Page 1: Management Guide
TigerSwitch 10/100 48-Port 10/100Mbps Fast Ethernet Managed Switch ◆ 48 auto-MDI/MDI-X 10BASE-T/100BASE-TX ports ◆ 2 Gigabit RJ-45 ports shared with 2 SFP transceiver slots ◆ 2 Gigabit RJ-45 ports ◆ 17.8 Gbps of aggregate bandwidth ◆ Non-blocking switching architecture ◆ Spanning Tree Protocol and Rapid STP ◆...
Page 3 TigerSwitch 10/100 Management Guide From SMC’s Tiger line of feature-rich workgroup LAN solutions 38 Tesla Irvine, CA 92618 Phone: (949) 679-8000 November 2004 Pub. # 149100005200H...
Page 4 38 Tesla Irvine, CA 92618 All rights reserved. Trademarks: SMC is a registered trademark; and EZ Switch, TigerStack and TigerSwitch are trademarks of SMC Networks, Inc. Other product and company names are trademarks or registered trademarks of their respective holders.
Page 5 IMITED ARRANTY Limited Warranty Statement: SMC Networks, Inc. (“SMC”) warrants its products to be free from defects in workmanship and materials, under normal use and service, for the applicable warranty term. All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized Reseller.
Page 6 * SMC will provide warranty service for one year following discontinuance from the active SMC price list. Under the limited lifetime warranty, internal and external power supplies, fans, and cables are covered by a standard one-year warranty from date of purchase. SMC Networks, Inc. 38 Tesla Irvine, CA 92618...
Page 7: Table Of Contents
Introduction ........1-1 Key Features ..........1-1 Description of Software Features .
Page 8 ONTENTS Using DHCP/BOOTP ......3-19 Managing Firmware ........3-21 Downloading System Software from a Server .
Page 9 Configuring a Standard IP ACL ..... 3-80 Configuring an Extended IP ACL ....3-82 Configuring a MAC ACL .
Page 10 ONTENTS Configuring VLAN Behavior for Interfaces ..3-156 Private VLANs ........3-159 Displaying Current Private VLANs .
Page 11 Getting Help on Commands ......4-5 Showing Commands ........4-6 Partial Keyword Lookup .
Page 12 ONTENTS User Access Commands ....... 4-34 username ........4-35 enable password .
Page 13 logging sendmail level ......4-69 logging sendmail source-email ..... . 4-70 logging sendmail destination-email .
Page 14 ONTENTS show radius-server ......4-101 TACACS+ Client ........4-102 tacacs-server host .
Page 15 show map access-list mac ......4-134 ACL Information ........4-135 show access-list .
Page 16 ONTENTS lacp port-priority ........4-171 show lacp .
Page 17 Displaying VLAN Information ......4-207 show vlan ........4-207 Configuring Private VLANs .
Page 18 ONTENTS Multicast Filtering Commands ......4-236 IGMP Snooping Commands ......4-236 ip igmp snooping .
Page 19 Table 1-1 Key Features ........1-1 Table 1-2 System Defaults .
Page 20 ABLES Table 4-21 SMTP Alert Commands ......4-68 Table 4-22 Time Commands ....... 4-72 Table 4-23 System Status Commands .
Page 21 Table 4-58 Priority Commands (Layer 2) ....4-221 Table 4-59 Default CoS Priority Levels ..... . 4-225 Table 4-60 Priority Commands (Layer 3 and 4) .
Page 22 ABLES xviii...
Page 23 Figure 3-1 Home Page ........3-3 Figure 3-2 Panel Display .
Page 24 IGURES Figure 3-37 ACL Configuration - Extended IP ....3-83 Figure 3-38 ACL Configuration - MAC ..... . . 3-85 Figure 3-39 Binding a Port to an ACL .
Page 25 IGURES Figure 3-74 Queue Mode ....... . . 3-172 Figure 3-75 Configuring Queue Scheduling ....3-173 Figure 3-76 IP Precedence/DSCP Priority Status .
Page 26 IGURES xxii...
Page 27: Introduction
This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch. However, there are many options that you should configure to maximize the switch’s performance for your particular network environment.
Page 28: Description Of Software Features
NTRODUCTION Feature Port Trunking Broadcast Storm Control Static Address IEEE 802.1D Bridge Store-and-Forward Switching Spanning Tree Algorithm Virtual LANs Traffic Prioritization Multicast Filtering Supports IGMP snooping and query Description of Software Features The switch provides a wide range of advanced performance enhancing features.
Page 29 ESCRIPTION OF OFTWARE EATURES Configuration Backup and Restore – You can save the current configuration settings to a file on a TFTP server, and later download this file to restore the switch configuration settings. Authentication – This switch authenticates management access via the console port, Telnet or web browser.
Page 30 NTRODUCTION Rate Limiting – This feature controls the maximum rate for traffic transmitted or received on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic into or out of the network. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped.
Page 31 ESCRIPTION OF OFTWARE EATURES Store-and-Forward Switching – The switch copies each frame into its memory before forwarding them to another port. This ensures that all frames are a standard Ethernet size and have been verified for accuracy with the cyclic redundancy check (CRC). This prevents bad frames from entering the network and wasting bandwidth.
Page 32 NTRODUCTION switch to restrict traffic to the VLAN groups to which a user has been assigned. By segmenting your network into VLANs, you can: • Eliminate broadcast storms which severely degrade performance in a flat network. • Simplify network management for node changes/moves by remotely configuring VLAN membership for any port, rather than having to manually change the network connection.
Page 33: System Defaults
System Defaults The switch’s system defaults are provided in the configuration file “Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as the startup configuration file (page 3-23). The following table lists some of the basic system defaults. Function Console Port Connection...
Page 34 NTRODUCTION Function Management SNMP Port Configuration Rate Limiting Port Trunking Broadcast Storm Protection Spanning Tree Enabled Address Table Table 1-2 System Defaults Parameter HTTP Server HTTP Port Number HTTP Secure Server HTTP Secure Port Number Community Strings Traps Admin Status Auto-negotiation Flow Control Input and output limits...
Page 35 Function Parameter Virtual LANs Default VLAN PVID Acceptable Frame Type Ingress Filtering Switchport Mode (Egress Mode) GVRP (global) GVRP (port interface) Traffic Ingress Port Priority Prioritization Weighted Round Robin IP Precedence Priority IP DSCP Priority IP Port Priority IP Settings IP Address Subnet Mask Default Gateway...
Page 36 NTRODUCTION 1-10...
Page 37: Initial Configuration
NITIAL Connecting to the Switch Configuration Options The switch includes a built-in network management agent. The agent offers a variety of management options, including SNMP, RMON (Groups 1, 2, 3, 9) and a Web-based interface. A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI).
Page 38: Required Connections
NITIAL ONFIGURATION The switch’s Web interface, CLI configuration program, and SNMP agent allow you to perform the following management functions: • Set user names and passwords for up to 16 users • Set an IP interface for a management VLAN •...
Page 39 Attach a VT100-compatible terminal, or a PC running a terminal emulation program to the switch. You can use the console cable provided with this package, or use a null-modem cable that complies with the wiring assignments shown in the Installation Guide. To connect a terminal to the console port, complete the following steps: 1.
Page 40: Remote Connections
NITIAL ONFIGURATION For a description of how to use the CLI, see “Using the Command Line Interface” on page 4-1. For a list of all the CLI commands and detailed information on using the CLI, refer to “Command Groups” on page 4-12. Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you must first configure it with a valid IP address, subnet mask, and default...
Page 41: Basic Configuration
Basic Configuration Console Connection The CLI program provides two different command levels — normal access level (Normal Exec) and privileged access level (Privileged Exec). The commands available at the Normal Exec level are a limited subset of those available at the Privileged Exec level and allow you to only display information and use basic utilities.
Page 42: Setting An Ip Address
NITIAL ONFIGURATION 2. Type “configure” and press <Enter>. 3. Type “username guest password 0 password,” for the Normal Exec level, where password is your new password. Press <Enter>. 4. Type “username admin password 0 password,” for the Privileged Exec level, where password is your new password. Press <Enter>. Note: ‘0’...
Page 43: Manual Configuration
Manual Configuration You can manually assign an IP address to the switch. You may also need to specify a default gateway that resides between this device and management stations that exist on another network segment. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods. Anything outside this format will not be accepted by the CLI program.
Page 44: Dynamic Configuration
NITIAL ONFIGURATION Dynamic Configuration If you select the “bootp” or “dhcp” option, IP will be enabled but will not function until a BOOTP or DHCP reply has been received. You therefore need to use the “ip dhcp restart” command to start broadcasting service requests.
Page 45: Enabling Snmp Management Access
6. Then save your configuration changes by typing “copy running-config startup-config.” Enter the startup file name and press <Enter>. Console(config)#interface vlan 1 Console(config-if)#ip address dhcp Console(config-if)#end Console#ip dhcp restart Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: User specified.
Page 46: Trap Receivers
NITIAL ONFIGURATION The default strings are: • public - with read-only access. Authorized management stations are only able to retrieve MIB objects. • private - with read-write access. Authorized management stations are able to both retrieve and modify MIB objects. Note: If you do not intend to utilize SNMP, we recommend that you delete both of the default community strings.
Page 47: Saving Configuration Settings
“community-string” is the string associated with that host. Press <Enter>. 2. In order to configure the switch to send SNMP notifications, you must enter at least one snmp-server enable traps command. Type “snmp-server enable traps type,” where “type” is either authentication or link-up-down.
Page 48: Managing System Files
NITIAL ONFIGURATION Managing System Files The switch’s flash memory supports three types of system files that can be managed by the CLI program, Web interface, or SNMP. The switch’s file system allows files to be uploaded and downloaded, copied, deleted, and set as a start-up file.
Page 49: Configuring The Switch
ONFIGURING THE Using the Web Interface This switch provides an embedded HTTP Web agent. Using a Web browser you can configure the switch and view statistics to monitor network activity. The Web agent can be accessed by any computer on the network using a standard Web browser (Internet Explorer 5.0 or above, or Netscape Navigator 6.2 or above).
Page 50 ONFIGURING THE WITCH Notes: 1. You are allowed three attempts to enter the correct password; on the third failed attempt the current connection is terminated. 2. If you log into the Web interface as guest (Normal Exec level), you can view the configuration settings or change the guest password.
Page 51: Navigating The Web Browser Interface
Navigating the Web Browser Interface To access the web-browser interface you must first enter a user name and password. The administrator has Read/Write access to all configuration parameters and statistics. The default user name and password for the administrator is “admin.” Home Page When your web browser connects with the switch’s web agent, the home page is displayed as shown below.
Page 52: Configuration Options
ONFIGURING THE WITCH Configuration Options Configurable parameters have a dialog box or a drop-down list. Once a configuration change has been made on a page, be sure to click on the Apply button to confirm the new setting. The following table summarizes the web page configuration buttons.
Page 53: Main Menu
Main Menu Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program. Menu System System Information Switch Information Bridge Extension IP Configuration...
Page 54 ONFIGURING THE WITCH Menu SNTP Configuration Clock Time Zone SNMP Configuration Security User Accounts Authentication Settings Configures authentication sequence, HTTPS Settings Host-Key Settings Settings Port Security 802.1X Information Configuration Port Configuration Statistics Configuration Port Binding Table 3-2 Main Menu (Continued) Description Configures SNTP client settings, including broadcast mode or a specified list of servers...
Page 55 Table 3-2 Main Menu (Continued) Menu IP Filter Port Port Information Trunk Information Port Configuration Trunk Configuration Trunk Membership LACP Configuration Aggregation Port Port Counters Port Internal Information Port Neighbors Information Port Broadcast Control Sets the broadcast storm threshold for each Trunk Broadcast Control Mirror Port...
Page 56 ONFIGURING THE WITCH Menu Output Port Configuration Output Trunk Configuration Port Statistics Address Table Static Addresses Dynamic Addresses Address Aging Spanning Tree Information Configuration Port Information Trunk Information Port Configuration Trunk Configuration VLAN 802.1Q VLAN GVRP Status Basic Information Current Table Static List Static Table Table 3-2 Main Menu (Continued)
Page 57 Table 3-2 Main Menu (Continued) Menu Static Membership by Port Port Configuration Trunk Configuration Private VLAN Information Configuration Association Port Information Port Configuration Trunk Information Trunk Configuration Priority Default Port Priority Default Trunk Priority Traffic Classes Traffic Classes Status Queue Mode Description Configures membership type for interfaces, including tagged, untagged or forbidden...
Page 58: Table 3-2 Main Menu
ONFIGURING THE WITCH Menu Queue Scheduling IP Precedence/ DSCP Priority Status IP Precedence Priority IP DSCP Priority IP Port Priority Status IP Port Priority ACL CoS Priority IGMP Snooping IGMP Configuration Multicast Router Port Information Static Multicast Router Port Configuration IP Multicast Registration Table IGMP Member...
Page 59: Basic Configuration
Basic Configuration Displaying System Information You can easily identify the system by displaying the device name, location and contact information. Field Attributes • System Name – Name assigned to the switch system. • Object ID – MIB II object ID for switch’s network management subsystem.
Page 60: Figure 3-3 System Information
ONFIGURING THE WITCH Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that allows access to the Command Line Interface via Telnet.) 3-12 Figure 3-3 System Information...
Page 61: Displaying Switch Hardware/Software Versions
CLI – Specify the hostname, location and contact information. Console(config)#hostname R&D 5 Console(config)#snmp-server location WC 9 Console(config)#snmp-server contact Ted Console(config)#exit Console#show system System description: TigerSwitch 10/100 6752AL2 System OID string: 1.3.6.1.4.1.202.20.44 System information System Up time: seconds System Name: System Location: System Contact MAC address Web server:...
Page 62: Figure 3-4 Switch Information
ONFIGURING THE WITCH Management Software • Loader Version – Version number of loader code. • Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code. • Operation Code Version – Version number of runtime code. • Role – Shows that this switch is operating as Master or Slave. Expansion Slot •...
Page 63: Displaying Bridge Extension Capabilities
CLI – Use the following command to display version information. Console#show version Unit 1 Serial number: Service tag: Hardware version: Module A type: Module B type: Number of ports: Main power status: Redundant power status Agent (master) Unit ID: Loader version: Boot ROM version: Operation code version: Console#...
Page 64: Figure 3-5 Bridge Extension Configuration
ONFIGURING THE WITCH • Configurable PVID Tagging – This switch allows you to override the default Port VLAN ID (PVID used in frame tags) and egress status (VLAN-Tagged or Untagged) on each port. (Refer to “VLAN Configuration” on page 3-141.) •...
Page 65: Setting The Switch's Ip Address
CLI – Enter the following command. Console#show bridge-ext Max support VLAN numbers: Max support VLAN ID: Extended multicast filtering services: No Static entry individual port: VLAN learning: Configurable PVID tagging: Local VLAN capable: Traffic classes: Global GVRP status: GMRP: Console# Setting the Switch’s IP Address This section describes how to configure an IP interface for management access over the network.
Page 66: Manual Configuration
ONFIGURING THE WITCH Requests will be broadcast periodically by the switch for an IP address. (DHCP/BOOTP values can include the IP address, subnet mask, and default gateway.) • IP Address – Address of the VLAN interface that is allowed management access. Valid IP addresses consist of four numbers, 0 to 255, separated by periods.
Page 67: Using Dhcp/Bootp
CLI – Specify the management interface, IP address and default gateway. Console#config Console(config)#interface vlan 1 Console(config-if)#ip address 10.1.0.254 255.255.255.0 Console(config-if)#exit Console(config)#ip default-gateway 192.168.1.254 Console(config)# Using DHCP/BOOTP If your network provides DHCP/BOOTP services, you can configure the switch to be dynamically configured by these services. Web –...
Page 68 ONFIGURING THE WITCH CLI – Specify the management interface, and set the IP address mode to DHCP or BOOTP, and then enter the “ip dhcp restart” command. Console#config Console(config)#interface vlan 1 Console(config-if)#ip address dhcp Console(config-if)#end Console#ip dhcp restart Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: dhcp.
Page 69: Managing Firmware
Managing Firmware You can upload/download firmware to or from a TFTP server, or copy files to and from switch units in a stack. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation.
Page 70: Downloading System Software From A Server
ONFIGURING THE WITCH Downloading System Software from a Server When downloading runtime code, you can specify the destination file name to replace the current image, or first download the file using a different name from the current runtime code file, and then set the new file as the startup file.
Page 71: Figure 3-9 Select Start-Up Operation File
ASIC ONFIGURATION If you download to a new destination file, go to the System/File/Set Start-Up menu, mark the operation code file used at startup, and click Apply. To start the new firmware, reboot the system via the System/Reset menu. Figure 3-9 Select Start-Up Operation File To delete a file select System, File, Delete.
Page 72: Saving Or Restoring Configuration Settings
ONFIGURING THE WITCH CLI – To download new firmware form a TFTP server, enter the IP address of the TFTP server, select “opcode” as the file type, then enter the source and destination file names. When the file has finished downloading, set the new file to start up the system, and then restart the switch.
Page 73 - running-config to tftp – Copies the running configuration to a TFTP server. - startup-config to file – Copies the startup configuration to a file on the switch. - startup-config to running-config – Copies the startup config to the running config. - startup-config to tftp –...
Page 74: Downloading Configuration Settings From A Server
ONFIGURING THE WITCH Downloading Configuration Settings from a Server You can download the configuration file under a new file name and then set it as the startup file, or you can specify the current startup configuration file as the destination file to directly replace it. Note that the file “Factory_Default_Config.cfg”...
Page 75: Figure 3-12 Setting The Startup Configuration Settings
If you download to a new file name using “tftp to startup-config” or “tftp to file,” the file is automatically set as the start-up configuration file. To use the new settings, reboot the system via the System/Reset menu. Note that you can also select any configuration file as the start-up configuration by using the System/File/Set Start-Up page.
Page 76: Console Port Settings
ONFIGURING THE WITCH Console Port Settings You can access the onboard configuration program by attaching a VT100 compatible device to the switch’s serial console port. Management access through the console port is controlled by various parameters, including a password, timeouts, and basic communication settings. These parameters can be configured via the web or CLI interface.
Page 77: Figure 3-13 Console Port Settings
• Speed – Sets the terminal line’s baud rate for transmit (to terminal) and receive (from terminal). Set the speed to match the baud rate of the device connected to the serial port. (Range: 9600, 19200, 38400, 57600, or 115200 baud; Default: 9600 bps) •...
Page 78: Telnet Settings
ONFIGURING THE WITCH CLI – Enter Line Configuration mode for the console, then specify the connection parameters as required. To display the current console port settings, use the show line command from the Normal Exec level. Console(config)#line console Console(config-line)#login local Console(config-line)#password 0 secret Console(config-line)#timeout login response 0 Console(config-line)#exec-timeout 0...
Page 79 • Login Timeout – Sets the interval that the system waits for a user to log into the CLI. If a login attempt is not detected within the timeout interval, the connection is terminated for the session. (Range: 0-300 seconds; Default: 300 seconds) •...
Page 80: Figure 3-14 Enabling Telnet
ONFIGURING THE WITCH Web – Click System, Line, Telnet. Specify the connection parameters for Telnet access, then click Apply. CLI – Enter Line Configuration mode for a virtual terminal, then specify the connection parameters as required. To display the current virtual terminal settings, use the show line command from the Normal Exec level.
Page 81: Configuring Event Logging
Configuring Event Logging The switch allows you to control the logging of error messages, including the type of events that are recorded in switch memory, logging to a remote System Log (syslog) server, and displays a list of recent event messages. System Log Configuration The system allows you to enable or disable event logging, and specify which levels are logged to RAM or flash memory.
Page 82: Table 3-3 Logging Levels
ONFIGURING THE WITCH Level Severity Name Debug Informational Notice Warning Error Critical Alert Emergency * There are only Level 2, 5 and 6 error messages for the current firmware release. • RAM Level – Limits log messages saved to the switch’s temporary RAM memory for all levels up to the specified level.
Page 83: Remote Log Configuration
Web – Click System, Log, System Logs. Specify System Log Status, set the level of event messages to be logged to RAM and flash memory, then click Apply. CLI – Enable system logging and then specify the level of messages to be logged to RAM and flash memory.
Page 84 ONFIGURING THE WITCH Command Attributes • Remote Log Status – Enables/disables the logging of debug or error messages to the remote logging process. (Default: Enabled) • Logging Facility – Sets the facility type for remote logging of syslog messages. There are eight facility types specified by values of 16 to 23. The facility type is used by the syslog server to dispatch log messages to an appropriate service.
Page 85: Figure 3-16 Remote Logs
Web – Click System, Log, Remote Logs. To add an IP address to the Host IP List, type the new IP address in the Host IP Address box, and then click Add. To delete an IP address, click the entry in the Host IP List, and then click Remove.
Page 86: Displaying Log Messages
ONFIGURING THE WITCH Displaying Log Messages The Logs page allows you to scroll through the logged system and event messages. The switch can store up to 2048 log entries in temporary random access memory (RAM; i.e., memory flushed on power reset) and up to 4096 entries in permanent flash memory.
Page 87: Sending Simple Mail Transfer Protocol Alerts
Sending Simple Mail Transfer Protocol Alerts To alert system administrators of problems, the switch can use SMTP (Simple Mail Transfer Protocol) to send email messages when triggered by logging events of a specified level. The messages are sent to specified SMTP servers on the network and can be retrieved using POP or IMAP clients.
Page 88: Figure 3-18 Enabling And Configuring Smtp Alerts
ONFIGURING THE WITCH Web – Click System, Log, SMTP. Enable SMTP, specify a source email address, and select the minimum severity level. To add an IP address to the SMTP Server List, type the new IP address in the SMTP Server field and click Add.
Page 89: Resetting The System
CLI – Enter the IP address of at least one SMTP server, set the syslog severity level to trigger an email message, and specify the switch (source) and up to five recipient (destination) email addresses. Enable SMTP with the logging sendmail command to complete the configuration. Use the show logging sendmail command to display the current SMTP configuration.
Page 90: Setting The System Clock
ONFIGURING THE WITCH CLI – Use the reload command to restart the switch. When prompted, confirm that you want to reset the switch. Console#reload System will be restarted, continue <y/n>? y Note: When restarting the system, it will always run the Power-On Self-Test.
Page 91: Figure 3-20 Sntp Configuration
• SNTP Server – Sets the IP address for up to three time servers. The switch attempts to update the time from the first server, if this fails it attempts an update from the next server in the sequence. Web – Select SNTP, Configuration. Modify any of the required parameters, and click Apply.
Page 92: Setting The Time Zone
ONFIGURING THE WITCH Setting the Time Zone SNTP uses Coordinated Universal Time (or UTC, formerly Greenwich Mean Time, or GMT) based on the time at the Earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC.
Page 93: Simple Network Management Protocol
Simple Network Management Protocol Simple Network Management Protocol (SNMP) is a communication protocol designed specifically for managing devices on a network. Equipment commonly managed with SNMP includes switches, routers and host computers. SNMP is typically used to configure these devices for proper operation in a network environment, as well as to monitor them to evaluate performance or detect potential problems.
Page 94: Specifying Trap Managers And Trap Types
ONFIGURING THE WITCH • Access Mode - Read-Only – Specifies read-only access. Authorized management stations are only able to retrieve MIB objects. - Read/Write – Specifies read-write access. Authorized management stations are able to both retrieve and modify MIB objects. Web –...
Page 95: Figure 3-23 Configuring Ip Trap Managers
Command Attributes • Trap Manager Capability – This switch supports up to five trap managers. • Current – Displays a list of the trap managers currently configured. • Trap Manager IP Address – IP address of the host (the targeted recipient).
Page 96: User Authentication
ONFIGURING THE WITCH CLI – This example adds a trap manager and enables both authentication and link-up, link-down traps. Console(config)#snmp-server host 192.168.1.19 private version 2c Console(config)#snmp-server enable traps authentication User Authentication You can restrict management access to this switch using the following options: •...
Page 97: Figure 3-24 Access Levels
Command Attributes • Account List – Displays the current list of user accounts and associated access levels. (Defaults: admin, and guest) • New Account – Displays configuration settings for a new account. - User Name – The name of the user. (Maximum length: 8 characters;...
Page 98: Configuring Local/Remote Logon Authentication
ONFIGURING THE WITCH CLI – Assign a user name to access-level 15 (i.e., administrator), then specify the password. Console(config)#username bob access-level 15 Console(config)#username bob password 0 smith Console(config)# Configuring Local/Remote Logon Authentication Use the Authentication Settings menu to restrict management access based on specified user names and passwords.
Page 99 Command Usage • By default, management access is always checked against the authentication database stored on the local switch. If a remote authentication server is used, you must specify the authentication sequence and the corresponding parameters for the remote authentication protocol. Local and remote logon authentication control management access via the console port, web browser, or Telnet.
Page 100 ONFIGURING THE WITCH • RADIUS Settings - Global – Provides globally applicable RADIUS settings. - ServerIndex – Specifies one of five RADIUS servers that may be configured. The switch attempts authentication using the listed sequence of servers. The process ends when a server either approves or denies access to a user.
Page 101: Figure 3-25 Authentication Settings
UTHENTICATION Web – Click Security, Authentication Settings. To configure local or remote authentication preferences, specify the authentication sequence (i.e., one to three methods), fill in the parameters for RADIUS or TACACS+ authentication if selected, and click Apply. Figure 3-25 Authentication Settings 3-53...
Page 102: Configuring Https
ONFIGURING THE WITCH CLI – Specify all the required parameters to enable logon authentication. Console(config)#authentication login radius Console(config)#radius-server port 181 Console(config)#radius-server key green Console(config)#radius-server retransmit 5 Console(config)#radius-server timeout 10 Console(config)#radius-server 1 host 192.168.1.25 Console(config)#end Console#show radius-server Remote RADIUS server configuration: Global settings: Communication key with RADIUS server: ***** Server port number:...
Page 103: Table 3-4 Https System Support
• If you enable HTTPS, you must indicate this in the URL that you specify in your browser: https://device[:port_number] • When you start HTTPS, the connection is established in this way: - The client authenticates the server using the server’s digital certificate.
Page 104: Replacing The Default Secure-Site Certificate
ONFIGURING THE WITCH Web – Click Security, HTTPS Settings. Enable HTTPS and specify the port number, then click Apply. CLI – This example enables the HTTP secure server and modifies the port number. Console(config)#ip http secure-server Console(config)#ip http secure-port 441 Console(config)# Replacing the Default Secure-site Certificate When you log onto the web interface using HTTPS (for secure access), a...
Page 105: Configuring The Secure Shell
When you have obtained these, place them on your TFTP server, and use the following command at the switch's command-line interface to replace the default (unrecognized) certificate with an authorized one: Console#copy tftp https-certificate TFTP server ip address: <server ip-address> Source certificate file name: <certificate file name>...
Page 106 ONFIGURING THE WITCH Command Usage The SSH server on this switch supports both password and public key authentication. If password authentication is specified by the SSH client, then the password can be authenticated either locally or via a RADIUS or TACACS+ remote authentication server, as specified on the Authentication Settings page (page 3-50).
Page 107 3. Import Client’s Public Key to the Switch – Use the copy tftp public-key command (page 4-87) to copy a file containing the public key for all the SSH client’s granted management access to the switch. (Note that these clients must be configured locally on the switch via the User Accounts page as described on page 3-48.) The clients are subsequently authenticated using these keys.
Page 108: Generating The Host Key Pair
ONFIGURING THE WITCH e. The switch compares the decrypted bytes to the original bytes it sent. If the two sets match, this means that the client's private key corresponds to an authorized public key, and the client is authenticated. Notes: 1. To use SSH with only password authentication, the host public key must still be given to the client, either during initial connection or manually entered into the known host file.
Page 109 • Host-Key Type – The key type used to generate the host key pair (i.e., public and private keys). (Range: RSA (Version 1), DSA (Version 2), Both; Default: RSA) The SSH server uses RSA or DSA for key exchange when the client first establishes a connection with the switch, and then negotiates with the client to select either DES (56-bit) or 3DES (168-bit) for data encryption.
Page 110: Figure 3-27 Ssh Host-Key Settings
ONFIGURING THE WITCH Web – Click Security, SSH, Host-Key Settings. Select the host-key type from the drop-down box, select the option to save the host key from memory to flash (if required) prior to generating the key, and then click Generate.
Page 111: Configuring The Ssh Server
CLI – This example generates a host-key pair using both the RSA and DSA algorithms, stores the keys to flash memory, and then displays the host’s public keys. Console#ip ssh crypto host-key generate Console#ip ssh save host-key Console#show public-key host Host: RSA: 1024 65537...
Page 112: Figure 3-28 Ssh Server Settings
ONFIGURING THE WITCH • SSH Authentication Retries – Specifies the number of authentication attempts that a client is allowed before authentication fails and the client has to restart the authentication process. (Range: 1-5 times; Default: 3) • SSH Server-Key Size – Specifies the SSH server key size. (Range: 512-896 bits;...
Page 113: Configuring Port Security
CLI – This example enables SSH, sets the authentication parameters, and displays the current configuration. It shows that the administrator has made a connection via SHH, and then disables this connection. Console(config)#ip ssh server Console(config)#ip ssh timeout 100 Console(config)#ip ssh authentication-retries 5 Console(config)#ip ssh server-key size 512 Console(config)#end Console#show ip ssh...
Page 114 ONFIGURING THE WITCH already in the address table will be retained and will not age out. Any other device that attempts to use the port will be prevented from accessing the switch. Command Usage • A secure port has the following restrictions: - It cannot use port monitoring.
Page 115: Configuring 802.1X Port Authentication
Web – Click Security, Port Security. Set the action to take when an invalid address is detected on a port, mark the checkbox in the Status column to enable security for a port, set the maximum number of MAC addresses allowed on a port, and click Apply.
Page 116 ONFIGURING THE WITCH This switch uses the Extensible Authentication Protocol over LANs (EAPOL) to exchange authentication protocol messages with the client, and a remote RADIUS authentication server to verify user identity and access rights. When a client (i.e., Supplicant) connects to a switch port, the switch (i.e., Authenticator) responds with an EAPOL identity request.
Page 117: Displaying 802.1X Global Settings
• The RADIUS server and 802.1X client support EAP. (The switch only supports EAPOL in order to pass the EAP packets from the server to the client.) • The RADIUS server and client also have to support the same EAP authentication type –...
Page 118: Configuring 802.1X Global Settings
ONFIGURING THE WITCH CLI – This example shows the default global setting for 802.1X. Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status disabled disabled 802.1X Port Details 802.1X is disabled on port 1/1 802.1X is disabled on port 1/52 Console# Configuring 802.1X Global Settings The 802.1X protocol includes port authentication.
Page 119: Configuring Port Settings For 802.1X
Configuring Port Settings for 802.1X When 802.1X is enabled, you need to configure the parameters for the authentication process that runs between the client and the switch (i.e., authenticator), as well as the client identity lookup process that runs between the switch and authentication server. These parameters are described in this section.
Page 120: Figure 3-32 802.1X Port Configuration
ONFIGURING THE WITCH • Quiet Period – Sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. (Range: 1-65535 seconds; Default: 60) • Re-authen Period – Sets the time period after which a connected client must be re-authenticated.
Page 121 CLI – This example sets the 802.1X parameters on port 2. For a description of the additional fields displayed in this example, see “show dot1x” on page 4-114. Console(config)#interface ethernet 1/2 Console(config-if)#dot1x port-control auto Console(config-if)#dot1x re-authentication Console(config-if)#dot1x max-req 5 Console(config-if)#dot1x timeout quiet-period 30 Console(config-if)#dot1x timeout re-authperiod 1800 Console(config-if)#dot1x timeout tx-period 40 Console(config-if)#end...
Page 122: Displaying 802.1X Statistics
ONFIGURING THE WITCH Displaying 802.1X Statistics This switch can display statistics for dot1x protocol exchanges for any port. Parameter Rx EAPOL Start Rx EAPOL Logoff Rx EAPOL Invalid Rx EAPOL Total Rx EAP Resp/Id Rx EAP Resp/Oth Rx EAP LenError Rx Last EAPOLVer Rx Last EAPOLSrc Tx EAPOL Total...
Page 123: U Ser A Uthentication
Web – Select Security, 802.1X, Statistics. Select the required port and then click Query. Click Refresh to update the statistics. Figure 3-33 Displaying 802.1X Port Statistics CLI – This example displays the 802.1X statistics for port 4. Console#show dot1x statistics interface ethernet 1/4 Eth 1/4 Rx: EAPOL EAPOL...
Page 124: Filtering Addresses For Management Access
ONFIGURING THE WITCH Filtering Addresses for Management Access You create a list of up to 16 IP addresses or IP address groups that are allowed management access to the switch through the web interface, SNMP, or Telnet. Command Usage • The management interfaces are open to all IP addresses by default.
Page 125: Figure 3-34 Creating A Web Ip Filter List
• End IP Address – The end address of a range. • Add/Remove Filtering Entry – Adds/removes an IP address from the list. Web – Click Security, IP Filter. Enter the IP addresses or range of addresses that are allowed management access to an interface, and click Add IP Filtering Entry to update the filter list.
Page 126: Access Control Lists
ONFIGURING THE WITCH CLI – This example allows SNMP access for a specific client. Console(config)#management snmp-client 10.1.2.3 Console(config)#end Console#show management all-client Management IP Filter HTTP-Client: Start IP address ----------------------------------------------- 1. 10.1.2.1 SNMP-Client: Start IP address ----------------------------------------------- 1. 10.1.2.3 TELNET-Client: Start IP address ----------------------------------------------- Console# Access Control Lists...
Page 127: Setting The Acl Name And Type
Command Usage The following restrictions apply to ACLs: • Each ACL can have up to 32 rules. • The maximum number of ACLs is 88. • However, due to resource restrictions, the average number of rules bound to the ports should not exceed 20. •...
Page 128: Configuring A Standard Ip Acl
ONFIGURING THE WITCH MAC: MAC ACL mode that filters packets based on the source or destination MAC address and the Ethernet frame type (RFC 1060). Web – Click Security, ACL, Configuration. Enter an ACL name in the Name field, select the list type (IP Standard, IP Extended, or MAC), and click Add to open the configuration page for the new list.
Page 129: Figure 3-36 Acl Configuration - Standard Ip
• Subnet Mask – A subnet mask containing four integers from 0 to 255, each separated by a period. The mask uses 1 bits to indicate “match” and 0 bits to indicate “ignore.” The mask is bitwise ANDed with the specified source IP address, and compared with the address for each IP packet entering the port(s) to which this ACL has been assigned.
Page 130: Configuring An Extended Ip Acl
ONFIGURING THE WITCH Configuring an Extended IP ACL Command Attributes • Action – An ACL can contain any combination of permit or deny rules. • Source/Destination Address Type – Specifies the source or destination IP address. Use “Any” to include all possible addresses, “Host”...
Page 131: Figure 3-37 Acl Configuration - Extended Ip
- 4 (rst) – Reset - 8 (psh) – Push - 16 (ack) – Acknowledgement - 32 (urg) – Urgent pointer For example, use the code value and mask below to catch packets with the following flags set: - SYN flag valid, use control-code 2, control bitmask 2 - Both SYN and ACK valid, use control-code 18, control bitmask 18 - SYN valid and ACK invalid, use control-code 2, control bitmask 18 Web –...
Page 132: Configuring A Mac Acl
ONFIGURING THE WITCH CLI – This example adds two rules: 1. Accept any incoming packets if the source address is in subnet 10.7.1.x. For example, if the rule is matched; i.e., the rule (10.7.1.0 & 255.255.255.0) equals the masked address (10.7.1.2 & 255.255.255.0), the packet passes through.
Page 133: Figure 3-38 Acl Configuration - Mac
• Ethernet Type – This option can only be used to filter Ethernet II formatted packets. (Range: 0-65535) A detailed listing of Ethernet protocol types can be found in RFC 1060. A few of the more common types include 0800 (IP), 0806 (ARP), 8137 (IPX).
Page 134: Binding A Port To An Access Control List
ONFIGURING THE WITCH Binding a Port to an Access Control List After configuring Access Control Lists (ACL), you should bind them to the ports that need to filter traffic. You can assign one IP access list to any port, but you can only assign one MAC access list to all the ports on the switch.
Page 135: Port Configuration
CLI – This example assigns an IP and MAC access list to port 1, and an IP access list to port 3. Console(config)#interface ethernet 1/1 Console(config-if)#ip access-group david in Console(config-if)#mac access-group jerry in Console(config-if)#exit Console(config)#interface ethernet 1/3 Console(config-if)#ip access-group david in Console(config-if)# Port Configuration Displaying Connection Status...
Page 136: Figure 3-40 Displaying Port/Trunk Information
ONFIGURING THE WITCH Web – Click Port, Port Information or Trunk Information. Figure 3-40 Displaying Port/Trunk Information Field Attributes (CLI) Basic Information: • Port type – Indicates the port type. (100BASE-TX, 1000BASE-T, or SFP) • MAC address – The physical layer address for this port. (To access this item on the web, see “Setting the Switch’s IP Address”...
Page 137 • Capabilities – Specifies the capabilities to be advertised for a port during auto-negotiation. (To access this item on the web, see “Configuring Interface Connections” on page 3-48.) The following capabilities are supported. - 10half - Supports 10 Mbps half-duplex operation - 10full - Supports 10 Mbps full-duplex operation - 100half - Supports 100 Mbps half-duplex operation - 100full - Supports 100 Mbps full-duplex operation...
Page 138: Configuring Interface Connections
ONFIGURING THE WITCH CLI – This example shows the connection status for Port 5. Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: Mac address: Configuration: Name: Port admin: Speed-duplex: Capabilities: Broadcast storm: Broadcast storm limit: Flow control: Lacp: Port security:...
Page 139 • Autonegotiation (Port Capabilities) – Allows auto-negotiation to be enabled/disabled. When auto-negotiation is enabled, you need to specify the capabilities to be advertised. When auto-negotiation is disabled, you can force the settings for speed, mode, and flow control.The following capabilities are supported. - 10half - Supports 10 Mbps half-duplex operation - 10full - Supports 10 Mbps full-duplex operation - 100half - Supports 100 Mbps half-duplex operation...
Page 140: Creating Trunk Groups
ONFIGURING THE WITCH Web – Click Port, Port Configuration or Trunk Configuration. Modify the required interface settings, and click Apply. CLI – Select the interface, and then enter the required settings. Console(config)#interface ethernet 1/13 Console(config-if)#description RD SW#13 Console(config-if)#shutdown Console(config-if)#no shutdown Console(config-if)#no negotiation Console(config-if)#speed-duplex 100half Console(config-if)#flowcontrol...
Page 141 automatically negotiate a trunked link with LACP-configured ports on another device. You can configure any number of ports on the switch as LACP, as long as they are not already configured as part of a static trunk. If ports on another device are also configured as LACP, the switch and the other device will negotiate a trunk link between them.
Page 142: Statically Configuring A Trunk
ONFIGURING THE WITCH Statically Configuring a Trunk Command Usage • When configuring static trunks, you may not be able to link switches of different types, depending on the manufacturer’s implementation. However, note that the static trunks on this switch are Cisco EtherChannel compatible.
Page 143: Figure 3-42 Static Trunk Configuration
ONFIGURATION Web – Click Port, Trunk Membership. Enter a trunk ID of 1-4 in the Trunk field, select any of the switch ports from the scroll-down port list, and click Add. After you have completed adding ports to the member list, click Apply.
Page 144: Enabling Lacp On Selected Ports
ONFIGURING THE WITCH CLI – This example creates trunk 2 with ports 1 and 2. Just connect these ports to two static trunk ports on another switch to form a trunk. Console(config)#interface port-channel 2 Console(config-if)#exit Console(config)#interface ethernet 1/1 Console(config-if)#channel-group 2 Console(config-if)#exit Console(config)#interface ethernet 1/2 Console(config-if)#channel-group 2...
Page 145: Figure 3-43 Lacp Trunk Configuration
• A trunk formed with another switch using LACP will automatically be assigned the next available trunk ID. • If more than four ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails.
Page 146: Configuring Lacp Parameters
ONFIGURING THE WITCH CLI – The following example enables LACP for ports 1 to 6. Just connect these ports to LACP-enabled trunk ports on another switch to form a trunk. Console(config)#interface ethernet 1/1 Console(config-if)#lacp Console(config-if)#exit Console(config)#interface ethernet 1/6 Console(config-if)#lacp Console(config-if)#end Console#show interfaces status port-channel 1 Information of Trunk 1 Basic information:...
Page 147 Note: If the port channel admin key (lacp admin key, page 4-171) is not set (through the CLI) when a channel group is formed (i.e., it has a null value of 0), this key is set to the same value as the port admin key used by the interfaces that joined the group (lacp admin key, as described in this section and on page 4-170).
Page 148: Figure 3-44 Lacp - Aggregation Port
ONFIGURING THE WITCH Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and Port Priority for the Port Actor. You can optionally configure these settings for the Port Partner. (Be aware that these settings only affect the administrative state of the partner, and will not take effect until the next time an aggregate link is formed with this device.) After you have completed setting the port LACP parameters, click Apply.
Page 149: P Ort C Onfiguration
CLI – The following example configures LACP parameters for ports 1-4. Ports 1-4 are used as active members of the LAG. Console(config)#interface ethernet 1/1 Console(config-if)#lacp actor system-priority 3 Console(config-if)#lacp actor admin-key 120 Console(config-if)#lacp actor port-priority 128 Console(config-if)#exit Console(config)#interface ethernet 1/4 Console(config-if)#lacp actor system-priority 3 Console(config-if)#lacp actor admin-key 120 Console(config-if)#lacp actor port-priority 512...
Page 150: Displaying Lacp Port Counters
ONFIGURING THE WITCH Displaying LACP Port Counters You can display statistics for LACP protocol messages. Field LACPDUs Sent LACPDUs Received Marker Sent Marker Received LACPDUs Unknown Pkts LACPDUs Illegal Pkts Web – Click Port, LACP, Port Counters Information. Select a member port to display the corresponding information.
Page 151: Displaying Lacp Settings And Status For The Local Side
CLI – The following example displays LACP counters. Console#show lacp counters Port channel : 1 ------------------------------------------------------------------- Eth 1/ 1 ------------------------------------------------------------------- LACPDUs Sent: LACPDUs Receive: Marker Sent: Marker Receive: LACPDUs Unknown Pkts: 0 LACPDUs Illegal Pkts: 0 Displaying LACP Settings and Status for the Local Side You can display configuration settings and the operational state for the local side of an link aggregation.
Page 152 ONFIGURING THE WITCH Table 3-7 LACP Internal Configuration Information (Continued) Field LACP Port Priority Admin State, Oper State 3-104 Description LACP port priority assigned to this interface within the channel group. Administrative or operational values of the actor’s state parameters: •...
Page 153: Figure 3-46 Lacp - Port Internal Information
Web – Click Port, LACP, Port Internal Information. Select a port channel to display the corresponding information. Figure 3-46 LACP - Port Internal Information CLI – The following example displays the LACP configuration settings and operational state for the local side of port channel 1. Console#show lacp 1 internal Port channel : 1 -------------------------------------------------------------------...
Page 154: Displaying Lacp Settings And Status For The Remote Side3-107
ONFIGURING THE WITCH Displaying LACP Settings and Status for the Remote Side You can display configuration settings and the operational state for the remote side of an link aggregation. Table 3-8 LACP Neighbor Configuration Information Field Partner Admin System ID Partner Oper System Partner Admin Port Number...
Page 155: Figure 3-47 Lacp - Port Neighbors Information
Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-47 LACP - Port Neighbors Information CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1. Console#show lacp 1 neighbors Port channel 1 neighbors -------------------------------------------------------------------...
Page 156: Setting Broadcast Storm Thresholds
ONFIGURING THE WITCH Setting Broadcast Storm Thresholds Broadcast storms may occur when a device on your network is malfunctioning, or if application programs are not well designed or properly configured. If there is too much broadcast traffic on your network, performance can be severely degraded or everything can come to complete halt.
Page 157: Figure 3-48 Port Broadcast Control
ONFIGURATION Web – Click Port, Port/Trunk Broadcast Control. Set the threshold, mark the Enabled field for the desired interface and click Apply. Figure 3-48 Port Broadcast Control 3-109...
Page 158: Configuring Port Mirroring
ONFIGURING THE WITCH CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 600 octets per second for port 2 (which applies to all ports). Console(config)#interface ethernet 1/1 Console(config-if)#no switchport broadcast Console(config-if)#exit...
Page 159: Figure 3-49 Mirror Port Configuration
Command Attributes • Mirror Sessions – Displays a list of current mirror sessions. • Source Unit – The unit whose port traffic will be monitored. • Source Port – The port whose traffic will be monitored. • Type – Allows you to select which traffic to mirror to the target port, Rx (receive), or Tx (transmit).
Page 160: Configuring Rate Limits
ONFIGURING THE WITCH Configuring Rate Limits This function allows the network manager to control the maximum rate for traffic transmitted or received on a port. Rate limiting is configured on ports at the edge of a network to limit traffic coming into or out of the network.
Page 161: Rate Limit Configuration
CLI - This example sets and displays Fast Ethernet and Gigabit Ethernet granularity. Console(config)#rate-limit fastethernet granularity 512 Console(config)#rate-limit gigabitethernet granularity 33300 4-162 console#show rate-limit Fast ethernet granularity: Gigabit ethernet granularity: Console# Rate Limit Configuration Use the rate limit configuration pages to apply rate limiting. Command Usage •...
Page 162: Showing Port Statistics
ONFIGURING THE WITCH Web – Click Port, Rate Limit, Input/Output Port/Trunk Configuration. Enable the Rate Limit Status for the required interfaces, set the Rate Limit Level, and click Apply. Figure 3-51 Output Rate Limit Port Configuration CLI - This example sets the rate limit level for input and output traffic passing through port 3.
Page 163: Table 3-9 Port Statistics
Note: RMON groups 2, 3 and 9 can only be accessed using SNMP management software such as SMC EliteView. Parameter Interface Statistics Received Octets Received Unicast Packets Received Multicast Packets Received Broadcast Packets Received Discarded Packets Received Unknown Packets Received Errors Transmit Octets Transmit Unicast Packets...
Page 164 ONFIGURING THE WITCH Parameter Transmit Multicast Packets Transmit Broadcast Packets Transmit Discarded Packets Transmit Errors Etherlike Statistics Alignment Errors Late Collisions FCS Errors Excessive Collisions Single Collision Frames The number of successfully transmitted frames for Internal MAC Transmit Errors 3-116 Table 3-9 Port Statistics (Continued) Description The total number of packets that higher-level protocols...
Page 165 Table 3-9 Port Statistics (Continued) Parameter Multiple Collision Frames Carrier Sense Errors SQE Test Errors Frames Too Long Deferred Transmissions A count of frames for which the first transmission Internal MAC Receive Errors RMON Statistics Drop Events Jabbers Received Bytes Collisions Received Frames Broadcast Frames...
Page 166 ONFIGURING THE WITCH Parameter Multicast Frames CRC/Alignment Errors The number of CRC/alignment errors (FCS or Undersize Frames Oversize Frames Fragments 64 Bytes Frames 65-127 Byte Frames 128-255 Byte Frames 256-511 Byte Frames 512-1023 Byte Frames 1024-1518 Byte Frames 1519-1536 Byte Frames 3-118 Table 3-9 Port Statistics (Continued) Description...
Page 167: Figure 3-52 Port Statistics
ONFIGURATION Web – Click Port, Port Statistics. Select the required interface, and click Query. You can also use the Refresh button at the bottom of the page to update the screen. Figure 3-52 Port Statistics 3-119...
Page 168 ONFIGURING THE WITCH CLI – This example shows statistics for port 13. Console#show interfaces counters ethernet 1/13 Ethernet 1/13 Iftable stats: Octets input: 868453, Octets output: 3492122 Unicast input: 7315, Unitcast output: 6658 Discard input: 0, Discard output: 0 Error input: 0, Error output: 0 Unknown protos input: 0, QLen output: 0 Extended iftable stats: Multi-cast input: 0, Multi-cast output: 17027...
Page 169: Address Table Settings
Address Table Settings Switches store the addresses for all known devices. This information is used to pass traffic directly between the inbound and outbound ports. All the addresses learned by monitoring traffic are stored in the dynamic address table. You can also manually configure static addresses that are bound to a specific port.
Page 170: Displaying The Address Table
ONFIGURING THE WITCH Web – Click Address Table, Static Addresses. Specify the interface, the MAC address and VLAN, then click Add Static Address. Figure 3-53 Configuring a Static Address Table CLI – This example adds an address to the static address table, but sets it to be deleted when the switch is reset.
Page 171: Figure 3-54 Configuring A Dynamic Address Table
• VLAN – ID of configured VLAN (1-4094). • Address Table Sort Key – You can sort the information displayed based on MAC address, VLAN or interface (port or trunk). • Dynamic Address Counts – The number of addresses dynamically learned.
Page 172: Changing The Aging Time
ONFIGURING THE WITCH Changing the Aging Time You can set the aging time for entries in the dynamic address table. Command Attributes • Aging Status – Enables/disables the function. • Aging Time – The time after which a learned entry is discarded. (Range: 10-30000 seconds;...
Page 173 The spanning tree algorithms supported by this switch include these versions: • STP – Spanning Tree Protocol (IEEE 802.1D) • RSTP – Rapid Spanning Tree Protocol (IEEE 802.1w) STA uses a distributed algorithm to select a bridging device (STA-compliant switch, bridge or router) that serves as the root of the spanning tree network.
Page 174: Displaying Global Settings
ONFIGURING THE WITCH that can be used when a node or port fails, and retaining the forwarding database for ports insensitive to changes in the tree structure when reconfiguration occurs. Displaying Global Settings You can display a summary of the current bridge STA information that applies to the entire switch using the STA Information screen.
Page 175 • Designated Root – The priority and MAC address of the device in the Spanning Tree that this switch has accepted as the root device. - Root Port – The number of the port on this switch that is closest to the root.
Page 176: Figure 3-56 Sta Information
ONFIGURING THE WITCH • Root Forward Delay – The maximum time (in seconds) this device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a discarding state;...
Page 177: Each Port
CLI – This command displays global STA settings, followed by settings for each port. Console#show spanning-tree Spanning-tree information --------------------------------------------------------------- Spanning tree mode Spanning tree enable/disable Priority Bridge Hello Time (sec.) Bridge Max Age (sec.) Bridge Forward Delay (sec.) Root Hello Time (sec.) Root Max Age (sec.) Root Forward Delay (sec.) Designated Root...
Page 178: Configuring Global Settings
ONFIGURING THE WITCH Configuring Global Settings Global settings apply to the entire switch. Command Usage • Spanning Tree Protocol Uses RSTP for the internal state machine, but sends only 802.1D BPDUs. • Rapid Spanning Tree Protocol RSTP supports connections to either STP or RSTP nodes by monitoring the incoming protocol messages and dynamically adjusting the type of protocol messages the RSTP node transmits, as described below:...
Page 179 • Priority – Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device. (Note that lower numeric values indicate higher priority.) - Default: 32768 - Range: 0-61440, in steps of 4096...
Page 180 ONFIGURING THE WITCH • Forward Delay – The maximum time (in seconds) this device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a discarding state;...
Page 181: Figure 3-57 Sta Configuration
Web – Click Spanning Tree, STA, Configuration. Modify the required attributes, and click Apply. Figure 3-57 STA Configuration CLI – This example enables Spanning Tree Protocol, sets the mode to RSTP, and then configures the STA and RSTP parameters. Console(config)#spanning-tree Console(config)#spanning-tree mode rstp Console(config)#spanning-tree priority 45056 Console(config)#spanning-tree hello-time 5...
Page 182: Displaying Interface Settings
ONFIGURING THE WITCH Displaying Interface Settings The STA Port Information and STA Trunk Information pages display the current status of ports and trunks in the Spanning Tree. Field Attributes • Spanning Tree – Shows if STA has been enabled on this interface. •...
Page 183 • Designated Bridge – The bridge priority and MAC address of the device through which this port must communicate to reach the root of the Spanning Tree. • Designated Port – The port priority and number of the port on the designated bridging device through which this switch must communicate with the root of the Spanning Tree.
Page 184 ONFIGURING THE WITCH • Trunk Member – Indicates if a port is a member of a trunk. (STA Port Information only) These additional parameters are only displayed for the CLI: • Admin status – Shows if this interface is enabled. •...
Page 185: Figure 3-58 Sta Port Information
• Admin Edge Port – You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.
Page 186: Configuring Interface Settings
ONFIGURING THE WITCH CLI – This example shows the STA attributes for port 5. Console#show spanning-tree ethernet 1/5 1/ 5 information -------------------------------------------------------------- Admin status: Role: State: Path cost: Priority: Designated cost: Designated port Designated root: Designated bridge: Fast forwarding: Forward transitions: Admin edge port: Oper edge port: Admin Link type:...
Page 187 - Learning - Port has transmitted configuration messages for an interval set by the Forward Delay parameter without receiving contradictory information. Port address table is cleared, and the port begins learning addresses. - Forwarding - Port forwards packets, and continues learning addresses.
Page 188 ONFIGURING THE WITCH -Default: - Ethernet – Half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 - Fast Ethernet – Half duplex: 200,000; full duplex: 100,000; trunk: 50,000 - Gigabit Ethernet – Full duplex: 10,000; trunk: 5,000 • Admin Link Type – The link type attached to this interface. - Point-to-Point –...
Page 189: Vlan Configuration
Web – Click Spanning Tree, STA, Port Configuration or Trunk Configuration. Modify the required attributes, then click Apply. CLI – This example sets STA attributes for port 7. Console(config)#interface ethernet 1/7 Console(config-if)#spanning-tree port-priority 0 Console(config-if)#spanning-tree cost 50 Console(config-if)#spanning-tree link-type auto Console(config-if)#no spanning-tree edge-port Console(config-if)# VLAN Configuration...
Page 190: Assigning Ports To Vlans
ONFIGURING THE WITCH VLANs help to simplify network management by allowing you to move devices to a new VLAN without having to change any physical connections. VLANs can be easily organized to reflect departmental groups (such as Marketing or R&D), usage groups (such as e-mail), or multicast groups (used for multimedia applications such as videoconferencing).
Page 191 Note: VLAN-tagged frames can pass through VLAN-aware or VLAN-unaware network interconnection devices, but the VLAN tags should be stripped off before passing it on to any end-node host that does not support VLAN tagging. tagged frames VLAN Classification – When the switch receives a frame, it classifies the frame in one of two ways.
Page 192 ONFIGURING THE WITCH Automatic VLAN Registration – GVRP (GARP VLAN Registration Protocol) defines a system whereby the switch can automatically learn the VLANs to which each end station should be assigned. If an end station (or its network adapter) supports the IEEE 802.1Q VLAN protocol, it can be configured to broadcast a message to your network indicating the VLAN groups it wants to join.
Page 193 10 11 Forwarding Tagged/Untagged Frames If you want to create a small port-based VLAN for devices attached directly to a single switch, you can assign ports to the same untagged VLAN. However, to participate in a VLAN group that crosses several switches, you should create a VLAN for that group and enable tagging on all ports.
Page 194: Enabling Or Disabling Gvrp (Global Setting)
ONFIGURING THE WITCH Enabling or Disabling GVRP (Global Setting) GARP VLAN Registration Protocol (GVRP) defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. VLANs are dynamically configured based on join messages issued by host devices and propagated throughout the network.
Page 195: Displaying Current Vlans
Web – Click VLAN, 802.1Q VLAN, Basic Information. Figure 3-61 VLAN Basic Information CLI – Enter the following command. Console#show bridge-ext Max support vlan numbers: Max support vlan ID: Extended multicast filtering services: No Static entry individual port: VLAN learning: Configurable PVID tagging: Local VLAN capable: Traffic classes:...
Page 196: Figure 3-62 Displaying Current Vlans
ONFIGURING THE WITCH • Egress Ports – Shows all the VLAN port members. • Untagged Ports – Shows the untagged VLAN port members. Web – Click VLAN, 802.1Q VLAN, Current Table. Select any ID from the scroll-down list. Figure 3-62 Displaying Current VLANs Command Attributes (CLI) •...
Page 197: Creating Vlans
CLI – Current VLAN information can be displayed with the following command. Console#show vlan id 1 Vlan ID: Type: Static Name: DefaultVlan Status: Active Ports/Port Channel: Eth1/ 1(S) Eth1/ 2(S) Eth1/ 3(S) Eth1/ 4(S) Eth1/ 5(S) Eth1/ 6(S) Eth1/ 7(S) Eth1/ 8(S) Eth1/ 9(S) Eth1/10(S) Eth1/11(S) Eth1/12(S) Eth1/13(S) Eth1/14(S) Eth1/15(S) Eth1/16(S) Eth1/17(S) Eth1/18(S) Eth1/19(S) Eth1/20(S) Eth1/21(S) Eth1/22(S) Eth1/23(S) Eth1/24(S) Eth1/25(S)
Page 198: Figure 3-63 Configuring A Vlan Static List
ONFIGURING THE WITCH • State (CLI) – Enables or disables the specified VLAN. - Active: VLAN is operational. - Suspend: VLAN is suspended; i.e., does not pass packets. • Add – Adds a new VLAN group to the current list. •...
Page 199: Adding Static Members To Vlans (Vlan Index)
CLI – This example creates a new VLAN. Console(config)#vlan database Console(config-vlan)#vlan 2 name R&D media ethernet state active Console(config-vlan)#end Console#show vlan Vlan ID: Type: Static Name: DefaultVlan Status: Active Ports/Channel groups: Eth1/ 1(S) Eth1/ 2(S) Eth1/ 3(S) Eth1/ 4(S) Eth1/ 5(S) Eth1/ 6(S) Eth1/ 7(S) Eth1/ 8(S) Eth1/ 9(S) Eth1/10(S) Eth1/11(S) Eth1/12(S) Eth1/13(S) Eth1/14(S) Eth1/15(S) Eth1/16(S) Eth1/17(S) Eth1/18(S) Eth1/19(S) Eth1/20(S)
Page 200 ONFIGURING THE WITCH Command Attributes • VLAN – ID of configured VLAN (1-4094). • Name – Name of the VLAN (1 to 32 characters). • Status – Enables or disables the specified VLAN. - Enable: VLAN is operational. - Disable: VLAN is suspended; i.e., does not pass packets. •...
Page 201: Adding Static Members To Vlans (Port Index)
Web – Click VLAN, 802.1Q VLAN, Static Table. Select a VLAN ID from the scroll-down list. Modify the VLAN name and status if required. Select the membership type by marking the appropriate radio button in the list of ports or trunks. Click Apply. Figure 3-64 Configuring a VLAN Static Table CLI –...
Page 202: Figure 3-65 Vlan Static Membership By Port
ONFIGURING THE WITCH • Non-Member – VLANs for which the selected interface is not a tagged member. Web – Open VLAN, 802.1Q VLAN, Static Membership by Port. Select an interface from the scroll-down box (Port or Trunk). Click Query to display membership information for the interface.
Page 203: Configuring Vlan Behavior For Interfaces
Configuring VLAN Behavior for Interfaces You can configure VLAN behavior for specific interfaces, including the default VLAN identifier (PVID), accepted frame types, ingress filtering, GVRP status, and GARP timers. Command Usage • GVRP – GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network.
Page 204 ONFIGURING THE WITCH - If ingress filtering is disabled and a port receives frames tagged for VLANs for which it is not a member, these frames will be flooded to all other ports (except for those VLANs explicitly forbidden on this port).
Page 205: Figure 3-66 Vlan Port Configuration
• Mode – Indicates VLAN membership mode for an interface. (Default: Hybrid) - 1Q Trunk – Specifies a port as an end-point for a VLAN trunk. A trunk is a direct link between two switches, so the port transmits tagged frames that identify the source VLAN. Note that frames belonging to the port’s default VLAN (i.e., associated with the PVID) are also transmitted as tagged frames.
Page 206: Private Vlans
ONFIGURING THE WITCH CLI – This example sets port 3 to accept only tagged frames, assigns PVID 3 as the native VLAN ID, enables GVRP, sets the GARP timers, and then sets the switchport mode to hybrid. Console(config)#interface ethernet 1/3 Console(config-if)#switchport acceptable-frame-types tagged Console(config-if)#switchport ingress-filtering Console(config-if)#switchport native vlan 3...
Page 207: Displaying Current Private Vlans
To configure private VLANs, follow these steps: 1. Use the Private VLAN Configuration menu (page 3-161) to designate one or more isolated or community VLANs, and the primary VLAN that will channel traffic outside of the VLAN groups. 2. Use the Private VLAN Association menu (page 3-162) to map the secondary (i.e., isolate and community) VLAN(s) to the primary VLAN.
Page 208: Figure 3-67 Private Vlan Information
ONFIGURING THE WITCH Web – Click VLAN, Private VLAN, Information. Select the desired port from the VLAN ID drop-down menu. CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and are associated with VLAN 6.
Page 209: Configuring Private Vlans
Configuring Private VLANs The Private VLAN Configuration page is used to create/remove primary or community VLANs. Command Attributes • VLAN ID – ID of configured VLAN (1-4094). • Type – There are three types of VLANs within a private VLAN: - Primary VLANs –...
Page 210: Associating Vlans
ONFIGURING THE WITCH CLI – This example configures VLAN 5 as a primary VLAN, and VLAN 6 as a community VLAN and VLAN 7 as an isolated VLAN. Console(config)#vlan database Console(config-vlan)#private-vlan 5 primary Console(config-vlan)#private-vlan 6 community Console(config-vlan)#private-vlan 7 isolated Console(config-vlan)# Associating VLANs Each community or isolated VLAN must be associated with a primary VLAN.
Page 211: Displaying Private Vlan Interface Information
CLI – This example associates community VLANs 6 and 7 with primary VLAN 5. Console(config)#vlan database Console(config-vlan)#private-vlan 5 association 6 Console(config-vlan)#private-vlan 5 association 7 Console(config-vlan)# Displaying Private VLAN Interface Information Use the Private VLAN Port Information and Private VLAN Trunk Information menus to display the interfaces associated with private VLANs.
Page 212: Figure 3-70 Private Vlan Port Information
ONFIGURING THE WITCH • Isolated VLAN – Conveys traffic only between the VLAN’s isolated ports and promiscuous ports. Traffic between isolated ports within the VLAN is blocked. • Trunk – The trunk identifier. (Port Information only) Web – Click VLAN, Private VLAN, Port Information or Trunk Information.
Page 213: Configuring Private Vlan Interfaces
CLI – This example shows the switch configured with primary VLAN 5 and community VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as host ports and associated with VLAN 6. This means that traffic for port 4 and 5 can only pass through port 3.
Page 214: Figure 3-71 Private Vlan Port Configuration
ONFIGURING THE WITCH specify the associated primary VLAN. For “Host” type, the Primary VLAN displayed is the one to which the selected secondary VLAN has been associated. • Community VLAN – A community VLAN conveys traffic between community ports, and from community ports to their designated promiscuous ports.
Page 215: Class Of Service Configuration
CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and associated with VLAN 6.
Page 216: Figure 3-72 Port Priority Configuration
ONFIGURING THE WITCH Command Usage • This switch provides four priority queues for each port. It uses Weighted Round Robin to prevent head-of-queue blockage. • The default priority applies for an untagged frame received on a port set to accept all frame types (i.e, receives both untagged and tagged frames).
Page 217: Mapping Cos Values To Egress Queues
CLI – This example assigns a default priority of 5 to port 3. Console(config)#interface ethernet 1/3 Console(config-if)#switchport priority default 5 Console(config-if)#end Console#show interfaces switchport ethernet 1/3 Information of Eth 1/3 Broadcast threshold: LACP status: Ingress rate limit: disable, Level: 30 Egress rate limit: disable, Level: 30 VLAN membership mode: Ingress rule:...
Page 218: Table 3-11 Cos Priority Levels
ONFIGURING THE WITCH The priority levels recommended in the IEEE 802.1p standard for various network applications are shown in the following table. However, you can map the priority levels to the switch’s output queues in any way that benefits application traffic for your own network. Priority Level 0 (default) Command Attributes...
Page 219: Figure 3-73 Traffic Classes
Web – Click Priority, Traffic Classes. Assign priorities to the traffic classes (i.e., output queues), then click Apply. Figure 3-73 Traffic Classes CLI – The following example shows how to change the CoS assignments. Console(config)#interface ethernet 1/1 Console(config-if)#queue cos-map 0 0 Console(config-if)#queue cos-map 1 1 Console(config-if)#queue cos-map 2 2 Console(config-if)#end...
Page 220: Selecting The Queue Mode
ONFIGURING THE WITCH Selecting the Queue Mode You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
Page 221: Setting The Service Weight For Traffic Classes
Setting the Service Weight for Traffic Classes This switch uses the Weighted Round Robin (WRR) algorithm to determine the frequency at which it services each priority queue. As described in “Mapping CoS Values to Egress Queues” on page 3-169, the traffic classes are mapped to one of the four egress queues provided for each port.
Page 222: Layer 3/4 Priority Settings
ONFIGURING THE WITCH CLI – The following example shows how to assign WRR weights to each of the priority queues. Console(config)#queue bandwidth 6 9 12 Console(config)#exit Console#show queue bandwidth Queue ID Weight -------- ------ Console Layer 3/4 Priority Settings Mapping Layer 3/4 Priorities to CoS Values This switch supports several common methods of prioritizing layer 3/4 traffic to meet application requirements.
Page 223: Selecting Ip Precedence/Dscp Priority
Selecting IP Precedence/DSCP Priority The switch allows you to choose between using IP Precedence or DSCP priority. Select one of the methods or disable this feature. Command Attributes • Disabled – Disables both priority services. (This is the default setting.) •...
Page 224: Table 3-12 Mapping Ip Precedence
ONFIGURING THE WITCH Priority Level Command Attributes • IP Precedence Priority Table – Shows the IP Precedence to CoS map. • Class of Service Value – Maps a CoS value to the selected IP Precedence value. Note that “0” represents low priority and “7” represent high priority.
Page 225: Mapping Dscp Priority
CLI – The following example globally enables IP Precedence service on the switch, maps IP Precedence value 1 to CoS value 0 (on port 1), and then displays the IP Precedence settings. Console(config)#map ip precedence Console(config)#interface ethernet 1/1 Console(config-if)#map ip precedence 1 cos 0 Console(config-if)#end Console#show map ip precedence ethernet 1/1 Precedence mapping status: enabled...
Page 226: Figure 3-78 Mapping Ip Dscp Priority Values
ONFIGURING THE WITCH Table 3-13 Mapping DSCP Priority Values (Continued) IP DSCP Value 18, 20, 22, 24 26, 28, 30, 32, 34, 36 38, 40, 42 46, 56 Command Attributes • DSCP Priority Table – Shows the DSCP Priority to CoS map. •...
Page 227: Mapping Ip Port Priority
CLI – The following example globally enables DSCP Priority service on the switch, maps DSCP value 0 to CoS value 1 (on port 1), and then displays the DSCP Priority settings. Console(config)#map ip dscp Console(config)#interface ethernet 1/1 Console(config-if)#map ip dscp 1 cos 0 Console(config-if)#end Console#show map ip dscp ethernet 1/1 DSCP mapping status: enabled...
Page 228: Figure 3-79 Ip Port Priority Status
ONFIGURING THE WITCH Web – Click Priority, IP Port Priority Status. Set IP Port Priority Status to Enabled. Click Priority, IP Port Priority. Enter the port number for a network application in the IP Port Number box and the new CoS value in the Class of Service box, and then click Apply.
Page 229: Mapping Cos Values To Acls
CLI – The following example globally enables IP Port Priority service on the switch, maps HTTP traffic on port 5 to CoS value 0, and then displays all the IP Port Priority settings for that port. Console(config)#map ip port Console(config)#interface ethernet 1/5 Console(config-if)#map ip port 80 cos 0 Console(config-if)#end Console#show map ip port ethernet 1/5...
Page 230: Figure 3-81 Acl Cos Priority
ONFIGURING THE WITCH • CoS Priority – CoS value used for packets matching an IP ACL rule. (Range: 0-7) • ACL CoS Priority Mapping – Displays the configured information. Web – Click Priority, ACL CoS Priority. Enable mapping for any port, select an ACL from the scroll-down list, then click Add.
Page 231: Multicast Filtering
Multicast Filtering Multicasting is used to support real-time applications such as videoconferencing or streaming audio. A multicast server does not have to establish a separate connection with each client. It merely broadcasts its service to the network, and any hosts that want to receive the multicast register with their local multicast switch/router.
Page 232: Layer 2 Igmp (Snooping And Query)
ONFIGURING THE WITCH Layer 2 IGMP (Snooping and Query) IGMP Snooping and Query – If multicast routing is not supported on other switches in your network, you can use IGMP Snooping and Query (page 3-184) to monitor IGMP service requests passing between multicast clients and servers, and dynamically configure the switch ports which need to forward multicast traffic.
Page 233 • IGMP Querier – A router, or multicast-enabled switch, can periodically ask their hosts if they want to receive multicast traffic. If there is more than one router/switch on the LAN performing IP multicasting, one of these devices is elected “querier” and assumes the role of querying the LAN for group members.
Page 234: Figure 3-82 Igmp Configuration
ONFIGURING THE WITCH • IGMP Version — Sets the protocol version for compatibility with other devices on the network. (Range: 1-2; Default: 2) Notes: 1. All systems on the subnet must support the same version. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Timeout.
Page 235: Displaying Interfaces Attached To A Multicast Router
CLI – This example modifies the settings for multicast filtering, and then displays the current status. Console(config)#ip igmp snooping Console(config)#ip igmp snooping querier Console(config)#ip igmp snooping query-count 10 Console(config)#ip igmp snooping query-interval 100 Console(config)#ip igmp snooping query-max-response-time 20 Console(config)#ip igmp snooping router-port-expire-time 300 4-246 Console(config)#ip igmp snooping version 2 Console(config)#exit Console#show ip igmp snooping...
Page 236: Specifying Static Interfaces For A Multicast Router
ONFIGURING THE WITCH Web – Click IGMP Snooping, Multicast Router Port Information. Select the required VLAN ID from the scroll-down list to display the associated multicast routers. Figure 3-83 Multicast Router Port Information CLI – This example shows that Port 11 has been statically configured as a port attached to a multicast router.
Page 237: Displaying Port Members Of Multicast Services
• VLAN ID – Selects the VLAN to propagate all multicast traffic coming from the attached multicast router. • Port or Trunk – Specifies the interface attached to a multicast router. Web – Click IGMP Snooping, Static Multicast Router Port Configuration. Specify the interfaces attached to a multicast router, indicate the VLAN which will forward all the corresponding multicast traffic, and then click Add.
Page 238: Figure 3-85 Ip Multicast Registration Table
ONFIGURING THE WITCH • Multicast Group Port List – Shows the interfaces that have already been assigned to the selected VLAN to propagate a specific multicast service. Web – Click IGMP Snooping, IP Multicast Registration Table. Select a VLAN ID and the IP address for a multicast service from the scroll-down lists.
Page 239: Assigning Ports To Multicast Services
Assigning Ports to Multicast Services Multicast filtering can be dynamically configured using IGMP Snooping and IGMP Query messages as described in “Configuring IGMP snooping and Query Parameters” on page 3-133. For certain applications that require tighter control, you may need to statically configure a multicast service on the switch.
Page 240: Figure 3-86 Igmp Member Port Table
ONFIGURING THE WITCH Web – Click IGMP Snooping, IGMP Member Port Table. Specify the interface attached to a multicast service (via an IGMP-enabled switch or multicast router), indicate the VLAN that will propagate the multicast service, specify the multicast IP address, and click Add. After you have completed adding ports to the member list, click Apply.
Page 241: Command Line Interface
OMMAND This chapter describes how to use the Command Line Interface (CLI). Using the Command Line Interface Accessing the CLI When accessing the management interface for the switch over a direct connection to the server’s console port, or via a Telnet connection, the switch can be managed by entering command keywords and parameters at the prompt.
Page 242: Telnet Connection
OMMAND NTERFACE After connecting to the system through the console port, the login screen displays: User Access Verification Username: admin Password: CLI session with the SMC6752AL2 is opened. To end the CLI session, enter [Exit]. Console# Telnet Connection Telnet operates over the IP transport protocol. In this environment, your management station and any network device you want to manage over the network must have a valid IP address.
Page 243 2. At the prompt, enter the user name and system password. The CLI will display the “Vty-n#” prompt for the administrator to show that you are using privileged access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you are using normal access mode (i.e., Normal Exec), where n indicates the number of the current Telnet session.
Page 244: Entering Commands
OMMAND NTERFACE Entering Commands This section describes how to enter CLI commands. Keywords and Arguments A CLI command is a series of keywords and arguments. Keywords identify a command, and arguments specify configuration parameters. For example, in the command “show interfaces status ethernet 1/5,” show interfaces and status are keywords, ethernet is an argument that specifies the interface type, and 1/5 specifies the unit/port.
Page 245: Command Completion
Command Completion If you terminate input with a Tab key, the CLI will print the remaining characters of a partial keyword up to the point of ambiguity. In the “logging history” example, typing log followed by a tab will result in printing the command up to “logging.”...
Page 246: Showing Commands
OMMAND NTERFACE Showing Commands If you enter a “?” at the command prompt, the system will display the first level of keywords for the current command class (Normal Exec or Privileged Exec) or configuration class (Global, ACL, Interface, Line or VLAN Database).
Page 247: Partial Keyword Lookup
The command “show interfaces ?” will display the following information: Console#show interfaces ? counters status switchport Console# Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided. (Remember not to leave a space between the command and question mark.) For example “s?”...
Page 248: Understanding Command Modes
OMMAND NTERFACE Understanding Command Modes The command set is divided into Exec and Configuration classes. Exec commands generally display information on system status or clear statistical counters. Configuration commands, on the other hand, modify interface parameters or enable certain switching functions. These classes are further divided into different modes.
Page 249: Configuration Commands
To enter Privileged Exec mode, enter the following user names and passwords: Username: admin Password: [admin login password] CLI session with the SMC6752AL2 is opened. To end the CLI session, enter [Exit]. Console# Username: guest Password: [guest login password] CLI session with the SMC6752AL2 is opened. To end the CLI session, enter [Exit].
Page 250: Table 4-2 Configuration Modes
OMMAND NTERFACE • VLAN Configuration - Includes the command to create VLAN groups. To enter the Global Configuration mode, enter the command configure in Privileged Exec mode. The system prompt will change to “Console(config)#” which gives you access privilege to all Global Configuration commands.
Page 251: Command Line Processing
Command Line Processing Commands are not case sensitive. You can abbreviate commands and parameters as long as they contain enough letters to differentiate them from any other currently available commands or parameters. You can use the Tab key to complete partial commands, or enter a partial command followed by the “?”...
Page 252: Command Groups
OMMAND NTERFACE Command Groups The system commands can be broken down into the functional groups shown below Command Group Description Line General System Management Flash/File Authentication Access Control List Provides filtering for IP frames (based on address, SNMP Interface Mirror Port Rate Limiting Link Aggregation 4-12...
Page 253 Table 4-4 Command Groups (Continued) Command Group Description Address Table Configures the address table for filtering specified addresses, displays current entries, clears the table, or sets the aging time Spanning Tree Configures Spanning Tree settings for the switch VLANs Configures VLAN settings, and defines port membership for VLAN groups;...
Page 254: Line Commands
OMMAND NTERFACE Line Commands You can access the onboard configuration program by attaching a VT100 compatible device to the server’s serial port. These commands are used to set communication parameters for the serial port or Telnet (i.e., a virtual terminal). Command line login...
Page 255: Line
line This command identifies a specific line for configuration, and to process subsequent line configuration commands. Syntax line {console | vty} • console - Console terminal line. • vty - Virtual terminal for remote console access (i.e., Telnet). Default Setting There is no default line.
Page 256: Login
OMMAND NTERFACE login This command enables password checking at login. Use the no form to disable password checking and allow connections without a password. Syntax login [local] no login local - Selects local password checking. Authentication is based on the user name specified with the username command. Default Setting login local Command Mode...
Page 257: Password
Example Console(config-line)#login local Console(config-line)# Related Commands username (4-35) password (4-17) password This command specifies the password for a line. Use the no form to remove the password. Syntax password {0 | 7} password no password • {0 | 7} - 0 means plain password, 7 means encrypted password •...
Page 258: Timeout Login Response
OMMAND NTERFACE configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords. Example Console(config-line)#password 0 secret Console(config-line)# Related Commands login (4-16) password-thresh (4-20) timeout login response This command sets the interval that the system waits for a user to log into the CLI.
Page 259: Exec-Timeout
Example To set the timeout to two minutes, enter this command: Console(config-line)#timeout login response 120 Console(config-line)# Related Commands silent-time (4-21) exec-timeout (4-14) exec-timeout This command sets the interval that the system waits until user input is detected. Use the no form to restore the default. Syntax exec-timeout [seconds] no exec-timeout...
Page 260: Password-Thresh
OMMAND NTERFACE Example To set the timeout to two minutes, enter this command: Console(config-line)#exec-timeout 120 Console(config-line)# Related Commands silent-time (4-21) timeout login response (4-13) password-thresh This command sets the password intrusion threshold which limits the number of failed logon attempts. Use the no form to remove the threshold value.
Page 261: Silent-Time
Example To set the password threshold to five attempts, enter this command: Console(config-line)#password-thresh 5 Console(config-line)# Related Commands silent-time (4-21) timeout login response (4-13) silent-time This command sets the amount of time the management console is inaccessible after the number of unsuccessful logon attempts exceeds the threshold set by the password-thresh command.
Page 262: Databits
OMMAND NTERFACE databits This command sets the number of data bits per character that are interpreted and generated by the console port. Use the no form to restore the default value. Syntax databits {7 | 8} no databits • 7 - Seven data bits per character. •...
Page 263: Parity
parity This command defines the generation of a parity bit. Use the no form to restore the default setting. Syntax parity {none | even | odd} no parity • none - No parity • even - Even parity • odd - Odd parity Default Setting No parity Command Mode...
Page 264: Stopbits
OMMAND NTERFACE Default Setting 9600 Command Mode Line Configuration Command Usage Set the speed to match the baud rate of the device connected to the serial port. Some baud rates available on devices connected to the port might not be supported. The system indicates if the speed you selected is not supported.
Page 265: Disconnect
disconnect This command terminates an SSH, Telnet, or console connection. Syntax disconnect session-id session-id – The session identifier for an SSH, Telnet or console connection. (Range: 0-4) Command Mode Privileged Exec Command Usage Specifying session identifier “0” will disconnect the console connection.
Page 266: General Commands
OMMAND NTERFACE Example To show all lines, enter this command: Console#show line Console configuration: Password threshold: Interactive timeout: Disabled Login timeout: Disabled Silent time: Baudrate: Databits: Parity: Stopbits: VTY configuration: Password threshold: Interactive timeout: 600 sec Login timeout: 300 sec console# General Commands Command...
Page 267: Enable
enable This command activates Privileged Exec mode. In privileged mode, additional commands are available, and certain commands display additional information. See “Understanding Command Modes” on page 4-8. Syntax enable [level] level - Privilege level to log into the device. The device has two predefined privilege levels: 0: Normal Exec, 15: Privileged Exec.
Page 268: Disable
OMMAND NTERFACE disable This command returns to Normal Exec mode from privileged mode. In normal access mode, you can only display basic information on the switch's configuration or Ethernet statistics. To gain access to all commands, you must use the privileged mode. See “Understanding Command Modes”...
Page 269: Show History
Example Console#configure Console(config)# Related Commands end (4-30) show history This command shows the contents of the command history buffer. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The history buffer size is fixed at 10 Execution commands and 10 Configuration commands.
Page 270: Reload
OMMAND NTERFACE The ! command repeats commands from the Execution command history buffer when you are in Normal Exec or Privileged Exec Mode, and commands from the Configuration command history buffer when you are in any of the configuration modes. In this example, the !2 command repeats the second command in the Execution history buffer (config).
Page 271: Exit
Command Mode Global Configuration, Interface Configuration, Line Configuration, and VLAN Database Configuration. Example This example shows how to return to the Privileged Exec mode from the Interface Configuration mode: Console(config-if)#end Console# exit This command returns to the previous configuration mode or exit the configuration program.
Page 272: System Management Commands
OMMAND NTERFACE Command Mode Normal Exec, Privileged Exec Command Usage The quit and exit commands can both exit the configuration program. Example This example shows how to quit a CLI session: Console#quit Press ENTER to start session User Access Verification Username: System Management Commands These commands are used to control system logs, passwords, user names,...
Page 273: Device Designation Commands
Table 4-7 System Management Commands (Continued) Command Group Function System Status Frame Size Device Designation Commands Table 4-8 Device Designation Commands Command Function prompt Customizes the prompt used in PE and NE mode GC hostname Specifies the host name for the switch snmp-server Sets the system contact string contact...
Page 274: Hostname
OMMAND NTERFACE hostname This command specifies or modifies the host name for this device. Use the no form to restore the default host name. Syntax hostname name no hostname name - The name of this host. (Maximum length: 255 characters) Default Setting None Command Mode...
Page 275: Username
username This command adds named users, requires authentication at login, specifies or changes a user's password (or specify that no password is required), or specifies or changes a user's access level. Use the no form to remove a user name. Syntax username name {access-level level | nopassword | password {0 | 7} password}...
Page 276: Enable Password
OMMAND NTERFACE Command Usage The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords.
Page 277: Table 4-11 Ip Filter Commands
Command Usage • You cannot set a null password. You will have to enter a password to change the command mode from Normal Exec to Privileged Exec with the enable command (page 4-27). • The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server.
Page 278: Management
OMMAND NTERFACE management This command specifies the client IP addresses that are allowed management access to the switch through various protocols. Use the no form to restore the default setting. Syntax [no] management {all-client | http-client | snmp-client | telnet-client} start-address [end-address] •...
Page 279: Show Management
• You can delete an address range just by specifying the start address, or by specifying both the start address and end address. Example This example restricts management access to the indicated addresses. Console(config)#management all-client 192.168.1.19 Console(config)#management all-client 192.168.1.25 192.168.1.30 Console(config)# show management This command displays the client IP addresses that are allowed...
Page 280: Table 4-12 Web Server Commands
OMMAND NTERFACE Example Console#show management all-client Management IP Filter HTTP-Client: Start IP address ----------------------------------------------- 1. 192.168.1.19 2. 192.168.1.25 SNMP-Client: Start IP address ----------------------------------------------- 1. 192.168.1.19 2. 192.168.1.25 TELNET-Client: Start IP address ----------------------------------------------- 1. 192.168.1.19 2. 192.168.1.25 Console# Web Server Commands Command Function ip http port...
Page 281: Ip Http Port
ip http port This command specifies the TCP port number used by the web browser interface. Use the no form to use the default port. Syntax ip http port port-number no ip http port port-number - The TCP port to be used by the browser interface. (Range: 1-65535) Default Setting Command Mode...
Page 282: Ip Http Secure-Server
OMMAND NTERFACE Example Console(config)#ip http server Console(config)# Related Commands ip http port (4-41) ip http secure-server This command enables the secure hypertext transfer protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Use the no form to disable this function.
Page 283: Ip Http Secure-Port
• A padlock icon should appear in the status bar for Internet Explorer 5.x and Netscape Navigator 6.2 or later versions. • The following web browsers and operating systems currently support HTTPS: Web Browser Internet Explorer 5.0 or later Netscape Navigator 6.2 or later •...
Page 284: Ip Telnet Port
OMMAND NTERFACE Command Mode Global Configuration Command Usage • You cannot configure the HTTP and HTTPS servers to use the same port. • If you change the HTTPS port number, clients attempting to connect to the HTTPS server must specify the port number in the URL, in this format: https://device:port_number Example...
Page 285: Ip Telnet Server
Default Setting Command Mode Global Configuration Example Console(config)#ip telnet port 123 Console(config)# Related Commands ip telnet server (4-45) ip telnet server This command allows this device to be monitored or configured from Telnet. Use the no form to disable this function. Syntax [no] ip telnet server Default Setting...
Page 286: Secure Shell Commands
OMMAND NTERFACE Secure Shell Commands The Berkley-standard includes remote access tools originally designed for Unix systems. Some of these tools have also been implemented for Microsoft Windows and other environments. These tools, including commands such as rlogin (remote login), rsh (remote shell), and rcp (remote copy), are not secure from hostile attacks.
Page 287 Table 4-15 SSH Commands (Continued) Command Function ip ssh crypto Generates the host key host-key generate ip ssh crypto zeroize Clear the host key from RAM ip ssh save host-key Saves the host key from RAM to flash memory disconnect Terminates a line connection show ip ssh Displays the status of the SSH server and...
Page 288 OMMAND NTERFACE 2. Provide Host Public Key to Clients – Many SSH client programs automatically import the host public key during the initial connection setup with the switch. Otherwise, you need to manually create a known hosts file on the management station and place the host public key in it. An entry for a public key in the known hosts file would appear similar to the following example: 10.1.0.54 1024 35 15684995401867669259333946775054617325313674890836547254...
Page 289: Ip Ssh Server
The client sends its public key to the switch. b. The switch compares the client's public key to those stored in memory. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. d.
Page 290: Ip Ssh Timeout
OMMAND NTERFACE • You must generate the host key before enabling the SSH server. Example Console#ip ssh crypto host-key generate dsa Console#configure Console(config)#ip ssh server Console(config)# Related Commands ip ssh crypto host-key generate (4-53) show ssh (4-55) ip ssh timeout This command configures the timeout for the SSH server.
Page 291: Ip Ssh Authentication-Retries
Related Commands exec-timeout (4-19) show ip ssh (4-55) ip ssh authentication-retries This command configures the number of times the SSH server attempts to reauthenticate a user. Use the no form to restore the default setting. Syntax ip ssh authentication-retries count no ip ssh authentication-retries count –...
Page 292: Delete Public-Key
OMMAND NTERFACE Default Setting 768 bits Command Mode Global Configuration Command Usage • The server key is a private key that is never shared outside the switch. • The host key is shared with the SSH client, and is fixed at 1024 bits. Example Console(config)#ip ssh server-key size 512 Console(config)#...
Page 293: Ip Ssh Crypto Host-Key Generate
ip ssh crypto host-key generate This command generates the host key pair (i.e., public and private). Syntax ip ssh crypto host-key generate [dsa | rsa] • dsa – DSA (Version 2) key type. • rsa – RSA (Version 1) key type. Default Setting Generates both the DSA and RSA key pairs.
Page 294: Ip Ssh Crypto Zeroize
OMMAND NTERFACE ip ssh crypto zeroize This command clears the host key from memory (i.e. RAM). Syntax ip ssh crypto zeroize [dsa | rsa] • dsa – DSA key type. • rsa – RSA key type. Default Setting Clears both the DSA and RSA key. Command Mode Privileged Exec Command Usage...
Page 295: Show Ssh
Default Setting Saves both the DSA and RSA key. Command Mode Privileged Exec Example Console#ip ssh save host-key dsa Console# Related Commands ip ssh crypto host-key generate (4-53) show ip ssh This command displays the connection settings used when authenticating client access to the SSH server.
Page 296: Table 4-16 Show Ssh - Display Description
OMMAND NTERFACE Field Description Session The session number. (Range: 0-3) Version The Secure Shell version number. State The authentication negotiation state. (Values: Negotiation-Started, Authentication-Started, Session-Started) Username The user name of the client. Encryption The encryption method is automatically negotiated between the client and server.
Page 297: Show Public-Key
show public-key This command shows the public key for the specified user or for the host. Syntax show public-key [user [username]| host] username – Name of an SSH user. (Range: 1-8 characters) Default Setting Shows all public keys. Command Mode Privileged Exec Command Usage •...
Page 298 OMMAND NTERFACE Example Console#show public-key host Host: RSA: 1024 35 1568499540186766925933394677505461732531367489083654725415020245593 1998685443583616519999233297817660658309586108259132128902337654680 1726272571413428762941301196195566782595664104869574278881462065194 1746772984865468615717739390164779355942303577413098022737087794545 24083971752646358058176716709574804776117 DSA: ssh-dss AAAB3NzaC1kc3MAAACBAPWKZTPbsRIB8ydEXcxM3dyV/yrDbKStIlnzD/ Dg0h2HxcYV44sXZ2JXhamLK6P8bvuiyacWbUWa4PAtp1KMSdqsKeh3hKoA3vRRSy1N2 XFfAKxl5fwFfvJlPdOkFgzLGMinvSNYQwiQXbKTBH0Z4mUZpE85PWxDZMaCNBPjBrRA AAAFQChb4vsdfQGNIjwbvwrNLaQ77isiwAAAIEAsy5YWDC99ebYHNRj5kh47wY4i8cZ vH+p9cnrfwFTMU01VFDly3IR2G395NLy5Qd7ZDxfA9mCOfTyyEfbobMJZi8oGCstSNO xrZZVnMqWrTYfdrKX7YKBw/Kjw6Bm iFq7O+jAhf1Dg45loAc27s6TLdtny1wRq/ ow2eTCD5nekAAACBAJ8rMccXTxHLFAczWS7EjOyDbsloBfPuSAb4oAsyjKXKVYNLQkT LZfcFRu41bS2KV5LAwecsigF+DjKGWtPNIQqabKgYCw2odVzX4Gg+yqdTlYmGA7fHGm 8ARGeiG4ssFKy4Z6DmYPXFum1Yg0fhLwuHpOSKdxT3kk475S7 w0W Console# 4-58...
Page 299: Logging On
Event Logging Commands Command logging on logging history logging host logging facility logging trap clear logging show logging show log logging on This command controls logging of error messages, sending debug or error messages to switch memory. The no form disables the logging process. Syntax [no] logging on Default Setting...
Page 300: Logging History
OMMAND NTERFACE Example Console(config)#logging on Console(config)# Related Commands logging history (4-60) clear logging (4-64) logging history This command limits syslog messages saved to switch memory based on severity. The no form returns the logging of syslog messages to the default level.
Page 301: Logging Host
Level Severity Name alerts emergencies * There are only Level 2, 5 and 6 error messages for the current firmware release. Default Setting Flash: errors (level 3 - 0) RAM: warnings (level 6 - 0) Command Mode Global Configuration Command Usage The message level specified for flash memory must be a higher priority (i.e., numerically lower) than that specified for RAM.
Page 302: Logging Facility
OMMAND NTERFACE Command Usage • By using this command more than once you can build up a list of host IP addresses. • The maximum number of host IP addresses allowed is five. Example Console(config)#logging host 10.1.0.3 Console(config)# logging facility This command sets the facility type for remote logging of syslog messages.
Page 303: Logging Trap
logging trap This command enables the logging of system messages to a remote server, or limits the syslog messages saved to a remote server based on severity. Use this command without a specified level to enable remote logging. Use the no form to disable remote logging. Syntax logging trap [level] no logging trap...
Page 304: Clear Logging
OMMAND NTERFACE clear logging This command clears messages from the log buffer. Syntax clear logging [flash | ram] • flash - Event history stored in flash memory (i.e., permanent memory). • ram - Event history stored in temporary RAM (i.e., memory flushed on power reset).
Page 305: Table 4-19 Show Logging Flash/Ram - Display Description
Default Setting None Command Mode Privileged Exec Example The following example shows that system logging is enabled, the message level for flash memory is “errors” (i.e., default level 3 - 0), the message level for RAM is “informational” (i.e., default level 6 - 0). Console#show logging flash Syslog logging: History logging in FLASH: level errors...
Page 306: Table 4-20 Show Logging Trap - Display Description
OMMAND NTERFACE The following example displays settings for the trap function. Console#show logging trap Syslog logging: REMOTELOG status: REMOTELOG facility type: REMOTELOG level type: REMOTELOG server IP address: 0.0.0.0 REMOTELOG server IP address: 0.0.0.0 REMOTELOG server IP address: 0.0.0.0 REMOTELOG server IP address: 0.0.0.0 REMOTELOG server IP address: 0.0.0.0 Console# Table 4-20 show logging trap - display description...
Page 307: Show Log
show log This command displays the system and event messages stored in memory. Syntax show log {flash | ram} [login] [tail] • flash - Event history stored in flash memory (i.e., permanent memory). • ram - Event history stored in temporary RAM (i.e., memory flushed on power reset).
Page 308: Logging Sendmail Host
OMMAND NTERFACE SMTP Alert Commands These commands configure SMTP event handling, and forwarding of alert messages to the specified SMTP servers and email recipients. Command logging sendmail host logging sendmail level logging sendmail source-email logging sendmail destination-email logging sendmail show logging sendmail logging sendmail host This command specifies SMTP servers that will be sent alert messages.
Page 309: Logging Sendmail Level
• To send email alerts, the switch first opens a connection, sends all the email alerts waiting in the queue one by one, and finally closes the connection. • To open a connection, the switch first selects the server that successfully sent mail during the last connection, or the first server configured by this command.
Page 310: Logging Sendmail Source-Email
OMMAND NTERFACE logging sendmail source-email This command sets the email address used for the “From” field in alert messages. Use the no form to delete the source email address. Syntax [no] logging sendmail source-email email-address email-address - The source email address used in alert messages. (Range: 0-41 characters) Default Setting None...
Page 311: Logging Sendmail
Command Mode Global Configuration Command Usage You can specify up to five recipients for alert messages. However, you must enter a separate command to specify each recipient. Example Console(config)#logging sendmail destination-email ted@this-company.com Console(config)# logging sendmail This command enables SMTP event handling. Use the no form to disable this function.
Page 312: Time Commands
OMMAND NTERFACE Example Console#show logging sendmail SMTP servers ----------------------------------------------- 1. 192.168.1.200 SMTP minimum severity level: 4 SMTP destination email addresses ----------------------------------------------- 1. ted@this-company.com SMTP source email address: SMTP status: Console# Time Commands The system clock can be dynamically set by polling a set of specified time servers (NTP or SNTP).
Page 313: Sntp Client
sntp client This command enables SNTP client requests for time synchronization from NTP or SNTP time servers specified with the sntp servers command. Use the no form to disable SNTP client requests. Syntax [no] sntp client Default Setting Disabled Command Mode Global Configuration Command Usage •...
Page 314: Sntp Server
OMMAND NTERFACE sntp server This command sets the IP address of the servers to which SNTP time requests are issued. Use the this command with no arguments to clear all time servers from the current list. Syntax sntp server [ip1 [ip2 [ip3]]] ip - IP address of a time server (NTP or SNTP).
Page 315: Sntp Poll
sntp poll This command sets the interval between sending time requests when the switch is set to SNTP client mode. Use the no form to restore to the default. Syntax sntp poll seconds no sntp poll seconds - Interval between time requests. (Range: 16-16384 seconds) Default Setting 16 seconds Command Mode...
Page 316: Clock Timezone
OMMAND NTERFACE Example Console#show sntp Current time: Poll interval: 16 Current mode: SNTP status : Enabled SNTP server 137.92.140.80 0.0.0.0 0.0.0.0 Current server: 137.92.140.80 Console# clock timezone This command sets the time zone for the switch’s internal clock. Syntax clock timezone name hour hours minute minutes {before-utc | after-utc} •...
Page 317: Calendar Set
Example Console(config)#clock timezone Japan hours 8 minute 0 after-UTC Console(config)# Related Commands show sntp (4-75) calendar set This command sets the system clock. It may be used if there is no time server on your network, or if you have not configured the switch to receive signals from a time server.
Page 318: Show Calendar
OMMAND NTERFACE show calendar This command displays the system clock. Default Setting None Command Mode Normal Exec, Privileged Exec Example Console#show calendar 15:12:45 April 1 2004 Console# System Status Commands Command show startup-config show running-config show system show users show version 4-78 Table 4-23 System Status Commands Function...
Page 319: Show Startup-Config
show startup-config This command displays the configuration file stored in non-volatile memory that is used to start up the system. Default Setting None Command Mode Privileged Exec Command Usage • Use this command in conjunction with the show running-config command to compare the information in running memory to the information stored in non-volatile memory.
Page 320 OMMAND NTERFACE Example Console#show startup-config building startup-config, please wait... username admin access-level 15 username admin password 0 admin username guest access-level 0 username guest password 0 guest enable password level 15 0 super snmp-server community public ro snmp-server community private rw logging history ram 6 logging history flash 3 vlan database...
Page 321: Show Running-Config
show running-config This command displays the configuration information currently in use. Default Setting None Command Mode Privileged Exec Command Usage • Use this command in conjunction with the show startup-config command to compare the information in running memory to the information stored in non-volatile memory.
Page 322 OMMAND NTERFACE Example Console#show running-config building running-config, please wait... phymap 00-30-f1-d3-26-00 SNTP server 0.0.0.0 0.0.0.0 0.0.0.0 clock timezone SNMP-server community private rw SNMP-server community public ro username admin access-level 15 username admin password 7 21232f297a57a5a743894a0e4a801fc3 username guest access-level 0 username guest password 7 084e0343a0486ff05530df6c705c8bb4 enable password level 15 7 1b3231655cebb7a1f783eddf27d254ca logging history ram 6 logging history flash 3...
Page 323: Show System
show system This command displays system information. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage • For a description of the items shown by this command, refer to “Displaying System Information” on page -11. • The POST results should all display “PASS.” If any POST test indicates “FAIL,”...
Page 324: Show Users
OMMAND NTERFACE show users Shows all active console and Telnet sessions, including user name, idle time, and IP address of Telnet client. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The session used to execute this command is indicated by a “*” symbol next to the Line (i.e., session) index number.
Page 325: Jumbo Frame
Command Mode Normal Exec, Privileged Exec Command Usage See “Displaying Switch Hardware/Software Versions” on page 3-13 for detailed information on the items displayed by this command. Example Console#show version Unit 1 Serial number: Service tag: Hardware version: Module A type: Module B type: Number of ports: Main power status:...
Page 326: Flash/File Commands
OMMAND NTERFACE Command Mode Global Configuration Command Usage • This switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields.
Page 327: Copy
Command Function whichboot Displays the files booted boot system Specifies the file or image used to start up the system copy This command moves (upload/download) a code image or configuration file between the switch’s flash memory and a TFTP server. When you save the system code or configuration settings to a file on a TFTP server, that file can later be downloaded to the switch to restore system operation.
Page 328 OMMAND NTERFACE Command Mode Privileged Exec Command Usage • The system prompts for data required to complete the copy command. • The destination file name should not contain slashes (\ or /), the leading letter of the file name should not be a period (.), and the maximum length for file names on the TFTP server is 127 characters or 31 characters for files on the switch.
Page 329 Example The following example shows how to upload the configuration settings to a file on the TFTP server: Console#copy file tftp Choose file type: 1. config: 2. opcode: <1-2>: 1 Source file name: startup TFTP server ip address: 10.1.0.99 Destination file name: startup.01 TFTP completed.
Page 330: Delete
OMMAND NTERFACE This example shows how to copy a public-key used by SSH from an TFTP server. Note that public key authentication via SSH is only supported for users configured locally on the switch: Console#copy tftp public-key TFTP server IP address: 192.168.1.19 Choose public key type: 1.
Page 331: Dir
Example This example shows how to delete the test2.cfg configuration file from flash memory for unit 1. Console#delete 1:test2.cfg Console# Related Commands dir (4-91) delete public-key (4-52) This command displays a list of files in flash memory. Syntax dir [unit:] {{boot-rom: | config: | opcode:} [:filename]} The type of file or image to display includes: •...
Page 332: Whichboot
OMMAND NTERFACE • File information is shown below: Column Heading file name file type startup size Example The following example shows how to display all file information: Console#dir 1: file name ---------------------------- Unit1: Diag_V2.2.1.3.bix V2.1.5.4.bix V2.2.2.2.bix Factory_Default_Config.cfg Config File startup ------------------------------------------------------------------ Console# whichboot...
Page 333: Boot System
Example This example shows the information displayed by the whichboot command. See the table under the dir command for a description of the file information displayed by this command. Console#whichboot file name ---------------------------- Unit1: Diag_V2.2.1.3.bix V2.2.2.2.bix startup ------------------------------------------------------------------ Console# boot system This command specifies the image used to start up the system.
Page 334: Authentication Commands
OMMAND NTERFACE Example Console(config)#boot system config: startup Console(config)# Related Commands dir (4-91) whichboot (4-92) Authentication Commands You can configure this switch to authenticate users logging into the system for management access using local or RADIUS authentication methods. You can also enable port-based authentication for network client access using IEEE 802.1X.
Page 335: Authentication Login
authentication login This command defines the login authentication method and precedence. Use the no form to restore the default. Syntax authentication login {[local] [radius] [tacacs]} no authentication login • local - Use local password. • radius - Use RADIUS server password. •...
Page 336: Authentication Enable
OMMAND NTERFACE Example Console(config)#authentication login radius Console(config)# Related Commands username - for setting the local user names and passwords (4-35) authentication enable This command defines the authentication method and precedence to use when changing from Exec command mode to Privileged Exec command mode with the enable command (see page 4-27).
Page 337: Radius Client
• You can specify three authentication methods in a single command to indicate the authentication sequence. For example, if you enter “authentication enable radius tacacs local,” the user name and password on the RADIUS server is verified first. If the RADIUS server is not available, then authentication is attempted on the TACACS+ server.
Page 338: Radius-Server Host
OMMAND NTERFACE radius-server host This command specifies primary and backup RADIUS servers and authentication parameters that apply to each server. Use the no form to restore the default values. Syntax [no] radius-server index host {host_ip_address | host_alias} [auth-port auth_port] [timeout timeout] [retransmit retransmit] [key key] •...
Page 339: Radius-Server Port
radius-server port This command sets the RADIUS server network port. Use the no form to restore the default. Syntax radius-server port port_number no radius-server port port_number - RADIUS server UDP port used for authentication messages. (Range: 1-65535) Default Setting 1812 Command Mode Global Configuration Example...
Page 340: Radius-Server Retransmit
OMMAND NTERFACE Example Console(config)#radius-server key green Console(config)# radius-server retransmit This command sets the number of retries. Use the no form to restore the default. Syntax radius-server retransmit number_of_retries no radius-server retransmit number_of_retries - Number of times the switch will try to authenticate logon access via the RADIUS server.
Page 341: Table 4-27 Authentication Commands
Command Mode Global Configuration Example Console(config)#radius-server timeout 10 Console(config)# show radius-server This command displays the current settings for the RADIUS server. Default Setting None Command Mode Privileged Exec Example Console#show radius-server Remote RADIUS server configuration: Global settings Communication key with RADIUS server: Server port number: Retransmit times: Request timeout:...
Page 342: Tacacs-Server Host
OMMAND NTERFACE TACACS+ Client Terminal Access Controller Access Control System (TACACS+) is a logon authentication protocol that uses software running on a central server to control access to TACACS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch.
Page 343: Tacacs-Server Port
tacacs-server port This command specifies the TACACS+ server network port. Use the no form to restore the default. Syntax tacacs-server port port_number no tacacs-server port port_number - TACACS+ server TCP port used for authentication messages. (Range: 1-65535) Default Setting Command Mode Global Configuration Example Console(config)#tacacs-server port 181...
Page 344: Show Tacacs-Server
OMMAND NTERFACE Example Console(config)#tacacs-server key green Console(config)# show tacacs-server This command displays the current settings for the TACACS+ server. Default Setting None Command Mode Privileged Exec Example Console#show tacacs-server Remote TACACS server configuration: Server IP address: Communication key with TACACS server: ***** Server port number: Console# Port Security Commands...
Page 345: Port Security
Command port security mac-address-table static show mac-address-table port security This command enables or configures port security. Use the no form without any keywords to disable port security. Use the no form with the appropriate keyword to restore the default settings for a response to security violation or for the maximum number of allowed addresses.
Page 346 OMMAND NTERFACE Command Usage • If you enable port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table will be accepted. •...
Page 347: Table 4-32 802.1X Port Authentication
802.1X Port Authentication The switch supports IEEE 802.1X (dot1x) port-based access control that prevents unauthorized access to the network by requiring users to first submit credentials for authentication. Client authentication is controlled centrally by a RADIUS server using EAP (Extensible Authentication Protocol).
Page 348: Dot1X System-Auth-Control
OMMAND NTERFACE dot1x system-auth-control This command enables 802.1X port authentication globally on the switch. Use the no form to restore the default. Syntax [no] system-auth-control Default Setting Disabled Command Mode Global Configuration Example Console(config)#dot1x system-auth-control Console(config)# dot1x default This command sets all configurable dot1x global and port settings to their default values.
Page 349: Dot1X Max-Req
dot1x max-req This command sets the maximum number of times the switch port will retransmit an EAP request/identity packet to the client before it times out the authentication session. Use the no form to restore the default. Syntax dot1x max-req count no dot1x max-req count –...
Page 350: Dot1X Operation-Mode
OMMAND NTERFACE Default force-authorized Command Mode Interface Configuration Example Console(config)#interface eth 1/2 Console(config-if)#dot1x port-control auto Console(config-if)# dot1x operation-mode This command allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. Use the no form with no keywords to restore the default to single host.
Page 351: Dot1X Re-Authenticate
• In “multi-host” mode, only one host connected to a port needs to pass authentication for all other hosts to be granted network access. Similarly, a port can become unauthorized for all hosts if one attached host fails re-authentication or sends an EAPOL logoff message. Example Console(config)#interface eth 1/2 Console(config-if)#dot1x operation-mode multi-host max-count 10...
Page 352: Dot1X Timeout Quiet-Period
OMMAND NTERFACE Example Console(config)#interface eth 1/2 Console(config-if)#dot1x re-authentication Console(config-if)# dot1x timeout quiet-period This command sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. Use the no form to reset the default. Syntax dot1x timeout quiet-period seconds no dot1x timeout quiet-period...
Page 353: Dot1X Timeout Tx-Period
Command Mode Interface Configuration Example Console(config)#interface eth 1/2 Console(config-if)#dot1x timeout re-authperiod 300 Console(config-if)# dot1x timeout tx-period This command sets the time that an interface on the switch waits during an authentication session before re-transmitting an EAP packet. Use the no form to reset to the default value.
Page 354: Show Dot1X
OMMAND NTERFACE show dot1x This command shows general port authentication related settings on the switch or a specific interface. Syntax show dot1x [statistics] [interface interface] • statistics - Displays dot1x status for each port. • interface • ethernet unit/port -unit - Stack unit. (This is unit 1) -port - Port number.
Page 355 - tx-period - supplicant-timeout – Supplicant timeout. - server-timeout - reauth-max - max-req - Status - Operation Mode - Max Count - Port-control - Supplicant - Current Identifier – The integer (0-255) used by the • Authenticator State Machine - State –...
Page 356 OMMAND NTERFACE • Reauthentication State Machine - State Example Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status disabled enabled 1/52 disabled 802.1X Port Details 802.1X is disabled on port 1/1 802.1X is enabled on port 1/2 reauth-enabled: Enable reauth-period: quiet-period:...
Page 357: Access Control List Commands
Access Control List Commands Access Control Lists (ACL) provide packet filtering for IP frames (based on address, protocol, Layer 4 protocol port number or TCP control code) or any frames (based on MAC address or Ethernet type). To filter packets, first create an access list, add the required rules and then bind the list to a specific port.
Page 358: Table 4-33 Access Control Lists
OMMAND NTERFACE • This switch supports ACLs for ingress filtering only. You can only bind one IP ACL to any port and one MAC ACL globally for ingress filtering. In other words, only two ACLs can be bound to an interface - Ingress IP ACL and Ingress MAC ACL.
Page 359: Access-List Ip
Command Function show ip Displays the rules for configured IP ACLs access-list Adds a port to an IP ACL access-group show ip Shows port assignments for IP ACLs access-group map access-list Sets the CoS value and corresponding output queue for packets matching an ACL rule show map Shows CoS value mapped to an access list for access-list ip...
Page 360: Permit, Deny (Standard Acl)
OMMAND NTERFACE Command Usage • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To create an ACL, you must add at least one rule to the list.
Page 361 Command Usage • New rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match” and 0 bits to indicate “ignore.” The bitmask is bitwise ANDed with the specified source IP address, and then compared with the address for each IP packet entering the port(s) to which this ACL has been assigned.
Page 362: Permit, Deny (Extended Acl)
OMMAND NTERFACE permit, deny (Extended ACL) This command adds a rule to an Extended IP ACL. The rule sets a filter condition for packets with specific source or destination IP addresses, protocol types, source or destination protocol ports, or TCP control codes. Use the no form to remove a rule.
Page 363 Default Setting None Command Mode Extended ACL Command Usage • All new rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match”...
Page 364: Show Ip Access-List
OMMAND NTERFACE Example This example accepts any incoming packets if the source address is within subnet 10.7.1.x. For example, if the rule is matched; i.e., the rule (10.7.1.0 & 255.255.255.0) equals the masked address (10.7.1.2 & 255.255.255.0), the packet passes through. Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any Console(config-ext-acl)# This allows TCP packets from class C addresses 192.168.1.0 to any...
Page 365: Ip Access-Group
Example Console#show ip access-list standard IP standard access-list david: permit host 10.1.1.21 permit 168.92.16.0 255.255.240.0 Console# Related Commands permit, deny 4-120 ip access-group (4-125) ip access-group This command binds a port to an IP ACL. Use the no form to remove the port.
Page 366: Show Ip Access-Group
OMMAND NTERFACE Example Console(config)#int eth 1/25 Console(config-if)#ip access-group david in Console(config-if)# Related Commands show ip access-list (4-124) show ip access-group This command shows the ports assigned to IP ACLs. Command Mode Privileged Exec Example Console#show ip access-group Interface ethernet 1/25 IP access-list david in Console# Related Commands...
Page 367: Show Map Access-List Ip
Command Mode Interface Configuration (Ethernet) Command Usage A packet matching a rule within the specified ACL is mapped to one of the output queues as shown in the following table. For information on mapping the CoS values to output queues, see queue cos-map on page 4-226.
Page 368: Access-List Mac
OMMAND NTERFACE Example Console#show map access-list ip Eth 1/25 access-list ip david cos 0 Console# Related Commands map access-list ip (4-126) MAC ACLs Command access-list mac permit, deny show mac access-list mac access-group Adds a port to a MAC ACL show mac access-group map access-list...
Page 369 Default Setting None Command Mode Global Configuration Command Usage • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To create an ACL, you must add at least one rule to the list.
Page 370: Permit, Deny (Mac Acl)
OMMAND NTERFACE permit, deny (MAC ACL) This command adds a rule to a MAC ACL. The rule filters packets matching a specified MAC source or destination address (i.e., physical layer address), or Ethernet protocol type. Use the no form to remove a rule. Syntax [no] {permit | deny} {any | host source | source address-bitmask}...
Page 371: Show Mac Access-List
• A detailed listing of Ethernet protocol types can be found in RFC 1060. A few of the more common types include the following: • 0800 - IP • 0806 - ARP • 8137 - IPX Example This rule permits packets from any source MAC address to the destination address 00-e0-29-94-34-de where the Ethernet type is 0800.
Page 372: Mac Access-Group
OMMAND NTERFACE mac access-group This command binds a port to a MAC ACL. Use the no form to remove the port. Syntax mac access-group acl_name in • acl_name – Name of the ACL. (Maximum length: 16 characters) • in – Indicates that this list applies to ingress packets. Default Setting None Command Mode...
Page 373: Map Access-List Mac
Related Commands mac access-group (4-132) map access-list mac This command sets the output queue for packets matching an ACL rule. The specified CoS value is only used to map the matching packet to an output queue; it is not written to the packet itself. Use the no form to remove the CoS mapping.
Page 374: Show Map Access-List Mac
OMMAND NTERFACE Related Commands queue cos-map (4-226) show map access-list mac (4-134) show map access-list mac This command shows the CoS value mapped to a MAC ACL for the current interface. (The CoS value determines the output queue for packets matching an ACL rule.) Syntax show map access-list mac [interface]...
Page 375: Show Access-List
ACL Information Command show access-list show access-group Shows the ACLs assigned to each port show access-list This command shows all ACLs and associated rules, as well as all the user-defined masks. Command Mode Privileged Exec Command Usage Once the ACL is bound to an interface (i.e., the ACL is active), the order in which the rules are displayed is determined by the associated mask.
Page 376: Show Access-Group
OMMAND NTERFACE show access-group This command shows the port assignments of ACLs. Command Mode Privileged Executive Example Console#show access-group Interface ethernet 1/25 IP standard access-list david MAC access-list jerry Console# SNMP Commands Controls access to this switch from management stations using the Simple Network Management Protocol (SNMP), as well as the error types sent to trap managers.
Page 377: Snmp Commands
snmp-server community This command defines the community access string for the Simple Network Management Protocol. Use the no form to remove the specified community string. Syntax snmp-server community string [ro|rw] no snmp-server community string • string - Community string that acts like a password and permits access to the SNMP protocol.
Page 378: Snmp-Server Contact
OMMAND NTERFACE snmp-server contact This command sets the system contact string. Use the no form to remove the system contact information. Syntax snmp-server contact string no snmp-server contact string - String that describes the system contact information. (Maximum length: 255 characters) Default Setting None Command Mode...
Page 379: Snmp-Server Host
Command Mode Global Configuration Example Console(config)#snmp-server location Room 23 Console(config)# Related Commands snmp-server contact (4-138) snmp-server host This command specifies the recipient of a Simple Network Management Protocol notification operation. Use the no form to remove the specified host. Syntax snmp-server host host-addr community-string [version {1 | 2c}] no snmp-server host host-addr •...
Page 380 OMMAND NTERFACE Command Usage • If you do not enter an snmp-server host command, no notifications are sent. In order to configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. In order to enable multiple hosts, you must issue a separate snmp-server host command for each host.
Page 381: Snmp-Server Enable Traps
snmp-server enable traps This command enables this device to send Simple Network Management Protocol traps (SNMP notifications). Use the no form to disable SNMP notifications. Syntax [no] snmp-server enable traps [authentication | link-up-down] • authentication - Keyword to issue authentication failure traps. •...
Page 382: Show Snmp
OMMAND NTERFACE show snmp This command checks the status of SNMP communications. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage This command provides information on the community access strings, counter information for SNMP input and output protocol data units, and whether or not SNMP logging has been enabled with the snmp-server enable traps command.
Page 383: Snmp C Ommands
Example Console#show snmp SNMP traps: Authentication: enabled Link-up-down: enabled SNMP communities: 1. alpha, and the privilege is read-write 2. private, and the privilege is read-write 3. public, and the privilege is read-only 0 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name 0 Illegal operation for community name supplied 0 Encoding errors...
Page 384: Interface Commands
OMMAND NTERFACE Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN. Command interface description speed-duplex negotiation capabilities flowcontrol shutdown switchport broadcast packet-rate clear counters show interfaces status show interfaces counters show interfaces switchport...
Page 385: Interface
interface This command configures an interface type and enter interface configuration mode. Use the no form to remove a trunk. Syntax interface interface no interface port-channel channel-id interface • ethernet unit/port - unit - Stack unit. (This is unit 1) - port - Port number.
Page 386: Speed-Duplex
OMMAND NTERFACE Default Setting None Command Mode Interface Configuration (Ethernet, Port Channel) Example The following example adds a description to port 24. Console(config)#interface ethernet 1/24 Console(config-if)#description RD-SW#3 Console(config-if)# speed-duplex This command configures the speed and duplex mode of a given interface when autonegotiation is disabled.
Page 387: Negotiation
• When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command. To set the speed/duplex mode under auto-negotiation, the required mode must be specified in the capabilities list for an interface. Example The following example configures port 5 to 100 Mbps, half-duplex operation.
Page 388: Capabilities
OMMAND NTERFACE Example The following example configures port 11 to use autonegotiation. Console(config)#interface ethernet 1/11 Console(config-if)#negotiation Console(config-if)# Related Commands capabilities (4-148) speed-duplex (4-146) capabilities This command advertises the port capabilities of a given interface during autonegotiation. Use the no form with parameters to remove an advertised capability, or the no form without parameters to restore the default values.
Page 389: Flowcontrol
Command Usage When auto-negotiation is enabled with the negotiation command, the switch will negotiate the best settings for a link based on the capabilites command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands.
Page 390: Shutdown
OMMAND NTERFACE • To force flow control on or off (with the flowcontrol or no flowcontrol command), use the no negotiation command to disable auto-negotiation on the selected interface. • When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command. To enable flow control under auto-negotiation, “flowcontrol”...
Page 391: Switchport Broadcast Packet-Rate
Command Usage This command allows you to disable a port due to abnormal behavior (e.g., excessive collisions), and then reenable it after the problem has been resolved. You may also want to disable a port for security reasons. Example The following example disables port 5. Console(config)#interface ethernet 1/5 Console(config-if)#shutdown Console(config-if)#...
Page 392: Clear Counters
OMMAND NTERFACE Example The following shows how to configure broadcast storm control at 600 packets per second: Console(config)#interface ethernet 1/5 Console(config-if)#switchport broadcast octet-rate 600 Console(config-if)# clear counters This command clears statistics on an interface. Syntax clear counters interface interface • ethernet unit/port - unit - Stack unit.
Page 393: Show Interfaces Status
show interfaces status This command displays the status for an interface. Syntax show interfaces status [interface] interface • ethernet unit/port - unit - Stack unit. (This is unit 1) - port - Port number. (Range: 1-52) • port-channel channel-id (Range: 1-4) •...
Page 394: Show Interfaces Counters
OMMAND NTERFACE Example Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: Mac address: Configuration: Name: Port admin: Speed-duplex: Capabilities: Broadcast storm: Broadcast storm limit: Flow control: Lacp: Port security: Max MAC count: Port security action: Current status: Link status: Port operation status:...
Page 395: Table 4-40 Interface Commands
Command Usage If no interface is specified, information on all interfaces is displayed. For a description of the items displayed by this command, see “Showing Port Statistics” on page 3-114. Example Console#show interfaces counters ethernet 1/7 Ethernet 1/7 Iftable stats: Octets input: 30658, Octets output: 196550 Unicast input: 6, Unicast output: 5 Discard input: 0, Discard output: 0...
Page 396: Show Interfaces Switchport
OMMAND NTERFACE show interfaces switchport This command displays the administrative and operational status of the specified interfaces. Syntax show interfaces switchport [interface] interface • ethernet unit/port - unit - Stack unit. (This is unit 1) - port - Port number. (Range: 1-52) •...
Page 397: Table 4-41 Interfaces Switchport Statistics
Table 4-41 Interfaces Switchport Statistics Field Description Broadcast threshold Shows if broadcast storm suppression is enabled or disabled; if enabled it also shows the threshold level (page 4-151). Lacp status Shows if Link Aggregation Control Protocol has been enabled or disabled (page 4-166). Ingress/Egress rate Shows if rate limiting is enabled, and the current rate limit.
Page 398: Mirror Port Commands
OMMAND NTERFACE Mirror Port Commands This section describes how to mirror traffic from a source port to a target port. Command port monitor show port monitor port monitor This command configures a mirror session. Use the no form to clear a mirror session.
Page 399: Show Port Monitor
• The mirror port and monitor port speeds should match, otherwise traffic may be dropped from the monitor port. • You can only create a single mirror session. Example The following example configures the switch to mirror received packets from port 6 to 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 rx Console(config-if)#...
Page 400: Rate Limit Commands
OMMAND NTERFACE Example The following shows mirroring configured from port 6 to port 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 rx Console(config-if)#end Console#show port monitor Port Mirroring ------------------------------------- Destination port(listen port):Eth1/11 Source port(monitored port) Mode Console# Rate Limit Commands This function allows the network manager to control the maximum rate for traffic transmitted or received on an interface.
Page 401: Rate-Limit
rate-limit Use this command to define the rate limit level for a specific interface. Use this command without specifying a rate to restore the default rate limit level. Use the no form to restore the default status of disabled. Syntax rate-limit {input | output} level [rate] no rate-limit {input | output} •...
Page 402: Rate-Limit Granularity
OMMAND NTERFACE rate-limit granularity Use this command to define the rate limit granularity for the Fast Ethernet ports, and the Gigabit Ethernet ports. Use the no form of this command to restore the default setting. Syntax rate-limit {fastethernet | gigabitethernet} granularity [granularity] no rate-limit {fastethernet | gigabitethernet} granularity •...
Page 403: Show Rate-Limit
show rate-limit Use this command to display the rate limit granularity. Default Setting Fast Ethernet interface – 3.3 Mbps Gigabit Ethernet interface – 33.3 Mbps Command Mode Privileged Exec Command Usage • For Fast Ethernet interfaces, the rate limit granularity is 512 Kbps, 1 Mbps, or 3.3 Mbps.
Page 404: Link Aggregation Commands
OMMAND NTERFACE Link Aggregation Commands Ports can be statically grouped into an aggregate link (i.e., trunk) to increase the bandwidth of a network connection or to ensure fault recovery. Or you can use the Link Aggregation Control Protocol (LACP) to automatically negotiate a trunk link between this switch and another network device.
Page 405 Guidelines for Creating Trunks General Guidelines – • Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • A trunk can have up to eight ports. • The ports at both ends of a connection must be configured as trunk ports.
Page 406: Channel-Group
OMMAND NTERFACE channel-group This command adds a port to a trunk. Use the no form to remove a port from a trunk. Syntax channel-group channel-id no channel-group channel-id - Trunk index (Range: 1-4) Default Setting The current port will be added to this trunk. Command Mode Interface Configuration (Ethernet) Command Usage...
Page 407 Command Mode Interface Configuration (Ethernet) Command Usage • The ports on both ends of an LACP trunk must be configured for full duplex, either by forced mode or auto-negotiation. • A trunk formed with another switch using LACP will automatically be assigned the next available port-channel ID.
Page 408: Lacp
OMMAND NTERFACE Example The following shows LACP enabled on ports 11-13. Because LACP has also been enabled on the ports at the other end of the links, the show interfaces status port-channel 1 command shows that Trunk 1 has been established.
Page 409: Lacp System-Priority
lacp system-priority This command configures a port's LACP system priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} system-priority priority no lacp {actor | partner} system-priority • actor - The local side an aggregate link. •...
Page 410: Lacp Admin-Key (Ethernet Interface)
OMMAND NTERFACE lacp admin-key (Ethernet Interface) This command configures a port's LACP administration key. Use the no form to restore the default setting. Syntax lacp {actor | partner} admin-key key [no] lacp {actor | partner} admin-key • actor - The local side an aggregate link. •...
Page 411: Lacp Admin-Key (Port Channel)
lacp admin-key (Port Channel) This command configures a port channel's LACP administration key string. Use the no form to restore the default setting. Syntax lacp {actor | partner} admin-key key [no] lacp {actor | partner} admin-key key - The port channel admin key is used to identify a specific link aggregation group (LAG) during local LACP setup on this switch.
Page 412: Lacp Port-Priority
OMMAND NTERFACE lacp port-priority This command configures LACP port priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} port-priority priority no lacp {actor | partner} port-priority • actor - The local side an aggregate link. •...
Page 413: Show Lacp
show lacp This command displays LACP information. Syntax show lacp [port-channel] {counters | internal | neighbors | sysid} • port-channel - Local identifier for a link aggregation group. (Range: 1-4) • counters - Statistics for LACP protocol messages. • internal - Configuration settings and operational state for local side.
Page 414: Table 4-45 Show Lacp Counters - Display Description
OMMAND NTERFACE Example Console#show lacp 1 counters Port channel : 1 ------------------------------------------------------------------- Eth 1/ 1 ------------------------------------------------------------------- LACPDUs Sent : 21 LACPDUs Received : 21 Marker Sent : 0 Marker Received : 0 LACPDUs Unknown Pkts : 0 LACPDUs Illegal Pkts : 0 Table 4-45 show lacp counters - display description Field LACPDUs Sent...
Page 415: Table 4-46 Show Lacp Internal - Display Description
Console#show lacp 1 internal Port channel : 1 ------------------------------------------------------------------- Oper Key : 4 Admin Key : 0 Eth 1/1 ------------------------------------------------------------------- LACPDUs Internal : 30 sec LACP System Priority : 32768 LACP Port Priority : 32768 Admin Key : 4 Oper Key : 4 Admin State : defaulted, aggregation, long timeout, LACP-activity Oper State : distributing, collecting, synchronization, aggregation, long timeout, LACP-activity...
Page 416 OMMAND NTERFACE Table 4-46 show lacp internal - display description (Continued) Field Admin State, Oper State 4-176 Description Administrative or operational values of the actor’s state parameters: • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner.
Page 417: Table 4-47 Show Lacp Neighbors - Display Description
Console#show lacp 1 neighbors Port channel 1 neighbors ------------------------------------------------------------------- Eth 1/1 ------------------------------------------------------------------- Partner Admin System ID : 32768, 00-00-00-00-00-00 Partner Oper System ID : 32768, 00-00-00-00-00-01 Partner Admin Port Number : 1 Partner Oper Port Number : 1 Port Admin Priority : 32768 Port Oper Priority : 32768 Admin Key : 0 Oper Key : 4...
Page 418: Table 4-49 Address Table Commands
OMMAND NTERFACE Console#show lacp sysid Port Channel ------------------------------------------------------------------- Console# Table 4-48 show lacp sysid - display description Field Channel group System Priority System MAC Address * The LACP system priority and system MAC address are concatenated to form the LAG system ID. Address Table Commands These commands are used to configure the address table for filtering specified addresses, displaying current entries, clearing the table, or setting...
Page 419: Address Table Commands
mac-address-table static This command maps a static address to a destination port in a VLAN. Use the no form to remove an address. Syntax mac-address-table static mac-address interface interface vlan vlan-id [action] no mac-address-table static mac-address vlan vlan-id • mac-address - MAC address. •...
Page 420: Clear Mac-Address-Table Dynamic
OMMAND NTERFACE • A static address cannot be learned on another port until the address is removed with the no form of this command. Example Console(config)#mac-address-table static 00-e0-29-94-34-de interface ethernet 1/1 vlan 1 delete-on-reset Console(config)# clear mac-address-table dynamic This command removes any learned entries from the forwarding database and clears the transmit and receive counts for any static or system configured entries.
Page 421: Mac-Address-Table Aging-Time
Default Setting None Command Mode Privileged Exec Command Usage • The MAC Address Table contains the MAC addresses associated with each interface. Note that the Type field may include the following types: - Learned - Dynamic address entries - Permanent - Static entry - Delete-on-reset - Static entry to be deleted when system is reset •...
Page 422: Show Mac-Address-Table Aging-Time
OMMAND NTERFACE Default Setting 300 seconds Command Mode Global Configuration Command Usage The aging time is used to age out dynamically learned forwarding information. Example Console(config)#mac-address-table aging-time 100 Console(config)# show mac-address-table aging-time This command shows the aging time for entries in the address table. Default Setting None Command Mode...
Page 423: Spanning Tree Commands
Spanning Tree Commands This section includes commands that configure the Spanning Tree Algorithm (STA) globally for the switch, and commands that configure STA for the selected interface. Command spanning-tree spanning-tree mode Configures STP or RSTP spanning-tree forward-time spanning-tree hello-time spanning-tree max-age spanning-tree priority...
Page 424: Spanning-Tree
OMMAND NTERFACE Command spanning-tree protocol-migration show spanning-tree Shows spanning tree configuration for spanning-tree This command enables the Spanning Tree Algorithm globally for the switch. Use the no form to disable it. Syntax [no] spanning-tree Default Setting Spanning tree is enabled. Command Mode Global Configuration Command Usage...
Page 425: Spanning-Tree Mode
spanning-tree mode This command selects the spanning tree mode for this switch. Use the no form to restore the default. Syntax spanning-tree mode {stp | rstp} no spanning-tree mode • stp - Spanning Tree Protocol (IEEE 802.1D) • rstp - Rapid Spanning Tree Protocol (IEEE 802.1w) Default Setting rstp Command Mode...
Page 426: Spanning-Tree Forward-Time
OMMAND NTERFACE spanning-tree forward-time This command configures the spanning tree bridge forward time globally for this switch. Use the no form to restore the default. Syntax spanning-tree forward-time seconds no spanning-tree forward-time seconds - Time in seconds. (Range: 4 - 30 seconds) The minimum value is the higher of 4 or [(max-age / 2) +1].
Page 427: Spanning-Tree Max-Age
Default Setting 2 seconds Command Mode Global Configuration Command Usage This command sets the time interval (in seconds) at which the root device transmits a configuration message. Example Console(config)#spanning-tree hello-time 5 Console(config)# spanning-tree max-age This command configures the spanning tree bridge maximum age globally for this switch.
Page 428: Spanning-Tree Priority
OMMAND NTERFACE becomes the designated port for the attached LAN. If it is a root port, a new root port is selected from among the device ports attached to the network. Example Console(config)#spanning-tree max-age 40 Console(config)# spanning-tree priority This command configures the spanning tree priority globally for this switch.
Page 429: Spanning-Tree Pathcost Method
spanning-tree pathcost method This command configures the path cost method used for Rapid Spanning Tree. Use the no form to restore the default. Syntax spanning-tree pathcost method {long | short} no spanning-tree pathcost method • long - Specifies 32-bit based values that range from 0-200,000,000. •...
Page 430: Spanning-Tree Spanning-Disabled
OMMAND NTERFACE Command Mode Global Configuration Command Usage This command limits the maximum transmission rate for BPDUs. Example Console(config)#spanning-tree transmission-limit 4 Console(config)# spanning-tree spanning-disabled This command disables the spanning tree algorithm for the specified interface. Use the no form to reenable the spanning tree algorithm for the specified interface.
Page 431: Spanning-Tree Cost
spanning-tree cost This command configures the spanning tree path cost for the specified interface. Use the no form to restore the default. Syntax spanning-tree cost cost no spanning-tree cost cost - The path cost for the port. (Range: 1-200,000,000)) The recommended range is: •...
Page 432: Spanning-Tree Port-Priority
OMMAND NTERFACE spanning-tree port-priority This command configures the priority for the specified interface. Use the no form to restore the default. Syntax spanning-tree port-priority priority no spanning-tree port-priority priority - The priority for a port. (Range: 0-240, in steps of 16) Default Setting Command Mode Interface Configuration (Ethernet, Port Channel)
Page 433: Spanning-Tree Portfast
Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.
Page 434: Spanning-Tree Link-Type
OMMAND NTERFACE Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command is used to enable/disable the fast spanning-tree mode for the selected port. In this mode, ports skip the Discarding and Learning states, and proceed straight to Forwarding. •...
Page 435: Spanning-Tree Protocol-Migration
Default Setting auto Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Specify a point-to-point link if the interface can only be connected to exactly one other bridge, or a shared link if it can be connected to two or more bridges.
Page 436: Show Spanning-Tree
OMMAND NTERFACE Command Usage If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the spanning-tree protocol-migration command at any time to manually re-check the appropriate BPDU format to send on the selected interfaces (i.e., RSTP or STP-compatible).
Page 437 • For a description of the items displayed under “Spanning-tree information,” see “Configuring Global Settings” on page 3 -130. For a description of the items displayed for specific interfaces, see “Displaying Interface Settings” on page 3 -134. Example Console#show spanning-tree Spanning-tree information --------------------------------------------------------------- Spanning tree mode:...
Page 438: Vlan Commands
OMMAND NTERFACE VLAN Commands A VLAN is a group of ports that can be located anywhere in the network, but communicate as though they belong to the same physical segment. This section describes commands used to create VLAN groups, add port members, specify how VLAN tagging is used, and enable automatic VLAN registration for the selected interface.
Page 439: Vlan
Command Mode Global Configuration Command Usage • Use the VLAN database command mode to add, change, and delete VLANs. After finishing configuration changes, you can display the VLAN settings by entering the show vlan command. • Use the interface vlan command mode to define the port membership mode and add or remove ports from a VLAN.
Page 440 OMMAND NTERFACE Default Setting By default only VLAN 1 exists and is active. Command Mode VLAN Database Configuration Command Usage • no vlan vlan-id deletes the VLAN. • no vlan vlan-id name removes the VLAN name. • no vlan vlan-id state returns the VLAN to the default state (i.e., active).
Page 441: Configuring Vlan Interfaces
Configuring VLAN Interfaces Table 4-53 Configuring VLAN Interfaces Command interface vlan switchport mode switchport acceptable-frame-types switchport ingress-filtering switchport native vlan switchport allowed vlan Configures the VLANs associated with switchport gvrp switchport forbidden vlan switchport priority default interface vlan This command enters interface configuration mode for VLANs, which is used to configure VLAN parameters for a physical interface.
Page 442: Switchport Mode
OMMAND NTERFACE Example The following example shows how to set the interface configuration mode to VLAN 1, and then assign an IP address to the VLAN: Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.254 255.255.255.0 Console(config-if)# Related Commands shutdown (4-150) switchport mode This command configures the VLAN membership mode for a port.
Page 443: Switchport Acceptable-Frame-Types
Example The following shows how to set the configuration mode to port 1, and then set the switchport mode to hybrid: Console(config)#interface ethernet 1/1 Console(config-if)#switchport mode hybrid Console(config-if)# Related Commands switchport acceptable-frame-types (4-203) switchport acceptable-frame-types This command configures the acceptable frame types for a port. Use the no form to restore the default.
Page 444: Switchport Ingress-Filtering
OMMAND NTERFACE Related Commands switchport mode (4-202) switchport ingress-filtering This command enables ingress filtering for an interface. Use the no form to restore the default. Syntax [no] switchport ingress-filtering Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage •...
Page 445: Switchport Native Vlan
switchport native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no form to restore the default. Syntax switchport native vlan vlan-id no switchport native vlan vlan-id - Default VLAN ID for a port. (Range: 1-4094, no leading zeroes) Default Setting VLAN 1...
Page 446: Switchport Allowed Vlan
OMMAND NTERFACE switchport allowed vlan This command configures VLAN groups on the selected interface. Use the no form to restore the default. Syntax switchport allowed vlan {add vlan-list [tagged | untagged] | remove vlan-list} no switchport allowed vlan • add vlan-list - List of VLAN identifiers to add. •...
Page 447: Switchport Forbidden Vlan
• If a VLAN on the forbidden list for an interface is manually added to that interface, the VLAN is automatically removed from the forbidden list for that interface. Example The following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as tagged VLANs for port 1: Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 1,2,5,6 tagged...
Page 448: Displaying Vlan Information
OMMAND NTERFACE Example The following example shows how to prevent port 1 from being added to VLAN 3: Console(config)#interface ethernet 1/1 Console(config-if)#switchport forbidden vlan add 3 Console(config-if)# Displaying VLAN Information Command show vlan show interfaces status vlan show interfaces switchport show vlan This command shows VLAN information.
Page 449: Configuring Private Vlans
Command Mode Normal Exec, Privileged Exec Example The following example shows how to display information for VLAN 1: Console#show vlan id 1 Vlan ID: Type: Name: Status: Ports/Port Channel: Console# Configuring Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN.
Page 450 OMMAND NTERFACE Table 4-55 Private VLAN Commands (Continued) Command Configure Private VLAN Interfaces switchport mode private-vlan switchport private-vlan host-association switchport private-vlan isolated switchport private-vlan mapping Display Private VLAN Information show vlan private-vlan Shows private VLAN information To configure private VLANs, follow these steps: Use the private-vlan command to designate one or more isolated or community VLANs and the primary VLAN that will channel traffic outside the community groups.
Page 451: Private-Vlan
private-vlan Use this command to create a primary, isolated or community private VLAN. Use the no form to remove the specified private VLAN. Syntax private-vlan vlan-id {community | primary | isolated} no private-vlan vlan-id • vlan-id - ID of private VLAN. (Range: 1-4094, no leading zeroes). •...
Page 452: Private Vlan Association
OMMAND NTERFACE Example Console(config)#vlan database Console(config-vlan)#private-vlan 2 primary Console(config-vlan)#private-vlan 3 community Console(config)# private vlan association Use this command to associate a primary VLAN with a secondary (i.e., community) VLAN. Use the no form to remove all associations for the specified primary VLAN. Syntax private-vlan primary-vlan-id association {secondary-vlan-id | add secondary-vlan-id | remove secondary-vlan-id}...
Page 453: Switchport Mode Private-Vlan
switchport mode private-vlan Use this command to set the private VLAN mode for an interface. Use the no form to restore the default setting. Syntax switchport mode private-vlan {host | promiscuous} no switchport mode private-vlan • host – This port type can subsequently be assigned to a community or isolated VLAN.
Page 454: Switchport Private-Vlan Host-Association
OMMAND NTERFACE switchport private-vlan host-association Use this command to associate an interface with a secondary VLAN. Use the no form to remove this association. Syntax switchport private-vlan host-association secondary-vlan-id no switchport private-vlan host-association secondary-vlan-id - ID of secondary (i.e., community) VLAN. (Range: 1-4094).
Page 455: Switchport Private-Vlan Mapping
Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage All ports assigned to an isolated VLAN can pass traffic between group members, but must communicate with resources outside of the group via a promiscuous port. Example Console(config)#interface ethernet 1/3 Console(config-if)#switchport private-vlan isolated 3 Console(config-if)# switchport private-vlan mapping Use this command to map an interface to a primary VLAN.
Page 456: Show Vlan Private-Vlan
OMMAND NTERFACE show vlan private-vlan Use this command to show the private VLAN configuration settings on this switch. Syntax show vlan private-vlan [community | isolated | primary] • community – Displays all community VLANs, along with their associated primary VLAN and assigned host interfaces. •...
Page 457: Gvrp And Bridge Extension Commands
GVRP and Bridge Extension Commands GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network. This section describes how to enable GVRP for individual interfaces and globally for the switch, as well as how to display default configuration settings for the Bridge Extension MIB.
Page 458: Show Bridge-Ext
OMMAND NTERFACE Command Mode Global Configuration Command Usage GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. This function should be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. Example Console(config)#bridge-ext gvrp Console(config)#...
Page 459: Switchport Gvrp
switchport gvrp This command enables GVRP for a port. Use the no form to disable it. Syntax [no] switchport gvrp Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Example Console(config)#interface ethernet 1/6 Console(config-if)#switchport gvrp Console(config-if)# show gvrp configuration This command shows if GVRP is enabled.
Page 460: Garp Timer
OMMAND NTERFACE garp timer This command sets the values for the join, leave and leaveall timers. Use the no form to restore the timers’ default values. Syntax garp timer {join | leave | leaveall} timer_value no garp timer {join | leave | leaveall} •...
Page 461: Show Garp Timer
Example Console(config)#interface ethernet 1/1 Console(config-if)#garp timer join 100 Console(config-if)# Related Commands show garp timer (4-221) show garp timer This command shows the GARP timers for the selected interface. Syntax show garp timer [interface] interface • ethernet unit/port - unit - Stack unit. (This is unit 1) - port - Port number.
Page 462: Priority Commands
OMMAND NTERFACE Priority Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with four priority queues for each port.
Page 463: Show Queue Cos-Map
Table 4-58 Priority Commands (Layer 2) (Continued) Command show queue cos-map show interfaces switchport queue mode This command sets the queue mode to strict priority or Weighted Round-Robin (WRR) for the class of service (CoS) priority queues. Use the no form to restore the default value. Syntax queue mode {strict | wrr} no queue mode...
Page 464: Switchport Priority Default
OMMAND NTERFACE Example The following example sets the queue mode to strict priority service mode: Console(config)#queue mode strict Console(config)# switchport priority default This command sets a priority for incoming untagged frames. Use the no form to restore the default value. Syntax switchport priority default default-priority-id no switchport priority default...
Page 465: Queue Bandwidth
Therefore, any inbound frames that do not have priority tags will be placed in queue 0 of the output port. (Note that if the output port is an untagged member of the associated VLAN, these frames are stripped of all VLAN tags prior to transmission.) Example The following example shows how to set a default priority on port 3 to 5: Console(config)#interface ethernet 1/3...
Page 466: Table 4-59 Default Cos Priority Levels
OMMAND NTERFACE Related Commands show queue bandwidth (4-227) queue cos-map This command assigns class of service (CoS) values to the priority queues (i.e., hardware output queues 0 - 3). Use the no form set the CoS map to the default values. Syntax queue cos-map queue_id [cos1 ...
Page 467: Table 4-57 Priority Commands
Example The following example shows how to map CoS values 0, 1 and 2 to egress queue 0, value 3 to egress queue 1, values 4 and 5 to egress queue 2, and values 6 and 7 to egress queue 3: Console(config)#interface ethernet 1/1 Console(config-if)#queue cos-map 0 0 1 2 Console(config-if)#queue cos-map 1 3...
Page 468 OMMAND NTERFACE Command Mode Privileged Exec Example Console#show queue bandwidth Queue ID Weight -------- ------ Console# show queue cos-map This command shows the class of service priority map. Syntax show queue cos-map [interface] interface • ethernet unit/port - unit - Stack unit. (This is unit 1) - port - Port number.
Page 469: Map Ip Port (Global Configuration)
Priority Commands (Layer 3 and 4) Table 4-60 Priority Commands (Layer 3 and 4) Command map ip port map ip port map ip precedence map ip precedence map ip dscp map ip dscp map access-list ip map access-list mac show map ip port show map ip precedence show map ip dscp...
Page 470: Map Ip Port (Interface Configuration)
OMMAND NTERFACE Default Setting Disabled Command Mode Global Configuration Command Usage The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. Example The following example shows how to enable TCP/UDP port mapping globally: Console(config)#map ip port Console(config)# map ip port (Interface Configuration)
Page 471: Map Ip Precedence (Global Configuration)
Example The following example shows how to map HTTP traffic to CoS value 0: Console(config)#interface ethernet 1/5 Console(config-if)#map ip port 80 cos 0 Console(config-if)# map ip precedence (Global Configuration) This command enables IP precedence mapping (i.e., IP Type of Service). Use the no form to disable IP precedence mapping.
Page 472: Map Ip Precedence (Interface Configuration)
OMMAND NTERFACE map ip precedence (Interface Configuration) This command sets IP precedence priority (i.e., IP Type of Service priority). Use the no form to restore the default table. Syntax map ip precedence ip-precedence-value cos cos-value no map ip precedence • precedence-value - 3-bit precedence value. (Range: 0-7) •...
Page 473: Map Ip Dscp (Global Configuration)
map ip dscp (Global Configuration) This command enables IP DSCP mapping (i.e., Differentiated Services Code Point mapping). Use the no form to disable IP DSCP mapping. Syntax [no] map ip dscp Default Setting Disabled Command Mode Global Configuration Command Usage •...
Page 474: Table 4-62 Ip Dscp To Cos Values
OMMAND NTERFACE Default Setting The DSCP default values are defined in the following table. Note that all the DSCP values that are not specified are mapped to CoS value 0. IP DSCP Value 10, 12, 14, 16 18, 20, 22, 24 26, 28, 30, 32, 34, 36 38, 40, 42 46, 56...
Page 475: Show Map Ip Port
show map ip port Use this command to show the IP port priority map. Syntax show map ip port [interface] interface • ethernet unit/port - unit - Stack unit. (This is unit 1) - port - Port number. (Range: 1-52) •...
Page 476: Show Map Ip Precedence
OMMAND NTERFACE show map ip precedence This command shows the IP precedence priority map. Syntax show map ip precedence [interface] interface • ethernet unit/port - unit - Stack unit. (This is unit 1) - port - Port number. (Range: 1-52) •...
Page 477: Show Map Ip Dscp
show map ip dscp This command shows the IP DSCP priority map. Syntax show map ip dscp [interface] interface • ethernet unit/port - unit - Stack unit. (This is unit 1) - port - Port number. (Range: 1-52) • port-channel channel-id (Range: 1-4) Default Setting None Command Mode...
Page 478: Multicast Filtering Commands
OMMAND NTERFACE Multicast Filtering Commands This switch uses IGMP (Internet Group Management Protocol) to query for any attached hosts that want to receive a specific multicast service. It identifies the ports containing hosts requesting a service and sends data out to those ports only. It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service.
Page 479: Ip Igmp Snooping
ip igmp snooping This command enables IGMP snooping on this switch. Use the no form to disable it. Syntax [no] ip igmp snooping Default Setting Enabled Command Mode Global Configuration Example The following example enables IGMP snooping. Console(config)#ip igmp snooping Console(config)# ip igmp snooping vlan static This command adds a port to a multicast group.
Page 480: Ip Igmp Snooping Version
OMMAND NTERFACE Command Mode Global Configuration Example The following shows how to statically configure a multicast group on a port: Console(config)#ip igmp snooping vlan 1 static 224.0.0.12 ethernet 1/5 Console(config)# ip igmp snooping version This command configures the IGMP snooping version. Use the no form to restore the default.
Page 481: Show Ip Igmp Snooping
show ip igmp snooping This command shows the IGMP snooping configuration. Default Setting None Command Mode Privileged Exec Command Usage See Configuring IGMP Snooping and Query Parameters” on page 3-184 for a description of the displayed items. Example The following shows the current IGMP snooping configuration: Console#show ip igmp snooping Service status: Querier status:...
Page 482: Igmp Query Commands (Layer 2)
OMMAND NTERFACE Command Mode Privileged Exec Command Usage Member types displayed include IGMP or USER, depending on selected options. Example The following shows the multicast entries learned through IGMP snooping for VLAN 1: Console#show mac-address-table multicast vlan 1 igmp-snooping VLAN M'cast IP addr. Member ports Type ---- --------------- ------------ ------- 224.1.2.3 Console#...
Page 483: Ip Igmp Snooping Querier
ip igmp snooping querier This command enables the switch as an IGMP querier. Use the no form to disable it. Syntax [no] ip igmp snooping querier Default Setting Enabled Command Mode Global Configuration Command Usage If enabled, the switch will serve as querier if elected. The querier is responsible for asking hosts if they want to receive multicast traffic.
Page 484: Ip Igmp Snooping Query-Interval
OMMAND NTERFACE Command Usage The query count defines how long the querier waits for a response from a multicast client before taking action. If a querier has sent a number of queries defined by this command, but a client has not responded, a countdown timer is started using the time defined by ip igmp snooping query-max- response-time.
Page 485: Ip Igmp Snooping Query-Max-Response-Time
ip igmp snooping query-max-response-time This command configures the query report delay. Use the no form to restore the default. Syntax ip igmp snooping query-max-response-time seconds no ip igmp snooping query-max-response-time seconds - The report delay advertised in IGMP queries. (Range: 5-25) Default Setting 10 seconds Command Mode...
Page 486: Ip Igmp Snooping Router-Port-Expire-Time
OMMAND NTERFACE ip igmp snooping router-port-expire-time This command configures the query timeout. Use the no form to restore the default. Syntax ip igmp snooping router-port-expire-time seconds no ip igmp snooping router-port-expire-time seconds - The time the switch waits after the previous querier stops before it considers the router port (i.e., the interface which had been receiving query packets) to have expired.
Page 487: Static Multicast Routing Commands
Static Multicast Routing Commands Table 4-66 Static Multicast Routing Commands Command ip igmp snooping vlan mrouter show ip igmp snooping mrouter ip igmp snooping vlan mrouter This command statically configures a multicast router port. Use the no form to remove the configuration. Syntax [no] ip igmp snooping vlan vlan-id mrouter interface •...
Page 488: Show Ip Igmp Snooping Mrouter
OMMAND NTERFACE Example The following shows how to configure port 11 as a multicast router port within VLAN 1: Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11 Console(config)# show ip igmp snooping mrouter This command displays information on statically configured and dynamically learned multicast router ports.
Page 489: Ip Interface Commands
IP Interface Commands An IP addresses may be used for management access to the switch over your network. The IP address for this switch is obtained via DHCP by default. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server when it is powered on.
Page 490 OMMAND NTERFACE Default Setting DHCP Command Mode Interface Configuration (VLAN) Command Usage • You must assign an IP address to this device to gain management access over the network. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server.
Page 491: Ip Default-Gateway
ip default-gateway This command establishes a static route between this switch and devices that exist on another network segment. Use the no form to remove the static route. Syntax ip default-gateway gateway no ip default-gateway gateway - IP address of the default gateway Default Setting No static route is established.
Page 492: Show Ip Interface
OMMAND NTERFACE Command Usage • This command issues a BOOTP or DHCP client request for any IP interface that has been set to BOOTP or DHCP mode via the ip address command. • DHCP requires the server to reassign the client’s last address if available.
Page 493: Show Ip Redirects
show ip redirects This command shows the default gateway configured for this device. Default Setting None Command Mode Privileged Exec Example Console#show ip redirects IP default gateway 10.1.0.254 Console# Related Commands show ip interface (4-252) ping This command sends ICMP echo request packets to another node on the network.
Page 494 OMMAND NTERFACE Command Usage • Use the ping command to see if another site on the network can be reached. • Following are some results of the ping command: - Normal response - The normal response occurs in one to ten seconds, depending on network traffic.
Page 495: Software Specifications
PPENDIX OFTWARE PECIFICATIONS Software Features Authentication Local, RADIUS, TACACS, Port (802.1X), HTTPS, SSH, Port Security Access Control Lists IP, MAC (up to 88 lists) DHCP Client Port Configuration 100BASE-TX: 10/100 Mbps, half/full duplex 1000BASE-T: 10/100 Mbps at half/full duplex, 1000 Mbps at full duplex Flow Control Full Duplex: IEEE 802.3-2002 Half Duplex: Back pressure...
Page 496: Management Features
OFTWARE PECIFICATIONS Spanning Tree Algorithm Spanning Tree Protocol (STP, IEEE 802.1D) Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) VLAN Support Up to 255 groups; port-based or tagged (802.1Q), GVRP for automatic VLAN learning, private VLANs Class of Service Supports four levels of priority and Weighted Round Robin Queueing (which can be configured by VLAN tag or port), Layer 3/4 priority mapping: IP Port, IP Precedence, IP DSCP Multicast Filtering...
Page 497: Standards
RMON Groups 1, 2, 3, 9 (Statistics, History, Alarm, Event) Standards IEEE 802.1D Spanning Tree Protocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1w Rapid Spanning Tree Protocol IEEE 802.1X Port Authentication IEEE 802.3-2002 Ethernet, Fast Ethernet, Gigabit Ethernet Full-duplex flow control Link Aggregation Control Protocol IEEE 802.3ac VLAN tagging...
Page 498: Management Information Bases
OFTWARE PECIFICATIONS Management Information Bases Bridge MIB (RFC 1493) Entity MIB (RFC 2737) Ether-like MIB (RFC 2665) Extended Bridge MIB (RFC 2674) Extensible SNMP Agents MIB (RFC 2742) Forwarding Table MIB (RFC 2096) IGMP MIB (RFC 2933) Interface Group MIB (RFC 2233) Interfaces Evolution MIB (RFC 2863) IP Multicasting related MIBs MAU MIB (RFC 2668)
Page 499: Troubleshooting
Problems Accessing the Management Interface Symptom Cannot connect using Telnet, web browser, or SNMP software ROUBLESHOOTING Table B-1 Troubleshooting Chart Action • Be sure the switch is powered up. • Check network cabling between the management station and the switch. •...
Page 500 ROUBLESHOOTING Table B-1 Troubleshooting Chart (Continued) Symptom Cannot connect using Secure Shell Cannot access the on-board configuration program via a serial port connection Forgot or lost the password Action • If you cannot connect using SSH, you may have exceeded the maximum number of concurrent Telnet/SSH sessions permitted.
Page 501: Using System Logs
Using System Logs If a fault does occur, refer to the Installation Guide to ensure that the problem you encountered is actually caused by the switch. If the problem appears to be caused by the switch, follow these steps: 1. Enable logging. 2.
Page 502 ROUBLESHOOTING...
Page 503: Glossary
Access Control List (ACL) ACLs can limit network traffic and restrict access to certain users or devices by checking each packet for certain IP or MAC (i.e., Layer 2) information. Boot Protocol (BOOTP) used to provide bootup information for network devices, BOOTP is including IP address information, the address of the TFTP server that contains the devices system files, and the name of the boot file.
Page 504 LOSSARY Dynamic Host Control Protocol (DHCP) Provides a framework for passing configuration information to hosts on a TCP/IP network. DHCP is based on the Bootstrap Protocol (BOOTP), adding the capability of automatic allocation of reusable network addresses and additional configuration options. Extensible Authentication Protocol over LAN (EAPOL) EAPOL is a client authentication protocol used by this switch to verify the network access rights for any device that is plugged into the switch.
Page 505 IEEE 802.1D Specifies a general method for the operation of MAC bridges, including the Spanning Tree Protocol. IEEE 802.1Q VLAN Tagging—Defines Ethernet frame tags which carry VLAN information. It allows switches to assign endstations to different virtual LANs, and defines a standard way for VLANs to communicate across switched networks.
Page 506: Ip Multicast Filtering
LOSSARY IGMP Query On each subnetwork, one IGMP-capable device will act as the querier — that is, the device that asks all hosts to report on the IP multicast groups they wish to join or to which they already belong. The elected querier will be the device with the lowest IP address in the subnetwork.
Page 507: Multicast Switching
Link Aggregation See Port Trunk. Link Aggregation Control Protocol (LACP) Allows ports to automatically negotiate a trunked link with LACP-configured ports on another device. Management Information Base (MIB) An acronym for Management Information Base. It is a set of database objects that contains information about a specific device.
Page 508: Port Mirroring
LOSSARY Port Mirroring A method whereby data on a target port is mirrored to a monitor port for troubleshooting with a logic analyzer or RMON probe. This allows data on the target port to be studied unobstructively. Port Trunk Defines a network link aggregation and trunking method which specifies how to create a single high-speed logical link that combines several lower-speed physical links.
Page 509 Simple Network Management Protocol (SNMP) The application protocol in the Internet suite of protocols which offers network management services. Simple Network Time Protocol (SNTP) allows a device to set its internal clock based on periodic updates SNTP from a Network Time Protocol (NTP) server. Updates can be requested from a specific NTP server, or can be received via broadcasts sent by NTP servers.
Page 510 LOSSARY User Datagram Protocol (UDP) provides a datagram mode for packet-switched communications. It uses IP as the underlying transport mechanism to provide access to IP-like services. UDP packets are delivered just like IP packets – connection-less datagrams that may be discarded before reaching their targets. UDP is useful when TCP would be too complex, too slow, or just unnecessary.
Page 511: Index
Numerics 802.1X, port authentication 3-67 acceptable frame type 3-155 Access Control List See ACL Extended IP 3-79 4-117 4-122 MAC 3-80 4-117 4-128 – 4-128 4-131 Standard IP 3-79 4-117 address table 3-121 4-178 aging time 3-124 4-182 BOOTP 3-19 4-248 BPDU 3-125 broadcast storm, threshold 3-108...
Page 512 NDEX GARP VLAN Registration Protocol See GVRP gateway, default 3-18 4-250 GVRP global setting 4-216 interface configuration 3-156 GVRP, global setting 3-146 hardware version, displaying 3-13 HTTPS 3-54 4-42 HTTPS, secure server 3-54 IEEE 802.1D 3-125 4-185 IEEE 802.1w 3-125 4-185 IEEE 802.1X 3-67 4-107...
Page 513 password, line 4-17 4-18 passwords 2-5 administrator setting 3-48 path cost 3-127 3-136 method 3-132 4-189 STA 3-127 3-136 4-189 port authentication 3-67 port priority configuring 3-167 4-221 default ingress 3-167 STA 3-136 4-192 port security, configuring 3-65 port, statistics 3-114 4-154 ports autonegotiation 3-91...
Page 514 NDEX STA 3-124 4-183 edge port 3-137 3-140 global settings, configuring 3-130 – 4-184 4-189 global settings, displaying 3-126 interface settings 3-134 4-196 link type 3-137 3-140 path cost 3-127 3-136 path cost method 3-132 port priority 3-136 4-192 protocol migration 3-140 transmission limit 3-132 standards, IEEE A-3 startup files...
Page 516 FOR TECHNICAL SUPPORT, CALL: From U.S.A. and Canada (24 hours a day, 7 days a week) (800) SMC-4-YOU; Phn: (949) 679-8000; Fax: (949) 679-1481 From Europe: Contact details can be found on www.smc-europe.com or www.smc.com INTERNET E-mail addresses: techsupport@smc.com european.techsupport@smc-europe.com Driver updates: http://www.smc.com/index.cfm?action=tech_support_drivers_downloads World Wide Web:...

This manual is also suitable for:

6752al2 - annexe 1

SMC Networks TIGERSWITCH SMC6752AL2 Management Manual

1 Introduction

2 Initial Configuration

3 Configuring the Switch

4 Command Line Interface

Quick Links

Management Guide

Related Manuals for SMC Networks TIGERSWITCH SMC6752AL2

Summary of Contents for SMC Networks TIGERSWITCH SMC6752AL2