Networks, Inc. 50 Minuteman Rd. Andover, MA 01810-1008 U.S.A. Phone: +1 978 684 1000 E-mail: support@enterasys.com WWW: http://www.enterasys.com (c) Copyright Enterasys Networks, Inc. 2008 Chassis Serial Number: 041800249041 Chassis Firmware Revision: 6.03.xx.xxxx C3(su)-> 1-6 Introduction...
Page 47: Logging In
(page 3-5) to change their own passwords. Administrators with Super User (su) access can use set system login command (page 3-4) to create and change user accounts, and the password command to change any local account password. SecureStack C3 Configuration Guide 1-7...
Page 48: Navigating The Command Line Interface
Using the Command Line Interface Navigating the Command Line Interface Getting Help with CLI Syntax The SecureStack C3 switch allows you to display usage and syntax information for individual commands by typing help or ? after the command. CLI Command Defaults Descriptions Each command description in this guide includes a section entitled “Defaults” which contains different information from the factory default settings on the switch described in Table 1‐1. The section defines CLI behavior if the user enters a command without typing optional parameters (indicated by square brackets [ ]). For commands without optional parameters, the defaults section lists “None”. For commands with optional parameters, this section describes how the CLI responds if the user opts to enter only the keywords of the command syntax. Figure 1‐2 provides an example. Figure 1-2 Sample CLI Defaults Description Syntax show port status [port-string] Defaults If port‐string is not specified, status information for all ports will be displayed. ...
Page 49: Performing A Partial Keyword Lookup
Learned 00-00-02-00-00-01 ge.1.3 Learned 00-00-02-00-00-02 ge.1.4 Learned 00-00-02-00-00-03 ge.1.5 Learned 00-00-02-00-00-04 ge.1.6 Learned 00-00-02-00-00-05 ge.1.7 Learned 00-00-02-00-00-06 ge.1.8 Learned 00-00-02-00-00-07 ge.1.9 Learned 00-00-02-00-00-08 ge.1.10 Learned --More-- Abbreviating and Completing Commands The SecureStack C3 switch allows you to abbreviate CLI commands and keywords down to the number of characters that will allow for a unique abbreviation. Figure 1‐6 shows how to abbreviate the show netstat command to sh net. SecureStack C3 Configuration Guide 1-9...
Page 50: Abbreviating A Command
Using the Command Line Interface Figure 1-6 Abbreviating a Command C3(su)->sh net Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address State ----- ------ ------ --------------------- --------------------- ------- 10.21.73.13.23 134.141.190.94.51246 ESTABLISHED 10.21.73.13.23 134.141.192.119.4724 ESTABLISHED *.80 LISTEN *.23 LISTEN 10.21.73.13.1030 134.141.89.113.514...
Page 51: About Securestack C3 Switch Operation In A Stack
This chapter provides information about configuring SecureStack C3 switches in a stack. For information about ... Refer to page ... About SecureStack C3 Switch Operation in a Stack Installing a New Stackable System of Up to Eight Units Installing Previously-Configured Systems in a Stack Adding a New Unit to an Existing Stack...
Page 52: Installing A New Stackable System Of Up To Eight Units
Installing a New Stackable System of Up to Eight Units • The console port on the manager switch remains active for out‐of‐band (local) switch management, but the console port on each member switch is deactivated. This enables you to set the IP address and system password using a single console port. Now each switch can be configured locally using only the manager’s console port, or inband using a remote device and the CLI set of commands described in this section. Once a stack is created (more than one switch is interconnected), the following procedure occurs: By default, unit IDs are arbitrarily assigned on a first‐come, first‐served basis. Unit IDs are saved against each module. Then, every time a board is power‐cycled, it will initialize with the same unit ID. This is important for port‐specific information (for example: ge.4.12 is the 12th Gigabit Ethernet port on Unit # 4). The management election process uses the following precedence to assign a management switch: Previously assigned / elected management unit b. Management assigned priority (values 1‐15) Hardware preference level d. Highest MAC Address Use the following recommended procedures when installing a new stackable system or adding a new unit to an existing stack. Important The following procedures assume that all units have a clean configuration from manufacturing. When adding a new unit to an already running stack, it is also assumed that the new unit is using the same firmware image version as other units in the stack.
Page 53: Installing Previously-Configured Systems In A Stack
(2) Clear the original unit number using the clear switch member command. Repeat Step 6 until all members have been renumbered in the order you desire. After the stack has been reconfigured, you can use the show switch unit command (“show switch” on page 2‐6) to physically confirm the identity of each unit. When you enter the command with a unit number, the MGR LED of the specified switch will blink for 10 seconds. The normal state of this LED is off for member units and steady green for the manager unit. Adding a New Unit to an Existing Stack Use the following procedure for installing a new unit to an existing stack configuration. This procedure assumes that the new unit being added has a clean configuration from manufacturing and is running the same firmware image version as other units in the stack. Ensure that power is off on the new unit being installed. Use one of the following methods to complete stack cable connections: – If the running stack uses a daisy chain topology, make the stack cable connections from the bottom of the stack to the new unit (that is, STACK DOWN port from the bottom unit of the running stack to the STACK UP port on the new unit). – If the running stack uses a ring stack topology, break the ring and make the stack cable connections to the new unit to close the ring. Apply power to the new unit. Creating a Virtual Switch Configuration You can create a configuration for a SecureStack C3 switch before adding the actual physical device to a stack. This preconfiguration feature includes configuring protocols on the ports of the “virtual switch.” SecureStack C3 Configuration Guide 2-3...
Page 54 Creating a Virtual Switch Configuration To create a virtual switch configuration in a stack environment: Display the types of switches supported in the stack, using the show switch switchtype command (page 2‐7). Using the output of the show switch switchtype command, determine the switch index (SID) of the model of switch being configured. Add the virtual switch to the stack using the set switch member command (page 2‐11). Use the SID of the switch model, determined in the previous step, and the unit ID that you want to assign to this switch member. Proceed to configure the ports of the virtual switch as you would do for physically present devices. The following example adds a C3G124‐24 mode to a stack as unit 2 of the stack. The first port on that virtual switch is then associated with VLAN 555. C3(su)->show switch switchtype Mgmt Code Switch Model ID Pref Version --- -------------------------------- ---- --------- C2G124-24 0xa08245 C2K122-24 0xa08245 C2G124-48 0xa08245 C2G124-48P 0xa08245 C2H124-48 0xa08245 C2H124-48P 0xa08245...
Page 55: Considerations About Using Clear Config In A Stack
Use clear config all when it is necessary to clear all config parameters, including stack unit IDs and switch priority values. This command will not clear the IP address nor will it remove an applied advanced feature license. • Use clear ip address to remove the IP address of the stack. • Use clear license to remove an applied license from a switch. Configuration parameters and stacking information can also be cleared on the master unit only by selecting the “restore configuration to factory defaults” option from the boot menu on switch startup. This selection will leave stacking priorities on all other units. Issues Related to Mixed Type Stacks Feature Support Because the SecureStack C2 and C3 switches have different hardware architectures, the functionality supported by the two switch types is different. When the two types of switches are mixed in a stack, the functionality supported will be the lowest common denominator of features supported on all platforms. Refer to the firmware Release Notes for information about supported features. Configuration Common Firmware Version Mixed stacking is supported by SecureStack C2 firmware version 5.02.xx.xxxx only. You can install the C2 firmware first, with the C3 switch in stand‐alone mode, or you can add the C3 switch to the stack and then copy the C2 firmware to the C3 switch using the set switch copy‐fw command (page 2‐10). After copying the C2 firmware to the C3 switch, you must reset the stack. Switch Manager It is recommended that a SecureStack C3 switch be made the manager of a mixed stack. Use the set switch movemanagement command (page 2‐11) to change the manager unit. SecureStack C3 Configuration Guide 2-5...
Page 56: Stacking Configuration And Management Commands
Stacking Configuration and Management Commands Stacking Configuration and Management Commands Purpose To review, individually configure and manage switches in a SecureStack C3 stack. Commands For information about... Refer to page... show switch show switch switchtype show switch stack-ports set switch set switch copy-fw 2-10 set switch description 2-10 set switch movemanagement 2-11 set switch member 2-11...
Page 57: Show Switch Switchtype
Unassigned Switch Type C3G124-24 Preconfigured Model Identifier C3G124-24 Plugged-in Model Identifier C3G124-24 Switch Status Switch Description Enterasys Networks, Inc. C3 -- Model C3G124-24 Detected Code Version 06.03.xx.xxxx Detected Code in Flash 03.01.20 Detected Code in Back Image 02.01.37 Up Time 0 days 6 hrs 37 mins 54 secs This example shows how to display status information for switch unit 1 in the stack:...
Page 58: Show Switch Stack-Ports
C3K122-24 0xa08245 C3K122-24P 0xa08245 This example shows how to display switch type information about SID1: C3(ro)->show switch switchtype 1 Switch Type 0x56950200 Model Identifier C2G124-24 Switch Description Enterasys Networks, Inc. C2 -- Model C2G124-24 Management Preference Expected Code Version 0xa08245 Supported Cards: Slot Card Index (CID) Model Identifier C2G124-24 show switch stack-ports Use this command to display various data flow and error counters on stack ports.
Page 59: Set Switch
Use this command to assign a switch ID, to set a switch’s priority for becoming the management switch if the previous management switch fails, or to change the switch unit ID for a switch in the stack. Syntax set switch {unit [priority value | renumber newunit]} Parameters unit Specifies a unit number for the switch. Value can range from 1 to 8. priority value Specifies a priority value for the unit. Valid values are 1 to 15 with higher values assigning higher priority. renumber newunit Specifies a new number for the unit. Note: This number must be a previously unassigned unit ID number. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 2-9...
Page 60: Set Switch Copy-Fw
set switch copy-fw Examples This example shows how to assign priority 3 to switch 5: C3(su)->set switch 5 priority 3 This example shows how to renumber switch 5 to switch 7: C3(su)->set switch 5 renumber 7 set switch copy-fw Use this command to replicate the code image file from the management switch to other switch(es) in the stack. Syntax set switch copy-fw [destination-system unit] Parameters destination‐system (Optional) Specifies the unit number of unit on which to copy the unit management image file. Defaults If destination‐system is not specified, the management image file will be replicated to all switches in the stack. Mode Switch command, read‐write. Example This example shows how to replicate the management image file to all switches in the stack: C3(su)->set switch copy-fw Are you sure you want to copy firmware? (y/n) y Code transfer completed successfully.
Page 61: Set Switch Movemanagement
Moving stack management will unconfigure entire stack including all interfaces. Are you sure you want to move stack management? (y/n) y set switch member Use this command to add a virtual member to a stack. This allows you to preconfigure a switch before the physical device is actually added to the stack. Syntax set switch member unit switch-id Parameters unit Specifies a unit number for the switch. switch‐id Specifies a switch ID (SID) for the switch. SIDs can be displayed with the show switch switchtype command. Defaults None. SecureStack C3 Configuration Guide 2-11...
Page 62: Clear Switch Member
clear switch member Mode Switch command, read‐write. Usage Refer to “Creating a Virtual Switch Configuration” on page 2‐3 for more information about how to add a virtual switch to a stack. Example This example shows how to specify a switch as unit 1 with a switch ID of 1: C3(su)->set switch member 1 1 clear switch member Use this command to remove a member entry from the stack. Syntax clear switch member unit Parameters unit Specifies the unit number of the switch. Defaults None. Mode Switch command, read‐write. Example This example shows how to remove the switch 5 entry from the stack: C3(su)->clear switch member 5 2-12 Configuring Switches in a Stack...
Page 63: Chapter 3: Basic Configuration
Set the switch IP address. 3-11 set ip address ip-address [mask ip-mask] [gateway ip-gateway] Download, activate, and verify new 3-45 copy tftp://tftp_server_ip_address/ firmware on the switch using TFTP filename system:image copy. 3-36 set boot system filename 3-26 show version SecureStack C3 Configuration Guide 3-1...
Page 64: Setting User Accounts And Passwords
Setting User Accounts and Passwords Table 3-2 Optional CLI Setup Commands Refer to Task CLI commands page... Save the active configuration. 3-41 save config Enable or disable SSH. 26-77 set ssh enable | disable Enable or disable Telnet. 3-37 set telnet {enable | disable} [inbound | outbound | all] Enable or disable HTTP 3-53...
Page 65: Show System Login
Number of days user passwords will remain valid before aging out. Configured with set system password aging (page 3-6). Username Login user names. Access Access assigned to this user account: super-user, read-write or read-only. State Whether this user account is enabled or disabled. SecureStack C3 Configuration Guide 3-3...
Page 66: Set System Login
set system login set system login Use this command to create a new user login account, or to disable or enable an existing account. The SecureStack C3 switch supports up to 16 user accounts, including the admin account, which cannot be deleted. Syntax set system login username {super-user | read-write | read-only} {enable | disable} Parameters username Specifies a login name for a new or existing user. This string can be a maximum of 80 characters, although a maximum of 16 characters is recommended for proper viewing in the show system login display. super‐user | Specifies the access privileges for this user. read‐write | read‐only enable | disable Enables or disables the user account. Defaults None. Mode Switch command, super user. Usage Login accounts, including the admin user account, can be locked out after multiple failed attempts to log in to the system. Refer to “show system lockout” on page 3‐7 and “set system lockout” on page 3‐8 for more information about lockout parameters.
Page 67: Set Password
None. Mode Switch command, super user. Example This example shows how to remove the “netops” user account: C3(su)->clear system login netops set password Use this command to change system default passwords or to set a new login password on the CLI. Syntax set password [username] Parameters username (Only available to users with super‐user access.) Specifies a system default or a user‐configured login account name. By default, the SecureStack C3 switch provides the following account names: ro for Read‐Only access. rw for Read‐Write access. admin for Super User access. (This access level allows Read‐Write access to all modifiable parameters, including user accounts.) Defaults None. Mode Switch command, read‐write. Switch command, super‐user. Usage Read‐Write users can change their own passwords. Super Users (Admin) can change any password on the system. If you forget the password for the admin user account, you can reset the password to the default password value by pressing the password reset button on the switch. SecureStack C3 Configuration Guide 3-5...
Page 68: Set System Password Length
set system password length Examples This example shows how a super‐user would change the Read‐Write password from the system default (blank string): C3(su)->set password rw Please enter new password: ******** Please re-enter new password: ******** Password changed. C3(su)-> This example shows how a user with Read‐Write access would change his password: C3(su)->set password Please enter old password: ******** Please enter new password: ******** Please re-enter new password: ******** Password changed.
Page 69: Set System Password History
Use this command to set the number of previously used user login passwords that will be checked for password duplication. This prevents duplicate passwords from being entered into the system with the set password command. Syntax set system password history size Parameters size Specifies the number of passwords checked for duplication. Valid values are 0 to 10. Defaults None. Mode Switch command, super user. Example This example shows how to configure the system to check the last 10 passwords for duplication C3(su)->set system password history 10 show system lockout Use this command to display settings for locking out users after failed attempts to log in to the system. Syntax show system lockout SecureStack C3 Configuration Guide 3-7...
Page 70: Set System Lockout
set system lockout Parameters None. Defaults None. Mode Switch command, super user. Example This example shows how to display user lockout settings. In this case, switch defaults have not been changed: C3(su)->show system lockout Lockout attempts: 3 Lockout time: 15 minutes. Table 3‐3 provides an explanation of the command output. These settings are configured with the set system lockout command (“set system lockout” on page 3‐8). Table 3-3 show system lockout Output Details Output Field What It Displays... Lockout attempts Number of failed login attempts allowed before a read-write or read-only user’s account will be disabled.
Page 71: Setting Basic Switch Properties
3-17 set system enhancedbuffermode 3-18 set system temperature 3-18 clear system temperature 3-19 show time 3-20 set time 3-20 show summertime 3-21 set summertime 3-22 set summertime date 3-22 set summertime recurring 3-23 SecureStack C3 Configuration Guide 3-9...
Page 72: Show Ip Address
show ip address For information about... Refer to page... clear summertime 3-24 set prompt 3-24 show banner motd 3-25 set banner motd 3-25 clear banner motd 3-26 show version 3-26 set system name 3-27 set system location 3-28 set system contact 3-28 set width 3-29...
Page 73: Set Ip Address
C3 Switch Operation in a Stack” on page 2‐1. mask ip‐mask (Optional) Sets the system’s subnet mask. gateway ip‐gateway (Optional) Sets the system’s default gateway (next‐hop device). Defaults If not specified, ip‐mask will be set to the natural mask of the ip‐address and ip‐gateway will be set to the ip‐address. Mode Switch command, read‐write. Usage Parameters must be entered in the order shown (host IP, then mask, then gateway) for the command to be accepted. Example This example shows how to set the system IP address to 10.1.10.1 with a mask of 255.255.128.0: C3(su)->set ip address 10.1.10.1 mask 255.255.128.0 clear ip address Use this command to clear the system IP address. Syntax clear ip address Parameters None. Defaults None. SecureStack C3 Configuration Guide 3-11...
Page 74: Show Ip Protocol
show ip protocol Mode Switch command, read‐write. Example This example shows how to clear the system IP address: C3(rw)->clear ip address show ip protocol Use this command to display the method used to acquire a network IP address for switch management. Syntax show ip protocol Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the method used to acquire a network IP address: C3(su)->show ip protocol System IP address acquisition method: dhcp set ip protocol Use this command to specify the protocol used to acquire a network IP address for switch management.
Page 75: Show System
Not Installed and/or Not Operating Fan1-Status Fan2-Status ----------- ----------- Temp-Alarm ----------- Thermal Threshold: 58% Temp alarm max threshold: 100% Temp alarm trap: disabled Temp alarm syslog: disabled Uptime d,h:m:s Logout -------------- ------- 0,20:36:49 0 min SecureStack C3 Configuration Guide 3-13...
Page 76: Show System Hardware
show system hardware The following table provides an explanation of the command output. Table 3-4 show system Output Details Output What It Displays... System contact Contact person for the system. Default of a blank string can be changed with the set system contact command (“set system contact” on page 3-28). System location Where the system is located.
Page 77: Show System Utilization
Parameters Display information about the processor running on the switch. storage Display information about the overall memory usage on the switch. process Display information about the processes running on the switch. Defaults None. Mode Switch command, read‐only. Examples This example shows how to display the system’s CPU utilization: C3(ro)->show system utilization cpu CPU Utilization Threshold Traps enable: Threshold = 80.0% Total CPU Utilization: Switch 5 sec 1 min 5 min ----------------------------------------------- SecureStack C3 Configuration Guide 3-15...
Page 78: Set System Utilization
set system utilization This example shows how to display the system’s overall memory usage: C3(ro)->show system utilization storage Storage Utilization: Type Description Size(Kb) Available (Kb) --------------------------------------------------------------- RAM device 262144 97173 Flash Images, Config, Other 31095 8094 This example shows how to display information about the processes running on the system. Only partial output is shown. C3(ro)->show system utilization process Switch:1 CPU:1 Name 5Sec 1Min 5Min ---------------------------------------------------------- c157930 ipMapForwardingTask 3.60% 3.02% 3.48%...
Page 79: Clear System Utilization
C3(rw)->clear system utilization C3(rw)->show system utilization cpu CPU Utilization Threshold Traps enable: Threshold = 80.0% Total CPU Utilization: Switch 5 sec 1 min 5 min ------------------------------------------------- show system enhancedbuffermode Use this command to display the status of enhanced buffer mode, which optimizes buffer distribution into a single CoS queue operation for standalone switches or non‐stacked switches. Syntax show system enhancedbuffermode Parameters None. SecureStack C3 Configuration Guide 3-17...
Page 80: Set System Enhancedbuffermode
set system enhancedbuffermode Defaults None. Mode Switch command, read‐write. Example This example shows how to display enhanced buffer mode status: C3(su)->show system enhancedbuffermode enable Optimized system buffer distribution Disable set system enhancedbuffermode Use this command to enable or disable enhanced buffer mode, which optimizes buffer distribution into a single CoS queue operation for standalone switches or non‐stacked switches. Executing this command will reset the switch, so the system prompts you to confirm whether you want to proceed. Syntax set system enhancedbuffermode {enable | disable} Parameters enable | disable Enables or disables enhanced buffer mode. Defaults None. Mode Switch command, read‐write. Example This example shows how to enable enhanced buffer mode: C3(su)->set system enhancedbuffermode enable Changes in the enhanced buffer mode will require resetting this unit.
Page 81: Clear System Temperature
Trap alerts are disabled by default. Overtemp threshold is 100% by default. Mode Switch command, read‐write. Usage On the platforms that support this feature, temperature sensors are located in several different locations within the device. Threshold calibrations have been calculated separately for each platform. The thermal overtemp threshold is the high‐water mark that, when reached, triggers an alert to warn the system administrator that the device is operating at high temperatures. When a high temperature alert condition occurs, the CPU LED on the front panel of the switch will flash red. In addition, if enabled, a syslog message will be logged and/or an SNMP trap will be sent. The values set with this command can be viewed with the show system command. Example The following example enables sending SNMP traps and sets the overtemp threshold to 60%. C3(su)->set system temperature trap enable overtemp-threshold 60 clear system temperature Use this command to reset system high temperature parameters to their default values, on the platforms that support this feature. Syntax clear system temperature Parameters None. Defaults None. SecureStack C3 Configuration Guide 3-19...
Page 82: Show Time
show time Mode Switch command, read‐write. Usage This command resets all the high temperature parameters to their default values: • Syslog alerts are disabled by default. • Trap alerts are disabled by default. • Overtemp threshold is 100% by default. Example This example resets all high temperature parameters to their defaults. C3(su)->clear system temperature show time Use this command to display the current time of day in the system clock. Syntax show time Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the current time. The output shows the day of the week, month, day, and the time of day in hours, minutes, and seconds and the year: C3(su)->show time THU SEP 05 09:21:57 2002 set time Use this command to change the time of day on the system clock.
Page 83: Show Summertime
Start : SUN APR 04 02:00:00 2004 : SUN OCT 31 02:00:00 2004 Offset: 60 minutes (1 hours 0 minutes) Recurring: yes, starting at 2:00 of the first Sunday of April and ending at 2:00 of the last Sunday of October SecureStack C3 Configuration Guide 3-21...
Page 84: Set Summertime
set summertime set summertime Use this command to enable or disable the daylight savings time function. Syntax set summertime {enable | disable} [zone] Parameters enable | disable Enables or disables the daylight savings time function. zone (Optional) Applies a name to the daylight savings time settings. Defaults If a zone name is not specified, none will be applied. Mode Switch command, read‐only. Example This example shows how to enable daylight savings time function: C3(su)->set summertime enable set summertime date Use this command to configure specific dates to start and stop daylight savings time. These settings will be non‐recurring and will have to be reset annually. Syntax set summertime date start_month start_date start_year start_hr_min end_month end_date end_year end_hr_min [offset_minutes] Parameters start_month ...
Page 85: Set Summertime Recurring
Specifies the day of the week to restart daylight savings time. start_hr_min Specifies the time of day to restart daylight savings time. Format is hh:mm. end_week Specifies the week of the month to end daylight savings time. end_day Specifies the day of the week to end daylight savings time. end_hr_min Specifies the time of day to end daylight savings time. Format is hh:mm. offset_minutes (Optional) Specifies the amount of time in minutes to offset daylight savings time from the non‐daylight savings time system setting. Valid values are 1 ‐ 1440. Defaults If an offset is not specified, none will be applied. Mode Switch command, read‐write. Example This example shows how set daylight savings time to recur starting on the first Sunday of April at 2 a.m. and ending the last Sunday of October at 2 a.m. with an offset time of one hour: C3(su)->set summertime recurring first Sunday April 02:00 last Sunday October 02:00 60 SecureStack C3 Configuration Guide 3-23...
Page 86: Clear Summertime
clear summertime clear summertime Use this command to clear the daylight savings time configuration. Syntax clear summertime Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the daylight savings time configuration: C3(su)->clear summertime set prompt Use this command to modify the command prompt. Syntax set prompt prompt_string Parameters prompt_string Specifies a text string for the command prompt. Note: A prompt string containing a space in the text must be enclosed in quotes as shown in the example below.
Page 87: Show Banner Motd
Note: Banner message text must be enclosed in beginning and ending double quotation marks. The message itself cannot contain any additional double quotation marks. Syntax set banner motd message Parameters message Specifies a message of the day. This is a text string that needs to be in double quotes if any spaces are used. Use a \n for a new line and \t for a tab (eight spaces). Defaults None. Mode Switch command, read‐write. Example This example shows how to set the message of the day banner to read: “This system belongs to XYZ Corporation. Use of this system is strictly limited to authorized personnel.” SecureStack C3 Configuration Guide 3-25...
Page 88: Clear Banner Motd
Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the message of the day banner to a blank string: C3(rw)->clear banner motd show version Use this command to display hardware and firmware information. Refer to “Downloading a Firmware Image” on page 3‐32 for instructions on how to download a firmware image. Syntax show version Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display version information. Please note that you may see different information displayed, depending on the type of hardware. C3(su)->show version Copyright (c) 2007 by Enterasys Networks, Inc. 3-26 Basic Configuration...
Page 89: Set System Name
Parameters string (Optional) Specifies a text string that identifies the system. Note: A name string containing a space in the text must be enclosed in quotes as shown in the example below. Defaults If string is not specified, the system name will be cleared. Mode Switch command, read‐write. Example This example shows how to set the system name to Information Systems: C3(su)->set system name “Information Systems” SecureStack C3 Configuration Guide 3-27...
Page 90: Set System Location
set system location set system location Use this command to identify the location of the system. Syntax set system location [string] Parameters string (Optional) Specifies a text string that indicates where the system is located. Note: A location string containing a space in the text must be enclosed in quotes as shown in the example below. Defaults If string is not specified, the location name will be cleared. Mode Switch command, read‐write.
Page 91: Set Width
[default] Parameters screenwidth Sets the number of terminal columns. Valid values are 50 to 150. default (Optional) Makes this setting persistent for all future sessions (written to NV‐RAM). Defaults None. Mode Switch command, read‐write. Usage The number of rows of CLI output displayed is set using the set length command as described in “set length” on page 3‐29. Example This example shows how to set the terminal columns to 50: C3(su)->set width 50 set length Use this command to set the number of lines the CLI will display. This command is persistent (written to NV‐RAM). Syntax set length screenlength Parameters screenlength Sets the number of lines in the CLI display. Valid values are 0, which disables the scrolling screen feature described in “Displaying Scrolling Screens” on page 1‐9, and from 5 to 512. SecureStack C3 Configuration Guide 3-29...
Page 92: Show Logout
show logout Defaults None. Mode Switch command, read‐write. Example This example shows how to set the terminal length to 50: C3(su)->set length 50 show logout Use this command to display the time (in seconds) an idle console or Telnet CLI session will remain connected before timing out. Syntax show logout Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the CLI logout setting: C3(su)->show logout Logout currently set to: 10 minutes. set logout Use this command to set the time (in minutes) an idle console or Telnet CLI session will remain connected before timing out. Syntax set logout timeout Parameters timeout Sets the number of minutes the system will remain idle before timing out. ...
Page 93: Show Console
(Optional) Displays the number of stop bits. Defaults If no parameters are specified, all settings will be displayed. Mode Switch command, read‐only. Example This example shows how to display all console settings: C3(su)->show console Baud Flow Bits StopBits Parity ------ ------- ---- ---------- ------ 9600 Disable none set console baud Use this command to set the console port baud rate. Syntax set console baud rate Parameters rate Sets the console baud rate. Valid values are: 300, 600, 1200, 2400, 4800, 5760, 9600, 14400, 19200, 38400, and 115200. SecureStack C3 Configuration Guide 3-31...
Page 94: Downloading A Firmware Image
Downloading a Firmware Image Defaults None. Mode Switch command, read‐write. Example This example shows how to set the console port baud rate to 19200: C3(su)->set console baud 19200 Downloading a Firmware Image You can upgrade the operational firmware in the SecureStack C3 switch without physically opening the switch or being in the same location. There are two ways to download firmware to the switch: • Via TFTP download. This procedure uses a TFTP server connected to the network and downloads the firmware using the TFTP protocol. For details on how to perform a TFTP download using the copy command, refer to “copy” on page 3‐45. For information on setting TFTP timeout and retry parameters, refer to “set tftp timeout” on page 3‐47 and “set tftp retry” on page 3‐48. • Via the serial (console) port. This procedure is an out‐of‐band operation that copies the firmware through the serial port to the switch. It should be used in cases when you cannot connect the switch to perform the in‐band copy download procedure via TFTP. Serial console download has been successfully tested with the following applications: – HyperTerminal Copyright 1999 – Tera Term Pro Version 2.3 Any other terminal applications may work but are not explicitly supported. The C3 switch allows you to download and store dual images. The backup image can be downloaded and selected as the startup image by using the commands described in this section. Downloading from a TFTP Server To perform a TFTP download, proceed as follows: If you have not already done so, set the switch’s IP address using the set ip address command ...
Page 95 When the XMODEM transfer is complete, the following message and header information will display: [Boot Menu] 4 Ready to receive the file with XMODEM/CRC..Ready to RECEIVE File xcode.bin in binary mode Send several Control-X characters to cCKCKCKCKCKCKCK XMODEM transfer complete, checking CRC..Verified operational code CRC. SecureStack C3 Configuration Guide 3-33...
Page 96: Reverting To A Previous Image
Downloading a Firmware Image The following Enterasys Header is in the image: MD5 Checksum....fe967970996c4c8c43a10cd1cd7be99a Boot File Identifier....0x0517 Header Version....0x0100 Image Type......0x82 Image Offset....0x004d Image length....0x006053b3 Ident Strings Length....0x0028 Ident Strings....C2G124-24 C2G124-48 C2H124-48 C2K124_24 Image Version Length....0x7 Image Version Bytes.....0x30 0x2e 0x35 0x2e 0x30 0x2e 0x34 (0.5.0.4) From the boot menu options screen, type 2 to display the baud rate selection screen again.
Page 97: Reviewing And Selecting A Boot Firmware Image
Refer to page... show boot system 3-35 set boot system 3-36 show boot system Use this command to display the firmware image the switch loads at startup. Syntax show boot system Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the switch’s boot firmware image: C3(su)->show boot system Current system image to boot: bootfile SecureStack C3 Configuration Guide 3-35...
Page 98: Set Boot System
set boot system set boot system Use this command to set the firmware image the switch loads at startup. Syntax set boot system filename Parameters filename Specifies the name of the firmware image file. Defaults None. Mode Switch command, read‐write. Usage This command allows you to set the firmware image to be loaded at startup. You can choose to reset the system to use the new firmware image immediately, or you can choose to only specify the new image to be loaded the next time the switch is rebooted. You can use the dir command to display the “Active” image and the “Boot” image, which will be the image loaded at the next system reboot. Note: If you are changing the firmware image to a version earlier than the current version, refer to “Reverting to a Previous Image”...
Page 99: Starting And Configuring Telnet
Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display Telnet status: C3(su)->show telnet Telnet inbound is currently: ENABLED Telnet outbound is currently: ENABLED set telnet Use this command to enable or disable Telnet on the switch. Syntax set telnet {enable | disable} [inbound | outbound | all] SecureStack C3 Configuration Guide 3-37...
Page 100: Telnet
telnet Parameters enable | disable Enables or disables Telnet services. inbound | (Optional) Specifies inbound service (the ability to Telnet to this switch), outbound | all outbound service (the ability to Telnet to other devices), or all (both inbound and outbound). Defaults If not specified, both inbound and outbound Telnet service will be enabled. Mode Switch command, read‐write. Example This example shows how to disable inbound and outbound Telnet services: C3(su)->set telnet disable all Disconnect all telnet sessions and disable now (y/n)? [n]: y All telnet sessions have been terminated, telnet is now disabled. telnet Use this command to start a Telnet connection to a remote host. The SecureStack C3 switch allows ...
Page 101: Managing Switch Configuration And Files
Refer to page... show snmp persistmode 3-40 set snmp persistmode 3-40 save config 3-41 3-41 show file 3-42 show config 3-43 configure 3-44 copy 3-45 delete 3-46 show tftp settings 3-46 set tftp timeout 3-47 SecureStack C3 Configuration Guide 3-39...
Page 102: Show Snmp Persistmode
show snmp persistmode For information about... Refer to page... clear tftp timeout 3-47 set tftp retry 3-48 clear tftp retry 3-48 show snmp persistmode Use this command to display the configuration persistence mode setting. Syntax show snmp persistmode Parameters None. Defaults None. Mode Switch command, read‐only. Usage By default, the mode is set to “auto save,” which automatically saves configuration changes at specific intervals. If the mode is set to “manual,” configuration commands are never automatically saved. In order to make configuration changes persistent when the mode is manual, the save config command must be issued as described in “Configuration Persistence Mode” on page 3‐39. Example This example shows how to display the configuration persistence mode setting. In this case, ...
Page 103: Save Config
Sets the configuration persistence mode to manual. In order to make configuration changes persistent, the save config command must be issued as described in “save config” on page 3‐41. This mode is useful for reverting back to old configurations. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the configuration persistence mode to manual: C3(su)->set snmp persistmode manual save config Use this command to save the running configuration. If applicable, this command will save the configuration to all switch members in a stack. Syntax save config Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to save the running configuration: C3(su)->save config Use this command to list configuration and image files stored in the file system. Syntax dir [filename] SecureStack C3 Configuration Guide 3-41...
Page 104: Show File
show file Parameters filename (Optional) Specifies the file name or directory to list. Defaults If filename is not specified, all files in the system will be displayed. Mode Switch command, read‐only. Example This example shows how to list all the configuration and image files in the system. The display indicates which image file is the Active file and which image file is the Boot file that will be used the next time the system reboots. C3(su)->dir Images: ================================================================== Filename: c3-series_06.03.00.0029 (Active) Version: 06.03.00.0029 Size: 9411584 (bytes) Date: Fri Aug 1 06:55:23 2008 CheckSum: 6126a7aadfdf05150afb6eca51982302 Compatibility: <platform specific> Filename: c3-series_06.03.00.0030 (Boot) Version: 06.03.00.0030 Size: 9411584 (bytes) Date:...
Page 105: Show Config
41 : set snmp user public authentication md5 :xxxxxxxxx: encryption des privacy :xxxxxxxxxx: 42 : 43 : set snmp view viewname All subtree 1 44 : 45 : ! show config Use this command to display the system configuration or write the configuration to a file. Syntax show config [all | facility] [outfile {configs/filename}] SecureStack C3 Configuration Guide 3-43...
Page 106: Configure
configure Parameters (Optional) Displays default and non‐default configuration settings. facility (Optional) Specifies the exact name of one facility for which to show configuration. For example, enter “router” to show only router configuration. outfile (Optional) Specifies that the current configuration will be written to a text file in the configs/ directory. configs/filename Specifies a filename in the configs/ directory to display. Defaults By default, show config will display all non‐default configuration information for all facilities. Mode Switch command, read‐only. Usage The separate facilities that can be displayed by this command are identified in the display of the current configuration by a # preceding the facility name. For example, “#port” indicates the facility name “port.” Examples This example shows how to write the current configuration to a file named save_config2: C3(rw)->show config all outfile configs/save_config2 This example shows how to display configuration for the facility “port”. C3(rw)->show config port This command shows non-default configurations only. Use 'show config all' to show both default and non-default configurations. begin #***** NON-DEFAULT CONFIGURATION ***** #port...
Page 107: Copy
{destination | system:image} Parameters source Specifies location and name of the source file to copy. Options are a local file path in the configs or logs directory, or the URL of a TFTP, Secure FTP (SFTP), server. or Secure Copy (SCP) destination Specifies location and name of the destination where the file will be copied. Options are a local file path in the configs directory, or the URL of a TFTP, server. SFTP, or SCP system:image The required destination of an image file. Note: Only TFTP can be used to download an image file. Defaults None. Mode Switch command, read‐write. Usage SFTP and SCP can only be used to transfer configuration files or the logs/current.log file. You cannot use SFTP or SCP to download images (system:image). SecureStack C3 Configuration Guide 3-45...
Page 108: Delete
delete Examples This example shows how to download an image via TFTP: C3(su)->copy tftp://10.1.192.34/version01000 system:image This example shows how to download a configuration file to the configs directory: C3(su)->copy tftp://10.1.192.1/Jan1_2004.cfg configs/Jan1_2004.cfg This example shows how to upload a configuration file from the configs directory using SFTP. C3(su)->copy configs/Jan1_2009.cfg sftp://user:passwd@10.1.192.1/Jan1_2009.cfg delete Use this command to remove an image or a CLI configuration file from the switch. Syntax delete filename Parameters filename Specifies the local path name to the file. Valid directories are /images and /configs.44. Defaults None. Mode Switch command, read‐write. Usage Use the dir command (page 3‐41) to display current image and configuration file names. Example This example shows how to delete the “Jan1_2004.cfg” configuration file: C3(su)->delete configs/Jan1_2004.cfg show tftp settings Use this command to display TFTP settings used by the switch during data transfers using TFTP. Syntax show tftp settings Parameters None.
Page 109: Set Tftp Timeout
TFTP max retry: 5 set tftp timeout Use this command to configure how long TFTP will wait for a reply of either an acknowledgement packet or a data packet during a data transfer. Syntax set tftp timeout seconds Parameters seconds Specifies the number of seconds to wait for a reply. The valid range is from 1 to 30 seconds. Default value is 2 seconds. Defaults None. Mode Switch command, read‐write. Example This example sets the timeout period to 4 seconds. C3(rw)->set tftp timeout 4 clear tftp timeout Use this command to reset the TFTP timeout value to the default value of 2 seconds. Syntax clear tftp timeout Parameters None. SecureStack C3 Configuration Guide 3-47...
Page 110: Set Tftp Retry
set tftp retry Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the timeout value to the default of 2 seconds. C3(rw)-> clear tftp timeout set tftp retry Use this command to configure how many times TFTP will resend a packet, either an acknowledgement packet or a data packet. Syntax set tftp retry retry Parameters retry Specifies the number of times a packet will be resent. The valid range is from 1 to 1000. Default value is 5 retries. Defaults None. Mode Switch command, read‐write. Example This example sets the retry count to 3. C3(rw)->set tftp retry 3 clear tftp retry Use this command to reset the TFTP retry value to the default value of 5 retries.
Page 111: Clearing And Closing The Cli
C3(rw)-> clear tftp retry Clearing and Closing the CLI Purpose To clear the CLI screen or to close your CLI session. Commands For information about... Refer to page... 3-49 exit 3-50 cls (clear screen) Use this command to clear the screen for the current CLI session. Syntax Parameters None Defaults None. Mode Switch command, read‐only. Example This example shows how to clear the CLI screen: C3(su)->cls SecureStack C3 Configuration Guide 3-49...
Page 112: Exit
exit exit Use either of these commands to leave a CLI session. Syntax exit Parameters None. Defaults None. Mode Switch command, read‐only. Usage By default, switch timeout occurs after 15 minutes of user inactivity, automatically closing your CLI session. Use the set logout command (page 3‐30) to change this default. Example This example shows how to exit a CLI session: C3(su)->exit Resetting the Switch Purpose To reset one or more switches, and to clear the user‐defined configuration parameters. Commands For information about... Refer to page... reset 3-50 clear config 3-51 reset Use this command to reset the switch without losing any user‐defined configuration settings. Syntax reset [unit] Parameters unit (Optional) Specifies a unit to be reset.
Page 113: Clear Config
Are you sure you want to reload the switch? (y/n) y Reloading switch 1. This switch is manager of the stack. STACK: detach 3 units clear config Use this command to clear the user‐defined configuration parameters. Syntax clear config [all] Parameters all (Optional) Clears user‐defined configuration parameters (and stack unit numbers and priorities, if applicable). Defaults If all is not specified, stacking configuration parameters will not be cleared. Mode Switch command, read‐write. Usage When using the clear config command to clear configuration parameters in a stack, it is important to remember the following: SecureStack C3 Configuration Guide 3-51...
Page 114: Using And Configuring Webview
Using and Configuring WebView • Use clear config to clear configuration parameters without clearing stack unit IDs. This command WILL NOT clear stack parameters and avoids the process of re‐numbering the stack. • Use clear config all when it is necessary to clear all configuration parameters, including stack unit IDs (if applicable) and switch priority values. • Use the clear ip address command to clear the IP address. Configuration parameters and stacking information can also be cleared on the master unit only by selecting option 10 (restore configuration to factory defaults) from the boot menu on switch startup. This selection will leave stacking priorities on all other units, if applicable. Example This example shows how to clear configuration parameters (including stacking parameters, if applicable): C3(su)->clear config all Using and Configuring WebView Purpose By default, WebView (The Enterasys Networks embedded web server for switch configuration and management tasks) is enabled on TCP port number 80 on the SecureStack C3 switch. You can verify WebView status, and enable or disable WebView using the commands described in this section. WebView can also be securely used over SSL port 443, if SSL is enabled on the switch. By default, SSL is disabled. To use WebView, type the IP address of the switch in your browser. To use WebView over SSL, type in https:// then the IP address of the switch. For example, https://172.16.2.10. Commands For information about... Refer to page... show webview 3-52 set webview...
Page 115: Set Webview
WebView is Enabled. set webview Use this command to enable or disable WebView on the switch. Syntax set webview {enable | disable} Parameters enable | disable Enable or disable WebView on the switch. Defaults None. Mode Switch command, read‐write. Usage It is good practice for security reasons to disable HTTP access on the switch when finished configuring with WebView, and then to only enable WebView on the switch when changes need to be made. Example This example shows how to disable WebView on the switch: C3(rw)->set webview disable show ssl Use this command to display SSL status. Syntax show ssl Parameters None. SecureStack C3 Configuration Guide 3-53...
Page 116: Set Ssl
set ssl Defaults None. Mode Switch command, read‐only. Example This example shows how to display SSL status: C3(rw)->show ssl SSL status: Enabled set ssl Use this command to enable or disable the use of WebView over SSL port 443. By default, SSL is disabled on the switch. This command can also be used to reinitialize the hostkey that is used for encryption. Syntax set ssl {enabled | disabled | reinitialize | hostkey reinitialize} Parameters enabled | disabled Enables or disables the ability to use WebView over SSL. reinitialize Stops and then restarts the SSL process. hostkey reinitialize Stops SSL, regenerates new keys, and then restarts SSL. Defaults None. Mode Switch command, read‐write. Example This example shows how to enable SSL: C3(rw)->set ssl enabled...
Page 117: Gathering Technical Support Information
Refer to page... show support 3-55 show support Use this command to display switch information for troubleshooting. Syntax show support Parameters None. Defaults None. Mode Switch command, read‐only. Usage This command initiates a number of show commands to easily gather basic information from an installed device. To use this command, set your console to capture the output to a file first, before executing the command, since the output is extensive. Output from the following commands is gathered by this command: • show version • show logging buffer • show port status • show system utilization process • show system utilization storage • show config Example There is no display example because the output of this command is quite lengthy. SecureStack C3 Configuration Guide 3-55...
Page 118: Configuring Hostprotect
Configuring Hostprotect Configuring Hostprotect Purpose This feature enables rate limiting of host bound traffic on SecureStack C3 switches, to assist in the prevention of Denial of Service issues. When enabled, the hostprotect functionality applies a 64 kbps meter to control plane traffic, such as BPDUs or LACP packets, destined for the host processor. Commands For information about... Refer to page... show system hostprotect 3-56 set system hostprotect 3-56 clear system hostprotect 3-57 show system hostprotect Use this command to display the status of the hostprotect feature. Syntax show system hostprotect Parameters None. Defaults Hostprotect is enabled by default. Mode Switch command, read‐only.
Page 119: Clear System Hostprotect
C3(rw)->set system hostprotect disable Changes in the host protect mode will require resetting this stack. Are you sure you want to continue? (y/n)y clear system hostprotect Use this command to return the hostprotect status to the default of enabled. Syntax clear system hostprotect Parameters None. Defaults The default state is enabled. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 3-57...
Page 120 clear system hostprotect Usage Changing the hostprotect status requires a reset of the switch or stack of switches. If more than two priority queue mappings exist and you execute this command to reset the hostprotect status to enabled, the command will not complete and you will get a warning message. Example This example attempts to return the hostprotect status to the default, but the command cannot complete because more than two priority queue mappings exist. C3(rw)->clear system hostprotect Changes in the host protect mode will require resetting this stack. Are you sure you want to continue? (y/n)y Error: Could not set system host protect to default 3-58 Basic Configuration...
Page 121: Chapter 4: Activating Licensed Features
INCREMENT advrouter 2006.0127 27-jan-2011 0123456789AB 0123456789AB The contents of the six fields, from the left, indicate: • Type—the type of license. For the SecureStack C3, the value in this field is always “INCREMENT.” • Feature—description of the feature being licensed. For example, ”advrouter” as shown in the character string above. • Date‐based version (DBV)—a date‐related string. For the SecureStack C3, the value in this field is not significant. • Expiration type—indicates whether the license is a permanent or an evaluation license. If the license is an evaluation license, this field will contain the expiration date of the license. If the license is a permanent license, this field will contain the word “permanent.” • Key—the license key. • Host ID—the serial number of the switch to which this license applies. When activating licenses on SecureStack devices, we recommend that you copy and paste the license character string, rather than entering the text manually. Licensing Procedure in a Stack Environment The licenses for all members of an operating stack can be activated during a single CLI session, by following these steps: Obtain valid licenses for all members of the stack from the Enterasys Customer Portal. SecureStack C3 Configuration Guide 4-1...
Page 122: Adding A New Member To A Licensed Stack
Clearing, Showing, and Applying Licenses Optionally, note the serial numbers of the switches in the stack. You can use the show system hardware command (page 3‐14) to display the switch serial numbers. Note: Since license keys are applied to the correct stack member switch automatically, based on the switch serial number that is part of the license string, you should know the serial numbers of the switches in order to enable the licenses of the member switches first, before the master unit.
Page 123: Set License
Refer to “Licensing Procedure in a Stack Environment” on page 4‐1 for more information. When activating licenses with this command, Enterasys Networks recommends that you copy and paste the entire license character string, rather than enter the text manually. If you enter the character string manually, ensure that you exactly match the capitalization of the character string sent to you. Every license is associated with a specific hardware platform, based on the serial number of the hardware platform. If you need to move a license from one hardware platform to another, you must contact Enterasys Customer Support to arrange for re‐hosting of the license. Example This example shows how to activate a permanent license key on the switch with serial number . In this example, the switch is a stand‐alone unit so its unit number is 1. 075103099041 C3(rw)->set license INCREMENT advrouter 2008.0212 permanent DF6A8558E5AB 075103099041 Validating license on unit 1 License successfully validated and set on unit 1 C3(rw)-> SecureStack C3 Configuration Guide 4-3...
Page 124: Show License
show license show license Use this command to display license key information for switches with activated licenses. Syntax show license [unit number] Parameters unit number (Optional) Specifies the switch for which to display license information. Refer to Chapter 2, Configuring Switches in a Stack, for more information about stack unit IDs, or numbers. Defaults If no unit number is specified, license key information for all switches in the stack is displayed. Mode Switch command, read‐only. Usage Licenses can be displayed, applied, and cleared only with the license commands described in this chapter. General configuration commands such as show config or clear config do not affect licenses. Example This example shows how to display license key information for switch unit 1 in the stack. C3(ro)->show license unit 1 unit 1 key: INCREMENT advrouter 2006.0728 permanent 31173CAC6495 045100039001 status: Active clear license Use this command to clear the license key settings..
Page 125 Example This example shows how to clear the licensed feature : advrouter C3(rw)->clear license featureId advrouter SecureStack C3 Configuration Guide 4-5...
Page 126 clear license 4-6 Activating Licensed Features...
Page 127: Commands
For information about... Refer to page... show inlinepower set inlinepower threshold set inlinepower trap set inlinepower detectionmode show port inlinepower set port inlinepower show inlinepower Use this command to display system power properties. Syntax show inlinepower Parameters None. Defaults None. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 5-1...
Page 128: Set Inlinepower Threshold
set inlinepower threshold Example This example shows how to display system power properties: C3(su)->show inlinepower Detection Mode : auto Unit Status Power(W) Consumption(W) Usage(%) Threshold(%) Trap ---- ------ -------- -------------- -------- ------------ ---- auto 0.00 0.00 enable Table 5‐1 provides an explanation of the command output. Table 5-1 show inlinepower Output Details Output What It Displays... Detection Mode Displays the PD detection mode used by the switch.
Page 129: Set Inlinepower Trap
{disable | enable} module-number Parameters disable | enable Disables or enables inline power trap messaging. module‐number Specifies the module or unit on which to disable or enable trap messaging. Defaults Sending of traps is disabled by default. Mode Switch command, read‐write. Usage The module’s or unit’s power usage threshold must be set using the set inlinepower threshold command as described on page 5‐2. Example This example shows how to enable inline power trap messaging on module 1: C3(su)->set inlinepower trap enable 1 set inlinepower detectionmode Use this command to specify the method the switch will use to detect PDs (powered devices) connected to its ports. Syntax set inlinepower detectionmode {auto | ieee) SecureStack C3 Configuration Guide 5-3...
Page 130: Show Port Inlinepower
show port inlinepower Parameters auto Specifies that the switch will use the standard 802.3af detection method first. If that fails, then the switch will use the legacy (pre 802.3af standard) capacitance method of detection. ieee Specifies that the switch will only use the standard 802.3af detection method. Defaults Default detection mode is auto. Mode Switch command, read‐write. Usage This command is used to specify how the switch should detect PDs connected to its ports. The PoE hardware in the switches can use the IEEE standard 802.3af (resistor‐based) method or a proprietary method using capacitor detection. If auto is configured, the switch will first use the IEEE resistor‐based detection method, and if that fails, the switch will use the capacitor‐based detection method. If ieee is configured, only the IEEE resistor‐based detection method will be used. Example This example sets the switch’s PD detection mode to IEEE standard 802.3af only. (su)->set inlinepower detectionmode ieee show port inlinepower Use this command to display all ports supporting PoE. Syntax show port inlinepower [port-string] Parameters port‐string (Optional) Displays information for specific PoE port(s). Defaults If not specified, information for all PoE ports will be displayed.
Page 131: Set Port Inlinepower
{[admin {off | auto}] [priority {critical | high | low}] [type type]} Parameters port‐string Specifies the port(s) on which to configure PoE. admin off | auto Sets the PoE administrative state to off (disabled) or auto (on). priority critical | Sets the port(s) priority for the PoE allocation algorithm to critical high | low (highest), high or low. type type Specifies a string describing the type of device connected to a port. Defaults None. Mode Switch command, read‐write. Example This example shows how to enable PoE on port 3.1 with critical priority: C3(su)->set port inlinepower ge.3.1 admin auto priority critical SecureStack C3 Configuration Guide 5-5...
Page 132 set port inlinepower 5-6 Configuring System Power and PoE...
Page 133: Configuring Cdp
Configuring Link Layer Discovery Protocol and LLDP-MED 6-13 Configuring CDP Purpose To review and configure the Enterasys CDP discovery protocol. This protocol is used to discover network topology. When enabled, this protocol allows Enterasys devices to send periodic PDUs about themselves to neighboring devices. Commands The commands used to review and configure the CDP discovery protocol are listed below. For information about... Refer to page... show cdp set cdp state set cdp auth set cdp interval set cdp hold-time clear cdp show neighbors SecureStack C3 Configuration Guide 6-1...
Page 134: Show Cdp
show cdp show cdp Use this command to display the status of the CDP discovery protocol and message interval on one or more ports. Syntax show cdp [port-string] Parameters port‐string (Optional) Displays CDP status for a specific port. For a detailed description of possible port‐string values, refer to ” on “Port String Syntax Used in the CLI page 7‐1. Defaults If port‐string is not specified, all CDP information will be displayed. Mode Switch command, read‐only. Example This example shows how to display CDP information for ports ge.1.1 through ge.1.9: C3(su)->show cdp 1.1-9 CDP Global Status :auto-enable CDP Version Supported :30 hex CDP Hold Time :180 CDP Authentication Code...
Page 135: Set Cdp State
{auto | disable | enable} [port-string] Parameters auto | disable | Auto‐enables, disables or enables the CDP protocol on the specified port(s). enable In auto‐enable mode, which is the default mode for all ports, a port automatically becomes CDP‐enabled upon receiving its first CDP message. port‐string (Optional) Enables or disables CDP on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, the CDP state will be globally set. Mode Switch command, read‐write. Examples This example shows how to globally enable CDP: C3(su)->set cdp state enable This example shows how to enable the CDP for port ge.1.2: C3(su)->set cdp state enable This example shows how to disable the CDP for port ge.1.2: C3(su)->set cdp state disable SecureStack C3 Configuration Guide 6-3...
Page 136: Set Cdp Auth
set cdp auth set cdp auth Use this command to set a global CDP authentication code. Syntax set cdp auth auth-code Parameters auth‐code Specifies an authentication code for the CDP protocol. This can be up to 16 hexadecimal values separated by commas. Defaults None. Mode Switch command, read‐write. Usage The authentication code value determines a switch’s CDP domain. If two or more switches have the same CDP authentication code, they will be entered into each other’s CDP neighbor tables. If they have different authentication codes, they are in different domains and will not be entered into each other’s CDP neighbor tables. A switch with the default authentication code (16 null characters) will recognize all switches, no matter what their authentication code, and enter them into its CDP neighbor table. Example This example shows how to set the CDP authentication code to 1,2,3,4,5,6,7,8: C3(su)->set cdp auth 1,2,3,4,5,6,7,8: set cdp interval Use this command to set the message interval frequency (in seconds) of the CDP discovery protocol. Syntax set cdp interval frequency Parameters frequency Specifies the transmit frequency of CDP messages in seconds.Valid values ...
Page 137: Set Cdp Hold-Time
None. Mode Switch command, read‐write. Example This example shows how to set CDP hold time to 60 seconds: C3(su)->set cdp hold-time 60 clear cdp Use this command to reset CDP discovery protocol settings to defaults. Syntax clear cdp {[state] [port-state port-string] [interval] [hold-time] [auth-code]} Parameters state (Optional) Resets the global CDP state to auto‐enabled. port‐state port‐string (Optional) Resets the port state on specific port(s) to auto‐enabled. interval (Optional) Resets the message frequency interval to 60 seconds. hold‐time (Optional) Resets the hold time value to 180 seconds. auth‐code (Optional) Resets the authentication code to 16 bytes of 00 (00‐00‐00‐ 00‐00‐00‐00‐00). Defaults At least one optional parameter must be entered. SecureStack C3 Configuration Guide 6-5...
Page 138: Show Neighbors
show neighbors Mode Switch command, read‐write. Example This example shows how to reset the CDP state to auto‐enabled: C3(su)->clear cdp state show neighbors This command displays Neighbor Discovery information for either the CDP or Cisco DP protocols. Syntax show neighbors [port-string] Parameters port‐string (Optional) Specifies the port or ports for which to display Neighbor Discovery information. Defaults If no port is specified, all Neighbor Discovery information is displayed. Mode Switch command, read‐only. Usage This command displays information discovered by both the CDP and the Cisco DP protocols. Example This example displays Neighbor Discovery information for all ports. C3(su)->show neighbors Port Device ID Port ID Type Network Address ------------------------------------------------------------------------------ ge.1.1 00036b8b1587 12.227.1.176...
Page 139: Configuring Cisco Discovery Protocol
6-10 set ciscodp port 6-10 clear ciscodp 6-12 show ciscodp Use this command to display global Cisco discovery protocol information. Syntax show ciscodp Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display global Cisco DP information. C3(su)->show ciscodp CiscoDP :Enabled Timer :5 Holdtime (TTl): 180 SecureStack C3 Configuration Guide 6-7...
Page 140: Show Ciscodp Port Info
show ciscodp port info Device ID : 001188554A60 Last Change : WED NOV 08 13:19:56 2006 Table 6‐2 provides an explanation of the command output. Table 6-2 show ciscodp Output Details Output Field What It Displays... CiscoDP Whether Cisco DP is globally enabled or disabled. Auto indicates that Cisco DP will be globally enabled only if Cisco DP PDUs are received.
Page 141: Set Ciscodp Status
{auto | disable | enable} Parameters auto Globally enable only if Cisco DP PDUs are received. disable Globally disable Cisco discovery protocol. enable Globally enable Cisco discovery protocol. Defaults None. Mode Switch command, read‐write. Example This example shows how to globally enable CiscoDP: C3(su)->set ciscodp state enable set ciscodp timer Use this command to set the number of seconds between Cisco discovery protocol PDU transmissions. Syntax set ciscodp timer seconds SecureStack C3 Configuration Guide 6-9...
Page 142: Set Ciscodp Holdtime
set ciscodp holdtime Parameters seconds Specifies the number of seconds between Cisco DP PDU transmissions. Valid values are from 5 to 254 seconds. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the Cisco DP timer to 120 seconds. C3(su)->set ciscodp timer 120 set ciscodp holdtime Use this command to set the time to live (TTL) for Cisco discovery protocol PDUs. This is the amount of time, in seconds, neighboring devices will hold PDU transmissions from the sending device. Syntax set ciscodp holdtime hold-time Parameters hold‐time Specifies the time to live for Cisco DP PDUs. Valid values are from 10 to 255 seconds. Defaults None. Mode Switch command, read‐write. Example This example shows how to set Cisco DP hold time to 180 seconds: C3(su)->set ciscodp hold-time 180 set ciscodp port Use this command to set the status, voice VLAN, extended trust mode, and CoS priority for ...
Page 143 Instructs attached phone to overwrite the 802.1p tag of traffic transmitted by the device connected to it with the specified value, when the trust mode of the port is set to untrusted. Value can range from 0 to 7, with 0 indicating the lowest priority. port‐string Specifies the port(s) on which status will be set. Defaults • Status: enabled • Voice VLAN: none • Trust mode: trusted • CoS value: 0 Mode Switch mode, read‐write. Usage The following points describe how the Cisco DP extended trust settings work on the switch. • A Cisco DP port trust status of trusted or untrusted is only meaningful when a Cisco IP phone is connected to a switch port and a PC or other device is connected to the back of the Cisco IP phone. • A Cisco DP port state of trusted or untrusted only affects tagged traffic transmitted by the device connected to the Cisco IP phone. Untagged traffic transmitted by the device connected to the Cisco IP phone is unaffected by this setting. • If the switch port is configured to a Cisco DP trust state of trusted (with the trusted yes parameter of this command), this setting is communicated to the Cisco IP phone instructing it to allow the device connected to it to transmit traffic containing any CoS or Layer 2 802.1p marking. SecureStack C3 Configuration Guide 6-11...
Page 144: Clear Ciscodp
clear ciscodp • If the switch port is configured to a Cisco DP trust state of untrusted (trusted no), this setting is communicated to the Cisco IP phone instructing it to overwrite the 802.1p tag of traffic transmitted by the device connected to it to 0, by default, or to the value specified by the cos parameter of this command. • There is a one‐to‐one correlation between the value set with the cos parameter and the 802.1p value assigned to ingressed traffic by the Cisco IP phone. A value of 0 equates to an 802.1p priority of 0. Therefore, a value of 7 is given the highest priority. Note: The Cisco Discovery Protocol must be globally enabled using the set ciscodp status command before operational status can be set on individual ports. Examples This example shows how to set the Cisco DP port voice VLAN ID to 3 on port ge.1.6 and enable the port operational state. C3(rw)->set ciscodp port status enable vvid 3 This example shows how to set the Cisco DP extended trust mode to untrusted on port ge.1.5 and ...
Page 145: Configuring Link Layer Discovery Protocol And Lldp-Med
LLDP‐MED is an enhancement to LLDP that provides the following benefits: • Auto‐discovery of LAN policies, such as VLAN id, 802.1p priority, and DiffServ codepoint settings, leading to “plug‐and‐play” networking • Device location and topology discovery, allowing creation of location databases and, in the case of VoIP, provision of E911 services • Extended and automated power management of Power over Ethernet endpoints • Inventory management, allowing network administrators to track their network devices and to determine their characteristics, such as manufacturer, software and hardware versions, and serial or asset numbers The information sent by an LLDP‐enabled device is extracted and tabulated by its peers. The communication can be done when information changes or on a periodic basis. The information tabulated is aged to ensure that it is kept up to date. Ports can be configured to send this information, receive this information, or both send and receive. Either LLDP or LLDP‐MED, but not both, can be used on an interface between two devices. A switch port uses LLDP‐MED when it detects that an LLDP‐MED‐capable device is connected to it. LLDP information is contained within a Link Layer Discovery Protocol Data Unit (LLDPDU) sent in a single 802.3 Ethernet frame. The information fields in LLDPDU are a sequence of short, variable‐length, information elements known as TLVs — type, length, and value fields where: • Type identifies what kind of information is being sent • Length indicates the length of the information string in octets • Value is the actual information that needs to be sent The LLDP standard specifies that certain TLVs are mandatory in transmitted LLDPDUs, while others are optional. You can configure on a port‐specific basis which optional LLDP and LLDP‐ MED TLVs should be sent in LLDPDUs. Purpose To review and configure LLPD and LLPD‐MED. SecureStack C3 Configuration Guide 6-13...
Page 146: Commands
Configuring Link Layer Discovery Protocol and LLDP-MED Commands The commands used to review and configure the CDP discovery protocol are listed below. For information about... Refer to page... show lldp 6-15 show lldp port status 6-16 show lldp port trap 6-16 show lldp port tx-tlv 6-17 show lldp port location-info 6-17 show lldp port local-info 6-18 show lldp port remote-info 6-21...
Page 147: Show Lldp
Notification Tx Interval MED Fast Start Count Tx-Enabled Ports : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12; Rx-Enabled Ports : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12; Trap-Enabled Ports : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12; MED Trap-Enabled Ports : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12; SecureStack C3 Configuration Guide 6-15...
Page 148: Show Lldp Port Status
show lldp port status show lldp port status Use this command to display the LLDP status of one or more ports. The command lists the ports that are enabled to send and receive LLDP PDUs. Ports are enabled or disabled with the set lldp port status command. Syntax show lldp port status [port-string] Parameters port‐string (Optional) Displays LLDP status for one or a range of ports. Defaults If port‐string is not specified, LLDP status information will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display LLDP port status information for all ports. C3(ro)->show lldp port status Tx-Enabled Ports : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12 Rx-Enabled Ports : ge.1.1-60; ge.2.1-24; ge.3.1-30; ge.4.1-12 show lldp port trap Use this command to display the ports that are enabled to send an LLDP notification when a ...
Page 149: Show Lldp Port Tx-Tlv
Aggr Frame Cap Pol Loc PoE ------- ---- ---- ---- --- ---- ---- ---- --- --- ---- ---- --- --- --- --- ge.1.1 ge.1.2 ge.1.3 show lldp port location-info Use this command to display configured location information for one or more ports. Ports are configured with a location value using the set lldp port location‐info command. Syntax show lldp port location-info [port-string] SecureStack C3 Configuration Guide 6-17...
Page 150: Show Lldp Port Local-Info
show lldp port local-info Parameters port‐string (Optional) Displays port location information for one or a range of ports. Defaults If port‐string is not specified, port location configuration information will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display port location information for three ports. C3(ro)->show lldp port location-info ge.1.1-3 Ports Type Location -------- ------------- ------------------------- ge.1.1 ELIN 1234567890 ge.1.2 ELIN 1234567890 ge.1.3 ELIN 1234567890 show lldp port local-info Use this command to display the local system information stored for one or more ports. You can use this information to detect misconfigurations or incompatibilities between the local port and ...
Page 151: Show Lldp Port Local-Info Output Details
Optional basic LLDP TLV. Value is the administratively assigned name for the system. Sys Desc Optional basic LLDP TLV. Value is sysDescr object defined in RFC 3418. Sys Cap Supported/Enabled Optional basic LLDP TLV. System capabilities, value can be bridge and/or router. SecureStack C3 Configuration Guide 6-19...
Page 152 show lldp port local-info Table 6-4 show lldp port local-info Output Details (Continued) Output Field What it Displays... Auto-Neg Supported/Enabled IEEE 802.3 Extensions MAC-PHY Configuration/Status TLV. Auto- negotiation supported and enabled settings should be the same on the two systems attached to the same link. Auto-Neg Advertised IEEE 802.3 Extensions MAC-PHY Configuration/Status TLV.
Page 153: Show Lldp Port Remote-Info
Device Type : Communication Device Endpoint (class III) Sys Name : AVE0E143D Sys Cap Supported/Enabled : bridge,telephone/bridge Auto-Neg Supported/Enabled : yes/yes Auto-Neg Advertised : 10BASE-T, 10BASE-TFD : 100BASE-TX, 100BASE-TXFD : pause, Spause Operational Speed/Duplex/Type : 100/full/TX Network Policy (app/tag/vlanId/cos/dscp) : voice/untagged/0/6/46 SecureStack C3 Configuration Guide 6-21...
Page 154: Show Lldp Port Network-Policy
show lldp port network-policy Hardware Revision : 4610D01A Firmware Revision : b10d01b2_7.bin Software Revision : a10d01b2_7.bin Serial Number : 05GM42004348 Manufacturer : Avaya Model Number : 4610 Note that the information fields displayed by the show lldp port remote‐info command will vary, depending on the type of remote device that is connected to the port. Table 6‐5 describes the output fields that are unique to the remote system information database. Refer to Table 6‐4 on page 19 for descriptions of the information fields that are common to both the local and the remote system information databases. Table 6-5 show lldp port remote-info Output Display Output Field What it Displays...
Page 155: Set Lldp Tx-Interval
Use this command to set the time, in seconds, between successive LLDP frame transmissions initiated by changes in the LLDP local system information. Syntax set lldp tx-interval frequency Parameters frequency Specifies the number of seconds between transmissions of LLDP frames. Value can range from 5 to 32,768 seconds. The default is 30 seconds. SecureStack C3 Configuration Guide 6-23...
Page 156: Set Lldp Hold-Multiplier
set lldp hold-multiplier Defaults None. Mode Switch command, read‐write. Example This example sets the transmit interval to 20 seconds. C3(rw)->set lldp tx-interval 20 set lldp hold-multiplier Use this command to set the time‐to‐live value used in LLDP frames sent by this device. The time‐ to‐live for LLDPDU data is calculated by multiplying the transmit interval by the hold multiplier value. Syntax set lldp hold-multiplier multiplier-val Parameters multiplier‐val Specifies the multiplier to apply to the transmit interval to determine the time‐to‐live value. Value can range from 2 to 10. Default value is 4. Defaults None. Mode Switch command, read‐write. Example This example sets the transmit interval to 20 seconds and the hold multiplier to 5, which will configure a time‐to‐live of 100 to be used in the TTL field in the LLDPDU header. C3(rw)->set lldp tx-interval 20 C3(rw)->set lldp hold-multiplier 5 set lldp trap-interval Use this command to set the minimum interval between LLDP notifications sent by this device. ...
Page 157: Set Lldp Med-Fast-Repeat
Switch command, read‐write. Example This example sets the minimum interval between LLDP traps to 10 seconds. C3(rw)->set lldp trap-interval 10 set lldp med-fast-repeat Network connectivity devices transmit only LLDP TLVs in LLDPDUs until they detect that an LLDP‐MED endpoint device has connected to a port. At that point, the network connectivity device starts sending LLDP‐MED TLVs at a fast start rate on that port. Use this command to set the number of successive LLDPDUs (with LLDP‐MED TLVs) to be sent for one complete fast start interval. Syntax set lldp med-fast-repeat count Parameters count Specifies the number of fast start LLDPDUs to be sent when an LLDP‐MED endpoint device is detected. Value can range from 1 to 10. Default is 3. Defaults None. Mode Switch command, read‐write. Example This example sets the number of fast start LLDPDUs to be sent to 4. C3(rw)->set lldp med-fast-repeat 4 SecureStack C3 Configuration Guide 6-25...
Page 158: Set Lldp Port Status
set lldp port status set lldp port status Use this command to enable or disable transmitting and processing received LLDPDUs on a port or range of ports. Syntax set lldp port status {tx-enable | rx-enable | both | disable} port-string Parameters tx‐enable Enables transmitting LLDPDUs on the specified ports. rx‐enable Enables receiving and processing LLDPDUs from remote systems on the specified ports. both Enables both transmitting and processing received LLDPDUs on the specified ports. disable Disables both transmitting and processing received LLDPDUs on the specified ports. port‐string Specifies the port or range of ports to be affected. Defaults None. Mode Switch command, read‐write.
Page 159: Set Lldp Port Med-Trap
Defaults None. Mode Switch command, read‐write. Example This example enables transmitting LLDP‐MED traps on ports ge.1.1 through ge.1.6. C3(rw)->set lldp port med-trap enable ge.1.1-6 set lldp port location-info Use this command to configure LLDP‐MED location information on a port or range of ports. Currently, only Emergency Call Services (ECS) Emergency Location Identification Number (ELIN) is supported. Syntax set lldp port location-info elin elin-string port-string Parameters elin Specifies that the ECS ELIN data format is to be used. elin‐string Specifies the location identifier. Value can be from 10 to 25 numerical characters. port‐string Specifies the port or range of ports to be affected. SecureStack C3 Configuration Guide 6-27...
Page 160: Set Lldp Port Tx-Tlv
set lldp port tx-tlv Defaults None. Mode Switch command, read‐write. Example After you configure a location information value, you must also configure the port to send the Location Information TLV with the set lldp port tx‐tlv command. This example configures the ELIN identifier 5551234567 on ports ge.1.1 through ge.1.6 and then configures the ports to send the Location Information TLV. C3(rw)->set lldp port location-info 5551234567 ge.1.1-6 C3(rw)->set lldp port tx-tlv med-loc ge.1.1-6 set lldp port tx-tlv Use this command to select the optional LLDP and LLDP‐MED TLVs to be transmitted in LLDPDUs by the specified port or ports. Use the show lldp port local‐info command to display the values of these TLVs for the port. Syntax set lldp port tx-tlv {[all] | [port-desc] [sys-name] [sys-desc] [sys-cap] [mgmt- addr] [vlan-id] [stp] [lacp] [gvrp] [mac-phy] [poe] [link-aggr] [max-frame] [med- cap] [med-pol] [med-loc] [med-poe]} port-string Parameters...
Page 161 LLDP‐MED Network Policy TLV. Values sent include application name, VLAN type (tagged or untagged), VLAN ID, and both Layer 2 and Layer 3 priorities associated with application, for all applications enabled on the port. See the set lldp port network‐policy command for more information. med‐loc LLDP‐MED Location Identification TLV. Value sent is the ECS ELIN value configured on the port. See the set lldp port location‐info command for more information. med‐poe LLDP‐MED Extended Power via MDI TLV. Values sent include the Power Limit (total power the port is capable of sourcing over a maximum length cable) and the power priority configured on the port. Only valid for PoE‐enabled ports. port‐string Specifies the port or range of ports to be affected. Defaults None. Mode Switch command, read‐write. Example This example configures the management address, MED capability, MED network policy, and MED location identification TLVs to be sent in LLDPDUs by port 1.1. C3(rw)->set lldp port tx-tlv mgmt-addr med-cap med-pol med-loc ge.1.1 SecureStack C3 Configuration Guide 6-29...
Page 162: Set Lldp Port Network-Policy
set lldp port network-policy set lldp port network-policy Use this command to configure LLDP network policies for a set of applications on a port or range of ports. The policies configured with this command are sent in LLDPDUs as LLDP‐MED Network Policy TLVs. Multiple Network Policy TLVs can be sent in a single LLDPDU. Syntax set lldp port network-policy {all | voice | voice-signaling | guest-voice | guest-voice-signaling | softphone-voice | video-conferencing | streaming-video | video-signaling} [state {enable | disable}] [tag {tagged | untagged}] [vid {vlan-id | dot1p}] [cos cos-value] [dscp dscp-value] port-string Parameters Configures all applications.
Page 163: Clear Lldp
C3(rw)->set lldp port tx-tlv med-pol ge.2.1 clear lldp Use this command to return LLDP parameters to their default values. Syntax clear lldp {all | tx-interval | hold-multiplier | trap-interval | med-fast-repeat} Parameters Returns all LLDP configuration parameters to their default values, including port LLDP configuration parameters. tx‐interval Returns the number of seconds between transmissions of LLDP frames.to the default of 30 seconds. hold‐multiplier Returns the multiplier to apply to the transmit interval to determine the time‐to‐live value to the default value of 4. trap‐interval Returns the minimum time between LLSP trap transmissions to the default value of 5 seconds. med‐fast‐repeat Returns the number of fast start LLDPDUs to be sent when an LLDP‐ MED endpoint device is detected to the default of 3. SecureStack C3 Configuration Guide 6-31...
Page 164: Clear Lldp Port Status
clear lldp port status Defaults None. Mode Switch command, read‐write. Example This example returns the transmit interval to the default value of 30 seconds. C3(rw)->clear lldp tx-interval clear lldp port status Use this command to return the port status to the default value of both (both transmitting and processing received LLDPDUs are enabled). Syntax clear lldp port status port-string Parameters port‐string Specifies the port or range of ports to be affected. Defaults None. Mode Switch command, read‐write. Example This example returns port 1.1 to the default state of enabled for both transmitting and processing received LLDPDUs. C3(rw)->clear lldp port status ge.1.1 clear lldp port trap Use this command to return the port LLDP trap setting to the default value of disabled.
Page 165: Clear Lldp Port Med-Trap
Specifies the port or range of ports to be affected. Defaults None. Mode Switch command, read‐write. Example This example returns port 1.1 to the default LLDP‐MED trap state of disabled. C3(rw)->clear lldp port med-trap ge.1.1 clear lldp port location-info Use this command to return the port ECS ELIN location setting to the default value of null. Syntax clear lldp port location-info elin port-string Parameters elin Specifies that the ECS ELIN location information value should be cleared. port‐string Specifies the port or range of ports to be affected. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 6-33...
Page 166: Clear Lldp Port Network-Policy
clear lldp port network-policy Example This example returns the location information ELIN value on port ge.1.1 to the default value of null. C3(rw)->clear lldp port location-info elin ge.1.1 clear lldp port network-policy Use this command to return LLDP network policy for a set of applications on a port or range of ports to default values. Syntax clear lldp port network-policy {all | voice | voice-signaling | guest-voice | guest-voice-signaling | softphone-voice | video-conferencing | streaming-video | video-signaling} {[state] [tag] [vid] [cos] [dscp]} port-string Parameters Applies command to all applications.
Page 167: Clear Lldp Port Tx-Tlv
Disables the System Description optional basic LLDP TLV from being transmitted in LLDPDUs. sys‐cap Disables the System Capabilities optional basic LLDP TLV from being transmitted in LLDPDUs. mgmt‐addr Disables the Management Address optional basic LLDP TLV from being transmitted in LLDPDUs. vlan‐id Disables the Port VLAN ID IEEE 802.1 Extensions TLV from being transmitted in LLDPDUs. Disables the Spanning Tree information defined by Protocol Identity IEEE 802.1 Extensions TLV from being transmitted in LLDPDUs. lacp Disables the LACP information defined by Protocol Identity IEEE 802.1 Extensions TLV from being transmitted in LLDPDUs. gvrp Disables the GVRP information defined by Protocol Identity IEEE 802.1 Extensions TLV from being transmitted in LLDPDUs. mac‐phy Disables the MAC‐PHY Configuration/Status IEEE 802.3 Extensions TLV from being transmitted in LLDPDUs. Disables the Power via MDI IEEE 802.3 Extensions TLV from being transmitted in LLDPDUs. Only valid for PoE‐enabled ports. link‐aggr Disables the Link Aggregation IEEE 802.3 Extensions TLV from being transmitted in LLDPDUs. max‐frame Disables the Maximum Frame Size IEEE 802.3 Extensions TLV from being transmitted in LLDPDUs. med‐cap Disables the LLDP‐MED Capabilities TLV from being transmitted in LLDPDUs. SecureStack C3 Configuration Guide 6-35...
Page 168 clear lldp port tx-tlv med‐pol Disables the LLDP‐MED Network Policy TLV from being transmitted in LLDPDUs. med‐loc Disables the LLDP‐MED Location Identification TLV from being transmitted in LLDPDUs. med‐poe Disables the LLDP‐MED Extended Power via MDI TLV from being transmitted in LLDPDUs. Only valid for PoE‐enabled ports. port‐string Specifies the port or range of ports to be affected. Defaults None. Mode Switch command, read‐write. Example This example disables the management address, MED capability, MED network policy, and MED location identification TLVs from being sent in LLDPDUs by port 1.1. C3(rw)->clear lldp port tx-tlv mgmt-addr med-cap med-pol med-loc ge.1.1 6-36 Discovery Protocol Configuration...
Page 169: Port Configuration Summary
Port Mirroring 7-36 Link Aggregation Control Protocol (LACP) 7-42 Configuring Protected Ports 7-56 Port Configuration Summary Port String Syntax Used in the CLI Commands requiring a port‐string parameter use the following syntax to designate port type, slot location, and port number: port type.unit_or_slot number.port number Where port type can be: fe for 100‐Mbps Ethernet ge for 1‐Gbps Ethernet tg for 10‐Gbps Ethernet host for the host port vlan for vlan interfaces lag for IEEE802.3 link aggregation ports Where unit_or_slotnumber can be: 1 ‐ 8 for switch units in a stack SecureStack C3 Configuration Guide 7-1...
Page 170: Reviewing Port Status
Reviewing Port Status Where port number depends on the device. The highest valid port number is dependent on the number of ports in the device and the port type. Port Slot/Unit Parameters Used in the CLI The “unit” parameter is often used interchangeably with “module” in the standalone switch CLI to indicate a module slot location. Examples Note: You can use a wildcard (*) to indicate all of an item. For example, fe.3.* would represent all 100Mbps Ethernet (fe) ports in slot 3, and ge.3 * would represent all 1-Gigabit Ethernet (ge) ports in slot 3.
Page 171: Show Port
Port 3.14 enabled show port status Use this command to display operating and admin status, speed, duplex mode and port type for one or more ports on the device. Syntax show port status [port-string] Parameters port‐string (Optional) Displays status for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, status information for all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display status information for ge.3.14: C3(su)->show port status 3.14 Port Alias Oper Admin Speed Duplex Type SecureStack C3 Configuration Guide 7-3...
Page 172: Show Port Counters
show port counters (truncated) Status Status ------------ -------------- ------- ------- -------- ------- ------------- 3.14 BaseT RJ45 Table 7‐1 provides an explanation of the command output. Table 7-1 show port status Output Details Output Field What It Displays... Port Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI”...
Page 173: Show Port Counters Output Details
“Port String Syntax Used in the CLI” on page 7-1. MIB2 Interface MIB2 interface designation. Bridge Port IEEE 802.1D bridge port designation. MIB2 Interface MIB2 network traffic counts Counters 802.1Q Switch Counts of frames received, transmitted, and filtered. Counters SecureStack C3 Configuration Guide 7-5...
Page 174: Clear Port Counters
clear port counters clear port counters Use this command to clear port counter statistics for a port or range of ports. Syntax clear port counters [port-string] Parameters port‐string (Optional) Specifies the port or range of ports to clear port counter statistics. Defaults If no port‐string is specified, port counters are cleared for all ports. Mode Switch command, read‐write Example This example clears the port counters for ge.3.1. C3(rw)->clear port counters ge3.1 show port cablestatus Use this command to troubleshoot and locate faults in copper cable connections on a per port basis. This command is only available on switch platforms that provide 1 Gigabit Ethernet RJ45 ports. Syntax show port cablestatus [port-string] Parameters port‐string (Optional) Specifies the port or ports to show status for. Defaults If no port is specified, information about all ports will be displayed.
Page 175: Disabling / Enabling And Naming Ports
Indicates the approximate length of the cable attached to the port. Disabling / Enabling and Naming Ports Purpose To disable and re‐enable one or more ports, and to assign an alias to a port. By default, all ports are enabled at device startup. You may want to disable ports for security or to troubleshoot network issues. Ports may also be assigned an alias for convenience. Commands For information about... Refer to page... set port disable set port enable show port alias set port alias SecureStack C3 Configuration Guide 7-7...
Page 176: Set Port Disable
set port disable set port disable Use this command to administratively disable one or more ports. When this command is executed, in addition to disabling the physical Ethernet link, the port will no longer learn entries in the forwarding database. Syntax set port disable port-string Parameters port‐string Specifies the port(s) to disable. For a detailed description of possible port‐ string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to disable ge.1.1: C3(su)->set port disable set port enable Use this command to administratively enable one or more ports. Syntax set port enable port-string Parameters port‐string Specifies the port(s) to enable. For a detailed description of possible port‐ string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None.
Page 177: Show Port Alias
C3(rw)->show port alias ge.3.1-3 Port ge.3.1 user Port ge.3.2 user Port ge.3.3 Admin set port alias Use this command to assign an alias name to a port. Syntax set port alias port-string [name] Parameters port‐string Specifies the port to which an alias will be assigned. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. name (Optional) Assigns an alias name to the port. If the alias name contains spaces, the text string must be surrounded by double quotes. Maximum length is 60 characters. Defaults If name is not specified, the alias assigned to the port will be cleared. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 7-9...
Page 178 set port alias Examples This example shows how to assign the alias “Admin” to 3.3: C3(rw)->set port alias ge.3.3 Admin This example shows how to clear the alias for 3.3: C3(rw)->set port alias ge.3.3 7-10 Port Configuration...
Page 179: Setting Speed And Duplex Mode
7-16 show port speed Use this command to display the default speed setting on one or more ports. Syntax show port speed [port-string] Parameters port‐string (Optional) Displays default speed setting(s) for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, default speed settings for all ports will display. Mode Switch command, read‐only. Example This example shows how to display the default speed setting for 1‐Gigabit Ethernet port 14 in slot 3: C3(su)->show port speed ge.3.14 default speed is 10 on port ge.3.14. SecureStack C3 Configuration Guide 7-11...
Page 180: Set Port Speed
set port speed set port speed Use this command to set the default speed of one or more ports. This setting only takes effect on ports that have auto‐negotiation disabled. Syntax set port speed port-string {10 | 100 | 1000} Parameters port‐string Specifies the port(s) for which to a speed value will be set. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. 10 | 100 | 1000 Specifies the port speed. Valid values are: 10 Mbps, 100 Mbps, or 1000 Mbps. Defaults None. Mode Switch command, read‐write. Example This example shows how to set ge.3.3 to a port speed of 10 Mbps: C3(su)->set port speed 3.3 10 show port duplex Use this command to display the default duplex setting (half or full) for one or more ports.
Page 181: Set Port Duplex
Use this command to set the default duplex type for one or more ports. This command will only take effect on ports that have auto‐negotiation disabled. Syntax set port duplex port-string {full | half} Parameters port‐string Specifies the port(s) for which duplex type will be set. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. full | half Sets the port(s) to full‐duplex or half‐duplex operation. Defaults None. Mode Switch command, read‐write. Example This example shows how to set ge.1.17 to full duplex: C3(su)->set port duplex 1.17 full SecureStack C3 Configuration Guide 7-13...
Page 182: Enabling / Disabling Jumbo Frame Support
Enabling / Disabling Jumbo Frame Support Enabling / Disabling Jumbo Frame Support Purpose To review, enable, and disable jumbo frame support on one or more ports. This allows Gigabit Ethernet ports to transmit frames up to 10 KB in size. Commands For information about... Refer to page... show port jumbo 7-14 set port jumbo 7-15 clear port jumbo 7-15 show port jumbo Use this command to display the status of jumbo frame support and maximum transmission units (MTU) on one or more ports. Syntax show port jumbo [port-string] Parameters port‐string...
Page 183: Set Port Jumbo
Mode Switch command, read‐write. Example This example shows how to enable jumbo frame support for Gigabit Ethernet port 14 in unit/slot C3(su)->set port jumbo enable ge.3.14 clear port jumbo Use this command to reset jumbo frame support status to enabled on one or more ports. Syntax clear port jumbo [port-string] Parameters port‐string (Optional) Specifies the port(s) on which to reset jumbo frame support status to enabled. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, jumbo frame support status will be reset on all ports. Mode Switch command, read‐write. Example This example shows how to reset jumbo frame support status for Gigabit Ethernet port 14 in slot 3: C3(su)->clear port jumbo ge.3.14 SecureStack C3 Configuration Guide 7-15...
Page 184: Setting Auto-Negotiation And Advertised Ability
Setting Auto-Negotiation and Advertised Ability Setting Auto-Negotiation and Advertised Ability Purpose To review, disable or enable auto‐negotiation, and to configure port advertisement for speed and duplex. During auto‐negotiation, the port “tells” the device at the other end of the segment what its capabilities and mode of operation are. If auto‐negotiation is disabled, the port reverts to the values specified by default speed, default duplex, and the port flow control commands. In normal operation, with all capabilities enabled, advertised ability enables a port to “advertise” that it has the ability to operate in any mode. The user may choose to configure a port so that only a portion of its capabilities are advertised and the others are disabled. Note: Advertised ability can be activated only on ports that have auto-negotiation enabled. Commands For information about... Refer to page... show port negotiation 7-16 set port negotiation 7-17...
Page 185: Set Port Negotiation
Parameters port‐string Specifies the port(s) for which to enable or disable auto‐negotiation. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. enable | disable Enables or disables auto‐negotiation. Defaults None. Mode Switch command, read‐write. Example This example shows how to disable auto‐negotiation on 1‐Gigabit Ethernet port 3 in slot 14: C3(su)->set port negotiation ge.3.14 disable show port advertise Use this command to display port capability and advertisement as far as speed and duplex for auto‐negotiation. Syntax show port advertise [port-string] Parameters port‐string (Optional) Displays advertised ability for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, advertisement for all ports will be displayed. SecureStack C3 Configuration Guide 7-17...
Page 186: Set Port Advertise
set port advertise Mode Switch command, read‐only. Example This example shows how to display advertisement status for Gigabit ports 13 and 14: C3(su)->show port advertise ge.1.13-14 ge.1.13 capability advertised remote ------------------------------------------------- 10BASE-T 10BASE-TFD 100BASE-TX 100BASE-TXFD 1000BASE-T 1000BASE-TFD pause ge.1.14 capability advertised remote ------------------------------------------------- 10BASE-T 10BASE-TFD 100BASE-TX 100BASE-TXFD 1000BASE-T 1000BASE-TFD pause set port advertise Use this command to configure what a port will advertise for speed/duplex capabilities in auto‐ negotiation. Syntax set port advertise {port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd | pause}...
Page 187: Clear Port Advertise
{port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd | pause} Parameters port‐string Clear advertisements for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Do not advertise 10BASE‐T half duplex mode. 10tfd Do not advertise 10BASE‐T full duplex mode. 100tx Do not advertise 100BASE‐TX half duplex mode. 100txfd Do not advertise 100BASE‐TX full duplex mode. 1000t Do not advertise 1000BASE‐T half duplex mode. 1000tfd Do not advertise 1000BASE‐T full duplex mode. pause Do not advertise PAUSE for full‐duplex links. Defaults None. Mode Switch command, read‐write. Example This example shows how to configure port 1 to not advertise 10 MB capability for auto‐ negotiation: C3(su)->clear port advertise ge.1.1 10t 10tfd SecureStack C3 Configuration Guide 7-19...
Page 188: Show Port Mdix
show port mdix show port mdix Use this command to display the status of cable connection type configuration mode for one or more ports. Switch ports can automatically detect and configure the required cable type, either straight through (MDI) or cross‐over (MDIX), or the ports can be configured to only allow one type of cable type, either MDI or MDIX. Syntax show port mdix {all|auto|forced-auto|mdi|mdix} [port-string] Parameters Display information about all ports. auto Display information about the ports configured to automatically determine the required MDI/MDIX mode. forced‐auto Display information about the ports forced automatically to determine the required MDI/MDIX mode. Display information about the ports configured with MDI only mode. mdix Display information about the ports configured with MDIX only mode. port‐string (Optional) Display the selected MDI/MDIX mode only for the port or ports specified. Defaults If port‐string is not specified, information is displayed for all ports. Mode Switch command, read‐only. Example This example displays information about ports configured for MDIX only mode. C3(su)->show port mdix mdix Port Number MDIX Mode ------------- ------------------...
Page 189 Configure ports to use MDI mode only. mdix Configure ports to use MDIX mode only. port‐string (Optional) Specify the port or ports to configure. Defaults If port‐string is not entered, all ports on the switch are configured. Mode Switch command, read‐write. Usage By default, Enterasys Networks switch devices are configured to automatically detect the cable type connection, straight through (MDI) or cross‐over (MDIX), required by the cable connected to the port. You can configure ports to only use MDI or MDIX connections with this command. This command only configures Ethernet ports, and cannot be used to configure combo ports on the switch. Example This example configures ports ge.1.1 and ge.1.2 to use MDIX mode. C3(su)->set port mdix mdix ge.1.1-2 SecureStack C3 Configuration Guide 7-21...
Page 190: Setting Flow Control
Setting Flow Control Setting Flow Control Purpose To review, enable or disable port flow control. Flow control is used to manage the transmission between two devices as specified by IEEE 802.3x to prevent receiving ports from being overwhelmed by frames from transmitting devices. Commands For information about... Refer to page... show flowcontrol 7-22 set flowcontrol 7-22 show flowcontrol Use this command to display the flow control state. Syntax show flowcontrol Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the port flow control state: C3(su)->show flowcontrol Flow control status: enabled set flowcontrol Use this command to enable or disable flow control.
Page 191 Defaults None. Mode Switch command, read‐write. Example This example shows how to enable flow control: C3(su)->set flowcontrol enable SecureStack C3 Configuration Guide 7-23...
Page 192: Setting Port Link Traps And Link Flap Detection
Setting Port Link Traps and Link Flap Detection Setting Port Link Traps and Link Flap Detection Purpose To disable or re‐enable link traps, display link trap status, and to configure the link flapping detection function. By default, all ports are enabled to send SNMP trap messages indicating changes to their link status (up or down). The link flap function detects when a link is going up and down rapidly (also called “link flapping”) on a physical port, and takes the required actions (disable port, and eventually send notification trap) to stop such a condition. If left unresolved, the “link flapping” condition can be detrimental to network stability because it can trigger Spanning Tree and routing table recalculation. Commands For information about... Refer to page... show port trap 7-24 set port trap 7-25 show linkflap 7-25 set linkflap globalstate...
Page 193: Set Port Trap
{globalstate | portstate | parameters | metrics | portsupported | actsupported | maximum | downports | action | operstatus | threshold | interval] | downtime | currentcount | totalcount | timelapsed | violations [port-string]} SecureStack C3 Configuration Guide 7-25...
Page 194 show linkflap Parameters globalstate Displays the global enable state of link flap detection. portstate Displays the port enable state of link flap detection. parameters Displays the current value of settable link flap detection parameters. metrics Displays linkflap detection metrics. portsupported Displays ports which can support the link flap detection function. actsupported Displays link flap detection actions supported by system hardware. maximum Displays the maximum allowed linkdowns per 10 seconds supported by system hardware. downports Displays ports disabled by link flap detection due to a violation. action Displays linkflap actions taken on violating port(s). operstatus Displays whether linkflap has deactivated port(s). threshold Displays the number of allowed link down transitions before action is taken. interval Displays the time period for counting link down transitions. downtime Displays how long violating port(s) are deactivated. currentcount Displays how many linkdown transitions are in the current interval. totalcount Displays how many linkdown transitions have occurred since the last reset. timelapsed Displays the time period since the last link down event or reset. violations Displays the number of link flap violations since the last reset. port‐string (Optional) Displays information for specific port(s). ...
Page 195: Show Linkflap Parameters Output Details
Output Field What it displays... Port Port designation. LinkStatus Link status according to the link flap function. CurrentCount Link down count accruing toward the link flap threshold. TotalCount Number of link downs since system start, SecureStack C3 Configuration Guide 7-27...
Page 196: Set Linkflap Globalstate
set linkflap globalstate Table 7-5 show linkflap metrics Output Details (Continued) Output Field What it displays... TimeElapsed Time (in seconds) since the last link down event. Violations Number of link flap violations on listed ports since system start. set linkflap globalstate Use this command to globally enable or disable the link flap detection function. ...
Page 197: Set Linkflap Interval
Mode Switch command, read‐write. Example This example shows how to set the link flap interval on port ge.1.4 to 1000 seconds. C3(rw)->set linkflap interval 1.4 1000 set linkflap action Use this command to set reactions to a link flap violation. Syntax set linkflap action port-string {disableInterface | gensyslogentry | gentrap | all} Parameters port‐string Specifies the port(s) on which to set the link flap action. disableInterface Sets the reaction as disabling the interface. gensyslogentry Sets the reaction as generating a syslog entry. gentrap Sets the reaction as generating an SNMP trap. Sets the reaction as all of the above. SecureStack C3 Configuration Guide 7-29...
Page 198: Clear Linkflap Action
clear linkflap action Defaults None. Mode Switch mode, read‐write. Example This example shows how to set the link flap violation action on port ge.1.4 to generating a Syslog entry. C3(rw)->set linkflap action 1.4 gensyslogentry clear linkflap action Use this command to clear reactions to a link flap violation. Syntax clear linkflap action [port-string] {disableInterface | gensyslogentry | gentrap | all} Parameters port‐string (Optional) Specifies the port(s) on which to clear the link flap action. disableInterface Clears the reaction as disabling the interface. gensyslogentry Clears the reaction as generating a syslog entry. gentrap Clears the reaction as generating an SNMP trap. Clears the reaction as all of the above. ...
Page 199: Set Linkflap Downtime
Use this command to set the time interval (in seconds) one or more ports will be held down after a link flap violation. Syntax set linkflap downtime port-string downtime-value Parameters port‐string Specifies the port(s) on which to set the link flap downtime. downtime‐value Specifies a downtime in seconds. A value of 0 will set the downtime to forever. Defaults None. Mode Switch mode, read‐write. Example This example shows how to set the link flap downtime on port ge.1.4 to 5000 seconds. C3(rw)->set linkflap downtime 1.4 5000 clear linkflap down Use this command to toggle link flap disabled ports to operational. Syntax clear linkflap down [port-string] SecureStack C3 Configuration Guide 7-31...
Page 200: Clear Linkflap
clear linkflap Parameters port‐string (Optional) Specifies the ports to make operational. Defaults If port‐string is not specified, all ports disabled by a link flap violation will be made operational. Mode Switch mode, read‐write. Example This example shows how to make disabled port ge.1.4 operational. C3(rw)->clear linkflap down clear linkflap Use this command to clear all link flap options and / or statistics on one or more ports. Syntax clear linkflap {all | stats [port-string] | parameter port-string {threshold | interval | downtime | all} Parameters all | stats Clears all options and statistics, or clears only statistics. parameter Clears link flap parameters. threshold | interval | Clears link flap threshold, interval, downtime or all parameters.
Page 201: Configuring Broadcast Suppression
7-34 show port broadcast Use this command to display port broadcast suppression thresholds. Syntax show port broadcast [port-string] Parameters port‐string (Optional) Select the ports for which to show broadcast suppression thresholds. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, broadcast status of all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display the broadcast suppression thresholds for ports 1 through 4: C3(su)->show port broadcast ge.1.1-4 Port Total BC Threshold Packets (pkts/s) ---------------------------------------- ge.1.1 SecureStack C3 Configuration Guide 7-33...
Page 202: Set Port Broadcast
set port broadcast ge.1.2 ge.1.3 ge.1.4 14881 set port broadcast Use this command to set the broadcast suppression threshold, in packets per second, on one or more ports. This sets a threshold on the broadcast traffic that is received and switched out to other ports. Syntax set port broadcast port-string threshold-val Parameters port‐string Select the ports for which to configure broadcast suppression thresholds. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. threshold‐val Sets the packets per second threshold on broadcast traffic. Maximum value is • 148810 for Fast Ethernet ports • 1488100 for 1‐Gigabit ports. • 14881000 for 10‐ Gigabit ports Defaults None. Mode Switch command, read‐write. Usage Per port broadcast suppression is hardset to be globally enabled on the C3. If you would like to disable broadcast suppression, you can get the same result by setting the threshold limit for each port to the maximum number of packets which can be received per second as listed in the ...
Page 203 Parameters port‐string Select the ports for which to clear broadcast suppression thresholds. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example clears the broadcast threshold limit to 14881 pps for ports 1 through 5: C3(su)->clear port broadcast ge.1.1-5 threshold SecureStack C3 Configuration Guide 7-35...
Page 204: Port Mirroring
The SecureStack C3 device allows you to mirror (or redirect) the traffic being switched on a port for the purposes of network traffic analysis and connection assurance. When port mirroring is enabled, one port becomes a monitor port for another port within the device. Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of port mirroring configuration is located on the Enterasys Networks web site: http://www.enterasys.com/support/manuals/ Mirroring Features The SecureStack C3 device supports the following mirroring features:...
Page 205: Configuring Smon Mib Port Mirroring
Enter MIB option 4 (createAndGo) and perform an SNMP Set operation. (Optional) Use the CLI to verify the port mirroring instance has been created and enabled as shown in the following example: C3(su)->show port mirroring Port Mirroring ============== Source Port = ge.1.3 Target Port = ge.1.2 Frames Mirrored = Rx and Tx Port Mirroring status enabled To create a port mirroring instance without automatically enabling it: Complete steps 1‐4 above. Enter MIB option 5 (createAndWait) and perform an SNMP Set operation. (Optional) Use the CLI to verify the port mirroring instance has been created set to disabled mode as shown in the following example: C3(su)->show port mirroring SecureStack C3 Configuration Guide 7-37...
Page 206: Purpose
show port mirroring Port Mirroring ============== Source Port = ge.1.3 Target Port = ge.1.2 Frames Mirrored = Rx and Tx Port Mirroring status disabled When you are ready to enable this instance, enter MIB option 1 (active) and perform an SNMP Set operation. (Optional) Use the CLI to verify the port mirroring instance has been enabled. To delete a port mirroring instance: Select a previously created port mirroring instance in your MIB browser. Enter MIB option 6 (destroy) and perform an SNMP Set operation. (Optional) Use the CLI to verify the port mirroring instance has been deleted as shown in the following example: C3(su)->show port mirroring No Port Mirrors configured. Purpose To review and configure port mirroring on the device.
Page 207: Set Port Mirroring
Syntax set port mirroring {create | disable | enable} source destination} Parameters create | disable | Creates, disables or enables mirroring settings on the specified ports. By enable default, port mirrors are enabled automatically when created. source Specifies the source port designation. This is the port on which the traffic will be monitored. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. destination Specifies the target port designation. This is the port that will duplicate or “mirror” all the traffic on the monitored port. Only one destination port can be configured per stack, if applicable. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults Port mirrors are automatically enabled when created on this platform. Mode Switch command, read‐write. Usage Note that LAG ports and their underlying physical ports, as described in “Link Aggregation Control Protocol (LACP)” on page 7‐42, cannot be mirrored. SecureStack C3 Configuration Guide 7-39...
Page 208: Clear Port Mirroring
clear port mirroring Example This example shows how to create and enable port mirroring with ge.1.4 as the source port, and ge.1.11 as the target port: C3(su)->set port mirroring create 1.11 clear port mirroring Use this command to clear a port mirroring relationship. Syntax clear port mirroring source destination Parameters source Specifies the source port of the mirroring configuration to be cleared. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. destination Specifies the target port of the mirroring configuration to be cleared. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear a port mirroring relationship between source port ge.1.4 and target port ge.1.11: C3(su)->clear port mirroring 1.11 set mirror vlan Assigns a VLAN to be reserved for mirroring traffic. If a mirrored VLAN is created, all mirrored ...
Page 209: Clear Mirror Vlan
= ge.1.10 Frames Mirrored = Rx and Tx Port Mirroring status enabled Mirror Vlan clear mirror vlan Use this command to clear the VLAN to be reserved for mirroring traffic. Syntax clear mirror vlan vlan-id Parameters vlan‐id Specifies the VLAN to be cleared. The ID can range from 2 to 4093. Defaults None. Mode Switch command, read‐write. Example The following example clears VLAN 2 from being used for remote port mirroring. C3(su)->clear mirror vlan 2 SecureStack C3 Configuration Guide 7-41...
Page 210: Link Aggregation Control Protocol (Lacp)
Link Aggregation Control Protocol (LACP) Link Aggregation Control Protocol (LACP) Caution: Link aggregation configuration should only be performed by personnel who are knowledgeable about Spanning Tree and Link Aggregation, and fully understand the ramifications of modifications beyond device defaults. Otherwise, the proper operation of the network could be at risk.
Page 211: Lacp Terminology
Admin Key Value assigned to aggregator ports and physical ports that are candidates for joining a LAG. The LACP implementation on SecureStack C3 devices will use this value to form an oper key and will determine which underlying physical ports are capable of aggregating by comparing oper keys. Aggregator ports allow only underlying ports with oper keys matching theirs to join their LAG.
Page 212: Commands
Link Aggregation Control Protocol (LACP) is, will block redundant paths). For information about building static aggregations, refer to set lacp static (page 7‐48). Each SecureStack C3 module provides six virtual link aggregator ports, which are designated in the CLI as lag.0.1 through lag.0.6. Each LAG can have up to eight associated physical ports. Once underlying physical ports (for example, fe.x.x, or .x.x) are associated with an aggregator port, the resulting aggregation will be represented as one LAG with a lag.0.x port designation. LACP determines which underlying physical ports are capable of aggregating by comparing operational keys. Aggregator ports allow only underlying ports with keys matching theirs to join their LAG. LACP uses a system priority value to build a LAG ID, which determines aggregation precedence. If there are two partner devices competing for the same aggregator, LACP compares the LAG IDs for each grouping of ports. The LAG with the lower LAG ID is given precedence and will be allowed to use the aggregator. There are a few cases in which ports will not aggregate: • An underlying physical port is attached to another port on this same switch (loopback). • There is no available aggregator for two or more ports with the same LAG ID. This can happen if there are simply no available aggregators, or if none of the aggregators have a matching admin key and system priority. • 802.1x authentication is enabled using the set eapol command (page 16‐18) and ports that would otherwise aggregate are not 802.1X authorized. The LACP implementation on the SecureStack C3 device will allow up to eight physical ports into a LAG. The device with the lowest LAG ID determines which underlying physical ports are allowed into a LAG based on the ports’ LAG port priority. Ports with the lowest LAG port priority values are allowed into the LAG and all other speed groupings go into a standby state. Multi‐port LAGs will continue to operate as long as there is at least one active port in the LAG. Therefore, there is no need to create backup single port LAGs or to specifically assign the LAG and all its physical ports to the egress list of the LAG’s VLAN. Typically, two or more ports are required to form a LAG. However, you can enable the creation of single port LAGs as described in “set lacp singleportlag” on page 7‐50. If a single port LAG goes down and the switch stays up, the switch will reconfigure the LAG to the same LAG number if the port comes back up.
Page 213: Show Lacp
C3(su)->show lacp lag.0.1 Global Link Aggregation state: enabled Single Port LAGs: disabled Aggregator: lag.0.1 Actor Partner System Identifier: 00:01:F4:5F:1E:20 00:11:88:11:74:F9 System Priority: 32768 32768 Admin Key: 32768 Oper Key: 32768 Attached Ports: ge.1.1 ge.1.3 Table 7‐7 provides an explanation of the command output. SecureStack C3 Configuration Guide 7-45...
Page 214: Set Lacp
MAC addresses for actor and partner. System Priority System priority value which determines aggregation precedence. Only one LACP system priority can be set on a SecureStack C3 device, using either the set lacp asyspri command (page 7-47), or the set port lacp command...
Page 215: Set Lacp Asyspri
Defaults None. Mode Switch command, read‐write. Usage LACP uses this value to determine aggregation precedence. If there are two partner devices competing for the same aggregator, LACP compares the LAG IDs for each grouping of ports. The LAG with the lower LAG ID is given precedence and will be allowed to use the aggregator. Example This example shows how to set the LACP system priority to 1000: C3(su)->set lacp asyspri 1000 set lacp aadminkey Use this command to set the administratively assigned key for one or more aggregator ports. Syntax set lacp aadminkey port-string value Parameters port‐string Specifies the LAG port(s) on which to assign an admin key. value Specifies an admin key value to set. Valid values are 0 to 65535. The default admin key value is 32768. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 7-47...
Page 216: Clear Lacp
clear lacp Usage LACP will use this value to form an oper key. Only underlying physical ports with oper keys matching those of their aggregators will be allowed to aggregate. The default admin key value for all LAG ports is 32768. Example This example shows how to set the LACP admin key to 2000 for LAG port 6: C3(su)->set lacp aadminkey lag.0.6 2000 clear lacp Use this command to clear LACP system priority or admin key settings. Syntax clear lacp {[asyspri] [aadminkey port-string]} Parameters asyspri Clears system priority. aadminkey port‐string Resets admin keys for one or more ports to the default value of 32768. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the actor admin key for LAG port 6: C3(su)->clear lacp aadminkey lag.0.6 set lacp static Use this command to disable or enable static link aggregation, or to assign one or more underlying ...
Page 217: Clear Lacp Static
Mode Switch command, read‐write. Example This example shows how to add port ge.1.6 to the LAG of aggregator port 6: C3(su)->set lacp static lag.0.6 clear lacp static Use this command to remove specific ports from a Link Aggregation Group. Syntax clear lacp static lagportstring port-string Parameters lagportstring Specifies the LAG aggregator port from which ports will be removed. port‐string Specifies the port(s) to remove from the LAG. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to remove ge.1.6 from the LAG of aggregator port 6: C3(su)->clear lacp static lag.0.6 SecureStack C3 Configuration Guide 7-49...
Page 218: Set Lacp Singleportlag
set lacp singleportlag set lacp singleportlag Use this command to enable or disable the formation of single port LAGs. Syntax set lacp singleportlag {enable | disable} Parameters disable | enable Enables or disables the formation of single port LAGs. Defaults None. Mode Switch command, read‐write. Usage When single port LAGs are enabled, Link Aggregration Groups can be formed when only one port is receiving protocol transmissions from a partner. When this setting is disabled, two or more ports are required to form a LAG. This setting has no effect on existing LAGs created with multiple member ports. It also does not prevent previously formed LAGs from coming up after they have gone down, as long as any previous LAG member ports come up connected to the same switch as before the LAG went down. Example This example enables the formation of single port LAGs: C3(su)->set lacp singleportlag enable clear lacp singleportlag Use this command to reset the single port LAG function back to the default state of disabled. Syntax clear lacp singleportlag Parameters None.
Page 219: Show Port Lacp
Usage State definitions, such as ActorAdminState and Partner AdminState, are indicated with letter abbreviations. If the show port lacp command displays one or more of the following letters, it means the state is true for the associated actor or partner ports: • E = Expired • F = Defaulted • D = Distributing (tx enabled) • C = Collecting (rx enabled) • S = Synchronized (actor and partner agree) • G = Aggregation allowed • S/l = Short/Long LACP timeout • A/p = Active/Passive LACP For more information about these states, refer to set port lacp (page 7‐52) and the IEEE 802.3 2002 specification. Examples f This example shows how to display detailed LACP status information or port ge.1.12: C3(su)-> show port lacp port 1.12 status detail SecureStack C3 Configuration Guide 7-51...
Page 220: Set Port Lacp
set port lacp Port Instance: 1.12 ActorPort: 1411 PartnerAdminPort: 1411 ActorSystemPriority: 32768 PartnerOperPort: 1411 ActorPortPriority: 32768 PartnerAdminSystemPriority: 32768 ActorAdminKey: 32768 PartnerOperSystemPriority: 32768 ActorOperKey: 32768 PartnerAdminPortPriority: 32768 ActorAdminState: -----GlA PartnerOperPortPriority: 32768 ActorOperState: -F----lA PartnerAdminKey: 1411 ActorSystemID: 00-e0-63-9d-b5-87 PartnerOperKey: 1411 SelectedAggID: none PartnerAdminState: --DCSGlp AttachedAggID:...
Page 221 (Optional) Enables LACPDU processing on this port. disable (Optional) Disables LACPDU processing on this port. padminkey Sets a default value to use as the port’s partner admin key. Only ports with padminkey matching admin keys are allowed to aggregate. Valid values are 1 ‐ 65535. padminport Sets a default value to use as the port’s partner admin value. Valid values padminport are 1 ‐ 65535. padminportpri Sets a default value to use as the port’s partner port priority. Valid values padminportpri are 0 ‐ 65535, with lower values given higher priority. padminstate Sets a port’s partner LACP administrative state. See aadminstate for valid lacpactive | options. lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire padminsysid Sets a default value to use as the port’s partner system ID. This is a MAC padminsysid address. padminsyspri Sets a default value to use as the port’s partner priority. Valid values are 0 padminsyspri ‐ 65535, with lower values given higher priority. Defaults At least one parameter must be entered per port‐string. If enable or disable are not specified, port(s) will be enabled with the LACP parameters entered. SecureStack C3 Configuration Guide 7-53...
Page 222: Clear Port Lacp
clear port lacp Mode Switch command, read‐write. Usage LACP commands and parameters beginning with an “a” (such as aadminkey) set actor values. Corresponding commands and parameters beginning with a “p” (such as padminkey) set corresponding partner values. Actor refers to the local device participating in LACP negotiation, while partner refers to its remote device partner at the other end of the negotiation. Actors and partners maintain current status of the other via LACPDUs containing information about their ports’ LACP status and operational state. Example This example shows how to set the actor admin key to 3555 for port 3.16: C3(su)->set port lacp port ge.3.16 aadminkey 3555 clear port lacp Use this command to clear link aggregation settings for one or more ports. Syntax clear port lacp port port-string {[aadminkey] [aportpri] [asyspri] [aadminstate {lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire | all}] [padminsyspri] [padminsysid] [padminkey] [padminportpri] [padminport] [padminstate {lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire | all}]}...
Page 223 Deletes a partner port from the LACP configuration. padminstate Clears the port’s specific partner admin state, or all partner admin state(s). lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire | all Defaults None. Mode Switch command, read‐write. Usage If you set a port to LACP passive using the command clear port lacp port <port‐string> aadminstate lacpactive, the command clear port lacp port <port‐string> aadminstate lacptimeout will also be added to the configuration. If you unset the first command, it will remove the second command automatically from the configuration file. Example This example shows how to clear all link aggregation parameters for port 3.16: C3(su)->clear port lacp port ge.3.16 SecureStack C3 Configuration Guide 7-55...
Page 224: Configuring Protected Ports
Configuring Protected Ports Configuring Protected Ports The Protected Port feature is used to prevent ports from forwarding traffic to each other, even when they are on the same VLAN. Ports may be designated as either protected or unprotected. Ports are unprotected by default. Multiple groups of protected ports are supported. Protected Port Operation Ports that are configured to be protected cannot forward traffic to other protected ports in the same group, regardless of having the same VLAN membership. However, protected ports can forward traffic to ports which are unprotected (not listed in any group). Protected ports can also forward traffic to protected ports in a different group, if they are in the same VLAN. Unprotected ports can forward traffic to both protected and unprotected ports. A port may belong to only one group of protected ports. This feature only applies to ports within a switch or a stack. It does not apply across multiple switches in a network. Commands For information about... Refer to page... set port protected 7-56 show port protected 7-57 clear port protected 7-57 set port protected name 7-58 show port protected name 7-58...
Page 225: Show Port Protected
Defaults If no parameters are entered, information about all protected ports is displayed. Mode Read‐only. Example This example shows how to display information about all protected ports: C3(ro)->show port protected Group id Port ---------------------- ge.1.1 ge.1.2 ge.1.3 clear port protected Use this command to remove a port or group from protected mode. Syntax clear port protected [port-string] | [group-id] Parameters port‐string (Optional) Specifies the port or ports to remove from protected mode. group‐id (Optional) Specifies the id of the group to remove from protected mode. Id can range from 0 to 2. Defaults If no parameters are entered, all protected ports and groups are cleared. SecureStack C3 Configuration Guide 7-57...
Page 226: Set Port Protected Name
set port protected name Mode Switch command, read‐write. Example This example shows how to clear protected ports ge.1.1 through ge.1.3: C3(rw)->clear port protected ge.1.1-3 set port protected name Use this command to assign a name to a protected port group id. Syntax set port protected name group-id name Parameters group‐id Specifies the id of this group. Id can range from 0 to 2. name Specifies a name for the group. The name can be up to 32 characters in length. Defaults None. Mode Switch command, read‐write. Example This example shows how to assign the name “group1” to protected port group 1: C3(rw)->set port protected name 1 group1 show port protected name Use this command to display the name for the group ids specified.
Page 227: Clear Port Protected Name
C3(ro)->show port protected name 1 Group ID Group Name ----------------------------- group1 clear port protected name Use this command to clear the name of a protected group. Syntax clear port protected name group-id Parameters group‐id Specifies the id of the group for which to clear the name. Id can range from 0 to 2. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the name of protected port group 1: C3(rw)->clear port protected name 1 SecureStack C3 Configuration Guide 7-59...
Page 228 clear port protected name 7-60 Port Configuration...
Page 229 Creating a Basic SNMP Trap Configuration 8-37 Configuring the SNMP Management Interface 8-39 Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of SNMP configuration is located on the Enterasys Networks web site: http://www.enterasys.com/support/manuals/ SNMP Configuration Summary SNMP is an application‐layer protocol that facilitates the exchange of management information ...
Page 230: Chapter 8: Snmp Configuration
SNMP Configuration Summary SNMPv1 and SNMPv2c The components of SNMPv1 and SNMPv2c network management fall into three categories: • Managed devices (such as a switch). • SNMP agents and MIBs, including SNMP traps, community strings, and Remote Monitoring (RMON) MIBs, which run on managed devices. • SNMP network management applications, such as the Enterasys NetSight application, which communicate with agents to get statistics and alerts from the managed devices. SNMPv3 SNMPv3 is an interoperable standards‐based protocol that provides secure access to devices by authenticating and encrypting frames over the network. The advanced security features provided in SNMPv3 are as follows: – Message integrity — Collects data securely without being tampered with or corrupted. – Authentication — Determines the message is from a valid source. – Encryption — Scrambles the contents of a frame to prevent it from being seen by an unauthorized source. Unlike SNMPv1 and SNMPv2c, in SNMPv3, the concept of SNMP agents and SNMP managers no longer apply. These concepts have been combined into an SNMP entity. An SNMP entity consists of an SNMP engine and SNMP applications. An SNMP engine consists of the following four components: • Dispatcher — This component sends and receives messages. • Message processing subsystem — This component accepts outgoing PDUs from the dispatcher and prepares them for transmission by wrapping them in a message header and returning them to the dispatcher. The message processing subsystem also accepts incoming messages from the dispatcher, processes each message header, and returns the enclosed PDU to the dispatcher. • Security subsystem — This component authenticates and encrypts messages. •...
Page 231: Using Snmp Contexts To Access Specific Mibs
Using SNMP Contexts to Access Specific MIBs By default, when operating from the switch CLI, SecureStack C3 devices allow access to all SNMP MIBs or contexts. A context is a collection of MIB objects, often associated with a particular physical or logical device. If no optional context parameters are configured for v1 and v2 “community” names and v3 “user” groups, these groups are able to access all SNMP MIB objects when in switch mode. Specifying a context parameter when setting up SNMP user group would permit or restrict the group’s switch management access to the MIB(s) specified by the context (MIB object ID) value. All SNMP contexts known to the device can be displayed using the show snmp context command as described in “show snmp context” on page 8‐21. Example This example permits the “powergroup” to manage all MIBs via SNMPv3: C3(su)->set snmp access powergroup security-model usm Configuration Considerations Commands for configuring SNMP on the SecureStack C3 device are independent during the SNMP setup process. For instance, target parameters can be specified when setting up optional notification filters — even though these parameters have not yet been created with the set snmp targetparams command. Reviewing SNMP Statistics Purpose To review SNMP statistics. SecureStack C3 Configuration Guide 8-3...
Page 232: Commands
show snmp engineid Commands For information about... Refer to page... show snmp engineid show snmp counters show snmp engineid Use this command to display the SNMP local engine ID. This is the SNMP v3 engine’s administratively unique identifier. Syntax show snmp engineid Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display SNMP engine properties: C3(su)->show snmp engineid EngineId: 80:00:15:f8:03:00:e0:63:9d:b5:87 Engine Boots = 12 Engine Time = 162181...
Page 233: Show Snmp Counters
= 290 snmpInGetNexts = 396279 snmpInSetRequests = 32 snmpInGetResponses snmpInTraps snmpOutTooBigs snmpOutNoSuchNames = 11 snmpOutBadValues snmpOutGenErrs snmpOutGetRequests snmpOutGetNexts snmpOutSetRequests snmpOutGetResponses = 396601 snmpOutTraps snmpSilentDrops snmpProxyDrops --- USM Stats counters: usmStatsUnsupportedSecLevels = 0 usmStatsNotInTimeWindows usmStatsUnknownUserNames SecureStack C3 Configuration Guide 8-5...
Page 234: Show Snmp Counters Output Details
show snmp counters usmStatsUnknownEngineIDs usmStatsWrongDigests usmStatsDecryptionErrors Table 8‐3 provides an explanation of the command output. Table 8-3 show snmp counters Output Details Output Field What It Displays... snmpInPkts Number of messages delivered to the SNMP entity from the transport service. snmpOutPkts Number of SNMP messages passed from the SNMP protocol entity to the transport service.
Page 235 Number of packets received by the SNMP engine that were dropped because they did not contain the expected digest value. usmStatsDecriptionErrors Number of packets received by the SNMP engine that were dropped because they could not be decrypted. SecureStack C3 Configuration Guide 8-7...
Page 236: Configuring Snmp Users, Groups, And Communities
Configuring SNMP Users, Groups, and Communities Configuring SNMP Users, Groups, and Communities Purpose To review and configure SNMP users, groups, and v1 and v2 communities. These are defined as follows: • User — A person registered in SNMPv3 to access SNMP management. • Group — A collection of users who share the same SNMP access privileges. • Community — A name used to authenticate SNMPv1 and v2 users. Commands For information about... Refer to page... show snmp user set snmp user clear snmp user 8-11 show snmp group 8-11 set snmp group 8-12...
Page 237: Set Snmp User
Row status Status of this entry: active, notInService, or notReady. set snmp user Use this command to create a new SNMPv3 user. Syntax set snmp user user [remote remoteid] [encryption {des | aes}] [privacy privpassword] [authentication {md5 | sha}] [authpassword] [volatile | nonvolatile] SecureStack C3 Configuration Guide 8-9...
Page 238 set snmp user Parameters user Specifies a name for the SNMPv3 user. remote remoteid (Optional) Registers the user on a specific remote SNMP engine. encryption des | (Optional) Specifies the encryption type for this user. AES refers to the Advanced Encryption Standard using a 128 bit key size. privacy privpassword (Optional) Specifies an encryption password. Minimum of 8 characters. Required if encryption is specified. authentication md5 (Optional) Specifies the authentication type required for this user as MD5 | sha or SHA. authpassword (Optional) Specifies a password for this user when authentication is required. Minimum of 8 characters. volatile | (Optional) Specifies a storage type for this user entry. nonvolatile Defaults If remote is not specified, the user will be registered for the local SNMP engine. If encryption is not specified, no encryption will be applied. If authentication is not specified, no authentication will be applied. If storage type is not specified, nonvolatile will be applied. Mode Switch command, read‐write. Usage Although all the parameters except for the user name are optional, if you are entering any of the optional parameters, it is recommended that you enter them in the order shown in the syntax statement. Examples This example shows how to create a new SNMP user named “netops”. By default, this user will be registered on the local SNMP engine without authentication and encryption. Entries related to this user will be stored in permanent (nonvolatile) memory: C3(su)->set snmp user netops This example creates a new SNMP user named “admin” with DES encryption and MD5 ...
Page 239: Clear Snmp User
[groupname groupname] [user user] [security-model {v1 | v2c | usm}] [volatile | nonvolatile | read-only] Parameters groupname (Optional) Displays information for a specific SNMP group. groupname user user (Optional) Displays information about users within the specified group. security‐model v1 | (Optional) Displays information about groups assigned to a specific v2c | usm security SNMP model. volatile | (Optional) Displays SNMP group information for a specified storage type. nonvolatile | read‐ only Defaults If groupname is not specified, information about all SNMP groups will be displayed. If user is not specified, information about all SNMP users will be displayed. If security‐model is not specified, user information about all SNMP versions will be displayed. If not specified, information for all storage types will be displayed. SecureStack C3 Configuration Guide 8-11...
Page 240: Set Snmp Group
set snmp group Mode Switch command, read‐only. Example This example shows how to display SNMP group information: C3(su)->show snmp group --- SNMP group information --- Security model = SNMPv1 Security/user name = public Group name = Anyone Storage type = nonVolatile Row status = active Security model = SNMPv1 Security/user name = public.router1 Group name = Anyone...
Page 241: Clear Snmp Group
If not specified, settings related to all security models will be cleared. Mode Switch command, read‐write. Example This example shows how to clear all settings assigned to the “public” user within the SNMP group “anyone”: C3(su)->clear snmp group anyone public show snmp community Use this command to display SNMP community names and status. In SNMPv1 and v2, community names act as passwords to remote management. Syntax show snmp community [name] Parameters name (Optional) Displays SNMP information for a specific community name. Defaults If name is not specified, information will be displayed for all SNMP communities. SecureStack C3 Configuration Guide 8-13...
Page 242: Set Snmp Community
set snmp community Mode Switch command, read‐only. Example This example shows how to display information about the SNMP “public” community name. For a description of this output, refer to set snmp community (page 8‐14). C3(su)->show snmp community public --- Configured community strings --- Name = ********* Security name = public Context Transport tag Storage type = nonVolatile Status = active set snmp community Use this command to configure an SNMP community group. Syntax set snmp community community [securityname securityname] [context context] [transport transport] [volatile | nonvolatile] Parameters community...
Page 243: Clear Snmp Community
C3(su)->set snmp community vip context - clear snmp community Use this command to delete an SNMP community name. Syntax clear snmp community name Parameters name Specifies the SNMP community name to clear. Defaults None. Mode Switch command, read‐write. Example This example shows how to delete the community name “vip.” C3(su)->clear snmp community vip Configuring SNMP Access Rights Purpose To review and configure SNMP access rights, assigning viewing privileges and security levels to SNMP user groups. SecureStack C3 Configuration Guide 8-15...
Page 244: Commands
show snmp access Commands For information about... Refer to page... show snmp access 8-16 set snmp access 8-18 clear snmp access 8-19 show snmp access Use this command to display access rights and security levels configured for SNMP one or more groups. Syntax show snmp access [groupname] [security-model {v1 | v2c | usm}] [noauthentication | authentication | privacy] [context context] [volatile | nonvolatile | read-only] Parameters groupname (Optional) Displays access information for a specific SNMPv3 group.
Page 245: Show Snmp Access Output Details
Storage type Whether access entries for this group are stored in volatile, nonvolatile or read-only memory. Row status Status of this entry: active, notInService, or notReady. SecureStack C3 Configuration Guide 8-17...
Page 246: Set Snmp Access
set snmp access set snmp access Use this command to set an SNMP access configuration. Syntax set snmp access groupname security-model {v1 | v2c | usm} [noauthentication | authentication | privacy] [context context] [exact | prefix] [read read] [write write] [notify notify] [volatile | nonvolatile] Parameters groupname Specifies a name for an SNMPv3 group. security‐model v1 | ...
Page 247: Clear Snmp Access
C3(su)->clear snmp access mis-group security-model usm authentication Configuring SNMP MIB Views Purpose To review and configure SNMP MIB views. SNMP views map SNMP objects to access rights. Commands For information about... Refer to page... show snmp view 8-20 show snmp context 8-21 set snmp view 8-21 clear snmp view 8-22 SecureStack C3 Configuration Guide 8-19...
Page 248: Show Snmp View
show snmp view show snmp view Use this command to display the MIB configuration for SNMPv3 view‐based access (VACM). Syntax show snmp view [viewname] [subtree oid-or-mibobject] [volatile | nonvolatile | read-only] Parameters viewname (Optional) Displays information for a specific MIB view. subtree oid‐or‐mibobject (Optional) Displays information for a specific MIB subtree when viewname is specified. volatile | nonvolatile | (Optional) Displays entries for a specific storage type. read‐only Defaults If no parameters are specified, all SNMP MIB view configuration information will be displayed. Mode Switch command, read‐only. Example This example shows how to display SNMP MIB view configuration information: C3(su)->show snmp view --- SNMP MIB View information --- View Name = All Subtree OID...
Page 249: Show Snmp Context
(MIBs). When created using the set snmp access command (“set snmp access” on page 8‐18), other contexts can be applied to limit access to a subset of management information. Example This example shows how to display a list of all SNMP contexts known to the device: C3(su)->show snmp context --- Configured contexts: default context (all mibs) set snmp view Use this command to set a MIB configuration for SNMPv3 view‐based access (VACM). Syntax set snmp view viewname viewname subtree subtree [mask mask] [included | excluded] [volatile | nonvolatile] SecureStack C3 Configuration Guide 8-21...
Page 250: Clear Snmp View
clear snmp view Parameters viewname viewname Specifies a name for a MIB view. subtree subtree Specifies a MIB subtree name. mask mask (Optional) Specifies a bitmask for a subtree. included | (Optional) Specifies subtree use (default) or no subtree use. excluded volatile | (Optional) Specifies the use of temporary or permanent (default) storage. nonvolatile Defaults If not specified, mask will be set to 255.255.255.255 If not specified, subtree use will be included. If storage type is not specified, nonvolatile (permanent) will be applied. Mode Switch command, read‐write. Example This example shows how to set an SNMP MIB view to “public” with a subtree name of 1.3.6.1 included: C3(su)->set snmp view viewname public subtree 1.3.6.1 included clear snmp view Use this command to delete an SNMPv3 MIB view. Syntax clear snmp view viewname subtree Parameters viewname Specifies the MIB view name to be deleted.
Page 251: Configuring Snmp Target Parameters
This example shows how to display SNMP target parameters information: C3(su)->show snmp targetparams --- SNMP TargetParams information --- Target Parameter Name = v1ExampleParams Security Name = public Message Proc. Model = SNMPv1 Security Level = noAuthNoPriv Storage type = nonVolatile Row status = active SecureStack C3 Configuration Guide 8-23...
Page 252: Set Snmp Targetparams
set snmp targetparams Target Parameter Name = v2cExampleParams Security Name = public Message Proc. Model = SNMPv2c Security Level = noAuthNoPriv Storage type = nonVolatile Row status = active Target Parameter Name = v3ExampleParams Security Name = CharlieDChief Message Proc. Model = USM Security Level = authNoPriv...
Page 253: Clear Snmp Targetparams
C3(su)->set snmp targetparams v1ExampleParams user fred security-model usm message-processing v3 authentication clear snmp targetparams Use this command to clear the SNMP target parameter configuration. Syntax clear snmp targetparams targetParams Parameters targetParams Specifies the name of the parameter in the SNMP target parameters table to be cleared. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear SNMP target parameters named “v1ExampleParams”: C3(su)->clear snmp targetparams v1ExampleParams SecureStack C3 Configuration Guide 8-25...
Page 254: Configuring Snmp Target Addresses
Configuring SNMP Target Addresses Configuring SNMP Target Addresses Purpose To review and configure SNMP target addresses which will receive SNMP notification messages. An address configuration can be linked to optional SNMP transmit, or target, parameters (such as timeout, retry count, and UDP port) set with the set snmp targetparams command (page 8‐24). Commands For information about... Refer to page... show snmp targetaddr 8-26 set snmp targetaddr 8-27 clear snmp targetaddr 8-28 show snmp targetaddr Use this command to display SNMP target address information. Syntax show snmp targetaddr [targetAddr] [volatile | nonvolatile | read-only] Parameters targetAddr (Optional) Displays information for a specific target address name. ...
Page 255: Set Snmp Targetaddr
[udpport udpport] [mask mask] [timeout timeout] [retries retries] [taglist taglist] [volatile | nonvolatile] Parameters targetaddr Specifies a unique identifier to index the snmpTargetAddrTable. Maximum length is 32 bytes. ipaddr Specifies the IP address of the target. param param Specifies an entry in the SNMP target parameters table, which is used when generating a message to the target. Maximum length is 32 bytes. udpport udpport (Optional) Specifies which UDP port of the target host to use. mask mask (Optional) Specifies the IP mask of the target. timeout timeout (Optional) Specifies the maximum round trip time allowed to communicate to this target address. This value is in .01 seconds and the default is 1500 (15 seconds.) retries retries (Optional) Specifies the number of message retries allowed if a response is not received. Default is 3. SecureStack C3 Configuration Guide 8-27...
Page 256: Clear Snmp Targetaddr
clear snmp targetaddr taglist taglist (Optional) Specifies a list of SNMP notify tag values. This tags a location to the target address as a place to send notifications. List must be enclosed in quotes and tag values must be separated by a space (for example, “tag 1 tag 2”). volatile | (Optional) Specifies temporary (default), or permanent storage for SNMP nonvolatile entries. Defaults If not specified, udpport will be set to 162. If not specified, mask will be set to 255.255.255.255 If not specified, timeout will be set to 1500. If not specified, number of retries will be set to 3. If taglist is not specified, none will be set. If not specified, storage type will be nonvolatile. Mode Switch command, read‐write. Example This example shows how to configure a trap notification called “TrapSink.” This trap notification will be sent to the workstation 192.168.190.80 (which is target address “tr”). It will use security and authorization criteria contained in a target parameters entry called “v2cExampleParams”. For more information on configuring a basic SNMP trap, refer to “Creating a Basic SNMP Trap Configuration” on page 8‐37: C3(su)->set snmp targetaddr tr 192.168.190.80 param v2cExampleParams taglist TrapSink clear snmp targetaddr Use this command to delete an SNMP target address entry.
Page 257: Configuring Snmp Notification Parameters
8-31 set snmp notify 8-32 clear snmp notify 8-33 show snmp notifyfilter 8-33 set snmp notifyfilter 8-34 clear snmp notifyfilter 8-35 show snmp notifyprofile 8-36 set snmp notifyprofile 8-36 clear snmp notifyprofile 8-37 SecureStack C3 Configuration Guide 8-29...
Page 258: Show Newaddrtrap
show newaddrtrap show newaddrtrap Use this command to display the global and port‐specific status of the SNMP new MAC addresses trap function. Syntax show newaddrtrap [port-string] Parameters port‐string (Optional) Displays the status of the new MAC addresses trap function on specific ports. Defaults If port‐string is not specified, the status of the new MAC addresses trap function will be displayed for all ports. Mode Switch command, read‐only. Usage By default, this function is disabled globally and per port. Example This example displays the New Address Trap state for Gigabit Ethernet ports 1 through 5 in unit/slot 1. C3(ro)->show newaddrtrap ge.1.1-5 New Address Traps Globally disabled Port Enable State --------- ------------ ge.1.1 disabled ge.1.2 disabled ge.1.3 disabled...
Page 259: Show Snmp Notify
C3(rw)->set newaddrtrap enable C3(rw)->set newaddrtrap ge.1.1-5 enable show snmp notify Use this command to display the SNMP notify configuration, which determines the management targets that will receive SNMP notifications. Syntax show snmp notify [notify] [volatile | nonvolatile | read-only] Parameters notify (Optional) Displays notify entries for a specific notify name. volatile | (Optional) Displays notify entries for a specific storage type. nonvolatile | read‐ only Defaults If a notify name is not specified, all entries will be displayed. If volatile, nonvolatile, or read‐only are not specified, all storage type entries will be displayed. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 8-31...
Page 260: Set Snmp Notify
set snmp notify Example This example shows how to display the SNMP notify information: C3(su)->show snmp notify --- SNMP notifyTable information --- Notify name Notify Tag = Console Notify Type = trap Storage type = nonVolatile Row status = active Notify name Notify Tag = TrapSink Notify Type = trap Storage type = nonVolatile Row status...
Page 261: Clear Snmp Notify
Syntax clear snmp notify notify Parameters notify Specifies an SNMP notify name to clear. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the SNMP notify configuration for “hello”: C3(su)->clear snmp notify hello show snmp notifyfilter Use this command to display SNMP notify filter information, identifying which profiles will not receive SNMP notifications. Syntax show snmp notifyfilter [profile] [subtree oid-or-mibobject] [volatile | nonvolatile | read-only] SecureStack C3 Configuration Guide 8-33...
Page 262: Set Snmp Notifyfilter
set snmp notifyfilter Parameters profile (Optional) Displays a specific notify filter. subtree oid‐or‐ (Optional) Displays a notify filter within a specific subtree. mibobject volatile | (Optional) Displays notify filter entries of a specific storage type. nonvolatile | read‐ only Defaults If no parameters are specified, all notify filter information will be displayed. Mode Switch command, read‐only. Usage See “About SNMP Notify Filters” on page 8‐29 for more information about notify filters. Example This example shows how to display SNMP notify filter information. In this case, the notify profile “pilot1” in subtree 1.3.6 will not receive SNMP notification messages: C3(su)->show snmp notifyfilter --- SNMP notifyFilter information --- Profile = pilot1 Subtree = 1.3.6 Filter type = included Storage type = nonVolatile Row status...
Page 263: Clear Snmp Notifyfilter
C3(su)->set snmp notifyfilter pilot1 subtree 1.3.6 clear snmp notifyfilter Use this command to delete an SNMP notify filter configuration. Syntax clear snmp notifyfilter profile subtree oid-or-mibobject Parameters profile Specifies an SNMP filter notify name to delete. subtree oid‐or‐ Specifies a MIB subtree ID containing the filter to be deleted. mibobject Defaults None. Mode Switch command, read‐write. Example This example shows how to delete the SNMP notify filter “pilot1”: C3(su)->clear snmp notifyfilter pilot1 subtree 1.3.6 SecureStack C3 Configuration Guide 8-35...
Page 264: Show Snmp Notifyprofile
show snmp notifyprofile show snmp notifyprofile Use this command to display SNMP notify profile information. This associates target parameters to an SNMP notify filter to determine who should not receive SNMP notifications. Syntax show snmp notifyprofile [profile] [targetparam targetparam] [volatile | nonvolatile | read-only] Parameters profile (Optional) Displays a specific notify profile. targetparam (Optional) Displays entries for a specific target parameter. targetparam volatile | (Optional) Displays notify filter entries of a specific storage type. nonvolatile | read‐ only Defaults If no parameters are specified, all notify profile information will be displayed. Mode Switch command, read‐only. Example This example shows how to display SNMP notify information for the profile named “area51”: C3(su)->show snmp notifyprofile area51 --- SNMP notifyProfile information --- Notify Profile = area51...
Page 265: Clear Snmp Notifyprofile
Use this command to delete an SNMP notify profile configuration. Syntax clear snmp notifyprofile profile targetparam targetparam Parameters profile Specifies an SNMP filter notify name to delete. targetparam Specifies an associated entry in the snmpTargetParamsTable. targetparam Defaults None. Mode Switch command, read‐write. Example This example shows how to delete SNMP notify profile “area51”: C3(su)->clear snmp notifyprofile area51 targetparam v3ExampleParams Creating a Basic SNMP Trap Configuration Traps are notification messages sent by an SNMPv1 or v2 agent to a network management station, a console, or a terminal to indicate the occurrence of a significant event, such as when a port or device goes up or down, when there are authentication failures, and when power supply errors SecureStack C3 Configuration Guide 8-37...
Page 266: Example
Creating a Basic SNMP Trap Configuration occur. The following configuration example shows how to use CLI commands to associate SNMP notification parameters with security and authorization criteria (target parameters), and map the parameters to a management target address. Note: This example illustrates how to configure an SNMPv2 trap notification. Creating an SNMPv1 or v3 Trap, or an SNMPv3 Inform notification would require using the same commands with different parameters, where appropriate. Always ensure that v1/v2 communities or v3 users used for generating traps or informs are pre-configured with enough privileges to access corresponding MIBs.
Page 267: Configuring The Snmp Management Interface
Configuring the SNMP Management Interface Purpose To configure the source IP address used by the SNMP agent when generating SNMP traps. Commands For information about... Refer to page... show snmp interface 8-39 set snmp interface 8-40 clear snmp interface 8-41 show snmp interface Use this command to display the interface used for the source IP address of the SNMP agent when generating SNMP traps. Syntax show snmp interface Parameters None. SecureStack C3 Configuration Guide 8-39...
Page 268: Set Snmp Interface
set snmp interface Defaults None. Mode Switch mode, read‐only. Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the SNMP agent. C3(rw)->show snmp interface loopback 1 192.168.10.1 set snmp interface Use this command to specify the interface used for the source IP address of the SNMP agent when generating SNMP traps. Syntax set snmp interface {loopback loop-ID | vlan vlan-ID} Parameters loopback loop‐ID Specifies the loopback interface to be used. The value of loop‐ID can range from 0 to 7. vlan vlan‐ID Specifies the VLAN interface to be used. The value of vlan‐ID can range from 1 to 4093. Defaults None. Mode Switch command, read‐write.
Page 269: Clear Snmp Interface
C3(rw)->set snmp interface vlan 100 C3(rw)->show snmp interface vlan 100 192.168.10.1 clear snmp interface Use this command to clear the interface used for the source IP address of the SNMP agent back to the default of the Host interface. Syntax clear snmp interface Parameters None. Defaults None. Mode Switch command, read‐write. Example This command returns the interface used for the source IP address of the SNMP agent back to the default of the Host interface. C3(rw)->show snmp interface vlan 100 192.168.10.1 C3(rw)->clear snmp interface C3(rw)-> SecureStack C3 Configuration Guide 8-41...
Page 270 clear snmp interface 8-42 SNMP Configuration...
Page 271: Chapter 9: Spanning Tree Configuration
Spanning Trees and the configuration of the Spanning Tree Algorithm. Otherwise, the proper operation of the network could be at risk. Spanning Tree Configuration Summary Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of Spanning Tree configuration is located on the Enterasys Networks web site: http://www.enterasys.com/support/manuals/ Overview: Single, Rapid, and Multiple Spanning Tree Protocols The IEEE 802.1D Spanning Tree Protocol (STP) resolves the problems of physical loops in a ...
Page 272: Spanning Tree Features
Spanning Tree Configuration Summary MSTP The IEEE 802.1s Multiple Spanning Tree Protocol (MSTP) builds upon 802.1D and RSTP by optimizing utilization of redundant links between switches in a network. When redundant links exist between a pair of switches running single STP, one link is forwarding while the others are blocking for all traffic flowing between the two switches. The blocking links are effectively used only if the forwarding link goes down. MSTP assigns each VLAN present on the network to a particular Spanning Tree instance, allowing each switch port to be in a distinct state for each such instance: blocking for one Spanning Tree while forwarding for another. Thus, traffic associated with one set of VLANs can traverse a particular inter‐switch link, while traffic associated with another set of VLANs can be blocked on that link. If VLANs are assigned to Spanning Trees wisely, no inter‐switch link will be completely idle, maximizing network utilization. For details on creating Spanning Tree instances, refer to “set spantree msti” on page 9‐12. For details on mapping Spanning Tree instances to VLANs, refer to “set spantree mstmap” on page 9‐14. Note: MSTP and RSTP are fully compatible and interoperable with each other and with legacy STP 802.1D. Spanning Tree Features The SecureStack C3 device meets the requirements of the Spanning Tree Protocols by performing ...
Page 273: Configuring Spanning Tree Bridge Parameters
• Communicating port non‐forwarding status through traps and syslog messages • Disabling a port based on frequency of failure events Port forwarding state in the designated port is gated by a timer that is set upon BPDU reception. It is analogous to the rcvdInfoWhile timer the port uses when receiving root information in the root/ alternate/backup role. There are two operational modes for Loop Protect on a port. If the port is connected to a device known to implement Loop Protect, it uses full functional mode. Otherwise the port operates in limited functional mode. Connection to a Loop Protect switch guarantees that the alternate agreement mechanism is implemented. This means the designated port can rely on receiving a response to its proposal regardless of the role of the connected port, which has two important implications. First, the designated port connected to a non‐root port may transition to forwarding. Second, there is no ambiguity when a timeout happens; a Loop Protect event has occurred. In full functional mode, when a type 2 BPDU is received and the port is designated and point‐to‐ point, the timer is set to 3 times helloTime. In limited functional mode there is the additional requirement that the flags field indicate a root role. If the port is a boundary port the MSTIs for that port follow the CIST, that is, the MSTI port timers are set according to the CIST port timer. If the port is internal to the region then the MSTI port timers are set independently using the particular MSTI message. Message age expiration and the expiration of the Loop Protect timer are both Loop Protect events. A notice level syslog message is produced for each such event. Traps may be configured to report these events as well. A syslog message and trap may be configured for disputed BPDUs. It is also configurable to force the locking of a SID/port for the occurrence of one or more events. When the configured number of events happen within a given window of time, the port is forced into blocking and held there until it is manually unlocked via management. Configuring Spanning Tree Bridge Parameters Purpose To display and set Spanning Tree bridge parameters, including device priorities, hello time, maximum wait time, forward delay, path cost, and topology change trap suppression. SecureStack C3 Configuration Guide 9-3...
Page 274: Commands
Configuring Spanning Tree Bridge Parameters Commands For information about... Refer to page... show spantree stats set spantree show spantree version set spantree version clear spantree version show spantree bpdu-forwarding set spantree bpdu-forwarding 9-10 show spantree bridgeprioritymode 9-10 set spantree bridgeprioritymode 9-11 clear spantree bridgeprioritymode 9-11...
Page 275: Show Spantree Stats
9-32 clear spantree autoedge 9-33 show spantree stats Use this command to display Spanning Tree information for one or more ports. Syntax show spantree stats [port port-string] [sid sid] [active] Parameters port port‐string (Optional) Displays information for the specified port(s). For a detailed description of possible port‐‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. sid sid (Optional) Displays information for a specific Spanning Tree identifier. If not specified, SID 0 is assumed. active (Optional) Displays information for ports that have received STP BPDUs since boot. Defaults If port‐string is not specified, Spanning Tree information for all ports will be displayed. If sid is not specified, information for Spanning Tree 0 will be displayed. If active is not specified information for all ports will be displayed regardless of whether or not they have received BPDUs. SecureStack C3 Configuration Guide 9-5...
Page 276: Show Spantree Output Details
show spantree stats Mode Switch command, read‐only. Example This example shows how to display the device’s Spanning Tree configuration: C3(su)->show spantree stats Spanning tree status - enabled Spanning tree instance Designated Root MacAddr - 00-e0-63-9d-c1-c8 Designated Root Priority Designated Root Cost - 10000 Designated Root Port - lag.0.1 Root Max Age - 20 sec Root Hello Time Root Forward Delay - 15 sec...
Page 277: Set Spantree
Use this command to globally enable or disable the Spanning Tree protocol on the switch. Syntax set spantree {disable | enable} Parameters disable | enable Globally disables or enables Spanning Tree. Defaults None. Mode Switch command, read‐write. Example This example shows how to disable Spanning Tree on the device: C3(su)->set spantree disable show spantree version Use this command to display the current version of the Spanning Tree protocol running on the device. Syntax show spantree version Parameters None. SecureStack C3 Configuration Guide 9-7...
Page 278: Set Spantree Version
set spantree version Defaults None. Mode Switch command, read‐only. Example This example shows how to display Spanning Tree version information for the device: C3(su)->show spantree version Force Version is mstp set spantree version Use this command to set the version of the Spanning Tree protocol to MSTP (Multiple Spanning Tree Protocol), RSTP (Rapid Spanning Tree Protocol) or to STP 802.1D‐compatible. Syntax set spantree version {mstp | stpcompatible | rstp} Parameters mstp Sets the version to STP 802.1s‐compatible. stpcompatible Sets the version to STP 802.1D‐compatible. rstp Sets the version to 802.1w‐compatible. Defaults None. Mode Switch command, read‐write.
Page 279: Clear Spantree Version
C3(su)->clear spantree version show spantree bpdu-forwarding Use this command to display the Spanning Tree BPDU forwarding mode. Syntax show spantree bpdu-forwarding Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the Spanning Tree BPDU forwarding mode: C3(su)->show spantree bpdu-forwarding BPDU forwarding is disabled. SecureStack C3 Configuration Guide 9-9...
Page 280: Set Spantree Bpdu-Forwarding
set spantree bpdu-forwarding set spantree bpdu-forwarding Use this command to enable or disable Spanning Tree BPDU forwarding. By default BPDU forwarding is disabled. Syntax set spantree bpdu-forwarding {disable | enable} Parameters disable | enable Disables or enables BPDU forwarding;. Defaults By default BPDU forwarding is disabled. Mode Switch command, read‐write. Usage The Spanning Tree protocol must be disabled (set spantree disable) for this feature to take effect. Example This example shows how to enable BPDU forwarding: C3(rw)-> set spantree bpdu-forwarding enable show spantree bridgeprioritymode Use this command to display the Spanning Tree bridge priority mode setting. Syntax show spantree bridgeprioritymode Parameters None.
Page 281: Set Spantree Bridgeprioritymode
65535. 8021t Sets the bridge priority mode to use 802.1t values, which are 0 to 61440, in increments of 4096. Values will automatically be rounded up or down, depending on the 802.1t value to which the entered value is closest. This is the default bridge priority mode. Defaults None Mode Switch command, read‐write. Usage The mode affects the range of priority values used to determine which device is selected as the Spanning Tree root as described in set spantree priority (“set spantree priority” on page 9‐17). The default for the switch is to use 802.1t bridge priority mode. Example This example shows how to set the bridge priority mode to 802.1D: C3(rw)->set spantree bridgeprioritymode 8021d clear spantree bridgeprioritymode Use this command to reset the Spanning Tree bridge priority mode to the default setting of 802.1t. Syntax clear spantree bridgeprioritymode Parameters None. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 9-11...
Page 282: Show Spantree Mstilist
show spantree mstilist Example This example shows how to reset the bridge priority mode to 802.1t: C3(rw)->clear spantree bridgeprioritymode show spantree mstilist Use this command to display a list of Multiple Spanning Tree (MST) instances configured on the device. Syntax show spantree mstilist Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display a list of MST instances. In this case, SID 2 has been configured: C3(su)->show spantree mstilist Configured Multiple Spanning Tree instances: set spantree msti Use this command to create or delete a Multiple Spanning Tree instance. Syntax set spantree msti sid sid {create | delete} Parameters sid sid Sets the Multiple Spanning Tree ID. Valid values are 1 ‐ 4094.
Page 283: Clear Spantree Msti
Defaults If sid is not specified, all MST instances will be cleared. Mode Switch command, read‐write. Example This example shows how to delete all MST instances: C3(su)->clear spantree msti show spantree mstmap Use this command to display the mapping of a filtering database ID (FID) to a Spanning Trees. Since VLANs are mapped to FIDs, this shows to which SID a VLAN is mapped. Syntax show spantree mstmap [fid fid] Parameters fid fid (Optional) Displays information for specific FIDs. Defaults If fid is not specified, information for all assigned FIDs will be displayed. Mode Switch command, read‐only. Example This example shows how to display SID to FID mapping information for FID 1. In this case, no new mappings have been configured: C3(su)->show spantree mstmap fid 1 SecureStack C3 Configuration Guide 9-13...
Page 284: Set Spantree Mstmap
set spantree mstmap FID: SID: set spantree mstmap Use this command to map one or more filtering database IDs (FIDs) to a SID. Since VLANs are mapped to FIDs, this essentially maps one or more VLAN IDs to a Spanning Tree (SID). Note: Since any MST maps that are associated with GVRP-generated VLANs will be removed from the configuration if GVRP communication is lost, it is recommended that you only create MST maps on statically-created VLANs.
Page 285: Show Spantree Vlanlist
9‐12, and the FIDs must be mapped to SID 1 using the set spantree mstmap command as described in “set spantree mstmap” on page 9‐14: C3(su)->show spantree vlanlist 1 The following SIDS are assigned to VLAN 1: 2 16 42 show spantree mstcfgid Use this command to display the MST configuration identifier elements, including format selector, configuration name, revision level, and configuration digest. Syntax show spantree mstcfgid Parameters None. Defaults None. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 9-15...
Page 286: Set Spantree Mstcfgid
set spantree mstcfgid Example This example shows how to display the MST configuration identifier elements. In this case, the default revision level of 0, and the default configuration name (a string representing the bridge MAC address) have not been changed. For information on using the set spantree mstcfgid command to change these settings, refer to “set spantree mstcfgid” on page 9‐16: C3(su)->show spantree mstcfgid MST Configuration Identifier: Format Selector: 0 Configuration Name: 00:01:f4:89:51:94 Revision Level: 0 Configuration Digest: ac:36:17:7f:50:28:3c:d4:b8:38:21:d8:ab:26:de:62 set spantree mstcfgid Use this command to set the MST configuration name and/or revision level. Syntax set spantree mstcfgid {cfgname name | rev level} Parameters cfgname name Specifies an MST configuration name. ...
Page 287: Set Spantree Priority
Parameters priority Specifies the priority of the bridge. Valid values are from 0 to 61440 (in increments of 4096), with 0 indicating highest priority and 61440 lowest priority. (Optional) Sets the priority on a specific Spanning Tree. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. Defaults If sid is not specified, priority will be set on Spanning Tree 0. Mode Switch command, read‐write. Usage The device with the highest priority (lowest numerical value) becomes the Spanning Tree root device. If all devices have the same priority, the device with the lowest MAC address will then become the root device. Depending on the bridge priority mode (set with the set spantree bridgeprioritymode command described in “set spantree bridgeprioritymode” on page 9‐11, some priority values may be rounded up or down. Example This example shows how to set the bridge priority to 4096 on SID 1: C3(su)->set spantree priority 4096 1 clear spantree priority Use this command to reset the Spanning Tree priority to the default value of 32768. Syntax clear spantree priority [sid] SecureStack C3 Configuration Guide 9-17...
Page 288: Set Spantree Hello
set spantree hello Parameters (Optional) Resets the priority on a specific Spanning Tree. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. Defaults If sid is not specified, priority will be reset on Spanning Tree 0. Mode Switch command, read‐write. Example This example shows how to reset the bridge priority on SID 1: C3(su)->clear spantree priority 1 set spantree hello Use this command to set the device’s Spanning Tree hello time, This is the time interval (in seconds) the device will transmit BPDUs indicating it is active. Syntax set spantree hello interval Parameters interval Specifies the number of seconds the system waits before broadcasting a bridge hello message (a multicast message indicating that the system is active). Valid values are 1 ‐ 10. Defaults None. Mode Switch command, read‐write. Example This example shows how to globally set the Spanning Tree hello time to 10 seconds: C3(su)->set spantree hello 10 clear spantree hello Use this command to reset the Spanning Tree hello time to the default value of 2 seconds. ...
Page 289: Set Spantree Maxage
Example This example shows how to globally reset the Spanning Tree hello time: C3(su)->clear spantree hello set spantree maxage Use this command to set the bridge maximum aging time. Syntax set spantree maxage agingtime Parameters agingtime Specifies the maximum number of seconds that the system retains the information received from other bridges through STP. Valid values are 6 ‐ Defaults None. Mode Switch command, read‐write. Usage The bridge maximum aging time is the maximum time (in seconds) a device can wait without receiving a configuration message (bridge “hello”) before attempting to reconfigure. All device ports (except for designated ports) should receive configuration messages at regular intervals. Any port that ages out STP information provided in the last configuration message becomes the designated port for the attached LAN. If it is a root port, a new root port is selected from among the device ports attached to the network. Example This example shows how to set the maximum aging time to 25 seconds: C3(su)->set spantree maxage 25 SecureStack C3 Configuration Guide 9-19...
Page 290: Clear Spantree Maxage
clear spantree maxage clear spantree maxage Use this command to reset the maximum aging time for a Spanning Tree to the default value of 20 seconds. Syntax clear spantree maxage Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to globally reset the maximum aging time: C3(su)->clear spantree maxage set spantree fwddelay Use this command to set the Spanning Tree forward delay. Syntax set spantree fwddelay delay Parameters delay Specifies the number of seconds for the bridge forward delay. Valid values are 4 ‐ 30. Defaults None. Mode Switch command, read‐write. Usage The forward delay is the maximum time (in seconds) the root device will wait before changing ...
Page 291: Clear Spantree Fwddelay
Example This example shows how to globally reset the bridge forward delay: C3(su)->clear spantree fwddelay show spantree backuproot Use this command to display the backup root status for an MST instance. Syntax show spantree backuproot [sid] Parameters (Optional) Display backup root status for a specific Spanning Tree identifier. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. Defaults If a SID is not specified, then status will be shown for Spanning Tree instance 0. Mode Switch command, read‐only. Example This example shows how to display the status of the backup root function on SID 0: C3(rw)->show spantree backuproot Backup root is set to disable on sid 0 SecureStack C3 Configuration Guide 9-21...
Page 292: Set Spantree Backuproot
set spantree backuproot set spantree backuproot Use this command to enable or disable the Spanning Tree backup root function on the switch. Syntax set spantree backuproot sid {disable | enable} Parameters Specifies the Spanning Tree instance on which to enable or disable the backup root function.Valid values are 0 ‐ 4094. disable | enable Enables or disables the backup root function. Defaults None. Mode Switch command, read‐write. Usage The Spanning Tree backup root function is disabled by default on the SecureStack C3. When this feature is enabled and the switch is directly connected to the root bridge, stale Spanning Tree information is prevented from circulating if the root bridge is lost. If the root bridge is lost, the backup root will dynamically lower its bridge priority so that it will be selected as the new root over the lost root bridge. Example This example shows how to enable the backup root function on SID 2: C3(rw)->set spantree backuproot 2 enable clear spantree backuproot Use this command to reset the Spanning Tree backup root function to the default state of disabled.
Page 293: Show Spantree Tctrapsuppress
None. Mode Switch command, read‐only. Example This example shows how to display the status of topology change trap suppression: C3(rw)->show spantree tctrapsuppress Topology change Trap Suppression is set to enabled set spantree tctrapsuppress Use this command to disable or enable topology change trap suppression on Rapid Spanning Tree edge ports. Syntax set spantree tctrapsuppress {disable | enable} Parameters disable | enable Disables or enables topology change trap suppression. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 9-23...
Page 294: Clear Spantree Tctrapsuppress
clear spantree tctrapsuppress Usage By default, RSTP non‐edge (bridge) ports that transition to forwarding or blocking cause the switch to issue a topology change trap. When topology change trap suppression is enabled, which is the device default, edge ports (such as end station PCs) are prevented from sending topology change traps. This is because there is usually no need for network management to monitor edge port STP transition states, such as when PCs are powered on. When topology change trap suppression is disabled, all ports, including edge and bridge ports, will transmit topology change traps. Example This example shows how to allow Rapid Spanning Tree edge ports to transmit topology change traps: C3(rw)->set spantree tctrapsuppress disable clear spantree tctrapsuppress Use this command to clear the status of topology change trap suppression on Rapid Spanning Tree edge ports to the default state of enabled (edge port topology changes do not generate traps). Syntax clear spantree tctrapsuppress Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear topology change trap suppression setting: C3(rw)->clear spantree tctrapsuppress set spantree protomigration Use this command to reset the protocol state migration machine for one or more Spanning Tree ...
Page 295: Show Spantree Spanguard
Use this command to display the status of the Spanning Tree SpanGuard function. Syntax show spantree spanguard Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the SpanGuard function status: C3(su)->show spantree spanguard Spanguard is disabled set spantree spanguard Use this command to enable or disable the Spanning Tree SpanGuard function. Syntax set spantree spanguard {enable | disable} Parameters enable | disable Enables or disables the SpanGuard function. Defaults None. SecureStack C3 Configuration Guide 9-25...
Page 296: Clear Spantree Spanguard
clear spantree spanguard Mode Switch command, read‐write. Usage SpanGuard is designed to disable, or lock out an “edge” port when an unexpected BPDU is received. The port can be configured to be re‐enabled after a set time period, or only after manual intervention. A port can be defined as an edge (user) port using the set spantree adminedge command, described in “set spantree adminedge” on page 9‐40. A port designated as an edge port is expected to be connected to a workstation or other end‐user type of device, and not to another switch in the network. When SpanGuard is enabled, if a non‐loopback BPDU is received on an edge port, the Spanning Tree state of that port will be changed to “blocking” and will no longer forward traffic. The port will remain disabled until the amount of time defined by set spantree spanguardtimeout (“set spantree spanguardtimeout” on page 9‐27) has passed since the last seen BPDU, the port is manually unlocked (set or clear spantree spanguardlock, “clear / set spantree spanguardlock” on page 9‐29), the configuration of the port is changed so it is not longer an edge port, or the SpanGuard function is disabled. SpanGuard is enabled and disabled only on a global basis (across the stack, if applicable). By default, SpanGuard is disabled and SpanGuard traps are enabled. Example This example shows how to enable the SpanGuard function: C3(rw)->set spantree spanguard enable clear spantree spanguard Use this command to reset the status of the Spanning Tree SpanGuard function to disabled. Syntax clear spantree spanguard Parameters None. Defaults None.
Page 297: Show Spantree Spanguardtimeout
Mode Switch command, read‐only. Example This example shows how to display the SpanGuard timeout setting: C3(su)->show spantree spanguardtimeout Spanguard timeout: 300 set spantree spanguardtimeout Use this command to set the amount of time (in seconds) an edge port will remain locked by the SpanGuard function. Syntax set spantree spanguardtimeout timeout Parameters timeout Specifies a timeout value in seconds. Valid values are 0 to 65535. A value of 0 will keep the port locked until manually unlocked. The default value is 300 seconds. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the SpanGuard timeout to 600 seconds: C3(su)->set spantree spanguardtimeout 600 SecureStack C3 Configuration Guide 9-27...
Page 298: Clear Spantree Spanguardtimeout
clear spantree spanguardtimeout clear spantree spanguardtimeout Use this command to reset the Spanning Tree SpanGuard timeout to the default value of 300 seconds. Syntax clear spantree spanguardtimeout Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the SpanGuard timeout to 300 seconds: C3(rw)->clear spantree spanguardtimeout show spantree spanguardlock Use this command to display the SpanGuard lock status of one or more ports. Syntax show spantree spanguardlock [port-string] Parameters port‐string (Optional) Specifies the port(s) for which to show SpanGuard lock status. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If no port string is specified, the SpanGuard lock status for all ports is displayed. Mode Switch command, read‐only.
Page 299: Clear / Set Spantree Spanguardlock
Defaults None. Mode Switch command, read‐write. Example This example shows how to unlock port 1.16: C3(rw)->clear spantree spanguardlock ge.1.16 show spantree spanguardtrapenable Use this command to display the state of the Spanning Tree SpanGuard trap function. Syntax show spantree spanguardtrapenable Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the state of the SpanGuard trap function: C3(ro)->show spantree spanguardtrapenable Spanguard SNMP traps are enabled SecureStack C3 Configuration Guide 9-29...
Page 300: Set Spantree Spanguardtrapenable
set spantree spanguardtrapenable set spantree spanguardtrapenable Use this command to enable or disable the sending of an SNMP trap message when SpanGuard has locked a port. Syntax set spantree spanguardtrapenable {disable | enable} Parameters disable | enable Disables or enables sending SpanGuard traps. By default, sending traps is enabled. Defaults None. Mode Switch command, read‐write. Example This example shows how to disable the SpanGuard trap function: C3(su)->set spantree spanguardtrapenable disable clear spantree spanguardtrapenable Use this command to reset the Spanning Tree SpanGuard trap function back to the default state of enabled. Syntax clear spantree spanguardtrapenable Parameters None. Defaults None.
Page 301: Show Spantree Legacypathcost
C3(su)->show spantree legacypathcost Legacy Path Cost is disabled. set spantree legacypathcost Use this command to enable or disable legacy (802.1D) path cost values. Syntax set spantree legacypathcost {disable | enable} Parameters disable Use 802.1t2001 values to calculate path cost. enable Use 802.1d1998 values to calculate path cost. Defaults None. Mode Switch command, read‐write. Usage By default, legacy path cost is disabled. Enabling the device to calculate legacy path costs affects the range of valid values that can be entered in the set spantree adminpathcost command. Example This example shows how to set the default path cost values to 802.1D. C3(rw)->set spantree legacypathcost enable SecureStack C3 Configuration Guide 9-31...
Page 302: Clear Spantree Legacypathcost
clear spantree legacypathcost clear spantree legacypathcost Use this command to set the Spanning Tree default value for legacy path cost to 802.1t values. Syntax clear spantree legacypathcost Defaults None. Mode Switch command, read‐write. Example This example clears the legacy path cost to 802.1t values. C3(rw)->clear spantree legacypathcost show spantree autoedge Use this command to display the status of automatic edge port detection. Syntax show spantree autoedge Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the status of the automatic edge port detection function: C3(rw)->show spantree autoedge autoEdge is currently enabled. set spantree autoedge Use this command to enable or disable the automatic edge port detection function.
Page 303: Clear Spantree Autoedge
Parameters disable | enable Disables or enables automatic edge port detection. Defaults None. Mode Switch command, read‐write. Example This example shows how to disable automatic edge port detection: C3(rw)->set spantree autoedge disable clear spantree autoedge Use this command to reset automatic edge port detection to the default state of enabled. Syntax clear spantree autoedge Parameters None. Defaults None. Mode Switch command, Read‐Write. Example This example shows how to reset automatic edge port detection to enabled: C3(rw)->clear spantree autoedge SecureStack C3 Configuration Guide 9-33...
Page 304: Configuring Spanning Tree Port Parameters
Configuring Spanning Tree Port Parameters Configuring Spanning Tree Port Parameters Purpose To display and set Spanning Tree port parameters. Commands For information about... Refer to page... set spantree portadmin 9-34 clear spantree portadmin 9-35 show spantree portadmin 9-35 show spantree portpri 9-36 set spantree portpri 9-36 clear spantree portpri 9-37 show spantree adminpathcost 9-38...
Page 305: Clear Spantree Portadmin
Resets the default admin status on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the default Spanning Tree admin state to enable on ge.1.12: C3(rw)->clear spantree portadmin 1.12 show spantree portadmin Use this command to display the status of the Spanning Tree algorithm on one or more ports. Syntax show spantree portadmin [port port-string] Parameters port port‐string (Optional) Displays status for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, status will be displayed for all ports. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 9-35...
Page 306: Show Spantree Portpri
show spantree portpri Example This example shows how to display port admin status for 1.1: C3(ro)->show spantree portadmin port ge.1.1 Port ge.1.1 has portadmin set to enabled show spantree portpri Use this command to show the Spanning Tree priority for one or more ports. Port priority is a component of the port ID, which is one element used in determining Spanning Tree port roles. Syntax show spantree portpri [port port-string] [sid sid] Parameters port port‐string (Optional) Specifies the port(s) for which to display Spanning Tree priority. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. sid sid (Optional) Displays port priority for a specific Spanning Tree identifier. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. Defaults If port‐string is not specified, port priority will be displayed for all Spanning Tree ports.
Page 307: Clear Spantree Portpri
1.3 240 sid 1 clear spantree portpri Use this command to reset the bridge priority of a Spanning Tree port to a default value of 128. Syntax clear spantree portpri port-string [sid sid] Parameters port‐string Specifies the port(s) for which to set Spanning Tree port priority. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. sid sid (Optional) Resets the port priority for a specific Spanning Tree identifier. Valid values are 0 ‐ 4094. If not specified, SID 0 will be assumed. Defaults If sid is not specified, port priority will be set for Spanning Tree 0. Mode Switch command, read‐write. Example This example shows how to reset the priority of ge.1.3 to 128 on SID 1 C3(su)->clear spantree portpri 1.3 sid 1 SecureStack C3 Configuration Guide 9-37...
Page 308: Show Spantree Adminpathcost
show spantree adminpathcost show spantree adminpathcost Use this command to display the admin path cost for a port on one or more Spanning Trees. Syntax show spantree adminpathcost [port port-string] [sid sid] Parameters port port‐string (Optional) Displays the admin path cost value for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. sid sid (Optional) Displays the admin path cost for a specific Spanning Tree identifier. Valid values are 0 ‐ 4094. If not specified, SID 0 will be assumed. Defaults If port‐string is not specified, admin path cost for all Spanning Tree ports will be displayed. If sid is not specified, admin path cost for Spanning Tree 0 will be displayed. Mode Switch command, read‐only. Example This example shows how to display the admin path cost for ge.3.4 on SID 1: C3(su)->show spantree adminpathcost port 3.4 sid 1 Port 3.4 has a Port Admin Path Cost of 0 on SID 1 set spantree adminpathcost Use this command to set the administrative path cost on a port and one or more Spanning Trees.
Page 309: Clear Spantree Adminpathcost
Used in the CLI” on page 7‐1. sid sid (Optional) Resets the admin path cost for specific Spanning Tree(s). Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. Defaults If sid is not specified, admin path cost will be reset for Spanning Tree 0. Mode Switch command, read‐write. Example This example shows how to reset the admin path cost to 0 for ge.3.2 on SID 1: C3(su)->clear spantree adminpathcost 3.2 sid 1 show spantree adminedge Use this command to display the edge port administrative status for a port. Syntax show spantree adminedge [port port-string] Parameters port‐string (Optional) Displays edge port administrative status for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified edge port administrative status will be displayed for all Spanning Tree ports. SecureStack C3 Configuration Guide 9-39...
Page 310: Set Spantree Adminedge
set spantree adminedge Mode Switch command, read‐only. Example This example shows how to display the edge port status for ge.3.2: C3(su)->show spantree adminedge port Port 3.2 has a Port Admin Edge of Edge-Port set spantree adminedge Use this command to set the edge port administrative status on a Spanning Tree port. Syntax set spantree adminedge port-string {true | false} Parameters port‐string Specifies the edge port. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. true | false Enables (true) or disables (false) the specified port as a Spanning Tree edge port. Defaults None.
Page 311: Show Spantree Operedge
1.11 show spantree operedge Use this command to display the Spanning Tree edge port operating status for a port. Syntax show spantree operedge [port port-string] Parameters port port‐string Displays edge port operating status for specific port(s). Defaults If port‐string is not specified, edge port operating status will be displayed for all Spanning Tree ports. Mode Switch command, read‐only. Example This example shows how to display the edge port status for ge.2.7: C3(rw)->show spantree operedge port ge.2.7 Port ge.2.7 has a Port Oper Edge of Edge-Port SecureStack C3 Configuration Guide 9-41...
Page 312: Configuring Spanning Tree Loop Protect Parameters
Configuring Spanning Tree Loop Protect Parameters Configuring Spanning Tree Loop Protect Parameters Purpose To display and set Spanning Tree Loop Protect parameters, including the global parameters of Loop Protect threshold, window, enabling traps, and disputed BPDU threshold, as well as per port and port/SID parameters. See “Loop Protect” on page 9‐2 for more information about the Loop Protect feature. Commands For information about... Refer to page... set spantree lp 9-43 show spantree lp 9-43 clear spantree lp 9-44 show spantree lplock 9-44 clear spantree lplock 9-45...
Page 313: Set Spantree Lp
Note: The Loop Protect enable/disable settings for an MSTI port should match those for the CIST port. Example This example shows how to enable Loop Protect on ge.2.3: C3(su)->set spantree lp 1.11 enable show spantree lp Use this command to display the Loop Protect status per port and/or per SID. Syntax show spantree lp [port port-string] [sid sid] Parameters port‐string (Optional) Specifies port(s) for which to display the Loop Protect feature status. sid sid (Optional) Specifies the specific Spanning Tree(s) for which to display the Loop Protect feature status. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. SecureStack C3 Configuration Guide 9-43...
Page 314: Clear Spantree Lp
clear spantree lp Defaults If no port‐string is specified, status is displayed for all ports. If no SID is specified, SID 0 is assumed. Mode Switch command, read‐only. Example This example shows how to display Loop Protect status on ge.2.3: C3(su)->show spantree lp port LoopProtect is disabled on port , SI clear spantree lp Use this command to return the Loop Protect status per port and optionally, per SID, to its default state of disabled. Syntax clear spantree lp port-string [sid sid] Parameters port‐string Specifies port(s) for which to clear the Loop Protect feature status. sid sid (Optional) Specifies the specific Spanning Tree(s) for which to clear the Loop Protect feature status. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. Defaults If no SID is specified, SID 0 is assumed. ...
Page 315: Clear Spantree Lplock
Example This example shows how to clear Loop Protect lock from ge.1.1: C3(rw)->show spantree lplock port The LoopProtect lock status for port , SID 0 is LOCKED C3(rw)->clear spantree lplock C3(rw)->show spantree lplock port The LoopProtect lock status for port , SID 0 is UNLOCKED SecureStack C3 Configuration Guide 9-45...
Page 316: Set Spantree Lpcapablepartner
set spantree lpcapablepartner set spantree lpcapablepartner Use this command to specify per port whether the link partner is Loop Protect capable. See “Loop Protect” on page 2. for more information. Syntax set spantree lpcapablepartner port-string {true | false} Parameters port‐string Specifies port(s) for which to configure a Loop Protect capable link partner. true | false Specifies whether the link partner is capable (true) or not (false). Defaults None. Mode Switch command, read‐write. Usage The default value for Loop Protect capable partner is false. If the port is configured with a Loop Protect capable partner (true), then the full functionality of the Loop Protect feature is used. If the value is false, then there is some ambiguity as to whether an Active Partner timeout is due to a loop protection event or is a normal situation due to the fact that the partner port does not transmit Alternate Agreement BPDUs. Therefore, a conservative approach is taken in that designated ports will not be allowed to forward unless receiving agreements from a port with root role. This type of timeout will not be considered a loop protection event. Loop protection is maintained by keeping the port from forwarding but since this is not considered a loop event it will not be factored into locking the port. Example This example shows how to set the Loop Protect capable partner to true for ge.1.1: C3(rw)->set spantree lpcapablepartner 1.1 true show spantree lpcapablepartner...
Page 317: Clear Spantree Lpcapablepartner
Use this command to reset the Loop Protect capability of port link partners to the default state of false. Syntax clear spantree lpcapablepartner port-string Parameters port‐string Specifies port(s) for which to clear their link partners’ Loop Protect capability (reset to false). Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the Loop Protect partner capability for ge.1.1: C3(rw)->clear spantree lpcapablepartner set spantree lpthreshold Use this command to set the Loop Protect event threshold. Syntax set spantree lpthreshold value Parameters value Specifies the number of events that must occur during the event window in order to lock a port/SID. The default value is 3 events. A threshold of 0 specifies that ports will never be locked. SecureStack C3 Configuration Guide 9-47...
Page 318: Show Spantree Lpthreshold
show spantree lpthreshold Defaults None. The default event threshold is 3. Mode Switch command, read‐write. Usage The LoopProtect event threshold is a global integer variable that provides protection in the case of intermittent failures. The default value is 3. If the event counter reaches the threshold within a given period (the event window), then the port, for the given SID, becomes locked (that is, held indefinitely in the blocking state). If the threshold is 0, the ports are never locked. Example This example shows how to set the Loop Protect threshold value to 4: C3(rw)->set spantree lpthreshold 4 show spantree lpthreshold Use this command to display the current value of the Loop Protect event threshold. Syntax show spantree lpthreshold Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the current Loop Protect threshold value: C3(rw)->show spantree lpthreshold The Loop Protect event threshold value is 4 clear spantree lpthreshold Use this command to return the Loop Protect event threshold to its default value of 3.
Page 319: Set Spantree Lpwindow
Use this command to set the Loop Protect event window value in seconds. Syntax set spantree lpwindow value Parameters value Specifies the number of seconds that comprise the period during which Loop Protect events are counted. The default event window is 180 seconds. Defaults None. Mode Switch command, read‐write. Usage The Loop Protect Window is a timer value, in seconds, that defines a period during which Loop Protect events are counted. The default value is 180 seconds. If the timer is set to 0, the event counter is not reset until the Loop Protect event threshold is reached. If the threshold is reached, that constitutes a loop protection event. Example This example shows how to set the Loop Protect event window to 120 seconds: C3(rw)->set spantree lpwindow 120 show spantree lpwindow Use this command to display the current Loop Protect event window value. Syntax show spantree lpwindow SecureStack C3 Configuration Guide 9-49...
Page 320: Clear Spantree Lpwindow
clear spantree lpwindow Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the current Loop Protect window value: C3(rw)->show spantree lpwindow The Loop Protect event window is set to 120 seconds clear spantree lpwindow Use this command to reset the Loop Protect event window to the default value of 180 seconds. Syntax clear spantree lpwindow Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the Loop Protect event window to the default of 180 seconds: C3(rw)->clear spantree lpwindow set spantree lptrapenable Use this command to enable or disable Loop Protect event notification.
Page 321: Show Spantree Lptrapenable
Use this command to display the current status of Loop Protect event notification. Syntax show spantree lptrapenable Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the current Loop Protect event notification status: C3(rw)->show spantree lptrapenable The Loop Protect event notification status is enable clear spantree lptrapenable Use this command to return the Loop Protect event notification state to its default state of disabled. Syntax clear spantree lptrapenable Parameters None. SecureStack C3 Configuration Guide 9-51...
Page 322: Set Spantree Disputedbpduthreshold
set spantree disputedbpduthreshold Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the Loop Protect event notification state to the default of disabled. C3(rw)->clear spantree lptrapenable set spantree disputedbpduthreshold Use this command to set the disputed BPDU threshold, which is the number of disputed BPDUs that must be received on a given port/SID until a disputed BPDU trap is sent. Syntax set spantree disputedbpduthreshold value Parameters value Specifies the number of disputed BPDUs that must be received on a given port/SID to cause a disputed BPDU trap to be sent. A threshold of 0 indicates that traps should not be sent. The default value is 0. Defaults None. Mode Switch command, read‐write. Usage A disputed BPDU is one in which the flags field indicates a designated role and learning, and the priority vector is worse than that already held by the port. If a disputed BPDU is received the port is forced to the listening state. Refer to the 802.1Q‐2005 standard, IEEE Standard for Local and Metropolitan Area Networks – Virtual Bridged Local Area Networks, for a full description of the dispute mechanism, which prevents looping in cases of one‐way communication. The disputed BPDU threshold is an integer variable that represents the number of disputed BPDUs that must be received on a given port/SID until a disputed BPDU trap is sent and a syslog ...
Page 323: Show Spantree Disputedbpduthreshold
None. Mode Switch command, read‐only. Example This example shows how to display the current disputed BPDU threshold: C3(rw)->show spantree disputedbpduthreshold The disputed BPDU threshold value is 0 clear spantree disputedbpduthreshold Use this command to return the disputed BPDU threshold to its default value of 0, meaning that disputed BPDU traps should not be sent. Syntax clear spantree disputedbpduthreshold Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the disputed BPDU threshold to the default of 0: C3(rw)->clear spantree disputedbpduthreshold SecureStack C3 Configuration Guide 9-53...
Page 324: Show Spantree Nonforwardingreason
show spantree nonforwardingreason show spantree nonforwardingreason Use this command to display the reason for placing a port in a non‐forwarding state due to an exceptional condition. Syntax show spantree nonforwardingreason port-string [sid sid] Parameters port‐string Specifies port(s) for which to display the non‐forwarding reason. sid sid (Optional) Specifies the specific Spanning Tree(s) for which to display the non‐forwarding reason. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. Defaults If no port‐string is specified, non‐forwarding reason is displayed for all ports. If no SID is specified, SID 0 is assumed. Mode Switch command, read‐only. Usage Exceptional conditions causing a port to be placed in listening or blocking state include a Loop Protect event, receipt of disputed BPDUs, and loopback detection. Example This example shows how to display the non‐forwarding reason on ge.1.1: C3(rw)->show spantree nonforwardingreason port The non-forwarding reason for port on SID 0 is None 9-54 Spanning Tree Configuration...
Page 325: Vlan Configuration Summary
10-13 Setting the Host VLAN 10-18 Enabling/Disabling GVRP (GARP VLAN Registration Protocol) 10-20 Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of VLAN configuration is located on the Enterasys Networks web site: http://www.enterasys.com/support/manuals/ VLAN Configuration Summary Virtual LANs allow the network administrator to partition network traffic into logical groups and ...
Page 326: Creating A Secure Management Vlan
VLAN Configuration Summary Creating a Secure Management VLAN By default at startup, there is one VLAN configured on the SecureStack C3 device. It is VLAN ID 1, the DEFAULT VLAN. The default community name, which determines remote access for SNMP management, is set to “public” with read‐write access. If the SecureStack C3 device is to be configured for multiple VLANs, it may be desirable to configure a management‐only VLAN. This allows a station connected to the management VLAN to manage the device. It also makes management secure by preventing configuration via ports assigned to other VLANs. To create a secure management VLAN, you must: Step Task Refer to page... Create a new VLAN. 10-5 Set the PVID for the desired switch port to the VLAN created in Step 1. 10-9 Add the desired switch port to the egress list for the VLAN created in 10-15...
Page 327: Viewing Vlans
Parameters static (Optional) Displays information related to static VLANs. Static VLANs are manually created using the set vlan command (“set vlan” on page 10‐5), SNMP MIBs, or the WebView management application. The default VLAN, VLAN 1, is always statically configured and can’t be deleted. Only ports that use a specified VLAN as their default VLAN (PVID) will be displayed. vlan‐list (Optional) Displays information for a specific VLAN or range of VLANs. portinfo (Optional) Displays VLAN attributes related to one or more ports. vlan vlan‐list | (Optional) Displays port information for one or more VLANs. vlan‐name port port‐string (Optional) Displays port information for one or more ports. Defaults If no options are specified, all information related to static and dynamic VLANs will be displayed. Mode Switch command, read‐only. Example This example shows how to display information for VLAN 1. In this case, VLAN 1 is named “DEFAULT VLAN”. Ports allowed to transmit frames belonging to VLAN 1 are listed as egress ports. Ports that won’t include a VLAN tag in their transmitted frames are listed as untagged ports. There are no forbidden ports (prevented from transmitted frames) on VLAN 1: C3(su)->show vlan 1 VLAN: 1 NAME: DEFAULT VLAN SecureStack C3 Configuration Guide 10-3...
Page 328: Show Vlan Output Details
show vlan VLAN Type: Default Egress Ports ge.1.1-10, ge.2.1-4, ge.3.1-7, Forbidden Egress Ports None. Untagged Ports ge.1.1-10, ge.2.1-4, ge.3.1-7, Table 10‐2 provides an explanation of the command output. Table 10-2 show vlan Output Details Output Field What It Displays... VLAN VLAN ID. NAME Name assigned to the VLAN. Status Whether it is enabled or disabled.
Page 329: Creating And Naming Static Vlans
Use this command to create a new static IEEE 802.1Q VLAN, or to enable or disable an existing VLAN. Syntax set vlan {create | enable | disable} vlan-list Parameters create | enable | Creates, enables or disables VLAN(s). disable vlan‐list Specifies one or more VLAN IDs to be created, enabled or disabled. Defaults None. Mode Switch command, read‐write. Usage Once a VLAN is created, you can assign it a name using the set vlan name command described in “set vlan name” on page 10‐6. Each VLAN ID must be unique. If a duplicate VLAN ID is entered, the device assumes that the Administrator intends to modify the existing VLAN. Enter the VLAN ID using a unique number between 1 and 4093. The VLAN IDs of 0 and 4094 and higher may not be used for user‐defined VLANs. Examples This example shows how to create VLAN 3: C3(su)->set vlan create 3 SecureStack C3 Configuration Guide 10-5...
Page 330: Set Vlan Name
set vlan name set vlan name Use this command to set or change the ASCII name for a new or existing VLAN. Syntax set vlan name vlan-list vlan-name Parameters vlan‐list Specifies the VLAN ID of the VLAN(s) to be named. vlan‐name Specifies the string used as the name of the VLAN (1 to 32 characters). Defaults None. Mode Switch command, read‐write. Example This example shows how to set the name for VLAN 7 to green: C3(su)->set vlan name 7 green clear vlan Use this command to remove a static VLAN from the list of VLANs recognized by the device. Syntax clear vlan vlan-list Parameters vlan‐list Specifies the VLAN ID of the VLAN(s) to be removed. Defaults None.
Page 331: Clear Vlan Name
Use this command to remove the name of a VLAN from the VLAN list. Syntax clear vlan name vlan-list Parameters vlan‐list Specifies the VLAN ID of the VLAN(s) for which the name will be cleared. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the name for VLAN 9: C3(su)->clear vlan name 9 SecureStack C3 Configuration Guide 10-7...
Page 332: Assigning Port Vlan Ids (Pvids) And Ingress Filtering
Assigning Port VLAN IDs (PVIDs) and Ingress Filtering Assigning Port VLAN IDs (PVIDs) and Ingress Filtering Purpose To assign default VLAN IDs to untagged frames on one or more ports, to configure VLAN ingress filtering and constraints, and to set the frame discard mode. Commands For information about... Refer to page... show port vlan 10-8 set port vlan 10-9 clear port vlan 10-9 show port ingress filter 10-10 set port ingress filter 10-11...
Page 333: Set Port Vlan
Note: The following command will reset the specified port’s egress status to tagged. To set the specified ports back to the default egress status of untagged, you must issue the set port vlan command as described on page 10-9. Syntax clear port vlan port-string SecureStack C3 Configuration Guide 10-9...
Page 334: Show Port Ingress Filter
show port ingress filter Parameters port‐string Specifies the port(s) to be reset to the host VLAN ID 1. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset ports 1.3 through 11 to a VLAN ID of 1 (Host VLAN): C3(su)->clear port vlan ge.1.3-11 show port ingress filter Use this command to show all ports that are enabled for port ingress filtering, which limits incoming VLAN ID frames according to a port VLAN egress list. If the VLAN ID specified in the received frame is not on the port’s VLAN egress list, then that frame is dropped and not forwarded. Syntax show port ingress-filter [port-string] Parameters port‐string (Optional) Specifies the port(s) for which to display ingress filtering status. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, ingress filtering status for all ports will be displayed.
Page 335: Set Port Ingress Filter
C3(su)->set port ingress-filter ge.1.3 enable show port discard Use this command to display the frame discard mode for one or more ports. Ports can be set to discard frames based on whether or not the frame contains a VLAN tag. They can also be set to discard both tagged and untagged frames, or neither. Syntax show port discard [port-string] Parameters port‐string (Optional) Displays the frame discard mode for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port-string is not specified, frame discard mode will be displayed for all ports. SecureStack C3 Configuration Guide 10-11...
Page 336: Set Port Discard
set port discard Mode Switch command, read‐only. Example This example shows how to display the frame discard mode for 2.7. In this case, the port has been set to discard all tagged frames: C3(su)->show port discard ge.2.7 Port Discard Mode ------------ ------------- ge.2.7 tagged set port discard Use this command to set the frame discard mode on one or more ports. Syntax set port discard port-string {tagged | untagged | both | none} Parameters port‐string Specifies the port(s) for which to set frame discard mode. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1.
Page 337: Configuring The Vlan Egress List
10-14 set vlan egress 10-15 clear vlan egress 10-15 show vlan dynamicegress 10-16 set vlan dynamicegress 10-17 show port egress Use this command to display the VLAN membership for one or more ports. Syntax show port egress [port-string] Parameters port‐string (Optional) Displays VLAN membership for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, VLAN membership will be displayed for all ports. SecureStack C3 Configuration Guide 10-13...
Page 338: Set Vlan Forbidden
set vlan forbidden Mode Switch command, read‐write. Example This example shows you how to show VLAN egress information for 1.1 through 3. In this case, all three ports are allowed to transmit VLAN 1 frames as tagged and VLAN 10 frames as untagged. Both are static VLANs: C3(su)->show port egress ge.1.1-3 Port Vlan Egress Registration Number Status Status ------------------------------------------------------- ge.1.1 tagged static ge.1.1 untagged static ge.1.2 tagged static ge.1.2 untagged static ge.1.3 tagged static ge.1.3 untagged static set vlan forbidden Use this command to prevent one or more ports from participating in a VLAN. This setting ...
Page 339: Set Vlan Egress
Note: The following command will reset the specified port’s egress status to tagged. To set the specified ports back to the default egress status of untagged, you must issue the set vlan egress command as described on page 10-15. SecureStack C3 Configuration Guide 10-15...
Page 340: Show Vlan Dynamicegress
show vlan dynamicegress Syntax clear vlan egress vlan-list port-string [forbidden] Parameters vlan‐list Specifies the number of the VLAN from which a port(s) will be removed from the egress list. port‐string Specifies one or more ports to be removed from the VLAN egress list of the specified vlan‐list. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. forbidden (Optional) Clears the forbidden setting from the specified port(s) and resets the port(s) as able to egress frames if so configured by either static or dynamic means. Defaults If forbidden is not specified, tagged and untagged settings will be cleared. Mode Switch command, read‐write. Examples This example shows how to remove 3.14 from the egress list of VLAN 9: C3(su)->clear vlan egress 9 ge.3.14 This example shows how to remove all Ethernet ports in slot 2 from the egress list of VLAN 4: C3(su)->clear vlan egress 4 ge.2.* show vlan dynamicegress Use this command to display the status of dynamic egress (enabled or disabled) for one or more ...
Page 341: Set Vlan Dynamicegress
Syntax set vlan dynamicegress vlan-list {enable | disable} Parameters vlan‐list Specifies the VLANs by ID to enable or disable dynamic egress. enable | disable Enables or disables dynamic egress. Defaults None. Mode Switch command, read‐write. Usage If dynamic egress is enabled for a particular VLAN, when a port receives a frame tagged with that VLAN’s ID, the switch will add the receiving port to that VLAN’s egress list. Dynamic egress is disabled on the SecureStack C3 by default. For example, assume you have 20 AppleTalk users on your network who are mobile users (that is, use different ports every day), but you want to keep the AppleTalk traffic isolated in its own VLAN. You can create an AppleTalk VLAN with a VLAN ID of 55 with a classification rule that all AppleTalk traffic gets tagged with VLAN ID 55. Then, you enable dynamic egress for VLAN 55. Now, when an AppleTalk user plugs into port ge.3.5 and sends an AppleTalk packet, the switch will tag the packet to VLAN 55 and also add port ge.3.5 to VLAN 55’s egress list, which allows the AppleTalk user to receive AppleTalk traffic. Example This example shows how to enable dynamic egress on VLAN 55: C3(rw)->set vlan dynamicegress 55 enable SecureStack C3 Configuration Guide 10-17...
Page 342: Setting The Host Vlan
Setting the Host VLAN Setting the Host VLAN Purpose To configure a host VLAN that only select devices are allowed to access. This secures the host port for management‐only tasks. Note: The host port is the management entity of the device. Refer to “Creating a Secure Management VLAN” on page 10-2 for more information. Commands For information about... Refer to page... show host vlan 10-18 set host vlan...
Page 343: Clear Host Vlan
“Creating and Naming Static VLANs” on page 10-5. Example This example shows how to set VLAN 7 as the host VLAN: C3(su)->set host vlan 7 clear host vlan Use this command to reset the host VLAN to the default setting of 1. Syntax clear host vlan Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the host VLAN to the default setting: C3(su)->clear host vlan SecureStack C3 Configuration Guide 10-19...
Page 344: Enabling/Disabling Gvrp (Garp Vlan Registration Protocol)
Enabling/Disabling GVRP (GARP VLAN Registration Protocol) Enabling/Disabling GVRP (GARP VLAN Registration Protocol) About GARP VLAN Registration Protocol (GVRP) The following sections describe the device operation when its ports are operating under the Generic Attribute Registration Protocol (GARP) application – GARP VLAN Registration Protocol (GVRP). Overview The purpose of GVRP is to dynamically create VLANs across a switched network. When a VLAN is declared, the information is transmitted out GVRP configured ports on the device in a GARP formatted frame using the GVRP multicast MAC address. A switch that receives this frame, examines the frame, and extracts the VLAN IDs. GVRP then creates the VLANs and adds the receiving port to its tagged member list for the extracted VLAN ID (s). The information is then transmitted out the other GVRP configured ports of the device. Figure 10‐1 shows an example of how VLAN blue from end station A would be propagated across a switch network. How It Works In Figure 10‐1 on page 10‐21, Switch 4, port 1 is registered as being a member of VLAN Blue and then declares this fact out all its ports (2 and 3) to Switch 1 and Switch 2. These two devices register this in the port egress lists of the ports (Switch 1, port 1 and Switch 2, port 1) that received the frames with the information. Switch 2, which is connected to Switch 3 and Switch 5 declares the same information to those two devices and the port egress list of each port is updated with the ...
Page 345: Example Of Vlan Propagation Via Gvrp
= Port declaring VLAN Blue Purpose To dynamically create VLANs across a switched network. The GVRP command set is used to display GVRP configuration information, the current global GVRP state setting, individual port settings (enable or disable) and timer settings. By default, GVRP is enabled globally on the device, but disabled on all ports. Commands For information about... Refer to page... show gvrp 10-22 show garp timer 10-22 set gvrp 10-23 clear gvrp 10-24 set garp timer 10-24 clear garp timer 10-25 SecureStack C3 Configuration Guide 10-21...
Page 346: Show Gvrp
show gvrp show gvrp Use this command to display GVRP configuration information. Syntax show gvrp [port-string] Parameters port‐string (Optional) Displays GVRP configuration information for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, GVRP configuration information will be displayed for all ports and the device. Mode Switch command, read‐only. Example This example shows how to display GVRP status for the device and for fw.2.1: C3(su)->show gvrp ge.2.1 Global GVRP status is enabled. Port Number GVRP status ----------- ----------- ge.2.1 disabled show garp timer Use this command to display GARP timer values for one or more ports.
Page 347: Set Gvrp
CLI” on page 7-1. Join Join timer setting. Leave Leave timer setting. Leaveall Leavall timer setting. set gvrp Use this command to enable or disable GVRP globally on the device or on one or more ports. Syntax set gvrp {enable | disable} [port-string] Parameters disable | Disables or enables GVRP on the device. enable port‐string (Optional) Disables or enables GVRP on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, GVRP will be disabled or enabled for all ports. SecureStack C3 Configuration Guide 10-23...
Page 348: Clear Gvrp
clear gvrp Mode Switch command, read‐write. Examples This example shows how to enable GVRP globally on the device: C3(su)->set gvrp enable This example shows how to disable GVRP globally on the device: C3(su)->set gvrp disable This example shows how to enable GVRP on 1.3: C3(su)->set gvrp enable ge.1.3 clear gvrp Use this command to clear GVRP status or on one or more ports. Syntax clear gvrp [port-string] Parameters port‐string (Optional) Clears GVRP status on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, GVRP status will be cleared for all ports. Mode Switch command, read‐write. Example This example shows how to clear GVRP status globally on the device: C3(su)->clear gvrp set garp timer Use this command to adjust the values of the join, leave, and leaveall timers. ...
Page 349: Clear Garp Timer
C3(su)->set garp timer leave 300 *.*.* This example shows how to set the leaveall timer value to 20000 centiseconds for all ports: C3(su)->set garp timer leaveall 20000 *.*.* clear garp timer Use this command to reset GARP timers back to default values. Syntax clear garp timer {[join] [leave] [leaveall]} port-string Parameters join (Optional) Resets the join timer to 20 centiseconds. leave (Optional) Resets the leave timer to 60 centiseconds. leaveall (Optional) Resets the leaveall time to 1000 centiseconds. port‐string Specifies the port or ports on which to reset the GARP timer(s). Defaults At least one optional parameter must be entered. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 10-25...
Page 350 clear garp timer Example The example shows how to reset the GARP leave timer to 60 centiseconds. C3(su)->clear garp timer leave ge.1.1 10-26 802.1Q VLAN Configuration...
Page 351: Chapter 11: Policy Classification Configuration
• Create, change or remove policy profiles based on business‐specific use of network services. • Permit or deny access to specific services by creating and assigning classification rules which map user profiles to protocol‐based frame filtering policies configured for a particular VLAN or Class of Service (CoS). • Assign or unassign ports to policy profiles so that only ports activated for a profile will be allowed to transmit frames accordingly. Note: It is recommended that you use Enterasys Networks NMS Policy Manager as an alternative to CLI for configuring policy classification on the SecureStack C3 devices. SecureStack C3 Configuration Guide 11-1...
Page 352: Configuring Policy Profiles
Configuring Policy Profiles Configuring Policy Profiles Purpose To review, create, change and remove user profiles that relate to business‐driven policies for managing network resources. Note: B3, C3, and G3 devices support profile-based CoS traffic rate limiting only. Policy rules specifying CoS will only rate limit on D2, C2 and B2 devices, including when C2 and B2 devices are configured on mixed stacks containing B3 and C3 devices.
Page 353: Show Policy Profile Output Details
Displays the precedence of types of rules. Admin Profile Usage Ports administratively assigned to use this policy profile. Oper Profile Usage Ports currently assigned to use this policy profile. Dynamic Profile Port dynamically assigned to use this policy profile. Usage SecureStack C3 Configuration Guide 11-3...
Page 354: Set Policy Profile
set policy profile set policy profile Use this command to create a policy profile entry. Syntax set policy profile profile-index [name name] [pvid-status {enable | disable}] [pvid pvid] [cos-status {enable | disable}] [cos cos] [egress-vlans egress- vlans][forbidden-vlans forbidden-vlans] [untagged-vlans untagged-vlans] [precedence precedence-list] [append] [clear] Parameters profile‐index Specifies an index number for the policy profile. Valid values are 1 ‐ 255. name name (Optional) Specifies a name for the policy profile. This is a string from 1 to ...
Page 355: Clear Policy Profile
C3(su)->set policy profile 1 name netadmin pvid-status enable pvid 10 cos-status enable cos 5 untagged-vlans 10 clear policy profile Use this command to delete a policy profile entry. Syntax clear policy profile profile-index Parameters profile‐index Specifies the index number of the profile entry to be deleted. Valid values are 1 to 255. Defaults None. Mode Switch command, read‐write. Example This example shows how to delete policy profile 8: C3(su)->clear policy profile 8 SecureStack C3 Configuration Guide 11-5...
Page 356: Configuring Classification Rules
Configuring Classification Rules Configuring Classification Rules Purpose To review, create, assign, and unassign classification rules to policy profiles. This maps user profiles to protocol‐based frame filtering policies. Note: B3, C3, and G3 devices support profile-based CoS traffic rate limiting only. Policy rules specifying CoS will only rate limit on D2, C2 and B2 devices, including when C2 and B2 devices are configured on mixed stacks containing B3 and C3 devices.
Page 357 |2048 (0x0800) |16|All | A|NV|fwrd| |Ether |2049 (0x0801) |16|All | A|NV|drop| |Ether |2989 (0x0bad) |16|All | A|NV|drop| |Ether |33079 (0x8137) |16|All | A|NV|drop| This example shows how to display policy classification information for administrative rule 1 C3(su)->show policy rule admin-pid 1 |Admin|Rule Type |Rule Data |Mk|PortStr |RS|ST|dPID|aPID|U| SecureStack C3 Configuration Guide 11-7...
Page 358: Show Policy Capability
show policy capability |admin|Port |ge.1.1 |16|ge.1.1 | A|NV| 1|?| |admin|Port |ge.1.2 |16|ge.1.2 | A|NV| 1|?| |admin|Port |ge.1.3 |16|ge.1.3 | A|NV| 1|?| |admin|Port |ge.1.4 |16|ge.1.4 | A|NV| 1|?| |admin|Port |ge.1.5 |16|ge.1.5 | A|NV| 1|?| |admin|Port |ge.1.6 |16|ge.1.6 | A|NV| 1|?| |admin|Port |ge.1.7 |16|ge.1.7 | A|NV|...
Page 359 | X | X | X | |TCP port destination | X | X | X | |ICMP packet type |TTL |IP type of service | X | X | X | |IP proto | X | X | X | SecureStack C3 Configuration Guide 11-9...
Page 360: Set Policy Rule
set policy rule |Ether II packet type | X | X | X | X | |LLC DSAP/SSAP/CTRL |VLAN tag |Replace tci |Port string | X | X | X | X | X | X | ============================================================= set policy rule Use this command to assign incoming untagged frames to a specific policy profile and to VLAN or ...
Page 361 Specifies that the rule should apply to traffic with the specified TCP destination port. tcpsourceport Specifies that the rule should apply to traffic with the specified TCP source port. udpdestport Specifies that the rule should apply to traffic with the specified UDP destination port. udpsourceport Specifies that the rule should apply to traffic with the specified UDP source port. data Specifies the code for the specified traffic classifier (listed above). This value is dependent on the classification type entered. Refer to Table 11‐3 for valid values for each classification type. mask mask (Optional) Specifies the number of significant bits to match, dependent on the data value entered. Refer to Table 11‐3 for valid values for each classification type and data value. vlan vlan Specifies the action of the rule is to classify to a VLAN ID. cos cos Specifies the action of the rule is to classify to a Class‐of‐Service ID. Valid values are 0 ‐ 4095. A value of ‐1 indicates that no CoS forwarding behavior modification is desired. (Not supported on B3, C3, and G3.) drop | forward Specifies that packets within this classification will be dropped or forwarded. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 11-11...
Page 362: Valid Values For Policy Classification Rules
set policy rule Usage An admin rule can be used to map incoming tagged frames to a policy role (profile). There can be only one admin rule configured per system (stack). Typically, this rule is used to implement the “User + IP phone” legacy feature. Refer to “Configuring User + IP Phone Authentication” on page 26‐48 for more information. You would configure a policy profile/role for IP phones (for example, assigning the traffic to a “voice” VLAN), then associate that policy profile with the admin rule, and associate the admin rule with the desired ports. Users authenticating over the same port will typically use a dynamically assigned policy role. A policy classification rule has two main parts: Traffic Description and Actions. The Traffic Description identifies the type of traffic to which the rule will pertain. Actions specify whether that traffic will be assigned class of service, assigned to a VLAN, or both. Table 11‐3 provides the set policy rule data values that can be entered for a particular parameter, and the mask bits that can be entered for each classifier associated with that parameter. Table 11-3 Valid Values for Policy Classification Rules Classification Rule Parameter data value mask bits ether Type field in Ethernet II packet: Not applicable.
Page 363: Clear Policy Rule
(Optional) Specifies the number of significant bits to match, dependent on the data value entered. Value of mask can range from 1 to 12. Refer to Table 11‐3 for valid values for each classification type and data value. The following parameters apply to deleting a classification rule. profile‐index Specifies a policy profile for which to delete classification rules. Valid profile‐index values are 1 ‐ 255. all‐pid‐entries Deletes all entries associated with the specified policy profile. ether Deletes associated Ethernet II classification rule. ipproto Deletes associated IP protocol classification rule. ipdestsocket Deletes associated IP destination classification rule. ipsourcesocket Deletes associated IP source classification rule. iptos Deletes associated IP Type of Service classification rule. macdest Deletes associated MAC destination address classification rule. macsource Deletes associated MAC source address classification rule. tcpdestport Deletes associated TCP destination port classification rule. tcpsourceport Deletes associated TCP source port classification rule. udpdestport Deletes associated UDP destination port classification rule. udpsourceport Deletes associated UDP source port classification rule. SecureStack C3 Configuration Guide 11-13...
Page 364: Clear Policy All-Rules
clear policy all-rules Defaults When applicable, data and mask must be specified for individual rules to be cleared. Mode Switch command, read‐write. Examples This example shows how to delete Ethernet II Type 1526 classification rule entries associated with policy profile 1 from all ports. C3(su)->clear policy rule 1 ether 1526 This example shows how to remove a rule from policy profile 5 that will forward UDP frames from source port 45. C3(su)->clear policy rule 5 udpportsource 45 forward clear policy all-rules Use this command to remove all policy classification rules. Syntax clear policy all-rules Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to remove all administrative and policy index rules: C3(su)->clear policy all-rules 11-14 Policy Classification Configuration...
Page 365: Assigning Ports To Policy Profiles
11-16 set policy port Use this command to assign ports to a policy profile. Syntax set policy port port-string profile-index Parameters port‐string Specifies the port(s) to add to the policy profile. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. profile‐index Specifies the ID of the policy profile (role) to which the port(s) will be added. This value must match the profile‐index value assigned using the set policy profile command (“set policy profile” on page 11‐4) in order for a policy profile to be active on the specified port. Defaults None. Mode Switch command, read‐write. Example This example shows how to allow Gigabit Ethernet ports 5 through 15 in slot 1 to transmit frames according to policy profile 1: C3(su)->set policy port ge.1.5-15 1 SecureStack C3 Configuration Guide 11-15...
Page 366: Clear Policy Port
clear policy port clear policy port Use this command to remove a policy profile from one or more ports. Syntax clear policy port port-string profile-index Parameters port‐string Specifies the port(s) from which to remove the policy profile. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. profile‐index Specifies the ID of the policy profile (role) to which the port(s) will be added. This value must match the profile‐index value assigned using the set policy profile command (“set policy profile” on page 11‐4) in order for a policy profile to be active on the specified port. Defaults None. Mode Switch command, read‐write. Example This example shows how to remove policy profile 10 from port 21 in slot 1: C3(rw)->clear policy port ge.1.21 10 11-16 Policy Classification Configuration...
Page 367: Configuring Policy Class Of Service (Cos)
Configuring Policy Class of Service (CoS) Configuring Policy Class of Service (CoS) Note: It is recommended that you use Enterasys Networks NMS Policy Manager as an alternative to CLI for configuring policy-based CoS on the switches. The SecureStack C3 supports Class of Service (CoS), which allows you to assign mission‐critical data to a higher priority through the device by delaying less critical traffic during periods of congestion. The higher priority traffic going through the device is serviced first (before lower priority traffic). The Class of Service capability of the device is implemented by a priority ...
Page 368 Configuring Policy Class of Service (CoS) ---------------------------------------------------------------------- Port Group Name :Default Port Group Port Type Assigned Ports :none ---------------------------------------------------------------------- Port Group Name :Users Port Group Port Type Assigned Ports :ge.1.1-46 ---------------------------------------------------------------------- Port Group Name :Uplink Port Group Port Type Assigned Ports :ge.1.47-48 ---------------------------------------------------------------------- Configure physical inbound rate limiters for each port group. For the user port group (1.0), ...
Page 369: About Cos-Based Flood Control
Assign the flood control resource to specific set cos port-config flood-ctrl ports. Example This example creates a broadcast rate limiter (index 1.0) of 5 packets per second and assigns it to ports ge.1.2 and ge.2.2. C3(su)->set cos state enable C3(su)->set cos port-resource flood-ctrl 1.0 broadcast rate 5 C3(su)->set cos port-config flood-ctrl 1.0 ports ge.1.2;ge.2.2 append SecureStack C3 Configuration Guide 11-19...
Page 370: Set Cos State
set cos state Commands For information about... Refer to page... set cos state 11-20 show cos state 11-21 clear cos state 11-21 set cos settings 11-22 clear cos settings 11-23 show cos settings 11-23 set cos port-config 11-24 show cos port-config 11-25 clear cos port-config 11-26...
Page 371: Show Cos State
Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to show the Class of Service enable state: C3(rw)->show cos state Class-of-Service application is enabled clear cos state Use this command to set CoS state back to its default setting of disabled. Syntax clear cos state Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the CoS state back to its default setting of disabled: C3(su)->clear cos state SecureStack C3 Configuration Guide 11-21...
Page 372: Set Cos Settings
set cos settings set cos settings Use this command to configure a Class of Service entry in the CoS settings table. Syntax set cos settings cos-index priority priority [tos-value tos-value] [irl-reference irl-reference] Parameters cos‐index Specifies a Class of Service entry. Valid values are 0 to 255. priority priority Specifies an 802.1d priority value. Valid values are 0 to 7, with 0 being the lowest priority. See Usage section below for more information. tos‐value tos‐value (Optional) Specifies a Type of Service value. Valid values are 0 to 255. See Usage section below for more information. irl‐reference (Optional) Set the inbound rate limiter associated with this entry. Valid irl‐reference values are 0 to 99. See Usage section below for more information. Defaults If no optional parameters are specified, none will be applied. Mode Switch command, read‐write. Usage The CoS settings table takes individual class of service features and displays them as belonging to a CoS entry. Essentially, it is used for CoS feature assignment. Each class of service entry consists of an index, 802.1p priority, an optional ToS value, and an IRL reference. • CoS Index Indexes are unique identifiers for each CoS setting. CoS indexes 0 through 7 are created by ...
Page 373: Clear Cos Settings
Specifies a Class of Service entry to clear. Clears all settings associated with this entry. priority Clears the priority value associated with this entry. tos‐value Clears the Type of Service value associated with this entry. irl‐reference Clear the IRL reference associated with this entry. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the priority for CoS entry 8: C3(rw)->clear cos settings 8 priority show cos settings Use this command to display Class of Service parameters. Syntax show cos settings [cos-list] Parameters cos‐list (Optional) Specifies a Class of Service entry to display. Defaults If not specified, all CoS entries will be displayed. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 11-23...
Page 374: Set Cos Port-Config
set cos port-config Example This example shows how to show all CoS settings: C3(su)->show cos settings CoS Index Priority flood-ctrl --------- ---------- ------- ------- ---------- enabled enabled enabled enabled enabled enabled enabled enabled set cos port-config Use this command to create a port group for inbound rate limiting or flood control and add or remove ports from the group. Syntax set cos port-config {irl|flood-ctrl} group-type-index [name name] [ports port- list] [append] | [clear] Parameters Specifies that this is an inbound rate limiting (IRL) port group.
Page 375: Show Cos Port-Config
C3(su)->set cos port-config irl 2.0 name Uplink ports ge.1.47-48 show cos port-config Use this command to show CoS port groups and the assigned ports. Syntax show cos port-config [irl|flood-ctrl [group-type-index]] Parameters (Optional) Specifies that inbound rate limiting configuration information should be displayed. flood‐ctrl (Optional) Specifies that flood control rate configuration information should be displayed. group‐type‐index (Optional) Show assigned ports for a specific port group. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. Defaults The show cos port‐config command by itself will show all Port Groups. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 11-25...
Page 376: Clear Cos Port-Config
clear cos port-config Example This example shows all inbound rate limiting port groups. Note that ports ge.1.1 through ge.1.48 were removed from the default port group 0.0 when they were added to port groups 1.0 and 2.0. C3(su)->show cos port-config irl Inbound Rate Limiting Port Configuration Entries ---------------------------------------------------------------------- Port Group Name :Default Port Group Port Type Assigned Ports :none ---------------------------------------------------------------------- Port Group Name :Users Port Group Port Type Assigned Ports :ge.1.1-46 ---------------------------------------------------------------------- Port Group Name :Uplink...
Page 377: Set Cos Port-Resource Irl
[type {drop}]}[syslog enable | disable] [trap enable|disable] Parameters group‐type‐index Specifies an inbound rate limiting port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. irl‐index Index number of the inbound rate limiter resource associated with this entry. Valid values range from 0 to 99. unit Unit of measure for the inbound rate limiter (only option is Kbps). kbps Kilobits per second. rate rate Data rate for this inbound rate limiter. This is the actual rate limit. Valid values range from 512 to 1,000,000 Kbps for a Gigabit port. type drop Action for the rate limiter. The only action option is drop the frame if all limiters are exceeded. syslog Enable or disable reporting a syslog entry if limiters are exceeded. enable|disable trap enable|disable Enable or disable sending a trap if limiters are exceeded. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 11-27...
Page 378: Set Cos Port-Resource Flood-Ctrl
set cos port-resource flood-ctrl Usage CoS port resources are where actual physical rate limiters are configured. Resources map directly to the number of rate limiters supported by the port type. (Port type 0 supports 100 IRL resources.) Resources exist for each port group and are indexed as group#.port‐type.irl‐index. Port resources are not initially configured as rate limiting. Inbound rate limiting, or rate policing, simply drops or clips traffic inbound if a configured rate is exceeded. CoS inbound rate limiting allows the user to configure rate limits based on kilobits per second. The show cos port‐resource command displays the resources available for each port group. By default, no IRL resources are configured. The default Rate Limiting algorithm is drop and cannot be configured otherwise. Example This example sets the inbound rate limit resource index number 1 for port group 2.0 to 10000 Kbps or 1 MB: C3(su)->set cos port-resource irl 2.0 1 unit kbps rate 10000 type drop set cos port-resource flood-ctrl Use this command to create a CoS‐based flood control port resource. This resource specifies flood control rate limiters that can be mapped to specific ports. Syntax set cos port-resource flood-ctrl group-type-index {unicast | multicast | broadcast | all} rate rate Parameters group‐type‐index...
Page 379: Show Cos Port-Resource
If irl or flood‐ctrl are not specified, all port resources are shown. If a port group and IRL index are not specified, the IRL configuration for all resources (0‐99) for all configured port groups will be shown. If a port group is not specified with the flood‐ctrl parameter, flood control resources for all configured port groups will be shown. Mode Switch command, read‐only. Examples This example displays the IRL resource index number 1 configuration for group 2.0. C3(su)->show cos port-resource irl 2.0 1 '?' after the rate value indicates an invalid rate value Group Index Resource Type Unit Rate Rate Limit Type Action SecureStack C3 Configuration Guide 11-29...
Page 380: Clear Cos Port-Resource Irl
clear cos port-resource irl ----------- -------- ---- ---- ---------- --------------- ------ kbps 10000 drop none This example displays the flood control resources configured for group 1.0. C3(su)->show cos port-resource flood-ctrl 1.0 '?' after the rate value indicates an invalid rate value Group Resource Type Unit Rate Rate Limit Action Index type --------- ----------- ----------...
Page 381: Clear Cos Port-Resource Flood-Ctrl
Clear unicast port resources for the specified port group. multicast Clear multicast port resources for the specified port group. broadcast Clear broadcast port resources for the specified port group. Clear all flood control port resources for the specified port group. rate (Optional) Clear the data rate limiter of the specified type of port resource to the default (none or disabled). Defaults None. Mode Switch command, read‐write. Example This example clears the unicast port resource for port group 1.0 to default values. C3(su)->clear cos port-resource flood-ctrl 1.0 unicast set cos reference Use this command to set the Class of Service inbound rate limiting reference configuration. Syntax set cos reference irl group-type-index reference rate-limit irl-index SecureStack C3 Configuration Guide 11-31...
Page 382: Show Cos Reference
show cos reference Parameters Specifies that an IRL reference is being configured. group‐type‐index Specifies an inbound rate limiting port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. reference IRL reference number associated with this entry. rate‐limit irl‐index Rate limiter (IRL resource index) to bind this reference to. Valid values range from 0 to 99. Defaults None. Mode Switch command, read‐write. Usage The CoS reference table maps the user‐defined IRL references found in the CoS settings table (see “set cos settings” on page 11‐22) to rate limiters created in the port resource table (see “set cos port‐resource irl” on page 11‐27). The CoS reference table indexes can be thought of as virtual rate limiters. The table accounts for the maximum number of rate limiters supported by the device. The virtual limiters then map to the physical rate limiters. The CoS IRL Reference Table is not configured by default. The CoS IRL reference table uses 100 indexes or virtual rate limiters, and maps each virtual limiter to a physical limiter or resource. An IRL reference table exists for each port group configured, and is indexed similarly to port resources, as port group#, port‐type, reference. IRL references are not populated with limiters (resources), but can be configured by the user. The IRL reference table can be displayed using the show cos reference command. Example In the CoS IRL reference mapping table for port groups 1.0 and 2.0, create a reference for the IRL resource number 1 created for each group. The reference number 1 is used. C3(su)->set cos reference irl 1.0 1 rate-limit 1 C3(su)->set cos reference irl 2.0 1 rate-limit 1 show cos reference Use this command to show the Class of Service inbound rate limiting reference configuration.
Page 383: Clear Cos Reference
C3(su)->show cos reference irl 1.0 Group Index Reference Type Rate Limiter ----------- --------- ---- ------------ none none none none none none clear cos reference Use this command to clear the Class of Service inbound rate limiting reference configuration. Syntax clear cos reference irl {all | group-type-index reference} Parameters Specifies that IRL references are being cleared. all Clear all groups indexes and references. SecureStack C3 Configuration Guide 11-33...
Page 384: Show Cos Unit
show cos unit group‐type‐index Specifies an inbound rate limiting port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. reference Clear a specific reference for the specified port group. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the CoS inbound rate limiting reference configuration for all groups: C3(su)->clear cos reference irl all show cos unit Use this command to show possible CoS unit entries. Syntax show cos unit [irl [port-type index] [kbps]] [flood-ctrl [port-type index] [pps]] Parameters (Optional) Display only IRL unit information.
Page 385: Clear Cos All-Entries
Use this command to clear all Class of Service entries except entries 0‐7. Syntax clear cos all-entries Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the CoS configuration for all entries except entries 0‐7: C3(su)->clear cos all-entries show cos port-type Use this command to display Class of Service port type configurations. Syntax show cos port-type [irl [port-type]] [flood-ctrl [port-type]] Parameters (Optional) Displays inbound rate limiting information. flood‐ctrl (Optional) Displays flood control information. port‐type (Optional) Displays information for a specific port type. (Only port type 0 is supported.) SecureStack C3 Configuration Guide 11-35...
Page 386 show cos port-type Defaults If no parameters are specified, inbound rate limiting and flood control information for all port types is displayed. Mode Switch command, read‐only. Usage The C3 implementation provides one default port type (0) for designating available inbound rate limiting or flood control resources. Port type 0 includes all ports. The port type 0 IRL description is “C3 100 IRL,” which indicates that this port type provides a maximum of 100 inbound rate limiting resources per port group. The port type 0 flood control description is “C3 3 flood‐ctrl” which indicates that this port type provides a maximum of 3 flood control resources per port group. Examples This example shows inbound rate limiting information for port type 0. C3(su)->show cos port-type irl 0 Number of resources: Supported rate types: irl = inbound rate limiter(s) Kbps = kilobits per second Port type Number of Supported Eligible...
Page 387: Chapter 12: Port Priority Configuration
Note: When CoS override is enabled using the set policy profile command as described in “set policy profile” on page 11-4, CoS-based classification rules will take precedence over priority settings configured with the set port priority command described in this section. SecureStack C3 Configuration Guide 12-1...
Page 388: Configuring Port Priority
Configuring Port Priority Configuring Port Priority Purpose To view or configure port priority characteristics as follows: • Display or change the port default Class‐of Service (CoS) transmit priority (0 through 7) of each port for frames that are received (ingress) without priority information in their tag header. • Display the current traffic class mapping‐to‐priority of each port. • Set each port to transmit frames according to 802.1D (802.1p) priority set in the frame header. Commands For information about... Refer to page... show port priority 12-4 set port priority 12-3 clear port priority 12-3 show port priority Use this command to display the 802.1D priority for one or more ports. Syntax show port priority [port-string] Parameters port‐string...
Page 389: Set Port Priority
Specifies a value of 0 to 7 to set the CoS priority for the port entered in the port‐string. Priority value of 0 is the lowest priority. Defaults None. Mode Switch command, read‐write. Usage The set port priority command will not change the 802.1p priority tag on tagged traffic with a default priority tag. The command only has an effect on how untagged traffic will be prioritized as it passes internally through the device. Example This example shows how to set a default priority of 6 on ge.1.3. Frames received by this port without priority information in their frame header are set to the default setting of 6: C3(su)->set port priority 1.3 6 clear port priority Use this command to reset the current CoS port priority setting to 0. This will cause all frames received without a priority value in its header to be set to priority 0. Syntax clear port priority port-string Parameters port‐string Specifies the port for which to clear priority. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. SecureStack C3 Configuration Guide 12-3...
Page 390: Configuring Priority To Transmit Queue Mapping
Configuring Priority to Transmit Queue Mapping Defaults None. Mode Switch command, read‐write. Example This example shows how to reset ge.1.11 to the default priority: C3(rw)->clear port priority 1.11 Configuring Priority to Transmit Queue Mapping Purpose To perform the following: • View the current priority to transmit queue mapping of each physical port. • Configure each port to either transmit frames according to the port priority, set using the set port priority command described in “set port priority” on page 12‐3, or according to a priority based on a percentage of port transmission capacity, assigned to transmit queues using the set port txq command described in “set port txq” on page 12‐8. • Clear current port priority queue settings for one or more ports. Commands For information about... Refer to page... show port priority-queue 12-4 set port priority-queue...
Page 391: Set Port Priority-Queue
Specifies a value of 0 through 5 (0 is the lowest level) that determines the queue on which to transmit the frames with the port priority entered in this command. Note: Although there are 8 queues, only queues 0 through 5 may be configured. Queues 6 and 7 are reserved for management traffic. Defaults None. Mode Switch command, read‐write. Usage This command enables you to change the transmit queue (0 to 5, with 0 being the lowest priority queue) for each port priority of the selected port. You can apply the new settings to one or more ports. SecureStack C3 Configuration Guide 12-5...
Page 392: Clear Port Priority-Queue
clear port priority-queue Example This example shows how to set priority 5 frames received on .2.12 to transmit on queue 0. C3(su)->set port priority-queue ge.2.12 5 0 clear port priority-queue Use this command to reset port priority queue settings back to defaults for one or more ports. Syntax clear port priority-queue port-string Parameters port‐string Specifies the port for which to clear priority‐to‐queue mappings. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the priority queue settings on ge.2.12: C3(su)->clear port priority-queue 2.12 12-6 Port Priority Configuration...
Page 393: Configuring Quality Of Service (Qos)
Refer to page... show port txq 12-7 set port txq 12-8 clear port txq 12-9 show port txq Use this command to display QoS transmit queue information for one or more physical ports. Syntax show port txq [port-string] Parameters port‐string (Optional) Specifies port(s) for which to display QoS settings. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Only physical ports will be displayed. LAG ports have no transmit queue information. Defaults If the port‐string is not specified, the QoS setting of all physical ports will be displayed. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 12-7...
Page 394: Set Port Txq
set port txq Example This example shows how to display the current algorithm and transmit queue weights configured on port ge.1.10: C3(su)->show port txq 1.10 Port ----- --- --- --- --- --- --- --- --- --- 1.10 WRR 10 set port txq Use this command to set QoS transmit queue arbitration values for physical ports. Syntax set port txq port-string value0 value1 value2 value3 value4 value5 value6 value7 Parameters port‐string Specifies port(s) on which to set queue arbitration values. For a detailed ...
Page 395: Clear Port Txq
Use this command to clear port transmit queue values back to their default values. Syntax clear port txq port-string Parameters port‐string Clears transmit queue values on specific port(s) back to their default values. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Only physical ports can be configured with this command. LAG ports cannot be configured. Defaults By default, transmit queues are defined as follows: Queue Mode Weight Queue Mode Weight Mode Switch command, read‐write. Example This example shows how to clear transmit queue values on ge.1.1: C3(su)->clear port txq SecureStack C3 Configuration Guide 12-9...
Page 396 clear port txq 12-10 Port Priority Configuration...
Page 397: Chapter 13: Igmp Configuration
Configuring IGMP on Routing Interfaces 13-10 IGMP Overview About IP Multicast Group Management The Internet Group Management Protocol (IGMP) runs between hosts and their immediately neighboring multicast device. The protocol’s mechanisms allow a host to inform its local device that it wants to receive transmissions addressed to a specific multicast group. A multicast‐enabled device can periodically ask its hosts if they want to receive multicast traffic. If there is more than one device on the LAN performing IP multicasting, one of these devices is elected “querier” and assumes the responsibility of querying the LAN for group members. Based on the group membership information learned from IGMP, a device can determine which (if any) multicast traffic needs to be forwarded to each of its ports. At Layer‐3, multicast devices use this information, along with a multicast routing protocol, to support IP multicasting across an IP network. IGMP provides the final step in an IP multicast packet delivery service, since it is only concerned with forwarding multicast traffic from the local device to group members on a directly attached subnetwork or LAN segment. This device supports IP multicast group management by passively snooping on the IGMP query and IGMP report packets transferred between IP multicast devices and IP multicast host groups to learn IP multicast group members. The purpose of IP multicast group management is to optimize a switched network’s performance so multicast packets will only be forwarded to those ports containing multicast group hosts or multicast devices instead of flooding to all ports in the subnet (VLAN). In addition to passively monitoring IGMP query and report messages, the SecureStack C3 can also actively send L3 IGMP query messages to learn locations of multicast devices and member hosts in multicast groups within each VLAN. However, note that IGMP neither alters nor routes any IP multicast packets. Since IGMP is not concerned with the delivery of IP multicast packets across subnetworks, multicast routing is needed if IP multicast packets have to be routed across different subnetworks. SecureStack C3 Configuration Guide 13-1...
Page 398: About Multicasting
The SecureStack C3 switch device uses IGMP (Internet Group Management Protocol) to query for any attached hosts who want to receive a specific multicast service. The device looks up the IP Multicast Group used for this service and adds it to the egress list of the Level 3 interface. It then propagates the service request on to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service. Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of multicast configuration is located on the Enterasys Networks web site: http://www.enterasys.com/support/manuals/ Configuring IGMP at Layer 2 Purpose To configure IGMP snooping from the switch CLI. Commands For information about...
Page 399: Show Igmpsnooping
Interfaces Enabled for IGMP Snooping... ge.1.1,ge.1.2,ge.1.3 Multicast Control Frame Count....0 Data Frames Forwarded by the CPU....0 set igmpsnooping adminmode Use this command to enable or disable IGMP on the system. Syntax set igmpsnooping adminmode {enable | disable} Parameters enable | disable Enables or disables IGMP snooping on the system. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 13-3...
Page 400: Set Igmpsnooping Interfacemode
set igmpsnooping interfacemode Usage In order for IGMP snooping to be enabled on one or all ports, it must be globally enabled on the device with this command, and then enabled on a port(s) using the set igmpsnooping interface mode command as described in “set igmpsnooping interfacemode” on page 13‐4. Note: IGMP snooping cannot be controlled via WebView. Example This example shows how to enable IGMP on the system: C3(su)->set igmpsnooping adminmode enable set igmpsnooping interfacemode Use this command to enable or disable IGMP on one or all ports. Syntax set igmpsnooping interfacemode port-string {enable | disable} Parameters port‐string Specifies one or more ports on which to enable or disable IGMP. enable | disable Enables or disables IGMP. Defaults None.
Page 401: Set Igmpsnooping Maxresponse
Usage The IGMP group membership interval time sets the frequency of host‐query frame transmissions and must be greater than the IGMP maximum response time as described in “set igmpsnooping maxresponse” on page 13‐5. Example This example shows how to set the IGMP group membership interval to 250 seconds: C3(su)->set igmpsnooping groupmembershipinterval 250 set igmpsnooping maxresponse Use this command to configure the IGMP query maximum response time for the system. Syntax set igmpsnooping maxresponse time Parameters time Specifies the IGMP maximum query response time. Valid values are 100 ‐ 255 seconds. The default value is 100 seconds. This value works together with the set igmpsnooping groupmembershipinterval command to remove ports from an IGMP group and must be lesser than the group membership interval value. Defaults None. Mode Switch command, read‐write. Usage This value must be less than the IGMP maximum response time described in “set igmpsnooping groupmembershipinterval” on page 13‐4. SecureStack C3 Configuration Guide 13-5...
Page 402: Set Igmpsnooping Mcrtrexpiretime
set igmpsnooping mcrtrexpiretime Example This example shows how to set the IGMP maximum response time to 100 seconds: C3(su)->set igmpsnooping maxresponse 100 set igmpsnooping mcrtrexpiretime Use this command to configure the IGMP multicast router expiration time for the system. Syntax set igmpsnooping mcrtrexpire time Parameters time Specifies the IGMP multicast router expiration time. Valid values are 0 ‐ 3600 seconds. A value of 0 will configure the system with an infinite expiration time. The default value is 0. Defaults None. Mode Switch command, read‐write. Usage This timer is for expiring the switch from the multicast database. If the timer expires, and the only address left is the multicast switch, then the entry will be removed. Example This example shows how to set the IGMP multicast router expiration time to infinity: C3(su)->set igmpsnooping mcrtrexpiretime 0 set igmpsnooping add-static This command creates a new static IGMP entry or adds one or more new ports to an existing entry. Syntax set igmpsnooping add-static group vlan-list [modify] [port-string] Parameters...
Page 403: Set Igmpsnooping Remove-Static
[modify] [port-string] Parameters group Specifies the multicast group IP address of the entry. vlan‐list Specifies the VLANs on which the entry is configured. modify (Optional) Removes the specified port or ports from an existing entry. port‐string (Optional) Specifies the port or ports to remove from the entry. Defaults If no ports are specified, all ports are removed from the entry. Mode Switch command, read‐write. Example This example removes port ge.1.1 from the entry for the multicast group with IP address of 233.11.22.33 configured on VLAN 20. C3(su)->set igmpsnooping remove-static 233.11.22.33 20 ge.1.1 show igmpsnooping static This command displays static IGMP ports for one or more VLANs or IGMP groups. Syntax show igmpsnooping static vlan-list [group group] SecureStack C3 Configuration Guide 13-7...
Page 404: Show Igmpsnooping Mfdb
show igmpsnooping mfdb Parameters vlan‐list Specifies the VLAN for which to display static IGMP ports. group group (Optional) Specifies the IGMP group for which to display static IGMP ports. Defaults If no group is specified, information for all groups is displayed. Mode Switch command, read‐only. Example This example displays the static IGMP ports for VLAN 20. C3(su)->show igmpsnooping static 20 -------------------------------------------------------------------------------- Vlan Id = 20 Static Multicast Group Address = 233.11.22.33 Type = IGMP IGMP Port List = ge.1.1 show igmpsnooping mfdb Use this command to display multicast forwarding database (MFDB) information.
Page 405: Clear Igmpsnooping
Use this command to clear all IGMP snooping entries. Syntax clear igmpsnooping Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear all IGMP snooping entries: C3(su)->clear igmpsnooping Are you sure you want to clear all IGMP snooping entries? (y/n) y IGMP Snooping Entries Cleared. SecureStack C3 Configuration Guide 13-9...
Page 406: Configuring Igmp On Routing Interfaces
Configuring IGMP on Routing Interfaces Configuring IGMP on Routing Interfaces Router: The commands covered in this section can be executed only when the device is in router mode. For details on how to enable router configuration modes, refer to “Enabling Router Configuration Modes”...
Page 407: Ip Igmp Enable
Parameters None. Defaults None. Usage Enabling IGMP on a routing interface requires both the ip igmp command (page 13‐10), which enables it on the router, and the ip igmp enable command (page 13‐11), which enables it on an interface. Once these commands are executed, the device will start sending and processing IGMP multicast traffic. IGMP is disabled by default, both globally and on a per interface basis. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to enable IGMP on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp enable ip igmp version Use this command to set the version of IGMP running on the router. The no form of this command resets IGMP to the default version of 2 (IGMPv2). Syntax ip igmp version version no ip igmp SecureStack C3 Configuration Guide 13-11...
Page 408: Show Ip Igmp Interface
show ip igmp interface Parameters version Specifies the IGMP version number to run on the router. Valid values are 1, 2, or 3. Defaults None. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the IGMP version to version 1 on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp version 1 show ip igmp interface Use this command to display information about one or more IGMP routing interfaces. Syntax show ip igmp interface [vlan vlan-id] Parameters vlan vlan‐id (Optional) Displays information for one or more VLANs. Defaults If not specified, information will be displayed for all VLANs configured for IGMP routing. Mode Any router mode.
Page 409: Show Ip Igmp Groups
---------- 228.1.1.1 12.12.12.2 ip igmp query-interval Use this command to set the IGMP query interval on a routing interface. The no form of this command resets the IGMP query interval to the default value of 125 seconds. Syntax ip igmp query-interval time no ip igmp query-interval Parameters time Specifies the IGMP query interval. Valid values are from 1 to 3600 seconds. Default is 125 seconds. Defaults None. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the IGMP query interval to 1800 seconds on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp query-interval 1800 SecureStack C3 Configuration Guide 13-13...
Page 410: Ip Igmp Query-Max-Response-Time
ip igmp query-max-response-time ip igmp query-max-response-time Use this command to set the maximum response time interval advertised in IGMPv2 queries. no form of this command resets the IGMP maximum response time to the default value of 100 (one tenth of a second). Syntax ip igmp query-max-response-time time no ip igmp query-max-response-time Parameters time Specifies the IGMP maximum response time interval. Valid values are ...
Page 411: Ip Igmp Startup-Query-Count
None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the IGMP startup query count to 10 onVLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp startup-query-count 10 ip igmp last-member-query-interval Use this command to set the maximum response time being inserted into group‐specific queries sent in response to leave group messages. The no form of this command resets the IGMP last member query interval to the default value of 1 second. Syntax ip igmp last-member-query-interval time no ip igmp last-member-query-interval Parameters time Specifies the IGMP last member query interval. Valid values are from 0 to 255 seconds. The default value is 1 second. Defaults None. SecureStack C3 Configuration Guide 13-15...
Page 412: Ip Igmp Last-Member-Query-Count
ip igmp last-member-query-count Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the IGMP last member query interval to 10 seconds on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp last-member-query-interval 10 ip igmp last-member-query-count Use this command to set the number of group‐specific queries sent before assuming there are no local members. The no form of this command resets the IGMP last member query count to the default value of 2. Syntax ip igmp last-member-query-count count no ip igmp last-member-query-count Parameters count Specifies the number of IGMP startup queries. Valid values are from 1 to 20. The default value is 2. Defaults None. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the IGMP last member query count to 10 on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp last-member-query-count 10 ip igmp robustness...
Page 413 Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Usage This value determines how many times IGMP messages will be sent. A higher number will mean that end stations will be more likely to see the packet. After the robustness value is reached, IGMP will assume there is no response to queries. Example This example shows how to set the IGMP robustness value to 5 on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp robustness 5 SecureStack C3 Configuration Guide 13-17...
Page 414 ip igmp robustness 13-18 IGMP Configuration...
Page 415: Configuring System Logging
Logging and Network Management This chapter describes switch‐related logging and network management commands and how to use them. Note: The commands in this chapter pertain to network management of the SecureStack C3 device from the switch CLI only. For information on router-related network management tasks, including reviewing router ARP tables and IP traffic, refer to Chapter For information about...
Page 416: Show Logging Server
show logging server For information about... Refer to page... clear logging default 14-6 show logging application 14-6 set logging application 14-7 clear logging application 14-9 show logging local 14-9 set logging local 14-10 clear logging local 14-10 show logging buffer 14-11 show logging interface 14-11...
Page 417: Set Logging Server
[descr descr] [port port] [state {enable | disable}] Parameters index Specifies the server table index number for this server. Valid values are 1 ‐ ip‐addr ip‐addr (Optional) Specifies the Syslog message server’s IP address. facility facility (Optional) Specifies the server’s facility name. Valid values are: local0 to local7. severity severity (Optional) Specifies the severity level at which the server will log messages. Valid values and corresponding levels are: 1 — emergencies (system is unusable) 2 — alerts (immediate action required) 3 — critical conditions 4 — error conditions 5 — warning conditions 6 — notifications (significant conditions) 7 — informational messages 8 — debugging messages descr descr (Optional) Specifies a textual string description of this facility/server. port port (Optional) Specifies the default UDP port the client uses to send to the server. state enable | (Optional) Enables or disables this facility/server configuration. disable SecureStack C3 Configuration Guide 14-3...
Page 418: Clear Logging Server
clear logging server Defaults If ip‐addr is not specified, an entry in the Syslog server table will be created with the specified index number and a message will display indicating that no IP address has been assigned. If not specified, facility, severity and port will be set to defaults configured with the set logging default command (“set logging default” on page 14‐5). If state is not specified, the server will not be enabled or disabled. Mode Switch command, read‐write. Example This command shows how to enable a Syslog server configuration for index 1, IP address 134.141.89.113, facility local4, severity level 3 on port 514: C3(su)->set logging server 1 ip-addr 134.141.89.113 facility local4 severity 3 port 514 state enable clear logging server Use this command to remove a server from the Syslog server table. Syntax clear logging server index Parameters index Specifies the server table index number for the server to be removed. ...
Page 419: Set Logging Default
Use this command to set logging default values. Syntax set logging default {[facility facility] [severity severity] port port]} Parameters facility facility Specifies the default facility name. Valid values are: local0 to local7. severity severity Specifies the default logging severity level. Valid values and corresponding levels are: 1 — emergencies (system is unusable) 2 — alerts (immediate action required) 3 — critical conditions 4 — error conditions 5 — warning conditions 6 — notifications (significant conditions) 7 — informational messages 8 — debugging messages port port Specifies the default UDP port the client uses to send to the server. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 14-5...
Page 420: Clear Logging Default
clear logging default Example This example shows how to set the Syslog default facility name to local2 and the severity level to 4 (error logging): C3(su)->set logging default facility local2 severity 4 clear logging default Use this command to reset logging default values. Syntax clear logging default {[facility] [severity] [port]} Parameters facility (Optional) Resets the default facility name to local4. severity (Optional) Resets the default logging severity level to 6 (notifications of significant conditions). port (Optional) Resets the default UDP port the client uses to send to the server to 514. Defaults At least one optional parameter must be entered. All three optional keywords must be entered to reset all logging values to defaults. Mode Switch command, read‐write. Example This example shows how to reset the Syslog default severity level to 6: C3(su)->clear logging default severity show logging application Use this command to display the severity level of Syslog messages for one or all applications ...
Page 421: Set Logging Application
CLI output. For a description of these entries, which are set using the set logging application command, refer to “set logging application” on page 14-7. set logging application Use this command to set the severity level of log messages for one or all applications. Syntax set logging application {[mnemonic | all]} [level level] SecureStack C3 Configuration Guide 14-7...
Page 422: Mnemonic Values For Logging Applications
set logging application Parameters mnemonic Specifies a case sensitive mnemonic abbreviation of an application to be logged. This parameter will vary depending on the number and types of applications running on your system. To display a complete list, use the show logging application command as described in “show logging application” on page 14‐6. Sample mnemonics and their corresponding applications are listed in Table 14‐3 on page 14‐8. Note: Mnemonic values are case sensitive and must be typed as they appear in Table 14-3. Sets the logging severity level for all applications. level level (Optional) Specifies the severity level at which the server will log messages for applications. Valid values and corresponding levels are: 1 — emergencies (system is unusable) 2 — alerts (immediate action required) 3 — critical conditions 4 — error conditions 5 — warning conditions 6 — notifications (significant conditions) 7 — informational messages 8 — debugging messages Table 14-3...
Page 423: Clear Logging Application
{mnemonic | all} Parameters mnemonic Resets the severity level for a specific application to 6. Valid mnemonic values and their corresponding applications are listed in Table 14‐3 on page 14‐8. Resets the severity level for all applications to 6. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the logging severity level to 6 for SNMP. C3(rw)->clear logging application SNMP show logging local Use this command to display the state of message logging to the console and a persistent file. Syntax show logging local Parameters None. Defaults None. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 14-9...
Page 424: Set Logging Local
set logging local Example This example shows how to display the state of message logging. In this case, logging to the console is enabled and logging to a persistent file is disabled. C3(su)->show logging local Syslog Console Logging enabled Syslog File Logging disabled set logging local Use this command to configure log messages to the console and a persistent file. Syntax set logging local console {enable | disable} file {enable | disable} Parameters console enable | disable Enables or disables logging to the console. file enable | disable Enables or disables logging to a persistent file. Defaults None. Mode Switch command, read‐write.
Page 425: Show Logging Buffer
<165>Sep 4 07:43:09 10.42.71.13 CLI[5]User:rw logged in from 10.2.1.122 (telnet) <165>Sep 4 07:43:24 10.42.71.13 CLI[5]User: debug failed login from 10.4.1.100 (telnet) show logging interface Use this command to display the interface used for the source IP address of the system logging. Syntax show logging interface Parameters None. Defaults None. Mode Switch mode, read‐only. SecureStack C3 Configuration Guide 14-11...
Page 426: Set Logging Interface
set logging interface Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the system logging. C3(rw)->show logging interface loopback 1 192.168.10.1 set logging interface Use this command to specify the interface used for the source IP address of the system logging. Syntax set logging interface {loopback loop-ID | vlan vlan-ID} Parameters loopback loop‐ID Specifies the loopback interface to be used. The value of loop‐ID can range from 0 to 7. vlan vlan‐ID Specifies the VLAN interface to be used. The value of vlan‐ID can range from 1 to 4093. Defaults None. Mode Switch command, read‐write. Usage This command allows you to configure the source IP address used by the system logging application when generating packets for management purposes. Any of the management interfaces, including VLAN routing interfaces, can be configured as the source IP address used in packets generated by the system logging. ...
Page 427: Clear Logging Interface
C3(rw)->set logging interface vlan 100 C3(rw)->show logging interface vlan 100 192.168.10.1 clear logging interface Use this command to clear the interface used for the source IP address of the system logging back to the default of the Host interface. Syntax clear logging interface Parameters None. Defaults None. Mode Switch command, read‐write. Example This command returns the interface used for the source IP address of the system logging back to the default of the Host interface. C3(rw)->show logging interface vlan 100 192.168.10.1 C3(rw)->clear logging interface C3(rw)-> SecureStack C3 Configuration Guide 14-13...
Page 428: Monitoring Network Events And Status
Monitoring Network Events and Status Monitoring Network Events and Status Purpose To display switch events and command history, to set the size of the history buffer, and to display and disconnect current user sessions. Commands For information about... Refer to page... history 14-14 show history 14-15 set history 14-15 ping 14-16 show users 14-16 disconnect 14-17 show netstat 14-17 history Use this command to display the contents of the command history buffer. The command history buffer includes all the switch commands entered up to a maximum of 100, as specified in the set ...
Page 429: Show History
None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the size of the history buffer: C3(su)->show history History buffer size: 20 set history Use this command to set the size of the history buffer. Syntax set history size [default] Parameters size Specifies the size of the history buffer in lines. Valid values are 1 to 100. default (Optional) Makes this setting persistent for all future sessions. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the size of the command history buffer to 30 lines: C3(su)->set history 30 SecureStack C3 Configuration Guide 14-15...
Page 430: Ping
ping ping Use this command to send ICMP echo‐request packets to another node on the network from the switch CLI. Syntax ping host Parameters host Specifies the IP address of the device to which the ping will be sent. Defaults None. Mode Switch command, read‐write. Examples This example shows how to ping IP address 134.141.89.29. In this case, this host is alive: C3(su)->ping 134.141.89.29 134.141.89.29 is alive In this example, the host at IP address is not responding: C3(su)->ping 134.141.89.255 no answer from 134.141.89.255 show users Use this command to display information about the active console port or Telnet session(s) logged in to the switch. Syntax show users Parameters None. Defaults None. Mode Switch command, read‐only.
Page 431: Disconnect
Syntax disconnect {ip-addr | console} Parameters ip‐addr Specifies the IP address of the Telnet session to be disconnected. This address is displayed in the output shown in “show users” on page 12‐15. console Closes an active console port. Defaults None. Mode Switch command, read‐write. Examples This example shows how to close a Telnet session to host 134.141.192.119: C3(su)->disconnect 134.141.192.119 This example shows how to close the current console session: C3(su)->disconnect console show netstat Use this command to display network layer statistics. Syntax show netstat Parameters None. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 14-17...
Page 432: Show Netstat Output Details
show netstat Example The following example shows the output of this command. C3(su)->show netstat Prot Local Address Foreign Address State ---- ----------------------------- ----------------------------- ----------- 127.0.0.1.2222 0.0.0.0.* LISTEN 0.0.0.0.80 0.0.0.0.* LISTEN 0.0.0.0.23 0.0.0.0.* LISTEN 10.1.56.17.23 134.141.99.104.47718 ESTABLISHED 0.0.0.0.17185 0.0.0.0.* 127.0.0.1.49152 127.0.0.1.17185 0.0.0.0.161 0.0.0.0.* 0.0.0.0.* 0.0.0.0.* 0.0.0.0.514 0.0.0.0.* The following table describes the output of this command. Table 14-4 show netstat Output Details Output Field What it displays...
Page 433: Managing Switch Network Addresses And Routes
14-25 clear mac algorithm 14-26 set mac multicast 14-26 clear mac address 14-27 show mac unreserved-flood 14-28 set mac unreserved-flood 14-28 show arp Use this command to display the switch’s ARP table. Syntax show arp Parameters None. Defaults None. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 14-19...
Page 434: Set Arp
set arp Example This example shows how to display the ARP table: C3(su)->show arp LINK LEVEL ARP TABLE IP Address Phys Address Flags Interface ----------------------------------------------------- 10.20.1.1 00-00-5e-00-01-1 host 134.142.21.194 00-00-5e-00-01-1 host 134.142.191.192 00-00-5e-00-01-1 host 134.142.192.18 00-00-5e-00-01-1 host 134.142.192.119 00-00-5e-00-01-1 host ----------------------------------------------------- Table 14‐5 provides an explanation of the command output. Table 14-5 show arp Output Details Output Field What It Displays...
Page 435: Clear Arp
[-w waittime] [-f first-ttl] [-m max-ttl] [-p port] [-q nqueries] [-r] [-d] [-n] [-v] host Parameters ‐w waittime (Optional) Specifies time in seconds to wait for a response to a probe. ‐f first‐ttl (Optional) Specifies the time to live (TTL) of the first outgoing probe packet. ‐m max‐ttl (Optional) Specifies the maximum time to live (TTL) used in outgoing probe packets. ‐p port (Optional) Specifies the base UDP port number used in probes. ‐q nqueries (Optional) Specifies the number of probe inquiries. ‐r (Optional) Bypasses the normal host routing tables. ‐d (Optional) Sets the debug socket option. ‐n (Optional) Displays hop addresses numerically. (Supported in a future release.) SecureStack C3 Configuration Guide 14-21...
Page 436: Show Mac
show mac ‐v (Optional) Displays verbose output, including the size and destination of each response. host Specifies the host to which the route of an IP packet will be traced. Defaults If not specified, waittime will be set to 5 seconds. If not specified, first‐ttl will be set to 1 second. If not specified, max‐ttl will be set to 30 seconds. If not specified, port will be set to 33434. If not specified, nqueries will be set to 3. If ‐r is not specified, normal host routing tables will be used. If ‐d is not specified, the debug socket option will not be used. If ‐v is not specified, summary output will be displayed. Mode Switch command, read‐only. Example This example shows how to use traceroute to display a round trip path to host 192.167.252.17. In this case, hop 1 is the SecureStack C3 switch, hop 2 is 14.1.0.45, and hop 3 is back to the host IP address. Round trip times for each of the three UDP probes are displayed next to each hop: C3(su)->traceroute 192.167.252.17 traceroute to 192.167.252.17 (192.167.252.17), 30 hops max, 40 byte packets matrix.enterasys.com (192.167.201.40) 20.000 ms 20.000 ms 20.000 ms 14.1.0.45 (14.1.0.45) 40.000 ms...
Page 437: Show Mac Agetime
The VLAN ID configured for the multicast MAC address. Status The status of the multicast address. Egress Ports The ports which have been added to the egress ports list. show mac agetime Use this command to display the timeout period for aging learned MAC entries. Syntax show mac agetime Parameters None. SecureStack C3 Configuration Guide 14-23...
Page 438: Set Mac Agetime
set mac agetime Defaults None. Mode Switch command, read‐only. Example This example shows how to display the MAC timeout period: C3(su)->show mac agetime Aging time: 300 seconds set mac agetime Use This command to set the timeout period for aging learned MAC entries. Syntax set mac agetime time Parameters time Specifies the timeout period in seconds for aging learned MAC addresses. Valid values are 10 to 1,000,000 seconds. Default value is 300 seconds. Defaults None. Mode Switch command, read‐only. Example This example shows how to set the MAC timeout period: C3(su)->set mac agetime 250 clear mac agetime Use this command to reset the timeout period for aging learned MAC entries to the default value ...
Page 439: Set Mac Algorithm
{mac-crc16-lowerbits | mac-crc16-upperbits | mac-crc32-lowerbits | mac-crc32-upperbits} Parameters mac‐crc16‐lowerbits Select the MAC CRC 16 lower bits algorithm for hashing. mac‐crc16‐upperbits Select the MAC CRC 16 upper bits algorithm for hashing. mac‐crc32‐lowerbits Select the MAC CRC 32 lower bits algorithm for hashing. mac‐crc32‐upperbits Select the MAC CRC 32 upper bits algorithm for hashing. Defaults The default MAC algorithm is mac‐crc16‐upperbits. Mode Switch command, read‐write. Usage Each algorithm is optimized for a different spread of MAC addresses. When changing this mode, the switch will display a warning message and prompt you to restart the device. The default MAC algorithm is mac‐crc16‐upperbits. Example This example sets the hashing algorithm to mac‐crc32‐upperbits. C3(rw)->set mac algorithm mac-crc32-upperbits show mac algorithm This command displays the currently selected MAC algorithm mode. Syntax show mac algorithm SecureStack C3 Configuration Guide 14-25...
Page 440: Clear Mac Algorithm
clear mac algorithm Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows the output of this command. C3(su)->show mac algorithm Mac hashing algorithm is mac-crc16-upperbits. clear mac algorithm Use this command to return the MAC hashing algorithm to the default value of mac‐crc16‐ upperbits. Syntax clear mac algorithm Parameters None. Defaults None. Mode Switch command, read‐write. Example This example resets the MAC hashing algorithm to the default value. C3(su)->clear mac algorithm set mac multicast Use this command to define on what ports within a VLAN a multicast address can be dynamically ...
Page 441: Clear Mac Address
Example This example configures multicast MAC address 01‐01‐22‐33‐44‐55 for VLAN 24. C3(su)->set mac multicast 01-01-22-33-44-55 24 clear mac address Use this command to remove a multicast MAC address. Syntax clear mac address mac-address [vlan-id] Parameters mac‐address Specifies the multicast MAC address to be cleared. The MAC address can be formatted as xx:xx:xx:xx:xx:xx or xx‐xx‐xx‐xx‐xx‐xx. vlan‐id (Optional) Specifies the VLAN ID from which to clear the static multicast MAC address. Defaults If no vlan‐id is specified, the multicast MAC address is cleared from all VLANs. Mode Switch command, read‐write. Example This example clears multicast MAC address 01‐01‐22‐33‐44‐55 from VLAN 24. C3(su)->clear mac multicast 01-01-22-33-44-55 24 SecureStack C3 Configuration Guide 14-27...
Page 442: Show Mac Unreserved-Flood
show mac unreserved-flood show mac unreserved-flood Use this command to display the state of multicast flood protection. Syntax show mac unreserved-flood Parameters None. Defaults None. Mode Switch command, read‐write. Example This example displays the status of multicast flood protection. C3(su)->show mac unreserved-flood mac unreserved flood is disabled. set mac unreserved-flood Use this command to enable or disable multicast flood protection. When enabled, this prevents policy profiles requiring a full 10 masks from being loaded. Syntax set mac unreserved-flood {disable | enable} Parameters disable | enable Disables or enables multicast flood protection.
Page 443: Configuring Simple Network Time Protocol (Sntp)
14-34 clear sntp poll-retry 14-34 set sntp poll-timeout 14-35 clear sntp poll-timeout 14-35 set timezone 14-36 show sntp interface 14-37 set sntp interface 14-37 clear sntp interface 14-38 show sntp Use this command to display SNTP client settings. Syntax show sntp SecureStack C3 Configuration Guide 14-29...
Page 444: Show Sntp Output Details
show sntp Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display SNTP client settings: C3(su)->show sntp SNTP Version: 3 Current Time: TUE SEP 09 16:13:33 2003 Timezone: 'EST', offset from UTC is -4 hours and 0 minutes Client Mode: unicast Broadcast Count: 0 Poll Interval: 512 seconds Poll Retry: 1 Poll Timeout: 5 seconds SNTP Poll Requests: 1175...
Page 445: Set Sntp Client
{broadcast | unicast | disable} Parameters broadcast Enables SNTP in broadcast client mode. unicast Enables SNTP in unicast (point‐to‐point) client mode. In this mode, the client must supply the IP address from which to retrieve the current time. disable Disables SNTP. Defaults None. Mode Switch command, read‐write. Example This example shows how to enable SNTP in broadcast mode: C3(su)->set sntp client broadcast clear sntp client Use this command to clear the SNTP client’s operational mode. Syntax clear sntp client Parameters None. SecureStack C3 Configuration Guide 14-31...
Page 446: Set Sntp Server
set sntp server Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the SNTP client’s operational mode: C3(su)->clear sntp client set sntp server Use this command to add a server from which the SNTP client will retrieve the current time when operating in unicast mode. Up to 10 servers can be set as SNTP servers. Syntax set sntp server ip-address [precedence] Parameters ip‐address Specifies the SNTP server’s IP address. precedence (Optional) Specifies this SNTP server’s precedence in relation to its peers. Valid values are 1 (highest) to 10 (lowest). Defaults If precedence is not specified, 1 will be applied. Mode Switch command, read‐write. Example This example shows how to set the server at IP address 10.21.1.100 as an SNTP server: C3(su)->set sntp server 10.21.1.100 clear sntp server Use this command to remove one or all servers from the SNTP server list.
Page 447: Set Sntp Poll-Interval
Use this command to set the poll interval between SNTP unicast requests. Syntax set sntp poll-interval value Parameters value The poll interval is 2 to the power of value in seconds, where value can range from 6 to 10. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the SNTP poll interval to 64 seconds: C3(su)->set sntp poll-interval 6 clear sntp poll-interval Use this command to clear the poll interval between unicast SNTP requests. Syntax clear sntp poll-interval Parameters None. Defaults None. SecureStack C3 Configuration Guide 14-33...
Page 448: Set Sntp Poll-Retry
set sntp poll-retry Mode Switch command, read‐write. Example This example shows how to clear the SNTP poll interval: C3(su)->clear sntp poll-interval set sntp poll-retry Use this command to set the number of poll retries to a unicast SNTP server. Syntax set sntp poll-retry retry Parameters retry Specifies the number of retries. Valid values are 0 to 10. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the number of SNTP poll retries to 5: C3(su)->set sntp poll-retry 5 clear sntp poll-retry Use this command to clear the number of poll retries to a unicast SNTP server. Syntax clear sntp poll-retry Parameters None.
Page 449: Set Sntp Poll-Timeout
Parameters timeout Specifies the poll timeout in seconds. Valid values are 1 to 30. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the SNTP poll timeout to 10 seconds: C3(su)->set sntp poll-timeout 10 clear sntp poll-timeout Use this command to clear the SNTP poll timeout. Syntax clear sntp poll-timeout Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the SNTP poll timeout: C3(su)->clear sntp poll-timeout SecureStack C3 Configuration Guide 14-35...
Page 450: Set Timezone
set timezone set timezone Use this command to configure the current timezone as an offset from UTC. Syntax set timezone name [hours] [minutes] Parameters name The name of the timezone. Typically, this name is a standard abbreviation such as EST (Eastern Standard Time) or EDT (Eastern Daylight Time). hours (Optional) Specifies the offset in hours from UTC. The value can range from ‐13 to 13. The default is 0 hours. minutes (Optional) Specifies additional offset in minutes from UTC. The value can range from 0 to 59. The default is 0 minutes. Defaults If you enter a timezone name without specifying an offset in hours and minutes, the default is an offset from UTC of 0 hours and 0 minutes. Mode Switch command, read‐write. Usage Typically, this command is used to configure the local timezone offset from UTC (Univeral Time) when SNTP is used to synchronize the time used by devices on the network. To display the current timezone setting used by SNTP, use the show sntp command. To clear an existing offset to zero, enter the command without specifying any hours or minutes. Standard timezone names and offsets can be found at the following URL, among others: http://www.timeanddate.com/library/abbreviations/timezones/ Example The following example sets the timezone name to EST and the offset to North American Eastern Standard Time offset of ‐5 hours from UTC, then displays the timezone used with SNTP. C3(su)->set timezone EST -5 C3(su)->show sntp SNTP Version: 3 Current Time: WED JUL 16 11:35:52 2008...
Page 451: Show Sntp Interface
Mode Switch mode, read‐only. Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the SNTP client. C3(rw)->show sntp interface loopback 1 192.168.10.1 set sntp interface Use this command to specify the interface used for the source IP address of the SNTP client. Syntax set sntp interface {loopback loop-ID | vlan vlan-ID} Parameters loopback loop‐ID Specifies the loopback interface to be used. The value of loop‐ID can range from 0 to 7. vlan vlan‐ID Specifies the VLAN interface to be used. The value of vlan‐ID can range from 1 to 4093. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 14-37...
Page 452: Clear Sntp Interface
clear sntp interface Usage This command allows you to configure the source IP address used by the SNTP application when generating packets for management purposes. Any of the management interfaces, including VLAN routing interfaces, can be configured as the source IP address used in packets generated by the SNTP client. An interface must have an IP address assigned to it before it can be set by this command. If no interface is specified, then the IP address of the Host interface will be used. If a non‐loopback interface is configured with this command, application packet egress is restricted to that interface if the server can be reached from that interface. Otherwise, the packets are transmitted over the first available route. Packets from the application server are received on the configured interface. If a loopback interface is configured, and there are multiple paths to the application server, the outgoing interface (gateway) is determined based on the best route lookup. Packets from the application server are then received on the sending interface. If route redundancy is required, therefore, a loopback interface should be configured. Example This example configures an IP address on VLAN interface 100 and then sets that interface as the SNTP client source IP address. C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0 C3(rw)->router(Config-if(Vlan 100))#exit C3(rw)->router(Config)#exit C3(rw)->router#exit C3(rw)->router>exit C3(rw)->set sntp interface vlan 100 C3(rw)->show sntp interface vlan 100 192.168.10.1 clear sntp interface Use this command to clear the interface used for the source IP address of the SNTP client back to ...
Page 453 Example This command returns the interface used for the source IP address of the SNTP client back to the default of the Host interface. C3(rw)->show sntp interface vlan 100 192.168.10.1 C3(rw)->clear sntp interface C3(rw)-> SecureStack C3 Configuration Guide 14-39...
Page 454: Configuring Node Aliases
Configuring Node Aliases Configuring Node Aliases The node alias feature enables administrators to determine the MAC address and location of a given end‐station (or node) using the node’s Layer 3 alias information (IP address) as a key. With this method, it is possible to determine that, for instance, IP address 123.145.2.23 is located on switch 5 port 3. The passive accumulation of a networkʹs node/alias information is accomplished by “snooping” on the contents of network traffic as it passes through the switch fabric. In the C3, node data is automatically accumulated into the ct‐alias mib, and by default this feature is enabled. The NetSight Console Compass utility and Automated Security Manager (ASM) use the information in the node/alias MIB table. Itʹs important to make sure that inter‐switch links are not learning node/alias information, as it would slow down searches by the NetSight Compass and ASM tools and give inaccurate results. Purpose To review, disable, and re‐enable node (port) alias functionality on the switch. Commands For information about... Refer to page... show nodealias config 14-40 set nodealias 14-41 clear nodealias config 14-42 show nodealias config Use this command to display node alias configuration settings on one or more ports.
Page 455: Set Nodealias
Whether or not a node alias agent is enabled (default) or disabled on this port. set nodealias Use this command to enable or disable a node alias agent on one or more ports, or set the maximum number of alias entries stored per port. Syntax set nodealias {enable | disable | maxentries maxentries} port-string Parameters enable | disable Enables or disables a node alias agent. maxentries maxentries Set the maximum number of alias entries stored per port. Valid range is 0 to 4096. The default value is 32. port‐string Specifies the port(s) on which to enable/disable node alias agent or set a maximum number of stored entries. Defaults None. Mode Switch command, read‐write. Usage Upon packet reception, node aliases are dynamically assigned to ports enabled with an alias agent, which is the default setting on SecureStack C3 devices. Node aliases cannot be statically created, but can be deleted using the command “clear nodealias config” (page 14‐42). SecureStack C3 Configuration Guide 14-41...
Page 456: Clear Nodealias Config
clear nodealias config Itʹs important to make sure that inter‐switch links are not learning node/alias information, as it would slow down searches by the NetSight Compass and ASM tools and give inaccurate results. Example This example shows how to disable the node alias agent on ge.1.3: C3(su)->set nodealias disable ge.1.3 clear nodealias config Use this command to reset node alias state to enabled and clear the maximum entries value. Syntax clear nodealias config port-string Parameters port‐string Specifies the port(s) on which to reset the node alias configuration. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the node alias configuration on ge.1.3 C3(su)->clear nodealias config ge.1.3 14-42 Logging and Network Management...
Page 457: Chapter 15: Rmon Configuration
“set rmon stats” on interface on the device. packets, CRC errors, page 15-4 oversized and undersized “clear rmon stats” on packets, fragments, jabbers, page 15-5 and counters for packets. SecureStack C3 Configuration Guide 15-1...
Page 458 Design Considerations Table 15-1 RMON Monitoring Group Functions and Commands (Continued) RMON Group What It Does... What It Monitors... CLI Command(s) History Records periodic statistical Sample period, number of “show rmon history” on samples from a network. samples and item(s) sampled. page 15-6 “set rmon history”...
Page 459: Statistics Group Commands
Statistics Group Commands Purpose To display, configure, and clear RMON statistics. Note: Due to hardware limitations, the only frame error counted is oversized frames. Commands For information about... Refer to page... show rmon stats 15-4 set rmon stats 15-4 clear rmon stats 15-5 SecureStack C3 Configuration Guide 15-3...
Page 460: Show Rmon Stats
show rmon stats show rmon stats Use this command to display RMON statistics measured for one or more ports. Syntax show rmon stats [port-string] Parameters port‐string (Optional) Displays RMON statistics for specific port(s). Defaults If port‐string is not specified, RMON stats will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display RMON statistics for Gigabit Ethernet port 1 in switch 1. C3(su)->show rmon stats ge.1.1 Port: ge.1.1 ------------------------------------- Index Owner = monitor Data Source = ifIndex.1 Drop Events Packets Collisions Octets Jabbers 64 Octets...
Page 461: Clear Rmon Stats
Example This example shows how to configure RMON statistics entry 2 for ge.1.20: C3(rw)->set rmon stats 2 ge.1.20 clear rmon stats Use this command to delete one or more RMON statistics entries. Syntax clear rmon stats {index-list | to-defaults} Parameters index‐list Specifies one or more stats entries to be deleted, causing them to disappear from any future RMON queries. to‐defaults Resets all history entries to default values. This will cause entries to reappear in RMON queries. Defaults None. Mode Switch command, read‐write. Example This example shows how to delete RMON statistics entry 2: C3(rw)->clear rmon stats 2 SecureStack C3 Configuration Guide 15-5...
Page 462: History Group Commands
History Group Commands History Group Commands Purpose To display, configure, and clear RMON history properties and statistics. Commands For information about... Refer to page... show rmon history 15-6 set rmon history 15-7 clear rmon history 15-7 show rmon history Use this command to display RMON history properties and statistics. The RMON history group records periodic statistical samples from a network. Syntax show rmon history [port-string] Parameters port‐string (Optional) Displays RMON history entries for specific port(s). Defaults If port‐string is not specified, information about all RMON history entries will be displayed.
Page 463: Set Rmon History
(Optional) Specifies the maximum number of entries to maintain. interval interval (Optional) Specifies the sampling interval in seconds. owner owner (Optional) Specifies an owner for this entry. Defaults If buckets is not specified, the maximum number of entries maintained will be 50. If not specified, interval will be set to 30 seconds. If owner is not specified, monitor will be applied. Mode Switch command, read‐write. Example This example shows how configure RMON history entry 1 on port ge.2.1 to sample every 20 seconds: C3(rw)->set rmon history 1 ge.2.1 interval 20 clear rmon history Use this command to delete one or more RMON history entries or reset one or more entries to default values. For specific values, refer to “set rmon history” on page 15‐7. Syntax clear rmon history {index-list | to-defaults} SecureStack C3 Configuration Guide 15-7...
Page 464 clear rmon history Parameters index‐list Specifies one or more history entries to be deleted, causing them to disappear from any future RMON queries. to‐defaults Resets all history entries to default values. This will cause entries to reappear in RMON queries. Defaults None. Mode Switch command, read‐write. Example This example shows how to delete RMON history entry 1: C3(rw)->clear rmon history 1 15-8 RMON Configuration...
Page 465: Alarm Group Commands
Owner = Manager Status = valid Variable = 1.3.6.1.4.1.5624.1.2.29.1.2.1.0 Sample Type = delta Startup Alarm = rising Interval = 30 Value Rising Threshold Falling Threshold Rising Event Index Falling Event Index = 0 Table 15‐2 provides an explanation of the command output. SecureStack C3 Configuration Guide 15-9...
Page 466: Set Rmon Alarm Properties
set rmon alarm properties Table 15-2 show rmon alarm Output Details Output Field What It Displays... Index Index number for this alarm entry. Owner Text string identifying who configured this entry. Status Whether this event entry is enabled (valid) or disabled. Variable MIB object to be monitored.
Page 467: Set Rmon Alarm Status
Mode Switch command, read‐write. Example This example shows how to configure a rising RMON alarm. This entry will conduct monitoring of the delta between samples every 30 seconds: C3(rw)->set rmon alarm properties 3 interval 30 object 1.3.6.1.4.1.5624.1.2.29.1.2.1.0 type delta rthresh 1 revent 2 owner Manager set rmon alarm status Use this command to enable an RMON alarm entry. An alarm is a notification that a statistical sample of a monitored variable has crossed a configured threshold. Syntax set rmon alarm status index enable SecureStack C3 Configuration Guide 15-11...
Page 468: Clear Rmon Alarm
clear rmon alarm Parameters index Specifies an index number for this entry. Maximum number or entries is 50. Maximum value is 65535. enable Enables this alarm entry. Defaults None. Mode Switch command, read‐write. Usage An RMON alarm entry can be created using this command, configured using the set rmon alarm properties command (“set rmon alarm properties” on page 15‐10), then enabled using this command. An RMON alarm entry can be created and configured at the same time by specifying an unused index with the set rmon alarm properties command. Example This example shows how to enable RMON alarm entry 3: C3(rw)->set rmon alarm status 3 enable clear rmon alarm Use this command to delete an RMON alarm entry. Syntax clear rmon alarm index Parameters index Specifies the index number of entry to be cleared. Defaults None.
Page 469: Event Group Commands
C3(rw)->show rmon event 3 Index 3 ---------------- Owner = Manager Status = valid Description = STP Topology change Type = log-and-trap Community = public Last Time Sent = 0 days 0 hours 0 minutes 37 seconds Table 15‐3 provides an explanation of the command output. SecureStack C3 Configuration Guide 15-13...
Page 470: Set Rmon Event Properties
set rmon event properties Table 15-3 show rmon event Output Details Output Field What It Displays... Index Index number for this event entry. Owner Text string identifying who configured this entry. Status Whether this event entry is enabled (valid) or disabled. Description Text string description of this event.
Page 471: Set Rmon Event Status
Specifies an index number for this entry. Maximum number of entries is 100. Maximum value is 65535. enable Enables this event entry. Defaults None. Mode Switch command, read‐write. Usage An RMON event entry can be created using this command, configured using the set rmon event properties command (“set rmon event properties” on page 15‐14), then enabled using this command. An RMON event entry can be created and configured at the same time by specifying an unused index with the set rmon event properties command. Example This example shows how to enable RMON event entry 1: C3(rw)->set rmon event status 1 enable clear rmon event Use this command to delete an RMON event entry and any associated log entries. Syntax clear rmon event index Parameters index Specifies the index number of the entry to be cleared. SecureStack C3 Configuration Guide 15-15...
Page 472 clear rmon event Defaults None. Mode Switch command, read‐write. Example This example shows how to clear RMON event 1: C3(rw)->clear rmon event 1 15-16 RMON Configuration...
Page 473: Filter Group Commands
15-18 clear rmon channel 15-19 show rmon filter 15-19 set rmon filter 15-20 clear rmon filter 15-21 show rmon channel Use this command to display RMON channel entries for one or more ports. Syntax show rmon channel [port-string] Parameters port‐string (Optional) Displays RMON channel entries for a specific port(s). Defaults If port‐string is not specified, information about all channels will be displayed. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 15-17...
Page 474: Set Rmon Channel
set rmon channel Example This example shows how to display RMON channel information for ge.2.12: C3(rw)->show rmon channel ge.2.12 Port ge.2.12 Channel index= 628 EntryStatus= valid ---------------------------------------------------------- Control AcceptType matched OnEventIndex OffEventIndex EventIndex Status ready Matches 4498 Description Thu Dec 16 12:57:32 EST 2004 Owner NetSight smith set rmon channel Use this command to configure an RMON channel entry.
Page 475: Clear Rmon Channel
Specifies the channel entry to be cleared. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear RMON channel entry 2: C3(rw)->clear rmon channel 2 show rmon filter Use this command to display one or more RMON filter entries. Syntax show rmon filter [index index | channel channel] Parameters index index | (Optional) Displays information about a specific filter entry, or about all channel channel filters which belong to a specific channel. Defaults If no options are specified, information for all filter entries will be displayed. Mode Switch command, read‐only. Example This example shows how to display all RMON filter entries and channel information: SecureStack C3 Configuration Guide 15-19...
Page 476: Set Rmon Filter
set rmon filter C3(rw)->show rmon filter Index= 55508 Channel Index= 628 EntryStatus= valid ---------------------------------------------------------- Data Offset PktStatus PktStatusMask PktStatusNotMask Owner ETS,NAC-D ----------------------------- Data ff ff ff ff ff ff ----------------------------- DataMask ff ff ff ff ff ff ----------------------------- DataNotMask 00 00 00 00 00 00 set rmon filter Use this command to configure an RMON filter entry.
Page 477: Clear Rmon Filter
C3(rw)->set rmon filter 1 9 offset 30 data 0a154305 dmask ffffffff clear rmon filter Use this command to clear an RMON filter entry. Syntax clear rmon filter {index index | channel channel} Parameters index index | Clears a specific filter entry, or all entries belonging to a specific channel. channel channel Defaults None. Mode Switch command, read‐write. Example This example shows how to clear RMON filter entry 1: C3(rw)->clear rmon filter index 1 SecureStack C3 Configuration Guide 15-21...
Page 478: Packet Capture Commands
Packet Capture Commands Packet Capture Commands Note that packet capture filter is sampling only and does not guarantee receipt of back‐to‐back packets. Purpose To display RMON capture entries, configure, enable, or disable capture entries, and clear capture entries. Commands For information about... Refer to page... show rmon capture 15-22 set rmon capture 15-23 clear rmon capture 15-24 show rmon capture Use this command to display RMON capture entries and associated buffer control entries. Syntax show rmon capture [index [nodata]] Parameters index (Optional) Displays the specified buffer control entry and all captured ...
Page 479: Set Rmon Capture
[offset offset] [asksize asksize] [owner owner]} Parameters index Specifies a buffer control entry. channel Specifies the channel to which this capture entry will be applied. action lock (Optional) Specifies the action of the buffer when it is full as: • lock ‐ Packets will cease to be accepted slice slice (Optional) Specifies the maximum octets from each packet to be saved in a buffer. Currently, the only value allowed is 1518. loadsize loadsize (Optional) Specifies the maximum octets from each packet to be downloaded from the buffer. The default is 100. offset offset (Optional) Specifies the first octet from each packet that will be retrieved. asksize asksize (Optional) Specifies the requested maximum octets to be saved in this buffer. Currently, the only value accepted is ‐1, which requests as many octets as possible. owner (Optional) Specifies the name of the entity that configured this entry. Defaults If not specified, action defaults to lock. If not specified, offset defaults to 0. If not specified, asksize defaults to ‐1 (which will request as many octets as possible). If slice is not specified, 1518 will be applied. If loadsize is not specified, 100 will be applied. If owner is not specified, it will be set to monitor. SecureStack C3 Configuration Guide 15-23...
Page 480: Clear Rmon Capture
clear rmon capture Mode Switch command, read‐write. Example This example shows how to create RMON capture entry 1 to “listen” on channel 628: C3(rw)->set rmon capture 1 628 clear rmon capture Use this command to clears an RMON capture entry. Syntax clear rmon capture index Parameters index Specifies the capture entry to be cleared. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear RMON capture entry 1: C3(rw)->clear rmon capture 1 15-24 RMON Configuration...
Page 481: Chapter 16: Dhcp Server Configuration
Configuring IP Address Pools 16-12 DHCP Overview Dynamic Host Configuration Protocol (DHCP) for IPv4 is a network layer protocol that implements automatic or manual assignment of IP addresses and other configuration information to client devices by servers. A DHCP server manages a user‐configured pool of IP addresses from which it can make assignments upon client requests. A relay agent passes DHCP messages between clients and servers which are on different physical subnets. DHCP Relay Agent The DHCP/BOOTP relay agent function can be configured on all of the SecureStack C3’s routing interfaces. The relay agent can forward a DHCP client’s request to a DHCP server located on a different network if the address of the server is configured as a helper address on the receiving interface. The relay agent interface must be a VLAN which is configured with an IP address. Refer to the ip helper‐address command (“ip helper‐address” on page 19‐18) for more information. DHCP Server DHCP server functionality allows the SecureStack C3 switch to provide basic IP configuration information to a client on the network who requests such information using the DHCP protocol. DHCP provides the following mechanisms for IP address allocation by a DHCP server: • Automatic—DHCP server assigns an IP address to a client for a limited period of time (or until the client explicitly relinquishes the address) from a defined pool of IP addresses configured on the server. • Manual—A client’s IP address is assigned by the network administrator, and DHCP is used simply to convey the assigned address to the client. This is managed by means of “static” address pools configured on the server. The amount of time that a particular IP address is valid for a system is called a lease. The SecureStack C3 maintains a lease database which contains information about each assigned IP SecureStack C3 Configuration Guide 16-1...
Page 482: Configuring A Dhcp Server
NetBIOS WINS server(s) and node name • Boot file • DHCP options as defined by RFC 2132 Note: A total of 16 address pools, dynamic and/or static, and a maximum of 256 addresses for the entire switch, can be configured on the SecureStack C3 Configuring a DHCP Server For DHCP to function on SecureStack C3 systems, the system has to “know about” the IP network for which the DHCP pool is to be created. On the C3, there are two ways to configure a DHCP server: one is to associate the DHCP address pool with the switch’s host port IP address, and the other is to associate the DHCP address pool ...
Page 483: Configuring General Dhcp Server Parameters
192.0.0.200 255.255.255.0 • Set other DHCP server parameters such as the number of ping packets to be sent before assigning an IP address, or enabling conflict logging. Configuring General DHCP Server Parameters Purpose To configure DHCP server parameters, and to display and clear address binding information, server statistics, and conflict information. Commands For information about... Refer to page... set dhcp 16-4 set dhcp bootp 16-4 set dhcp conflict logging 16-5 show dhcp conflict 16-5 SecureStack C3 Configuration Guide 16-3...
Page 484: Set Dhcp
set dhcp For information about... Refer to page... clear dhcp conflict 16-6 set dhcp exclude 16-7 clear dhcp exclude 16-7 set dhcp ping 16-8 clear dhcp ping 16-8 show dhcp binding 16-9 clear dhcp binding 16-9 show dhcp server statistics 16-10 clear dhcp server statistics 16-10...
Page 485: Set Dhcp Conflict Logging
Use this command to enable conflict logging. By default, conflict logging is enabled. Use the clear dhcp conflict logging command to disable conflict logging. Syntax set dhcp conflict logging Parameters None. Defaults None. Mode Switch command, read‐write. Example This example enables DHCP conflict logging. C3(rw)->set dhcp conflict logging show dhcp conflict Use this command to display conflict information, for one address or all addresses. Syntax show dhcp conflict [address] Parameters address [Optional] Specifies the address for which to display conflict information. Defaults If no address is specified, conflict information for all addresses is displayed. SecureStack C3 Configuration Guide 16-5...
Page 486: Clear Dhcp Conflict
clear dhcp conflict Mode Read‐only. Example This example displays conflict information for all addresses. Note that ping is the only detection method used. C3(ro)->show dhcp conflict IP address Detection Method Detection Time ----------- ----------------- --------------- 192.0.0.2 Ping 0 days 19h:01m:23s 192.0.0.3 Ping 0 days 19h:00m:46s 192.0.0.4 Ping 0 days 19h:01m:25s 192.0.0.12 Ping 0 days 19h:01m:26s clear dhcp conflict Use this command to clear conflict information for one or all addresses, or to disable conflict ...
Page 487: Set Dhcp Exclude
– 100, with the set dhcp exclude command. C3(rw)->set dhcp pool auto1 network 172.20.28.0 24 C3(rw)->set dhcp exclude 172.20.28.80 172.20.28.100 clear dhcp exclude Use this command to clear the configured IP addresses that the DHCP server should not assign to DHCP clients. Syntax clear dhcp exclude low-ipaddr [high-ipaddr] Parameters low‐ipaddr Specifies the first IP address in the address range to be cleared. high‐ipaddr (Optional) Specifies the last IP address in the address range to be cleared. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 16-7...
Page 488: Set Dhcp Ping
set dhcp ping Example This example clears the previously excluded range of IP addresses between 192.168.1.88 through 192.168.1.100. C3(rw)->clear dhcp exclude 192.168.1.88 192.168.1.100 set dhcp ping Use this command to configure the number of ping packets the DHCP server sends to an IP address before assigning the address to a requesting client. Syntax set dhcp ping packets number Parameters packets number Specifies the number of ping packets to be sent. The value of number can be 0, or range from 2 to 10. Entering 0 disables this function. The default value is 2 packets. Defaults None. Mode Switch command, read‐write. Example This example sets the number of ping packets sent to 3. C3(rw)->set dhcp ping packets 3 clear dhcp ping Use this command to reset the number of ping packets sent by the DHCP server back to the ...
Page 489: Show Dhcp Binding
Automatic 192.0.0.11 00:33:44:56:22:35 00:10:05 Automatic 192.0.0.12 00:33:44:56:22:36 00:10:30 Automatic 192.0.0.13 00:33:44:56:22:37 infinite Manual 192.0.0.14 00:33:44:56:22:38 infinite Manual clear dhcp binding Use this command to clear (delete) one or all DHCP address bindings. Syntax clear dhcp binding {ip-addr | *} Parameters ip‐addr Specifies the IP address for which to clear/delete the DHCP binding. Deletes all address bindings. Defaults None. SecureStack C3 Configuration Guide 16-9...
Page 490: Show Dhcp Server Statistics
show dhcp server statistics Mode Switch command, read‐write. Example This example deletes the DHCP address binding for IP address 192.168.1.1. C3(rw)->clear dhcp binding 192.168.1.1 show dhcp server statistics Use this command to display DHCP server statistics. Syntax show dhcp server statistics Parameters None. Defaults None. Mode Read‐only. Example This example displays server statistics. C3(ro)->show dhcp server statistics Automatic Bindings Expired Bindings Malformed Bindings Messages Received ----------...
Page 491 Parameters None. Defaults None. Mode Switch command, read‐write. Example This example clears all DHCP server counters. C3(rw)->clear dhcp server statistics SecureStack C3 Configuration Guide 16-11...
Page 492: Configuring Ip Address Pools
• A hardware address and type (Ethernet or IEEE 802) configured in a manual pool is checked only when a client‐identifier is not also configured for the pool and the incoming DHCP request packet does not include a client‐identifier option. Purpose To configure and clear DHCP address pool parameters, and to display address pool configuration information. Note: A total of 16 address pools, dynamic and/or static, can be configured on the SecureStack C3 Commands For information about... Refer to page... set dhcp pool 16-13 clear dhcp pool 16-14...
Page 493: Set Dhcp Pool
16-29 show dhcp pool configuration 16-29 set dhcp pool Use this command to create and assign a name to a DHCP server pool of addresses. Up to 16 address pools may be configured on a SecureStack C3. Note that entering this command is not required to create an address pool before configuring other address pool parameters. Syntax set dhcp pool poolname Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. Mode Switch command, read‐write. Example This example creates an address pool named “auto1.” C3(rw)->set dhcp pool auto1 SecureStack C3 Configuration Guide 16-13...
Page 494: Clear Dhcp Pool
clear dhcp pool clear dhcp pool Use this command to delete a DHCP server pool of addresses. Syntax clear dhcp pool poolname Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. Mode Switch command, read‐write. Example This example deletes the address pool named “auto1.” C3(rw)->clear dhcp pool auto1 set dhcp pool network Use this command to configure the subnet number and mask for an automatic DHCP address pool. Syntax set dhcp pool poolname network number {mask | prefix-length} Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 ...
Page 495: Clear Dhcp Pool Network
None. Mode Switch command, read‐write. Example This example deletes the network and mask from the address pool named “auto1.” C3(rw)->clear dhcp pool auto1 network set dhcp pool hardware-address Use this command to configure the MAC address of the DHCP client and create an address pool for manual binding. You can use either this command or the set dhcp pool client‐identifier command to create a manual binding pool, but using both is not recommended. Syntax set dhcp pool poolname hardware-address hw-addr [type] Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. hw‐addr Specifies the MAC address of the client’s hardware platform. This value can be entered using dotted hexadecimal notation or colons. type (Optional) Specifies the protocol of the hardware platform. Valid values are 1 for Ethernet or 6 for IEEE 802. Default value is 1, Ethernet. SecureStack C3 Configuration Guide 16-15...
Page 496: Clear Dhcp Pool Hardware-Address
clear dhcp pool hardware-address Defaults If no type is specified, Ethernet is assumed. Mode Switch command, read‐write. Example This example specifies 0001.f401.2710 as the Ethernet MAC address for the manual address pool named “manual1.” Alternatively, the MAC address could have be entered as 00:01:f4:01:27:10. C3(rw)->set dhcp pool manual1 hardware-address 0001.f401.2710 clear dhcp pool hardware-address Use this command to remove the hardware address of a DHCP client from a manual binding address pool. Syntax clear dhcp pool poolname hardware-address Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. Mode Switch command, read‐write. Example This example deletes the client hardware address from the address pool named “manual1.” C3(rw)->clear dhcp pool manual1 hardware-address set dhcp pool host Use this command to configure an IP address and network mask for a manual DHCP binding.
Page 497: Clear Dhcp Pool Host
Syntax clear dhcp pool poolname host Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. Mode Switch command, read‐write. Example This example deletes the host IP address from the address pool named “manual1.” C3(rw)->clear dhcp pool manual1 host set dhcp pool client-identifier Use this command to configure the client identifier of the DHCP client and create an address pool for manual binding. You can use either this command or the set dhcp pool hardware‐address command to create a manual binding pool, but using both is not recommended. Syntax set dhcp pool poolname client-identifier id SecureStack C3 Configuration Guide 16-17...
Page 498: Clear Dhcp Pool Client-Identifier
clear dhcp pool client-identifier Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Specifies the unique client identifier for this client. The value must be entered in xx:xx:xx:xx:xx:xx format. Defaults None. Mode Switch command, read‐write. Usage The client identifier is formed by concatenating the media type and the MAC address. For example, if the client hardware type is Ethernet and the client MAC address is 00:01:22:33:44:55, then the client identifier configured with this command must be 01:00:01:22:33:44:55. Example This example shows how to configure the minimum requirements for a manual binding address pool, using a client identifier rather than the hardware address of the client’s hardware platform. C3(rw)->set dhcp pool manual2 client-identifier 01:00:01:22:33:44:55 C3(rw)->set dhcp pool manual2 host 10.12.1.10 255.255.255.0 clear dhcp pool client-identifier Use this command to remove the unique identifier of a DHCP client from a manual binding address pool. Syntax clear dhcp pool poolname client-identifier Parameters...
Page 499: Set Dhcp Pool Client-Name
C3(rw)->set dhcp pool manual2 host 10.12.1.10 255.255.255.0 C3(rw)->set dhcp pool manual2 client-name appsvr1 clear dhcp pool client-name Use this command to delete a DHCP client name from an address pool for manual binding. Syntax clear dhcp pool poolname client-name Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. Mode Switch command, read‐write. Example This example deletes the client name from the manual binding pool “manual2.” C3(rw)->clear dhcp pool manual2 client-name SecureStack C3 Configuration Guide 16-19...
Page 500: Set Dhcp Pool Bootfile
set dhcp pool bootfile set dhcp pool bootfile Use this command to specify a default boot image for the DHCP clients who will be served by the address pool being configured. Syntax set dhcp pool poolname bootfile filename Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. filename Specifies the boot image file name. Defaults None. Mode Switch command, read‐write. Example This example sets the boot image filename for address pool named “auto1.” C3(rw)->set dhcp pool auto1 bootfile image1.img clear dhcp pool bootfile Use this command to remove a default boot image from the address pool being configured. Syntax clear dhcp pool poolname bootfile Parameters...
Page 501: Set Dhcp Pool Next-Server
C3(rw)->set dhcp pool auto1 bootfile image1.img C3(rw)->set dhcp pool auto1 next-server 10.1.1.10 clear dhcp pool next-server Use this command to remove the boot image file server from the address pool being configured. Syntax clear dhcp pool poolname next-server Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. Mode Switch command, read‐write. Example This example removes the file server from address pool “auto1.” C3(rw)->clear dhcp pool auto1 next-server SecureStack C3 Configuration Guide 16-21...
Page 502: Set Dhcp Pool Lease
set dhcp pool lease set dhcp pool lease Use this command to specify the duration of the lease for an IP address assigned by the DHCP server from the address pool being configured. Syntax set dhcp pool poolname lease {days [hours [minutes]] | infinite} Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. days Specifies the number of days an address lease will remain valid. Value can range from 0 to 59. hours (Optional) When a days value has been assigned, specifies the number of hours an address lease will remain valid. Value can range from 0 to 1439. minutes (Optional) When a days value and an hours value have been assigned, specifies the number of minute an address lease will remain valid. Value can range from 0 to 86399. infinite Specifies that the duration of the lease will be unlimited. Defaults If no lease time is specified, a lease duration of 1 day is configured. Mode Switch command, read‐write.
Page 503: Set Dhcp Pool Default-Router
Specifies the IP address of a default router. address2 ... address8 (Optional) Specifies, in order of preference, up to 7 additional default router addresses. Defaults None. Mode Switch command, read‐write. Example This example assigns a default router at 10.10.10.1 to the address pool named “auto1.” C3(rw)->set dhcp pool auto1 default-router 10.10.10.1 clear dhcp pool default-router Use this command to delete the default routers configured for this address pool. Syntax clear dhcp pool poolname default-router Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. SecureStack C3 Configuration Guide 16-23...
Page 504: Set Dhcp Pool Dns-Server
set dhcp pool dns-server Mode Switch command, read‐write. Example This example removes the default router from the address pool “auto1.” C3(rw)->clear dhcp pool auto1 default-router set dhcp pool dns-server Use this command to specify one or more DNS servers for the DHCP clients served by the address pool being configured. Up to 8 DNS servers can be configured. Syntax set dhcp pool poolname dns-server address [address2 ... address8] Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. address Specifies the IP address of a DNS server. address2 ... address8 (Optional) Specifies, in order of preference, up to 7 additional DNS server addresses. Defaults None. Mode Switch command, read‐write.
Page 505: Set Dhcp Pool Domain-Name
Specifies the name of the address pool. Pool names may be up to 31 characters in length. domain Specifies the domain name string. The domain name can be up to 255 characters in length. Defaults None. Mode Switch command, read‐write. Example This example assigns the “mycompany.com” domain name to the address pool “auto1.” C3(rw)->set dhcp pool auto1 domain-name mycompany.com clear dhcp pool domain-name Use this command to remove the domain name from the address pool being configured. Syntax clear dhcp pool poolname domain-name Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. SecureStack C3 Configuration Guide 16-25...
Page 506: Set Dhcp Pool Netbios-Name-Server
set dhcp pool netbios-name-server Mode Switch command, read‐write. Example This example removes the domain name from the address pool “auto1.” C3(rw)->clear dhcp pool auto1 domain-name set dhcp pool netbios-name-server Use this command to assign one or more NetBIOS name servers for the DHCP clients served by the address pool being configured. Up to 8 NetBIOS name servers can be configured. Syntax set dhcp pool poolname netbios-name-server address [address2 ... address8] Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. address Specifies the IP address of a NetBIOS name server. address2 ... address8 (Optional) Specifies, in order of preference, up to 7 additional NetBIOS name server addresses. Defaults None. Mode Switch command, read‐write.
Page 507: Set Dhcp Pool Netbios-Node-Type
Specifies the NetBIOs node type to be broadcast (no WINS). h‐node Specifies the NetBIOs node type to be hybrid (WINS, then broadcast). p‐node Specifies the NetBIOs node type to be peer (WINS only). m‐node Specifies the NetBIOs node type to be mixed (broadcast, then WINS). Defaults None. Mode Switch command, read‐write. Example This example specifies hybrid as the NetBIOS node type for the address pool “auto1.” C3(rw)->set dhcp pool auto1 netbios-node-type h-node clear dhcp pool netbios-node-type Use this command to remove the NetBIOS node type from the address pool being configured. Syntax clear dhcp pool poolname netbios-node-type Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. SecureStack C3 Configuration Guide 16-27...
Page 508: Set Dhcp Pool Option
set dhcp pool option Defaults None. Mode Switch command, read‐write. Example This example removes the NetBIOS node type from the address pool “auto1.” C3(rw)->clear dhcp pool auto1 netbios-node-type set dhcp pool option Use this command to configure DHCP options, described in RFC 2132. Syntax set dhcp pool poolname option code {ascii string | hex string-list | ip address- list} Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. code Specifies the DHCP option code, as defined in RFC 2132. Value can range ...
Page 509: Clear Dhcp Pool Option
C3(rw)->clear dhcp pool auto1 option 19 show dhcp pool configuration Use this command to display configuration information for one or all address pools. Syntax show dhcp pool configuration {poolname | all} Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. Mode Read‐only. Example This example displays configuration information for all address pools. C3(rw)->show dhcp pool configuration all Pool: Atg_Pool Pool Type Dynamic SecureStack C3 Configuration Guide 16-29...
Page 510 show dhcp pool configuration Network 192.0.0.0 255.255.255.0 Lease Time 1 days 0 hrs 0 mins Default Routers 192.0.0.1 Pool: static1 Pool Type Manual Client Name appsvr1 Client Identifier 01:00:01:f4:01:27:10 Host 10.1.1.1 255.0.0.0 Lease Time infinite Option 19 hex 01 Pool: static2 Pool Type Manual Hardware Address...
Page 511: Chapter 17: Dhcp Snooping And Dynamic Arp Inspection
Dynamic ARP Inspection Overview 17-15 Dynamic ARP Inspection Commands 17-20 DHCP Snooping Overview DHCP snooping monitors DHCP messages between DHCP clients and DHCP servers to filter harmful DHCP messages and to build a bindings database of {MAC address, IP address, VLAN ID, port} tuples that are considered authorized. DHCP snooping is disabled globally and on all VLANs by default. Ports are untrusted by default. DHCP snooping must be enabled globally and on specific VLANs. Ports within the VLANs must be configured as trusted or untrusted. DHCP servers must be reached through trusted ports. DHCP snooping enforces the following security rules: • DHCP packets from a DHCP server (DHCP OFFER, DHCP ACK, DHCP NAK) are dropped if received on an untrusted port. • DHCP RELEASE and DHCP DECLINE messages are dropped if they are for a MAC address in the snooping database but the bindingʹs interface in the database is different from the interface where the message was received. • On untrusted interfaces, the switch drops DHCP packets whose source MAC address does not match the client hardware address. This feature is a configurable option. DHCP Message Processing The hardware identifies all incoming DHCP packets on ports where DHCP snooping is enabled. On untrusted ports, the hardware traps all incoming DHCP packets to the CPU. On trusted ports, SecureStack C3 Configuration Guide 17-1...
Page 512: Building And Maintaining The Database
DHCP Snooping Overview the hardware forwards client messages and copies server messages to the CPU so DHCP snooping can learn the binding. The DHCP snooping application processes incoming DHCP messages. For DHCP RELEASE and DHCP DECLINE messages, the application compares the receive interface and VLAN with the clientʹs interface and VLAN in the bindings database. If the interfaces do not match, the application logs the event and drops the message. For valid client messages, DHCP snooping compares the source MAC address to the DHCP client hardware address. Where there is a mismatch, DHCP snooping logs and drops the packet. You can disable this feature using the set dhcpsnooping verify mac‐address disable command. Note: If the switch has been configured as a DHCP relay agent, to forward client requests to a DHCP server that does not reside on the same broadcast domain as the client, MAC address verification should be disabled in order to allow DHCP RELEASE packets to be processed by the DHCP snooping functionality and client bindings removed from the bindings database.
Page 513: Rate Limiting
If desired, add static bindings to the database. set dhcpsnooping binding mac-address vlan vlan-id ipaddr port port-string Configuration Notes DHCP Server • When the switch is operating in switch mode, then the DHCP server and DHCP clients must be in the same VLAN. • If the switch is in routing mode (on those platforms that support routing), then the DCHP server can be remotely connected to a routing interface, or running locally. • If the DHCP server is remotely connected, then the use of an IP helper address is required and MAC address verification should be disabled (set dhcpsnooping verify mac‐address disable). • The DHCP server must use Scopes in order to provide the IP addresses per VLAN. • DHCP snooping must be enabled on the interfaces where the DHCP clients are connected, and the interfaces must be untrusted DHCP snooping ports. • The routing interface that is connected to the DHCP server must be enabled for DHCP snooping and must be a trusted DHCP snooping port. SecureStack C3 Configuration Guide 17-3...
Page 514: Dhcp Snooping Commands
DHCP Snooping Commands DHCP Snooping Commands For information about... Refer to page... set dhcpsnooping 17-4 set dhcpsnooping vlan 17-5 set dhcpsnooping database write-delay 17-5 set dhcpsnooping trust 17-6 set dhcpsnooping binding 17-7 set dhcpsnooping verify 17-7 set dhcpsnooping log-invalid 17-8 set dhcpsnooping limit 17-9 show dhcpsnooping...
Page 515: Set Dhcpsnooping Vlan
Specifies the VLAN or range of VLANs on which DHCP snooping is to be enabled or disabled. enable | disable Enables or disables DHCP snooping for the specified VLANs. Defaults DHCP snooping is disabled by default on all VLANs. Mode Switch command, read‐write. Usage By default, DHCP snooping is disabled globally and on all VLANs. You must enable it globally with the set dhcpsnooping command, and then enable it on specific VLANs with this command. Example This example enables DHCP snooping on VLANS 10 through 20. C3(rw)->set dhcpsnooping vlan 10-20 enable set dhcpsnooping database write-delay Use this command to specify the interval between updates to the stored bindings database. Syntax set dhcpsnooping database write-delay seconds Parameters second Specify the interval in seconds between updates to the stored bindings database. The value can range from 15 to 86400 seconds. Defaults Every 5 minutes (300 seconds). SecureStack C3 Configuration Guide 17-5...
Page 516: Set Dhcpsnooping Trust
set dhcpsnooping trust Mode Switch command, read‐write. Usage When a switch learns of new bindings or when it loses bindings, the switch updates the entries in the bindings database according to the write delay timer. The switch also updates the entries in the binding file. The frequency at which the file is updated is based on the delay configured with this command, and the updates are batched. Example The following example specifies that the stored database should be updated once an hour. C3(rw)->set dhcpsnooping database write-delay 3600 set dhcpsnooping trust Use this command to enable or disable a port as a DHCP snooping trusted port. Syntax set dhcpsnooping trust port port-string {enable | disable} Parameters port port‐string Specifies the port or ports to be enabled or disabled as trusted ports. The ports can be physical ports or LAGs that are members of a VLAN. enable | disable Enables or disables the specified ports as trusted ports. Defaults By default, ports are untrusted. Mode Switch command, read‐write. Usage In order for DHCP snooping to operate, snooping has to be enabled globally and on specific ...
Page 517: Set Dhcpsnooping Binding
Specifies the port of the binding entry. Defaults None. Mode Switch command, read‐write. Usage When enabled globally and on VLANs, DHCP snooping builds its bindings database from DHCP client messages received on untrusted ports. Such entries in the database are dynamic entries which will be removed in response to valid DECLINE, RELEASE, and NACK messages or when the absolute lease time of the entry expires. You can add static entries to the bindings database with this command. Example This example creates a static entry, associating MAC address 00:01:02:33:44:55 with IP address 192.168.10.10 and VLAN 10, port ge.1.1. (rw)->set dhcpsnooping binding 00:01:02:33:44:55 vlan 10 192.168.10.10 port ge.1.1 set dhcpsnooping verify Use this command to enable or disable DHCP snooping to filter on source MAC address. Syntax set dhcpsnooping verify mac-address {enable | disable} SecureStack C3 Configuration Guide 17-7...
Page 518: Set Dhcpsnooping Log-Invalid
set dhcpsnooping log-invalid Parameters enable Enables verification of the source MAC address in client messages against the client hardware address. disable Disables verification of the source MAC address in client messages against the client hardware address. Defaults Source MAC address verification is enabled by default. Mode Switch command, read‐write. Usage When this verification is enabled, the DHCP snooping application compares the source MAC address contained in valid client messages with the client’s hardware address. If there is a mismatch, DHCP snooping logs the event and drops the packet. Use the show dhcpsnooping command to display the status (enabled or disabled) of source MAC address verification for each interface in an enabled VLAN. The show dhcpsnooping statistics command shows the actual number of MAC verification errors that occurred on untrusted ports. Example This example disables source MAC address verification and logging. (rw)->set dhcpsnooping verify mac-address disable set dhcpsnooping log-invalid Use this command to enable or disable logging of invalid DHCP messages on ports. Syntax set dhcpsnooping log-invalid port port-string {enable | disable} Parameters port port‐string Specifies the port or ports on which to enable or disable logging of ...
Page 519: Set Dhcpsnooping Limit
Use this command to configure rate limiting parameters for incoming DHCP packets on a port or ports. Syntax set dhcpsnooping limit port-string {none | rate pps {burst interval secs]} Parameters port‐string Specifies the port or ports to which to apply these rate limiting parameters. none Configures no limit on incoming DHCP packets. rate pps Specifies a rate limit in packets per second. The value of pps can range from 0 to 100 packets per second. burst interval secs Specifies a burst interval in seconds. The value of secs can range from 1 to 15 seconds. Defaults Rate = 15 packets per second Burst Interval = 1 second Mode Switch command, read‐write. SecureStack C3 Configuration Guide 17-9...
Page 520: Show Dhcpsnooping
show dhcpsnooping Usage To protect the switch from DHCP attacks when DHCP snooping is enabled, the snooping application enforces a rate limit for DHCP packets received on untrusted interfaces. DHCP snooping monitors the receive rate on each interface separately. If the receive rate exceeds the configured limit, DHCP snooping brings down the interface. You can re‐enable the interface with the set port enable command. Both the rate and the burst interval can be configured. You can display the currently configured rate limit parameters with the show dhcpsnooping port command. Example This example configures rate limit parameters on port ge.1.1. C3(rw)->set dhcpsnooping limit ge.1.1 rate 20 burst interval 2 C3(rw)->show dhcpsnooping port ge.1.1 Interface Trust State Rate Limit Burst Interval (pps) (seconds) ---------- ------------- ------------- --------------- ge.1.1 show dhcpsnooping Use this command to display DHCP snooping configuration parameters.
Page 521: Show Dhcpsnooping Database
Use this command to display DHCP snooping database configuration parameters. Syntax show dhcpsnooping database Parameters None. Defaults None. Mode Switch command, read‐write. Usage This command displays where the database file is stored (locally) and what the write delay value Example This example shows the output of the show dhcpsnooping database command. C3(su)->show dhcpsnooping database agent url: local write-delay: show dhcpsnooping port Use this command to display DHCP snooping configuration parameters for specific ports. Syntax show dhcpsnooping port port-string Parameters port‐string Specifies the port or ports for which to display configuration information. SecureStack C3 Configuration Guide 17-11...
Page 522: Show Dhcpsnooping Binding
show dhcpsnooping binding Defaults None. Mode Switch command, read‐write. Usage This command displays the trust state and rate limiting parameters configured on the specified ports. Example This example shows the output of the show dhcpsnooping port command. C3(su)->show dhcpsnooping port ge.1.1 Interface Trust State Rate Limit Burst Interval (pps) (seconds) ---------- ------------- ------------- --------------- ge.1.1 show dhcpsnooping binding Use this command to display the contents of the DHCP snooping bindings database. Syntax show dhcpsnooping binding [dynamic | static] [port port-string] [vlan vlan-id] Parameters dynamic | static (Optional) Limits the display of bindings in the database by type of ...
Page 523: Show Dhcpsnooping Statistics
The DHCP snooping application processes incoming DHCP messages on enabled untrusted interfaces. For DHCP RELEASE and DHCP DECLINE messages, the application compares the receive interface and VLAN with the clientʹs interface and VLAN in the bindings database. If the interfaces do not match, the application logs the event (if logging of invalid messages is enabled) and drops the message. If source MAC verification is enabled, for valid client messages, DHCP snooping compares the source MAC address to the DHCP client hardware address. Where there is a mismatch, DHCP snooping logs and drops the packet. This command displays, for each enabled untrusted interface, the number of source MAC verification failures and client interface mismatches that occurred since the last time these statistics were cleared. Since DHCP servers should not be connected through an untrusted port, the DHCP snooping application will drop incoming DHCP server messages on untrusted interfaces and increment a counter that is displayed with this command. Example This example shows the output of the show dhcpsnooping statistics command. C3(su)->show dhcpsnooping statistics Interface MAC Verify Client Ifc DHCP Server Failures Mismatch Msgs Rec'd ----------- ---------- ---------- ----------- ge.1.48 lag.0.1 SecureStack C3 Configuration Guide 17-13...
Page 524: Clear Dhcpsnooping Binding
clear dhcpsnooping binding clear dhcpsnooping binding Use this command to remove bindings from the DHCP snooping bindings database. Syntax clear dhcpsnooping binding [port port-string | mac mac-addr] Parameters port port‐string (Optional) Specifies the entry or entries to remove by port identifier. mac mac‐addr (Optional) Specifies the entry to remove by MAC address. Defaults If no parameters are entered, all bindings (static and dynamic) are removed. Mode Switch command, read‐write. Example This example clears the static binding entry that includes port ge.1.2. C3(su)->clear dhcpsnooping binding port ge.1.2 clear dhcpsnooping statistics Use this command to clear the DHCP snooping statistics counters. Syntax clear dhcpsnooping statistics Parameters None.
Page 525: Clear Dhcpsnooping Limit
This command will set the database write delay value to the default of 300 seconds. Example This example sets the database storage location to the default of local. C3(su)->clear dhcpsnooping database clear dhcpsnooping limit Use this command to reset the rate limit values to the defaults of 15 packets per second with a burst interval of 1 second. Syntax clear dhcpsnooping limit port-string Parameters port‐string Specifies the port or ports to which this command applies. Defaults None. Mode Switch command, read‐write. Example This example resets the rate limit values to their defaults on port ge.1.1. (su)->clear dhcpsnooping limit ge.1.1 Dynamic ARP Inspection Overview Dynamic ARP inspection (DAI) is a security feature that rejects invalid and malicious ARP packets. The feature prevents a class of man‐in‐the‐middle attacks where an unfriendly station SecureStack C3 Configuration Guide 17-15...
Page 526: Functional Description
Dynamic ARP Inspection Overview intercepts traffic for other stations by poisoning the ARP caches of its unsuspecting neighbors. ARP poisoning is a tactic where an attacker injects false ARP packets into the subnet, normally by broadcasting ARP responses in which the attacker claims to be someone else. By poisoning the ARP cache, a malicious user can intercept the traffic intended for other hosts on the network. The Dynamic ARP Inspection application performs ARP packet validation. When DAI is enabled, it verifies that the sender MAC address and the source IP address are a valid pair in the DHCP snooping binding database and drops ARP packets whose sender MAC address and sender IP address do not match an entry in the database. Additional ARP packet validation can be configured. If DHCP snooping is disabled on the ingress VLAN or the receive interface is trusted for DHCP snooping, ARP packets are dropped. Functional Description DAI is enabled on VLANs, effectively enabling DAI on the interfaces (physical ports or LAGs) that are members of that VLAN. Individual interfaces are configured as trusted or untrusted. The trust configuration for DAI is independent of the trust configuration for DHCP snooping. A trusted port is a port the network administrator does not consider to be a security threat. An untrusted port is one which could potentially be used to launch a network attack. DAI considers all physical ports and LAGs untrusted by default. Static Mappings Static mappings are useful when hosts configure static IP addresses, DHCP snooping cannot be run, or other switches in the network do not run dynamic ARP inspection. A static mapping associates an IP address to a MAC address on a VLAN. DAI consults its static mappings before it consults DHCP snooping — thus, static mappings have precedence over DHCP snooping bindings. ARP ACLs are used to define static mappings for DAI. In this implementation, only the subset of ARP ACL syntax required for DAI is supported. ARP ACLs are completely independent of ACLs used for QoS. A maximum of 100 ARP ACLs can be configured. Within an ACL, a maximum of 20 rules can be configured. Optional ARP Packet Validation If optional ARP packet validation has been configured, DAI verifies that the sender MAC address equals the source MAC address in the Ethernet header. Additionally, the option to verify that the target MAC address equals the destination MAC address in the Ethernet header can be ...
Page 527: Logging Invalid Packets
Rate Limiting To protect the switch from DHCP attacks when DAI is enabled, the DAI application enforces a rate limit for ARP packets received on untrusted interfaces. DAI monitors the receive rate on each interface separately. If the receive rate exceeds a configurable limit, DAI error disables the interface, which effectively brings down the interface. You can use the set port enable command to reenable the port. You can configure both the rate and the burst interval. The default rate is 15 pps on each untrusted interface with a range of 0 to 100 pps. The default burst interval is 1 second with a range to 1 to 15 seconds.. The rate limit cannot be set on trusted interfaces since ARP packets received on trusted interfaces do not come to the CPU. Eligible Interfaces Dynamic ARP inspection is enabled per VLAN, effectively enabling DAI on the members of the VLAN, either physical ports or LAGs. Trust is specified on the VLAN members. DAI cannot be enabled on port‐based routing interfaces. It may be connected to: • A single host through a trusted link (for example, a server) • If multiple hosts need to connected, there must be a switch between the router and the hosts, with DAI enabled on that switch Interaction with Other Functions • DAI relies on the DHCP snooping application to verify that a {IP address, MAC address, VLAN, interface} tuple is valid. • DAI registers with dot1q to receive notification of VLAN membership changes for the VLANs where DAI is enabled. • DAI tells the driver about each untrusted interface (physical port or LAG) where DAI is enabled so that the hardware will intercept ARP packets and send them to the CPU. SecureStack C3 Configuration Guide 17-17...
Page 528: Basic Configuration
Dynamic ARP Inspection Overview Basic Configuration The following basic configuration does not change the default rate limiting parameters. Procedure 17-2 Basic Dynamic ARP Inspection Configuration Step Task Command(s) Configure DHCP snooping. Refer to Procedure 17-1 on page 17-3. Enable ARP inspection on the VLANs where set arpinspection vlan vlan-range clients are connected, and optionally, enable [logging] logging of invalid ARP packets.
Page 529: Example Configuration
192.168.0.1 255.255.255.0 ip rip send version 2 ip rip receive version 2 ip rip enable exit router rip exit VLAN Configuration set vlan create 10 set vlan create 192 clear vlan egress 1 ge.1.1-2 SecureStack C3 Configuration Guide 17-19...
Page 530: Dynamic Arp Inspection Commands
Dynamic ARP Inspection Commands set vlan egress 10 ge.1.2 untagged set vlan egress 192 ge.1.1 untagged DHCP Snooping Configuration set dhcpsnooping enable set dhcpsnooping vlan 1 enable set dhcpsnooping vlan 10 enable set dhcpsnooping vlan 192 enable set dhcpsnooping verify mac-address disable set dhcpsnooping trust port ge.1.1 enable Dynamic ARP Inspection Configuration...
Page 531: Set Arpinspection Trust
If logging is enabled, invalid ARP packets are also logged. Example This example enables DAI on VLANs 2 through 5 and also enables logging of invalid ARP packets on those VLANs. C3(su)->set arpinspection vlan 2-5 logging set arpinspection trust Use this command to enable or disable a port as a dynamic ARP inspection trusted port. Syntax set arpinspection trust port port-string {enable | disable} Parameters port‐string Specifies the port or ports to be enabled or disabled as DAI trusted ports. The ports can be physical ports or LAGs that are members of a VLAN. enable | disable Enables or disables the specified ports as trusted for DAI. Defaults By default, all physical ports and LAGs are untrusted. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 17-21...
Page 532: Set Arpinspection Validate
set arpinspection validate Usage Individual interfaces are configured as trusted or untrusted. The trust configuration for DAI is independent of the trust configuration for DHCP snooping. A trusted port is a port the network administrator does not consider to be a security threat. An untrusted port is one which could potentially be used to launch a network attack. DAI considers all physical ports and LAGs untrusted by default. Packets arriving on trusted interfaces bypass all DAI validation checks. Example This example enables port ge.1.1 as trusted for DAI. C3(su)->set arpinspection trust port ge.1.1 enable set arpinspection validate Use this command to configure additional optional ARP validation parameters. Syntax set arpinspection validate {[src-mac] [dst-mac] [ip]} Parameters src‐mac Specifies that DAI should verify that the sender MAC address equals the source MAC address in the Ethernet header. dst‐mac Specifies that DAI should verify that the target MAC address equals the destination MAC address in the Ethernet header. This check only applies to ARP responses, since the target MAC address is unspecified in ARP requests. Specifies that DAI should check the IP address and drop ARP packets with an invalid address. An invalid address is one of the following: •...
Page 533: Set Arpinspection Limit
Configures no limit on incoming ARP packets. rate pps Specifies a rate limit in packets per second. The value of pps can range from 0 to 100 packets per second. burst interval secs Specifies a burst interval in seconds. The value of secs can range from 1 to 15 seconds. Defaults Rate = 15 packets per second Burst Interval = 1 second Mode Switch command, read‐write. Usage To protect the switch against DHCP attacks when DAI is enabled, the DAI application enforces a rate limit for ARP packets received on untrusted interfaces. DAI monitors the receive rate on each interface separately. If the receive rate exceeds the limit configured with this command, DAI disables the interface, which effectively brings down the interface. You can use the set port enable command to reenable the port. You can configure both the rate and the burst interval. The default rate is 15 pps on each untrusted interface with a range of 0 to 100 pps. The default burst interval is 1 second with a range to 1 to 15 seconds.. The rate limit cannot be set on trusted interfaces since ARP packets received on trusted interfaces do not come to the CPU. Example This example sets the rate to 20 packets per second and the burst interval to 2 seconds on ports ge.1.1 and ge.1.2. C3(su)->set arpinspection limit port ge.1.1-2 rate 20 burst interval 2 SecureStack C3 Configuration Guide 17-23...
Page 534: Set Arpinspection Filter
set arpinspection filter set arpinspection filter Use this command to create an ARP ACL and then to assign an ACL to a VLAN, optionally as a static mapping. Syntax set arpinspection filter name {permit ip host sender-ipaddr mac host sender-macaddr | vlan vlan-range [static]} Parameters name Specifies the name of the ARP ACL. permit Specifies that a permit rule is being created. ip host sender‐ipaddr Specifies the IP address in the rule being created. mac host Specifies the MAC address in the rule being created. sender‐macaddr vlan vlan‐range Specifies the VLAN or VLANs to which this ARP ACL is assigned. static (Optional) Specifies that this ARP ACL configures static mappings for the VLAN or VLANs. Defaults None.
Page 535: Show Arpinspection Ports
Use this command to display the ARP configuration of one or more ports. Syntax show arpinspection ports [port-string] Parameters port‐string (Optional) Specifies the port or ports for which to display ARP configuration information. Defaults If a port‐string is not specified, information about all DAI‐enabled untrusted ports is displayed. Mode Switch command, read‐write. Example This example displays the ARP configuration of lag.0.1. C3(su)->show arpinspection ports lag.0.1 Interface Trust State Rate Limit Burst Interval (pps) (seconds) ---------- ------------- ------------- --------------- lag.0.1 SecureStack C3 Configuration Guide 17-25...
Page 536: Show Arpinspection Vlan
show arpinspection vlan show arpinspection vlan Use this command to display the ARP configuration of one or more VLANs. Syntax show arpinspection vlan vlan-range Parameters vlan‐range Specifies the VLANs for which to display configuration information. Defaults None. Mode Switch command, read‐write. Example This example displays ARP configuration information for VLAN 5. C3(su)->show arpinspection vlan 5 Source MAC Validation Disabled Destination MAC Validation Disabled IP Address Validation Disabled Vlan Configuration Log Invalid ACL Name Static flag ----...
Page 537: Clear Arpinspection Validate
Syntax clear arpinspection validate {[src-mac] [dst-mac] [ip]} Parameters src‐mac Clear, or remove, the verification that the sender MAC address equals the source MAC address in the Ethernet header. dst‐mac Clear, or remove, the verification that the target MAC address equals the destination MAC address in the Ethernet header. Clear, or remove, checking the IP address and dropping ARP packets with an invalid address. Defaults All parameters are optional, but at least one parameter must be specified. Mode Switch command, read‐write. Usage This command removes previously configured additional validation of ARP packets by DAI, beyond the basic validation that the ARP packet’s sender MAC address and sender IP address match an entry in the DHCP snooping bindings database. Use the show arpinspection vlan command to display the current status of the additional validation rules. Example This example removes all 3 additional validation conditions. C3(su)->clear arpinspection validate src-mac dst-mac ip SecureStack C3 Configuration Guide 17-27...
Page 538: Clear Arpinspection Vlan
clear arpinspection vlan clear arpinspection vlan Use this command to disable dynamic ARP inspection on one or more VLANs or to disable logging of invalid ARP packets on one or more VLANs. Syntax clear arpinspection vlan vlan-range [logging] Parameters vlan‐range Specifies the VLAN or range of VLANs on which to disable dynamic ARP inspection. logging (Optional) Disable logging of invalid ARP packets for the specified VLANs. Defaults If logging is enabled for the specified VLAN but logging is not entered with this command, logging will remain enabled. Mode Switch command, read‐write. Usage You can use this command to disable dynamic ARP inspection on one or more VLANs, or you can disable logging of invalid ARP packets on specified VLANs. To disable both logging and DAI, you must enter this command twice. Example This example first displays the DAI configuration for VLAN 5, then disables DAI on VLAN 5, then disables logging of invalid ARP packets on VLAN 5. C3(su)->show arpinspection vlan 5 Source MAC Validation Disabled Destination MAC Validation Disabled...
Page 539: Clear Arpinspection Filter
| [vlan vlan-range [static] Parameters name Specifies the name of the ARP ACL. permit (Optional) Specifies that a permit rule is being deleted. ip host sender‐ipaddr Specifies the IP address in the rule being deleted. mac host Specifies the MAC address in the rule being deleted. sender‐macaddr vlan vlan‐range (Optional) Specifies the VLAN or VLANs to which this command should apply. Remove the ACL from the VLAN, if static is not specified also. static (Optional) Specifies that static mapping should be disabled for this ARP ACL for the specified VLAN or VLANs. Defaults If only the name is specified, the ACL is deleted from the switch. Mode Switch command, read‐write. Usage You can use this command to: • Remove a configured ARP ACL from the switch, or • Remove a permit rule from a configured ARP ACL, or • Remove the association of an ARP ACL with a VLAN or VLANs, or • Disable static mapping of an ARP ACL associated with a VLAN or VLANs. Use the set arpinspection filter command to create and assign an ARP ACL. Use the show arpinspection access‐list command to display currently configured ARP ACLs. SecureStack C3 Configuration Guide 17-29...
Page 540: Clear Arpinspection Limit
clear arpinspection limit Examples This example removes a permit rule from the ARP ACL named staticARP. C3(su)->clear arpinspection filter staticARP permit ip host 192.168.1.10 mac host 00:01:22:33:44:55 This example disables static mapping of the ARP ACL named staticARP that is associated with VLAN 5. C3(su)->clear arpinspection filter staticARP vlan 5 static This example removes the ARP ACL named staticARP from VLAN 5. C3(su)->clear arpinspection filter staticARP vlan 5 This example removes the ARP ACL named staticARP from the switch completely. C3(su)->clear arpinspection filter staticARP clear arpinspection limit Use this command to return the DAI rate limiting values to their default values for a port or range ...
Page 541: Clear Arpinspection Statistics
Use this command to clear all dynamic ARP inspection statistics. Syntax clear arpinspection statistics Parameters None. Defaults None. Mode Switch command, read‐write. Example This example clears all DAI statistics from the switch. C3(su)->clear arpinspection statistics SecureStack C3 Configuration Guide 17-31...
Page 542 clear arpinspection statistics 17-32 DHCP Snooping and Dynamic ARP Inspection...
Page 543: Chapter 18: Preparing For Router Mode
(su) access mode, and a system where the VLAN 1 interface has been configured for routing. The prompt changes depending on your current configuration mode, your specific switch, and the interface types and numbers configured for routing on your system. SecureStack C3 Configuration Guide 18-1...
Page 544: Example
Enabling Router Configuration Modes Table 18-1 Enabling the Switch for Routing Step To do this task... Type this command... At this prompt... For details, see... From admin (su) mode, router Switch: enable router mode. C3(su)-> Enable router Privileged enable Router: EXEC mode.
Page 545 OSPF, the instance ID) from Global or Interface Configuration mode. Note: To jump to a lower configuration mode, type exit at the command prompt. To revert back to switch CLI, type exit from Privileged EXEC router mode. SecureStack C3 Configuration Guide 18-3...
Page 546 Enabling Router Configuration Modes 18-4 Preparing for Router Mode...
Page 547: Configuring Routing Interface Settings
Note: For information about configuring tunnel interfaces, see “Configuring Tunnel Interfaces” on page 19-8. Commands For information about... Refer to page... show interface 19-2 interface 19-3 show ip interface 19-4 ip address 19-5 SecureStack C3 Configuration Guide 19-1...
Page 548: Show Interface
show interface For information about... Refer to page... show running-config 19-6 no shutdown 19-6 no ip routing 19-7 show interface Use this command to display information about one or more interfaces (VLANs or loopbacks) configured on the router. Syntax show interface [vlan vlan-id] [loopback loop-id] Parameters vlan vlan‐id (Optional) Displays interface information for a specific VLAN interface. This interface must be configured for IP routing as described in “Pre‐ Routing Configuration Tasks” on page 18‐1. loopback loop‐id (Optional) Displays interface information for a specific loopback interface. Defaults If interface type is not specified, information for all routing interfaces will be displayed. Mode Any router mode.
Page 549: Interface
18‐2 in “Enabling Router Configuration Modes” on page 18‐2. VLANs must be created from the switch CLI before they can be configured for IP routing. For details on creating VLANs and configuring them for IP, refer to “Enabling Router Configuration Modes” on page 18‐2. Each VLAN interface must be configured for routing separately using the interface command. To end configuration on one interface before configuring another, type exit at the command prompt. Enabling interface configuration mode is required for completing interface‐specific configuration tasks. For an example of how these commands are used, refer to “Pre‐Routing Configuration Tasks” on page 18‐1. A loopback interface is always expected to be up. This interface can provide the source address for sent packets and can receive both local and remote packets. The loopback interface is typically used by routing protocols, but it can also be used for management or network services such as RADIUS, SNMP, Syslog, SNTP, or sFlow. By default, if RADIUS is configured with no host IP address on the device, it will use the loopback interface 0 IP address (if it has been configured) as its source for the NAS‐IP attribute. (Administrators can assign where to source management or network service IP packets via the set interface commands.) Each SecureStack C3 system (stack) can support up to 24 routing interfaces. Each interface can be configured for the RIP and/or OSPF routing protocols. Note: For information about configuring tunnel interfaces, see “Configuring Tunnel Interfaces” on page 19-8. SecureStack C3 Configuration Guide 19-3...
Page 550: Show Ip Interface
show ip interface Examples This example shows how to enter configuration mode for VLAN 1: C3(su)->router#configure C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))# This example shows how to enter configuration mode for loopback 1: C3(su)->router#configure C3(su)->router(Config)#interface loopback 1 C3(su)->router(Config-if(Lpbk 1))# show ip interface Use this command to display information, including administrative status, IP address, MTU (Maximum Transmission Unit) size and bandwidth, and ACL configurations, for interfaces configured for IP. Syntax show ip interface [vlan vlan-id] [loopback loop-id] Parameters vlan vlan‐id (Optional) Displays information for a specific VLAN interface. This interface must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1. loopback loop‐id (Optional) Displays interface information for a specific loopback interface. Defaults If interface type is not specified, status information for all routing interfaces will be displayed. ...
Page 551: Ip Address
“ip proxy-arp” on page 19-14. ip address Use this command to set, remove, or disable a primary or secondary IP address for an interface. The no form of this command removes the specified IP address and disables the interface for IP processing. Syntax ip address ip-address ip-mask [secondary] no ip address ip-address ip-mask Parameters ip‐address Specifies the IP address of the interface to be added or removed. ip‐mask Specifies the mask for the associated IP subnet. secondary (Optional) Specifies that the configured IP address is a secondary address. Defaults If secondary is not specified, the configured address will be the primary address for the interface. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage Each SecureStack C3 system supports up to 24 routing interfaces, with up to 8 secondary addresses allowed for each primary IP address. SecureStack C3 Configuration Guide 19-5...
Page 552: Show Running-Config
show running-config Example This example sets the IP address to 192.168.1.1 and the network mask to 255.255.255.0 for VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip address 192.168.1.1 255.255.255.0 show running-config Use this command to display the non‐default, user‐supplied commands entered while configuring the device. Syntax show running-config Parameters None. Defaults None. Mode Any router mode. Example This example shows how to display the current router operating configuration: C3(su)->router#show running-config interface vlan 10 ip address 99.99.2.10 255.255.255.0 no shutdown router ospf 1 network 99.99.2.0 0.0.0.255 area 0.0.0.0 network 192.168.100.1 0.0.0.0...
Page 553: No Ip Routing
C3(su)->router(Config-if(Vlan 1))#no shutdown no ip routing Use this command to disable IP routing on the device. By default, IP routing is enabled when interfaces are configured for it as described in “Configuring Routing Interface Settings” on page 19‐1. Syntax no ip routing Parameters None. Mode Global configuration: C3(su)‐>router(Config)# Defaults None. Example This example shows how to disable IP routing on the device: C3(su)->router(Config)#no ip routing SecureStack C3 Configuration Guide 19-7...
Page 554: Configuring Tunnel Interfaces
Configuring Tunnel Interfaces Configuring Tunnel Interfaces Purpose The commands in this section describe how to create, delete, and manage tunnel interfaces. Several different types of tunnels provide functionality to facilitate the transition of IPv4 networks to IPv6 networks. These tunnels are divided into two classes: configured and automatic. The distinction is that configured tunnels are explicitly configured with a destination or endpoint of the tunnel. Automatic tunnels, in contrast, infer the endpoint of the tunnel from the destination address of packets routed into the tunnel. For information about configuring IPv6 parameters on tunnel interfaces, such as an IPv6 address, see Chapter 22, IPv6 Configuration. Note: IPv6 routing must be enabled with an IPv6 routing license key in order for these commands to be visible in the CLI. Commands For information about...
Page 555: Tunnel Source
{ipv4-addr | interface vlan vlan-id} no tunnel source Parameters ipv4‐addr The IPv4 source address of the tunnel. interface vlan vlan‐id Specify an interface to use a link‐local address. The VLAN must be configured in switch mode. Defaults None. Mode Router interface configuration: C3(su)‐>router(Config‐if(Tnnl 1))# Usage The no form of this command removes the source IPv4 address for the tunnel interface being configured. Example The following example configures the source IPv4 address for tunnel 1. C3(su)->router(Config)# interface tunnel 1 C3(su)->router(Config-if(Tnnl 1))# (su)->router(Config-if(Tnnl 1))# tunnel source 192.168.10.10 SecureStack C3 Configuration Guide 19-9...
Page 556: Tunnel Destination
tunnel destination tunnel destination This command specifies the IPv4 destination transport address of the tunnel. Syntax tunnel destination ipv4-addr no tunnel destination Parameters ipv4‐addr The IPv4 destination address of the tunnel. Defaults None. Mode Router interface configuration: C3(su)‐>router(Config‐if(Tnnl 1))# Usage The no form of this command removes the destination IPv4 address for the tunnel interface being configured. Example The following example configures the destination IPv4 address for tunnel 1. C3(su)->router(Config)# interface tunnel 1 C3(su)->router(Config-if(Tnnl 1))# (su)->router(Config-if(Tnnl 1))# tunnel destination 192.168.10.20 tunnel mode This command specifies the mode of the tunnel interface. Syntax tunnel mode ipv6ip no tunnel mode ipv6ip Parameters ipv6ip...
Page 557: Show Interface Tunnel
Specifies the tunnel for which to display information. Defaults None. Mode Router global configuration: C3(su)‐>router(Config)# Router privileged exec: C3(su)‐>router# Usage Use this command to display general interface information. Refer to in Chapter 22, IPv6 Configuration for a description of the show ipv6 interface tunnel command. Example This example shows the output of this command. C3(su)->router(Config)#show interface tunnel 1 Tunnel 1 is Operationally DOWN The name of this device is Tunnel 1 The MTU is 1480 bytes SecureStack C3 Configuration Guide 19-11...
Page 558: Reviewing And Configuring The Arp Table
Reviewing and Configuring the ARP Table Reviewing and Configuring the ARP Table Purpose To review and configure the routing ARP table, to enable proxy ARP on an interface, and to set a MAC address on an interface. Commands For information about... Refer to page... show ip arp 19-12 19-13 ip proxy-arp 19-14 arp timeout 19-15 clear arp-cache 19-15 show ip arp Use this command to display entries in the ARP (Address Resolution Protocol) table. ARP converts an IP address into a physical address.
Page 559: Arp
Encapsulation type used for the entry’s network address. Interface Interface (VLAN or loopback) through which the entry was learned. Use this command to add or remove permanent (static) ARP table entries. Up to 1,000 static ARP entries are supported per SecureStack C3 system. A multicast MAC address can be used in a static ARP entry. The no form of this command removes the specified permanent ARP entry: Syntax arp ip-address mac-address no arp ip-address Parameters ip‐address Specifies the IP address of a device on the network. Valid values are IP addresses in dotted decimal notation. mac‐address Specifies the 48‐bit hardware address corresponding to the ip‐address expressed in hexadecimal notation. SecureStack C3 Configuration Guide 19-13...
Page 560: Ip Proxy-Arp
ip proxy-arp Defaults None. Mode Global configuration: C3(su)‐>router(Config)# Usage The IP address specified for the static ARP entry must fall within one of the subnets or networks defined on the routed interfaces of the system ( or stack, if applicable). The system can then match the IP address of the static ARP entry with the appropriate routed interface and associate it with the correct VLAN. Example This example shows how to add a permanent ARP entry for the IP address 130.2.3.1 and MAC address 0003.4712.7a99: C3(su)->router(Config)#arp 130.2.3.1 0003.4712.7a99 ip proxy-arp Use this command to enable proxy ARP on an interface. The no form of this command disables proxy ARP. Syntax ip proxy-arp no ip proxy-arp Parameters None. Defaults Disabled. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Usage This variation of the ARP protocol allows the router to send an ARP response on behalf of an end node to the requesting host. Proxy ARP can be used to resolve routing issues on end stations that are unable to route in the subnetted environment. The SecureStack C3 will answer to ARP requests on behalf of targeted end stations on neighboring networks. It is disabled by default. Example This example shows how to enable proxy ARP on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip proxy-arp...
Page 561: Arp Timeout
Parameters seconds Specifies the time in seconds that an entry remains in the ARP cache. Valid values are 0 ‐ 65535. A value of 0 specifies that ARP entries will never be aged out. Defaults 14,400 seconds. Mode Global configuration: C3(su)‐>router(Config)# Example This example shows how to set the ARP timeout to 7200 seconds: C3(su)->router(Config)#arp timeout 7200 clear arp-cache Use this command to delete all nonstatic (dynamic) entries from the ARP table. clear arp-cache Parameters None. Mode Privileged EXEC: C3(su)‐>router# Defaults None. Example This example shows how to delete all dynamic entries from the ARP table: C3(su)->router#clear arp-cache SecureStack C3 Configuration Guide 19-15...
Page 562: Configuring Broadcast Settings
Configuring Broadcast Settings Configuring Broadcast Settings Purpose To configure IP broadcast settings. By default, interfaces on the SecureStack C3 do not forward broadcast packets. Commands For information about... Refer to page... ip directed-broadcast 19-16 ip forward-protocol 19-17 ip helper-address 19-18 ip directed-broadcast Use this command to enable or disable IP directed broadcasts on an interface. By default, interfaces on the SecureStack C3 do not forward directed broadcasts. The no form of this command disables IP directed broadcast on the interface. Syntax ip directed-broadcast no ip directed-broadcast Parameters None. Defaults None. Mode Interface configuration: C3(su)‐>Router1(Config‐if(Vlan 1))# Usage...
Page 563: Ip Forward-Protocol
[port] Parameters Specifies UDP as the IP forwarding protocol. port (Optional) Specifies a destination port that controls which UDP services are forwarded. Defaults If port is not specified, the following defaults are used: • Trivial File Transfer Protocol (TFTP) (port 69) • Domain Naming System (port 53) • Time service (port 37) • NetBIOS Name Server (port 137) • NetBIOS Datagram Server (port 138) • TACACS service (port 49) • EN‐116 Name Service (port 42) Mode Router command, Global configuration: C3(su)‐>router(Config)# Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1)# Usage In order to actually forward protocols, you must configure an IP helper address on the individual router interfaces with the command “ip helper‐address” (page 19‐18). If a certain service exists inside the node, and there is no need to forward the request to remote networks, the “no” form of this command should be used to disable the forwarding for the specific port. Such requests will not be automatically blocked from being forwarded just because a service for them exists in the node. The no form of this command removes a UDP port or protocol, disabling forwarding. SecureStack C3 Configuration Guide 19-17...
Page 564: Ip Helper-Address
ip helper-address Examples The following example globally disables IP forwarding for UDP port 69. C3(su)->router(Config)#no ip forward-protocol udp 69 The following example disables IP forwarding for UDP port 69 on a specific interface. C3(su)->router(Config)#interface vlan 10 C3(su)->router(Config-if(Vlan 10))#no ip forward-protocol udp 69 ip helper-address Use this command to enable the DHCP/BOOTP relay agent on a SecureStack C3 routed interface and/or to forward broadcast traffic identified with the ip forward‐protocol command to a unicast address. Enabling the relay agent allows forwarding of client DHCP/BOOTP requests to a DHCP/ BOOTP server that does not reside on the same broadcast domain as the client. Up to 6 IP helper addresses may be configured per interface. The no form of this command disables the forwarding of UDP datagrams to the specified address. Syntax ip helper-address address no ip helper-address address Parameters address Address of the host where UDP broadcast packets should be forwarded. Defaults None. Mode Interface configuration: C3(su)‐>Router1(Config‐if(Vlan 1))# Usage...
Page 565: Reviewing Ip Traffic And Configuring Routes
[destination-prefix [destination-prefix-match] | connected | ospf | rip | static | summary] Parameters destination‐prefix (Optional) Converts the specified address and mask into a prefix and destination‐prefix‐ displays any routes that match the prefix. match connected (Optional) Displays connected routes. ospf (Optional) Displays routes configured for the OSPF routing protocol. For details on configuring OSPF, refer to “Configuring OSPF” on page 20‐11. rip (Optional) Displays routes configured for the RIP routing protocol. For details on configuring RIP, refer to “Configuring RIP” on page 20‐2. static (Optional) Displays static routes. summary (Optional) Displays a summary of the IP routing table. SecureStack C3 Configuration Guide 19-19...
Page 566 show ip route Defaults If no parameters are specified, all IP route information will be displayed. Mode Any router mode. Usage The routing table contains all active static routes, all the RIP routes, and up to three best OSPF routes learned for each network. Example This example shows how to use the show ip route command to display all IP route information. A portion of the output is shown: C3(su)->router#show ip route Codes: C - connected, S - static, R - RIP, O - OSPF, IA - OSPF interarea N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 E - EGP, i - IS-IS, L1 - IS-IS level-1, LS - IS-IS level-2 * - candidate default, U - per user static route...
Page 567 Parameters prefix Specifies a destination IP address prefix. mask Specifies a destination prefix mask. dest‐addr Specifies a forwarding (gateway) IP address. distance (Optional) Specifies an administrative distance metric for this route. Valid values are 1 (default) to 255. Routes with lower values receive higher preference in route selection. Defaults If distance is not specified, the default value of 1 will be applied. Mode Global configuration: C3(su)‐>router(Config)# Example This example shows how to set IP address 10.1.2.3 as the next hop gateway to destination address 10.0.0.0: C3(su)->router(Config)#ip route 10.0.0.0 255.0.0.0 10.1.2.3 ping Use this command to test routing network connectivity by sending IP ping requests. Syntax ping ip-address Parameters ip‐address Specifies the IP address of the system to ping. Defaults None. SecureStack C3 Configuration Guide 19-21...
Page 568: Traceroute
traceroute Mode Privileged EXEC: C3(su)‐>router# Usage This command is also available in switch mode. Examples This example shows output from a successful ping to IP address 182.127.63.23: C3(su)->router#ping 182.127.63.23 182.127.63.23 is alive This example shows output from an unsuccessful ping to IP address 182.127.63.24: C3(su)->router#ping 182.127.63.24 no answer from 182.127.63.24 traceroute Use this command to display a hop‐by‐hop path through an IP network from the device to a specific destination host. Three ICMP probes will be transmitted for each hop between the source and the traceroute destination. Syntax traceroute host Parameters host Specifies a host to which the route of an IP packet will be traced. Defaults None. Mode Privileged EXEC: C3(su)‐>router# Usage There is also a traceroute command available in switch mode. Example This example shows how to use traceroute to display a round trip path to host 192.141.90.183. C3(su)->router#traceroute 192.141.90.183 Traceroute to 192.141.90.183, 30 hops max, 40 byte packets 10.1.56.1 0.000 ms 0.000 ms...
Page 569: Configuring Icmp Redirects
Syntax ip icmp redirect enable no ip icmp redirect enable Parameters None. Defaults By default, sending ICMP redirects to the CPU is enabled globally and on all interfaces. Mode Router global configuration mode: C3(su)‐>router(Config)# Interface configuration mode: C3(su)‐>Router1(Config‐if(Vlan 1))# Usage You can use this command in router global configuration mode to enable or disable sending ICMP redirects globally on the switch. You can use this command in router interface configuration mode to enable or disable sending ICMP redirects only on specific interfaces. Examples This example disables sending ICMP redirects on the interface VLAN 5. C3(su)->router#configure C3(su)->router(Config)#interface vlan 5 C3(su)->Router1(Config-if(Vlan 5))# no ip icmp redirect enable SecureStack C3 Configuration Guide 19-23...
Page 570: Show Ip Icmp Redirect
show ip icmp redirect This example disables sending ICMP redirects globally. C3(su)->router#configure C3(su)->router(Config)#no ip icmp redirect enable show ip icmp redirect Use this command to display the status of sending ICMP redirects at a global or interface level. Syntax show ip icmp redirect {status | interface [vlan vlan-id]} Parameters status Display the global ICMP redirect status. interface Display ICMP redirect status for interfaces. vlan vlan‐id (Optional) Display ICMP redirect status for the specified VLAN. Defaults If no VLAN is specified with the interface parameter, information for all VLAN interfaces is displayed. Mode Privileged EXEC mode:C3(su)‐>router# Router global configuration mode: C3(su)‐>router(Config)# Examples This example displays the global ICMP redirect status.
Page 571: Activating Advanced Routing Features
Note: The command prompts used in examples throughout this guide show a system where the VLAN 1 interface has been configured for routing. The prompt changes depending on your current configuration mode, your specific device, and the interface types and numbers configured for routing on your system. SecureStack C3 Configuration Guide 20-1...
Page 572: Configuring Rip
Configuring RIP Configuring RIP Purpose To enable and configure the Routing Information Protocol (RIP). RIP Configuration Task List and Commands Table 20‐1 lists the tasks and commands associated with RIP configuration. Commands are described in the associated section as shown. Table 20-1 RIP Configuration Task List and Commands To do this... Use these commands... Enable RIP configuration mode. “router rip” on page 20-2 Enable RIP on an interface. “ip rip enable”...
Page 573: Ip Rip Enable
Use this command to enable RIP on an interface. The no form of this command disables RIP on an interface: By default, RIP is disabled on all interfaces. Syntax ip rip enable no ip rip enable Parameters None. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to enable RIP on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip rip enable distance Use this command to configure the administrative distance for RIP routes. The no form of this command resets RIP administrative distance to the default value of 120. Syntax distance weight no distance [weight] SecureStack C3 Configuration Guide 20-3...
Page 574: Ip Rip Send Version
ip rip send version Parameters weight Specifies an administrative distance for RIP routes. Valid values are 1 ‐ 255. Defaults None. Mode Router configuration: C3(su)‐>router(Config‐router)# Usage If several routes (coming from different protocols) are presented to the SecureStack C3, the protocol with the lowest administrative distance will be chosen for route installation. By default, RIP administrative distance is set to 120. The distance command can be used to change this value, resetting RIP’s route preference in relation to other routes as shown in the table below. Route Source Default Distance Connected Static OSPF Example This example shows how to change the default administrative distance for RIP to 1001: C3(su)->router(Config)#router rip C3(su)->router(Config-router)#distance 100 ip rip send version Use this command to set the RIP version for RIP update packets transmitted out an interface. The no version of this command sets the version of the RIP update packets to RIPv1. Syntax ip rip send version {1 | 2 | r1compatible} no ip rip send version Parameters Specifies RIP version 1. This is the default setting.
Page 575: Ip Rip Receive Version
Specifies RIP version 2. 1 2 Specifies RIP versions 1 and 2. none Specifies that no RIP routes will be processed on this interface. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Defaults None. Example This example shows how to set the RIP receive version to 2 for update packets received on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip rip receive version 2 ip rip authentication-key Use this command to enable or disable a RIP authentication key (password) for use on an interface. The no form of this command prevents RIP from using authentication. Syntax ip rip authentication-key name no ip rip authentication-key SecureStack C3 Configuration Guide 20-5...
Page 576: Ip Rip Message-Digest-Key
ip rip message-digest-key Parameters name Specifies the password to enable or disable for RIP authentication. Defaults None. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the RIP authentication key chain to “password” on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip rip authentication-key password ip rip message-digest-key Use this command to enable or disable a RIP MD5 authentication key (password) for use on an interface. The no form of this command prevents RIP from using authentication. Syntax ip rip message-digest-key keyid md5 key no ip rip message-digest-key keyid Parameters keyid Specifies the key ID to enable or disable for RIP authentication. Valid values ...
Page 577: No Auto-Summary
Mode Router configuration: C3(su)‐>router(Config‐router)# Usage By default, RIP version 2 supports automatic route summarization, which summarizes subprefixes to the classful network boundary when crossing network boundaries. Disabling automatic route summarization enables CIDR, allowing RIP to advertise all subnets and host routing information on the SecureStack C3 device. To verify which routes are summarized for an interface, use the show ip route command as described in “show ip route” on page 19‐19. The reverse of the command re‐enables automatic route summarization. By default, RIP auto‐ summarization affects both RIPv1 and RIPv2 routes. Note: This command is necessary for enabling CIDR for RIP on the SecureStack C3 device. Example This example shows how to disable RIP automatic route summarization: C3(su)->router(Config)#router rip C3(su)->router(Config-router)#no auto-summary split-horizon poison Use this command to enable or disable split horizon poison‐reverse mode for RIP packets. The no form of this command disables split horizon poison reverse. Syntax split-horizon poison no split-horizon poison Parameters None.
Page 578: Passive-Interface
passive-interface Mode Router configuration: C3(su)‐>router(Config‐router)# Usage Split horizon prevents a network from being advertised out the same interface it was received on. This function is disabled by default. Example This example shows how to disable split horizon poison reverse for RIP packets transmitted on the VLAN 1 interface: C3(su)->router(Config)#router rip C3(su)->Router1(Config-router)#no split-horizon poison passive-interface Use this command to prevent RIP from transmitting update packets on an interface. The no form of this command disables passive interface. Syntax passive-interface vlan vlan-id no passive-interface vlan vlan-id Parameters vlan vlan‐id Specifies the number of the VLAN to make a passive interface. This VLAN must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1. Defaults None. Mode Router configuration: C3(su)‐>router(Config‐router)# Usage This command does not prevent RIP from monitoring updates on the interface. Example This example shows how to set VLAN 2 as a passive interface. No RIP updates will be transmitted on VLAN 2: C3(su)->router(Config)#router rip C3(su)->router(Config-router)#passive-interface vlan 2 20-8 IPv4 Routing Protocol Configuration...
Page 579: Receive-Interface
C3(su)->router(Config-router)#no receive-interface vlan 2 redistribute Use this command to allow routing information discovered through non‐RIP protocols to be distributed in RIP update messages. The no form of this command clears redistribution parameters. Syntax redistribute {connected | ospf process-id | static} [metric metric value] [subnets] no redistribute {connected | ospf process-id | static} Parameters connected Specifies that non‐RIP routing information discovered via directly connected interfaces will be redistributed. ospf Specifies that OSPF routing information will be redistributed in RIP. process‐id Specifies the process ID, an internally used identification number for each instance of the OSPF routing process run on a router. Valid values are 1 to 65535. SecureStack C3 Configuration Guide 20-9...
Page 580 redistribute static Specifies that non‐RIP routing information discovered via static routes will be redistributed. Static routes are those created using the ip route command detailed in “ip route” on page 19‐21. metric metric value (Optional) Specifies a metric for the connected, OSPF or static redistribution route. This value should be consistent with the designation protocol. subnets (Optional) Specifies that connected, OSPF or static routes that are subnetted will be redistributed. Mode Router configuration: C3(su)‐>router(Config‐router)# Defaults If metric value is not specified, 1 will be applied. If subnets is not specified, only non‐subnetted routes will be redistributed. Example This example shows how to redistribute routing information discovered through static routes will be redistributed into RIP update messages: C3(su)->router(Config)#router rip C3(su)->router(Config-router)#redistribute static 20-10 IPv4 Routing Protocol Configuration...
Page 581: Configuring Ospf
“Activating Licensed Features” in order to enable the OSPF command set. If you wish to purchase an advanced routing license, contact Enterasys Networks Sales. Purpose To enable and configure the Open Shortest Path First (OSPF) routing protocol.
Page 582: Router Id
router id Table 20-2 OSPF Configuration Task List and Commands (Continued) To do this... Use these commands... • Define an area as a stub area. “area stub” on page 20-22 • Set the cost value for the default route that “area default cost”...
Page 583: Router Ospf
Parameters process‐id Specifies the process ID, an internally used identification number for an OSPF routing process run on a router. Only one OSPF process is allowed per stack or standalone. Valid values are 1 to 65535. Defaults None. Mode Global configuration: C3(su)‐>router(Config)# Usage You must execute the router ospf command to enable the protocol before completing many OSPF‐ specific configuration tasks. For details on enabling configuration modes, refer to Table 18‐2 on page 18‐2. Only one OSPF process (process‐id) is allowed per SecureStack C3 router. Example This example shows how to enable routing for OSPF process 1: C3(su)->router#conf terminal C3(su)->router(Config)#router ospf 1 C3(su)->router(Config-router)# 1583compatibility Use this command to enable RFC 1583 compatibility on OSPF interfaces. The no form of this command disables RFC 1583 compatibility on OSPF interfaces. Syntax 1583compatability no 1583compatability Parameters None. Defaults None. SecureStack C3 Configuration Guide 20-13...
Page 584: Ip Ospf Enable
ip ospf enable Mode Router configuration: C3(su)‐>router(Config‐router)# Example This example shows how to enable RFC 1583 compatibility: C3(su)->router(Config)#router ospf 1 C3(su)->router(Config-router)#1583compatability ip ospf enable Use this command to enable OSPF on an interface. The no form of this command disables OSPF on an interface. Syntax ip ospf enable no ip ospf enable Parameters None. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to enable OSPF on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip ospf enable ip ospf areaid Use this command to configure area IDs for OSPF interfaces. If OSPF is enabled on an interface as ...
Page 585: Ip Ospf Cost
Specifies the cost of sending a packet. Valid values range from 1 to 65535. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Usage Each router interface that participates in OSPF routing is assigned a default cost. This command overwrites the default of 10. Example This example shows how to set the OSPF cost to 20 for the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip ospf cost 20 ip ospf priority Use this command to set the OSPF priority value for router interfaces. The no form of this command resets the value to the default of 1. Syntax ip ospf priority number no ip ospf priority SecureStack C3 Configuration Guide 20-15...
Page 586: Timers Spf
timers spf Parameters number Specifies the router’s OSPF priority in a range from 0 to 255. Default value is Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Usage The priority value is communicated between routers by means of hello messages and influences the election of a designated router. Example This example shows how to set the OSPF priority to 20 for the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip ospf priority 20 timers spf Use this command to change OSPF timer values to fine‐tune the OSPF network. The no form of this command restores the default timer values (5 seconds for delay and 10 seconds for holdtime). Syntax timers spf spf-delay spf-hold no timers spf Parameters spf‐delay Specifies the delay, in seconds, between the receipt of an update and the SPF execution. Valid values are 0 to 4294967295. spf‐hold Specifies the minimum amount of time, in seconds, between two ...
Page 587: Ip Ospf Retransmit-Interval
Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the OSPF retransmit interval for the VLAN 1 interface to 20: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip ospf retransmit-interval 20 ip ospf transmit-delay Use this command to set the amount of time required to transmit a link state update packet on an interface. The no form of this command resets the retransmit interval value to the default, 1 second. Syntax ip ospf transmit-delay seconds no ip ospf transmit-delay Parameters seconds Specifies the transmit delay in seconds. Valid values are from 1 to 65535. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# SecureStack C3 Configuration Guide 20-17...
Page 588: Ip Ospf Hello-Interval
ip ospf hello-interval Example This example shows how to set the time required to transmit a link state update packet on the VLAN 1 interface at 20 seconds: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip ospf transmit-delay 20 ip ospf hello-interval Use this command to set the number of seconds a router must wait before sending a hello packet to neighbor routers on an interface. The no form of this command sets the hello interval value to the default value of 10 seconds. Syntax ip ospf hello-interval seconds no ip ospf hello-interval Parameters seconds Specifies the hello interval in seconds. Hello interval must be the same on neighboring routers (on a specific subnet), but can vary between subnets. This parameter is an unsigned integer with valid values between 1 and 65535. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the hello interval to 5 for the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1...
Page 589: Ip Ospf Authentication-Key
C3(su)->router(Config-if(Vlan 1))#ip ospf dead-interval 20 ip ospf authentication-key Use this command to assign a password to be used by neighboring routers using OSPF’s simple password authentication.The no form of this command removes an OSPF authentication password on an interface. Syntax ip ospf authentication-key password no ip ospf authentication-key Parameters password Specifies an OSPF authentication password. Valid values are alphanumeric strings up to 8 characters in length. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Usage This password is used as a “key” that is inserted directly into the OSPF header in routing protocol packets. A separate password can be assigned to each OSPF network on a per‐interface basis. All neighboring routers on the same network must have the same password configured to be able to exchange OSPF information. SecureStack C3 Configuration Guide 20-19...
Page 590: Ip Ospf Message Digest Key Md5
ip ospf message digest key md5 Example This example shows how to enables an OSPF authentication key on the VLAN 1 interface with the password “yourpass”: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip ospf authentication-key yourpass ip ospf message digest key md5 Use this command to enable or disable OSPF MD5 authentication on an interface. This validates OSPF MD5 routing updates between neighboring routers. The no form of this command disables MD5 authentication on an interface. Syntax ip ospf message-digest-key keyid md5 key no ip ospf message-digest-key keyid Parameters keyid Specifies the key identifier on the interface where MD5 authentication is ...
Page 591: Area Range
Intra-area - 8; Inter-area - 10; External type 1 - 13; External type 2 - 150 Example This example shows how to change the default administrative distance for external OSPF routes to 100: C3(su)->router(Config)#router ospf 1 C3(su)->router(Config-router)#distance ospf external 100 area range Use this command to define the range of addresses to be used by Area Border Routers (ABRs) when they communicate routes to other areas. Each SecureStack C3 stack can support up to 4 OSPF areas. The no form of this command stops the routes from being summarized. Syntax area area-id range ip-address ip-mask [advertise | no-advertise] no area area-id range ip-address ip-mask SecureStack C3 Configuration Guide 20-21...
Page 592: Area Stub
area stub Parameters area‐id Specifies the area from which routes are to be summarized. This is a decimal value from 0 to 429496295. ip‐address Specifies the IP address associated with the area ID. ip‐mask Specifies the mask for the IP address. advertise | no‐ (Optional) Enters address range in advertise mode, or do not advertise advertise mode. Defaults If not specified, advertise mode will be set. Mode Router configuration: C3(su)‐>router(Config‐router)# Example This example shows how to define the address range as 172.16.0.0/16 for summarized routes from area 0.0.0.8: C3(su)->router(Config)#router ospf 1 C3(su)->router(Config-router)#area 0.0.0.8 range 172.16.0.0 255.255.0.0 area stub Use this command to define an OSPF area as a stub area. This is an area into which Autonomous System external ASAs will not be flooded. The no form of this command changes the stub back to a plain area. Syntax area area-id stub [no-summary] no area area-id stub [no-summary] Parameters area‐id Specifies the stub area. Valid values are decimal values or ip addresses.
Page 593: Area Default Cost
Parameters area‐id Specifies the stub area. Valid values are decimal values or IP addresses. cost Specifies a cost value for the summary route that is sent into a stub area by default. Valid values are 24‐bit numbers, from 0 to 16777215. Defaults None. Mode Router configuration: C3(su)‐>router(Config‐router)# Usage The use of this command is restricted to ABRs attached to stub and NSSA areas. Example This example shows how to set the cost value for stub area 10 to 99: C3(su)->router(Config)#router ospf 1 C3(su)->router(Config-router)#area 10 default-cost 99 area nssa Use this command to configure an area as a Not So Stubby Area (NSSA). The no form of this command changes the NSSA back to a plain area. Syntax area area-id nssa [default-information-originate] no area area-id nssa [default-information-originate] SecureStack C3 Configuration Guide 20-23...
Page 594: Area Virtual-Link
area virtual-link Parameters area‐id Specifies the NSSA area. Valid values are decimal values or IP addresses. default‐ (Optional) Generates a default of Type 7 into the NSSA. This is used when information‐ the router is an NSSA ABR. originate Defaults If default‐information‐originate is not specified, no default type will be generated. Mode Router configuration: C3(su)‐>router(Config‐router)# Usage An NSSA allows some external routes represented by external Link State Advertisements (LSAs) to be imported into it. This is in contrast to a stub area that does not allow any external routes. External routes that are not imported into an NSSA can be represented by means of a default route. This configuration is used when an OSPF internetwork is connected to multiple non‐OSPF routing domains. Example This example shows how to configure area 10 as an NSSA area: C3(su)->router(Config)#router ospf 1 C3(su)->router(Config-router)#area 10 nssa default-information-originate area virtual-link Use this command to define an OSPF virtual link, which represents a logical connection between the backbone and a non‐backbone OSPF area. The no form of this command removes the virtual link and/or its associated settings. Syntax area area-id virtual-link router-id no area area-id virtual-link router-id In addition to the syntax above, the options for using this command are: area area-id virtual-link router-id authentication-key key no area area-id virtual-link router-id authentication-key key...
Page 595: Redistribute
Example This example shows how to configure a virtual link over transition area 0.0.0.2 to router ID 192.168.7.2: C3(su)->router(Config)#router ospf 1 C3(su)->router(Config-router)#area 0.0.0.2 virtual-link 192.168.7.2 redistribute Use this command to allow routing information discovered through non‐OSPF protocols to be distributed in OSPF update messages. The no form of this command clears redistribution parameters. Syntax redistribute {connected | rip | static} [metric metric value] [metric-type type- value] [subnets] no redistribute {connected | rip | static} SecureStack C3 Configuration Guide 20-25...
Page 596: Show Ip Ospf
show ip ospf Parameters connected Specifies that non‐OSPF information discovered via directly connected interfaces will be redistributed. Specifies that RIP routing information will be redistributed in OSPF. static Specifies that non‐OSPF information discovered via static routes will be redistributed. Static routes are those created using the ip route command detailed in “ip route” on page 19‐21. metric metric value (Optional) Specifies a metric for the connected, RIP or static redistribution route. This value should be consistent with the designation protocol. metric‐type type (Optional) Specifies the external link type associated with the default value connected, RIP or static route advertised into the OSPF routing domain. Valid values are 1 for type 1 external route, and 2 for type 2 external route. subnets (Optional) Specifies that connected, RIP, or static routes that are subnetted routes will be redistributed. Defaults If metric value is not specified, 0 will be applied. If type value is not specified, type 2 (external route) will be applied. If subnets is not specified, only the shortest prefix matching routes will be redistributed. Mode Router configuration: C3(su)‐>router(Config‐router)# Example This example shows how to redistribute RIP routing information to non‐subnetted routes in OSPF routes: C3(su)->router(Config)#router ospf C3(su)->router(Config-router)#redistribute rip show ip ospf Use this command to display OSPF information. Syntax show ip ospf Parameters...
Page 597: Show Ip Ospf Database
191.3.3.3 155.155.155.155 1306 0x8000003c 0x5bc6 191.3.3.4 155.155.155.155 1306 0x8000003c 0x51cf 191.3.3.5 155.155.155.155 1306 0x8000003c 0x47d8 191.3.3.6 155.155.155.155 1307 0x8000003c 0x3de1 191.3.3.7 155.155.155.155 1307 0x8000003c 0x33ea 191.3.3.8 155.155.155.155 1307 0x8000003c 0x29f3 191.3.3.9 155.155.155.155 1307 0x8000003c 0x1ffc SecureStack C3 Configuration Guide 20-27...
Page 598: Show Ip Ospf Interface
show ip ospf interface 191.4.0.0 155.155.155.155 1307 0x8000003c 0x8e98 Displaying Router Link States(Area 0.0.0.8) LinkID ADV Router Seq# Checksum 3.3.3.3 3.3.3.3 0x8000008e 0xb6f9 155.155.155.155 155.155.155.155 0x8000009c 0x6e96 Displaying Net Link States(Area 0.0.0.8) LinkID ADV Router Seq# Checksum 192.168.30.2 155.155.155.155 0x8000003b 0x59ab 192.168.31.2 155.155.155.155...
Page 599: Show Ip Ospf Interface Output Details
20-17), the ip ospf hello- interval (“ip ospf hello-interval” on page 20-18), the ip ospf retransmit-delay (“ip ospf transmit-delay” on page 20-17) and the ip ospf dead interval (“ip ospf dead- interval” on page 20-18) commands. SecureStack C3 Configuration Guide 20-29...
Page 600: Show Ip Ospf Neighbor
show ip ospf neighbor show ip ospf neighbor Use this command to display the state of communication between an OSPF router and its neighbor routers. Syntax show ip ospf neighbor [detail] [ip-address] [vlan vlan-id] Parameters detail (Optional) Displays detailed information about the neighbors, including the area in which they are neighbors, who the designated router/backup designated router is on the subnet, if applicable, and the decimal equivalent of the E‐bit value from the hello packet options field. ip‐address (Optional) Displays OSPF neighbors for a specific IP address. vlan vlan‐id (Optional) Displays OSPF neighbors for a specific VLAN. This VLAN must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1. Defaults If detail is not specified, summary information will be displayed. If ip‐address is not specified, OSPF neighbors will be displayed for all IP addresses configured for routing. If vlan‐id is not specified, OSPF neighbors will be displayed for all VLANs configured for routing. Mode Any router mode. Example This example shows how to use the show ospf neighbor command: C3(su)->router#show ip ospf neighbor State Dead-Int...
Page 601: Show Ip Ospf Virtual-Links
Timer intervals configured for the virtual link, including Hello, Wait, and Retransmit configured intervals. Adjacency State State of adjacency between this router and the virtual link neighbor of this router. clear ip ospf process Use this command to reset the OSPF process. This will require adjacencies to be reestablished and routes to be reconverged. Syntax clear ip ospf process process-id SecureStack C3 Configuration Guide 20-31...
Page 602 clear ip ospf process Parameters process‐id Specifies the process ID, an internally used identification number for each instance of the OSPF routing process run on a router. Valid values are 1 to 65535. Defaults None. Mode Privileged EXEC: C3(su)‐>router# Example This example shows how to reset OSPF process 1: C3(su)->router#clear ip ospf process 1 20-32 IPv4 Routing Protocol Configuration...
Page 603: Configuring Dvmrp
“Activating Licensed Features” in order to enable the DVMRP command set. If you wish to purchase an advanced routing license, contact Enterasys Networks Sales. Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of multicast configuration is located on the Enterasys Networks web site: http://www.enterasys.com/support/manuals/...
Page 604: Ip Dvmrp
ip dvmrp Table 20-1 Commands to Enable DVMRP on an Interface To do this... Use these commands... Globally enable IGMP. “ip igmp” on page 13-10 Globally enable DVMRP. “ip dvmrp” on page 20-34. Enable IGMP on each interface. “ip igmp enable”...
Page 605: Ip Dvmrp Metric
Specifies a metric associated with a set of destinations for DVMRP reports. Valid values are from 1 to 31. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Usage To reset the DVMRP metric back to the default value of 1, enter ip dvmrp metric 1. Example This example shows how to set a DVMRP of 16 on the VLAN 1 interface: C3(su)->router(Config-if(Vlan 1))#ip dvmrp metric 16 show ip dvmrp Use this command to display DVMRP routing information. Syntax show ip dvmrp [route | neighbor | status] Parameters route | neighbor | (Optional) Displays, DVMRP routing information, neighbor information, status or DVMRP enable status. SecureStack C3 Configuration Guide 20-35...
Page 606 show ip dvmrp Defaults If no optional parameters are specified, status information will be displayed. Mode Any router mode. Example This example shows how to display DVMRP status information: C3(su)->router#show ip dvmrp Vlan Id Metric Admin Status Oper. Status ------- ------- ------------ ------------ Enabled Enabled Enabled Enabled Enabled Enabled Enabled Enabled Enabled Enabled Enabled Disabled 20-36 IPv4 Routing Protocol Configuration...
Page 607: Configuring Irdp
20-40 show ip irdp 20-40 ip irdp enable Use this command to enable IRDP on an interface. The no form of this command disables IRDP on an interface. Syntax ip irdp enable no ip irdp enable Parameters None. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to enable IRDP on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip irdp enable SecureStack C3 Configuration Guide 20-37...
Page 608: Ip Irdp Maxadvertinterval
ip irdp maxadvertinterval ip irdp maxadvertinterval Use this command to set the maximum interval in seconds between IRDP advertisements. The no form of this command resets the maximum advertisement interval to the default value of 600 seconds. Syntax ip irdp maxadvertinterval interval no irdp maxadvertinterval Parameters interval Specifies a maximum advertisement interval in seconds. Valid values are 4 to 1800. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the maximum IRDP advertisement interval to 1000 seconds on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip irdp maxadvertinterval 1000 ip irdp minadvertinterval Use this command to set the minimum interval in seconds between IRDP advertisements. The no ...
Page 609: Ip Irdp Holdtime
None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the IRDP hold time to 4000 seconds on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip irdp holdtime 4000 ip irdp preference Use this command to set the IRDP preference value for an interface. This value is used by IRDP to determine the interface’s selection as a default gateway address. The no form of this command resets the interface’s IRDP preference value to the default of 0. Syntax ip irdp preference preference no irdp preference Parameters preference Specifies the value to indicate the interface’s use as a default router address. Valid values are ‐2147483648 to 2147483647. The minimum value indicates that the address, even though it may be advertised, is not to be used by neighboring hosts as a default router address. SecureStack C3 Configuration Guide 20-39...
Page 610: Ip Irdp Broadcast
ip irdp broadcast Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set IRDP preference on the VLAN 1 interface so that the interface’s address may still be advertised, but cannot be used by neighboring hosts as a default router address: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip irdp preference -2147483648 ip irdp broadcast Use this command to configure IRDP to use the limited broadcast address of 255.255.255.255. The default is multicast with address 224.0.0.1. The no form of this command resets IRDP to use multicast on IP address 224.0.0.1. Syntax ip irdp broadcast no ip irdp broadcast Parameters None. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to enable broadcast for IRDP on the VLAN 1 interface:...
Page 611 C3(su)->router(Config-if(vlan 1))#show ip irdp vlan 1 Interface vlan 1 has router discovery enabled Advertisements will occur between 450 and 600 seconds Advertisements are sent with broadcasts Advertisements are valid for 1800 seconds Default preference will be 0 SecureStack C3 Configuration Guide 20-41...
Page 612: Configuring Vrrp
“Activating Licensed Features” in order to enable the VRRP command set. If you wish to purchase an advanced routing license, contact Enterasys Networks Sales. Purpose To enable and configure the Virtual Router Redundancy Protocol (VRRP). This protocol eliminates ...
Page 613: Create
Syntax create vlan vlan-id vrid no create vlan vlan-id vrid Parameters vlan vlan‐id Specifies the number of the VLAN on which to create a VRRP session. This VLAN must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1. vrid Specifies a unique Virtual Router ID (VRID) to associate with the routing interface. Defaults None. Mode Router configuration: C3(su)->router(Config-router)# Usage This command must be executed to create an instance of VRRP on a routing interface (VLAN) before any other VRRP settings can be configured. Example This example shows how to create a VRRP session on the VLAN 1 interface with a VRID of 1: C3(su)->router(Config)#router vrrp C3(su)->router(Config-router)#create vlan 1 1 SecureStack C3 Configuration Guide 20-43...
Page 614: Address
address address Use this command to configure a virtual router IP address. The no form of this command clears the VRRP address configuration. Syntax address vlan vlan-id vrid ip-address owner no address vlan vlan-id vrid ip-address owner Parameters vlan vlan‐id Specifies the number of the VLAN on which to configure a virtual router address. This VLAN must be configured for IP routing as described in “Pre‐ Routing Configuration Tasks” on page 18‐1. vrid Specifies a unique Virtual Router ID (VRID) associated with the routing interface. ip‐address Specifies the virtual router IP address to associate with the router. owner Specifies a value to indicate if the router owns the IP address as one of its interfaces. Valid values are: • 1 to indicate the router owns the address. • 0 to indicate the router does not own the address. Defaults None. Mode Router configuration: C3(su)‐>router(Config‐router)# Usage If the virtual router IP address is the same as the interface (VLAN) address owned by a VRRP ...
Page 615: Priority
Specifies the VRRP priority value to associate with the vrid. Valid values are from 1 to 254, with the highest value setting the highest priority. Priority value of 255 is reserved for the VRRP router that owns the IP address associated with the virtual router. Priority 0 is reserved for signaling that the master has stopped working and the backup router must transition to master state. Defaults None. Mode Router configuration: C3(su)‐>router(Config‐router)# Example This example shows how set a VRRP priority of 200 on the VLAN 1 interface, VRID 1: C3(su)->router(Config)#router vrrp C3(su)->router(Config-router)#priority vlan 1 1 200 advertise-interval Use this command to set the interval in seconds between VRRP advertisements. The no form of this command clears the VRRP advertise interval value. Syntax advertise-interval vlan vlan-id vrid interval no advertise-interval vlan vlan-id vrid interval SecureStack C3 Configuration Guide 20-45...
Page 616: Preempt
preempt Parameters vlan vlan‐id Specifies the number of the VLAN on which to configure the VRRP advertisement interval. This VLAN must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1. vrid Specifies a unique Virtual Router ID (VRID) associated with the routing interface. Valid values are from 1 to 255. interval Specifies a VRRP advertisement interval to associate with the vrid. Valid values are from 1 to 255 seconds. Defaults None. Mode Router configuration: C3(su)‐>router(Config‐router)# Usage VRRP advertisements are sent by the master router to other routers participating in the VRRP master selection process, informing them of its configured values. Once the master is selected, then advertisements are sent every advertising interval to let other VRRP routers in this VLAN/ VRID know the router is still acting as master of the VLAN/VRID. All routers with the same VRID should be configured with the same advertisement interval. Example This example shows how set an advertise interval of 3 seconds on the VLAN 1 interface, VRID 1: C3(su)->router(Config)#router vrrp C3(su)->router(Config-router)#advertise-interval vlan 1 1 3 preempt Use this command to enable or disable preempt mode on a VRRP router. The no form of this command disables preempt mode. Syntax preempt vlan-id vrid no preempt vlan-id vrid Parameters vlan vlan‐id Specifies the number of the VLAN on which to set preempt mode. This ...
Page 617: Enable
C3(su)->router(Config-router)#no preempt vlan 1 1 enable Use this command to enable VRRP on an interface. The no form of this command disables VRRP on an interface. Syntax enable vlan vlan-id vrid no enable vlan vlan-id vrid Parameters vlan vlan‐id Specifies the number of the VLAN on which to enable VRRP. This VLAN must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1. vrid Specifies the Virtual Router ID (VRID) associated with the vlan‐id. Valid values are from 1 to 255. Defaults None. Mode Router configuration: C3(su)‐>router(Config‐router)# Example This example shows how to enable VRRP on the VLAN 1 interface, VRID 1: C3(su)->router(Config)#router vrrp C3(su)->router(Config-router)#enable vlan 1 1 SecureStack C3 Configuration Guide 20-47...
Page 618: Ip Vrrp Authentication-Key
ip vrrp authentication-key ip vrrp authentication-key Use this command to enable or disable a VRRP authentication key (password) for use on an interface. The no form of this command prevents VRRP from using authentication. Syntax ip vrrp authentication-key name no ip vrrp authentication-key Parameters name Specifies the password to enable or disable for VRRP authentication. Defaults None. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the VRRP authentication key chain to “password” on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip vrrp authentication-key password show ip vrrp Use this command to display VRRP routing information. Syntax show ip vrrp Parameters None.
Page 619: Configuring Pim-Sm
“Activating Licensed Features” in order to enable the PIM-SM command set. If you wish to purchase an advanced routing license, contact Enterasys Networks Sales. Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of multicast configuration is located on the Enterasys Networks web site: http://www.enterasys.com/support/manuals/...
Page 620: Ip Pimsm
ip pimsm For information about... Refer to page... Display commands show ip pimsm 20-52 show ip pimsm componenttable 20-53 show ip pimsm interface 20-54 show ip pimsm neighbor 20-55 show ip pimsm rp 20-56 show ip pimsm rphash 20-57 show ip pimsm staticrp 20-58 show ip mroute 20-59...
Page 621: Ip Pimsm Enable
C3(su)->router(Config)# ip pimsm staticrp 192.15.18.3 224.0.0.0 240.0.0.0 ip pimsm enable This command sets the administrative mode of PIM‐SM multicast routing on a routing interface to enabled. By default, PIM is disabled on all IP interfaces. The no form of this command disables PIM on the specific interface. Syntax ip pimsm enable no ip pimsm enable Parameters None. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to enable PIM on IP interface for VLAN 1. C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip pimsm enable SecureStack C3 Configuration Guide 20-51...
Page 622: Ip Pimsm Query-Interval
ip pimsm query-interval ip pimsm query-interval This command configures the transmission frequency of hello messages in seconds between PIM‐enabled neighbors. The no form of this command resets the hello interval to the default, 30 seconds. Syntax ip pimsm query-interval seconds no ip pimsm query-interval Parameters seconds This field has a range of 10 to 3600 seconds. Default is 30. Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the hello interval rate to 100 seconds. C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip pimsm query-interval 100 show ip pimsm Use this command to display system‐wide PIM‐SM routing information. Syntax show ip pimsm Parameters...
Page 623: Show Ip Pimsm Componenttable
This field indicates the current state of the PIM-SM protocol on the interface. Possible values are Operational or Non-Operational. show ip pimsm componenttable This command displays the table containing objects specific to a PIM domain. One row exists for each domain to which the router is connected. Syntax show ip pimsm componenttable Parameters None. Defaults None. Mode Any router mode. Example This example shows how to display PIM router information: C3(su)->router> show ip pimsm componenttable SecureStack C3 Configuration Guide 20-53...
Page 624: Show Ip Pimsm Interface
show ip pimsm interface COMPONENT TABLE Component Component Component Component Index BSR Address BSR Expiry Time CRP Hold Time (hh:mm:ss) (hh:mm:ss) ---------- --------------- --------------- ------------- 192.168.30.2 00:02:10 00:00:00 Table 20‐8 provides an explanation of the command output. Table 20-8 show ip pimsm componenettable Output Details Output Field What it displays Component Index This field displays a number which uniquely identifies the component.
Page 625: Show Ip Pimsm Neighbor
The Subnet Mask of this PIM-SM interface. Designated Router IP Address of the Designated Router for this interface. Neighbor Count The number of neighbors on the PIM-SM interface. show ip pimsm neighbor Display the router’s PIM neighbors. Syntax show ip pimsm neighbor [vlan-id] SecureStack C3 Configuration Guide 20-55...
Page 626: Show Ip Pimsm Rp
show ip pimsm rp Parameters vlan‐id (Optional) Display all neighbors discovered on a specific Interface. Mode Any router mode. Defaults If the VLAN id is omitted, all neighbors off all interfaces will be displayed. Example This example shows how to display PIM information: C3(su)->router> show ip pimsm neighbor NEIGHBOR TABLE Vlan ID IP Address Up Time Expiry Time (hh:mm:ss) (hh:mm:ss) --------- ---------------- ---------- ------------ 192.168.30.2 01:36:41 00:01:25 192.168.6.1 01:36:41 00:01:25 Table 20‐11 provides an explanation of the command output.
Page 627: Show Ip Pimsm Rphash
The candidate-RP priority of the RP. This example shows how to display the candidate RPs for each group address. C3(su)->router> show ip pimsm rp candidate CANDIDATE RP TABLE Group Address Group Mask Address --------------- --------------- --------------- 224.0.0.0 240.0.0.0 192.168.30.2 show ip pimsm rphash Displays the Rendezvous Point router that will be selected from the set of active RP routers. The RP router, for the group, is selected by using the hash algorithm defined in RFC 2362. Syntax show ip pimsm rphash group-address SecureStack C3 Configuration Guide 20-57...
Page 628: Show Ip Pimsm Staticrp
show ip pimsm staticrp Parameters group‐address The Group Address for the RP. Defaults None. Mode Any router mode. Example This example shows how to display RP that will be selected for group address 224.0.0.0: C3(su)->router> show ip pimsm rphash 224.0.0.0 192.168.129.223 show ip pimsm staticrp Display the PIM‐SM static Rendezvous Point information. Syntax show ip pimsm staticrp Parameters None. Mode Any router mode. Defaults None. Example This example shows how to display PIM information. C3(su)->router# show ip pimsm staticrp STATIC RP TABLE Address Group Address...
Page 629: Show Ip Mroute
: 0.0.0.0 MultiCast Group : 239.1.8.9 Uptime : 6336 Upstream Neighbor: 0.0.0.0 Upstream Vlan : 111 Downstream Vlans : 8 Source Network : 192.168.111.10 Source Mask : 0.0.0.0 MultiCast Group : 239.1.7.105 Uptime : 6336 SecureStack C3 Configuration Guide 20-59...
Page 630 show ip mroute Upstream Neighbor: 0.0.0.0 Upstream Vlan : 111 Downstream Vlans : 8 Source Network : 192.168.111.10 Source Mask : 0.0.0.0 MultiCast Group : 239.1.8.169 Uptime : 6582 Upstream Neighbor: 0.0.0.0 Upstream Vlan : 111 Downstream Vlans : 8 Source Network : 192.168.111.10 Source Mask...
Page 631: Chapter 21: Ipv6 Management
21-4 set ipv6 gateway 21-5 clear ipv6 gateway 21-6 show ipv6 neighbors 21-6 show ipv6 netstat 21-7 ping ipv6 21-8 traceroute ipv6 21-9 show ipv6 status Use this command to display the status of the IPv6 management function. Syntax show ipv6 status Parameters None. SecureStack C3 Configuration Guide 21-1...
Page 632: Set Ipv6
set ipv6 Defaults None. Mode Switch mode, read‐only. Example This example shows how to display IPv6 management function status. C3(ro)->show ipv6 status IPv6 Administrative Mode: Disabled set ipv6 Use this command to globally enable or disable the IPv6 management function. Syntax set ipv6 {enable | disable} Parameters enable | disable Enable or disable the IPv6 management function. Defaults By default, IPv6 management is disabled. Mode Switch mode, read‐write. Usage When you enable IPv6 management on the switch, the system automatically generates a link‐local host address for the switch from the host MAC address. You can set a different host IPv6 address with the set ipv6 address command. Example This example shows how to enable IPv6 management. C3(su)-> set ipv6 enable C3(su)->show ipv6 status IPv6 Administrative Mode: Enabled C3(su)->show ipv6 address...
Page 633: Set Ipv6 Address
C3(su)->set ipv6 address 2001:0db8:1234:5555::9876:2/64 C3(su)->show ipv6 address Name IPv6 Address ------------ ---------------------------------------- host FE80::201:F4FF:FE5C:2880/64 host 2001:DB8:1234:5555::9876:2/64 This example shows how to use the eui64 parameter to configure the lower order 64 bits: C3(su)->set ipv6 address 2001:0db8:1234:5555::/64 eui64 C3(su)->show ipv6 address Name IPv6 Address ------------ ---------------------------------------- host FE80::201:F4FF:FE5C:2880/64 host 2001:DB8:1234:5555:201:F4FF:FE5C:2880/64 SecureStack C3 Configuration Guide 21-3...
Page 634: Show Ipv6 Address
show ipv6 address show ipv6 address Use this command to display the system IPv6 address(es) and IPv6 gateway address (default router), if configured. Syntax show ipv6 address Parameters None. Defaults None. Mode Switch command, read‐only. Usage This command displays the IPv6 addresses configured automatically and with the set ipv6 address and set ipv6 gateway commands. Example This example displays three IPv6 management addresses configured for the switch. C3(su)->show ipv6 address Name IPv6 Address ------------ ---------------------------------------- host FE80::201:F4FF:FE5C:2880/64 host 2001:DB8:1234:5555:201:F4FF:FE5C:2880/64 gateway FE80::201:F4FF:FE5D:1234 clear ipv6 address Use this command to clear IPv6 global addresses. ...
Page 635: Set Ipv6 Gateway
C3(su)->clear ipv6 address all C3(su)->show ipv6 address Name IPv6 Address ------------ ---------------------------------------- host FE80::201:F4FF:FE5C:2880/64 gateway FE80::201:F4FF:FE5D:1234 set ipv6 gateway Use this command to configure the IPv6 gateway (default router) address. Syntax set ipv6 gateway ipv6-addr Parameters ipv6‐addr The IPv6 address to be configured. The address can be a global unicast or link‐local IPv6 address, in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. Defaults None. Mode Switch mode, read‐write. Usage This command configures the IPv6 gateway address. Only one IPv6 gateway address can be configured for the switch, so executing this command when a gateway address has already been configured will overwrite the previously configured address. SecureStack C3 Configuration Guide 21-5...
Page 636: Clear Ipv6 Gateway
clear ipv6 gateway Use the show ipv6 address command to display a configured IPv6 gateway address. Example This example shows how to configure an IPv6 gateway address using a link‐local address. C3(su)->set ipv6 gateway fe80::201:f4ff:fe5d:1234 C3(su)->show ipv6 address Name IPv6 Address ------------ ---------------------------------------- host FE80::201:F4FF:FE5C:2880/64 gateway FE80::201:F4FF:FE5D:1234 clear ipv6 gateway Use this command to clear an IPv6 gateway address. Syntax clear ipv6 gateway Parameters None. Defaults None. Mode Switch mode, read‐write. Example This example shows how to remove a configured IPv6 gateway address. C3(su)->show ipv6 address Name IPv6 Address ------------...
Page 637: Show Ipv6 Netstat
Defaults None. Mode Switch command, read‐only. Example This example shows the output of this command. C3(su)->show ipv6 netstat Prot Local Address State Foreign Address ---- -------------------------------------------- ----------- 3333::211:88FF:FE59:4424.22 ESTABLISHED 2020::D480:1384:F58C:B114.1049 3333::211:88FF:FE59:4424.443 TIME_WAIT 2020::D480:1384:F58C:B114.1056 ::.23 LISTEN ::.* 3333::211:88FF:FE59:4424.22 ESTABLISHED 2020::D480:1384:F58C:B114.1050 3333::211:88FF:FE59:4424.22 ESTABLISHED 3333::2117:F1C0:90B:910D.1045 ::.80 LISTEN SecureStack C3 Configuration Guide 21-7...
Page 638: Ping Ipv6
ping ipv6 ::.* ::.22 LISTEN ::.* 3333::211:88FF:FE59:4424.80 ESTABLISHED 2020::D480:1384:F58C:B114.1053 3333::211:88FF:FE59:4424.80 ESTABLISHED 2020::D480:1384:F58C:B114.1054 ::.443 LISTEN ::.* 3333::211:88FF:FE59:4424.22 ESTABLISHED 2020::D480:1384:F58C:B114.1048 3333::211:88FF:FE59:4424.443 TIME_WAIT 2020::D480:1384:F58C:B114.1055 ping ipv6 Use this command to test routing network connectivity by sending IP ping requests. Syntax ping ipv6-addr [size num] Parameters ipv6‐addr Specifies the IPv6 address of the system to ping. Enter the address in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. size num (Optional) Specifies the size of the datagram packet. The value of num can range from 48 to 2048 bytes. Defaults None. Mode Switch mode, read‐write.
Page 639: Traceroute Ipv6
Parameters ipv6‐addr Specifies a host to which the route of an IPv6 packet will be traced. Enter the address in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. Defaults None. Mode Switch mode, read‐write. Usage This command is also available in router mode. Example This example shows how to use traceroute to display a round trip path to host 2001:0db8:1234:5555 C3(su)->router#traceroute ipv6 2001:0db8:1234:5555::1 Traceroute to 2001:0db8:1234:5555, 30 hops max, 40 byte packets 1 2001:0db8:1234:5555 1.000000e+00 ms 1.000000e+00 ms 1.000000e+00 ms SecureStack C3 Configuration Guide 21-9...
Page 640 traceroute ipv6 21-10 IPv6 Management...
Page 641: Chapter 22: Ipv6 Configuration
“Activating Licensed Features” in order to enable the IPv6 routing configuration command set. If you wish to purchase an IPv6 routing license, contact Enterasys Networks Sales. The commands in this chapter perform configuration of IPv6 parameters on the SecureStack C3. ...
Page 642: Default Conditions
Overview autoconfiguration is part of Router Advertisement and the SecureStack C3 can support both stateless and stateful autoconfiguration of end nodes. The SecureStack C3 supports both EUI‐64 interface identifiers and manually configured interface IDs. Refer to the following RFCs for more information about Neighbor Discovery and stateless address autoconfiguration: • RFC 2461, “Neighbor Discovery for IP Version 6” • RFC 2462, “IPv6 Stateless Address Autoconfiguration” For ICMPv6, error PDU generation is supported, as are path MTU, echo, and redirect. Router Advertisement is an integral part of IPv6 and is supported. Numerous options are available including stateless/stateful address configuration, router and address lifetimes, and Neighbor Discovery timer control. Ping and traceroute applications for IPv6 are provided. Management of IPv6 features is provided by means of CLI commands and SNMP. See Chapter 21, IPv6 Management for descriptions of the CLI commands. Default Conditions The following table lists the default IPv6 conditions. Condition Default Value IPv6 forwarding Enabled IPv6 route distance IPv6 unicast-routing Disabled IPv6 enable Disabled IPv6 mtu 1500 IPv6 nd dad attempts IPv6 nd managed-config-flag False IPv6 nd ns-interval...
Page 643: General Configuration Commands
22-8 ipv6 forwarding This command enables or disables IPv6 forwarding on the router. Syntax ipv6 forwarding no ipv6 forwarding Parameters None. Defaults IPv6 forwarding is enabled. Mode Router global configuration: C3(su)‐>router(Config)# Usage The no form of this command disables IPv6 forwarding on the router. Example This example disables IPv6 forwarding. C3(su)->router(Config)# no ipv6 forwarding ipv6 hop-limit This command sets the maximum number of IPv6 hops used in IPv6 packets and router advertisements generated by this device. Syntax ipv6 hop-limit hops no ipv6 hop-limit SecureStack C3 Configuration Guide 22-3...
Page 644: Ipv6 Route
ipv6 route Parameters hops Specifies the maximum number of IPv6 hops used in IPv6 packets and router advertisements generated by this device. Value can range from 1 to 255. The default value is 64. Defaults The default maximum number of IPv6 hops is 64. Mode Router global configuration: C3(su)‐>router(Config)# Usage This command sets the value of the hop limit field in IPv6 packets originated by this device. This value is also placed in the “Cur Hop Limit” field of router advertisements generated by this router. Use the no form of this command to reset the limit to the default value. Example This example sets the hop limit to 50. C3(su)->router(Config)# ipv6 hop-limit 50 ipv6 route This command configures static IPv6 routes. Syntax ipv6 route ipv6-prefix/prefix-length interface {tunnel tunnel-id | vlan vlan-id} next-hop-addr [pref] no ipv6 route ipv6-prefix/prefix-length interface {tunnel tunnel-id | vlan vlan- id} next-hop-addr [pref] Parameters ipv6‐prefix/prefix‐length...
Page 645: Ipv6 Route Distance
Example This command creates a static IPv6 route to network 2001:0DB8:2222:4455::/64 by way of interface VLAN 6 and gives it a preference of 5. C3(su)->router(Config)# ipv6 route 2001:0DB8:2222:4455::/64 interface vlan 6 fe80::1234:5678:2dd:1 5 ipv6 route distance This command configures the default distance, or preference, for static IPv6 routes. Syntax ipv6 route distance pref no ipv6 route distance Parameters pref A distance value used when no distance is specified when a static route is configured. The value can range from 1 to 255. Lower route distance values are preferred when determining the best route. Defaults Default preference or administrative distance is 1. Mode Router global configuration: C3(su)‐>router(Config)# SecureStack C3 Configuration Guide 22-5...
Page 646: Ipv6 Unicast-Routing
ipv6 unicast-routing Usage The default distance is used when no distance is specified in the ipv6 route command. Changing the default distance does not update the distance of existing static routes, even if they were assigned the original default distance. The new default distance will only be applied to static routes created after invoking the ipv6 route distance command. Use the no form of this command to return the default distance to 1. Example This command sets the default distance value to 3. C3(su)->router(Config)# ipv6 route distance 3 ipv6 unicast-routing This command enables/disables forwarding of IPv6 unicast datagrams. Syntax ipv6 unicast-routing no ipv6 unicast-routing Parameters None. Defaults Disabled. Mode Router global configuration: C3(su)‐>router(Config)# Usage Use this command to enable forwarding of IPv6 unicast datagrams on the SecureStack C3. Use the no form of the command to disable forwarding of IPv6 unicast datagrams. Example This command enables forwarding of IPv6 unicast datagrams on the router. C3(su)->router(Config)# ipv6 unicast-routing ping ipv6 Use this command to test routing network connectivity by sending IP ping requests. ...
Page 647: Ping Ipv6 Interface
2001:DB8:1234:5555::1234:1 ping ipv6 interface Use this command to test routing network connectivity by sending IP ping requests. Syntax ping ipv6 interface {vlan vlan-id | tunnel tunnel-id | loopback loop-id} {link-local-address ipv6-lladdr | ipv6-addr} [size num] Parameters vlan vlan‐id Specifies a VLAN interface as the source. tunnel tunnel‐id Specifies a tunnel interface as the source. loopback loop‐id Specifies a loopback interface as the source. link‐local‐address Specifies a link‐local IPv6 address to ping. ipv6‐lladdr SecureStack C3 Configuration Guide 22-7...
Page 648: Traceroute Ipv6
traceroute ipv6 ipv6‐addr Specifies the global IPv6 address of the system to ping. Enter the address in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. size num (Optional) Specifies the size of the datagram packet. The value of num can range from 48 to 2048 bytes. Defaults None. Mode Router privileged exec: C3(su)‐>router# Usage Use this command to ping an interface by using the link‐local address or the global IPv6 address of the interface. You can use a loopback, tunnel, or logical interface as the source. The source and target devices must have the ping utility enabled and running on top of TCP/IP. The switch can be pinged from any IP workstation with which the switch is connected through the default VLAN (VLAN 1), as long as there is a physical path between the switch and the workstation. The terminal interface sends three pings to the target station. Example This example shows output from a successful ping to link‐local address fe80::211:88ff:fe55:4a7f. C3(su)->router#ping ipv6 interface vlan 6 link-local-address fe80::211:88ff:fe55:4a7f Send count=3, Receive count=3 from fe80::211:88ff:fe55:4a7f Average round trip time = 1.00 ms traceroute ipv6 Use this command to discover the routes that packets actually take when traveling to their ...
Page 649 Example This example shows how to use traceroute to display a round trip path to host 2001:0db8:1234:5555::1 C3(su)->router#traceroute ipv6 2001:0db8:1234:5555::1 Traceroute to 2001:0db8:1234:5555::1, 30 hops max, 40 byte packets 1 2001:0db8:1234:5555::1 1.000000e+00 ms 1.000000e+00 ms 1.000000e+00 ms SecureStack C3 Configuration Guide 22-9...
Page 650: Interface Configuration Commands
Interface Configuration Commands Interface Configuration Commands For information about... Refer to page... ipv6 address 22-10 ipv6 enable 22-11 ipv6 mtu 22-12 ipv6 address This command configures a global IPv6 address on an interface, including VLAN, tunnel, and loopback interfaces, and enables IPv6 processing on the interface. Syntax ipv6 address {ipv6-addr/prefix-length | ipv6-prefix/prefix-length eui64} no ipv6 address [ipv6-addr/prefix-length | ipv6-prefix/prefix-length eui64] Parameters ipv6‐addr The IPv6 address to be configured on the interface.
Page 651: Ipv6 Enable
Router Advertisement Managed Config Flag Disabled Router Advertisement Other Config Flag Disabled Router Advertisement Suppress Flag Disabled ipv6 enable This command enables IPv6 routing on an interface that has not been configured with an explicit IPv6 address. Syntax ipv6 enable no ipv6 enable Parameters None. Defaults IPv6 is disabled. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage When this command is executed, an IPv6 link‐local unicast address is configured on the interface and IPv6 processing is enabled. You do not need to use this command if you configured an IPv6 global address on an interface with the ipv6 address command. SecureStack C3 Configuration Guide 22-11...
Page 652: Ipv6 Mtu
ipv6 mtu The no ipv6 enable command disables IPv6 routing on an interface that has been enabled with the ipv6 enable command, but it does not disable IPv6 processing on an interface that is configured with an explicit IPv6 address. Example This example enables IPv6 processing on VLAN 7. Note that a link‐local address has been automatically configured. C3(su)->router(Config-if(Vlan 7))# ipv6 enable C3(su)->router>show ipv6 interface vlan 7 Vlan 7 Administrative Mode Enabled Vlan 7 IPv6 Routing Operational Mode Enabled IPv6 is Enabled IPv6 Prefix is FE80::211:88FF:FE55:4A7F/128 Routing Mode Enabled Interface Maximum Transmit Unit 1500 Router Duplicate Address Detection Transmits Router Advertisement NS Interval...
Page 653 Note: All interfaces attached to the same physical medium must be configured with the same MTU to operate properly. Example This example sets the MTU value to 1500 bytes. C3(su)->router(Config-if(Vlan 1))# ipv6 mtu 1500 SecureStack C3 Configuration Guide 22-13...
Page 654: Neighbor Cache And Neighbor Discovery Commands
Neighbor Cache and Neighbor Discovery Commands Neighbor Cache and Neighbor Discovery Commands The IPv6 Neighbor Cache functions similarly to the IPv4 ARP table. Entries can be made to the Neighbor Cache by the Neighbor Discovery protocol. The Neighbor Discovery commands allow you to set protocol parameters on an interface basis. For information about... Refer to page... clear ipv6 neighbors 22-14 ipv6 nd dad attempts 22-15 ipv6 nd ns-interval 22-15 ipv6 nd reachable-time 22-16 ipv6 nd other-config-flag 22-17 ipv6 nd ra-interval 22-18...
Page 655: Ipv6 Nd Dad Attempts
IPv6 Duplicate Address Detection is described in RFC 2462. Duplicate Address Detection uses Neighbor Solicitation and Neighbor Advertisement messages to verify the uniqueness of an address. Duplicate Address Detection must be performed on unicast addresses prior to assigning them to an interface. An address remains in a tentative state while Duplicate Address Detection is being performed. If a tentative address is found to be a duplicate, an error message is returned and the address is not assigned to the interface. Use this command to change the number of Neighbor Solicitation messages that can be sent for Duplicate Address Detection from the default value of 1. The no form of the command returns the value to the default of 1. A value of 0 disables Duplicate Address Detection on the interface. The show ipv6 interface command displays the current DAD attempt setting. Example This example changes the number of consecutive Neighbor Solicitation messages sent for DAD to 3 on this interface. C3(su)->router(Config-if(Vlan 1))# ipv6 nd dad attempts 3 ipv6 nd ns-interval This command configures the interval between Neighbor Solicitations sent on an interface. Syntax ipv6 nd ns-interval {msec | 0} no ipv6 nd ns-interval SecureStack C3 Configuration Guide 22-15...
Page 656: Ipv6 Nd Reachable-Time
ipv6 nd reachable-time Parameters msec Sets the interval in milliseconds between retransmissions of Neighbor Solicitation messages on the interface. The value can range from 1000 (one second) to 3,600,000 (one hour) milliseconds. An advertised value of 0 means the interval is unspecified. Defaults By default, a value of 0 is advertised in RA messages. Mode Router interface configuration:C3(su)‐>router(Config‐if(Vlan 1))# Usage The NS interval is used to determine the time between retransmissions of neighbor solicitation messages to a neighbor when resolving a unicast address (DAD) or when probing the reachability of a neighbor. This value is also advertised in Router Advertisement (RA) messages sent on the interface. Use the no form of this command to set the interval to the default of 0. Example This example sets the NS interval to 2 seconds. C3(su)->router(Config-if(Vlan 1))# ipv6 nd ns-interval 2000 ipv6 nd reachable-time This command configures the length of time within which some reachability confirmation must be received from a neighbor for the neighbor to be considered reachable. Syntax ipv6 nd reachable-time msec no ipv6 nd reachable-time Parameters msec The amount of time in milliseconds that a remote IPv6 node is ...
Page 657: Ipv6 Nd Other-Config-Flag
C3(su)->router(Config-if(Vlan 1))# ipv6 nd reachable-time 60000 ipv6 nd other-config-flag This command sets the “other stateful configuration” flag in router advertisements sent on this interface to true. Syntax ipv6 nd other-config-flag no ipv6 nd other-config-flag Parameters None. Defaults Flag is set to false by default. Mode Router interface configuration: C3(su)‐>router(Config‐if (Vlan 1))# Usage When the value of the “other stateful configuration” flag is true, end nodes should use stateful autoconfiguration (DHCPv6) to obtain additional information (excluding addresses). When the value is false, end nodes do not. Refer to RFC 2462, “IPv6 Stateless Address Autoconfiguration,” for more information. Use the no form of this command to reset the flag to false. Example This example sets the other stateful configuration flag to true. C3(su)->router(Config-if(Vlan 1))# ipv6 nd other-config-flag SecureStack C3 Configuration Guide 22-17...
Page 658: Ipv6 Nd Ra-Interval
ipv6 nd ra-interval ipv6 nd ra-interval This command sets the transmission interval between router advertisements. Syntax ipv6 nd ra-interval sec no ipv6 nd ra-interval Parameters Specifies the value in seconds of the router advertisement transmission interval. The value can range from 4 to 1800 seconds. Defaults 600 seconds. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage The no form of this command resets the interval value to the default of 600 seconds. Example This example sets the router advertisement transmission interval to 120 seconds. C3(su)->router(Config-if(Vlan 1))# ipv6 nd ra-interval 120 ipv6 nd ra-lifetime This command sets the value, in seconds, that is placed in the Router Lifetime field of router advertisements sent from this interface. Syntax ipv6 nd ra-lifetime sec | 0 no ipv6 nd ra-lifetime Parameters Specifies the value of the Router Lifetime in seconds. The value must be ...
Page 659: Ipv6 Nd Suppress-Ra
Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage By default, transmission of router advertisements is enabled. This command disables such transmissions. Use the no form of this command to re‐enable transmission. Example This example disables router advertisement transmission. C3(su)->router(Config-if(Vlan 1))# ipv6 nd suppress-ra ipv6 nd prefix This command configures the IPv6 prefixes to be included in router advertisements sent by this interface. Syntax ipv6 nd prefix {ipv6-prefix/prefix-length} [{valid-lifetime | infinite} {preferred-lifetime | infinite}] [no-autoconfig] [off-link] no ipv6 nd prefix {ipv6-prefix/prefix-length} SecureStack C3 Configuration Guide 22-19...
Page 660 ipv6 nd prefix Parameters ipv6‐prefix/prefix‐length The IPv6 network prefix and the prefix length being configured. The prefix must be in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. The prefix length is a decimal number indicating the number of high‐ order contiguous bits of the address that comprise the network portion of the address. valid‐lifetime | infinite (Optional) Specifies the length of time in seconds (relative to the time the packet is sent) that the prefix is valid for the purpose of on‐link determination. The lifetime value can range from 0 to 4,294,967,295. Specifying infinite means that the prefix is always valid. preferred‐lifetime | (Optional) Specifies the length of time in seconds (relative to the time infinite the packet is sent) that addresses generated from the prefix by means of stateless address autoconfiguration remain preferred. The lifetime value can range from 0 to 4,294,967,295. Specifying infinite means that the prefix is always preferred. no‐autoconfig Unsets the autonomous address‐configuration flag. When not set, means that this prefix cannot be used for autonomous address configuration. By default, the autonomous address‐configuration flag is set/enabled. off‐link Unsets the on‐link flag. When not set, means that this prefix cannot be used for on‐link determination. By default, the on‐link flag is set/ enabled. Defaults • Valid‐lifetime — 604800 • Preferred‐lifetime — 2592000 • Autoconfig — enabled •...
Page 661 Example This example configures a prefix that can be used for both on‐link determination and autoconfiguration, using the default values for valid lifetime and preferred lifetime. (su)->router(Config-if(Vlan 1))# ipv6 nd prefix 2001:0db8:4444:5555/64 SecureStack C3 Configuration Guide 22-21...
Page 662: Query Commands
Query Commands Query Commands For information about... Refer to page... show ipv6 22-22 show ipv6 interface 22-22 show ipv6 neighbors 22-24 show ipv6 route 22-25 show ipv6 route preferences 22-27 show ipv6 route summary 22-28 show ipv6 traffic 22-29 clear ipv6 statistics 22-34 show ipv6 This command displays the status of IPv6 forwarding mode and unicast routing mode.
Page 663 Enabled Router Advertisement Other Config Flag Enabled Router Advertisement Suppress Flag Disabled This example displays information about IPv6 interface tunnel 1. C3(su)->router>show ipv6 interface tunnel 1 Tunnel 1 Administrative Mode Enabled Tunnel 1 IPv6 Routing Operational Mode Disabled Mode for IPv6 Tunnel IPv6OVER4 SecureStack C3 Configuration Guide 22-23...
Page 664: Show Ipv6 Neighbors
show ipv6 neighbors Source Address for IPv6 Tunnel 192.168.1.2 Destination Address for IPv6 Tunnel 192.168.8.1 Routing Mode Enabled Interface Maximum Transmit Unit 1480 Router Duplicate Address Detection Transmits Router Advertisement NS Interval Router Lifetime Interval 1800 Router Advertisement Reachable Time Router Advertisement Interval Router Advertisement Managed Config Flag Disabled...
Page 665: Show Ipv6 Route
[{ipv6-addr [route-type] | {{ipv6-prefix/prefix-length | interface interface} [route-type] | route-type | all] Parameters ipv6‐addr Specifies a specific IPv6 address for which the best‐matching route should be displayed. ipv6‐prefix/prefix‐length The IPv6 network prefix of the route to display, and the prefix length. The prefix must be in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. The prefix length is a decimal number indicating the number of high‐ order contiguous bits of the address that comprise the network portion of the address. interface interface Specifies that the routes with next‐hops on this interface should be displayed. Interface can be of the form: vlan vlan‐id tunnel tunnel‐id loopback loop‐id route‐type Specifies the route type as one of the following: connected static ospf Specifies that all routes should be displayed. SecureStack C3 Configuration Guide 22-25...
Page 666: Show Ipv6 Route Output Details
show ipv6 route Defaults If no parameters are entered, information about all active IPv6 routes is displayed. Mode Router privileged execution: C3(su)‐>router# Router user execution: C3(su)‐>router> Usage Use this command to display IPv6 routing table information for active routes. Example This example displays all active IPv6 routes. C3(su)->router>show ipv6 route IPv6 Routing Table - 5 entries Codes: C - connected, S - static O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF Ext 1, OE2 - OSPF Ext 2 ON1 - OSPF NSSA Ext Type 1, ON2 - OSPF NSSA Ext Type 2 ::/0 [1/0] via FE80::2D0:B7FF:FE2C:7694,...
Page 667: Show Ipv6 Route Preferences
Preference of static routes. OSPF Intra Preference of routes within the OSPF area. OSPF Inter Preference of routes to other OSPF routes that are outside of the area. OSPF Ext T1 Preference of OSPF Type-1 external routes. SecureStack C3 Configuration Guide 22-27...
Page 668: Show Ipv6 Route Summary
show ipv6 route summary Table 22-3 show ipv6 route preferences Output Details Output Field What It Displays... OSPF Est T2 Preference of OSPF Type-2 external routes. OSPF NSSA T1 Preference of OSPF NSSA Type 1 routes. OSPF NSS! T2 Preference of OSPF NSSA Type 2 routes. show ipv6 route summary This command displays the summary of the routing table.
Page 669: Show Ipv6 Traffic
Received Datagrams Discarded Due To No Route....0 Received Datagrams With Unknown Protocol....0 Received Datagrams Discarded Due To Invalid Address..0 Received Datagrams Discarded Due To Truncated Data..0 Received Datagrams Discarded Other......0 SecureStack C3 Configuration Guide 22-29...
Page 670: Show Ipv6 Traffic Output Details
show ipv6 traffic Received Datagrams Reassembly Required....0 Datagrams Successfully Reassembled......0 Datagrams Failed To Reassemble......0 Datagrams Forwarded........0 Datagrams Locally Transmitted......876 Datagrams Transmit Failed......... 0 Datagrams Successfully Fragmented......0 Datagrams Failed To Fragment......0 Fragments Created......... 0 Multicast Datagrams Received......
Page 671 IPv6 routers, this counter will include only those packets which were Source-Routed via this entity, and the Source-Route processing was successful. Note that for a successfully forwarded datagram the counter of the outgoing interface increments. SecureStack C3 Configuration Guide 22-31...
Page 672 show ipv6 traffic Table 22-5 show ipv6 traffic Output Details (Continued) Output Field What It Displays... Datagrams Locally Transmitted Total number of IPv6 datagrams which local IPv6 user protocols (including ICMP) supplied to IPv6 in requests for transmission. Note that this counter does not include any datagrams counted in ipv6IfStatsOutForwDatagrams.
Page 673 Number of ICMP Neighbor Advertisement messages sent by the Messages Transmitted interface. ICMPv6 Redirect Messages Number of Redirect messages sent. For a host, this object will Transmitted always be zero, since hosts do not send redirects. SecureStack C3 Configuration Guide 22-33...
Page 674: Clear Ipv6 Statistics
clear ipv6 statistics Table 22-5 show ipv6 traffic Output Details (Continued) Output Field What It Displays... ICMPv6 Group Membership Query Number of ICMPv6 Group Membership Query messages sent. Messages Transmitted ICMPv6 Group Membership Response Number of ICMPv6 group Membership Response messages sent. Messages Transmitted ICMPv6 Group Membership Reduction Number of ICMPv6 Group Membership Reduction messages...
Page 675: Chapter 23: Ipv6 Proxy Routing
Preparing a Mixed Stack for IPv6 Proxy Routing 23-2 Commands 23-3 Overview IPv6 proxy routing allows a mixed C2/C3 stack to support some IPv6 routing functionality. When IPv6 proxy routing is enabled, all the switches in the stack can support IPv6 unicast routing and IPv6 tunneling. You can configure port‐based and VLAN‐based IPv6 routing interfaces on any C2 or C3 stack unit. There is no change in existing IPv4 routing capabilities. Since this is a function that exists only in a mixed stack, it is implemented only in the C2 firmware, release 5.01 and later. For IPv6 proxy routing to exist in the stack, a C3 unit must run as the manager of the stack. To facilitate this, the stack manager preference of C3 units should be set to a higher value than C2 units. If a C3 unit is added to an all C2 stack, you must move the manager to a C3 unit to use this feature. Multiple C3 units can exist in the mixed stack. All the C3 units in the mixed stack will independently perform hardware IPv6 routing/tunneling. The manager C3 unit will transparently do the hardware IPv6 routing/tunneling for all the C2 units. When IPv6 proxy routing is enabled, the C2 being configured for routing/tunneling (called the proxy client) is configured to redirect the routed IPV6/Tunneling packets to one of the stacking ports of the C3 stack manager (called the proxy server). The C2 is only configured if the proxy feature is already enabled on the stack. It should be noted that only IPv6 packets with a destination MAC of the router MAC of the system are redirected to the proxy server. On the proxy server, all incoming packets to the stacking ports with a destination of one of the stacking ports will be processed through L2 and L3 switching logic. If the destination port is not one of the stacking ports (not an IPv6 packet), then the incoming packet is forwarded based on header information. This feature is disabled by default. In order to use the OSPF, PIM‐SM, DVMRP, or VRRP protocols, you must have purchased and installed the C2 advanced routing license. SecureStack C3 Configuration Guide 23-1...
Page 676: Limitations
Preparing a Mixed Stack for IPv6 Proxy Routing Limitations • Proxy routing will use up to two masks in the fast forwarding processor associated with each port involved in routing of IPv6 packets. This will require restrictions on the use of policy when proxy routing is enabled. • All IPv6 packets ingressing or egressing a C2 port must be sent over the stack to the C3 stack master. Limited stack bandwidth and the amount of IPv6 traffic must be carefully considered when configuring multiple C2 ports for IPv6 routing. • If the stack master moves from a C3 unit to a C2 unit in the stack, proxy routing will no longer be available. To ensure that proxy routing continues to operate in the event of a failover, C3 units must be configured to be preferred when a new master is elected. Preparing a Mixed Stack for IPv6 Proxy Routing At least two C3 switches should be added to a C2 stack, for management redundancy. As in any mixed C2/C3 mixed stack, the C2 firmware (release 5.01 or later) must be installed on the C3 switches. Refer to “Issues Related to Mixed Type Stacks” on page 2‐5 for additional information. If you are adding the C3 switches to an existing C2 stack, make one of the C3 switches the stack manager. For example, if the current stack manager is unit 1 and the C3 switch that you want to become manager is unit 7: C2(su)->set switch movemenagement 1 7 Moving stack management will unconfigure entire stack including all interfaces.
Page 677: Commands
Parameters None. Defaults IPv6 proxy routing is disabled by default. Mode Router global configuration: C2(su)‐>router(Config)# Usage IPv6 proxy routing is disabled by default. It must be enabled with this command before the C2 switches in the stack will start redirecting routed IPv6/tunneling packets to the C3 proxy server. Uses the no form of this command to disable IPv6 proxy routing. Example This example enables IPv6 proxy routing. c2(su)->router c2(su)->router>enable c2(su)->router#config Enter configuration commands: c2(su)->router(Config)#ipv6 proxy-routing show ipv6 proxy-routing Use this command to display the status of IPv6 proxy routing. Syntax show ipv6 proxy-routing Parameters None. SecureStack C3 Configuration Guide 23-3...
Page 678 show ipv6 proxy-routing Defaults None. Mode Any routing mode. Example This example shows the output of this command when IPv6 proxy routing is disabled. c2(su)->router(Config)#show ipv6 proxy-routing IPv6 Proxy Routing Mode........Disable 23-4 IPv6 Proxy Routing...
Page 679: Chapter 24: Dhcpv6 Configuration
“Activating Licensed Features” in order to enable the DHCPv6 configuration command set. If you wish to purchase an IPv6 routing license, contact Enterasys Networks Sales. The commands described in this chapter perform configuration of the Dynamic Host ...
Page 680: Default Conditions
Global Configuration Commands RFC 3315 also describes DHCPv6 Relay Agent interactions, which are very much like DHCPv4 Relay Agent. RFC 3046 describes the DHCPv6 Relay Agent Information Option, which employs very similar capabilities as those described by DHCPv4 Relay Agent Option in RFC 2132. With the larger address space inherent to IPv6, addresses within a network can be allocated more effectively in a hierarchical fashion. DHCPv6 introduces the notion of “prefix delegation” as described in RFC 3633 as a way for routers to centralize and delegate IP address assignment. Default Conditions The following table lists the default DHCPv6 conditions. Condition Default Value IPv6 DHCP Disabled IPv6 DHCP Relay Agent Information Option IPv6 DHCP Relay Agent Information Remote ID Sub-option IPv6 DHCP Preferred Lifetime 2592000 seconds IPv6 DHCP Valid Lifetime 604800 seconds Global Configuration Commands Purpose...
Page 681: Ipv6 Dhcp Relay-Agent-Info-Opt
DHCPv6 after it has been enabled. Example This example enables DHCPv6. C3(su)->router(Config)# ipv6 dhcp enable ipv6 dhcp relay-agent-info-opt This command configures a number to represent the DHCPv6 Relay Agent Information Option. Syntax ipv6 dhcp relay-agent-info-opt option Parameters option The value of option may range from 32 to 65535. The default value is 32. Defaults The default value of the DHCPv6 Relay Agent Information Option is 32. Mode Router global configuration: C3(su)‐>router(Config)# Usage The DHCPv6 Relay Agent Information Option allows for various sub‐options to be attached to messages that are being relayed by the local router to a relay server. The relay server may in turn use this information in determining an address to assign to a DHCPv6 client. Refer to RFC 3046 for more information. Example This example sets the Relay Agent Information Option value to 82. C3(su)->router(Config)# ipv6 dhcp relay-agent-info-opt 82 SecureStack C3 Configuration Guide 24-3...
Page 682: Ipv6 Dhcp Relay-Agent-Info-Remote-Id-Subopt
ipv6 dhcp relay-agent-info-remote-id-subopt ipv6 dhcp relay-agent-info-remote-id-subopt This command configures a number to represent the DHCPv6 Relay Agent Remote‐ID sub‐option. Syntax ipv6 dhcp relay-agent-info-remote-id-subopt option Parameters option The value of option may range from 1 to 65535. The default value is 1. Defaults The default value of the DHCPv6 Relay Agent Remote‐ID sub‐option is 1. Mode Router global configuration: C3(su)‐>router(Config)# Usage This sub‐option may be added by DHCP relay agents which terminate switched or permanent circuits and have mechanisms to identify the remote host end of the circuit. Refer to RFC 3046 for more information. Example This example sets the Relay Agent Remote‐ID sub‐option value to 2. C3(su)->router(Config)# ipv6 dhcp relay-agent-info-remote-id-subopt 2 ipv6 dhcp pool This command allows you to enter IPv6 DHCP pool configuration mode for the specified pool name. Syntax ipv6 dhcp pool pool-name no ipv6 dhcp pool pool-name Parameters pool‐name...
Page 683 Usage DHCPv6 pools are used to specify information for the DHCPv6 server to distribute to DHCPv6 clients. These pools are shared between multiple interfaces over which DHCPv6 server capabilities are configured. After executing this command and entering pool configuration mode, you can return to global configuration mode by executing the exit command. Pool configuration commands are described in the section “Address Pool Configuration Commands” on page 24‐6. Use the no form of this command to remove a specified pool. Example This example enters DHCP pool configuration mode to configure the pool named “PoolA.” C3(su)->router(Config)# ipv6 dhcp pool PoolA C3(su)->router(Config-dhcp6s-pool)# SecureStack C3 Configuration Guide 24-5...
Page 684: Address Pool Configuration Commands
Address Pool Configuration Commands Address Pool Configuration Commands Purpose These DHCP pool configuration mode commands are used to configure address pool parameters. This information is provided to DHCP clients by the DHCP server. Commands For information about... Refer to page... domain-name 24-6 dns-server 24-7 prefix-delegation 24-7 exit 24-8 domain-name This command sets the DNS domain name which is provided to DHCPv6 clients by the DHCPv6 server. Syntax domain-name name no domain-name name Parameters name Specifies the DNS domain name for the pool being configured. The name can consist of no more than 31 alpha‐numeric characters. Defaults None.
Page 685: Dns-Server
Usage A DNS server address is configured for stateless server support. A DHCPv6 pool can have up to 8 DNS server addresses configured for it. The no form of this command will remove the DHCPv6 server address from the DHCPv6 pool being configured. Example This example configures a DNS server address for the pool named PoolA. C3(su)->router(Config)# ipv6 dhcp pool PoolA C3(su)->router(Config-dhcp6s-pool)# dns-server 2001:0db8:1234:5678::A prefix-delegation This command configures a numeric prefix to be delegated to a specified prefix delegation client. Syntax prefix-delegation prefix/prefix-length DUID [name hostname] [valid-lifetime {secs | infinite}] [preferred-lifetime {secs | infinite}] no prefix-delegation prefix/prefix-length DUID SecureStack C3 Configuration Guide 24-7...
Page 686: Exit
exit Parameters prefix/prefix‐length This prefix must be in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. The value of prefix‐length is a decimal number indicating the number of high‐order contiguous bits of the address that comprise the prefix. DUID The DHCP Unique Identifier (DUID) of the prefix delegation client, as described in RFC 3315. name hostname (Optional) The name of the prefix delegation client, consisting of up to 31 alpha‐numeric characters. This name is used for logging and/or tracing only. valid‐lifetime secs | (Optional) The valid lifetime of the prefix, specified as seconds or as infinite infinite. The value of secs can range from 0 to 4294967295. preferred‐lifetime (Optional) The preferred lifetime of the prefix, specified as seconds or as secs | infinite infinite. The value of secs can range from 0 to 4294967295. Defaults Default value of valid lifetime of prefix: 604,800 Default value of preferred lifetime of prefix: 2,592,000 Mode Router DHCPv6 pool configuration mode: C3(su)‐>router(Config‐dhcp6s‐pool)# Usage Use this command to manually configure an IPv6 address prefix to be delegated to a specific client, identified by their DHCP unique identifier. Refer to RFC 3633, “IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6,” for more information about prefix delegation. Use the no form of this command to remove a configured prefix. Example This example configures a prefix to be delegated to the prefix delegation client identified by the DUID 00:02:00:00:00:11:0A:C0:89:D3:03:00:09:AA. The default lifetime values are used. C3(su)->router(Config)# ipv6 dhcp pool PoolA C3(su)->router(Config-dhcp6s-pool)# prefix-delegation 2001:0db8:10::/48 00:02:00:00:00:11:0A:C0:89:D3:03:00:09:AA exit...
Page 687 Defaults None. Mode Router DHCPv6 pool configuration mode: C3(su)‐>router(Config‐dhcp6s‐pool)# Example This example illustrates how to exit DHCPv6 pool configuration mode. C3(su)->router(Config-dhcp6s-pool)# exit C3(su)->router(Config)# SecureStack C3 Configuration Guide 24-9...
Page 688: Interface Configuration Commands
Interface Configuration Commands Interface Configuration Commands Purpose These commands are used to configure an interface as either a DHCPv6 server or a DHCPv6 relay agent. Commands For information about... Refer to page... ipv6 dhcp server 24-10 ipv6 dhcp relay 24-11 ipv6 dhcp server This command configures DHCPv6 server functionality on an interface. Syntax ipv6 dhcp server pool-name [rapid-commit} [preference pref] no ipv6 dhcp server pool-name Parameters pool‐name Specifies the pool containing stateless and/or prefix delegation ...
Page 689: Ipv6 Dhcp Relay
{destination dest-addr interface intf | interface intf} Parameters destination dest‐addr Specifies the IPv6 address of a DHCPv6 relay server. This IPv6 address can be a global address, a multicast address, or a link‐local address. If the address is a multicast or link‐local address, then you must specify the interface to be used to contact the relay server with the interface parameter. interface intf Specifies the interface to be used to contact the relay server. The interface is identified by port type.unit number.port number. For example, .3.1. If destination dest‐addr is not specified, then an interface must be specified and the DHCPV6‐ALL‐AGENTS multicast address (FF02::1:2) is used to relay DHCPv6 messages to the relay server. remote‐id {duid‐ifid | (Optional) Specifies that the Relay Agent Information Option user‐defined‐string} Remote‐ID sub‐option is to be added to relayed messages. Specifying duid‐ifid causes the remote ID to be derived from the relay agent’s DUID and the relay interface number. Alternatively, you can specify the remote ID as a user‐defined‐string of alpha‐numeric characters. Refer to RFC 3046 and RFC 4649 for more information about the Remote‐ID option. Defaults If remote‐id is not specified, the Relay Agent Information Option Remote‐ID sub‐option is not added to relayed messages. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage Use this command to configure a routing interface as a DHCPv6 relay agent. An interface can be configured as either a DHCPv6 server or a DHCPv6 relay agent, but not both. Use the no form of this command to remove DHCPv6 relay agent functionality from an interface. SecureStack C3 Configuration Guide 24-11...
Page 690 ipv6 dhcp relay Examples This example configures interface VLAN 8 as a DHCPv6 relay agent that relays DHCPv6 messages to the DHCPv6 server at the global address 2001:0db8:1234:5555::122:10. C3(su)->router(Config)# interface vlan 8 C3(su)->router(Config-if(Vlan 8))# ipv6 dhcp relay destination 2001:0db8:1234:5555::122:10/64 This example configures interface VLAN 8 as a DHCPv6 relay agent by configuring the interface through which the relay agent relays messages using the DHCPV6‐ALL‐AGENTS multicast address. C3(su)->router(Config)# interface vlan 8 C3(su)->router(Config-if(Vlan 8))# ipv6 dhcp relay interface ge.3.1 24-12 DHCPv6 Configuration...
Page 691: Dhcpv6 Show Commands
24-18 show ipv6 dhcp binding 24-18 show ipv6 dhcp This command displays the state of DHCPv6 on the switch and, if DHCPv6 is enabled, the switch’s DHCP unique identifier (DUID). Syntax show ipv6 dhcp Parameters None. Defaults None. Mode Router privileged execution: C3(su)‐>router# Example This example illustrates the output of this command when DHCPv6 is enabled on the switch. C3(su)->router# show ipv6 dhcp DHCPv6 is enabled Server DUID: 00:01:00:06:90:83:57:c7:00:11:88:56:5d:58 SecureStack C3 Configuration Guide 24-13...
Page 692: Show Ipv6 Dhcp Interface
show ipv6 dhcp interface show ipv6 dhcp interface This command displays DHCPv6 configuration information or DHCPv6 statistics for the specified routing interface. Syntax show ipv6 dhcp vlan vlan-id [statistics] Parameters vlan vlan‐id Specifies the ID of the routing interface for which to display DHCPv6 information. statistics (Optional) Specifies that DHCPv6 statistics for the specified interface should be displayed. Defaults If statistics is not specified, configuration information about the interface is displayed. Mode Router privileged execution: C3(su)‐>router# Usage When you display DHCPv6 configuration information, the information displayed is different depending on whether the interface has been configured as a DHCPv6 server or relay agent. Examples This example displays DHCPv6 configuration information about VLAN 80, which was configured as a DHCPv6 server. C3(su)->router# show ipv6 dhcp interface vlan 80 IPv6 Interface Vlan 80 Mode...
Page 693: Output Of Show Ipv6 Dhcp Interface Command
DHCPv6 Malformed Packets Received Received DHCPv6 Packets Discarded Total DHCPv6 Packets Received DHCPv6 Advertisement Packets Transmitted DHCPv6 Reply Packets Transmitted DHCPv6 Reconfig Packets Transmitted DHCPv6 Relay-reply Packets Transmitted DHCPv6 Relay-forward Packets Transmitted Total DHCPv6 Packets Transmitted Table 24‐2 provides an explanation of the command output. SecureStack C3 Configuration Guide 24-15...
Page 694: Show Ipv6 Dhcp Statistics
show ipv6 dhcp statistics show ipv6 dhcp statistics This command displays IPv6 DHCP statistics for all interfaces. Syntax show ipv6 dhcp statistics Parameters None. Defaults None. Mode Router privileged execution: C3(su)‐>router# Example This example displays the output of this command. C3(su)->router# show ipv6 dhcp statistics DHCPv6 Interface Global Statistics ------------------------------------ DHCPv6 Solicit Packets Received DHCPv6 Request Packets Received DHCPv6 Confirm Packets Received DHCPv6 Renew Packets Received DHCPv6 Rebind Packets Received...
Page 695: Clear Ipv6 Dhcp Statistics
Total DHCPv6 Packets Transmitted Total number of DHCPv6 sent statistics. clear ipv6 dhcp statistics This command clears IPv6 DHCP statistics, either all statistics or only for a specific interface. Syntax clear ipv6 dhcp statistics [vlan vlan-id] Parameters vlan vlan‐id (Optional) Specifies the interface for which to clear DHCPv6 statistics. Defaults If no interface is specified, IPv6 DHCP statistics for all interfaces are cleared. Mode Router privileged execution: C3(su)‐>router# Example This example clears DHCPv6 statistics for VLAN 80. C3(su)->router# clear ipv6 dhcp statistics vlan 80 SecureStack C3 Configuration Guide 24-17...
Page 696: Show Ipv6 Dhcp Pool
show ipv6 dhcp pool show ipv6 dhcp pool This command displays information about a specific configured pool. Syntax show ipv6 dhcp pool pool-name Parameters pool‐name The name of the configured address pool for which to display information. Defaults None. Mode Router privileged execution: C3(su)‐>router# Usage The information displayed by this command differs, depending on the configuration parameters of the pool. Examples This example displays the output for PoolA that was not configured for prefix delegation. C3(su)->router# show ipv6 dhcp pool PoolA DHCPv6 Pool: PoolA DNS Server: 2001:db8:1234:5678::A Domain Name: enterasys.com This example displays the output for PoolB that was configured for prefix delegation.
Page 697 This example displays all bindings for the client with the IPv6 address FE80::111:FCF1:DEA5:10. C3(su)->router# show ipv6 dhcp binding FE80::111:FCF1:DEA5:10 DHCP Client Address: FE80::111:FCF1:DEA5:10 DUID: 000300010002FCA5DC1C IA ID: 0x00040001, T1 0, T2 0 Prefix/Prefix Length: 3FFE:C00:C18:11::/68 Prefix Type: IPPD Expiration: 12320 seconds Valid Lifetime: 12345 Preferred Lifetime: 180 SecureStack C3 Configuration Guide 24-19...
Page 698 show ipv6 dhcp binding 24-20 DHCPv6 Configuration...
Page 699: Chapter 25: Ospfv3 Configuration
“Activating Licensed Features” in order to enable the OSPFv3 protocol configuration command set. If you wish to purchase an IPv6 routing license, contact Enterasys Networks Sales. The commands in this chapter perform configuration of the OSPFv3 routing protocol on the ...
Page 700: Default Conditions
Overview semantics. LSA scope is generalized to link, area, and AS scope. OSPFv3 specifies the processing of unsupported LSAs. Unsupported LSAs are maintained in the database and flooded according to scope. In OSPFv3, routers with 100 or more interfaces generate more than one router LSA. A new link LSA has been created. Addresses in LSAs are specified as [prefix, prefix length]. Area ID and Router ID remain 32 bit identifiers. OSPFv3 identifies Neighbors by router ID instead of the interface address used in OSPFv2. Note that both OSPFv3 and OSPFv2 can be enabled and run on the SecureStack C3. Default Conditions The following table lists the default OSPFv3 conditions. Condition Default Value IPv6 OSPF Disabled IPv6 OSPF cost IPv6 OSPF dead-interval 40 seconds IPv6 OSPF hello-interval 10 seconds IPv6 OSPF mtu-ignore Enabled IPv6 OSPF network Broadcast IPv6 OSPF priority IPv6 OSPF retransmit-interval IPv6 OSPF transmit-delay Area stub no-summary...
Page 701: Global Ospfv3 Configuration Commands
25-5 exit-overflow-interval 25-6 external-lsdb-limit 25-7 maximum-paths 25-8 redistribute 25-8 ipv6 router id This command configures a 32‐bit integer, entered in 32‐bit dotted‐quad notation, used to uniquely identify this OSPFv3 router. Syntax ipv6 router id ip-address Parameters ip‐address Specifies the ID of the OSPFv3 router, in 32‐bit dotted‐quad notation. Defaults None. Mode Router global configuration: C3(su)‐>router(Config)# Usage Use this command to configure the OSPFv3 router ID. Example This example illustrates configuring the OSPFv3 router ID as 2.2.2.2. C3(su)->router(Config)# ipv6 router id 2.2.2.2 SecureStack C3 Configuration Guide 25-3...
Page 702: Ipv6 Router Ospf
ipv6 router ospf ipv6 router ospf This command enters Router OSPFv3 configuration mode. Syntax ipv6 router ospf Parameters None. Defaults None. Mode Router global configuration: C3(su)‐>router(Config)# Usage Use this command to enter OSPFv3 configuration mode so you can configure global OSPFv3 parameters. Example This example illustrates entering router OSPFv3 configuration mode. C3(su)->router(Config)# ipv6 router ospf C3(su)->router(Config-router)# default-information originate This command is used to control the advertisement of default routes. Syntax default-information originate [always] [metric value] [metric-type type] no default-information originate [metric] [metric-type] Parameters always (Optional) Always advertises the default route information.
Page 703: Default-Metric
Mode Router OSPFv3 configuration: C3 (su)->router(Config-router)# Usage Use this command to cause the same metric value to be used for all redistributed routes. Use the no form of this command to remove a configured default metric. Example This example configures a metric of 100 to be used for all redistributed routes. C3(su)->router(Config-router)# default-metric 100 distance ospf This command sets the route preference value of OSPFv3. Syntax distance ospf {intra | inter | type1 | type2} preference no distance ospf {intra | inter | type1 | type2} SecureStack C3 Configuration Guide 25-5...
Page 704: Exit-Overflow-Interval
exit-overflow-interval Parameters intra Specifies the preference for intra‐area routes (all routes within an area) inter Specifies the preference for inter‐area routes (all routes between areas) type1 Specifies the preference for Type 1 external routes (routes learned by redistribution from other routing domains) type2 Specifies the preference for Type 2external routes (routes learned by redistribution from other routing domains) preference The preference range is from 1 to 255. Defaults The default preference values are: Intra‐area = 8 Inter‐area = 10 Type 1 = 13 Type 2 = 50 Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Lower route preference values are preferred when determining the best route. The OSPFv3 specification (RFC 2328) requires that preferences must be given to the routes learned via OSPFv3 in the following order: intra‐area < inter‐area < Type 1 < Type 2. A route with a preference of 255 cannot be used to forward traffic. Use the no form of this command to reset the preference values back to the defaults. Example The following example set the intra‐area preference to 5. C3(su)->router(Config-router)# distance ospf intra 5 exit-overflow-interval This command configures the exit overflow interval for OSPFv3. Syntax exit-overflow-interval seconds no exit-overflow-interval Parameters seconds...
Page 705: External-Lsdb-Limit
The no form of this command resets the interval to the default of 0. Example This example sets the exit overflow interval to 10 seconds. C3(su)->router(Config-router)# exit-overflow-interval 10 external-lsdb-limit This command configures the external LSDB limit for OSPFv3. Syntax external-lsdb-limit limit no external-lsdb-limit Parameters limit Specifies the limit, which can range from ‐1 to 2147483647. A value of ‐1 means that there is no limit. Defaults The default value is ‐1. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage When the number of non‐default AS‐external‐LSAs in a routerʹs link‐state database reaches the external LSDB limit, the router enters overflow state. The router never holds more than the external LSDB limit non‐default AS‐external‐LSAs in it database. The external LSDB limit MUST be set identically in all routers attached to the OSPFv3 backbone and/or any regular OSPFv3 area. The no form of this command resets the limit to the default value of ‐1, meaning no limit. Example This example sets the external LSDB limit to 1000. C3(su)->router(Config-router)# external-lsdb-limit 1000 SecureStack C3 Configuration Guide 25-7...
Page 706: Maximum-Paths
maximum-paths maximum-paths This command sets the number of paths that OSPFv3 can report for a given destination. Syntax maximum-paths maxpaths no maximum-paths Parameters maxpaths Specifies the value for maxpaths, which can range from 1 to 4. Defaults The default value is 4. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Use the no form of this command to reset the maximum number of paths to the default value of 4. Example This example sets the maximum number of paths for a given destination to 3. C3(su)->router(Config-router)# maximum-paths 3 redistribute This command configures the OSPFv3 protocol to allow redistribution of routes from the specified source protocol/routers. Syntax redistribute {connected | static} [metric value] [metric-type type] [tag tag] no redistribute {connected | static} [metric] [metric-type] [tag] Parameters connected | static Specifies the source protocol to redistribute.
Page 707 Metric = unspecified Metric type = Type 2 Tag = 0 Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage The no form of this command configures the OSPFv3 protocol to prohibit redistribution of routes from the specified source protocol/routers. Example This example configures route redistribution of static routes and applies a metric of 10 C3(su)->router(Config-router)# redistribute static metric 10 SecureStack C3 Configuration Guide 25-9...
Page 708: Area Configuration Commands
Area Configuration Commands Area Configuration Commands Purpose These commands are used to configure area parameters. Commands For information about... Refer to page... area default-cost 25-10 area nssa 25-11 area nssa default-info-originate 25-12 area nssa no-redistribute 25-12 area nssa no-summary 25-13 area nssa translator role 25-14 area nssa translator-stab-intv 25-14 area range 25-15...
Page 709: Area Nssa
C3(su)->router(Config-router)# area 20 default-cost 50 area nssa This command configures the specified area to function as a not so stubby area (NSSA). Syntax area areaid nssa no area areaid nssa Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. Defaults None. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage An NSSA allows some external routes represented by external Link State Advertisements (LSAs) to be imported into it. This is in contrast to a stub area that does not allow any external routes. External routes that are not imported into an NSSA can be represented by means of a default route. This configuration is used when an OSPFv3 internetwork is connected to multiple non‐ OSPF routing domains. The no form of this command changes the NSSA back to a plain area. Example This example shows how to configure area 20 as an NSSA. C3(su)->router(Config-router)# area 20 nssa SecureStack C3 Configuration Guide 25-11...
Page 710: Area Nssa Default-Info-Originate
area nssa default-info-originate area nssa default-info-originate This command configures the metric value and type for the default route advertised into the NSSA. Syntax area areaid nssa default-info-originate [metric] [comparable | non-comparable] no area areaid nssa default-info-originate Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. metric (Optional) Specifies the metric of the default route, in the range of 1 to 16777214. comparable | (Optional) Specifies the metric type: non‐comparable • comparable — nssa‐external 1 • non‐comparable — nssa‐external 2 Defaults Default metric value is 10. Mode Router OSPFv3 configuration: C3 (su)->router(Config-router)# Usage Use this command to allow a default route to be advertised within the area. This option should be ...
Page 711: Area Nssa No-Summary
C3(su)->router(Config-router)# area 20 no-redistribute area nssa no-summary This command configures the NSSA area border router to not advertise summary routes into the NSSA. Syntax area areaid nssa no-summary no area areaid nssa no-summary Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. Defaults None. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Use this command to prevent the advertising of summary routes into the specified NSSA by this router. Use the no form of this command to enable advertising of summary routes into the NSSA. Example This example the router to not advertise summary routes into NSSA 20. C3(su)->router(Config-router)# area 20 nssa no-summary SecureStack C3 Configuration Guide 25-13...
Page 712: Area Nssa Translator Role
area nssa translator role area nssa translator role This command configures the translator role of the router. Syntax area areaid nssa translator-role {always | candidate} no area areaid nssa translator-role Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. always Specifies that the router will always assume the role of the translator the instant is becomes a border router. candidate Specifies that the router will participate in the translator election process when it becomes a border router. Defaults By default, the translator role is disabled. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage The NSSA Translator Role specifies whether or not an NSSA router will unconditionally translate Type‐7 LSAs to Type‐5 LSAs when acting as an NSSA border router. When the always parameter is specified with this command, the router will always translate Type‐ 7 LSAs, regardless of the translator state of other NSSA border routers. When the candidate ...
Page 713: Area Range
{summarylink | nssaexternallink} [advertise | not-advertise] no area areaid range ipv6-prefix/prefix-length Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. ipv6‐prefix/prefix‐length Specifies IPv6 prefix and the length of the IPv6 prefix for the address range. The prefix must be specified in hexadecimal using 16‐bit values between colons. The value of prefix‐length is a decimal number indicating the number of high‐order contiguous bits that comprise the prefix. summarylink Specifies that route summarization should be based on summary LSAs. nssaexternallink Specifies that route summarization should be based on external LSAs Type 7. advertise | (Optional) Specifies whether or not the routes should be advertised. If not‐advertise neither parameter is specifies, the default is advertise. Defaults Area address ranges are not configured by default. SecureStack C3 Configuration Guide 25-15...
Page 714: Area Stub
area stub Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Address ranges control the advertisement of routes across area boundaries. Routing information is summarized, or aggregated, at area boundaries. External to the area, at most a single route is advertised (via an inter‐area‐prefix‐LSA) for each address range. A route is advertised if and only if the address range’s status is set to advertise. The default condition is to advertise. For ABRs configured for NSSA, route summarization/aggregation can be implemented based on LSA type — either summary LSAs (specified with the summarylink parameter), or NSSA external LSAs Type 7 (specified with the nssaexternallink parameter). You can configure multiple address ranges with this command. Use the no form of this command to remove a configured address range. Example This example configures an address range to be consolidated and advertised based on summary LSAs. C3(su)->router(Config-router)# area 20 range 3FFe:501::/32 summarylink area stub This command creates a stub area for the specified area ID. Syntax area areaid stub no area areaid stub Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. Defaults None. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage...
Page 715: Area Stub No-Summary
Defaults None. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Use the no form of this command to set the summary LSA import mode to the default for the specified stub area. Example The example disables the import of summary LSAs into stub area 30. C3(su)->router(Config-router)# area 30 stub no-summary area virtual-link This command creates the OSPFv3 virtual interface for the specified area and neighbor. Syntax area areaid virtual-link neighborid no area areaid virtual-link neighborid Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. neighborid Specifies the virtual link neighbor by means of its router ID. The router ID must be entered in 32‐bit dotted‐quad notation. SecureStack C3 Configuration Guide 25-17...
Page 716: Area Virtual-Link Dead-Interval
area virtual-link dead-interval Defaults None. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage The virtual link neighbor is identified by its router ID. Use the no form of this command to delete the configured OSPFv3 virtual interface identified by area and neighbor. Example This example creates a virtual interface for area 20 and the neighbor with router ID 2.2.2.2. C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.2 area virtual-link dead-interval This command configures the dead interval for the specified OSPFv3 virtual interface. Syntax area areaid virtual-link neighborid dead-interval seconds no area areaid virtual-link neighborid dead-interval Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. neighborid Specifies the virtual link neighbor by means of its router ID. The router ID must be entered in 32‐bit dotted‐quad notation. ...
Page 717: Area Virtual-Link Hello-Interval
This example configures a hello interval of 30 seconds for the specified OSPFv3 virtual interface. C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.2 hello-interval 30 area virtual-link retransmit-interval This command configures the retransmit interval for the specified OSPFv3 virtual interface. Syntax area areaid virtual-link neighborid retransmit-interval seconds no area areaid virtual-link neighborid retransmit-interval Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. neighborid Specifies the virtual link neighbor by means of its router ID. The router ID must be entered in 32‐bit dotted‐quad notation. seconds Specifies the value of the retransmit interval in seconds. The range is from 1 to 3600 seconds. SecureStack C3 Configuration Guide 25-19...
Page 718: Area Virtual-Link Transmit-Delay
area virtual-link transmit-delay Defaults The default retransmit interval is 5 seconds. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Use the no form of this command to return a configured value to the default value of 5 seconds. Example This example sets the retransmit interval to 10 seconds for the specified OSPFv3 virtual interface. C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.2 retransmit-interval area virtual-link transmit-delay This command configures the transmit delay for the specified OSPFv3 virtual interface. Syntax area areaid virtual-link neighborid transmit-delay seconds no area areaid virtual-link neighborid transmit-delay Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. neighborid Specifies the virtual link neighbor by means of its router ID. The router ID must be entered in 32‐bit dotted‐quad notation. ...
Page 719: Interface Configuration Commands
Parameters None. Defaults OSPFv3 is disabled by default. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage Use this command to enable OSPFv3 on a router VLAN interface or on a loopback interface. Use the no form of this command to disable OSPFv3 on an interface. Note: In order for OSPFv3 to run on an interface, IPv6 must be explicitly enabled on the interface using the ipv6 enable command. SecureStack C3 Configuration Guide 25-21...
Page 720: Ipv6 Ospf Areaid
ipv6 ospf areaid Example This example enters router interface configuration mode for VLAN 7 and then enables OSPFv3 on the interface. C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 ospf enable ipv6 ospf areaid This command sets the OSPFv3 area to which the router interface belongs. Syntax ipv6 ospf areaid areaid no ipv6 ospf areaid areaid Parameters areaid Specifies the area ID in either 32‐bit dotted‐quad format or as a decimal number between 0 and 4294967295. Defaults None. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage The area ID uniquely identifies the area to which the interface connects. Assigning an area ID which does not exist on an interface causes the area to be created with default values. Use the no form of this command to remove an area from the interface.
Page 721: Ipv6 Ospf Dead-Interval
C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 ospf cost 100 ipv6 ospf dead-interval This command sets the OSPFv3 dead interval for the router interface. Syntax ipv6 ospf dead-interval seconds no ipv6 ospf dead-interval seconds Parameters seconds Specifies the OSPFv3 dead interval in seconds. The value can range from 1 to 2147483647 seconds. Defaults The default dead interval value is 40 seconds. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage The OSPFv3 dead interval is the length of time in seconds that a router’s Hello packets have not been seen before its neighbor routers declare that the router is down. The value for the dead interval must be the same for all routers attached to a common network, and should be some multiple of the hello interval. Use the no form of this command to return the dead interval to the default value of 40 seconds. SecureStack C3 Configuration Guide 25-23...
Page 722: Ipv6 Ospf Hello-Interval
ipv6 ospf hello-interval Example This example sets the dead interval for router interface VLAN 7 to 60 seconds. C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 ospf dead-interval 60 ipv6 ospf hello-interval This command sets the OSPFv3 hello interval for the router interface. Syntax ipv6 ospf hello-interval seconds no ipv6 ospf hello-interval seconds Parameters seconds Specifies the OSPFv3 hello interval in seconds. The value can range from 1 to 65535 seconds. Defaults The default hello interval is 10 seconds. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage Use this command to specify the interval between hello packets that OSPFv3 sends on the interface being configured. The shorter the hello interval, the faster topological changes will be detected, but more routing traffic will ensue. The hello interval must be the same for all routers ...
Page 723: Ipv6 Ospf Network
C3(su)->router(Config-if(Vlan 7))# ipv6 ospf mtu-ignore ipv6 ospf network This command changes the default OSPFv3 network type for the router interface. Syntax ipv6 ospf network {broadcast | point-to-point} no ipv6 ospf network {broadcast | point-to-point} Parameters broadcast Sets the network type to broadcast. point‐to‐point Sets the network type to point‐to‐point. Defaults Default network type is broadcast. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage Normally, the network type is determined from the physical IP network type. By default, all Ethernet networks are OSPFv3 type broadcast. Similarly, tunnel interfaces default to point‐to‐ point. When an Ethernet port is used as a single large bandwidth IP network between two routers, the network type can be point‐to‐point since there are only two routers. Using point‐to‐point as the network type eliminates the overhead of the OSPFv3 designated router election. It is normally not useful to set a tunnel to OSPFv3 network type broadcast. SecureStack C3 Configuration Guide 25-25...
Page 724: Ipv6 Ospf Priority
ipv6 ospf priority Use the no form of this command to set the network type to the default. Example This example sets the network type to point‐to‐point for router interface VLAN 7. C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 ospf network point-to-point ipv6 ospf priority This command sets the OSPFv3 priority for the router interface. Router priority helps determine the designated router for an OSPFv3 link. Syntax ipv6 ospf priority priority no ipv6 ospf priority Parameters priority Specifies the priority value, which can range from 0 to 255. Defaults Default priority value is 1. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage When two routers on the same network attempt to become the designated router, the one with the higher router priority takes precedence. If there is a tie, the router with the higher router ID takes precedence. A router with a router priority set to zero is ineligible to become the designated router ...
Page 725: Ipv6 Ospf Transmit-Delay
This example sets the retransmit interval to 10 seconds for router interface VLAN 7. C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 ospf retransmit-interval 10 ipv6 ospf transmit-delay This command sets the OSPFv3 transmit delay for the router interface. Syntax ipv6 ospf transmit-delay seconds no ipv6 ospf transmit-delay Parameters seconds Specifies the transmit delay, which can range from 1 to 3600 seconds. Defaults Default value is 1 second. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage The transmit delay, specified in seconds, sets the estimated number of seconds it takes to transmit a link state update packet over this interface. Use the no form of this command to return the transmit delay to the default value of 1 seconds. SecureStack C3 Configuration Guide 25-27...
Page 726 ipv6 ospf transmit-delay Example This example sets the transmit delay value to 4 seconds for router interface VLAN 7. C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 ospf transmit-delay 4 25-28 OSPFv3 Configuration...
Page 727: Ospfv3 Show Commands
25-46 show ipv6 ospf This command displays OSPFv3 router information. Syntax show ipv6 ospf Parameters None. Defaults None. Mode Router privileged execution: C3(su)‐>router# Example This example shows how to display OSPFv3 router information. C3(su)->router# show ipv6 ospf Router ID 2.2.2.2 OSPF Admin Mode Enable ASBR Mode Enable SecureStack C3 Configuration Guide 25-29...
Page 728: Show Ipv6 Ospf Output Details
show ipv6 ospf ABR Status Enable Exit Overflow Interval External LSA Count External LSA Checksum New LSAs Originated LSAs Received External LSDB Limit No Limit Default Metric Not Configured Maximum Paths Default Route Advertise Disabled Always FALSE Metric Metric Type External Type 2 Table 25‐1 provides an explanation of the command output.
Page 729: Show Ipv6 Ospf Area
Area Border Router Count Total number of area border routers reachable within this area. Area LSA Count Total number of link-state advertisements in this area's link-state database, excluding AS External LSAs. SecureStack C3 Configuration Guide 25-31...
Page 730: Show Ipv6 Ospf Abr
show ipv6 ospf abr Table 25-2 show ipv6 ospf area Output Details (Continued) Output Field What It Displays... Area LSA Checksum Number representing the Area LSA Checksum for the specified Area ID excluding the external (LS type 5) link-state advertisements. Stub Mode Whether the specified area is a stub area or not.
Page 731: Show Ipv6 Ospf Asbr
The area ID of the area from which this route is learned. Next Hop Address of the next hop toward the destination. Next Hop Intf The outgoing router interface to use when forwarding traffic to the next hop. SecureStack C3 Configuration Guide 25-33...
Page 732: Show Ipv6 Ospf Database
show ipv6 ospf database show ipv6 ospf database This command displays information about the link state database when OSPFv3 is enabled. Syntax show ipv6 ospf [areaid] database [{external | inter-area {prefix | router} | link | network | nssa-external | prefix | router | unknown {area | as | link}}] [lsid] [{adv-router [rtrid] | self-originate | database-summary}] Parameters areaid (Optional) Display database information about a specific area. Enter the ...
Page 733 80000213 DFC0 V6E--R- --More-- or (q)uit This example illustrates the output of this command using the adv‐router parameter. C3(su)->router>show ipv6 ospf database external adv-router AS External States LS Age: 930 LS Type: AS-External-LSA LS Id: 1 Advertising Router: 2.2.2.2 LS Seq Number: 0x80000006 Checksum: 0x3e4c Length: 36 Options:(E-Bit) SecureStack C3 Configuration Guide 25-35...
Page 734: Show Ipv6 Ospf Database Output Details
show ipv6 ospf database Metric Type: 2 Metric:20 IPv6 Prefix: 2301::/64 (None) Table 25‐5 provides an explanation of the command output. Table 25-5 show ipv6 ospf database Output Details Output Field What It Displays... Link Id Number that uniquely identifies an LSA that a router originates from all other self originated LSAs of the same LS type. Advertising Router The Advertising Router.
Page 735: Show Ipv6 Ospf Database Database-Summary Output Details
Total number of NSSA external LSAs in the OSPFv3 link state database. Link Total number of link LSAs in the OSPFv3 link state database. Intra-area Prefix Total number of intra-area prefix LSAs in the OSPFv3 link state database. SecureStack C3 Configuration Guide 25-37...
Page 736: Show Ipv6 Ospf Interface
show ipv6 ospf interface Table 25-6 show ipv6 ospf database database-summary Output Details (Continued) Output Field What It Displays... Link Unknown Total number of link-source unknown LSAs in the OSPFv3 link state database. Area Unknown Total number of area unknown LSAs in the OSPFv3 link state database.
Page 737: Show Ipv6 Ospf Interface Command Output Details
LSA acknowledgement after receiving an LSA. Iftransit Delay Interval The number of seconds the interface adds to the age of LSA packets before transmission. Authentication Type The type of authentication the interface performs on LSAs it receives. SecureStack C3 Configuration Guide 25-39...
Page 738: Show Ipv6 Ospf Interface Stats
show ipv6 ospf interface stats Table 25-7 show ipv6 ospf interface Command Output Details (Continued) Output Field What It Displays... Metric Cost The priority of the path. Low costs have a higher priority than high costs. OSPF MTU-ignore Whether to ignore MTU mismatches in database descriptor packets sent from neighboring routers.
Page 739: Show Ipv6 Ospf Interface Stats Output Details
Number of virtual link not found packets received. Area Mismatch Number of area mismatch packets received. Invalid Destination Address Number of invalid destination address packets received. No Neighbor at Source Address Number of no neighbor at source address packets received. SecureStack C3 Configuration Guide 25-41...
Page 740: Show Ipv6 Ospf Neighbor
show ipv6 ospf neighbor Table 25-8 show ipv6 ospf interface stats Output Details Output Field What It Displays... Invalid OSPF Packet Type Number of packets received with invalid packet type. Packet Type / Sent / Received Columns listing packet types and number of packets sent and received per type.
Page 741: Show Ipv6 Ospf Neighbor Output Details
Amount of time, in seconds, to wait before the router assumes the neighbor is unreachable. This example displays the output of this command when a neighbor is specified. C3(su)->router#show ipv6 ospf neighbor 8.8.8.8 Interface Vlan 45 Area Id 0.0.0.30 Options Router Priority Dead timer due in (secs) State Full/DR Events Retransmission Queue Length Table 25‐10 provides an explanation of the command output. SecureStack C3 Configuration Guide 25-43...
Page 742: Show Ipv6 Ospf Range
show ipv6 ospf range Table 25-10 show ipv6 ospf neighbor routerid Output Details Output Field What It Displays... Interface Interface of the local router. Area ID OSPFv3 area ID associated with the interface. Options An integer value that indicates the optional OSPFv3 capabilities supported by the neighbor.
Page 743: Show Ipv6 Ospf Stub Table
The OSPFv3 cost for a route is a function of the metric value. Import Summary LSA Controls the import of summary LSAs into stub areas. SecureStack C3 Configuration Guide 25-45...
Page 744: Show Ipv6 Ospf Virtual-Link
show ipv6 ospf virtual-link show ipv6 ospf virtual-link This command displays the OSPFv3 virtual interface information for a specific area and neighbor. Syntax show ipv6 ospf virtual-link areaid neighborid Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. neighborid Specifies the neighbor by its router ID, specified in 32‐bit dotted quad format. Defaults None. Mode Router privileged execution: C3(su)‐>router# Example This information displays virtual link information for area ID 10 and the neighbor with router ID of 3.3.3.3. C3(su)->router(Config)#show ipv6 ospf virtual-link 10 3.3.3.3 Area ID Neighbor IP Address 3.3.3.3 Hello Interval Dead Interval...
Page 745 Table 25-13 show ipv6 ospf virtual-link Output Details (Continued) Output Field What It Displays... Metric The metric of this virtual link. Neighbor State The state of the neighbor. States are: down, loopback, waiting, point-to-point, designated router, and backup designated router. SecureStack C3 Configuration Guide 25-47...
Page 746 show ipv6 ospf virtual-link 25-48 OSPFv3 Configuration...
Page 747: Chapter 26: Authentication And Authorization Configuration
Configuring Secure Shell (SSH) 26-80 Configuring Access Lists 26-82 Note: An Enterasys Networks Feature Guide document containing an in-depth discussion of authentication and authorization configuration is located on the Enterasys Networks web site: http://www.enterasys.com/support/manuals/ Overview of Authentication and Authorization Methods The following methods are available for controlling which users are allowed to access, monitor, ...
Page 748 Overview of Authentication and Authorization Methods TACACS+ application. When RADIUS or TACACS+ is enabled, this essentially overrides login user accounts. When HACA is active per a valid RADIUS or TACACS+ configuration, the user names and passwords used to access the switch via Telnet, SSH, WebView, and COM ports will be validated against the configured RADIUS server. Only in the case of a RADIUS timeout will those credentials be compared against credentials locally configured on the switch. For details, refer to “Configuring RADIUS” on page 26‐6. • SNMP user or community names – allows access to the SecureStack C3 switch via a network SNMP management application. To access the switch, you must enter an SNMP user or community name string. The level of management access is dependent on the associated access policy. For details, refer to Chapter • 802.1X Port Based Network Access Control using EAPOL (Extensible Authentication Protocol) – provides a mechanism via a RADIUS server for administrators to securely authenticate and grant appropriate access to end user devices communicating with SecureStack C3 ports. For details on using CLI commands to configure 802.1X, refer to “Configuring 802.1X Authentication” on page 26‐15. Note: To configure EAP pass-through, which allows client authentication packets to be forwarded through the switch to an upstream device, 802.1X authentication must be globally disabled with the set dot1x command.
Page 749: Radius Filter-Id Attribute And Dynamic Policy Profile Assignment
RADIUS Filter-ID Attribute and Dynamic Policy Profile Assignment If you configure an authentication method that requires communication with a RADIUS server, you can use the RADIUS Filter‐ID attribute to dynamically assign a policy profile and/or management level to authenticating users and/or devices. The RADIUS Filter‐ID attribute is simply a string that is formatted in the RADIUS Access‐Accept packet sent back from the RADIUS server to the switch during the authentication process. Each user can be configured in the RADIUS server database with a RADIUS Filter‐ID attribute that specifies the name of the policy profile and/or management level the user should be assigned upon successful authentication. During the authentication process, when the RADIUS server returns a RADIUS Access‐Accept message that includes a Filter‐ID matching a policy profile name configured on the switch, the switch then dynamically applies the policy profile to the physical port the user/device is authenticating on. Filter-ID Attribute Formats Enterasys Networkssupports two Filter‐ID formats — “decorated” and “undecorated.” The decorated format has three forms: • To specify the policy profile to assign to the authenticating user (network access authentication): Enterasys:version=1:policy=string where string specifies the policy profile name. Policy profile names are case‐sensitive. • To specify a management level (management access authentication): Enterasys:version=1:mgmt=level where level indicates the management level, either ro, rw, or su. • To specify both management level and policy profile: Enterasys:version=1:mgmt=level:policy=string SecureStack C3 Configuration Guide 26-3...
Page 750: Setting The Authentication Login Method
Setting the Authentication Login Method The undecorated format is simply a string that specifies a policy profile name. The undecorated format cannot be used for management access authentication. Decorated Filter‐IDs are processed first by the switch. If no decorated Filter‐IDs are found, then undecorated Filter‐IDs are processed. If multiple Filter‐IDs are found that contain conflicting values, a Syslog message is generated. Setting the Authentication Login Method Purpose To configure the authentication login method to be used for management. Commands The commands used to configure the authentication login method are listed below. For information about... Refer to page... show authentication login 26-4 set authentication login 26-4 clear authentication login 26-5 show authentication login Use this command to display the current authentication login method for management.
Page 751: Clear Authentication Login
Specifies that the local network password settings will be used for authentication login. radius Specifies that RADIUS will be used for authentication login. tacacs Specifies that TACACS+ will be used for authentication login. Defaults None. Mode Switch command, Read‐Write. Example This example shows how to set the authentication login method to use the local password settings: C3(rw)->set authentication login local clear authentication login Use this command to reset the authentication login method to the default setting of “any”. Syntax clear authentication login Parameters None. Defaults None. Mode Switch command, Read‐Write. Example This example shows how to reset the authentication login method. C3(rw)->clear authentication login SecureStack C3 Configuration Guide 26-5...
Page 752: Configuring Radius
Configuring RADIUS Configuring RADIUS Purpose To perform the following: • Review the RADIUS client/server configuration on the switch. • Enable or disable the RADIUS client. • Set local and remote login options. • Set primary and secondary server parameters, including IP address, timeout period, authentication realm, and number of user login attempts allowed. • Reset RADIUS server settings to default values. • Configure a RADIUS accounting server. • Configure the interface used for the source IP address of the RADIUS application when generating RADIUS packets. Commands For information about... Refer to page... show radius 26-6 set radius 26-7 clear radius 26-9 show radius accounting 26-10 set radius accounting 26-10...
Page 753: Set Radius
Use this command to enable, disable, or configure RADIUS authentication. Syntax set radius {enable | disable} | {retries number-of-retries} | {timeout timeout} | {server index ip-address port [secret-value] [realm {management-access | any | network-access}} | {realm {management-access | any | network-access} {index| all}} SecureStack C3 Configuration Guide 26-7...
Page 754 set radius Parameters enable | disable Enables or disables the RADIUS client. retries number‐of‐ Specifies the number of retry attempts before the RADIUS server times out. retries Valid values are from 0 to 10. Default is 3. timeout timeout Specifies the maximum amount of time (in seconds) to establish contact with the RADIUS server before retry attempts begin. Valid values are from 1 to 30. Default is 20 seconds. server index Specifies the index number, IP address and the UDP authentication port for ip_address port the RADIUS server. secret‐value (Optional) Specifies an encryption key to be used for authentication between the RADIUS client and server. realm Realm allows you to define who has to go through the RADIUS server for management‐ authentication. access | any | • management‐access: This means that anyone trying to access the switch network‐access (Telnet, SSH, Local Management) has to authenticate through the RADIUS server. • network‐access: This means that all the users have to authenticate to a RADIUS server before they are allowed access to the network. • any: Means that both management‐access and network‐access have been enabled. Note: If the management-access or any access realm has been configured, the local “admin”...
Page 755: Clear Radius
[retries] | [timeout] | [server {index | all | realm {index | all}}] Parameters retries Resets the maximum number of attempts a user can contact the RADIUS server before timing out to 3. timeout Resets the maximum amount of time to establish contact with the RADIUS server before timing out to 20 seconds. server Deletes server settings. index | all For use with the server parameter to clear the server configuration for all servers or a specific RADIUS server as defined by an index. realm Resets the realm setting for all servers or a specific RADIUS server as defined by an index. Mode Switch command, read‐write. Defaults None. Examples This example shows how to clear all settings on all RADIUS servers: C3(su)->clear radius server all This example shows how to reset the RADIUS timeout to the default value of 20 seconds: C3(su)->clear radius timeout SecureStack C3 Configuration Guide 26-9...
Page 756: Show Radius Accounting
show radius accounting show radius accounting Use this command to display the RADIUS accounting configuration. This transmits accounting information between a network access server and a shared accounting server. Syntax show radius accounting [server] | [counter ip-address] | [retries] | [timeout] Parameters server (Optional) Displays one or all RADIUS accounting server configurations. counter ip‐address (Optional) Displays counters for a RADIUS accounting server. retries (Optional) Displays the maximum number of attempts to contact the RADIUS accounting server before timing out. timeout (Optional) Displays the maximum amount of time before timing out. Mode Switch command, read‐only. Defaults If no parameters are specified, all RADIUS accounting configuration information will be displayed. Example This example shows how to display RADIUS accounting configuration information. In this case, RADIUS accounting is not currently enabled and global default settings have not been changed. One server has been configured. For details on enabling and configuring RADIUS accounting, refer to “set radius accounting” on page 26‐10: C3(ro)->show radius accounting RADIUS accounting status:...
Page 757: Clear Radius Accounting
C3(su)->set radius accounting timeout 30 This example shows how to set RADIUS accounting retries to 10: C3(su)->set radius accounting retries 10 clear radius accounting Use this command to clear RADIUS accounting configuration settings. Syntax clear radius accounting {server ip-address | retries | timeout | counter} Parameters server ip‐address Clears the configuration on one or more accounting servers. retries Resets the retries to the default value of 3. timeout Resets the timeout to 5 seconds. counter Clears counters. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 26-11...
Page 758: Show Radius Interface
show radius interface Defaults None. Example This example shows how to reset the RADIUS accounting timeout to 5 seconds. C3(su)->clear radius accounting timeout show radius interface Use this command to display the interface used for the source IP address of the RADIUS application when generating RADIUS packets. Syntax show radius interface Parameters None. Defaults None. Mode Switch mode, read‐only. Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the RADIUS application. C3(rw)->show radius interface loopback 1 192.168.10.1 set radius interface Use this command to specify the interface used for the source IP address of the RADIUS application when generating RADIUS packets. Syntax set radius interface {loopback loop-ID | vlan vlan-ID} Parameters...
Page 759: Clear Radius Interface
C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0 C3(rw)->router(Config-if(Vlan 100))#exit C3(rw)->router(Config)#exit C3(rw)->router#exit C3(rw)->router>exit C3(rw)->set radius interface vlan 100 C3(rw)->show radius interface vlan 100 192.168.10.1 clear radius interface Use this command to clear the interface used for the source IP address of the RADIUS application back to the default of the Host interface, if configured. If no Host address is configured, the source IP address will be the address of the routed interface on which the packet egresses. Syntax clear radius interface Parameters None. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 26-13...
Page 760 clear radius interface Example This command returns the interface used for the source IP address of the RADIUS application back to the default of the Host interface. C3(rw)->show radius interface vlan 100 192.168.10.1 C3(rw)->clear radius interface C3(rw)-> 26-14 Authentication and Authorization Configuration...
Page 761: Configuring 802.1X Authentication
26-23 clear eapol 26-23 show dot1x Use this command to display 802.1X status, diagnostics, statistics, and reauthentication or initialization control information for one or more ports. Syntax show dot1x [auth-diag] [auth-stats] [port [init | reauth]] [port-string] Parameters auth‐diag (Optional) Displays authentication diagnostics information. auth‐stats (Optional) Displays authentication statistics. port init | reauth (Optional) Displays the status of port initialization and reauthentication control for the port. port‐string (Optional) Displays information for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If no parameters are specified, 802.1X status will be displayed. SecureStack C3 Configuration Guide 26-15...
Page 762 show dot1x If port‐string is not specified, information for all ports will be displayed. Mode Switch command, read‐only. Examples This example shows how to display 802.1X status: C3(su)->show dot1x DOT1X is disabled. This example shows how to display authentication diagnostics information for ge.1.1: C3(su)->show dot1x auth-diag .1.1 Port : 1 Auth-Diag Enter Connecting: EAP Logoffs While Connecting: Enter Authenticating: Success While Authenticating Timeouts While Authenticating: Fails While Authenticating: ReAuths While Authenticating: EAP Starts While Authenticating: EAP logoff While Authenticating: Backend Responses:...
Page 763: Show Dot1X Auth-Config
If port‐string is not specified, information for all ports will be displayed. Mode Switch command, read‐only. Examples This example shows how to display the EAPOL port control mode for .1.1: C3(su)->show dot1x auth-config authcontrolled-portcontrol ge.1.1 Port 1: Auth controlled port control: Auto This example shows how to display the 802.1X quiet period settings for .1.1: C3(su)->show dot1x auth-config quietperiod ge.1.1 Port 1: Quiet period: This example shows how to display all 802.1X authentication configuration settings for .1.1: C3(ro)->show dot1x auth-config ge.1.1 SecureStack C3 Configuration Guide 26-17...
Page 764: Set Dot1X
set dot1x Port : 1 Auth-Config PAE state: Initialize Backend auth state: Initialize Admin controlled directions: Both Oper controlled directions: Both Auth controlled port status: Authorized Auth controlled port control: Auto Quiet period: Transmission period: Supplicant timeout: Server timeout: Maximum requests: Reauthentication period: 3600 Reauthentication control:...
Page 765: Set Dot1X Auth-Config
Default value is 2. quietperiod value Specifies the time (in seconds) following a failed authentication before another attempt can be made by the authenticator PAE state machine. Valid values are 0 – 65535. Default value is 60 seconds. reauthenabled false | Enables (true) or disables (false) reauthentication control of the true reauthentication timer state machine. Default value is false. reauthperiod value Specifies the time lapse (in seconds) between attempts by the reauthentication timer state machine to reauthenticate a port. Valid values are 0 – 65535. Default value is 3600 seconds. servertimeout timeout Specifies a timeout period (in seconds) for the authentication server, used by the backend authentication state machine. Valid values are 1 – 300. Default value is 30 seconds. supptimeout timeout Specifies a timeout period (in seconds) for the authentication supplicant used by the backend authentication state machine. Valid values are 1 – 300. Default value is 30 seconds. txperiod value Specifies the period (in seconds) which passes between authenticator PAE state machine EAP transmissions. Valid values are 0 – 65535. Default value is 30 seconds. port‐string (Optional) Limits the configuration of desired settings to specified port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, authentication parameters will be set on all ports. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 26-19...
Page 766: Clear Dot1X Auth-Config
clear dot1x auth-config Examples This example shows how to enable reauthentication control on ports .1.1‐3: C3(su)->set dot1x auth-config reauthenabled true ge.1.1-3 This example shows how to set the 802.1X quiet period to 120 seconds on ports .1.1‐3: C3(su)->set dot1x auth-config quietperiod 120 ge.1.1-3 clear dot1x auth-config Use this command to reset 802.1X authentication parameters to default values on one or more ports. Syntax clear dot1x auth-config [authcontrolled-portcontrol] [maxreq] [quietperiod] [reauthenabled] [reauthperiod] [servertimeout] [supptimeout] [txperiod] [port- string] Parameters authcontrolled‐...
Page 767: Show Eapol
Defaults If port‐string is not specified, only EAPOL enable status will be displayed. Mode Switch command, read‐only. Example This example shows how to display EAPOL status for ports .1.1‐3: C3(su)->show eapol ge.1.1-3 EAPOL is disabled. Port Authentication State Authentication Mode -------- -------------------- -------------------- ge.1.1 Initialize Auto ge.1.2 Initialize Auto ge.1.3 Initialize Auto Table 26‐2 provides an explanation of the command output. For details on using the set eapol command to enable the protocol and assign an authentication mode, refer to “set eapol” on page 26‐23. SecureStack C3 Configuration Guide 26-21...
Page 768: Show Eapol Output Details
show eapol Table 26-2 show eapol Output Details Output Field What It Displays... Port Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 7-1. Authentication State Current EAPOL authentication state for each port. Possible internal states for the authenticator (switch) are: •...
Page 769: Set Eapol
• forced‐unauth ‐ Forced unauthorized mode, which filters and discards all frames received on the port. port‐string Specifies the port(s) on which to set EAPOL parameters. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Examples This example shows how to enable EAPOL: C3(su)->set eapol enable This example shows how to enable EAPOL with forced authorized mode on port .1.1: C3(su)->set eapol auth-mode forced-auth ge.1.1 clear eapol Use this command to globally clear the EAPOL authentication mode, or to clear settings for one or more ports. Syntax clear eapol [auth-mode] [port-string] SecureStack C3 Configuration Guide 26-23...
Page 770 clear eapol Parameters auth‐mode (Optional) Globally clears the EAPOL authentication mode. port‐string Specifies the port(s) on which to clear EAPOL parameters. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If auth‐mode is not specified, all EAPOL settings will be cleared. If port‐string is not specified, settings will be cleared for all ports. Mode Switch command, read‐write. Example This example shows how to clear the EAPOL authentication mode for port .1.3: C3(su)->clear eapol auth-mode ge.1.3 26-24 Authentication and Authorization Configuration...
Page 771: Configuring Mac Authentication
26-32 set macauthentication portreauthenticate 26-32 set macauthentication macreauthenticate 26-33 set macauthentication reauthperiod 26-33 clear macauthentication reauthperiod 26-34 set macauthentication significant-bits 26-35 clear macauthentication significant-bits 26-35 show macauthentication Use this command to display MAC authentication information for one or more ports. Syntax show macauthentication [port-string] SecureStack C3 Configuration Guide 26-25...
Page 772: Show Macauthentication Output Details
show macauthentication Parameters port‐string (Optional) Displays MAC authentication information for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, MAC authentication information will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display MAC authentication information for .2.1 through 8: C3(su)->show macauthentication ge.2.1-8 MAC authentication: - enabled MAC user password: - NOPASSWORD Port username significant bits - 48 Port Port Reauth Auth Auth Reauthentications State Period Allowed Allocated...
Page 773: Show Macauthentication Session
Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 7-1. MAC Address MAC address associated with the session. Duration Time this session has been active. SecureStack C3 Configuration Guide 26-27...
Page 774: Set Macauthentication
set macauthentication Table 26-4 show macauthentication session Output Details (Continued) Output Field What It Displays... Reauth Period Reauthentication period for this port, set using the set macauthentication reauthperiod command described in “set macauthentication reauthperiod” on page 26-33. Reauthentications Whether or not reauthentication is enabled or disabled on this port. Set using the set macauthentication reauthentication command described in “set macauthentication...
Page 775: Clear Macauthentication Password
Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the MAC authentication password: C3(su)->clear macauthentication password set macauthentication port Use this command to enable or disable one or more ports for MAC authentication. Syntax set macauthentication port {enable | disable} port-string Parameters enable | disable Enables or disables MAC authentication. port‐string Specifies port(s) on which to enable or disable MAC authentication. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 26-29...
Page 776: Set Macauthentication Portinitialize
set macauthentication portinitialize Usage Enabling port(s) for MAC authentication requires globally enabling MAC authentication on the switch as described in “set macauthentication” on page 26‐28, and then enabling it on a port‐by‐ port basis. By default, MAC authentication is globally disabled and disabled on all ports. Example This example shows how to enable MAC authentication on .2.1 though 5: C3(su)->set macauthentication port enable ge.2.1-5 set macauthentication portinitialize Use this command to force one or more MAC authentication ports to re‐initialize and remove any currently active sessions on those ports. Syntax set macauthentication portinitialize port-string Parameters port‐string Specifies the MAC authentication port(s) to re‐initialize. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to force .2.1 through 5 to initialize: C3(su)->set macauthentication portinitialize ge.2.1-5 set macauthentication portquietperiod This sets the number of seconds following a failed authentication before another attempt may be ...
Page 777: Clear Macauthentication Portquietperiod
This sets the quiet period back to the default value of 30 seconds. Syntax clear macauthentication portquietperiod [port-string] Parameters port‐string (Optional) Specifies the ports for which the quiet period is to be reset. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If a port‐string is not specified then all ports will be set to the default port quiet period. Mode Switch command, read‐write. Example This example resets the default quiet period on port 1: C3(su)->clear macauthentication portquietperiod ge.1.1 set macauthentication macinitialize Use this command to force a current MAC authentication session to re‐initialize and remove the session. Syntax set macauthentication macinitialize mac-addr Parameters mac‐addr Specifies the MAC address of the session to re‐initialize. SecureStack C3 Configuration Guide 26-31...
Page 778: Set Macauthentication Reauthentication
set macauthentication reauthentication Mode Switch command, read‐write. Defaults None. Example This example shows how to force the MAC authentication session for address 00‐60‐97‐b5‐4c‐07 to re‐initialize: C3(su)->set macauthentication macinitialize 00-60-97-b5-4c-07 set macauthentication reauthentication Use this command to enable or disable reauthentication of all currently authenticated MAC addresses on one or more ports. Syntax set macauthentication reauthentication {enable | disable} port-string Parameters enable | disable Enables or disables MAC reauthentication. port‐string Specifies port(s) on which to enable or disable MAC reauthentication. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to enable MAC reauthentication on ...
Page 779: Set Macauthentication Macreauthenticate
C3(su)->set macauthentication portreauthentication ge.2.1-5 set macauthentication macreauthenticate Use this command to force an immediate reauthentication of a MAC address. Syntax set macauthentication macreauthenticate mac-addr Parameters mac‐addr Specifies the MAC address of the session to reauthenticate. Defaults None. Mode Switch command, read‐write. Example This example shows how to force the MAC authentication session for address 00‐60‐97‐b5‐4c‐07 to reauthenticate: C3(su)->set macauthentication macreauthenticate 00-60-97-b5-4c-07 set macauthentication reauthperiod Use this command to set the MAC reauthentication period (in seconds). This is the time lapse between attempts to reauthenticate any current MAC address authenticated to a port. Syntax set macauthentication reauthperiod time port-string SecureStack C3 Configuration Guide 26-33...
Page 780: Clear Macauthentication Reauthperiod
clear macauthentication reauthperiod Parameters time Specifies the number of seconds between reauthentication attempts. Valid values are 1 ‐ 4294967295. port‐string Specifies the port(s) on which to set the MAC reauthentication period. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Usage Changing the Reauth Period with the set macauthentication reauthperiod command does not affect current sessions. New sessions will use the correct period. Example This example shows how to set the MAC reauthentication period to 7200 seconds (2 hours) on .2.1 through 5: C3(su)->set macauthentication reauthperiod 7200 ge.2.1-5 clear macauthentication reauthperiod Use this command to clear the MAC reauthentication period on one or more ports. Syntax clear macauthentication reauthperiod [port-string] Parameters port‐string (Optional) Clears the MAC reauthentication period on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. ...
Page 781: Set Macauthentication Significant-Bits
Defaults None. Mode Switch command, read‐write. Usage This command allows you to specify a mask to apply to MAC addresses when authenticating users through a RADIUS server. The most common use of significant bit masks is for authentication of all MAC addresses for a specific vendor. On switches using MAC authentication, the MAC address of a user attempting to log in is sent to the RADIUS server as the user name. If access is denied, and if a significant bit mask has been configured (other than 48) with this command, the switch will apply the mask and resend the masked address to the RADIUS server. For example, if a user with MAC address of 00‐16‐CF‐12‐ 34‐56 is denied access, and a 32 bit mask has been configured, the switch will apply the mask and resend a MAC address of 00‐16‐CF‐12‐00‐00 to the RADIUS server. To use a significant bits mask for authentication of devices by a particular vendor, specify a 24‐bit mask, to mask out everything except the vendor portion of the MAC address. Example This example sets the MAC authentication significant bits mask to 24. C3(su)->set macauthentication significant-bits 24 clear macauthentication significant-bits Use this command to reset the number of significant bits of the MAC address to use for authentication to the default of 48. Syntax clear macauthentication significant-bits Parameters None. Defaults None. SecureStack C3 Configuration Guide 26-35...
Page 782 clear macauthentication significant-bits Mode Switch command, read‐write. Example This example resets the MAC authentication significant bits to 48. C3(su)->clear macauthentication significant-bits 26-36 Authentication and Authorization Configuration...
Page 783: Configuring Multiple Authentication Methods
Commands For information about... Refer to page... show multiauth 26-38 set multiauth mode 26-39 clear multiauth mode 26-39 set multiauth precedence 26-40 clear multiauth precedence 26-40 show multiauth port 26-41 set multiauth port 26-41 SecureStack C3 Configuration Guide 26-37...
Page 784: Show Multiauth
show multiauth For information about... Refer to page... clear multiauth port 26-42 show multiauth station 26-43 show multiauth session 26-43 show multiauth idle-timeout 26-44 set multiauth idle-timeout 26-45 clear multiauth idle-timeout 26-46 show multiauth session-timeout 26-46 set multiauth session-timeout 26-47 clear multiauth session-timeout 26-48 show multiauth...
Page 785: Set Multiauth Mode
User must authenticate using 802.1x authentication before normal traffic (anything other than authentication traffic) can be forwarded. Defaults None. Mode Switch command, read‐write. Usage Multiauth multi mode requires that MAC, PWA, and 802.1X authentication be enabled globally, and configured appropriately on the desired ports according to their corresponding command sets described in this chapter. Refer to “Configuring 802.1X Authentication” on page 26‐15 and “Configuring MAC Authentication” on page 26‐25 and “Configuring Port Web Authentication (PWA)” on page 26‐68. Example This example shows how to enable simultaneous multiple authentications: C3(rw)->set multiauth mode multi clear multiauth mode Use this command to clear the system authentication mode. Syntax clear multiauth mode Parameters None. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 26-39...
Page 786: Set Multiauth Precedence
set multiauth precedence Example This example shows how to clear the system authentication mode: C3(rw)->clear multiauth mode set multiauth precedence Use this command to set the system’s multiple authentication administrative precedence. Syntax set multiauth precedence {[dot1x] [mac] [pwa]} Parameters dot1x Sets precedence for 802.1X authentication. Sets precedence for MAC authentication. Sets precedence for port web authentication Defaults Default precedence order is dot1x, pwa, mac. Mode Switch command, read‐write. Usage When a user is successfully authenticated by more than one method at the same time, the precedence of the authentication methods will determine which RADIUS‐returned filter ID will be processed and result in an applied traffic policy profile. Example This example shows how to set precedence for MAC authentication: C3(rw)->set multiauth precedence mac dot1x clear multiauth precedence Use this command to clear the system’s multiple authentication administrative precedence to the ...
Page 787: Show Multiauth Port
------------ ------------ ---------- ---------- ---------- ge.3.1 auth-opt ge.3.2 auth-opt ge.3.3 auth-opt ge.3.4 auth-opt set multiauth port Use this command to set multiple authentication properties for one or more ports. Syntax set multiauth port mode {auth-opt | auth-reqd | force-auth | force-unauth} | numusers numusers port-string SecureStack C3 Configuration Guide 26-41...
Page 788: Clear Multiauth Port
clear multiauth port Parameters mode Specifies the port(s)’ multiple authentication mode as: auth‐opt | • auth‐opt — Authentication optional (“non‐strict” behavior). If a user auth‐reqd | does not attempt to authenticate using 802.1x, or if 802.1x force‐auth | authentication fails, the port will allow traffic to be forwarded force‐unauth according to the defined default VLAN. • auth‐reqd — Authentication is required. • force‐auth — Authentication considered. • force‐unauth — Authentication disabled. numusers Specifies the number of users allowed authentication on port(s). Valid numusers values depend on your specific platform. Refer to Appendix A, Policy and Authentication Capacities for information about multi‐user capacities. port‐string Specifies the port(s) on which to set multiple authentication properties. Defaults Default value for the number of users allowed to authenticate on a port is 1. Mode Switch command, read‐write. Examples This example shows how to set the port multiple authentication mode to required on .3.14: C3(rw)->set multiauth port mode auth-reqd ge.3.14 This example shows how to set the number of users allowed to authenticate on port ...
Page 789: Show Multiauth Station
This example shows how to display multiple authentication station entries. In this case, two end user MAC addresses are shown: C3(rw)->show multiauth station Port Address type Address ------------ ------------ ------------------------ ge.1.20 00-10-a4-9e-24-87 ge.2.16 00-b0-d0-e5-0c-d0 show multiauth session Use this command to display multiple authentication session entries. Syntax show multiauth session [all] [agent {dot1x | mac | pwa}] [mac address] [port port-string] SecureStack C3 Configuration Guide 26-43...
Page 790: Show Multiauth Idle-Timeout
show multiauth idle-timeout Parameters (Optional) Displays information about all sessions, including those with terminated status. agent dot1x | mac | (Optional) Displays 802.1X, or MAC, or port web authentication session information. mac address (Optional) Displays multiple authentication session entries for specific MAC address(es). port port‐string (Optional) Displays multiple authentication session entries for the specified port or ports. Defaults If no options are specified, multiple authentication session entries will be displayed for all sessions, authentication types, MAC addresses, and ports. Mode Switch command, read‐only. Example This example shows how to display multiple authentication session information for port .1.1. C3(su)->show multiauth session port ge.1.1 __________________________________________ Port | ge.1.1 Station address | 00-01-03-86-0A-87 Auth status | success Last attempt | FRI MAY 18 11:16:36 2007 Agent type...
Page 791: Set Multiauth Idle-Timeout
[dot1x | mac | pwa] timeout Parameters dot1x (Optional) Specifies the IEEE 802.1X port‐based network access control authentication method for which to set the timeout value. (Optional) Specifies the Enterasys MAC authentication method for which to set the timeout value. (Optional) Specifies the Enterasys Port Web Authentication method for which to set the timeout value. timeout Specifies the timeout value in seconds. The value can range from 0 to 65535. A value of 0 means that no idle timeout will be applied unless an idle timeout value is provided by the authenticating server. Defaults If no authentication method is specified, the idle timeout value is set for all authentication methods. Mode Switch mode, read‐write. Usage If you set an idle timeout value, a MAC user whose MAC address has aged out of the forwarding database will be unauthenticated if no traffic has been seen from that address for the specified idle timeout period. A value of zero indicates that no idle timeout will be applied unless an idle timeout value is provided by the authenticating server. For example, if a session is authenticated by a RADIUS server, that server may encode a Idle‐Timeout Attribute in its authentication response. Example This example sets the idle timeout value for all authentication methods to 300 seconds. C3(su)->set multiauth idle-timeout 300 SecureStack C3 Configuration Guide 26-45...
Page 792: Clear Multiauth Idle-Timeout
clear multiauth idle-timeout clear multiauth idle-timeout Use this command to reset the maximum number of consecutive seconds an authenticated session may be idle before termination of the session to its default value of 0. Syntax clear multiauth idle-timeout [dot1x | mac | pwa] Parameters dot1x (Optional) Specifies the IEEE 802.1X port‐based network access control authentication method for which to reset the timeout value to its default. (Optional) Specifies the Enterasys MAC authentication method for which to reset the timeout value to its default. (Optional) Specifies the Enterasys Port Web Authentication method for which to reset the timeout value to its default. Defaults If no authentication method is specified, the idle timeout value is reset to its default value of 0 for all authentication methods. Mode Switch mode, read‐write. Example This example resets the idle timeout value for all authentication methods to 0 seconds. C3(su)->clear multiauth idle-timeout show multiauth session-timeout Use this command to display the session timeout value, in seconds, for all authentication methods. Syntax show multiauth session-timeout Parameters...
Page 793: Set Multiauth Session-Timeout
[dot1x | mac | pwa] timeout Parameters dot1x (Optional) Specifies the IEEE 802.1X port‐based network access control authentication method for which to set the session timeout value. (Optional) Specifies the Enterasys MAC authentication method for which to set the session timeout value. (Optional) Specifies the Enterasys Port Web Authentication method for which to set the session timeout value. timeout Specifies the timeout value in seconds. The value can range from 0 to 65535. A value of 0 means that no session timeout will be applied unless a session timeout value is provided by the authenticating server. Defaults If no authentication method is specified, the session timeout value is set for all authentication methods. Mode Switch mode, read‐write. Usage A value of zero may be superseded by a session timeout value provided by the authenticating server. For example, if a session is authenticated by a RADIUS server, that server may encode a Session‐Timeout Attribute in its authentication response. Example This example sets the session timeout value for the IEEE 802.1X authentication method to 300 seconds. C3(su)->set multiauth session-timeout dot1x 300 SecureStack C3 Configuration Guide 26-47...
Page 794: Clear Multiauth Session-Timeout
clear multiauth session-timeout clear multiauth session-timeout Use this command to reset the maximum number of consecutive seconds an authenticated session may last before termination of the session to its default value of 0. Syntax clear multiauth session-timeout [dot1x | mac | pwa] Parameters dot1x (Optional) Specifies the IEEE 802.1X port‐based network access control authentication method for which to reset the timeout value to its default. (Optional) Specifies the Enterasys MAC authentication method for which to reset the timeout value to its default. (Optional) Specifies the Enterasys Port Web Authentication method for which to reset the timeout value to its default. Defaults If no authentication method is specified, the session timeout value is reset to its default value of 0 for all authentication methods. Mode Switch mode, read‐write. Example This example resets the session timeout value for the IEEE 802.1X authentication method to 0 seconds. C3(su)->clear multiauth session-timeout dot1x Configuring User + IP Phone Authentication User + IP phone authentication is a legacy feature that allows a user and their IP phone to both use ...
Page 795: Configuring Vlan Authorization (Rfc 3580)
Note: A policy license, if applicable, is not required to deploy RFC 3580 dynamic VLAN assignment. Commands For information about... Refer to page... set vlanauthorization 26-50 set vlanauthorization egress 26-50 clear vlanauthorization 26-51 show vlanauthorization 26-51 SecureStack C3 Configuration Guide 26-49...
Page 796: Set Vlanauthorization
set vlanauthorization set vlanauthorization Enable or disable the use of the RADIUS VLAN tunnel attribute to put a port into a particular VLAN based on the result of authentication. Syntax set vlanauthorization {enable | disable} [port-string] Parameters enable | disable Enables or disables vlan authorization/tunnel attributes. port‐string (Optional) Specifies which ports to enable or disable the use of VLAN tunnel attributes/authorization. For a detailed description of possible port‐ string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults VLAN authentication is disabled by default. Mode Switch command, read‐write. Examples This example shows how to enable VLAN authentication for all Gigabit Ethernet ports: C3(rw)-> set vlanauthorization enable ge.*.* This example shows how to disable VLAN authentication for all Gigabit Ethernet ports on switch unit/module 3: C3(rw)-> set vlanauthorization disable ge.3.* set vlanauthorization egress Controls the modification of the current VLAN egress list of 802.1x authenticated ports for the ...
Page 797: Clear Vlanauthorization
C3(rw)->set vlanauthorization egress tagged ge.3.10-15 clear vlanauthorization Use this command to return port(s) to the default configuration of VLAN authorization disabled, egress untagged. Syntax clear vlanauthorization [port-string] Parameters port‐string (Optional) Specifies which ports are to be restored to default configuration. If no port string is entered, the action will be a global setting. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If no port string is entered, all ports a will be reset to default configuration with VLAN authorization disabled and egress frames untagged. Mode Switch command, read‐write. Example This example show how to clear VLAN authorization for all ports on slots 3, 4, and 5: C3(rw)->clear vlanauthorization ge.3-5.* show vlanauthorization Displays the VLAN authentication status and configuration information for the specified ports. Syntax show vlanauthorization [port-string] SecureStack C3 Configuration Guide 26-51...
Page 798: Configuring Policy Maptable Response
Configuring Policy Maptable Response Parameters port‐string (Optional) Displays VLAN authentication status for the specified ports. If no port string is entered, then the global status of the setting is displayed. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If no port string is entered, the status for all ports will be displayed. Mode Switch command, read‐only. Example This command shows how to display VLAN authorization status for ge.1.1: C3(su)->show vlanauthorization ge.1.1 Vlan Authorization: - enabled port status administrative operational authenticated vlan id egress egress mac address ------- -------- -------------- ----------- ----------------- ------- ge.1.1 enabled...
Page 799: Operational Description
When Policy Maptable Response is “Both” Hybrid authentication mode uses both Filter‐ID attributes and tunnel attributes. To enable hybrid authentication mode, use the set policy maptable command and set the response parameter to both. When configured to use both sets of attributes: • If both the Filter‐ID and tunnel attributes are present in the RADIUS reply, then the policy profile specified by the Filter‐ID is applied to the authenticating user, and if VLAN authorization is enabled globally and on the authenticating user’s port, the VLAN specified by the tunnel attributes is applied to the authenticating user. If VLAN authorization is not enabled, the VLAN specified by the policy profile is applied. See “Configuring VLAN Authorization (RFC 3580)” on page 26‐49 for information about enabling VLAN authorization globally and on specific ports. • If the Filter‐ID attributes are present but the tunnel attributes are not present, the policy profile specified by the Filter‐ID is applied, along with the VLAN specified by the policy profile. • If the tunnel attributes are present but the Filter‐ID attributes are not present or are invalid, and if VLAN authorization is enabled globally and on the authenticating user’s port, then the switch will check the VLAN‐to‐policy mapping table (configured with the set policy maptable command): – If an entry mapping the received VLAN ID to a valid policy profile is found, then that policy profile, along with the VLAN specified by the policy profile, will be applied to the authenticating user. – If no matching mapping table entry is found, the VLAN specified by the tunnel attributes will be applied to the authenticating user. – If the VLAN‐to‐policy mapping table is invalid, then the etsysPolicyRFC3580MapInvalidMapping MIB is incremented and the VLAN specified by the tunnel attributes will be applied to the authenticating user. SecureStack C3 Configuration Guide 26-53...
Page 800: Commands
show policy maptable If VLAN authorization is not enabled, the tunnel attributes are ignored. When Policy Maptable Response is “Policy” When the switch is configured to use only Filter‐ID attributes, by setting the set policy maptable command response parameter to policy: • If the Filter‐ID attributes are present, the specified policy profile will be applied to the authenticating user. If no Filter‐ID attributes are present, or if the policy ID is unknown or invalid, the default policy (if it exists) will be applied. • If the tunnel attributes are present, they are ignored. No VLAN‐to‐policy mapping will occur. On switches that support policy, the default maptable response mode is policy. On switches that do not support policy, the default maptable response mode is tunnel. When Policy Maptable Response is “Tunnel” When the switch is configured to use only tunnel attributes, by setting the set policy maptable command response parameter to tunnel, and if VLAN authorization is enabled both globally and on the authenticating user’s port: • If the tunnel attributes are present, the specified VLAN will be applied to the authenticating user. No VLAN‐to‐policy mapping will occur. • If the tunnel attributes are not present, the default policy VLAN will be applied if it exists. Otherwise, the port VLAN will be applied. • If the Filter‐ID attributes are present, they are ignored. If VLAN authorization is not enabled, the user will be allowed onto the port with the default policy, if it exists. If no default policy exists, the port VLAN will be applied. On switches that support policy, the default maptable response mode is policy. On switches that do not support policy, the default maptable response mode is tunnel.
Page 801: Set Policy Maptable
Syntax set policy maptable {vlan-list policy-index | response {both | policy | tunnel}} Parameters vlan‐list policy‐index Specifies an entry in the VLAN‐to‐policy mapping table, which relates a policy profile with a VLAN ID or range of IDs. vlan‐list can range from 1 to 4093. policy‐index can range from 1 to 1023. response Indicates that this command is configuring the policy maptable response. both Sets the maptable response to look at both the Filter‐ID and tunnel attributes in a RADIUS Access‐Accept reply to determine how to handle an authenticating user. This is equivalent to enabling hybrid authentication mode. policy Sets the maptable response to policy mode. The system will look at only the Filter‐ID attributes in a RADIUS Access‐Accept reply to determine how to handle an authenticating user. tunnel Sets the maptable response to tunnel mode. The system will look at only the tunnel attributes in a RADIUS Access‐Accept reply to determine how to handle an authenticating user. SecureStack C3 Configuration Guide 26-55...
Page 802: Clear Policy Maptable
clear policy maptable Defaults No mapping table entries are configured. The default policy maptable response setting is policy mode. Mode Switch command, read‐write. Usage This command can be used to create entries in the VLAN‐to‐policy mapping table and also to set the switch’s maptable response. Refer to “Operational Description” on page 26‐53 for more information about the switch’s operations for all maptable response parameters. When you are using VLAN authorization for dynamic VLAN assignment, you should set the policy maptable response to tunnel. See “Configuring VLAN Authorization (RFC 3580)” on page 26‐49. Examples This example shows how to set the policy maptable response to both, or hybrid authentication mode: C3(rw)->set policy maptable response both This example shows how to configure a policy mapping entry that will map VLAN 144 to policy profile 4. C3(rw)->set policy maptable 144 4 clear policy maptable Use this command to clear a VLAN‐to‐policy mapping table entry or to reset the maptable response to the default value of policy mode. Syntax clear policy maptable {vlan-list | response} Parameters vlan‐list Clears the policy profile mapping for the specified VLAN ID or range of ...
Page 803: Configuring Mac Locking
1 days 17:24:01 VLAN ID Policy Profile (Faculty) Configuring MAC Locking This feature locks a MAC address to one or more ports, preventing connection of unauthorized devices through the port(s). When source MAC addresses are received on specified ports, the switch discards all subsequent frames not containing the configured source addresses. The only frames forwarded on a “locked” port are those with the “locked” MAC address(es) for that port. There are two methods of locking a MAC to a port: first arrival and static. The first arrival method is defined to be locking the first n number of MACs which arrive on a port configured with MAC locking enabled. The value n is configured with the set maclock firstarrival command. The static method is defined to be statically provisioning a MAC‐port lock using the set maclock command. The maximum number of static MAC addresses allowed for MAC locking on a port can be configured with the set maclock static command. You can configure the switch to issue a violation trap if a packet arrives with a source MAC address different from any of the currently locked MAC addresses for that port. MACs are unlocked as a result of: • A link down event • When MAC locking is disabled on a port • When a MAC is aged out of the forwarding database when FirstArrival aging is enabled When properly configured, MAC locking is an excellent security tool as it prevents MAC spoofing on configured ports. Also if a MAC were to be secured by something like Dragon Dynamic Intrusion Detection, MAC locking would make it more difficult for a hacker to send packets into the network because the hacker would have to change their MAC address and move to another port. In the meantime the system administrator would be receiving a maclock trap notification. Purpose To review, disable, enable, and configure MAC locking. SecureStack C3 Configuration Guide 26-57...
Page 804: Commands
show maclock Commands For information about... Refer to page... show maclock 26-58 show maclock stations 26-59 set maclock enable 26-60 set maclock disable 26-61 set maclock 26-61 clear maclock 26-62 set maclock static 26-63 clear maclock static 26-63 set maclock firstarrival 26-64 clear maclock firstarrival 26-65...
Page 805: Show Maclock Stations
Most recent MAC address(es) violating the maximum static and first arrival value(s) Address set for the port. show maclock stations Use this command to display MAC locking information about end stations connected to the switch. Syntax show maclock stations [firstarrival | static] [port-string] Parameters firstarrival (Optional) Displays MAC locking information about end stations first connected to MAC locked ports. static (Optional) Displays MAC locking information about static (management defined) end stations connected to MAC locked ports. port‐string (Optional) Displays end station information for specified port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If no parameters are specified, MAC locking information will be displayed for all end stations. Mode Switch command, read‐only. SecureStack C3 Configuration Guide 26-59...
Page 806: Set Maclock Enable
set maclock enable Example This example shows how to display MAC locking information for the end stations connected to all Gigabit Ethernet ports in unit/module 2: C3(su)->show maclock stations ge.2.* Port Number MAC Address Status State Aging ------------ ----------------- -------------- -------------- ----- ge.2.1 00:a0:c9:39:5c:b4 active first arrival true ge.2.7 00:a0:c9:39:1f:11 active static false Table 26‐7 provides an explanation of the command output. Table 26-7 show maclock stations Output Details Output Field What It Displays...
Page 807: Set Maclock Disable
7‐1. Defaults If port‐string is not specified, MAC locking will be disabled globally on the switch. Mode Switch command, read‐write. Example This example shows how to disable MAC locking on .2.3: C3(su)->set maclock disable ge.2.3 set maclock Use this command to create a static MAC address‐to‐port locking, and to enable or disable MAC locking for the specified MAC address and port. Syntax set maclock mac-address port-string {create | enable | disable} Parameters mac‐address Specifies the MAC address for which MAC locking will be created, enabled or disabled. port‐string Specifies the port on which to create, enable or disable MAC locking for the specified MAC. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. SecureStack C3 Configuration Guide 26-61...
Page 808: Clear Maclock
clear maclock create Establishes a MAC locking association between the specified MAC address and port. Create automatically enables MAC locking between the specified MAC address and port. enable | disable Enables or disables MAC locking between the specified MAC address and port. Defaults None. Mode Switch command, read‐write. Usage Configuring a port for MAC locking requires globally enabling it on the switch first using the set maclock enable command as described in “set maclock enable” on page 26‐60. Static MAC locking a user on multiple ports is not supported. Statically MAC locked addresses will display in the show mac output (as described on page 14‐22) as address type “other” and will not remove them on link down. Example This example shows how to create a MAC locking association between MAC address 0e‐03‐ef‐d8‐ 44‐55 and port .3.2: C3(rw)->set maclock 0e-03-ef-d8-44-55 ge.3.2 create clear maclock Use this command to remove a static MAC address to port locking entry. Syntax clear maclock mac-address port-string Parameters mac‐address Specifies the MAC address that will be removed from the list of static MACs allowed to communicate on the port.
Page 809: Set Maclock Static
Parameters port‐string Specifies the port on which to set the maximum number of static MACs allowed. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. value Specifies the maximum number of static MAC addresses allowed per port. Valid values are 0 to 20. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the maximum number of allowable static MACs to 2 on .3.1: C3(rw)->set maclock static ge.3.1 2 clear maclock static Use this command to reset the number of static MAC addresses allowed per port to the default value of 20. Syntax clear maclock static port-string SecureStack C3 Configuration Guide 26-63...
Page 810: Set Maclock Firstarrival
set maclock firstarrival Parameters port‐string Specifies the port on which to reset number of static MAC addresses allowed. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the number of allowable static MACs on .2.3: C3(rw)->clear maclock static ge.2.3 set maclock firstarrival Use this command to restrict MAC locking on a port to a maximum number of end station addresses first connected to that port. Syntax set maclock firstarrival port-string value Parameters port‐string Specifies the port on which to limit MAC locking. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. value Specifies the number of first arrival end station MAC addresses to be allowed connections to the port. Valid values are 0 to 600. Defaults None.
Page 811: Clear Maclock Firstarrival
None. Mode Switch command, read‐write. Example This example shows how to reset MAC first arrivals on .2.3: C3(su)->clear maclock firstarrival ge.2.3 set maclock agefirstarrival Use this command to enable or disable the aging of first arrival MAC addresses. When enabled, first arrival MAC addresses that are aged out of the forwarding database will be removed from the associated port MAC lock. Syntax set maclock agefirstarrival port-string {enable | disable} Parameters port‐string Specifies the port(s) on which to enable or disable first arrival aging. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. enable | disable Enable or disable first arrival aging. By default, first arrival aging is disabled. Defaults None. SecureStack C3 Configuration Guide 26-65...
Page 812: Clear Maclock Agefirstarrival
clear maclock agefirstarrival Mode Switch mode, read‐write. Example This example enables first arrival aging on port .1.1. C3(su)-> set maclock agefirstarrival ge.1.1 enable clear maclock agefirstarrival Use this command to reset first arrival aging on one or more ports to its default state of disabled. Syntax clear maclock agefirstarrival port-string Parameters port‐string Specifies the port(s) on which to disable first arrival aging. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch mode, read‐write. Example This example disables first arrival aging on port .1.1. C3(su)-> clear maclock agefirstarrival ge.1.1 enable set maclock move Use this command to move all current first arrival MACs to static entries. ...
Page 813: Set Maclock Trap
Use this command to enable or disable MAC lock trap messaging. Syntax set maclock trap port-string {enable | disable} Parameters port‐string Specifies the port on which MAC lock trap messaging will be enabled or disabled. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. enable | disable Enables or disables MAC lock trap messaging. Defaults None. Mode Switch command, read‐write. Usage When enabled, this feature authorizes the switch to send an SNMP trap message if an end station is connected that exceeds the maximum values configured using the set maclock firstarrival and set maclock static commands. Violating MAC addresses are dropped from the device’s (or stack’s) filtering database. Example This example shows how to enable MAC lock trap messaging on .2.3: C3(su)->set maclock trap ge.2.3 enable SecureStack C3 Configuration Guide 26-67...
Page 814: Configuring Port Web Authentication (Pwa)
Configuring Port Web Authentication (PWA) Configuring Port Web Authentication (PWA) About PWA PWA provides a way of authenticating users through a Web portal before allowing general access to the network. To log on using PWA, the user makes a request through a web browser for the PWA web page or is automatically redirected to this login page after requesting a URL in a browser. Depending upon the authenticated state of the user, a login page or a logout page will display. When a user submits username and password, the switch then authenticates the user via a preconfigured RADIUS server. If the login is successful, then the user will be granted full network access according to the user’s policy configuration on the switch. Purpose To review, enable, disable, and configure Port Web Authentication (PWA). Commands For information about... Refer to page... show pwa 26-69 set pwa 26-70 show pwa banner 26-71 set pwa banner 26-71 clear pwa banner 26-72...
Page 815: Show Pwa
26-73. PWA Enhanced Whether PWA enhanced mode is enabled or disabled. Default state of disabled can Mode be changed using the set pwa enhancedmode command as described in “set pwa enhancedmode” on page 26-79. SecureStack C3 Configuration Guide 26-69...
Page 816: Set Pwa
set pwa Table 26-8 show pwa Output Details (Continued) Output Field What It Displays... PWA Logo Whether the Enterasys logo will be displayed or hidden at user login. Default state of enabled (displayed) can be changed using the set pwa displaylogo command as described in “set pwa displaylogo”...
Page 817: Show Pwa Banner
Example This example shows how to display the PWA login banner: C3(su)->show pwa banner Welcome to Enterasys Networks set pwa banner Use this command to configure a string to be displayed as the PWA login banner. Syntax set pwa banner string Parameters string Specifies the PWA login banner. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the PWA login banner to “Welcome to Enterasys Networks ”: C3(su)->set pwa banner “Welcome to Enterasys Networks” SecureStack C3 Configuration Guide 26-71...
Page 818: Clear Pwa Banner
Use this command to reset the PWA login banner to a blank string. Syntax clear pwa banner Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the PWA login banner to a blank string C3(su)->clear pwa banner set pwa displaylogo Use this command to set the display options for the Enterasys Networks logo. Syntax set pwa displaylogo {display | hide} Parameters display | hide Displays or hides the Enterasys Networks logo when the PWA website displays. Defaults None. Mode Switch command, read‐write. Example This example shows how to hide the Enterasys Networks logo: ...
Page 819: Set Pwa Ipaddress
This example shows how to set a PWA IP address of 1.2.3.4: C3(su)->set pwa ipaddress 1.2.3.4 set pwa protocol Use this command to set the port web authentication protocol. Syntax set pwa protocol {chap | pap} Parameters chap | pap Sets the PWA protocol to: • CHAP (PPP Challenge Handshake Protocol) ‐ encrypts the username and password between the end‐station and the switch port. • PAP (Password Authentication Protocol‐ does not provide any encryption between the end‐station the switch port. Defaults None. Mode Switch command, read‐write. Example This example shows how to set a the PWA protocol to CHAP: C3(su)->set pwa protocol chap SecureStack C3 Configuration Guide 26-73...
Page 820: Set Pwa Guestname
set pwa guestname set pwa guestname Use this command to set a guest user name for PWA networking. PWA will use this name to grant network access to guests without established login names and passwords. Syntax set pwa guestname name Parameters name Specifies a guest user name. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the PWA guest user name to “guestuser”: C3(su)->set pwa guestname guestuser clear pwa guestname Use this command to clear the PWA guest user name. Syntax clear pwa guestname Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the PWA guest user name C3(su)->clear pwa guestname...
Page 821: Set Pwa Guestpassword
C3(su)->set pwa guestpassword Guest Password: ********* Retype Guest Password: ********* set pwa gueststatus Use this command to enable or disable guest networking for port web authentication. Syntax set pwa gueststatus {authnone | authradius | disable} Parameters authnone Enables guest networking with no authentication method. authradius Enables guest networking with RADIUS authentication. Upon successful authentication from RADIUS, PWA will apply the policy returned from RADIUS to the PWA port. disable Disables guest networking. Defaults None. Mode Switch command, read‐write. SecureStack C3 Configuration Guide 26-75...
Page 822: Set Pwa Initialize
set pwa initialize Usage PWA will use a guest password and guest user name to grant network access with default policy privileges to users without established login names and passwords. Example This example shows how to enable PWA guest networking with RADIUS authentication: C3(su)->set pwa guestnetworking authradius set pwa initialize Use this command to initialize a PWA port to its default unauthenticated state. Syntax set pwa initialize [port-string] Parameters port‐string (Optional) Initializes specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, all ports will be initialized. Mode Switch command, read‐write. Example This example shows how to initialize ports .1.5‐7: C3(su)->set pwa initialize ge.1.5-7 set pwa quietperiod Use this command to set the amount of time a port will remain in the held state after a user ...
Page 823: Set Pwa Maxrequest
[port-string] Parameters maxrequests Specifies the maximum number of log on attempts. port‐string (Optional) Sets the maximum requests for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, maximum requests will be set for all ports. Mode Switch command, read‐write. Example This example shows how to set the PWA maximum requests to 3 for all ports: C3(su)->set pwa maxrequests 3 set pwa portcontrol This command enables or disables PWA authentication on select ports. Syntax set pwa portcontrol {enable | disable} [port-string] SecureStack C3 Configuration Guide 26-77...
Page 824: Show Pwa Session
show pwa session Parameters enable | disable Enables or disables PWA on specified ports. port‐string (Optional) Sets the control mode on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, PWA will enabled on all ports. Mode Switch command, read‐write. Example This example shows how to enable PWA on ports 1‐22: C3(su)->set pwa portcontrol enable ge.1.1-22 show pwa session Use this command to display information about current PWA sessions. Syntax show pwa session [port-string] Parameters port‐string (Optional) Displays PWA session information for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, session information for all ports will be displayed. Mode Switch command, read‐only.
Page 825: Set Pwa Enhancedmode
This command enables PWA URL redirection. The switch intercepts all HTTP packets on port 80 from the end user, and sends the end user a refresh page destined for the PWA IP Address configured. Syntax set pwa enhancedmode {enable | disable} Parameters enable | disable Enables or disables PWA enhancedmode. Defaults None. Mode Switch command, read‐write. Example This example shows how to enable PWA enhancedmode: C3(su)->set pwa enhancedmode enable SecureStack C3 Configuration Guide 26-79...
Page 826: Configuring Secure Shell (Ssh)
Configuring Secure Shell (SSH) Configuring Secure Shell (SSH) Purpose To review, enable, disable, and configure the Secure Shell (SSH) protocol, which provides secure Telnet. Commands For information about... Refer to page... show ssh status 26-80 set ssh 26-80 set ssh hostkey 26-81 show ssh status Use this command to display the current status of SSH on the switch. Syntax show ssh status Parameters None. Defaults None.
Page 827: Set Ssh Hostkey
Enables or disables SSH, or reinitializes the SSH server. reinitialize Reinitializes the SSH server. Defaults None. Mode Switch command, read‐write. Example This example shows how to disable SSH: C3(su)->set ssh disable set ssh hostkey Use this command to reinitialize new SSH authentication keys. Syntax set ssh hostkey reinitialize Parameters reinitialize Reinitializes the server host authentication keys. Defaults None Mode Switch command, read‐write. Example This example shows how to regenerate SSH keys: C3(su)->set ssh hostkey reinitialize SecureStack C3 Configuration Guide 26-81...
Page 828: Configuring Access Lists
Configuring Access Lists Configuring Access Lists Router: These commands can be executed when the device is in router mode only. For details on how to enable router configuration modes, refer to “Enabling Router Configuration Modes” on page 18-2. Note: Refer to the Release Notes for your product for any limitations that may apply to access control lists.
Page 829: Access-List (Standard)
| replace entryno {deny | permit} source [source-wildcard] To move entries within an ACL: access-list access-list-number move destination source1 [source2] Parameters access‐list‐number Specifies a standard access list number. Valid values are from 1 to 99. [entryno [entryno]] When using the no access‐list command, you can delete a whole access‐list, or only specific entries in the list with the optional entryno parameter. Specify a range of entries by entering the start and end entry numbers. deny | permit Denies or permits access if specified conditions are met. source Specifies the network or host from which the packet will be sent. Valid options for expressing source are: • IP address or range of addresses (A.B.C.D) • any ‐ Any source host • host source ‐ IP address of a single source host source‐wildcard (Optional) Specifies the bits to ignore in the source address. SecureStack C3 Configuration Guide 26-83...
Page 830: Access-List (Extended)
access-list (extended) insert | replace (Optional) Inserts this new entry before a specified entry in an existing ACL, entryno or replaces a specified entry with this new entry. move destination (Optional) Moves a sequence of access list entries before another entry. source1 source2 Destination is the number of the existing entry before which this new entry will be moved. Source1 is a single entry number or the first entry number in the range to be moved. Source2 (optional) is the last entry number in the range to be moved. If source2 is not specified, only the source1 entry will be moved. Defaults If insert, replace or move are not specified, the new entry will be appended to the access list. If source2 is not specified with move, only one entry will be moved. Mode Global configuration: C3(su)‐>router(Config)# Usage Valid access list numbers for standard ACLs are 1 to 99. For extended ACLs, valid values are 100 to 199. Access lists are applied to interfaces by using the ip access‐group command (page 26‐86). All access lists have an implicit “deny any any” statment as their last entry. Examples This example shows how to create access list 1 with three entries that allow access to only those hosts on the three specified networks. The wildcard bits apply to the host portions of the network addresses. Any host with a source address that does not match the access list entries will be rejected: C3(su)->router(Config)#access-list 1 permit 192.5.34.0 0.0.0.255 C3(su)->router(Config)#access-list 1 permit 128.88.0.0 0.0.255.255 C3(su)->router(Config)#access-list 1 permit 36.0.0.0 0.255.255.255 This example moves entry 16 to the beginning of ACL 22: C3(su)->router(Config)#access-list 22 move 1 16...
Page 831 Note: This parameter is not available when you specify the icmp protocol. destination Specifies the network or host to which the packet will be sent. Valid options for expressing destination are: • IP address (A.B.C.D) • any ‐ Any destination host • host source ‐ IP address of a single destination host destination‐wildcard (Optional) Specifies the bits to ignore in the destination address. insert | replace (Optional) Inserts this new entry before a specified entry in an existing entryno ACL, or replaces a specified entry with this new entry. move destination (Optional) Moves a sequence of access list entries before another entry. source1 source2 Destination is the number of the existing entry before which this new entry will be moved. Source1 is a single entry number or the first entry number in the range to be moved. Source2 (optional) is the last entry number in the range to be moved. If source2 is not specified, only the source1 entry will be moved. Defaults If insert, replace, or move are not specified, the new entry will be appended to the access list. If source2 is not specified with move, only one entry will be moved. SecureStack C3 Configuration Guide 26-85...
Page 832: Ip Access-Group
ip access-group If eq port is not specified, TCP/UDP ports are not used for filtering. Only the protocol, source, and destination are used for applying the rule. Mode Global configuration: C3(su)‐>router(Config)# Usage Access lists are applied to interfaces by using the ip access‐group command as described in “ip access‐group” on page 26‐86. Valid access‐list‐numbers for extended ACLs are 100 to 199. For standard ACLs, valid values are 1 to 99. All access lists have an implicit “deny any any” statment as their last entry. Examples This example shows how to define access list 145 to deny ICMP transmissions from any source and for any destination: C3(su)->router(Config)#access-list 145 deny ICMP any any This example appends to access list 145 a permit statement that allows the host with IP address 88.255.255.254 to do an SSH remote login to any destination on TCP port 22. C3(su)->router(Config)#access-list 145 permit tcp host 88.255.255.254 any eq 22 This example appends to access list 145 a permit statement that allows SNMP control traffic (from UDP port 161) to be sent from IP addresses within the range defined by 88.255.128.0 0.0.127.255 to any destination. C3(su)->router(Config)#access-list 145 permit udp 88.255.128.0 0.0.127.255 eq 161 ip access-group Use this command to apply access restrictions to inbound frames on an interface when operating ...
Page 833 Usage ACLs must be applied per routing interface. An access list can be applied to inbound traffic only. Access lists can now be applied to routed VLANs which incorporate LAGs. Example This example shows how to apply access list 1 for all inbound frames on the VLAN 1 interface. Through the definition of access list 1, only frames with a source address on the 192.5.34.0/24 network will be routed. All the frames with other source addresses received on the VLAN 1 interface are dropped: C3(su)->router(Config)#access-list 1 permit 192.5.34.0 0.0.0.255 C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip access-group 1 in SecureStack C3 Configuration Guide 26-87...
Page 834 ip access-group 26-88 Authentication and Authorization Configuration...
Page 835 27-7 clear tacacs session 27-8 show tacacs command 27-9 set tacacs command 27-9 show tacacs singleconnect 27-10 set tacacs singleconnect 27-10 show tacacs interface 27-11 set tacacs interface 27-11 clear tacacs interface 27-12 SecureStack C3 Configuration Guide 27-1...
Page 836: Chapter 27: Tacacs+ Configuration
TACACS+ Configuration show tacacs show tacacs Use this command to display the current TACACS+ configuration information and status. Syntax show tacacs [state] Parameters state (Optional) Displays only the TACACS+ client status. Defaults If state is not specified, all TACACS+ configuration information will be displayed. Mode Switch command, Read‐Only. Example This example shows how to display all TACACS configuration information. C3(ro)->show tacacs TACACS+ status:Disabled TACACS+ session accounting state:disable TACACS+ command authorization state:disable TACACS+ command auccounting state:disable TACACS+ single connect state:Disabled TACACS+ service: exec TACACS+ session authorization A-V pairs: access-level...
Page 837: Set Tacacs
Use this command to enable or disable the TACACS+ client. Syntax set tacacs {enable | disable} Parameters enable | disable Enables or disables the TACACS client. Defaults None. Mode Switch command, Read‐Write. Usage The TACACS+ client can be enabled on the switch anytime, with or without a TACACS+ server online. If the TACACS+ server is offline and TACACS+ is enabled, the login authentication is switched to RADIUS or local, if enabled. Examples This example shows how to enable the TACACS+ client. C3(rw)->set tacacs enable show tacacs server Use this command to display the current TACACS+ server configuration. Syntax show tacacs server {index | all} SecureStack C3 Configuration Guide 27-3...
Page 838: Set Tacacs Server
TACACS+ Configuration set tacacs server Parameters Display the configuration of the TACACS+ server identified by index . index The value of index can range from 1 to 2,147,483,647. Display the configuration for all configured TACACS+ servers. Defaults None. Mode Switch command, Read‐Only. Example This example displays configuration information for TACACS+ server 1. C3(ro)->show tacacs server 1 TACACS+ Server IP address Port Timeout -------------- ---------- ------ ------- 192.168.10.1 set tacacs server Use this command to configure the TACACS+ server(s) to be used by the TACACS+ client. You can configure the timeout value for all configured servers or a single server, or you can configure the IP address, TCP port, and secret for a single server. For simplicity, two syntax statements are ...
Page 839: Clear Tacacs Server
C3(rw)->set tacacs server 1 192.168.10.10 49 mysecret C3(rw)->set tacacs server 1 timeout 20 clear tacacs server Use this command to remove one or all configured TACACS+ servers, or to return the timeout value to its default value for one or all configured TACACS+ servers. Syntax clear tacacs server {all | index} [timeout] Parameters Specifies that all configured TACACS+ servers should be affected. Specifies one TACACS+ server to be affected. index timeout (Optional) Return the timeout value to its default value of 10 seconds. Defaults If timeout is not specified, the affected TACACS+ servers will be removed. Mode Switch command, Read‐Write. SecureStack C3 Configuration Guide 27-5...
Page 840: Show Tacacs Session
TACACS+ Configuration show tacacs session Examples This example removes TACACS+ server 1. C3(rw)->clear tacacs server 1 This example resets the timeout value to its default value of 10 seconds for all configured TACACS+ servers. C3(rw)->clear tacacs server all timeout show tacacs session Use this command to display the current TACACS+ client session settings. Syntax show tacacs session {authorization | accounting} Parameters authorization Display client session authorization settings. accounting Display client session accounting settings. Defaults None. Mode Switch command, Read‐Only. Examples This example shows how to display client session authorization information: C3(ro)->show tacacs session authorization TACACS+ service: exec TACACS+ session authorization A-V pairs:...
Page 841: Set Tacacs Session
Specifies the name of the service that the TACACS+ client will request from the TACACS+ server. The name specified here must match the name of a service configured on the server. The default service name is exec. read‐only attribute Specifies that the read‐only access privilege level should be matched to value a privilege level configured on the TACACS+ server by means of an attribute‐value pair specified by attribute and value. By default, attribute is “priv‐lvl” and value is 0. read‐write attribute Specifies that the read‐write access privilege level should be matched to value a privilege level configured on the TACACS+ server by means of an attribute‐value pair specified by attribute and value. By default, attribute is “priv‐lvl” and value is 1. super‐user attribute Specifies that the super‐user access privilege level should be matched to value a privilege level configured on the TACACS+ server by means of an attribute‐value pair specified by attribute and value. By default, attribute is “priv‐lvl” and value is 15. Defaults None. Mode Switch command, Read‐Write. Usage When session accounting is enabled, the TACACS+ server will log accounting information, such as start and stop times, IP address of the client, and so forth, for each authorized client session. When the TACACS+ client is enabled on the switch (with the set tacacs enable command), the session authorization parameters configured with this command are sent by the client to the TACACS+ server when a session is initiated on the switch. The parameter values must match a service and access level attribute‐value pairs configured on the server for the session to be authorized. If the parameter values do not match, the session will not be allowed. SecureStack C3 Configuration Guide 27-7...
Page 842: Clear Tacacs Session
TACACS+ Configuration clear tacacs session The service name and attribute‐value pairs can be any character string, and are determined by your TACACS+ server configuration. Since a task ID is associated with each accounting session, if there is a failover to a backup server, the accounting information will still be associated with the correct session using the task ID. Examples This example configures the service requested by the TACACS+ client as the service name “basic.” C3(rw)->set tacacs session authorization service basic This example maps the read‐write access privilege level to an attribute named “priv‐lvl” with the value of 5 configured on the TACACS+ server. C3(rw)->set tacacs session authorization read-write priv-lvl 5 This example enables TACACS+ session accounting. C3(rw)->set tacacs session accounting enable clear tacacs session Use this command to return the TACACS+ session authorization settings to their default values. Syntax clear tacacs session authorization {[service]|[read-only]|[read-write] | [super-user]} Parameters authorization ...
Page 843: Show Tacacs Command
C3(rw)->show tacacs command authorization TACACS+ command authorization state: enabled set tacacs command Use this command to enable or disable TACACS+ accounting or authorization on a per‐command basis. Syntax set tacacs command {accounting | authorization} {enable | disable} Parameters accounting | Specifies either TACACS+ accounting or authorization to be enabled or authorization disabled. enable | disable Enable or disable accounting or authorization on a per‐command basis. Defaults None. Mode Switch command, Read‐Write. Usage In order for per‐command accounting or authorization by a TACACS+ server to take place, the command must be executed within an authorized session. SecureStack C3 Configuration Guide 27-9...
Page 844: Show Tacacs Singleconnect
TACACS+ Configuration show tacacs singleconnect When per‐command accounting is enabled, the TACACS+ server will log accounting information, such as start and stop times, IP address of the client, and so forth, for each command executed during the session. When per‐command authorization is enabled, the TACACS+ server will check whether each command is permitted for that authorized session and return a success or fail. If the authorization fails, the command is not executed. Example This example shows how to enable TACACS+ authorization on a command basis. C3(rw)->set tacacs command authorization enable show tacacs singleconnect Use this command to display the current status of the TACACS+ client’s ability to send multiple requests over a single TCP connection. Syntax show tacacs singleconnect Parameters None. Defaults None. Mode Switch command, Read‐Write. Example This example shows how to display the state of the TACACS+ client’s ability to send multiple requests over a single connection. C3(rw)->show tacacs singleconnect TACACS+ single-connect state: enabled set tacacs singleconnect Use this command to enable or disable the ability of the TACACS+ client to send multiple requests ...
Page 845: Show Tacacs Interface
Parameters None. Defaults None. Mode Switch mode, read‐only. Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the TACACS+ packets generated by the switch. C3(rw)->show tacacs interface loopback 1 192.168.10.1 set tacacs interface Use this command to specify the interface used for the source IP address of the TACACS+ packets generated by the switch. Syntax set tacacs interface {loopback loop-ID | vlan vlan-ID} Parameters loopback loop‐ID Specifies the loopback interface to be used. The value of loop‐ID can range from 0 to 7. SecureStack C3 Configuration Guide 27-11...
Page 846: Clear Tacacs Interface
TACACS+ Configuration clear tacacs interface vlan vlan‐ID Specifies the VLAN interface to be used. The value of vlan‐ID can range from 1 to 4093. Defaults None. Mode Switch command, read‐write. Usage This command allows you to configure the source IP address used by the TACACS+ application on the switch when generating packets for management purposes. Any of the management interfaces, including VLAN routing interfaces, can be configured as the source IP address used in packets generated by the TACACS+ client. An interface must have an IP address assigned to it before it can be set by this command. If no interface is specified, then the IP address of the Host interface will be used. If a non‐loopback interface is configured with this command, application packet egress is restricted to that interface if the server can be reached from that interface. Otherwise, the packets are transmitted over the first available route. Packets from the application server are received on the configured interface. If a loopback interface is configured, and there are multiple paths to the application server, the outgoing interface (gateway) is determined based on the best route lookup. Packets from the application server are then received on the sending interface. If route redundancy is required, therefore, a loopback interface should be configured. Example This example configures an IP address on VLAN interface 100 and then sets that interface as the TACACS+ client source IP address. C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0 C3(rw)->router(Config-if(Vlan 100))#exit C3(rw)->router(Config)#exit C3(rw)->router#exit C3(rw)->router>exit C3(rw)->set tacacs interface vlan 100 C3(rw)->show tacacs interface vlan 100...
Page 847 TACACS+ Configuration None. Defaults None. Mode Switch command, read‐write. Example This command returns the interface used for the source IP address of the TACACS+ client back to the default of the Host interface. C3(rw)->show tacacs interface vlan 100 192.168.10.1 C3(rw)->clear tacacs interface C3(rw)-> SecureStack C3 Configuration Guide 27-13...
Page 848 TACACS+ Configuration clear tacacs interface 27-14...
Page 849: Chapter 28: Sflow Configuration
An sFlow solution consists of an sFlow Agent, embedded in the network device such as a switch or router, and an sFlow Collector. The sFlow Agent uses sampling technology to capture traffic statistics from the device it is monitoring and immediately forwards the sampled traffic statistics to an sFlow Collector for analysis in sFlow datagrams. The sFlow Agent uses two forms of sampling— statistical packet‐based sampling of switched or routed Packet Flows, and time‐based sampling of counters. Version 5 of sFlow is described in detail in the document entitled “sFlow Version 5” available from sFlow.org (http://www.sflow.org). Using sFlow in Your Network The advantages of using sFlow include: • sFlow makes it possible to monitor ports of a switch, with no impact on the distributed switching performance. (See “Usage Notes” on page 28‐3 for more information.) • sFlow requires very little memory or CPU usage. Samples are not aggregated into a flow‐ table on the switch — they are forwarded immediately over the network to the sFlow Collector. • The system is tolerant to packet loss in the network. (The statistical model means loss is equivalent to a slight change in the sampling rate.) • The sFlow Collector can receive data from multiple switches, providing a real‐time synchronized view of the whole network. • The sFlow Collector can analyze traffic patterns for whatever protocols are found in the packet headers (for example, TCP/IP, IPX, Ethernet, AppleTalk). There is no need for the layer 2 switch to decode and understand all protocols. SecureStack C3 Configuration Guide 28-1...
Page 850: Definitions
sFlow Configuration Overview Definitions The following table describes some of the main sFlow terms and concepts. Table 28-1 sFlow Definitions Term Definition Data Source A Data Source refers to a location within a Network Device that can make traffic measurements. Possible Data Sources include interfaces, physical entities within the device such as the backplane, and VLANs.
Page 851: Packet Flow Sampling
When a sample is taken, the counter indicating how many packets to skip before taking the next sample is reset. The value of the counter is set to a random integer where the sequence of random integers used over time is the Sampling Rate. Packet flow sampling results in the generation of Packet Flow Records. A Packet Flow Record contains information about the attributes of a packet flow, including: • Information on the packet itself — a packet header, packet length, and packet encapsulation. • Information about the path the packet took through the device, including information relating to the selection of the forwarding path. Counter Sampling The primary objective of the counter sampling is to, in an efficient way, periodically export counters associated with Data Sources. A maximum sampling interval is assigned to each sFlow Instance associated with a Data Source. Counter sampling is accomplished as follows: The sFlow Agent keep a list of counter sources being sampled. When a Packet Flow Sample is generated, the sFlow Agent examines the list of counter sources and adds counters to the sample datagram, least recently sampled first. Counters are only added to the datagram if the sources are within a short period, 5 seconds say, of failing to meet the required sampling interval. Periodically, say every second, the sFlow Agent examines the list of counter sources and sends any counters that need to be sent to meet the sampling interval requirement. The set of counters is a fixed set defined in Section 5 of the document entitled “sFlow Version 5” available from sFlow.org (http://www.sflow.org). Usage Notes Although the switch hardware has the capability to sample packets on any port, to ensure that CPU utilitization is not compromised, the number of sFlow samplers that can be configured per switch or stack of switches is limited to a maximum of 32. There is no limitation on the number of pollers that can be configured. Under certain circumstances, the switch will drop packet samples that the sFlow implementation is not able to count and therefore cannot correctly report sample_pool and drops fields of flow samples sent to the sFlow Collector. Under heavy load, this sample loss could be significant and could therefore affect the accuracy of the sampling analysis. SecureStack C3 Configuration Guide 28-3...
Page 852: Example Configuration
sFlow Configuration Commands sFlow is disabled by default on SecureStack and G‐Series devices. Example Configuration The general procedure for configuring sFlow includes: Configure your sFlow Collector information to be used by the sFlow Agent on the switch. Up to eight Collectors can be configured. The information is stored in the sFlowReceiverTable. Enable and configure sFlow packet flow sampling instances on each port. Enable and configure sFlow counter sampling poller instances on each port. The following is an example of the commands used to configure sFlow: # configure sFlow Collector 1 # accept defaults for datagram size and port set sflow receiver 1 owner enterasys timeout 180000 set sflow receiver 1 ip 192.168.16.91 #configure packet sampling instances on ports 1 through 12 #assign to sFlow Collector 1 set sflow port ge.1.1-12 sampler 1 set sflow port ge.1.1-12 sampler maxheadersize 256...
Page 853: Show Sflow Receivers
Index String Size -------- -------- ---------- ------------ ----- ------------------- ets1 17766 1400 6343 10.1.2.117 1400 6343 0.0.0.0 1400 6343 0.0.0.0 1400 6343 0.0.0.0 1400 6343 0.0.0.0 1400 6343 0.0.0.0 1400 6343 0.0.0.0 1400 6343 0.0.0.0 SecureStack C3 Configuration Guide 28-5...
Page 854: Show Sflow Receivers Output Descriptions
sFlow Configuration show sflow receivers This example displays information about the Collector with index 1. C3(su)->show sflow receivers 1 Receiver Index Owner String ets1 Time out 17758 IP Address: 10.1.2.117 Address Type IPv4 Port 6343 Datagram Version Maximum Datagram Size 1400 The following table describes the output fields. Table 28-2 show sflow receivers Output Descriptions Output...
Page 855: Set Sflow Receiver Owner
Usage In order for an sFlow Collector to be assigned to receive sample datagrams from the sFlow Agent on the switch, an entry for that Collector must be configured in the switch’s sFlow Receivers Table. An entry must contain an owner identity string, a non‐zero timeout value, and the IP address of the Collector. Configure the IP address with the set sflow receiver ip command. An entry without an owner identity string is considered unclaimed and cannot be assigned as a receiver to sampler or poller instances. Once the timer set by this command expires, the receiver/Collector and all the samplers and pollers associated with this Collector expire and are removed from the switch’s configuration. In order to start sending sample data to the Collector again, the Collector must be reconfigured with a new timeout value and samplers and pollers must be configured again. Therefore, you should consider setting the timeout value to the largest value that is reasonable for your environment. Example This example configures an entry for index 1 in the sFlow Receivers Table. (su)->set sflow receiver 1 owner ets1 timeout 180000 set sflow receiver ip Use this command to configure the IP address of an sFlow Collector in the switch’s sFlow Receivers Table. Syntax set sflow receiver index ip ipaddr SecureStack C3 Configuration Guide 28-7...
Page 856: Set Sflow Receiver Maxdatagram
sFlow Configuration set sflow receiver maxdatagram Parameters index Index number in the sFlow Receivers Table for the receiver/Collector being configured. The index can range from 1 to 8. ip ipaddr The IP address of the receiver/Collector being configured. An IP address of 0.0.0.0 means that no sample datagrams will be sent to the Collector. Defaults The default IP address is 0.0.0.0. Mode Switch command, read‐write. Usage In order for an sFlow Collector to be assigned to receive sample datagrams from the sFlow Agent on the switch, an entry for that Collector must be configured in the switch’s sFlow Receivers Table. An entry must contain an owner identity string, a non‐zero timeout value, and the IP address of the Collector. Configure the owner identity string and timeout value with the set sflow receiver owner command. Sample datagrams will not be sent to a Collector whose entry in the sFlow Receivers Table has an IP address of 0.0.0.0. Example This example configures an IP address of 10.10.10.10 to index entry 1. C3(su)->set sflow receiver 1 ip 10.10.10.10 set sflow receiver maxdatagram Use this command to set the maximum number of data bytes that can be sent in a single sample datagram. Syntax set sflow receiver index maxdatagram bytes Parameters...
Page 857: Set Sflow Receiver Port
Switch command, read‐write. Example This example changes the sFlow receiver port on the Collector to 1234. C3(su)->set sflow receiver 1 port 1234 clear sflow receiver Use this command to delete a receiver/Collector from the sFlow Receivers Table, or to return certain parameters to their default values for the specified Collector. Syntax clear sflow receiver index [ip | maxdatagram | owner [timeout] | port] Parameters index Index number in the sFlow Receivers Table for the receiver/Collector being configured. The index can range from 1 to 8. (Optional) Clear the IP address to 0.0.0.0. Sample datagrams are not sent to Collectors with an IP address of 0.0.0.0. maxdatagram (Optional) Return the maximum datagram size to 1400 bytes. SecureStack C3 Configuration Guide 28-9...
Page 858: Set Sflow Port Poller
sFlow Configuration set sflow port poller owner (Optional) Clear the owner identity string. Entries in the sFlow Receiver Table without an identity string are considered unclaimed. timeout (Optional) Clear the timeout value of the specified entry. port port (Optional) Clear the UDP port on the receiver/Collector to which the sample datagrams should be sent. The value is reset to the default of 6343. Defaults If no optional parameters are specified, the entire entry is cleared. Mode Switch command, read‐write. Usage You can clear the IP address, maximum datagram size, or UDP port without deleting an entry from the sFlow Receivers Table. If you clear the owner or timeout, the entire entry is cleared. If you enter only an entry index and none of the optional parameters, the entire entry is cleared. Once an entry is cleared, all pollers and samplers associated with that receiver are also removed from the switch configuration. Example This example returns the maximum datagram size to the default of 1400 bytes for the Collector with index 1. C3(su)->clear sflow receiver 1 maxdatagram set sflow port poller Use this command to configure poller instances on ports, or data sources. Syntax set sflow port port-string poller {index | interval seconds} Parameters port‐string Specifies the port or ports (data sources) on which the poller instance is ...
Page 859: Show Sflow Pollers
Use this command to display information about configured poller instances. Syntax show sflow pollers Parameters None. Defaults None. Mode Switch command, read‐only. Example This example displays the output of this command. C3(su)->show sflow pollers Poller Receiver Poller Data Source Index Interval ----------- ------- ------- ge.1.1 ge.1.2 ge.1.3 ge.1.4 ge.1.5 ge.1.6 ge.1.7 ge.1.8 SecureStack C3 Configuration Guide 28-11...
Page 860: Clear Sflow Port Poller
sFlow Configuration clear sflow port poller clear sflow port poller Use this command to change the poller interval or to remove poller instances. Syntax clear sflow port port-string poller [interval] Parameters port‐string Specifies the port or ports on which the poller instance is being cleared. interval (Optional) Specifies that the polling interval should be cleared to 0. A value of 0 disables counter sampling. Defaults If interval is not specified, the poller instance is cleared. Mode Switch command, read‐write. Example This example removes the poller instance on port ge.1.1. C3(su)->clear sflow port ge.1.1 poller set sflow port sampler Use this command to configure sampler instances on ports, or data sources. Syntax set sflow port port-string sampler {index | maxheadersize bytes | rate rate} Parameters...
Page 861: Show Sflow Samplers
Use this command to display information about configured sampler instances. Syntax show sflow samplers Parameters None. Defaults None. Mode Switch command, read‐only. Example This example displays the output of this command. C3(su)->show sflow samplers Sampler Receiver Packet Max Header Data Source Index Sampling Rate Size ----------- ------- ------------- ---------- ge.1.1 1024 SecureStack C3 Configuration Guide 28-13...
Page 862: Clear Sflow Port Sampler
sFlow Configuration clear sflow port sampler ge.1.2 1024 ge.1.3 1024 ge.1.4 1024 ge.1.5 1024 ge.1.6 1024 ge.1.7 1024 ge.1.8 1024 clear sflow port sampler Use this command to change the sampler rate or maximum header size, or to remove sampler instances. Syntax clear sflow port port-string sampler [maxheadersize | rate] Parameters port‐string Specifies the port or ports on which the sampler instance is being cleared. maxheadersize (Optional) Specifies that the maximum header size should be cleared to ...
Page 863: Show Sflow Interface
Example This example configures an IP address on VLAN interface 100 and then sets that interface as the management interface for the sFlow Agent. C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0 C3(rw)->router(Config-if(Vlan 100))#exit C3(rw)->router(Config)#exit C3(rw)->router#exit C3(rw)->router>exit C3(rw)->set sflow interface vlan 100 C3(rw)->show sflow interface vlan 100 192.168.10.1 show sflow interface Use this command to display the interface used by the sFlow Agent when sending sampling datagrams to the sFlow Collector. Syntax show sflow interface Parameters SecureStack C3 Configuration Guide 28-15...
Page 864: Clear Sflow Interface
sFlow Configuration clear sflow interface None. Defaults None. Mode Switch mode, read‐only. Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the sFlow Agent. C3(rw)->show sflow interface loopback 1 192.168.10.1 clear sflow interface Use this command to clear the management interface used by the sFlow Agent back to the default of the Host VLAN. Syntax clear sflow interface Parameters None. Defaults None. Mode Switch command, read‐write. Example This command returns the managment interface used by the sFlow Agent back to the default of the Host VLAN. C3(rw)->show sflow interface vlan 100 192.168.10.1 C3(rw)->clear sflow interface...
Page 865: Show Sflow Agent
Configuration show sflow agent Use this command to display information about the sFlow Agent. Syntax show sflow agent Parameters None. Defaults None. Mode Switch command, read‐only. Example This example displays the output of this command. C3(rw)->show sflow agent sFlow Version 1.3;Broadcom Corp.;06.03.00.0001T IP Address 192.168.1.6 SecureStack C3 Configuration Guide 28-17...
Page 866 sFlow Configuration show sflow agent 28-18...
Page 867: Appendix A: Policy And Authentication Capacities
(numuser = 1) vlan/cos/drop/fwd (max 7 vlan rules per profile) mac dest/mac source cos/drop/fwd ip protocol cos/drop/fwd ip dest socket/ip source socket cos/drop/fwd ip tos cos/drop/fwd tcp dest port/ tcp source port cos/drop/fwd SecureStack C3 Configuration Guide A-1...
Page 868: Policy Capacities
Policy and Authentication Capacities Authentication Capacities Table A-1 Policy Capacities (Continued) Feature Capacity udp dest port/udp source port cos/drop/fwd icmp type 1. These rules cannot be masked. Authentication Capacities Refer to the “Configuring User Authentication” Feature Guide for an in‐depth discussion of authentication configuration. This Feature Guide is located on the Enterasys Networks web site: http://www.enterasys.com/support/manuals/ Table A-2 Authentication Capacities Authentication Feature Capacity IEEE 802.1x (dot1x) authentication Supported MAC-based authentication Supported...
Page 869: Index
Index Numerics starting Command History Buffer 14-14, 14-15 802.1D Getting help xxxvii Command Line Interface. See also CLI 802.1p 11-17, 12-1 GVRP Configuration 802.1Q 10-1 enabling and disabling 10-23 clearing switch parameters 3-51 802.1s purpose of 10-20 modes for router operation 18-2 802.1w timer...
Page 870 about 22-1 configuring 22-14 Port Mirroring 7-36 configuring 22-14 Neighbors Port Priority displaying cache 21-6 OSPF 20-30 configuring 12-2 OSPFv3, configuring 25-1 Network Management Port String IPv6 proxy routing 23-1 addresses and routes 14-19 syntax used in the CLI IRDP 20-37 monitoring switch events and Port Trunking...
Page 871 enabling 18-2 enabling in switch mode 3-37 Routing Interfaces Terminal Settings 3-29 configuring 19-3 TFTP Routing Protocol Configuration downloading firmware upgrades DVMRP 20-33 3-32 IRDP 20-37 Timeout OSPF 20-11 19-15 OSPFv3 25-1 CLI, system 3-30 20-2 RADIUS 26-7 VRRP 20-42 Timers OSPF 20-16...
Page 872 Index - 4...

Enterasys SECURESTACK C3 Configuration Manual

Chapter 1: Introduction

Chapter 3: Basic Configuration

Chapter 4: Activating Licensed Features

Quick Links

Related Manuals for Enterasys SECURESTACK C3

Summary of Contents for Enterasys SECURESTACK C3