Download Print this page

SMC Networks SMC TigerStack III SMC6824M Management Manual

SMC Networks SMC TigerStack III SMC6824M Management Manual

24-port fast ethernet switch

Hide thumbs Also See for SMC TigerStack III SMC6824M:

Installation manual (82 pages)

,

Specifications (2 pages)

Table Of Contents

Table of Contents

Advertisement

Quick Links

See also: Installation Manual

TigerStack III 10/100

24-Port Fast Ethernet Switch

◆ 24 auto-MDI/MDI-X 10BASE-T/100BASE-TX ports

◆ 10BASE-T/100BASE-TX ports support PoE capabilities*

◆ 2 Gigabit combo ports (RJ-45/SFP)

◆ 8.8 Gbps of aggregate bandwidth

◆ Stacks up to 8 units

◆ Non-blocking switching architecture

◆ Spanning Tree Protocol, RSTP, and MSTP

◆ Up to six LACP or static 4-port trunks

◆ RADIUS and TACACS+ authentication

◆ Rate limiting for bandwidth management

◆ CoS support for four-level priority

◆ Full support for VLANs with GVRP

◆ IP Multicasting with IGMP Snooping

◆ Manageable via console, Web, SNMP/RMON

Management Guide

SMC6824M

SMC6824MPE*

SMC6826MPE*

Table of Contents

Advertisement

Table of Contents

Need help?

Need help?

Do you have a question about the SMC TigerStack III SMC6824M and is the answer not in the manual?

Questions and answers

Summary of Contents for SMC Networks SMC TigerStack III SMC6824M

Page 1: Management Guide
TigerStack III 10/100 24-Port Fast Ethernet Switch ◆ 24 auto-MDI/MDI-X 10BASE-T/100BASE-TX ports ◆ 10BASE-T/100BASE-TX ports support PoE capabilities* ◆ 2 Gigabit combo ports (RJ-45/SFP) ◆ 8.8 Gbps of aggregate bandwidth ◆ Stacks up to 8 units ◆ Non-blocking switching architecture ◆...
Page 3 TigerStack III 10/100 Management Guide From SMC’s Tiger line of feature-rich workgroup LAN solutions 38 Tesla Irvine, CA 92618 Phone: (949) 679-8000 June 2005 Pub. # 150200037700A...
Page 4 38 Tesla Irvine, CA 92618 All rights reserved. Trademarks: SMC is a registered trademark; and EZ Switch, TigerStack and TigerSwitch are trademarks of SMC Networks, Inc. Other product and company names are trademarks or registered trademarks of their respective holders.
Page 5 IMITED ARRANTY Limited Warranty Statement: SMC Networks, Inc. (“SMC”) warrants its products to be free from defects in workmanship and materials, under normal use and service, for the applicable warranty term. All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized Reseller.
Page 6 * SMC will provide warranty service for one year following discontinuance from the active SMC price list. Under the limited lifetime warranty, internal and external power supplies, fans, and cables are covered by a standard one-year warranty from date of purchase. SMC Networks, Inc. 38 Tesla Irvine, CA 92618...
Page 7: Table Of Contents
Connecting to the Switch ........
Page 8 Displaying System Information ......3-13 Displaying Switch Hardware/Software Versions ... 3-15 Displaying Bridge Extension Capabilities .
Page 9 Replacing the Default Secure-site Certificate ..3-77 Configuring the Secure Shell ......3-78 Generating the Host Key Pair .
Page 10 Power Over Ethernet Settings ....... 3-145 Switch Power Status ....... . . 3-146 Setting a Switch Power Budget .
Page 11 Mapping CoS Values to Egress Queues ... . . 3-204 Selecting the Queue Mode ......3-206 Setting the Service Weight for Traffic Classes .
Page 12 ABLE OF ONTENTS Negating the Effect of Commands ..... . . 4-6 Using Command History ....... 4-6 Understanding Command Modes .
Page 13 enable password ....... . . 4-36 IP Filter Commands ........4-37 management .
Page 14 ABLE OF ONTENTS logging sendmail ....... . . 4-67 show logging sendmail ......4-68 Time Commands .
Page 15 radius-server key ....... . 4-102 radius-server retransmit ......4-103 radius-server timeout .
Page 16 ABLE OF ONTENTS match access-list ip ......4-137 show marking ........4-138 MAC ACLs .
Page 17 negotiation ........4-173 capabilities .
Page 18 ABLE OF ONTENTS spanning-tree transmission-limit ..... . . 4-213 spanning-tree backup-root ......4-214 spanning-tree mst-configuration .
Page 19 switchport private-vlan host-association ... . . 4-246 switchport private-vlan mapping ....4-246 show vlan private-vlan .
Page 20 ABLE OF ONTENTS IGMP Query Commands (Layer 2) ....4-273 ip igmp snooping querier ......4-273 ip igmp snooping query-count .
Page 21 PPENDICES Software Specifications ......A-1 Software Features ......... . . A-1 Management Features .
Page 22 ABLE OF ONTENTS xviii...
Page 23 Web Page Configuration Buttons ....3-4 Table 3-2 Switch Main Menu ......3-6 Table 3-3 Logging Levels .
Page 24 ABLES Table 4-19 show logging flash/ram - display description ..4-62 Table 4-20 show logging trap - display description ... . . 4-63 Table 4-21 SMTP Commands .
Page 25 Table 4-56 Spanning Tree Commands ..... . 4-204 Table 4-57 VLAN Commands ......4-230 Table 4-58 Editing VLAN Groups .
Page 26 ABLES xxii...
Page 27 Figure 3-18 Enabling and Configuring SMTP Alerts ... . 3-41 Figure 3-19 Resetting the Switch ......3-42 Figure 3-20 SNTP Configuration .
Page 28 Figure 3-62 Displaying the Global PoE Status ....3-147 Figure 3-63 Setting the Switch Power Budget ....3-148 Figure 3-64 Displaying Port PoE Status .
Page 29 Figure 3-99 Changing Priorities Based on ACL Rules ..3-219 Figure 3-100 Configuring Internet Group Management Protocol . . 3-223 Figure 3-101 Mapping Multicast Switch Ports to VLANs ..3-225 Figure 3-102 Configuring a VLAN to Forward Multicast Traffic . . 3-226 Figure 3-103 Displaying Port Members of Multicast Services .
Page 30 IGURES xxvi...
Page 31: Introduction
The default configuration can be used for most of the features provided by these switches. However, there are many options that you should configure to maximize the switch’s performance for your particular network environment. The 24 10/100 Mbps ports on the SMC6824MPE and SMC6826MPE also support the IEEE 802.3af Power-over-Ethernet (PoE) standard that...
Page 32: Description Of Software Features
Supports IGMP snooping and query * SMC6824MPE and SMC6826MPE only. Description of Software Features The switch provides a wide range of advanced performance enhancing features. Flow control eliminates the loss of packets due to bottlenecks caused by port saturation. Broadcast storm suppression prevents broadcast traffic storms from engulfing the network.
Page 33: Management Features
IEEE 802.1X protocol. This protocol uses the Extensible Authentication Protocol over LANs (EAPOL) to request user credentials from the 802.1X client, and then uses the EAP between the switch and the authentication server to verify the client’s right to access the network via an authentication server (i.e., RADIUS server).
Page 34 Static Addresses – A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.
Page 35 (CRC). This prevents bad frames from entering the network and wasting bandwidth. To avoid dropping frames on congested ports, the switch provides 8 MB for frame buffering. This buffer can queue packets awaiting transmission on congested networks.
Page 36 VLAN members from being segmented from the rest of the group (as sometimes occurs with IEEE 802.1D STP). Virtual LANs – The switch supports up to 255 VLANs. A Virtual LAN is a collection of network nodes that share the same collision domain regardless of their physical location or connection point in the network.
Page 37: System Defaults
Class of Service value by the switch, and the traffic then sent to the corresponding output queue. Multicast Filtering – Specific multicast traffic can be assigned to its own VLAN to ensure that it does not interfere with normal network traffic and to guarantee real-time delivery by setting the required priority level for the designated VLAN.
Page 38: Table 1-2 System Defaults
NTRODUCTION Table 1-2 System Defaults Function Parameter Authentication Privileged Exec Level Normal Exec Level Enable Privileged Exec from Normal Exec Level RADIUS Authentication TACACS Authentication 802.1X Port Authentication HTTPS Port Security IP Filtering Web Management HTTP Server HTTP Port Number HTTP Secure Server HTTP Secure Port Number SNMP...
Page 39 Table 1-2 System Defaults Function Parameter Power over Status Ethernet Rate Limiting Input and output limits Port Trunking Static Trunks LACP Broadcast Storm Status Protection Broadcast Limit Rate Spanning Tree Status Protocol Fast Forwarding (Edge Port) Disabled Address Table Aging Time Virtual LANs Default VLAN PVID...
Page 40 NTRODUCTION Table 1-2 System Defaults Function Parameter IP Settings Management VLAN IP Address Subnet Mask Default Gateway DHCP BOOTP Multicast Filtering IGMP Snooping System Log Status Messages Logged Messages Logged to Flash SMTP Email Alerts Event Handler SNTP Clock Synchronization * SMC6824MPE and SMC6826MPE only.
Page 41: Initial Configuration
A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI). Note: The IP address for this switch is assigned via DHCP by default. To change this address, see “Setting an IP Address” on page 2-7.
Page 42 NITIAL ONFIGURATION The switch’s CLI configuration program, web interface, and SNMP agent allow you to perform the following management functions: • Set user names and passwords • Set an IP interface for the management VLAN • Configure SNMP parameters •...
Page 43: Required Connections
Required Connections The switch provides an RS-232 serial port that enables a connection to a PC or terminal for monitoring and configuring the switch. A null-modem console cable is provided with the switch. Note: When configuring a stack, connect to the console port on the Master unit.
Page 44: Remote Connections
IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol. The IP address for this switch is obtained via DHCP by default. To manually configure this address or enable dynamic address assignment via DHCP or BOOTP, see “Setting an IP Address”...
Page 45: Stack Operations
CLI. • If the Master/Slave button is pushed in on more than one switch, or is not pressed on any switch, the system will not be able to initialize the stack connections.
Page 46: Resilient Ip Interface For Management Access
Access to both CLI levels are controlled by user names and passwords. The switch has a default user name and password for each level. To log into the CLI at the Privileged Exec level using the default user name and password, perform these steps: 1.
Page 47: Setting Passwords
Manual — You have to input the information, including IP address and subnet mask. If your management station is not in the same IP subnet as the switch, you will also need to specify the default gateway router. ASIC ONFIGURATION...
Page 48: Manual Configuration
VLAN. Manual Configuration You can manually assign an IP address to the switch. You may also need to specify a default gateway that resides between this device and management stations that exist on another network segment. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods.
Page 49: Dynamic Configuration
If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the switch will start broadcasting service requests as soon as it is powered on. To automatically configure the switch by communicating with BOOTP or...
Page 50: Enabling Snmp Management Access
The switch can be configured to accept management commands from Simple Network Management Protocol (SNMP) applications such as SMC EliteView. You can configure the switch to (1) respond to SNMP requests or (2) generate SNMP traps. When SNMP management stations send requests to the switch (either to return information or to set a parameter), the switch provides the requested data or sets the specified parameter.
Page 51: Community Strings (For Snmp Version 1 And 2C Clients)
- Specifies read-write access. Authorized management stations are able to both retrieve and modify MIB objects. To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it is recommended that you change the default community strings.
Page 52: Trap Receivers
Trap Receivers You can also specify SNMP stations that are to receive traps from the switch. To configure a trap receiver, use the “snmp-server host” command. From the Privileged Exec level global configuration mode prompt, type: “snmp-server host host-address community-string [version {1 | 2c | 3 {auth | noauth | priv}}]”...
Page 53: Saving Configuration Settings
Console(config)# For a more detailed explanation on how to configure the switch for access from SNMP v3 clients, refer to “Simple Network Management Protocol” on page 3-45, or refer to the specific CLI commands for SNMP starting on page 4-151.
Page 54: Managing System Files
Diagnostic Code — Software that is run during system boot-up, also known as POST (Power On Self-Test). Due to the size limit of the flash memory, the switch supports only two operation code files, and three configuration files (including the factory defaults file).
Page 55: Configuring Power Over Ethernet
DC power to be supplied to attached devices over the unused pairs of wires in the connecting Ethernet cable. Any 802.3af compliant device attached to a port can directly draw power from the switch over the Ethernet cable without requiring its own separate power source. This...
Page 56 NITIAL ONFIGURATION 2-16...
Page 57: Configuring The Switch
Telnet. For more information on using the CLI, refer to Chapter 4 “Command Line Interface.” Prior to accessing the switch from a Web browser, be sure you have first performed the following tasks: 1. Configure the switch with a valid IP address, subnet mask, and default gateway using an out-of-band serial connection, BOOTP or DHCP protocol (see “Setting the IP Address”...
Page 58 If you log in as “admin” (Privileged Exec level), you can change the settings on any page. 3. If the path between your management station and this switch does not pass through any device that uses the Spanning Tree Algorithm, then you can set the switch port attached to your management station to fast forwarding (i.e., enable Admin...
Page 59: Navigating The Web Browser Interface
“admin.” Home Page When your Web browser connects with the switch’s Web agent, the home page is displayed as shown below. The home page displays the Main Menu on the left side of the screen and System Information on the right side.
Page 60: Configuration Options
ONFIGURING THE WITCH Configuration Options Configurable parameters have a dialog box or a drop-down list. Once a configuration change has been made on a page, be sure to click on the Apply button to confirm the new setting. The following table summarizes the Web page configuration buttons.
Page 61: Panel Display
Panel Display The web agent displays an image of the switch’s ports. The Mode can be set to display different information for the ports, including Active (i.e., up or down), Duplex (i.e., half or full duplex), or Flow Control (i.e., with or without flow control).
Page 62: Main Menu
ONFIGURING THE WITCH Main Menu Using the onboard Web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program. Menu...
Page 63 Configures community strings and related trap functions Allows SNMP to be enabled or disabled Sets the SNMP v3 engine ID on this switch Sets the SNMP v3 engine ID for a remote device Configures SNMP v3 users on this switch...
Page 64 Aggregation Port Port Counters Information Port Internal Information Port Neighbors Information Table 3-2 Switch Main Menu (Continued) Description Port authentication Displays the global configuration setting Configures the global configuration setting Sets parameters for individual ports Displays protocol statistics for the selected...
Page 65 Sets the output rate limit for each trunk Lists Ethernet and RMON port statistics Displays the status of global power parameters Configures the power budget for the switch Displays the status of port power parameters 3-148 Configures port power parameters Displays entries for interface, address or...
Page 66 Static Table Static Membership by Port Port Configuration Trunk Configuration 3-10 Table 3-2 Switch Main Menu (Continued) Description Configures individual trunk settings for STA spanning tree instance Displays port settings for a specified MST instance Displays trunk settings for a specified MST...
Page 67 Table 3-2 Switch Main Menu (Continued) Menu Private VLAN Information Configuration Association Port Information Port Configuration Trunk Information Trunk Configuration Priority Default Port Priority Default Trunk Priority Traffic Classes Traffic Classes Status Queue Mode Queue Scheduling IP Precedence/DSCP Priority Status...
Page 68 Static Host Table Cache * Only the SMC6824MPE and SMC6826MPE support Power over Ethernet. 3-12 Table 3-2 Switch Main Menu (Continued) Description Enables mapping IP Precedence and DSCP Priority settings to ports, or trunks. Sets the CoS value and corresponding output...
Page 69: Basic Configuration
You can easily identify the system by providing a descriptive name, location and contact information. Field Attributes • System Name – Name assigned to the switch system. • Object ID – MIB II object ID for switch’s network management subsystem. (SMC6824M: 1.3.6.1.4.1.202.20.28; SMC6824MPE: 1.3.6.1.4.1.202.20.41; SMC6826MPE: 1.3.6.1.4.1.202.20.53) •...
Page 70: Figure 3-3 System Information
ONFIGURING THE WITCH Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that access the Command Line Interface via Telnet.) 3-14 Figure 3-3 System Information...
Page 71: Displaying Switch Hardware/Software Versions
Field Attributes Main Board • Serial Number – The serial number of the switch. • Number of Ports – Number of built-in ports. • Hardware Version – Hardware version of the main board. 0 days, 0 hours, 6 minutes, and 26.75 seconds...
Page 72 • Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code. • Operation Code Version – Version number of runtime code. • Role – Shows that this switch is operating as Master or Slave. Expansion Slots • Expansion Slot 1/2 – Stacking module, or - SMC6824M: Optional modules (1000BASE-T, 1000BASE-XGBIC, 100BASE-FX multimode or single-mode ).
Page 73: Figure 3-4 General Switch Information
Web – Click System, Switch Information. Figure 3-4 General Switch Information CLI – Use the following command to display version information. Console#show version Unit 1 Serial number: Service tag: Hardware version: Module A type: Module B type: Number of ports:...
Page 74: Displaying Bridge Extension Capabilities
• Extended Multicast Filtering Services – This switch does not support the filtering of individual multicast addresses based on GMRP (GARP Multicast Registration Protocol). • Traffic Classes – This switch provides mapping of user priorities to multiple traffic classes. (Refer to “Class of Service Configuration” on page 3-202.) •...
Page 75: Setting The Ip Address
By default, the switch uses DHCP to assign IP settings to VLAN 1 on the switch. If you wish to manually configure IP settings, you need to set an IP address and subnet mask that is compatible with your network.
Page 76: Command Attributes
• Management VLAN – ID of the configured VLAN (1-4093). This is the only VLAN through which you can gain management access to the switch. By default, all ports on the switch are members of VLAN 1, so a management station can be connected to any port on the switch.
Page 77: Manual Configuration
Manual Configuration Web – Click System, IP Configuration. Select the VLAN through which the management station is attached, set the IP Address Mode to “Static.” Enter the IP address, subnet mask and gateway, then click Apply. Figure 3-6 IP Interface Configuration - Manual CLI –...
Page 78: Using Dhcp/Bootp
IP Address Mode to DHCP or BOOTP. Click Apply to save your changes. Then click Restart DHCP to immediately request a new address. Note that the switch will also broadcast a request for IP configuration settings on each power reset.
Page 79: Managing Firmware
You can upload/download firmware to or from a TFTP server, or copy files to and from switch units in a stack. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation.
Page 80: Downloading System Software From A Server
TFTP server, set the file type to “opcode,” enter the file name of the software to download, select a file on the switch to overwrite or specify a new file name, then click Apply. If you replaced the current firmware used for startup and want to start using the new operation code, reboot the system via the System/Reset menu.
Page 81: Figure 3-9 Setting The Startup Code
ASIC ONFIGURATION If you download to a new destination file, go to the File, Set Start-Up menu, mark the operation code file used at startup, and click Apply. To start the new firmware, reboot the system via the System/Reset menu. Figure 3-9 Setting the Startup Code To delete a file, select System, File, Delete.
Page 82: Saving Or Restoring Configuration Settings
• File Transfer Method - The configuration copy operation includes these options: - file to file - Copies a file within the switch directory, assigning it a new name. - file to running-config - Copies a file in the switch to the running configuration.
Page 83 - tftp to startup-config - Copies a file from a TFTP server to the startup config. - file to unit - Copies a file from this switch to another unit in the stack. - unit to file - Copies a file from another unit in the stack to this switch •...
Page 84: Downloading Configuration Settings From A Server
Web – Click System, File, Copy. Choose “tftp to startup-config” or “tftp to file,” and enter the IP address of the TFTP server. Specify the name of the file to download and select a file on the switch to overwrite or specify a new file name, then click Apply.
Page 85: Figure 3-12 Setting The Startup Configuration Settings
Figure 3-12 Setting the Startup Configuration Settings CLI – Enter the IP address of the TFTP server, specify the source file on the server, set the startup file name on the switch, and then restart the switch. Console#copy tftp startup-config TFTP server ip address: 192.168.1.19...
Page 86: Console Port Settings
Console Port Settings You can access the onboard configuration program by attaching a VT100 compatible device to the switch’s serial console port. Management access through the console port is controlled by various parameters, including a password, timeouts, and basic communication settings. These parameters can be configured via the Web or CLI interface.
Page 87 • Password Threshold – Sets the password intrusion threshold, which limits the number of failed logon attempts. When the logon attempt threshold is reached, the system interface becomes silent for a specified amount of time (set by the Silent Time parameter) before allowing the next logon attempt.
Page 88: Figure 3-13 Console Port Settings
ONFIGURING THE WITCH Web – Click System, Line, Console. Specify the console port connection parameters as required, then click Apply. CLI – Enter Line Configuration mode for the console, then specify the connection parameters as required. To display the current console port settings, use the show line command from the Normal Exec level.
Page 89: Telnet Settings
These parameters can be configured via the Web or CLI interface. Command Attributes • Telnet Status – Enables or disables Telnet access to the switch. (Default: Enabled) • Telnet Port Number – Sets the TCP port number for Telnet on the switch.
Page 90: Figure 3-14 Configuring The Telnet Interface
ONFIGURING THE WITCH Web – Click System, Line, Telnet. Specify the connection parameters for Telnet access, then click Apply. Figure 3-14 Configuring the Telnet Interface CLI – Enter Line Configuration mode for a virtual terminal, then specify the connection parameters as required. To display the current virtual terminal settings, use the show line command from the Normal Exec level.
Page 91: Configuring Event Logging
Configuring Event Logging The switch allows you to control the logging of error messages, including the type of events that are recorded in switch memory, logging to a remote System Log (syslog) server, and displays a list of recent event messages.
Page 92: Table 3-3 Logging Levels
0 to level 7 will be logged to RAM. (Range: 0-7, Default: 6) The switch allows you to specify which levels are logged to RAM or flash memory. Note:The Flash Level must be equal to or less than the RAM Level.
Page 93: Remote Log Configuration
Web – Click System, Log, System Logs. Specify the System Log Status, set the level of event messages to be logged to RAM and flash memory, and then click Apply. CLI – Enable system logging and then specify the level of messages to be logged to RAM and flash memory.
Page 94: Figure 3-16 Remote Logs
This attribute specifies the facility type tag sent in syslog messages. (See RFC 3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to process messages, such as sorting or storing messages in the corresponding database.
Page 95: Displaying Log Messages
Displaying Log Messages Use the Logs page to scroll through the logged system and event messages. The switch can store up to 2048 log entries in temporary random access memory (RAM; i.e., memory flushed on power reset) and up to 4096 entries in permanent flash memory.
Page 96: Sending Simple Mail Transfer Protocol Alerts
7 to level 0. (Default: Level 7) • SMTP Server List – Specifies a list of up to three recipient SMTP servers. The switch attempts to connect to the other listed servers if the first fails. Use the New SMTP Server text field and the Add/Remove buttons to configure the list.
Page 97: Figure 3-18 Enabling And Configuring Smtp Alerts
ASIC ONFIGURATION Web – Click System, Log, SMTP. Enable SMTP, specify a source email address, and select the minimum severity level. To add an IP address to the SMTP Server List, type the new IP address in the SMTP Server field and click Add.
Page 98: Resetting The System
WITCH CLI – Enter the IP address of at least one SMTP server, set the syslog severity level to trigger an email message, and specify the switch (source) and up to five recipient (destination) email addresses. Enable SMTP with the logging sendmail command to complete the configuration. Use the show logging sendmail command to display the current SMTP configuration.
Page 99: Setting The System Clock
You can also manually set the clock using the CLI. (See “calendar set” on page 4-74.) If the clock is not set, the switch will only record the time from the factory default set at the last bootup.
Page 100: Setting The Time Zone
WITCH Web – Select SNTP, Configuration. Modify any of the required parameters and click Apply. CLI – This example configures the switch to operate as an SNTP client and then displays the current time and settings. Console(config)#sntp server 10.1.0.19 137.82.140.80 128.250.36.2...
Page 101: Simple Network Management Protocol
• Hours (0-13) – The number of hours before UTC (0-12) or after UTC (0-13). • Minutes (0-59) – The number of minutes before/after UTC. • Direction – Configures the time zone to be before (east) or after (west) UTC. Web –...
Page 102 “groups” that are defined by a security model and specified security levels. Each group also has a defined security access to set of MIB objects for reading and writing, which are known as “views.” The switch has a default view (all MIB objects) and default groups defined for security models v1 and v2c.
Page 103: Table 3-4 Snmpv3 Security Models And Levels
Table 3-4 SNMPv3 Security Models and Levels Model Level Group Read noAuth public NoPriv (read only) noAuth private NoPriv (read/ write) noAuth user NoPriv defined noAuth public NoPriv (read only) noAuth private NoPriv (read/ write) noAuth user NoPriv defined noAuth user NoPriv defined...
Page 104: Enabling The Snmp Agent
IP Trap Managers should be listed in this table. For security reasons, you should consider removing the default strings. Command Attributes • SNMP Community Capability – The switch supports up to five community strings. • Current – Displays a list of the community strings currently configured.
Page 105: Figure 3-23 Configuring Snmp Community Strings
• Access Mode – Specifies the access rights for the community string: - Read-Only – Authorized management stations are only able to retrieve MIB objects. - Read/Write – Authorized management stations are able to both retrieve and modify MIB objects. Web –...
Page 106: Specifying Trap Managers And Trap Types
SNMP access for the host. • Notifications are issued by the switch as trap messages by default. The recipient of a trap message does not send a response to the switch. Traps are therefore not as reliable as inform messages, which include a request for acknowledgement of receipt.
Page 107 5. Specify a remote engine ID where the user resides (page 3-54). 6. Then configure a remote user (page 3-58). Command Attributes • Trap Manager Capability – This switch supports up to five trap managers. • Current – Displays a list of the trap managers currently configured.
Page 108: Figure 3-24 Configuring Snmp Trap Managers
ONFIGURING THE WITCH - Retry times – The maximum number of times to resend an inform message if the recipient does not acknowledge receipt. (Range: 0-255; Default: 3) • Enable Authentication Traps specified IP trap managers whenever authentication of an SNMP request fails.
Page 109: Configuring Snmpv3 Management Access
The engine ID is also used in combination with user passwords to generate the security keys for authenticating and encrypting SNMPv3 packets. A local engine ID is automatically generated that is unique to the switch. This is referred to as the default engine ID. If the local engine ID is deleted or changed, all SNMP users will be cleared.
Page 110: Specifying A Remote Engine Id
ONFIGURING THE WITCH Web – Click SNMP, SNMPv3, Engine ID. Enter an ID of up to 26 hexadecimal characters and then click Save. CLI – This example sets an SNMPv3 engine ID. Console(config)#snmp-server engine-id local 12345abcdef Console(config)#exit Console#show snmp engine-id Local SNMP engineID: 12345abcdef000000000000000 Local SNMP engineBoots: 1 Console#...
Page 111: Configuring Snmpv3 Users
Web – Click SNMP, SNMPv3, Remote Engine ID. Enter an ID of up to 26 hexadecimal characters and then click Save. CLI – This example specifies a remote SNMPv3 engine ID. Console(config)#snmp-server engineID remote 54321 192.168.1.19 Console(config)#exit Console#show snmp engine-id Local SNMP engineID: 8000002a8000000000e8666672 Local SNMP engineBoots: 1 Remote SNMP engineID...
Page 112 ONFIGURING THE WITCH - AuthPriv – SNMP communications use both authentication and encryption (only available for the SNMPv3 security model). • Authentication Protocol – The method used for user authentication. (Options: MD5, SHA; Default: MD5) • Authentication Password – A minimum of eight plain text characters is required.
Page 113: Figure 3-27 Configuring Snmpv3 Users
IMPLE ETWORK ANAGEMENT ROTOCOL Web – Click SNMP, SNMPv3, Users. Click New to configure a user name. In the New User page, define a name and assign it to a group, then click Add to save the configuration and return to the User Name list. To delete a user, check the box next to the user name, then click Delete.
Page 114: Configuring Remote Snmpv3 Users
ONFIGURING THE WITCH CLI – Use the snmp-server user command to configure a new user name and assign it to a group. Console(config)#snmp-server user chris group r&d v3 auth md5 greenpeace priv des56 einstien Console(config)#exit Console#show snmp user EngineId: 80000034030001f488f5200000 User Name: chris Authentication Protocol: md5 Privacy Protocol: des56...
Page 115 Command Attributes • User Name – The name of user connecting to the SNMP agent. (Range: 1-32 characters) • Group Name – The name of the SNMP group to which the user is assigned. (Range: 1-32 characters) • Engine ID – The engine identifier for the SNMP agent on the remote device where the remote user resides.
Page 116: Figure 3-28 Configuring Remote Snmpv3 Users
ONFIGURING THE WITCH Web – Click SNMP, SNMPv3, Remote Users. Click New to configure a user name. In the New User page, define a name and assign it to a group, then click Add to save the configuration and return to the User Name list. To delete a user, check the box next to the user name, then click Delete.
Page 117: Configuring Snmpv3 Groups
CLI – Use the snmp-server user command to configure a new user name and assign it to a group. Console(config)#snmp-server user mark group r&d remote 192.168.1.19 v3 auth md5 greenpeace priv des56 einstien Console(config)#exit Console#show snmp user No user exist. SNMP remote user EngineId: 80000000030004e2b316c54321 User Name: mark...
Page 118: Table 3-5 Supported Notification Messages
ONFIGURING THE WITCH • Notify View – The configured view for notifications. (Range: 1-64 characters) Table 3-5 Supported Notification Messages Object Label RFC 1493 Traps newRoot topologyChange SNMPv2 Traps coldStart 3-62 Object ID 1.3.6.1.2.1.17.0.1 1.3.6.1.2.1.17.0.2 1.3.6.1.6.3.1.1.5.1 Description The newRoot trap indicates that the sending agent has become the new root of...
Page 119 Table 3-5 Supported Notification Messages (Continued) Object Label Object ID warmStart 1.3.6.1.6.3.1.1.5.2 1.3.6.1.6.3.1.1.5.3 linkDown 1.3.6.1.6.3.1.1.5.4 linkUp IMPLE ETWORK ANAGEMENT ROTOCOL Description A warmStart trap signifies that the SNMPv2 entity, acting in an agent role, is reinitializing itself such that its configuration is unaltered.
Page 120 ONFIGURING THE WITCH Table 3-5 Supported Notification Messages (Continued) Object Label authenticationFailure RMON Events (V2) risingAlarm fallingAlarm Private Traps swPowerStatus ChangeTrap 3-64 Object ID 1.3.6.1.6.3.1.1.5.5 1.3.6.1.2.1.16.0.1 1.3.6.1.2.1.16.0.2 1.3.6.1.4.1.202.20.28.63.2.1.0.1 1.3.6.1.4.1.202.20.41.63.2.1.0.1 1.3.6.1.4.1.202.20.53.63.2.1.0.1 Description An authenticationFailure trap signifies that the SNMPv2 entity, acting in an agent role, has received a protocol message that is not...
Page 121 Table 3-5 Supported Notification Messages (Continued) Object Label Object ID swIpFilterRejectTrap 1.3.6.1.4.1.202.20.28.63.2.1.0.40 1.3.6.1.4.1.202.20.41.63.2.1.0.40 1.3.6.1.4.1.202.20.53.63.2.1.0.40 swSmtpConnFailure 1.3.6.1.4.1.202.20.28.63.2.1.0.41 Trap 1.3.6.1.4.1.202.20.41.63.2.1.0.41 1.3.6.1.4.1.202.20.53.63.2.1.0.41 pethPsePortOnOff 1.3.6.1.4.1.202.20.41.63.2.1.0.43 Notification 1.3.6.1.4.1.202.20.53.63.2.1.0.43 pethPsePortPower 1.3.6.1.4.1.202.20.41.63.2.1.0.44 MaintenanceStatus 1.3.6.1.4.1.202.20.53.63.2.1.0.44 Notification pethMainPower 1.3.6.1.4.1.202.20.41.63.2.1.0.45 UsageOnNotification 1.3.6.1.4.1.202.20.53.63.2.1.0.45 pethMainPower 1.3.6.1.4.1.202.20.41.63.2.1.0.46 UsageOffNotification 1.3.6.1.4.1.202.20.53.63.2.1.0.46 * These are legacy notifications and therefore must be enabled in conjunction with the corresponding traps on the SNMP Configuration menu (page 3-52).
Page 122: Figure 3-29 Configuring Snmpv3 Groups
ONFIGURING THE WITCH Web – Click SNMP, SNMPv3, Groups. Click New to configure a new group. In the New Group page, define a name, assign a security model and level, and then select read and write views. Click Add to save the new group and return to the Groups list.
Page 123: Setting Snmpv3 Views
CLI – Use the snmp-server group command to configure a new group, specifying the security model and level, and restricting MIB access to defined read and write views. Console(config)#snmp-server group secure-users v3 priv read defaultview write defaultview notify defaultview Console(config)#exit Console#show snmp group Group Name: secure-users Security Model: v3...
Page 124: Figure 3-30 Configuring Snmpv3 Views
In the New View page, define a name and specify OID subtrees in the switch MIB to be included or excluded in the view. Click Back to save the new view and return to the SNMPv3 Views list. For a specific view, click on View OID Subtrees to display the current configuration, or click on Edit OID Subtrees to make changes to the view settings.
Page 125: User Authentication
Row Status: active Console# User Authentication You can restrict management access to this switch and provide secure network access using the following options: • User Accounts – Manually configure management access rights for users. • Authentication Settings – Use remote authentication to configure access rights.
Page 126: Configuring User Accounts
ONFIGURING THE WITCH Configuring User Accounts The guest only has read access for most configuration parameters. However, the administrator has write access for all parameters governing the onboard agent. You should therefore assign a new administrator password as soon as possible, and store it in a safe place. The default guest name is “guest”...
Page 127: Figure 3-31 Configuring User Accounts
Web – Click Security, User Accounts. To configure a new user account, enter the user name, access level, and password, then click Add. To change the password for a specific user, enter the user name and new password, confirm the password by entering it again, then click Apply. Figure 3-31 Configuring User Accounts CLI –...
Page 128: Configuring Local/Remote Logon Authentication
Use the Authentication Settings menu to restrict management access based on specified user names and passwords. You can manually configure access rights on the switch, or you can use a remote access authentication server based on RADIUS or TACACS+ protocols.
Page 129 (Range: 1-30; Default: 2) - Timeout for a reply – The number of seconds the switch waits for a reply from the RADIUS server before it resends the request. (Range: 1-65535; Default: 5)
Page 130: Figure 3-32 Authentication Server Settings
Do not use blank spaces in the string. (Maximum length: 20 characters) Note: The local switch user database has to be set up by manually entering user names and passwords using the CLI. (See “username” on page 4-34.) Web –...
Page 131: Configuring Https
Server port number: 200 Console(config)# Configuring HTTPS You can configure the switch to enable the Secure Hypertext Transfer Protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Command Usage •...
Page 132: Table 3-6 Https Support
• HTTPS Status – Allows you to enable/disable the HTTPS server feature on the switch. (Default: Enabled) • Change HTTPS Port Number – Specifies the UDP port number used for HTTPS/SSL connection to the switch’s web interface. (Default: Port 443) 3-76...
Page 133: Replacing The Default Secure-Site Certificate
This is because the certificate has not been signed by an approved certification authority. If you want this warning to be replaced by a message confirming that the connection to the switch is secure, you must obtain a unique certificate and a private key and password from a recognized certification authority.
Page 134: Configuring The Secure Shell
Source certificate file name: <certificate file name> Source private file name: <private key file name> Private password: <password for private key> Note:The switch must be reset for the new certificate to be activated. To reset the switch, type: Configuring the Secure Shell The Berkley-standard includes remote access tools originally designed for Unix systems.
Page 135 51941746772984865468615717739390164779355942303577413098022737087794545 24083971752646358058176716709574804776117 3. Import Client’s Public Key to the Switch – Use the copy tftp public-key command (page 4-82) to copy a file containing the public key for all the SSH client’s granted management access to the switch. (Note that these clients must be configured locally on the switch via the User Accounts page as described on page 3-70.) The clients are...
Page 136 The switch compares the client's public key to those stored in memory. c. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. d. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch.
Page 137: Generating The Host Key Pair
Generating the Host Key Pair A host public/private key pair is used to provide secure communications between an SSH client and the switch. After generating this key pair, you must provide the host public key to SSH clients and import the client’s public key to the switch as described in the proceeding section (Command Usage).
Page 138: Figure 3-34 Ssh Host-Key Settings
ONFIGURING THE WITCH • Generate – This button is used to generate the host key pair. Note that you must first generate the host key pair before you can enable the SSH server on the SSH Server Settings page. • Clear – This button clears the host key from both volatile memory (RAM) and non-volatile memory (Flash).
Page 139: Configuring The Ssh Server
(Default: Disabled) • Version – The Secure Shell version number. Version 2.0 is displayed, but the switch supports management access via either SSH Version 1.5 or 2.0 clients. • SSH Authentication Timeout – Specifies the time interval in seconds that the SSH server waits for a response from a client during an authentication attempt.
Page 140: Figure 3-35 Ssh Server Settings
• SSH Server-Key Size – Specifies the SSH server key size. (Range: 512-896 bits: Default: 768) - The server key is a private key that is never shared outside the switch. - The host key is shared with the SSH client, and is fixed at 1024 bits.
Page 141: Configuring Port Security
Configuring Port Security Port security is a feature that allows you to configure a switch port with one or more device MAC addresses that are authorized to access the network through that port. When port security is enabled on a port, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number.
Page 142 ONFIGURING THE WITCH • If a port is disabled (shut down) due to a security violation, it must be manually re-enabled from the Port/Port Configuration page (page 3-117). Command Attributes • Port – Port number. • Name – Descriptive text (page 3-114). •...
Page 143: Figure 3-36 Enabling Port Security
Web – Click Security, Port Security. Set the action to take when an invalid address is detected on a port, mark the checkbox in the Status column to enable security for a port, set the maximum number of MAC addresses allowed on a port, and click Apply.
Page 144: Configuring 802.1X Port Authentication
(i.e., Authenticator) responds with an EAPOL identity request. The client provides its identity (such as a user name) in an EAPOL response to the switch, which it forwards to the RADIUS server. The RADIUS server verifies the client identity and sends an access challenge back to the client.
Page 145: Displaying 802.1X Global Settings
RADIUS server specified. • 802.1X must be enabled globally for the switch. • Each switch port that will be used must be set to dot1x “Auto” mode. • Each client that needs to be authenticated must have dot1x client software installed and properly configured.
Page 146: Configuring 802.1X Global Settings
802.1X System Authentication Control – Sets the global setting for 802.1X. (Default: Disabled) Web – Select Security, 802.1X, Configuration. Enable 802.1X globally for the switch, and click Apply. Figure 3-38 802802.1X Global Configuration CLI – This example enables 802.1X globally for the switch. Console(config)#dot1x system-auth-control Console(config)# 3-90 Operation Mode...
Page 147: Configuring Port Settings For 802.1X
• Re-authentication – Sets the client to be re-authenticated after the interval specified by the Re-authentication Period. Re-authentication can be used to detect if a new device is plugged into a switch port. (Default: Disabled) • Max Request – Sets the maximum number of times the switch port will retransmit an EAP request packet to the client before it times out the authentication session.
Page 148: Figure 3-39 802.1X Port Configuration
(Range: 1-65535 seconds; Default: 3600 seconds) • TX Period – Sets the time period during an authentication session that the switch waits before re-transmitting an EAP packet. (Range: 1-65535; Default: 30 seconds) • Authorized - Yes – Connected client is authorized.
Page 149 Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status Authorized disabled enabled 1/25 disabled 1/26 disabled 802.1X Port Details 802.1X is disabled on port 1/1 802.1X is enabled on port 1/2 reauth-enabled: reauth-period: quiet-period: tx-period: supplicant-timeout: 30 server-timeout: reauth-max: max-req:...
Page 150: Displaying 802.1X Statistics
ONFIGURING THE WITCH Displaying 802.1X Statistics This switch can display statistics for dot1x protocol exchanges for any port. Parameter Rx EXPOL Start Rx EAPOL Logoff The number of EAPOL Logoff frames that have been Rx EAPOL Invalid The number of EAPOL frames that have been received by...
Page 151: Figure 3-40 Displaying 802.1X Statistics
Web – Select Security, 802.1X, Statistics. Select the required port and then click Query. Click Refresh to update the statistics. Figure 3-40 Displaying 802.1X Statistics CLI – This example displays the 802.1X statistics for port 4. Console#show dot1x statistics interface ethernet 1/4 Eth 1/4 Rx: EAPOL EAPOL...
Page 152: Filtering Ip Addresses For Management Access
• If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager.
Page 153: Figure 3-41 Entering Ip Addresses To Be Filtered
Web – Click Security, IP Filter. Enter the IP addresses or range of addresses that are allowed management access to an interface, and click Add IP Filtering Entry. Figure 3-41 Entering IP Addresses to be Filtered CLI – This example restricts management access for Telnet and SNMP clients.
Page 154: Configuring Access Control Lists
An ACL is a sequential list of permit or deny conditions that apply to IP addresses, MAC addresses, or other more specific criteria. This switch tests ingress or egress packets against the conditions in an ACL one by one. A packet will be accepted as soon as it matches a permit rule, or dropped as soon as it matches a deny rule.
Page 155: Setting The Acl Name And Type
• When an ACL is bound to an interface as an egress filter, all entries in the ACL must be deny rules. Otherwise, the bind operation will fail. • The switch does not support the explicit “deny any any” rule for the egress IP ACL or the egress MAC ACLs. If these rules are included in ACL, and you attempt to bind the ACL to an interface for egress checking, the bind operation will fail.
Page 156: Configuring A Standard Ip Acl
ONFIGURING THE WITCH Web – Click Security, ACL, Configuration. Enter an ACL name in the Name field, select the list type (IP Standard, IP Extended, or MAC), and click Add to open the configuration page for the new list. CLI – This example creates a standard IP ACL named bill. Console(config)#access-list ip standard bill Console(config-std-acl)# Configuring a Standard IP ACL...
Page 157: Configuring An Extended Ip Acl
Web – Specify the action (i.e., Permit or Deny). Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range. Then click Add.
Page 158 ONFIGURING THE WITCH • Source/Destination Subnet Mask – Subnet mask for source or destination address. (See the description for SubMask on page 3-100.) • Service Type – Packet priority settings based on the following criteria: - Precedence – IP precedence level. (Range: 0-7) - TOS –...
Page 159: Figure 3-44 Configuring Extended Ip Acls
CCESS ONTROL ISTS Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range.
Page 160: Configuring A Mac Acl
ONFIGURING THE WITCH CLI – This example adds three rules: 1. Accept any incoming packets if the source address is in subnet 10.7.1.x. For example, if the rule is matched; i.e., the rule (10.7.1.0 & 255.255.255.0) equals the masked address (10.7.1.2 & 255.255.255.0), the packet passes through.
Page 161 • Ethernet Type Bitmask – Protocol bitmask. (Range: 600-fff hex.) • Packet Format – This attribute includes the following packet types: - Any – Any Ethernet packet type. - Untagged-eth2 – Untagged Ethernet II packets. - Untagged-802.3 – Untagged Ethernet 802.3 packets. - Tagged-eth2 –...
Page 162: Figure 3-45 Configuring Mac Acls
ONFIGURING THE WITCH Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or MAC). If you select “Host,” enter a specific address (e.g., 11-22-33-44-55-66). If you select “MAC,” enter a base address and a hexadecimal bitmask for an address range.
Page 163: Configuring Acl Masks
Configuring ACL Masks You must specify masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/filter packets matching the permit/deny rules specified in an ingress ACL. You can also configure up to seven user-defined masks for an ingress or egress ACL.
Page 164: Configuring An Ip Acl Mask
ONFIGURING THE WITCH Web – Click Security, ACL, Mask Configuration. Click Edit for one of the basic mask types to open the configuration page. CLI – This example creates an IP ingress mask, and then adds two rules. Each rule is checked in order of precedence to look for a match in the ACL entries.
Page 165: Figure 3-47 Configuring An Ip Based Acl
• Source/Destination Subnet Mask – Subnet mask for source or destination address. (See the description for SubMask on page 3-100.) • Protocol Bitmask – Check the protocol field. • Service Type Mask – Check the rule for the specified priority type. (Options: Precedence, TOS, DSCP;...
Page 166: Configuring A Mac Acl Mask
ONFIGURING THE WITCH CLI – This shows that the entries in the mask override the precedence in which the rules are entered into the ACL. In the following example, packets with the source address 10.1.1.1 are dropped because the “deny 10.1.1.1 255.255.255.255”...
Page 167: Figure 3-48 Configuring An Acl Mac Mask
CCESS ONTROL ISTS Web – Configure the mask to match the required rules in the MAC ingress or egress ACLs. Set the mask to check for any source or destination address, a host address, or an address range. Use a bitmask to search for specific VLAN ID(s) or Ethernet type(s).
Page 168: Binding A Port To An Access Control List
• You must configure a mask for an ACL rule before you can bind it to a port. • This switch supports ACLs for both ingress and egress filtering. However, you can only bind one IP ACL and one MAC ACL to any port for ingress filtering, and one IP ACL and one MAC ACL to any port for egress filtering.
Page 169: Figure 3-49 Mapping Acls To Port Ingress/Egress Queues
ACL must be deny rules. Otherwise, the bind operation will fail. • The switch does not support the explicit “deny any any” rule for the egress IP ACL or the egress MAC ACLs. If these rules are included in the ACL, and you attempt to bind the ACL to an interface for egress checking, the bind operation will fail.
Page 170: Port Configuration
ONFIGURING THE WITCH CLI – This example assigns an IP and MAC ingress ACL to port 1, and an IP ingress ACL to port 2. Console(config)#interface ethernet 1/1 Console(config-if)#ip access-group david in Console(config-if)#mac access-group jerry in Console(config-if)#exit Console(config)#interface ethernet 1/2 Console(config-if)#ip access-group david in Console(config-if)# Port Configuration...
Page 171: Figure 3-50 Port - Port Information
Web – Click Port, Port Information or Trunk Information. Figure 3-50 Port - Port Information Field Attributes (CLI) Basic information: • Port type – Indicates the port type. (100BASE-TX, 1000BASE-GBIC, 100BASE-FX-S, 100BASE-FX-M, 1000BASE-T, or SFP) • MAC address – The physical layer address for this port. (To access this item on the web, see “Setting the IP Address”...
Page 172 ONFIGURING THE WITCH - 100full - Supports 100 Mbps full-duplex operation - 1000full - Supports 1000 Mbps full-duplex operation - Sym - Transmits and receives pause frames for flow control - FC - Supports flow control • Broadcast storm – Shows if broadcast storm control is enabled or disabled.
Page 173: Configuring Interface Connections
CLI – This example shows the connection status for Port 13. Console#show interfaces status ethernet 1/13 Information of Eth 1/13 Basic information: Port type: Mac address: Configuration: Name: Port admin: Speed-duplex: Capabilities: Broadcast storm: Broadcast storm limit: Flow control: LACP: Port security: Max MAC count: Port security action:...
Page 174 - FC - Supports flow control Flow control can eliminate frame loss by “blocking” traffic from end stations or segments connected directly to the switch when its buffers fill. When enabled, back pressure is used for half-duplex operation and IEEE 802.3x for full-duplex operation. (Avoid using flow control on a port connected to a hub unless it is actually required to solve a problem.
Page 175: Figure 3-51 Configuring Port Attributes
Web – Click Port, Port Configuration or Trunk Configuration. Modify the required interface settings, and click Apply. Figure 3-51 Configuring Port Attributes CLI – Select the interface, and then enter the required settings. Console(config)#interface ethernet 1/13 Console(config-if)#description RD SW#13 Console(config-if)#shutdown Console(config-if)#no shutdown Console(config-if)#no negotiation Console(config-if)#speed-duplex 100half...
Page 176: Creating Trunk Groups
• Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • You can create up to six trunks on the switch, with up to four ports per trunk. Note that because the stack functions conceptually as a single system, you can include ports from different units in the same trunk.
Page 177: Statically Configuring A Trunk
However, note that the static trunks on this switch are Cisco EtherChannel compatible. • To avoid creating a loop in the network, be sure you add a static trunk via the...
Page 178: Figure 3-52 Static Trunk Configuration
Add. After you have completed adding ports to the member list, click Apply. CLI – This example creates trunk 1 with port 24 on unit 1 and 2. Just connect these ports to two static trunk ports on another switch to form a trunk. Console(config)#interface port-channel 1...
Page 179: Enabling Lacp On Selected Ports
LACP will automatically be assigned the next available trunk ID. • If more than four ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails.
Page 180: Figure 3-53 Lacp Port Configuration
- Unit – Stack unit. (Range: 1-8) - Port – Port identifier. (Range: 1-26) Web – Click Port, LACP, Configuration. Select any of the switch ports from the scroll-down port list and click Add. After you have completed adding ports to the member list, click Apply.
Page 181: Configuring Lacp Parameters
Console#show interfaces status port-channel 1 Information of Trunk 1 Basic information: Port type: Mac address: Configuration: Name: Port admin: Speed-duplex: Capabilities: Flow control: Port security: Max MAC count: Current status: Created by: Link status: Port operation status: Operation speed-duplex: 100full Flow control type: Member Ports: Eth1/1, Eth1/2, Eth1/3, Eth1/4, Console#...
Page 182 - Ports must be configured with the same system priority to join the same LAG. - System priority is combined with the switch’s MAC address to form the LAG identifier. This identifier is used to indicate a specific LAG during LACP negotiations with other systems.
Page 183: Figure 3-54 Lacp Aggregation Port Configuration
ONFIGURATION Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and Port Priority for the Port Actor. You can optionally configure these settings for the Port Partner. (Be aware that these settings only affect the administrative state of the partner, and will not take effect until the next time an aggregate link is formed with this device.) After you have completed setting the port LACP parameters, click Apply.
Page 184 ONFIGURING THE WITCH CLI – The following example configures LACP parameters for ports 1-6. Ports 1-4 are used as active members of the LAG; ports 5 and 6 are set to backup mode. Console(config)#interface ethernet 1/1 Console(config-if)#lacp actor system-priority 3 Console(config-if)#lacp actor admin-key 120 Console(config-if)#lacp actor port-priority 128 Console(config-if)#exit...
Page 185: Displaying Lacp Port Counters
Displaying LACP Port Counters You can display statistics for LACP protocol messages. Field LACPDUs Sent LACPDUs Received Marker Sent Marker Received LACPDUs Unknown Pkts Number of frames received that either (1) Carry the LACPDUs Illegal Pkts Web – Click Port, LACP, Port Counters Information. Select a member port to display the corresponding information.
Page 186: Displaying Lacp Settings And Status For The Local Side
ONFIGURING THE WITCH CLI – The following example displays LACP counters for port channel 1. Console#show lacp 1 counters Channel group : 2 --------------------------------------------------------------- Eth 1/ 1 --------------------------------------------------------------- LACPDUs Sent: LACPDUs Receive: Marker Sent: Marker Receive: LACPDUs Unknown Pkts: 0 LACPDUs Illegal Pkts: 0 Console# Displaying LACP Settings and Status for the Local Side...
Page 187 Table 3-9 LACP Internal Configuration Information (Continued) Field Description Admin State, Administrative or operational values of the actor’s state parameters: Oper State • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner.
Page 188: Figure 3-56 Displaying Lacp Port Information
ONFIGURING THE WITCH Web – Click Port, LACP, Port Internal Information. Select a port channel to display the corresponding information. Figure 3-56 Displaying LACP Port Information CLI – The following example displays the LACP configuration settings and operational state for the local side of port channel 1. Console#show lacp 1 internal Channel group : 1 -------------------------------------------------------------------...
Page 189: Displaying Lacp Settings And Status For The Remote Side
Displaying LACP Settings and Status for the Remote Side You can display configuration settings and the operational state for the remote side of an link aggregation. Table 3-10 LACP Neighbor Configuration Information Field Partner Admin System Partner Oper System ID LAG partner’s system ID assigned by the LACP Partner Admin Port Number Partner Oper...
Page 190: Figure 3-57 Displaying Remote Lacp Port Information
ONFIGURING THE WITCH Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-57 Displaying Remote LACP Port Information CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1. Console#show lacp 1 neighbors Channel group 1 neighbors -------------------------------------------------------------------...
Page 191: Setting Broadcast Storm Thresholds
Command Usage • Broadcast Storm Control is enabled by default. • Broadcast control does not effect IP multicast traffic. • The specified threshold applies to all ports on the switch. Command Attributes • Threshold – Threshold as percentage of port bandwidth.
Page 192: Configuring Port Mirroring
ONFIGURING THE WITCH CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 60 packets per second for port 2. Console(config)#interface ethernet 1/1 Console(config-if)#no switchport broadcast Console(config-if)#exit Console(config)#interface ethernet 1/2 Console(config-if)#switchport broadcast packet-rate 60...
Page 193: Figure 3-59 Configuring A Mirror Port
Command Attributes • Mirror Sessions – Displays a list of current mirror sessions. • Source Unit – The unit whose port traffic will be monitored. (Range: 1-8) • Source Port – The port whose traffic will be monitored. (Range: 1-26) •...
Page 194: Configuring Rate Limits
Rate limiting is configured on interfaces at the edge of a network to limit traffic coming out of the switch. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped.
Page 195: Showing Port Statistics
RMON MIB. Interfaces and Ethernet-like statistics display errors on the traffic passing through each port. This information can be used to identify potential problems with the switch (such as a faulty port or unusually heavy loading). RMON statistics provide access to a broad range of statistics, including a total count of different frame types and sizes passing through each port.
Page 196 ONFIGURING THE WITCH Parameter Received Discarded Packets Received Unknown Packets Received Errors Transmit Octets Transmit Unicast Packets Transmit Multicast Packets The total number of packets that higher-level Transmit Broadcast Packets Transmit Discarded Packets Transmit Errors 3-140 Table 3-11 Port Statistics (Continued) Description The number of inbound packets which were chosen to be discarded even though no errors had been...
Page 197 Table 3-11 Port Statistics (Continued) Parameter Etherlike Statistics Alignment Errors Late Collisions FCS Errors Excessive Collisions Single Collision Frames Internal MAC Transmit Errors Multiple Collision Frames A count of successfully transmitted frames for which Carrier Sense Errors SQE Test Errors Frames Too Long Deferred Transmissions Description...
Page 198 ONFIGURING THE WITCH Parameter Internal MAC Receive Errors RMON Statistics Drop Events Jabbers Received Bytes Collisions Received Frames Broadcast Frames Multicast Frames CRC/Alignment Errors Undersize Frames Oversize Frames Fragments 3-142 Table 3-11 Port Statistics (Continued) Description A count of frames for which reception on a particular interface fails due to an internal MAC sublayer receive error.
Page 199 Table 3-11 Port Statistics (Continued) Parameter 64 Bytes Frames 65-127 Byte Frames 128-255 Byte Frames 256-511 Byte Frames 512-1023 Byte Frames 1024-1518 Byte Frames 1519-1536 Byte Frames Description The total number of frames (including bad packets) received and transmitted that were 64 octets in length (excluding framing bits but including FCS octets).
Page 200: Figure 3-61 Port Statistics
ONFIGURING THE WITCH Web – Click Port, Port Statistics. Select the required interface, and click Query. You can also use the Refresh button at the bottom of the page to update the screen. 3-144 Figure 3-61 Port Statistics...
Page 201: Power Over Ethernet Settings
Once configured to supply power, an automatic detection process is initialized by the switch that is authenticated by a PoE signature from the connected device. Detection and authentication prevent damage to non-802.3af compliant devices.
Page 202: Switch Power Status
Ports can be set to one of three power priority levels, critical, high, or low. To control the power supply within the switch’s budget, ports set at critical or high priority have power enabled in preference to those ports set at low priority.
Page 203: Setting A Switch Power Budget
Web – Click PoE, Power Status. Figure 3-62 Displaying the Global PoE Status CLI – This example displays the current power status for the switch. Console#show power mainpower Unit 1 Mainpower Status Maximum Available Power : 375 watts System Operation Status : on...
Page 204: Displaying Port Power Status
Web – Click PoE, Power Config. Specify the desired power budget for the switch. Click Apply. Figure 3-63 Setting the Switch Power Budget CLI – Use the power mainpower maximum allocation command to set the PoE power budget for the switch.
Page 205: Configuring Port Poe Power
Console# Configuring Port PoE Power If a device is connected to a switch port and the switch detects that it requires more than the power budget of the port, no power is supplied to the device (i.e., port power remains off).
Page 206: Figure 3-65 Configuring Port Poe Power
WITCH • If a device is connected to a critical or high-priority port and causes the switch to exceed its budget, port power is turned on, but the switch drops power to one or more lower-priority ports. Note: Power is dropped from low-priority ports in sequence starting from port number 1.
Page 207: Address Table Settings
Setting Static Addresses A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.
Page 208: Displaying The Address Table
Displaying the Address Table The Dynamic Address Table contains the MAC addresses learned by monitoring the source address for traffic entering the switch. When the destination address for inbound traffic is found in the database, the packets intended for that address are forwarded directly to the associated port.
Page 209: Figure 3-67 Displaying The Mac Dynamic Address Table
• VLAN – ID of configured VLAN (1-4093). • Address Table Sort Key – You can sort the information displayed based on MAC address, VLAN or interface (port or trunk). • Dynamic Address Counts – The number of addresses dynamically learned.
Page 210: Changing The Aging Time
The Spanning Tree Algorithm (STA) can be used to detect and disable network loops, and to provide backup links between switches, bridges or routers. This allows the switch to interact with other bridging devices (that is, an STA-compliant switch, bridge or router) in your network to ensure...
Page 211 • MSTP – Multiple Spanning Tree Protocol (IEEE 802.1s) STA uses a distributed algorithm to select a bridging device (STA-compliant switch, bridge or router) that serves as the root of the spanning tree network. It selects a root port on each bridging device (except for the root device) which incurs the lowest path cost when forwarding a packet from that device to the root device.
Page 212: Displaying Global Settings
STA Information screen. Field Attributes • Spanning Tree State – Shows if the switch is enabled to participate in an STA-compliant network. • Bridge ID – A unique identifier for this bridge, consisting of the bridge...
Page 213 • Designated Root – The priority and MAC address of the device in the Spanning Tree that this switch has accepted as the root device. - Root Port – The number of the port on this switch that is closest to the root. This switch communicates with the root device through this port.
Page 214 ONFIGURING THE WITCH • Priority – Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority (i.e., lower numeric value) becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device.
Page 215: Figure 3-69 Displaying The Spanning Tree Algorithm
Web – Click Spanning Tree, STA Information. Figure 3-69 Displaying the Spanning Tree Algorithm CLI – This command displays global STA settings, followed by settings for each port. Console#show spanning-tree Spanning-tree information --------------------------------------------------------------- Spanning tree mode: Spanning tree enabled/disabled: Spanning tree backup root: Instance: VLANs configuration: Priority:...
Page 216: Configuring Global Settings
Note: The current root port and current root cost display as zero when this device is not connected to the network. Configuring Global Settings Global settings apply to the entire switch. Command Usage • Spanning Tree Protocol Uses RSTP for the internal state machine, but sends only 802.1D BPDUs.
Page 217 RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU (i.e., STP BPDU) after a port’s migration delay timer expires, the switch assumes it is connected to an 802.1D bridge and starts using only 802.1D BPDUs.
Page 218 - Maximum: The lower of 40 or [2 x (Forward Delay - 1)] 9. IEEE 802.1D priority format cannot be used for a switch that is a member of an MIST. If you select 802.1D priority format for a bridge in this state, the system will return an error message.
Page 219 Configuration Settings for MSTP • Max Instance Numbers – The maximum number of MSTP instances to which this switch can be assigned. (Default: 65) • Configuration Digest – An MD5 signature key that contains the VLAN ID to MST ID mapping table. In other words, this key is a mapping of all VLANs to the CIST.
Page 220: Figure 3-70 Configuring The Spanning Tree Algorithm
ONFIGURING THE WITCH Web – Click Spanning Tree, STA Configuration. Modify the required attributes, and click Apply. Figure 3-70 Configuring the Spanning Tree Algorithm 3-164...
Page 221: Displaying Interface Settings
CLI – This example enables Spanning Tree Protocol, sets the mode to MST, and then configures the STA and MSTP parameters. Console(config)#spanning-tree Console(config)#spanning-tree backup-root Console(config)#spanning-tree mode mstp Console(config)#spanning-tree priority 40000 Console(config)#spanning-tree hello-time 5 Console(config)#spanning-tree max-age 38 Console(config)#spanning-tree forward-time 20 Console(config)#spanning-tree pathcost method long Console(config)#spanning-tree transmission-limit 5 Console(config)#Console(config)#spanning-tree mst-configuration...
Page 222 ONFIGURING THE WITCH - If two ports of a switch are connected to the same segment and there is no other STA device attached to this segment, the port with the smaller ID forwards packets and the other is discarding.
Page 223 • Priority – Defines the priority used for this port in the Spanning Tree Algorithm. If the path cost for all ports on a switch is the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
Page 224: Figure 3-71 Sta Port Information
- Point-to-Point – A connection to exactly one other bridge. - Shared – A connection to two or more bridges. - Auto – The switch automatically determines if the interface is attached to a point-to-point link or to shared media.
Page 225: Configuring Interface Settings
CLI – This example shows general STA configuration and attributes for port 5. Console#show spanning-tree ethernet 1/5 1/ 5 information -------------------------------------------------------------- Admin status: Role: State: External path cost: Internal path cost: Priority: Designated cost: Designated port Designated root: Designated bridge: Fast forwarding: Forward transitions: Admin edge port:...
Page 226: Default
• Priority – Defines the priority used for this port in the Spanning Tree Protocol. If the path cost for all ports on a switch are the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
Page 227: Figure 3-72 Configuring Spanning Tree Algorithm Per Port
Port should only be enabled for ports connected to an end-node device. (Default: Disabled) • Migration – If at any time the switch detects STA BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode.
Page 228: Configuring Multiple Spanning Trees
By default all VLANs are assigned to the Internal Spanning Tree (MST Instance 0) that connects all bridges and LANs within the MST region. This switch supports up to 65 instances. You should try to group VLANs which cover the same general area of your network. However, remember...
Page 229: Figure 3-73 Mstp Vlan Configuration
Command Attributes • MST Instance – Instance identifier of this spanning tree. (Default: 0) • Priority – The priority of a spanning tree instance. (Range: 0-61440 in steps of 4096; Options: 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, 61440; Default: 32768) •...
Page 230 ONFIGURING THE WITCH CLI – This displays STA settings for instance 1, followed by settings for each port. Console#show spanning-tree mst 1 Spanning-tree information --------------------------------------------------------------- Spanning tree mode: Spanning tree enabled/disabled: Instance: VLANs configuration: Priority: Bridge Hello Time (sec.): Bridge Max Age (sec.): Bridge Forward Delay (sec.): Root Hello Time (sec.): Root Max Age (sec.):...
Page 231: Displaying Interface Settings For Mstp
CLI – This example sets the priority for MSTI 1, and adds VLANs 1-5 to this MSTI. Console(config)#spanning-tree mst-configuration Console(config-mst)#mst 1 priority 4096 Console(config-mstp)#mst 1 vlan 1-5 Console(config-mst)# Displaying Interface Settings for MSTP The MSTP Port Information and MSTP Trunk Information pages display the current status of ports and trunks in the selected MST instance.
Page 232 ONFIGURING THE WITCH CLI – This displays STA settings for instance 0, followed by settings for each port. The settings for instance 0 are global settings that apply to the IST (page 3-156), the settings for other instances only apply to the local spanning tree.
Page 233: Configuring Interface Settings For Mstp
• Priority – Defines the priority used for this port in the Spanning Tree Protocol. If the path cost for all ports on a switch are the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
Page 234: Figure 3-75 Mstp Port Configuration
ONFIGURING THE WITCH when the Path Cost Method is set to short (page 3-63), the maximum path cost is 65,535. By default, the system automatically detects the speed and duplex mode used on each port, and configures the path cost according to the values shown below.
Page 235: Vlan Configuration
IEEE 802.1Q VLANs In large networks, routers are used to isolate broadcast traffic for each subnet into separate domains. This switch provides a similar service at Layer 2 by using VLANs to organize any group of network nodes into separate broadcast domains. VLANs confine broadcast traffic to the originating group, and can eliminate broadcast storms in large networks.
Page 236: Assigning Ports To Vlans
VLAN Classification – When the switch receives a frame, it classifies the frame in one of two ways. If the frame is untagged, the switch assigns the frame to an associated VLAN (based on the default VLAN ID of the receiving port).
Page 237 IEEE 802.1Q VLAN protocol, it can be configured to broadcast a message to your network indicating the VLAN groups it wants to join. When this switch receives these messages, it will automatically place the receiving port in the specified VLANs, and then forward the message to all other ports.
Page 238: Forwarding Tagged/Untagged Frames
When forwarding a frame from this switch along a path that contains any VLAN-aware devices, the switch should include VLAN tags. When forwarding a frame from this switch along a path that does not contain any VLAN-aware devices (including the destination host), the switch must first strip off the VLAN tag before forwarding the frame.
Page 239: Enabling Or Disabling Gvrp (Global Setting)
However, when this switch receives an untagged frame from a VLAN-unaware device, it first decides where to forward the frame, and then inserts a VLAN tag reflecting the ingress port’s default VID. Enabling or Disabling GVRP (Global Setting)
Page 240: Displaying Basic Vlan Information
• VLAN Version Number specified in the IEEE 802.1Q standard. • Maximum VLAN ID – Maximum VLAN ID recognized by this switch. • Maximum Number of Supported VLANs – Maximum number of VLANs that can be configured on this switch.
Page 241: Displaying Current Vlans
• Up Time at Creation – Time this VLAN was created (i.e., System Up Time). • Status – Shows how this VLAN was added to the switch. - Dynamic GVRP: Automatically learned via GVRP. - Permanent: Added as a static entry.
Page 242: Creating Vlans
WITCH Command Attributes (CLI) • VLAN – ID of configured VLAN (1-4093, no leading zeroes). • Type – Shows how this VLAN was added to the switch. - Dynamic: Automatically learned via GVRP. - Static: Added as a static entry.
Page 243: Figure 3-79 Vlan Static List - Creating Vlans
• VLAN ID – ID of configured VLAN (1-4093, no leading zeroes). • VLAN Name – Name of the VLAN (1 to 32 characters). • Status (Web) – Enables or disables the specified VLAN. - Enable: VLAN is operational. - Disable: VLAN is suspended; i.e., does not pass packets. •...
Page 244: Adding Static Members To Vlans (Vlan Index)
VLAN compliant devices, or untagged they are not connected to any VLAN-aware devices. Or configure a port as forbidden to prevent the switch from automatically adding it to a VLAN via the GVRP protocol. Notes: 1. You can also use the VLAN Static Membership by Port page to configure VLAN groups based on the port index (page 3-190).
Page 245 Command Attributes • VLAN – ID of configured VLAN (1-4093). • Name – Name of the VLAN (1 to 32 characters). • Status – Enables or disables the specified VLAN. - Enable: VLAN is operational. - Disable: VLAN is suspended; i.e., does not pass packets. •...
Page 246: Adding Static Members To Vlans (Port Index)
ONFIGURING THE WITCH Web – Click VLAN, 802.1Q VLAN, Static Table. Select a VLAN ID from the scroll-down list. Modify the VLAN name and status if required. Select the membership type by marking the appropriate radio button in the list of ports or trunks.
Page 247: Figure 3-81 Assigning Vlan Port And Trunk Groups
• Non-Member – VLANs for which the selected interface is not a tagged member. Web – Click VLAN, 802.1Q VLAN, Static Membership by Port. Select an interface from the scroll-down box (Port or Trunk). Click Query to display membership information for the interface. Select a VLAN ID, and then click Add to add the interface as a tagged member, or click Remove to remove the interface.
Page 248 BPDU frames, such as GMRP. • GVRP Status – Enables/disables GVRP for the interface. GVRP must be globally enabled for the switch before this setting can take effect. (See “Displaying Bridge Extension Capabilities” on page 3-18.) When disabled, any GVRP packets received on this port will be discarded and no GVRP registrations will be propagated from other ports.
Page 249 • GARP Join Timer queries to participate in a VLAN group. (Range: 20-1000 centiseconds; Default: 20) • GARP Leave Timer VLAN group. This time should be set to more than twice the join time. This ensures that after a Leave or LeaveAll message has been issued, the applicants can rejoin before the port actually leaves the group.
Page 250: Private Vlans
Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN. This switch supports two types of private VLAN ports: promiscuous, and community ports. A promiscuous port can communicate with all interfaces within a private VLAN. Community...
Page 251: Displaying Current Private Vlans
Multiple primary VLANs can be configured on this switch, and multiple community VLANs can be configured within each primary VLAN. To configure private VLANs, follow these steps: 1.
Page 252: Figure 3-83 Displaying Private Vlan Port Information
VLAN ID drop-down menu. Figure 3-83 Displaying Private VLAN Port Information CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and are associated with VLAN 6.
Page 253: Configuring Private Vlans
Web – Click Private VLAN, Private VLAN Configuration. Enter the VLAN ID number, select Primary or Community type, then click Add. To remove a private VLAN from the switch, highlight an entry in the Current list box and then click Remove. Note that all member ports must be removed from the VLAN before it can be deleted (page 3-188).
Page 254: Associating Community Vlans
ONFIGURING THE WITCH Associating Community VLANs Each community VLAN must be associated with a primary VLAN. Command Attributes • Primary VLAN ID – ID of primary VLAN (1-4093). • Association – Community VLANs associated with the selected primary VLAN. • Non-Association – Community VLANs not associated with the selected primary VLAN.
Page 255: Displaying Private Vlan Interface Information
• Primary VLAN – Conveys traffic between promiscuous ports, and between promiscuous ports and community ports within the associated secondary VLANs. • Secondary VLAN – On this switch all secondary VLANs are community VLANs. A community VLAN conveys traffic between community ports, and from community ports to their designated promiscuous ports.
Page 256: Configuring Private Vlan Interfaces
ONFIGURING THE WITCH CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and associated with VLAN 6.
Page 257: Figure 3-87 Configuring Private Vlan Ports
Apply. Figure 3-87 Configuring Private VLAN Ports CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and associated with VLAN 6.
Page 258: Class Of Service Configuration
Layer 2 Queue Settings Setting the Default Priority for Interfaces You can specify the default port priority for each interface on the switch. All untagged packets entering the switch are tagged with the specified default port priority, and then sorted into the appropriate priority queue at the output port.
Page 259: Figure 3-88 Configuring Class Of Service Per Port
Web – Click Priority, Default Port Priority or Default Trunk Priority. Modify the default priority for any interface, then click Apply. Figure 3-88 Configuring Class of Service per Port CLI – This example assigns a default priority of 5 to port 3. Console(config)#interface ethernet 1/3 Console(config-if)#switchport priority default 5 Console(config-if)#end...
Page 260: Mapping Cos Values To Egress Queues
The priority levels recommended in the IEEE 802.1p standard for various network applications are shown in the following table. However, you can map the priority levels to the switch’s output queues in any way that benefits application traffic for your own network.
Page 261: Figure 3-89 Configuring Traffic Classes
Priority Queue: 1 0 0 1 2 2 3 3 Console# 18. Mapping specific values for CoS priorities is implemented as an interface configuration command, but any changes will apply to the all interfaces on the switch. LASS OF : 0 1 2 3 4 5 6 7...
Page 262: Selecting The Queue Mode
WITCH Selecting the Queue Mode You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
Page 263: Setting The Service Weight For Traffic Classes
Setting the Service Weight for Traffic Classes This switch uses the Weighted Round Robin (WRR) algorithm to determine the frequency at which it services each priority queue. As described in “Mapping CoS Values to Egress Queues” on page 3-204, the traffic classes are mapped to one of the four egress queues provided for each port.
Page 264: Layer 3/4 Priority Settings
Because different priority information may be contained in the traffic, this switch maps priority values to the output queues in the following manner: • The precedence for priority mapping is IP Port Priority, IP Precedence or DSCP Priority, and then Default Port Priority.
Page 265: Mapping Ip Precedence
Disabled, IP Precedence or IP DSCP from the scroll-down menu, then click Apply. Figure 3-92 Setting IP Precedence/DSCP Priority Status CLI – The following example enables IP Precedence service on the switch. Console(config)#map ip precedence Console(config)# Mapping IP Precedence The Type of Service (ToS) octet in the IPv4 header includes three precedence bits defining eight different priority levels ranging from highest priority for network control packets to lowest priority for routine traffic.
Page 266: Figure 3-93 Mapping Ip Precedence To Class Of Service Values
Figure 3-93 Mapping IP Precedence to Class of Service Values – The following example globally enables IP Precedence service on the switch, maps IP Precedence value 1 to CoS value 0 on port 5, and then displays all the IP Precedence settings.
Page 267: Mapping Dscp Priority
Console#show map ip precedence ethernet 1/5 Precedence mapping status: disabled Port Precedence COS --------- ---------- --- Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Console# Mapping DSCP Priority The DSCP is six bits wide, allowing coding for up to 64 different...
Page 268: Figure 3-94 Mapping Ip Dscp Priority To Class Of Service Values
Class of Service Value field, then click Apply. Figure 3-94 Mapping IP DSCP Priority to Class of Service Values 21. Mapping specific values for DSCP Priority is implemented as an interface configuration command, but any changes will apply to the all interfaces on the switch. 3-212...
Page 269: Mapping Ip Port Priority
– The following example globally enables DSCP Priority service on the switch, maps DSCP value 0 to CoS value 1 (on port 5), and then displays the DSCP Priority settings. Console(config)#map ip dscp Console(config)#interface ethernet 1/5 Console(config-if)#map ip dscp 1 cos 0...
Page 270: Figure 3-95 Globally Enabling The Ip Port Priority Status
Apply. Figure 3-96 Mapping Ports and Trunks to IP TCP/UDP Priority 22. Mapping specific values for IP Port Priority is implemented as an interface configuration command, but any changes will apply to the all interfaces on the switch. 3-214...
Page 271: Copy Settings
– The following example globally enables IP Port Priority service on the switch, maps HTTP traffic (on port 5) to CoS value 0, and then displays the IP Port Priority settings for that port. Console(config)#map ip port Console(config)#interface ethernet 1/5...
Page 272: Mapping Cos Values To Acls
ONFIGURING THE WITCH Web – Click Priority, Copy Settings. Select the source priority settings to be copied, enter the source port or trunk number and choose the destination interface/s to copy to, then click Copy Settings. Figure 3-97 Mapping Priority Settings to Ports/Trunks CLI –...
Page 273: Command Usage
Command Usage You must configure an ACL mask before you can map CoS values to the rule. Command Attributes • Port – Port identifier. • Name – Name of ACL. • Type – Type of ACL (IP or MAC). • CoS Priority – CoS value used for packets matching an IP ACL rule. (Range: 0-7) Web –...
Page 274: Changing Priorities Based On Acl Rules
Precedence or six bits for Differentiated Services Code Point (DSCP) service. Note that the IP frame header can include either the IP Precedence or DSCP priority type. • The precedence for priority mapping by this switch is IP Precedence or DSCP Priority, and then 802.1p priority. Command Attributes •...
Page 275: Figure 3-99 Changing Priorities Based On Acl Rules
Web – Click Priority, ACL Marker. Select a port and an ACL rule. To specify a ToS priority, mark the Precedence/DSCP check box, select Precedence or DSCP from the scroll-down box, and enter a priority. To specify an 802.1p priority, mark the 802.1p Priority check box, and enter a priority.
Page 276: Multicast Filtering
It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service. This procedure is called multicast filtering.
Page 277: Layer 2 Igmp (Snooping And Query)
IP multicast packets across different subnetworks. Therefore, when DVMRP or PIM routing is enabled for a subnet on this switch, you also need to enable IGMP. Layer 2 IGMP (Snooping and Query) IGMP Snooping and Query – If multicast routing is not supported on...
Page 278: Configuring Igmp Snooping And Query Parameters
This is also referred to as IGMP Snooping. (Default: Enabled) • Act as IGMP Querier — When enabled, the switch can serve as the Querier, which is responsible for asking hosts if they want to receive multicast traffic.
Page 279: Figure 3-100 Configuring Internet Group Management Protocol
• IGMP Report Delay — Sets the time between receiving an IGMP Report for an IP multicast address on a port before the switch sends an IGMP Query out of that port and removes the entry from its list. (Range: 5-25 seconds;...
Page 280: Displaying Interfaces Attached To A Multicast Router
VLAN ID. Command Attributes • VLAN ID – ID of configured VLAN (1-4093). • Multicast Router List – Multicast routers dynamically discovered by this switch or those that are statically assigned to an interface on this switch. 3-224 : Enabled...
Page 281: Specifying Interfaces Attached To A Multicast Router
IGMP querier. Therefore, if the IGMP querier is a known multicast router/ switch connected over the network to an interface (port or trunk) on your switch, you can manually configure the interface (and a specified VLAN) to join all the current multicast groups supported by the attached router.
Page 282: Displaying Port Members Of Multicast Services
ONFIGURING THE WITCH • Port or Trunk – Specifies the interface attached to a multicast router. Web – Click IGMP Snooping, Static Multicast Router Port Configuration. Specify the interfaces attached to a multicast router, indicate the VLAN which will forward all the corresponding multicast traffic, and then click Add.
Page 283: Figure 3-103 Displaying Port Members Of Multicast Services
Web – Click IGMP Snooping, IP Multicast Registration Table. Select a VLAN ID and the IP address for a multicast service from the scroll-down lists. The switch will display all the interfaces that are propagating this multicast service. Figure 3-103 Displaying Port Members of Multicast Services CLI –...
Page 284: Assigning Ports To Multicast Services
Query Parameters” on page 3-222. For certain applications that require tighter control, you may need to statically configure a multicast service on the switch. First add all the ports attached to participating hosts to a common VLAN, and then assign the multicast service to that VLAN group.
Page 285: Configuring Domain Name Service
Configuring General DNS Server Parameters Command Usage • To enable DNS service on this switch, first configure one or more name servers, and then enable domain lookup status. • To append domain names to incomplete host names received from a DNS client (i.e., not formatted with dotted notation), you can specify a...
Page 286 ONFIGURING THE WITCH through the domain list, appending each domain name in the list to the host name, and checking with the specified name servers for a match. • When more than one name server is specified, the servers are queried in the specified sequence until a response is received, or the end of the list is reached with no response.
Page 287: Figure 3-105 Configuring Dns
ONFIGURING OMAIN ERVICE Web – Select DNS, General Configuration. Set the default domain name or list of domain names, specify one or more name servers to use for address resolution, enable domain lookup status, and click Apply. Figure 3-105 Configuring DNS 3-231...
Page 288: Configuring Static Dns Host To Address Entries
ONFIGURING THE WITCH CLI - This example sets a default domain name and a domain list. However, remember that if a domain list is specified, the default domain name is not used. Console(config)#ip domain-name sample.com Console(config)#ip domain-list sample.com.uk Console(config)#ip domain-list sample.com.jp Console(config)#ip name-server 192.168.1.55 10.1.0.55 Console(config)#ip domain-lookup Console#show dns...
Page 289: Figure 3-106 Mapping Ip Addresses To A Host Name
ONFIGURING OMAIN ERVICE • Alias – Displays the host names that are mapped to the same address(es) as a previously configured entry. Web – Select DNS, Static Host Table. Enter a host name and one or more corresponding addresses, then click Apply. Figure 3-106 Mapping IP Addresses to a Host Name 3-233...
Page 290: Displaying The Dns Cache
ONFIGURING THE WITCH CLI - This example maps two address to a host name, and then configures an alias host name for the same addresses. Console(config)#ip host rd5 192.168.1.55 10.1.0.55 Console(config)#ip host rd6 10.1.0.55 Console#show host Hostname Inet address 10.1.0.55 192.168.1.55 Alias 1.rd6 Console#...
Page 291: Figure 3-107 Displaying The Dns Cache
Web – Select DNS, Cache. Figure 3-107 Displaying the DNS Cache CLI - This example displays all the resource records learned from the designated name servers. Console#show dns cache FLAG TYPE CNAME CNAME CNAME CNAME CNAME ALIAS CNAME ALIAS CNAME ALIAS CNAME Console#...
Page 292 ONFIGURING THE WITCH 3-236...
Page 293: Command Line Interface
Using the Command Line Interface Accessing the CLI When accessing the management interface for the switch over a direct connection to the server’s console port, or via a Telnet connection, the switch can be managed by entering command keywords and parameters at the prompt.
Page 294: Telnet Connection
Note: The IP address for this switch is obtained via DHCP by default. To access the switch through a Telnet session, you must first set the IP address for the switch, and set the default gateway if you are managing the switch from a different IP subnet.
Page 295: Entering Commands
After you configure the switch with an IP address, you can open a Telnet session by performing these steps. 1. From the remote host, enter the Telnet command and the IP address of the device you want to access. 2. At the prompt, enter the user name and system password. The CLI will display the “Vty-n#”...
Page 296: Minimum Abbreviation
NTERING OMMANDS You can enter commands as follows: • To enter a simple command, enter the command keyword. • To enter multiple commands, enter each command in the required order. For example, to enable Privileged Exec command mode, and display the startup configuration, enter: Console>enable Console#show startup-config...
Page 297 The system configuration of running SNMP statistics Sntp Specify spanning-tree Secure shell The system configuration of starting up Information of system Login by tacacs server Display information about terminal lines System hardware and software status Switch VLAN Virtual Interface OMMAND NTERFACE...
Page 298: Partial Keyword Lookup
NTERING OMMANDS Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided. (Remember not to leave a space between the command and question mark.) For example “s?” shows all the keywords starting with “s.”...
Page 299: Exec Commands
You must be in Global Configuration mode to access any of the other configuration modes. Exec Commands When you open a new console session on the switch with the user name and password “guest,” the system enters the Normal Exec command mode (or guest mode), displaying the “Console>”...
Page 300: Configuration Commands
Configuration commands are privileged level commands used to modify switch settings. These commands modify the running configuration only and are not saved when the switch is rebooted. To store the running configuration in nonvolatile storage, use the copy running-config startup-config command.
Page 301: Table 4-2 Configuration Command Modes
To enter the other modes, at the configuration prompt type one of the following commands. Use the exit or end command to return to the Privileged Exec mode. Table 4-2 Configuration Command Modes Mode Command Line line {console | vty} Access access-list ip standard Control...
Page 302: Command Line Processing
NTERING OMMANDS Command Line Processing Commands are not case sensitive. You can abbreviate commands and parameters as long as they contain enough letters to differentiate them from any other currently available commands or parameters. You can use the Tab key to complete partial commands, or enter a partial command followed by the “?”...
Page 303: Command Groups
Controls system logs, system passwords, user name, browser management options, and a variety of other system information Manages code image or switch configuration files Configures logon access using local or remote authentication; also configures port security and IEEE 802.1X port access control...
Page 304 Configures the address table for filtering specified addresses, displays current entries, clears the table, or sets the aging time Configures Spanning Tree settings for the switch Configures VLAN settings, and defines port membership for VLAN groups; also enables or configures private VLANs Configures GVRP settings that permit automatic VLAN learning;...
Page 305: Line Commands
Line Commands You can access the onboard configuration program by attaching a VT100 compatible device to the switch’s serial port. These commands are used to set communication parameters for the serial port or Telnet (i.e., a virtual terminal). Command line...
Page 306 OMMANDS line This command identifies a specific line for configuration, and to process subsequent line configuration commands. Syntax line {console | vty} • console - Console terminal line. • vty - Virtual terminal for remote console access (i.e., Telnet). Default Setting There is no default line.
Page 307 Command Mode Line Configuration Command Usage • There are three authentication modes provided by the switch itself at login: - login selects authentication by a single global password as specified by the password line configuration command. When using this method, the management interface starts in Normal Exec (NE) mode.
Page 308: Line
OMMANDS Related Commands username (4-34) password (4-16) password This command specifies the password for a line. Use the no form to remove the password. Syntax password {0 | 7} password no password • {0 | 7} - 0 means plain password, 7 means encrypted password •...
Page 309: Timeout Login Response
Related Commands login (4-15) password-thresh (4-19) timeout login response This command sets the interval that the system waits for a user to log into the CLI. Use the no form to restore the default setting. Syntax timeout login response [seconds] no timeout login response seconds - Integer that specifies the number of seconds.
Page 310: Exec-Timeout
OMMANDS exec-timeout This command sets the interval that the system waits until user input is detected. Use the no form to restore the default. Syntax exec-timeout [seconds] no exec-timeout seconds - Integer that specifies the number of seconds. (Range: 0 - 65535 seconds; 0: no timeout) Default Setting CLI and Telnet: 600 seconds (10 minutes) Command Mode...
Page 311: Password-Thresh
password-thresh This command sets the password intrusion threshold which limits the number of failed logon attempts. Use the no form to remove the threshold value. Syntax password-thresh [threshold] no password-thresh threshold - The number of allowed password attempts. (Range: 1-120; 0: no threshold) Default Setting The default value is three attempts.
Page 312: Silent-Time
OMMANDS silent-time This command sets the amount of time the management console is inaccessible after the number of unsuccessful logon attempts exceeds the threshold set by the password-thresh command. Use the no form to remove the silent time value. Syntax silent-time seconds no silent-time seconds - The number of seconds to disable console response.
Page 313: Parity
Default Setting 8 data bits per character Command Mode Line Configuration Command Usage The databits command can be used to mask the high bit on input from devices that generate 7 data bits with parity. If parity is being generated, specify 7 data bits per character.
Page 314: Speed
Some baud rates available on devices connected to the port might not be supported. The system indicates if the speed you selected is not supported. If you select the “auto” option, the switch will automatically detect the baud rate configured on the attached terminal, and adjust the speed accordingly.
Page 315: Stopbits
stopbits This command sets the number of the stop bits transmitted per byte. Use the no form to restore the default setting. Syntax stopbits {1 | 2} • 1 - One stop bit • 2 - Two stop bits Default Setting 1 stop bit Command Mode Line Configuration...
Page 316: Show Line
OMMANDS Example Console#disconnect 1 Console# Related Commands show ssh (4-53) show users (4-80) show line This command displays the terminal line’s parameters. Syntax show line [console | vty] • console - Console terminal line. • vty - Virtual terminal for remote console access. Default Setting Shows all lines Command Mode...
Page 317: General Commands
General Commands Command enable disable configure show history reload exit quit help enable This command activates Privileged Exec mode. In privileged mode, additional commands are available, and certain commands display additional information. See “Understanding Command Modes” on page 4-6. Syntax enable [level] level - Privilege level to log into the device.
Page 318: Disable
This command returns to Normal Exec mode from privileged mode. In normal access mode, you can only display basic information on the switch's configuration or Ethernet statistics. To gain access to all commands, you must use the privileged mode. See “Understanding Command Modes” on page 4-6.
Page 319: Configure
This command activates Global Configuration mode. You must enter this mode to modify any settings on the switch. You must also enter Global Configuration mode prior to enabling some of the other configuration modes, including Interface Configuration, Line Configuration, VLAN Database Configuration, and Multiple Spanning Tree Configuration.
Page 320: Reload
ENERAL OMMANDS Example In this example, the show history command lists the contents of the command history buffer: Console#show history Execution command history: 2 config 1 show history Configuration command history: 4 interface vlan 1 3 exit 2 interface vlan 1 1 end Console# The ! command repeats commands from the Execution command history...
Page 321: End
Example This example shows how to reset the switch: Console#reload System will be restarted, continue <y/n>? y This command returns to Privileged Exec mode. Default Setting None Command Mode Global Configuration, Interface Configuration, Line Configuration, VLAN Database Configuration, and Multiple Spanning Tree Configuration.
Page 322: Quit
ENERAL OMMANDS Example This example shows how to return to the Privileged Exec mode from the Global Configuration mode, and then quit the CLI session: Console(config)#exit Console#exit Press ENTER to start session User Access Verification Username: quit Use this command to exit the configuration program. Default Setting None Command Mode...
Page 323: System Management Commands
Time (System Clock) System Status Table 4-7 System Management Commands Configures information that uniquely identifies this switch Configures the basic user names and passwords for management access Configures IP addresses that are allowed management access Enables management access via a web browser...
Page 324: Device Designation Commands
4-32 OMMANDS Table 4-8 Device Designation Commands Function Customizes the CLI prompt Specifies the host name for the switch Sets the system contact string Sets the system location string Displays the switch’s unit ID using its front-panel LEDs Mode Page...
Page 325: Hostname
Global Configuration Example Console(config)#hostname RD#1 Console(config)# light unit This command displays the stack unit ID using the switch’s front-panel LEDs. Syntax light unit [unit] unit - Specifies a stack unit on which to light the front-panel LEDs. The LEDs on the first unit number of ports will flash, where unit is the stack identifier for the specified device.
Page 326: User Access Commands
User Access Commands The basic commands required for management access are listed in this section. This switch also includes other options for password checking via the console or a Telnet connection (page 4-13), user authentication via a remote authentication server (page 4-151), and host access authentication for specific ports (page 4-110).
Page 327: Table 4-10 Default Login Settings
Default Setting • The default access level is Normal Exec. • The factory defaults for the user names and passwords are: Table 4-10 Default Login Settings username access-level guest admin Command Mode Global Configuration Command Usage The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server.
Page 328: Enable Password
YSTEM ANAGEMENT enable password After initially logging onto the system, you should set the Privileged Exec password. Remember to record it in a safe place. Use this command to control access to the Privileged Exec level from the Normal Exec level. Use the no form to reset the default password.
Page 329: Ip Filter Commands
Displays the switch to be monitored or management This command specifies the client IP addresses that are allowed management access to the switch through various protocols. Use the no form to restore the default setting. Syntax [no] management {all-client | http-client | snmp-client | telnet-client} start-address [end-address] •...
Page 330: Show Management
ANAGEMENT Command Usage • If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager.
Page 331: Web Server Commands
End ip address 192.168.1.19 192.168.1.30 Table 4-12 Web Server Commands Function Specifies the port to be used by the web browser interface Allows the switch to be monitored or configured from a browser Enables HTTPS/SSL for encrypted communications OMMAND NTERFACE Mode Page...
Page 332: Ip Http Port
YSTEM ANAGEMENT ip http port This command specifies the TCP port number used by the web browser interface. Use the no form to use the default port. Syntax ip http port port-number no ip http port port-number - The TCP port to be used by the browser interface. (Range: 1-65535) Default Setting Command Mode...
Page 333: Ip Http Secure-Server
This command enables the secure hypertext transfer protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Use the no form to disable this function. Syntax [no] ip http secure-server...
Page 334: Ip Http Secure-Port
(4-82) ip http secure-port This command specifies the UDP port number used for HTTPS connection to the switch’s web interface. Use the no form to restore the default port. Syntax ip http secure-port port_number no ip http secure-port port_number –...
Page 335: Telnet Server Commands
• port-number - The TCP port to be used by the browser interface. (Range: 1-65535) Table 4-14 Telnet Server Commands Function Allows the switch to be monitored or configured from Telnet; also specifies the port to be used by the Telnet interface OMMAND...
Page 336: Secure Shell Commands
Telnet. When a client contacts the switch via the SSH protocol, the switch uses a public-key that the client must match along with a local user name and password for access authentication.
Page 337: Table 4-15 Secure Shell Commands
Shows SSH users, including privilege level and public key type The SSH server on this switch supports both password and public key authentication. If password authentication is specified by the SSH client, then the password can be authenticated either locally or via a RADIUS or TACACS+ remote authentication server, as specified by the authentication login command on page 4-98.
Page 338 51941746772984865468615717739390164779355942303577413098022737087794545 24083971752646358058176716709574804776117 3. Import Client’s Public Key to the Switch – Use the copy tftp public-key command to copy a file containing the public key for all the SSH client’s granted management access to the switch. (Note that these clients must be configured locally on the switch with the username command as described on page 4-34.) The clients are subsequently authenticated using...
Page 339: Ip Ssh Server
The switch compares the client's public key to those stored in memory. c. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. d. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch.
Page 340: Ip Ssh Timeout
Telnet sessions and SSH sessions. • The SSH server uses DSA or RSA for key exchange when the client first establishes a connection with the switch, and then negotiates with the client to select either DES (56-bit) or 3DES (168-bit) for data encryption.
Page 341: Ip Ssh Authentication-Retries
Command Usage The timeout specifies the interval the switch will wait for a response from the client during the SSH negotiation phase. Once an SSH session has been established, the timeout for user input is controlled by the exec-timeout command for vty sessions.
Page 342: Ip Ssh Server-Key Size
Command Mode Global Configuration Command Usage • The server key is a private key that is never shared outside the switch. • The host key is shared with the SSH client, and is fixed at 1024 bits. Example Console(config)#ip ssh server-key size 512...
Page 343: Ip Ssh Crypto Host-Key Generate
Example Console#delete public-key admin dsa Console# ip ssh crypto host-key generate Use this command to generate the host key pair (i.e., public and private). Syntax ip ssh crypto host-key generate [dsa | rsa] • dsa – DSA (Version 2) key type. •...
Page 344: Ip Ssh Crypto Zeroize
YSTEM ANAGEMENT ip ssh crypto zeroize This command clears the host key from memory (i.e. RAM). Syntax ip ssh crypto zeroize [dsa | rsa] • dsa – DSA key type. • rsa – RSA key type. Default Setting Clears both the DSA and RSA key. Command Mode Privileged Exec Command Usage...
Page 345: Show Ip Ssh
Default Setting Saves both the DSA and RSA key. Command Mode Privileged Exec Example Console#ip ssh save host-key dsa Console# Related Commands ip ssh crypto host-key generate (4-51) show ip ssh This command displays the connection settings used when authenticating client access to the SSH server.
Page 346: Table 4-7 System Management Commands
YSTEM ANAGEMENT Field Session Version State Username Encryption 4-54 OMMANDS Table 4-16 show ssh - display description Description The session number. (Range: 0-3) The Secure Shell version number. The authentication negotiation state. (Values: Negotiation-Started, Authentication-Started, Session-Started) The user name of the client. The encryption method is automatically negotiated between the client and server.
Page 347: Show Public-Key
show public-key This command shows the public key for the specified user or for the host. Syntax show public-key [user [username]| host] username – Name of an SSH user. (Range: 1-8 characters) Default Setting Shows all public keys. Command Mode Privileged Exec Command Usage •...
Page 348: Event Logging Commands
OMMANDS Table 4-17 Event Logging Commands Function Controls logging of error messages Limits syslog messages saved to switch memory based on severity Adds a syslog server host IP address that will receive logging messages Sets the facility type for remote logging of syslog...
Page 349: Logging On
This command controls logging of error messages, sending debug or error messages to switch memory. The no form disables the logging process. Syntax [no] logging on Default Setting None Command Mode Global Configuration Command Usage The logging process controls error messages saved to switch memory.
Page 350: Table 4-18 Logging Levels
YSTEM ANAGEMENT • ram - Event history stored in temporary RAM (i.e., memory flushed on power reset). • level - One of the syslog severity levels listed in the following table. Messages sent include the selected level down to level 0. Level * There are only Level 2, 5 and 6 error messages for the current firmware release.
Page 351: Logging Host
logging host This command adds a syslog server host IP address that will receive logging messages. Use the no form to remove a syslog server host. Syntax [no] logging host host_ip_address host_ip_address - The IP address of a syslog server. Default Setting None Command Mode...
Page 352: Logging Trap
The command specifies the facility type tag sent in syslog messages. (See RFC 3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to sort messages or to store messages in the corresponding database.
Page 353: Clear Log
(4-63) show logging This command displays the configuration settings for logging messages to local switch memory, to an SMTP event handler, or to a remote syslog server. Syntax show logging {flash | ram | sendmail | trap} • flash - Displays settings for storing event messages in flash memory (i.e., permanent memory).
Page 354: Table 4-19 Show Logging Flash/Ram - Display Description
YSTEM ANAGEMENT Default Setting None Command Mode Privileged Exec Example The following example shows that system logging is enabled, the message level for flash memory is “errors” (i.e., default level 3 - 0), and the message level for RAM is “debugging” (i.e., default level 7 - 0). Console#show logging flash Syslog logging: History logging in FLASH: level errors...
Page 355: Show Log
Table 4-20 show logging trap - display description Field Syslog logging REMOTELOG status REMOTELOG facility type REMOTELOG level type REMOTELOG server IP address Related Commands show logging sendmail (4-68) show log This command displays the log messages stored in local memory. Syntax show log {flash | ram} •...
Page 356: Smtp Alert Commands
YSTEM ANAGEMENT Example The following example shows the event message stored in RAM. Console#show log ram [1] 00:01:30 2001-01-01 "VLAN 1 link-up notification." level: 6, module: 5, function: 1, and event no.: 1 [0] 00:01:30 2001-01-01 "Unit 1, Port level: 6, module: 5, function: 1, and event no.: 1 Console# SMTP Alert Commands Configures SMTP event handling, and forwarding of alert messages to the...
Page 357: Logging Sendmail Level
If it fails to send mail, the switch selects the next server in the list and tries to send mail again. If it still fails, the system will repeat the process at a periodic interval.
Page 358: Logging Sendmail Source-Email
(Range: 1-41 characters) Default Setting None Command Mode Global Configuration Command Usage You may use a symbolic email address that identifies the switch, or the address of an administrator responsible for the switch. Example Console(config)#logging sendmail source-email bill@this-company.com Console(config)# 4-66...
Page 359: Logging Sendmail Destination-Email
logging sendmail destination-email This command specifies the email recipients of alert messages. Use the no form to remove a recipient. Syntax [no] logging sendmail destination-email email-address email-address - The recipient email address for alert messages. (Range: 1-41 characters) Default Setting None Command Mode Global Configuration...
Page 360: Show Logging Sendmail
(NTP or SNTP). Maintaining an accurate time on the switch enables the system log to record meaningful dates and times for event entries. If the clock is not set, the switch will only record the time from the factory default set at the last bootup.
Page 361: Sntp Client
Command Usage • The time acquired from time servers is used to record accurate dates and times for log events. Without SNTP, the switch only records the time starting from the factory default set at the last bootup (i.e., 00:00:00, Jan.
Page 362: Sntp Server
YSTEM ANAGEMENT Example Console(config)#sntp server 10.1.0.19 Console(config)#sntp poll 60 Console(config)#sntp client Console(config)#end Console#show sntp Current time: Poll interval: 60 Current mode: unicast SNTP status : Enabled SNTP server 137.92.140.80 0.0.0.0 0.0.0.0 Current server: 137.92.140.80 Console# Related Commands sntp server (4-70) sntp poll (4-71) show sntp (4-72) sntp server...
Page 363: Sntp Poll
(4-71) show sntp (4-72) sntp poll This command sets the interval between sending time requests when the switch is set to SNTP client mode. Use the no form to restore to the default. Syntax sntp poll seconds no sntp poll seconds - Interval between time requests.
Page 364: Show Sntp
YSTEM ANAGEMENT Related Commands sntp client (4-69) show sntp This command displays the current time and configuration settings for the SNTP client, and indicates whether or not the local time has been properly updated. Command Mode Normal Exec, Privileged Exec Command Usage This command displays the current time, the poll interval used for sending time synchronization requests, and the current SNTP mode (i.e.,...
Page 365: Clock Timezone
This command sets the time zone for the switch’s internal clock. Syntax clock timezone name hour hours minute minutes {before-utc | after-utc} • name - Name of timezone, usually an acronym. (Default: UTC; Range: 1-29 characters) • hours - Number of hours before UTC (0-12) or after UTC (0-13).
Page 366: Calendar Set
ANAGEMENT calendar set This command sets the system clock. It may be used if there is no time server on your network, or if you have not configured the switch to receive signals from a time server. Syntax calendar set hour min sec {month day year | day month year} •...
Page 367: System Status Commands
Example This example shows how to display the current system clock setting. Console#show calendar 15:12:50 March 21 2003 Console# System Status Commands Command show startup-config show running-config show system show users show version show startup-config This command displays the configuration file stored in non-volatile memory that is used to start up the system.
Page 368 YSTEM ANAGEMENT • This command displays settings for key command modes. Each mode group is separated by “!” symbols, and includes the configuration mode command, and corresponding commands. This command displays the following information: - Users (names and access levels) - SNMP community strings - Event logging configuration - VLAN database (VLAN ID, name and state)
Page 369: Show Running-Config
“!” symbols, and includes the configuration mode command, and corresponding commands. This command displays the following information: - IP address or address mode - MAC address for each switch in the stack - SNTP server settings - SNMP community strings - Event logging configuration...
Page 370 YSTEM ANAGEMENT Example Console#show running-config IP address DHCP phymap 00-04-e2-b3-16-c0 00-30-f1-b0-e9-80 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 SNTP server 10.1.0.19 0.0.0.0 0.0.0.0 snmp-server community public ro snmp-server community private rw username admin access-level 15 username admin password 7 21232f297a57a5a743894a0e4a801fc3 username guest access-level 0 username guest password 7 084e0343a0486ff05530df6c705c8bb4 enable password level 15 7 1b3231655cebb7a1f783eddf27d254ca logging history ram 6...
Page 371: Show System
POST result Uart Loopback Test ... PASS DRAM Test ... PASS Timer Test ... PASS PCI Device Test ... PASS Switch Int Loopback test ... PASS Done All Pass. Console# OMMAND 0 days, 0 hours, 1 minutes, and 25.59 [NONE]...
Page 372: Show Users
YSTEM ANAGEMENT show users Shows all active console and Telnet sessions, including user name, idle time, and IP address of Telnet client. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The session used to execute this command is indicated by a “*” symbol next to the Line (i.e., session) index number.
Page 373: Table 4-24 Flash/File Commands
Command Mode Normal Exec, Privileged Exec Command Usage See “Displaying Switch Hardware/Software Versions” on page 3-15 for detailed information on the items displayed by this command. Example Console#show version Unit1 Serial number: Service tag: Hardware version: Module A type: Module B type:...
Page 374: Flash/File Commands
When you save the system code or configuration settings to a file on a TFTP server, that file can later be downloaded to the switch to restore system operation. The success of the file transfer depends on the accessibility of the TFTP server and the quality of the network connection.
Page 375 • To replace the startup configuration, you must use startup-config as the destination. • Use the copy file unit command to copy a local file to another switch in the stack. Use the copy unit file command to copy a file from another switch in the stack.
Page 376 \Write to FLASH finish. Success. Console# This example shows how to copy a secure-site certificate from an TFTP server. It then reboots the switch to activate the certificate. Console#copy tftp https-certificate TFTP server ip address: 10.1.0.19 Source certificate file name: SS-certificate...
Page 377 This example shows how to copy a public-key used by SSH from an TFTP server. Note that public key authentication via SSH is only supported for users configured locally on the switch. Console#copy tftp public-key TFTP server IP address: 192.168.1.19 Choose public key type: 1.
Page 378: Delete
LASH OMMANDS delete This command deletes a file or image. Syntax delete [unit:] filename filename - Name of the configuration file or image name. unit - Specifies the stack unit. (Range: 1-8) Default Setting None Command Mode Privileged Exec Command Usage •...
Page 379: Dir
The type of file or image to display includes: • boot-rom - Boot ROM (or diagnostic) image file • config - Switch configuration file • opcode - Run-time operation code image file. • filename - Name of the file or image. If this file exists but contains errors, information on this file cannot be shown.
Page 380: Whichboot
LASH OMMANDS Example The following example shows how to display all file information: Console#dir file name ------------------------------------- Unit1: D21210 V24213 Factory_Default_Config.cfg --------------------------------------------------------------------------- Console# whichboot This command displays which files were booted when the system powered Command Mode Privileged Exec Example This example shows the information displayed by the whichboot command.
Page 381: Boot System
boot system Use this command to specify the file or image used to start up the system. Syntax boot system [unit:] {boot-rom| config | opcode}: filename The type of file or image to set as a default includes: • boot-rom* - Boot ROM. •...
Page 382: Power Over Ethernet Commands
When a device is connected to a switch port, its power requirements are detected by the switch before power is supplied. If the power required by a device exceeds the power budget of the port or the whole switch, power is not supplied.
Page 383: Power Mainpower Maximum Allocation
Use the Syntax power mainpower maximum allocation <watts> [unit unit] • watts - The power budget for the switch. (Range: 37 - 375 watts) • unit - Specifies the stack unit. (Range: 1 - 8) Default Setting...
Page 384 It cannot detect other legacy devices that do not reflect back the test voltages. • For legacy devices to be supported by this switch, they must be able to accept power over the data pairs connected to the 10/100BASE-TX ports.
Page 385: Power Inline
This command instructs the switch to automatically detect if a PoE-compliant device is connected to the specified port, and turn power on or off accordingly. Use the no form to turn off power for a port. Syntax [no] power inline Default Setting Detection is enabled for PoE-compliant devices.
Page 386: Power Inline Priority
Interface Configuration Command Usage If a device is connected to a switch port and the switch detects that it requires more than the maximum power allocated to the port, no power is supplied to the device (i.e., port power remains off).
Page 387: Show Power Inline Status
• Power is dropped from low-priority ports in sequence starting from port number 1. Example Console(config)#interface ethernet 1/1 Console(config-if)#power inline priority 2 Console(config-if)# Related Commands power mainpower maximum allocation (4-91) show power inline status This command displays the current power status for all ports or for specific ports.
Page 388: Show Power Mainpower
Admin Oper Power (mWatt) Power (used) Priority show power mainpower Use this command to display the current power status for the switch. Command Mode Privileged Exec Example Console#show power mainpower Unit 1 Mainpower Status Maximum Available Power : 375 watts...
Page 389: Authentication Commands
Authentication Commands You can configure this switch to authenticate users logging into the system for management access using local or RADIUS authentication methods. You can also enable port-based authentication for network client access using IEEE 802.1X. Command Group Authentication Sequence...
Page 390: Authentication Login
UTHENTICATION OMMANDS authentication login This command defines the login authentication method and precedence. Use the no form to restore the default. Syntax authentication login {[local] [radius] [tacacs]} no authentication login • local - Use local password. • radius - Use RADIUS server password. •...
Page 391: Authentication Enable
Example Console(config)#authentication login radius Console(config)# Related Commands username - for setting the local user names and passwords (4-34) authentication enable This command defines the authentication method and precedence to use when changing from Exec command mode to Privileged Exec command mode with the enable command (see page 4-25).
Page 392: Radius Client
RADIUS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch. Command radius-server host radius-server port...
Page 393: Radius-Server Host
• port_number - RADIUS server UDP port used for authentication messages. (Range: 1-65535) • timeout - Number of seconds the switch waits for a reply before resending a request. (Range: 1-65535) • retransmit - Number of times the switch will try to authenticate logon access via the RADIUS server.
Page 394: Radius-Server Port
UTHENTICATION OMMANDS radius-server port This command sets the RADIUS server network port. Use the no form to restore the default. Syntax radius-server port port_number no radius-server port port_number - RADIUS server UDP port used for authentication messages. (Range: 1-65535) Default Setting 1812 Command Mode Global Configuration...
Page 395: Radius-Server Retransmit
This command sets the number of retries. Use the no form to restore the default. Syntax radius-server retransmit number_of_retries no radius-server retransmit number_of_retries - Number of times the switch will try to authenticate logon access via the RADIUS server. (Range: 1 - 30) Default Setting Command Mode Global Configuration...
Page 396: Show Radius-Server
UTHENTICATION OMMANDS Command Mode Global Configuration Example Console(config)#radius-server timeout 10 Console(config)# show radius-server This command displays the current settings for the RADIUS server. Default Setting None Command Mode Privileged Exec Example Console#show radius-server Remote RADIUS server configuration: Global settings: Communication key with RADIUS server: ***** Server port number: Retransmit times: Request timeout:...
Page 397: Tacacs+ Client
TACACS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch. Command tacacs-server host tacacs-server port...
Page 398: Tacacs-Server Port
UTHENTICATION OMMANDS tacacs-server port This command specifies the TACACS+ server network port. Use the no form to restore the default. Syntax tacacs-server port port_number no tacacs-server port port_number - TACACS+ server TCP port used for authentication messages. (Range: 1-65535) Default Setting Command Mode Global Configuration Example...
Page 399: Show Tacacs-Server
If a device with an unauthorized MAC address attempts to use the switch port, the intrusion will be detected and the switch can automatically take action by disabling the port and sending a trap message.
Page 400: Port Security
UTHENTICATION OMMANDS Command port security mac-address-table static Maps a static address to a port in a VLAN GC show mac-address-table Displays entries in the bridge-forwarding port security This command enables or configures port security. Use the no form without any keywords to disable port security. Use the no form with the appropriate keyword to restore the default settings for a response to security violation or for the maximum number of allowed addresses.
Page 401 Command Usage • If you enable port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table will be accepted.
Page 402: 802.1X Port Authentication
UTHENTICATION OMMANDS 802.1X Port Authentication The switch supports IEEE 802.1X (dot1x) port-based access control that prevents unauthorized access to the network by requiring users to first submit credentials for authentication. Client authentication is controlled centrally by a RADIUS server using EAP (Extensible Authentication Protocol).
Page 403: Dot1X System-Auth-Control
Console(config)#dot1x default Console(config)# dot1x max-req This command sets the maximum number of times the switch port will retransmit an EAP request/identity packet to the client before it times out the authentication session. Use the no form to restore the default.
Page 404: Dot1X Port-Control
UTHENTICATION OMMANDS Default Command Mode Interface Configuration Example Console(config)#interface ethernet 1/1 Console(config-if)#dot1x max-req 2 Console(config)# dot1x port-control This command sets the dot1x mode on a port interface. Use the no form to restore the default. Syntax dot1x port-control {auto | force-authorized | force-unauthorized} no dot1x port-control •...
Page 405: Dot1X Operation-Mode
dot1x operation-mode This command allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. Use the no form with no keywords to restore the default to single host. Use the no form with the multi-host max-count keywords to restore the default maximum count. Syntax dot1x operation-mode {single-host | multi-host [max-count count]} no dot1x operation-mode [multi-host max-count]...
Page 406: Dot1X Re-Authenticate
UTHENTICATION OMMANDS dot1x re-authenticate This command forces re-authentication on all ports or a specific interface. Syntax dot1x re-authenticate [interface] interface ethernet unit/port - unit - The stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) Command Mode Privileged Exec Example Console#dot1x re-authenticate Console#...
Page 407: Dot1X Timeout Quiet-Period
This command sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. Use the no form to reset the default. Syntax dot1x timeout quiet-period seconds no dot1x timeout quiet-period seconds - The number of seconds.
Page 408: Dot1X Timeout Tx-Period
Console(config-if)#dot1x timeout re-authperiod 300 Console(config-if)# dot1x timeout tx-period This command sets the time that an interface on the switch waits during an authentication session before re-transmitting an EAP packet. Use the no form to reset to the default value. Syntax...
Page 409 This command displays the following information: • Global 802.1X Parameters – Shows whether or not 802.1X port authentication is globally enabled on the switch. • 802.1X Port Summary – Displays the port access control parameters for each interface that has enabled 802.1X, including the following items: - Status –...
Page 410 UTHENTICATION OMMANDS - Supplicant– MAC address of authorized client. - Current Identifier– The integer (0-255) used by the Authenticator to identify the current authentication session. • Authenticator State Machine - State– Current state (including initialize, disconnected, connecting, authenticating, authenticated, aborting, held, force_authorized, force_unauthorized).
Page 411: Table 4-35 Access Control List Commands
An ACL is a sequential list of permit or deny conditions that apply to IP addresses, MAC addresses, or other more specific criteria. This switch tests ingress or egress packets against the conditions in an ACL one by one. A...
Page 412: Access Control List Commands
• The switch does not support the explicit “deny any any” rule for the egress IP ACL or the egress MAC ACLs. If these rules are included in ACL, and you attempt to bind the ACL to an interface for egress checking, the bind operation will fail.
Page 413 Masks for Access Control Lists You must specify masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/filter packets matching the permit/deny the rules specified in an ingress ACL. You can also configure up to seven user-defined masks for an ACL.
Page 414: Ip Acls
CCESS ONTROL IP ACLs Command access-list ip access-list ip extended fragment-auto-mask permit, deny permit, deny show ip access-list access-list ip mask-precedence mask show access-list ip mask-precedence ip access-group show ip access-group Shows port assignments for IP ACLs map access-list ip show map access-list ip match access-list ip...
Page 415: Access-List Ip
access-list ip This command adds an IP access list and enters configuration mode for standard or extended IP ACLs. Use the no form to remove the specified ACL. Syntax [no] access-list ip {standard | extended} acl_name • standard – Specifies an ACL that filters packets based on the source IP address.
Page 416: Access-List Ip Extended Fragment-Auto-Mask
CCESS ONTROL access-list ip extended fragment-auto-mask This command automatically creates extra masks to support fragmented ACL entries. Use the no form to disable this feature. Syntax [no] access-list ip extended fragment-auto-mask Default Setting Disabled Command Mode Global Configuration Command Usage If this feature is disabled, fragmented packets will not be matched by any ACL rule, and will be handled according to the default permit or deny rule.
Page 417: Permit, Deny (Extended Acl)
Command Mode Standard ACL Command Usage • New rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match”...
Page 418 CCESS ONTROL [no] {permit | deny} tcp {any | source address-bitmask | host source} {any | destination address-bitmask | host destination} [precedence precedence] [tos tos] [dscp dscp] [source-port sport [bitmask]] [destination-port dport [port-bitmask]] [control-flag control-flags flag-bitmask] • protocol-number – A specific protocol number. (Range: 0-255) •...
Page 419 with the address for each IP packet entering the port(s) to which this ACL has been assigned. • You can specify both Precedence and ToS in the same rule. However, if DSCP is used, then neither Precedence nor ToS can be specified. •...
Page 420: Show Ip Access-List
CCESS ONTROL This permits all TCP packets from class C addresses 192.168.1.0 with the TCP control code set to “SYN.” Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any control-flag 2 2 Console(config-ext-acl)# Related Commands access-list ip (4-123) show ip access-list This command displays the rules for configured IP ACLs. Syntax show ip access-list {standard | extended} [acl_name] •...
Page 421: Access-List Ip Mask-Precedence
access-list ip mask-precedence This command changes to the IP Mask mode used to configure access control masks. Use the no form to delete the mask table. Syntax [no] access-list ip mask-precedence {in | out} • in – Ingress mask for ingress ACLs. •...
Page 422: Mask (Ip Acl)
CCESS ONTROL mask (IP ACL) This command defines a mask for IP ACLs. This mask defines the fields to check in the IP header. Use the no form to remove a mask. Syntax [no] mask [protocol] {any | host | source-bitmask} {any | host | destination-bitmask} [precedence] [tos] [dscp] [source-port [port-bitmask]] [destination-port [port-bitmask]]...
Page 423 determined by the mask, and not the order in which the ACL rules were entered. • First create the required ACLs and ingress or egress masks before mapping an ACL to an interface. • If you enter dscp, you cannot enter tos or precedence. You can enter both tos and precedence without dscp.
Page 424 CCESS ONTROL This shows how to create a standard ACL with an ingress mask to deny access to the IP host 171.69.198.102, and permit access to any others. Console(config)#access-list ip standard A2 Console(config-std-acl)#permit any Console(config-std-acl)#deny host 171.69.198.102 Console(config-std-acl)#end Console#show access-list IP standard access-list A2: deny host 171.69.198.102 permit any...
Page 425: Show Access-List Ip Mask-Precedence
ACL is bound to an interface (i.e., the ACL is active), the order in which the rules are displayed is determined by the associated mask. Switch(config)#access-list ip extended 6 Switch(config-ext-acl)#permit any any Switch(config-ext-acl)#deny tcp any any control-flag 2 2 Switch(config-ext-acl)#end Console#show access-list IP extended access-list A6:...
Page 426: Ip Access-Group
• If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. • You must configure a mask for an ACL rule before you can bind it to a port.
Page 427: Show Ip Access-Group
Related Commands show ip access-list (4-128) show ip access-group This command shows the ports assigned to IP ACLs. Command Mode Privileged Exec Example Console#show ip access-group Interface ethernet 1/2 IP standard access-list david Console# Related Commands ip access-group (4-134) map access-list ip This command sets the output queue for packets matching an ACL rule.
Page 428: Show Map Access-List Ip
CCESS ONTROL • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown in the following table. For information on mapping the CoS values to output queues, see queue cos-map on page 4-257.
Page 429: Match Access-List Ip
Related Commands map access-list ip (4-135) match access-list ip This command changes the IEEE 802.1p priority, IP Precedence, or DSCP Priority of a frame matching the defined ACL rule. (This feature is commonly referred to as ACL packet marking.) Use the no form to remove the ACL marker.
Page 430: Show Marking
CCESS ONTROL IP frame header can include either the IP Precedence or DSCP priority type. • The precedence for priority mapping by this switch is IP Precedence or DSCP Priority, and then 802.1p priority. Example Console(config)#interface ethernet 1/12 Console(config-if)#match access-list ip bill set dscp 0...
Page 431: Access-List Mac
Table 4-38 MAC ACL Commands Command access-list mac mask-precedence mask show access-list mac mask-precedence mac access-group show mac access-group map access-list mac show map access-list match access-list mac Changes the 802.1p priority the priority show marking access-list mac This command adds a MAC access list and enters MAC ACL configuration mode.
Page 432: Permit, Deny (Mac Acl)
CCESS ONTROL Command Usage • An egress ACL must contain all deny rules. • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list.
Page 433 [no] {permit | deny} untagged-eth2 {any | host source | source address-bitmask} {any | host destination | destination address-bitmask} [ethertype protocol [protocol-bitmask]] [no] {permit | deny} tagged-802.3 {any | host source | source address-bitmask} {any | host destination | destination address-bitmask} [vid vid vid-bitmask] [no] {permit | deny} untagged-802.3 {any | host source | source address-bitmask}...
Page 434: Show Mac Access-List
CCESS ONTROL • A detailed listing of Ethernet protocol types can be found in RFC 1060. A few of the more common types include the following: - 0800 - IP - 0806 - ARP - 8137 - IPX Example This rule permits packets from any source MAC address to the destination address 00-e0-29-94-34-de where the Ethernet type is 0800.
Page 435: Access-List Mac Mask-Precedence
access-list mac mask-precedence This command changes to MAC Mask mode used to configure access control masks. Use the no form to delete the mask table. Syntax [no] access-list ip mask-precedence {in | out} • in – Ingress mask for ingress ACLs. •...
Page 436: Mask (Mac Acl)
CCESS ONTROL mask (MAC ACL) This command defines a mask for MAC ACLs. This mask defines the fields to check in the packet header. Use the no form to remove a mask. Syntax [no] mask [pktformat] {any | host | source-bitmask} {any | host | destination-bitmask} [vid [vid-bitmask]] [ethertype [ethertype-bitmask]] •...
Page 437 Example This example shows how to create an Ingress MAC ACL and bind it to a port. You can then see that the order of the rules have been changed by the mask. Console(config)#access-list mac M4 Console(config-mac-acl)#permit any any Console(config-mac-acl)#deny tagged-eth2 00-11-11-11-11-11 ff-ff-ff-ff-ff-ff any vid 3 Console(config-mac-acl)#end Console#show access-list...
Page 438: Show Access-List Mac Mask-Precedence
CCESS ONTROL show access-list mac mask-precedence This command shows the ingress or egress rule masks for MAC ACLs. Syntax show access-list mac mask-precedence [in | out] • in – Ingress mask precedence for ingress ACLs. • out – Egress mask precedence for egress ACLs. Command Mode Privileged Exec Example...
Page 439: Show Mac Access-Group
• If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. • You must configure a mask for an ACL rule before you can bind it to a port.
Page 440: Show Map Access-List Mac
CCESS ONTROL Default Setting None Command Mode Interface Configuration (Ethernet) Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • By default, a packet matching a rule within the specified ACL is mapped to one of the output queues as shown below.
Page 441: Match Access-List Mac
Command Mode Privileged Exec Example Console#show map access-list mac Access-list to COS of Eth 1/5 Access-list M5 cos 0 Console# Related Commands map access-list mac (4-147) match access-list mac This command changes the IEEE 802.1p priority of a Layer 2 frame matching the defined ACL rule.
Page 442: Acl Information
CCESS ONTROL Related Commands show marking (4-138) ACL Information Command show access-list show access-group show access-list This command shows all ACLs and associated rules, as well as all the user-defined masks. Command Mode Privileged Exec Command Usage Once the ACL is bound to an interface (i.e., the ACL is active), the order in which the rules are displayed is determined by the associated mask.
Page 443: Show Access-Group
MAC access-list jerry Console# SNMP Commands Controls access to this switch from management stations using the Simple Network Management Protocol (SNMP), as well as the error types sent to trap managers. SNMP Version 3 provides security features that cover message integrity, authentication, and encryption;...
Page 444: Snmp-Server
SNMP C OMMANDS Command snmp-server location Sets the system location string snmp-server host snmp-server enable traps snmp-server engine-id show snmp engine-id Shows the SNMPv3 engine ID snmp-server view show snmp view snmp-server group show snmp group snmp-server user show snmp user snmp-server This command enables the SNMPv3 engine and services for all management clients (i.e., versions 1, 2c, 3).
Page 445: Show Snmp
show snmp This command can be used to check the status of SNMP communications. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage This command provides information on the community access strings, counter information for SNMP input and output protocol data units, and whether or not SNMP logging has been enabled with the snmp-server enable traps command.
Page 446: Snmp-Server Community
SNMP C OMMANDS snmp-server community This command defines the SNMP v1 and v2c community access string. Use the no form to remove the specified community string. Syntax snmp-server community string [ro|rw] no snmp-server community string • string - Community string that acts like a password and permits access to the SNMP protocol.
Page 447: Snmp-Server Location
Default Setting None Command Mode Global Configuration Example Console(config)#snmp-server contact Paul Console(config)# Related Commands snmp-server location (4-155) snmp-server location This command sets the system location string. Use the no form to remove the location string. Syntax snmp-server location text no snmp-server location text - String that describes the system location.
Page 448: Snmp-Server Host
SNMP C OMMANDS snmp-server host This command specifies the recipient of a Simple Network Management Protocol notification operation. Use the no form to remove the specified host. Syntax snmp-server host host-addr [inform [retry retries | timeout seconds]] community-string [version {1 | 2c | 3 {auth | noauth | priv} [udp-port port]} no snmp-server host host-addr •...
Page 449 • Notifications are issued by the switch as trap messages by default. The recipient of a trap message does not send a response to the switch. Traps are therefore not as reliable as inform messages, which include a request for acknowledgement of receipt.
Page 450 6. Specify a remote engine ID where the user resides (page 4-160). 7. Then configure a remote user (page 4-167). • The switch can send SNMP version 1, 2c, or 3 notifications to a host IP address, depending on the SNMP version that the management station supports.
Page 451: Snmp-Server Enable Traps
snmp-server enable traps This command enables this device to send Simple Network Management Protocol traps or informs (i.e., SNMP notifications). Use the no form to disable SNMP notifications. Syntax [no] snmp-server enable traps [authentication | link-up-down] • authentication - Keyword to issue authentication failure notifications.
Page 452: Snmp-Server Engine-Id
• ip-address - The Internet address of the remote device. • engineid-string - String identifying the engine ID. (Range: 1-26 hexadecimal characters) Default Setting A unique engine ID is automatically generated by the switch based on its MAC address. Command Mode Global Configuration Command Usage •...
Page 453: Show Snmp Engine-Id
“1234” is equivalent to “1234” followed by 22 zeroes. • A local engine ID is automatically generated that is unique to the switch. This is referred to as the default engine ID. If the local engineID is deleted or changed, all SNMP users will be cleared.
Page 454: Snmp-Server View
SNMP C OMMANDS Table 4-42 show snmp engine-id - display description Field Local SNMP engineID Local SNMP engineBoots Remote SNMP engineID IP address snmp-server view This command adds an SNMP view which controls user access to the MIB. Use the no form to remove an SNMP view. Syntax snmp-server view view-name oid-tree {included | excluded} no snmp-server view view-name...
Page 455: Show Snmp View
Examples This view includes MIB-2. Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included Console(config)# This view includes the MIB-2 interfaces table, ifDescr. The wild card is used to select all the index values in this table. Console(config)#snmp-server view ifEntry.2 1.3.6.1.2.1.2.2.1.*.2 included Console(config)# This view includes the MIB-2 interfaces table, and the mask selects all index entries.
Page 456: Snmp-Server Group
SNMP C OMMANDS Table 4-43 show snmp view - display description Field View Type Storage Type Row Status snmp-server group This command adds an SNMP group, mapping SNMP users to SNMP views. Use the no form to remove an SNMP group. Syntax snmp-server group groupname {v1 | v2c | v3 {auth | noauth | priv}} [read readview] [write writeview] [notify notifyview]...
Page 457: Show Snmp Group
• For additional information on the notification messages supported by this switch, see “Supported Notification Messages” on page 3-62. Also, note that the authentication, link-up and link-down messages are legacy traps and must therefore be enabled in conjunction with the snmp-server enable traps command (page 4-159).
Page 458: Table 4-44 Show Snmp Group - Display Description
SNMP C OMMANDS Group Name: public Security Model: v2c Read View: defaultview Write View: none Notify View: none Storage Type: volatile Row Status: active Group Name: private Security Model: v1 Read View: defaultview Write View: defaultview Notify View: none Storage Type: volatile Row Status: active Group Name: private Security Model: v2c...
Page 459: Snmp-Server User
snmp-server user This command adds a user to an SNMP group, restricting the user to a specific SNMP Read and a Write View. Use the no form to remove a user from an SNMP group. Syntax snmp-server user username groupname [remote ip-address] {v1 | v2c | v3 [encrypted] [auth {md5 | sha} auth-password [priv des56 priv-password]] no snmp-server user username {v1 | v2c | v3 | remote}...
Page 460 SNMP C OMMANDS ID with the snmp-server engine-id command before using this configuration command. • Before you configure a remote user, use the snmp-server engine-id command (page 4-160) to specify the engine ID for the remote device where the user resides. Then use the snmp-server user command to specify the user and the IP address for the remote device where the user resides.
Page 461: Show Snmp User
show snmp user This command shows information on SNMP users. Command Mode Privileged Exec Example Console#show snmp user EngineId: 01000000000000000000000000 User Name: steve Authentication Protocol: md5 Privacy Protocol: des56 Storage Type: nonvolatile Row Status: active SNMP remote user EngineId: 80000000030004e2b316c54321 User Name: mark Authentication Protocol: mdt Privacy Protocol: des56...
Page 462: Interface Commands
NTERFACE OMMANDS Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN. Command interface description speed-duplex negotiation capabilities flowcontrol shutdown switchport broadcast packet-rate clear counters show interfaces status show interfaces counters show interfaces switchport...
Page 463: Interface
interface This command configures an interface type and enter interface configuration mode. Use the no form to remove a trunk. Syntax interface interface no interface port-channel channel-id interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) •...
Page 464: Speed-Duplex
NTERFACE OMMANDS Default Setting None Command Mode Interface Configuration (Ethernet, Port Channel) Example The following example adds a description to port 25 Console(config)#interface ethernet 1/25 Console(config-if)#description RD-SW#3 Console(config-if)# speed-duplex This command configures the speed and duplex mode of a given interface when autonegotiation is disabled.
Page 465: Negotiation
Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • When auto-negotiation is enabled the switch will negotiate the best settings for a link based on the capabilities command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands.
Page 466: Capabilities
• symmetric (Gigabit only) - When specified, the port transmits and receives pause frames; when not specified, the port will auto-negotiate to determine the sender and receiver for asymmetric pause frames. (The current switch ASIC only supports symmetric pause frames.) Default Setting • 100BASE-TX: 10half, 10full, 100half, 100full •...
Page 467: Flowcontrol
Command Usage When auto-negotiation is enabled with the negotiation command, the switch will negotiate the best settings for a link based on the capabilities command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands.
Page 468: Shutdown
NTERFACE OMMANDS • To force flow control on or off (with the flowcontrol or no flowcontrol command), use the no negotiation command to disable auto-negotiation on the selected interface. • When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command. To enable flow control under auto-negotiation, “flowcontrol”...
Page 469: Switchport Broadcast Packet-Rate
• This command can enable or disable broadcast storm control for the selected interface. However, the specified threshold value applies to all ports on the switch. Example The following shows how to configure broadcast storm control at 600...
Page 470: Clear Counters
NTERFACE OMMANDS clear counters This command clears statistics on an interface. Syntax clear counters interface interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) • port-channel channel-id (Range: 1-6) Default Setting None Command Mode Privileged Exec...
Page 471: Show Interfaces Status
show interfaces status This command displays the status for an interface. Syntax show interfaces status [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) • port-channel channel-id (Range: 1-6) • vlan vlan-id (Range: 1-4093) Default Setting Shows the status for all interfaces.
Page 472: Show Interfaces Counters
NTERFACE OMMANDS Example Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: Mac address: Configuration: Name: Port admin: Speed-duplex: Capabilities: Broadcast storm: Broadcast storm limit: Flow control: LACP: Port security: Max MAC count: Port security action: Current status: Link status: Port operation status:...
Page 473 Command Usage If no interface is specified, information on all interfaces is displayed. For a description of the items displayed by this command, see “Showing Port Statistics” on page 3-139. Example Console#show interfaces counters ethernet 1/7 Ethernet 1/7 Iftable stats: Octets input: 30658, Octets output: 196550 Unicast input: 6, Unicast output: 5 Discard input: 0, Discard output: 0...
Page 474: Show Interfaces Switchport
NTERFACE OMMANDS show interfaces switchport This command displays the administrative and operational status of the specified interfaces. Syntax show interfaces switchport [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) •...
Page 475: Table 4-47 Show Interfaces Switchport - Display Description
Table 4-47 show interfaces switchport - display description Field Description Broadcast threshold Shows if broadcast storm suppression is enabled or disabled; if enabled it also shows the threshold level (page 4-177). LACP status Shows if Link Aggregation Control Protocol has been enabled or disabled (page 4-190).
Page 476: Mirror Port Commands
IRROR OMMANDS Mirror Port Commands This section describes how to mirror traffic from a source port to a target port. Command port monitor show port monitor Shows the configuration for a mirror port port monitor This command configures a mirror session. Use the no form to clear a mirror session.
Page 477: Show Port Monitor
However, you should avoid sending too much traffic to the destination port from multiple source ports. Example The following example configures the switch to mirror all packets from port 6 to 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 both...
Page 478: Rate Limit Commands
IMIT OMMANDS Example The following shows mirroring configured from port 6 to port 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 Console(config-if)#end Console#show port monitor Port Mirroring ------------------------------------- Destination port(listen port):Eth1/1 Source port(monitored port) Mode Console# Rate Limit Commands This function allows the network manager to control the maximum rate for traffic transmitted or received on an interface.
Page 479: Rate-Limit
rate-limit This command defines the rate limit for a specific interface. Use this command without specifying a rate to restore the default rate. Use the no form to restore the default status of disabled. Syntax rate-limit {input | output} [rate] no rate-limit {input | output} •...
Page 480: Link Aggregation Commands
Cisco EtherChannel standard. For dynamic trunks, the switches have to comply with LACP. This switch supports up to six trunks. For example, a trunk consisting of two 1000 Mbps ports can support an aggregate bandwidth of 4 Gbps when operating at full duplex.
Page 481 Guidelines for Creating Trunks General Guidelines – • Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • A trunk can have up to eight ports. • The ports at both ends of a connection must be configured as trunk ports.
Page 482: Channel-Group
• When configuring static trunks, the switches must comply with the Cisco EtherChannel standard. • Use no channel-group to remove a port group from a trunk. • Use no interfaces port-channel to remove a trunk from the switch. Example The following example creates trunk 1 and then adds port 11:...
Page 483 • A trunk formed with another switch using LACP will automatically be assigned the next available port-channel ID. • If the target switch has also enabled LACP on the connected ports, the trunk will be activated automatically. • If more than four ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails.
Page 484: Lacp System-Priority
• Port must be configured with the same system priority to join the same LAG. • System priority is combined with the switch’s MAC address to form the LAG identifier. This identifier is used to indicate a specific LAG during LACP negotiations with other systems.
Page 485: Lacp Admin-Key (Ethernet Interface)
• Once the remote side of a link has been established, LACP operational settings are already in use on that side. Configuring LACP settings for the partner only applies to its administrative state, not its operational state, and will only take effect the next time an aggregate link is established with the partner.
Page 486: Lacp Admin-Key (Port Channel)
Syntax lacp admin-key key [no] lacp admin-key key - The port channel admin key is used to identify a specific link aggregation group (LAG) during local LACP setup on this switch. (Range: 0-65535) Default Setting Command Mode Interface Configuration (Port Channel) Command Usage •...
Page 487: Lacp Port-Priority
Example Console(config)#interface port channel 1 Console(config-if)#lacp admin-key 3 Console(config-if)# lacp port-priority This command configures LACP port priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} port-priority priority no lacp {actor | partner} port-priority • actor - The local side an aggregate link. •...
Page 488: Show Lacp
GGREGATION show lacp This command displays LACP information. Syntax show lacp [port-channel] {counters | internal | neighbors | sys-id} • port-channel - Local identifier for a link aggregation group. (Range: 1-6) • counters - Statistics for LACP protocol messages. • internal - Configuration settings and operational state for local side. •...
Page 489: Table 4-52 Show Lacp Internal - Display Description
Table 4-51 show lacp counters - display description Field Description Marker Received Number of valid Marker PDUs received by this channel group. LACPDUs Number of frames received that either (1) Carry the Slow Unknown Pkts Protocols Ethernet Type value, but contain an unknown PDU, or (2) are addressed to the Slow Protocols group MAC Address, but do not carry the Slow Protocols Ethernet Type.
Page 490 GGREGATION Table 4-52 show lacp internal - display description Field LACP Port Priority Admin State, Oper State 4-198 OMMANDS Description LACP port priority assigned to this interface within the channel group. Administrative or operational values of the actor’s state parameters: •...
Page 491: Table 4-53 Show Lacp Neighbors - Display Description
Console#show lacp 1 neighbors Channel group 1 neighbors --------------------------------------------------------------------- Eth 1/1 --------------------------------------------------------------------- Partner Admin System ID : 32768, 00-00-00-00-00-00 Partner Oper System ID : 32768, 00-00-00-00-00-01 Partner Admin Port Number : 1 Partner Oper Port Number : 1 Port Admin Priority : 32768 Port Oper Priority : 32768 Admin Key : 0 Oper Key : 4...
Page 492: Table 4-55 Address Table Commands
00-30-F1-8F-2C-A7 32768 00-30-F1-8F-2C-A7 32768 00-30-F1-8F-2C-A7 Description A link aggregation group configured on this switch. LACP system priority for this channel group. System MAC address. Table 4-55 Address Table Commands Function Maps a static address to a port in a VLAN...
Page 493: Mac-Address-Table Static
• port-channel channel-id (Range: 1-6) • vlan-id - VLAN ID (Range: 1-4093) • action - - delete-on-reset - Assignment lasts until the switch is reset. - permanent - Assignment is permanent. Default Setting No static addresses are defined. The default mode is permanent.
Page 494: Address Table Commands
DDRESS ABLE OMMANDS Example Console(config)#mac-address-table static 00-e0-29-94-34-de interface ethernet 1/1 vlan 1 delete-on-reset Console(config)# clear mac-address-table dynamic This command removes any learned entries from the forwarding database and clears the transmit and receive counts for any static or system configured entries.
Page 495: Mac-Address-Table Aging-Time
Default Setting None Command Mode Privileged Exec Command Usage • The MAC Address Table contains the MAC addresses associated with each interface. Note that the Type field may include the following types: - Learned - Dynamic address entries - Permanent - Static entry - Delete-on-reset - Static entry to be deleted when system is reset •...
Page 496: Show Mac-Address-Table Aging-Time
Console#show mac-address-table aging-time Aging time: 300 sec. Console# Spanning Tree Commands This section includes commands that configure the Spanning Tree Algorithm (STA) globally for the switch, and commands that configure STA for the selected interface. Command spanning-tree spanning-tree mode spanning-tree...
Page 497 Table 4-56 Spanning Tree Commands Command spanning-tree hello-time spanning-tree max-age Configures the spanning tree bridge spanning-tree default priority spanning-tree priority spanning-tree pathcost method spanning-tree transmission-limit spanning-tree backup-root spanning-tree mst-configuration mst vlan mst priority name revision max-hops spanning-tree spanning-disabled spanning-tree cost spanning-tree port-priority Function...
Page 498: Spanning-Tree
The Spanning Tree Algorithm (STA) can be used to detect and disable network loops, and to provide backup links between switches, bridges or routers. This allows the switch to interact with other bridging devices (that is, an STA-compliant switch, bridge or router) in your network to 4-206 Function...
Page 499: Spanning-Tree Mode
This example shows how to enable the Spanning Tree Algorithm for the switch: Console(config)#spanning-tree Console(config)# spanning-tree mode Use this command to select the spanning tree mode for this switch. Use the no form to restore the default. Syntax spanning-tree mode {stp | rstp | mstp} no spanning-tree mode •...
Page 500: Spanning-Tree Forward-Time
RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU after a port’s migration delay timer expires, the switch assumes it is connected to an 802.1D bridge and starts using only 802.1D BPDUs.
Page 501: Spanning-Tree Hello-Time
Console(config)#spanning-tree forward-time 20 Console(config)# spanning-tree hello-time This command configures the spanning tree bridge hello time globally for this switch. Use the no form to restore the default. Syntax spanning-tree hello-time time no spanning-tree hello-time time - Time in seconds, (Range: 1 - 10 seconds).
Page 502: Spanning-Tree Max-Age
Console(config)#spanning-tree hello-time 5 Console(config)# spanning-tree max-age This command configures the spanning tree bridge maximum age globally for this switch. Use the no form to restore the default. Syntax spanning-tree max-age seconds no spanning-tree max-age seconds - Time in seconds. (Range: 6-40 seconds) The minimum value is the higher of 6 or [2 x (hello-time + 1)].
Page 503: Spanning-Tree Default Priority
Global Configuration Command Usage IEEE 802.1D priority format cannot be used for a switch that is a member of an MIST. If you select 802.1D priority format for a bridge in this state, the system will return an error message.
Page 504: Spanning-Tree Pathcost Method
PANNING OMMANDS Default Setting 32768 Command Mode Global Configuration Command Usage Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority (i.e., lower numeric value) becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device.
Page 505: Spanning-Tree Transmission-Limit
Command Usage The path cost method is used to determine the best path between devices. Therefore, lower values should be assigned to ports attached to faster media, and higher values assigned to ports with slower media. Note that path cost (page 4-212) takes precedence over port priority (page 4-221).
Page 506: Spanning-Tree Backup-Root
Command Usage This command will automatically lower the bridge priority of this device by 4096 if the switch loses contact with the current root bridge. For this command to succeed, the switch must have a direct connection to current root bridge, and its adjusted bridge priority must be higher (i.e., a numerically lower value) than all the other bridges in the spanning tree.
Page 507: Mst Vlan
• By default all VLANs are assigned to the Internal Spanning Tree (MSTI 0) that connects all bridges and LANs within the MST region. This switch supports up to 58 instances. You should try to group VLANs which cover the same general area of your network. However, remember...
Page 508: Mst Priority
MAC address will then become the root device. • You can set this switch to act as the MSTI root device by specifying a priority of 0, or as the MSTI alternate device by specifying a priority of 16384.
Page 509: Name
The MST region name and revision number (page 4-218) are used to designate a unique MST region. A bridge (i.e., spanning-tree compliant device such as this switch) can only belong to one MST region. And all bridges in the same region must be configured with the same MST instances.
Page 510: Revision
The MST region name (page 4-217) and revision number are used to designate a unique MST region. A bridge (i.e., spanning-tree compliant device such as this switch) can only belong to one MST region. And all bridges in the same region must be configured with the same MST instances.
Page 511: Spanning-Tree Spanning-Disabled
Default Setting Command Mode MST Configuration Command Usage An MSTI region is treated as a single node by the STP and RSTP protocols. Therefore, the message age for BPDUs inside an MSTI region is never changed. However, each spanning tree instance within a region, and the internal spanning tree (IST) that connects these instances use a hop count to specify the maximum number of bridges that will propagate a BPDU.
Page 512: Spanning-Tree Cost
PANNING OMMANDS spanning-tree cost This command configures the spanning tree path cost for the specified interface. Use the no form to restore the default. Syntax spanning-tree cost cost no spanning-tree cost cost - The path cost for the port. (Range: 1-200,000,000)) The recommended range is: •...
Page 513: Spanning-Tree Port-Priority
• This command defines the priority for the use of a port in the Spanning Tree Algorithm. If the path cost for all ports on a switch are the same, the port with the highest priority (that is, lowest value) will be configured as an active link in the spanning tree.
Page 514: Spanning-Tree Portfast
PANNING OMMANDS Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.
Page 515: Spanning-Tree Link-Type
Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command is used to enable/disable the fast spanning-tree mode for the selected port. In this mode, ports skip the Discarding and Learning states, and proceed straight to Forwarding. • Since end-nodes cannot cause forwarding loops, they can be passed through the spanning tree state changes more quickly than allowed by standard convergence time.
Page 516: Spanning-Tree Mst Cost
• When automatic detection is selected, the switch derives the link type from the duplex mode. A full-duplex interface is considered a point-to-point link, while a half-duplex interface is assumed to be on a shared link.
Page 517: Spanning-Tree Mst Port-Priority
Default Setting • Ethernet – half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 • Fast Ethernet – half duplex: 200,000; full duplex: 100,000; trunk: 50,000 • Gigabit Ethernet – full duplex: 10,000; trunk: 5,000 Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage •...
Page 518: Spanning-Tree Protocol-Migration
• This command defines the priority for the use of an interface in the multiple spanning-tree. If the path cost for all interfaces on a switch are the same, the interface with the highest priority (that is, lowest value) will be configured as an active link in the spanning tree.
Page 519: Show Spanning-Tree
Command Usage If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the spanning-tree protocol-migration command at any time to manually re-check the appropriate BPDU format to send on the selected interfaces (i.e., RSTP or STP-compatible).
Page 520 PANNING OMMANDS • Use the show spanning-tree interface command to display the spanning tree configuration for an interface within the Common Spanning Tree (CST). • Use the show spanning-tree mst instance_id command to display the spanning tree configuration for an instance within the Multiple Spanning Tree (MST).
Page 521: Show Spanning-Tree Mst Configuration
--------------------------------------------------------------- 1/ 1 information --------------------------------------------------------------- Admin status: Role: State: External path cost: Internal path cost: Priority: Designated cost: Designated port Designated root: Designated bridge: Fast forwarding: Forward transitions: Admin edge port: Oper edge port: Admin Link type: Oper Link type: Spanning Tree Status: show spanning-tree mst configuration This command shows the configuration of the multiple spanning tree.
Page 522: Vlan Commands
VLAN C OMMANDS VLAN Commands A VLAN is a group of ports that can be located anywhere in the network, but communicate as though they belong to the same physical segment. This section describes commands used to create VLAN groups, add port members, specify how VLAN tagging is used, and enable automatic VLAN registration for the selected interface.
Page 523: Vlan
Command Mode Global Configuration Command Usage • Use the VLAN database command mode to add, change, and delete VLANs. After finishing configuration changes, you can display the VLAN settings by entering the show vlan command. • Use the interface vlan command mode to define the port membership mode and add or remove ports from a VLAN.
Page 524: Configuring Vlan Interfaces
• no vlan vlan-id name removes the VLAN name. • no vlan vlan-id state returns the VLAN to the default state (i.e., active). • You can configure up to 255 VLANs on the switch. Example The following example adds a VLAN, using VLAN ID 105 and name RD5.
Page 525: Interface Vlan
Table 4-59 Configuring VLAN Interfaces Command switchport forbidden vlan switchport priority default interface vlan This command enters interface configuration mode for VLANs, which is used to configure VLAN parameters for a physical interface. Syntax interface vlan vlan-id vlan-id - ID of the configured VLAN. (Range: 1-4093, no leading zeroes) Default Setting None...
Page 526: Switchport Mode
VLAN C OMMANDS switchport mode This command configures the VLAN membership mode for a port. Use the no form to restore the default. Syntax switchport mode {trunk | hybrid} no switchport mode • trunk - Specifies a port as an end-point for a VLAN trunk. A trunk is a direct link between two switches, so the port transmits tagged frames that identify the source VLAN.
Page 527: Switchport Acceptable-Frame-Types
switchport acceptable-frame-types This command configures the acceptable frame types for a port. Use the no form to restore the default. Syntax switchport acceptable-frame-types {all | tagged} no switchport acceptable-frame-types • all - The port accepts all frames, tagged or untagged. •...
Page 528: Switchport Ingress-Filtering
VLAN C OMMANDS switchport ingress-filtering This command enables ingress filtering for an interface. Use the no form to restore the default. Syntax [no] switchport ingress-filtering Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Ingress filtering only affects tagged frames. •...
Page 529: Switchport Native Vlan
switchport native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no form to restore the default. Syntax switchport native vlan vlan-id no switchport native vlan vlan-id - Default VLAN ID for a port. (Range: 1-4093, no leading zeroes) Default Setting VLAN 1...
Page 530: Switchport Allowed Vlan
VLAN groups as a tagged member. • Frames are always tagged within the switch. The tagged/untagged parameter used when adding a VLAN to an interface tells the switch whether to keep or remove the tag from a frame on egress.
Page 531: Switchport Forbidden Vlan
• If a VLAN on the forbidden list for an interface is manually added to that interface, the VLAN is automatically removed from the forbidden list for that interface. Example The following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as tagged VLANs for port 1: Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 1,2,5,6 tagged...
Page 532: Displaying Vlan Information
VLAN C OMMANDS Example The following example shows how to prevent port 1 from being added to VLAN 3: Console(config)#interface ethernet 1/1 Console(config-if)#switchport forbidden vlan add 3 Console(config-if)# Displaying VLAN Information Command show vlan show interfaces status vlan show interfaces switchport show vlan This command shows VLAN information.
Page 533: Configuring Private Vlans
Configuring Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN. This switch supports two types of private VLAN ports: promiscuous, and community ports. A promiscuous port can communicate with all interfaces within a private VLAN. Community ports can only communicate with other ports in their own community VLAN, and with their designated promiscuous ports.
Page 534 VLAN C OMMANDS Table 4-61 Private VLAN Commands Command Display Private VLAN Information show vlan private-vlan Shows private VLAN information To configure private VLANs, follow these steps: 1. Use the private-vlan command to designate one or more community VLANs and the primary VLAN that will channel traffic outside the community groups.
Page 535: Private-Vlan
private-vlan Use this command to create a primary or secondary (i.e., community) private VLAN. Use the no form to remove the specified private VLAN. Syntax private-vlan vlan-id {community | primary} no private-vlan vlan-id • vlan-id - ID of private VLAN. (Range: 1-4093, no leading zeroes). •...
Page 536: Private-Vlan Association
VLAN C OMMANDS private-vlan association Use this command to associate a primary VLAN with a secondary (i.e., community) VLAN. Use the no form to remove all associations for the specified primary VLAN. Syntax private-vlan primary-vlan-id association {secondary-vlan-id | add secondary-vlan-id | remove secondary-vlan-id} no private-vlan primary-vlan-id association •...
Page 537: Switchport Mode Private-Vlan
switchport mode private-vlan Use this command to set the private VLAN mode for an interface. Use the no form to restore the default setting. Syntax switchport mode private-vlan {host | promiscuous} no switchport mode private-vlan • host – This port type can communicate with all other host ports assigned to the same secondary VLAN.
Page 538: Switchport Private-Vlan Host-Association
VLAN C OMMANDS switchport private-vlan host-association Use this command to associate an interface with a secondary VLAN. Use the no form to remove this association. Syntax switchport private-vlan host-association secondary-vlan-id no switchport private-vlan host-association • secondary-vlan-id – ID of secondary (i.e, community) VLAN. (Range: 1-4093, no leading zeroes).
Page 539: Show Vlan Private-Vlan
Console(config-if)#switchport private-vlan mapping 2 Console(config)# show vlan private-vlan Use this command to show the private VLAN configuration settings on this switch. Syntax show vlan private-vlan [community | primary] • community – Displays all community VLANs, along with their associate primary VLAN and assigned host interfaces.
Page 540: Gvrp And Bridge Extension Commands
VLAN information in order to automatically register VLAN members on interfaces across the network. This section describes how to enable GVRP for individual interfaces and globally for the switch, as well as how to display default configuration settings for the Bridge Extension MIB.
Page 541: Bridge-Ext Gvrp
This command enables GVRP globally for the switch. Use the no form to disable it. Syntax [no] bridge-ext gvrp Default Setting Disabled Command Mode Global Configuration Command Usage GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network.
Page 542: Switchport Gvrp
GVRP RIDGE Example Console#show bridge-ext Max support VLAN numbers: Max support VLAN ID: Extended multicast filtering services: No Static entry individual port: VLAN learning: Configurable PVID tagging: Local VLAN capable: Traffic classes: Global GVRP status: GMRP: Console# switchport gvrp This command enables GVRP for a port. Use the no form to disable it. Syntax [no] switchport gvrp Default Setting...
Page 543: Garp Timer
Default Setting Shows both global and interface-specific configuration. Command Mode Normal Exec, Privileged Exec Example Console#show gvrp configuration ethernet 1/7 Eth 1/ 7: Gvrp configuration: Disabled Console# garp timer This command sets the values for the join, leave and leaveall timers. Use the no form to restore the timers' default values.
Page 544: Show Garp Timer
GVRP RIDGE unless you are experiencing difficulties with GMRP or GVRP registration/deregistration. • Timer values are applied to GVRP for all the ports on all VLANs. • Timer values must meet the following restrictions: - leave >= (2 x join) - leaveall >...
Page 545: Priority Commands (Layer 2)
Priority Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with four priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.
Page 546: Queue Mode
RIORITY OMMANDS Priority Commands (Layer 2) Command queue mode queue bandwidth switchport priority default queue cos map show queue mode show queue bandwidth show queue cos-map Shows the class-of-service map show interfaces switchport queue mode This command sets the queue mode to strict priority or Weighted Round-Robin (WRR) for the class of service (CoS) priority queues.
Page 547: Queue Bandwidth
Global Configuration Command Usage You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
Page 548: Switchport Priority Default
RIORITY OMMANDS Command Usage WRR controls bandwidth sharing at the egress port by defining scheduling weights. Example The following example shows how to assign WRR weights of 1, 3, 5 and 7 to the CoS priority queues 0, 1, 2 and 3: Console(config)#queue bandwidth 1 3 5 7 Console(config)# Related Commands...
Page 549: Queue Cos-Map
IEEE 802.1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used. • This switch provides four priority queues for each port. It is configured to use Weighted Round Robin, which can be viewed with the show queue bandwidth command.
Page 550: Table 4-63 Priority Commands
RIORITY OMMANDS Default Setting This switch supports Class of Service by using eight priority queues, with Weighted Round Robin queuing for each port. Eight separate traffic classes are defined in IEEE 802.1p. The default priority levels are assigned according to recommendations in the IEEE 802.1p standard as shown below.
Page 551: Show Queue Mode
show queue mode This command shows the current queue mode. Default Setting None Command Mode Privileged Exec Example Console#sh queue mode Wrr status: Enabled Console# show queue bandwidth This command displays the weighted round-robin (WRR) bandwidth allocation for the priority queues. Default Setting None Command Mode...
Page 552: Show Queue Cos-Map
RIORITY OMMANDS show queue cos-map This command shows the class of service priority map. Syntax show queue cos-map [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) • port-channel channel-id (Range: 1-6) Default Setting None Command Mode...
Page 553: Map Ip Port (Global Configuration)
Table 4-66 Priority Commands (Layer 3 and 4) Command map access-list mac show map ip port show map ip precedence show map ip dscp show map access-list show map access-list map ip port (Global Configuration) This command enables IP port mapping (i.e., class of service mapping for TCP/UDP sockets).
Page 554: Map Ip Port (Interface Configuration)
RIORITY OMMANDS map ip port (Interface Configuration) This command sets IP port priority (i.e., TCP/UDP port priority). Use the no form to remove a specific setting. Syntax map ip port port-number cos cos-value no map ip port port-number • port-number - 16-bit TCP/UDP port number. (Range: 0-65535) •...
Page 555: Map Ip Precedence (Interface Configuration)
Command Mode Global Configuration Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • IP Precedence and IP DSCP cannot both be enabled. Enabling one of these priority types will automatically disable the other type. Example The following example shows how to enable IP precedence mapping globally:...
Page 556: Map Ip Dscp (Global Configuration)
RIORITY OMMANDS Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • IP Precedence values are mapped to default Class of Service values on a one-to-one basis according to recommendations in the IEEE 802.1p standard, and then subsequently mapped to the four hardware priority queues.
Page 557: Map Ip Dscp (Interface Configuration)
Example The following example shows how to enable IP DSCP mapping globally: Console(config)#map ip dscp Console(config)# map ip dscp (Interface Configuration) This command sets IP DSCP priority (i.e., Differentiated Services Code Point priority). Use the no form to restore the default table. Syntax map ip dscp dscp-value cos cos-value no map ip dscp...
Page 558: Show Map Ip Port
RIORITY OMMANDS • DSCP priority values are mapped to default Class of Service values according to recommendations in the IEEE 802.1p standard, and then subsequently mapped to the four hardware priority queues. • This command sets the IP DSCP priority for all interfaces. Example The following example shows how to map IP DSCP value 1 to CoS value 0: Console(config)#interface ethernet 1/5...
Page 559: Show Map Ip Precedence
Related Commands map ip port (Global Configuration) (4-261) map ip port (Interface Configuration) (4-262) show map ip precedence This command shows the IP precedence priority map. Syntax show map ip precedence [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
Page 560: Show Map Ip Dscp
RIORITY OMMANDS show map ip dscp This command shows the IP DSCP priority map. Syntax show map ip dscp [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) • port-channel channel-id (Range: 1-6) Default Setting None Command Mode...
Page 561: Multicast Filtering Commands
Multicast Filtering Commands This switch uses IGMP (Internet Group Management Protocol) to query for any attached hosts that want to receive a specific multicast service. It identifies the ports containing hosts requesting a service and sends data out to those ports only. It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service.
Page 562: Ip Igmp Snooping
ULTICAST ILTERING ip igmp snooping This command enables IGMP snooping on this switch. Use the no form to disable it. Syntax [no] ip igmp snooping Default Setting Enabled Command Mode Global Configuration Example The following example enables IGMP snooping. Console(config)#ip igmp snooping...
Page 563: Ip Igmp Snooping Version
Version 1. • Some commands are only enabled for IGMPv2, including ip igmp query-max-response-time and ip igmp query-timeout. Example The following configures the switch to use IGMP Version 1: Console(config)#ip igmp snooping version 1 Console(config)# OMMAND...
Page 564: Show Ip Igmp Snooping
ULTICAST ILTERING show ip igmp snooping This command shows the IGMP snooping configuration. Default Setting None Command Mode Privileged Exec Command Usage See “Configuring IGMP Snooping and Query Parameters” on page 3-222 for a description of the displayed items. Example The following shows the current IGMP snooping configuration: Console#show ip igmp snooping Service status:...
Page 565: Igmp Query Commands (Layer 2)
This command enables the switch as an IGMP querier. Use the no form to disable it. Syntax [no] ip igmp snooping querier Eth1/11 IGMP Function...
Page 566: Ip Igmp Snooping Query-Count
Default Setting Enabled Command Mode Global Configuration Command Usage If enabled, the switch will serve as querier if elected. The querier is responsible for asking hosts if they want to receive multicast traffic. Example Console(config)#ip igmp snooping querier Console(config)# ip igmp snooping query-count This command configures the query count.
Page 567: Ip Igmp Snooping Query-Interval
This command configures the query interval. Use the no form to restore the default. Syntax ip igmp snooping query-interval seconds no ip igmp snooping query-interval seconds - The frequency at which the switch sends IGMP host-query messages. (Range: 60-125) Default Setting 125 seconds Command Mode...
Page 568: Ip Igmp Snooping Query-Max-Response-Time
Global Configuration Command Usage • The switch must be using IGMPv2 for this command to take effect. • This command defines the time after a query, during which a response is expected from a multicast client. If a querier has sent a number of queries...
Page 569: Ip Igmp Snooping Router-Port-Expire-Time
- The time the switch waits after the previous querier stops before it considers the router port (i.e., the interface which had been receiving query packets) to have expired.
Page 570: Static Multicast Routing Commands
IGMP querier. Therefore, if the IGMP querier is a known multicast router/switch connected over the network to an interface (port or trunk) on your switch, you can manually configure that interface to join all the current multicast groups.
Page 571: Show Ip Igmp Snooping Mrouter
Example The following shows how to configure port 11 as a multicast router port within VLAN 1: Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11 Console(config)# show ip igmp snooping mrouter This command displays information on statically configured and dynamically learned multicast router ports.
Page 572: Ip Interface Commands
OMMANDS IP Interface Commands An IP addresses may be used for management access to the switch over your network. The IP address for this switch is obtained via DHCP by default. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server when it is powered on.
Page 573 Note: Only one VLAN interface can be assigned an IP address (the default is VLAN 1). This defines the management VLAN, the only VLAN through which you can gain management access to the switch. If you assign an IP address to any other VLAN, the new IP address overrides the original IP address and this becomes the new management VLAN.
Page 574: Ip Default-Gateway
IP I NTERFACE OMMANDS ip default-gateway This command establishes a static route between this switch and devices that exist on another network segment. Use the no form to remove the static route. Syntax ip default-gateway gateway no ip default-gateway gateway - IP address of the default gateway Default Setting No static route is established.
Page 575: Show Ip Interface
Dhcp. Console# Related Commands ip address (4-280) show ip interface Use this command to display the settings for the switch’s IP interface. Command Mode Privileged Exec Example Console#show ip interface IP address and netmask: 10.1.0.254 255.255.255.0 on VLAN 1, and address mode: User specified.
Page 576: Show Ip Redirects
• size - Number of bytes in a packet. (Range: 32-512, default: 32) The actual packet size will be eight bytes larger than the size specified because the switch adds header information. Default Setting This command has no default for the host.
Page 577 • Following are some results of the ping command: - Normal response -The normal response occurs in one to ten seconds, depending on network traffic. - Destination does not respond - If the host does not respond, a “timeout” appears in ten seconds. - Destination unreachable - The gateway for this destination indicates that the destination is unreachable.
Page 578: Dns Commands
DNS C OMMANDS DNS Commands These commands are used to configure Domain Naming System (DNS) services. You can manually configure entries in the DNS domain name to IP address mapping table, configure default domain names, or specify one or more name servers to use for domain name to address translation. Note that domain name services will not be enabled until at least one name server is specified with the ip name-server command and domain lookup is enabled with the ip domain-lookup command.
Page 579: Ip Host
ip host This command creates a static entry in the DNS table that maps a host name to an IP address. Use the no form to remove an entry. Syntax [no] ip host name address1 [address2 … address8] • name - Name of the host. (Range: 1-255 characters) •...
Page 580: Clear Host
DNS C OMMANDS clear host This command deletes entries from the DNS table. Syntax clear host {name | *} • name - Name of the host. (Range: 1-255 characters) • * - Removes all entries. Default Setting None Command Mode Privileged Exec Example This example clears all static entries from the DNS table.
Page 581: Ip Domain-List
• Domain names are added to the end of the list one at a time. • When an incomplete host name is received by the DNS server on this switch, it will work through the domain list, appending each domain name in the list to the host name, and checking with the specified name servers for a match.
Page 582: Ip Name-Server
DNS C OMMANDS • If there is no domain list, the domain name specified with the ip domain-name command is used. If there is a domain list, the default domain name is not used. Example This example adds two domain names to the current list and then displays the list.
Page 583: Ip Domain-Lookup
Command Usage The listed name servers are queried in the specified sequence until a response is received, or the end of the list is reached with no response. Example This example adds two domain-name servers to the list and then displays the list.
Page 584: Show Hosts
DNS C OMMANDS Example This example enables DNS and then displays the configuration. Console(config)#ip domain-lookup Console(config)#end Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: .sample.com Domain Name List: .sample.com.jp .sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# Related Commands ip domain-name (4-288) ip name-server (4-290) show hosts...
Page 585: Show Dns
show dns This command displays the configuration of the DNS server. Command Mode Privileged Exec Example Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: sample.com Domain Name List: sample.com.jp sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# show dns cache This command displays entries in the DNS cache.
Page 586: Clear Dns Cache
DNS C OMMANDS Field FLAG TYPE DOMAIN clear dns cache This command clears all entries in the DNS cache. Command Mode Privileged Exec Example Console#clear dns cache Console#show dns cache FLAG Console# 4-294 Table 4-75 Show DNS Output Description Description The entry number for each resource record.
Page 587: Software Specifications
OFTWARE Software Features Authentication Local, RADIUS, TACACS, Port (802.1X), HTTPS (HTTP/SSL), SSH, Port Security Access Control Lists IP, MAC (up to 32 lists) Power over Ethernet DHCP Client Port Configuration 100BASE-TX: 10/100 Mbps, half/full duplex 1000BASE-T: 10/100 Mbps at half/full duplex, 1000 Mbps at full duplex 1000BASE-SX/LX/LH: 1000 Mbps, full duplex (Optional module/SFP) 100BASE-FX: 100 Mbps, full duplex (Optional module/SFP) Flow Control...
Page 588: Management Features
OFTWARE PECIFICATIONS Port Trunking Static trunks (Cisco EtherChannel compliant) Dynamic trunks (Link Aggregation Control Protocol) Spanning Tree Protocol Spanning Tree Protocol (STP, IEEE 802.1D) Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s) VLAN Support Up to 255 groups;...
Page 589: Standards
SNMPv3 Management access via MIB database Trap management to specified hosts RMON Groups 1, 2, 3, 9 (Statistics, History, Alarm, Event) Standards IEEE 802.1D Spanning Tree Protocol and traffic priorities IEEE 802.1p priority tags IEEE 802.1Q VLAN IEEE 802.1w Rapid Spanning Tree Protocol IEEE 802.1X Port Authentication IEEE 802.3-2002 Ethernet, Fast Ethernet, Gigabit Ethernet,...
Page 590: Management Information Bases
OFTWARE PECIFICATIONS Management Information Bases Bridge MIB (RFC 1493) Entity MIB (RFC 2737) Ether-like MIB (RFC 2665) Extended Bridge MIB (RFC 2674) Extensible SNMP Agents MIB (RFC 2742) Forwarding Table MIB (RFC 2096) IGMP MIB (RFC 2933) Interface Group MIB (RFC 2233) Interfaces Evolution MIB (RFC 2863) IP Multicasting related MIBs MIB II (RFC 1213)
Page 591: Troubleshooting
• Be sure the management station has an IP address in the same subnet as the switch’s IP interface to which it is connected. • If you are trying to connect to the switch via the IP address for a tagged VLAN group, your management station, and the ports connecting intermediate switches in the network, must be configured with the appropriate tag.
Page 592 • Be sure you have generated a public key on the switch, and exported this key to the SSH client. • Be sure you have set up an account on the switch for each SSH user, including user name, authentication level, and password.
Page 593: Using System Logs
Using System Logs If a fault does occur, refer to the Installation Guide to ensure that the problem you encountered is actually caused by the switch. If the problem appears to be caused by the switch, follow these steps: 1. Enable logging.
Page 594 ROUBLESHOOTING...
Page 595: Glossary
ARP converts between IP addresses and MAC (i.e., hardware) addresses. ARP is used to locate the MAC address corresponding to a given IP address. This allows the switch to use IP addresses for routing decisions and the corresponding MAC addresses to forward packets from one hop to the next.
Page 596 EAPOL is a client authentication protocol used by this switch to verify the network access rights for any device that is plugged into the switch. A user name and password is requested by the switch, and then passed to an authentication server (e.g., RADIUS) for verification.
Page 597: Igmp Snooping
An IEEE standard for the Multiple Spanning Tree Protocol (MSTP) which provides independent spanning trees for VLAN groups. IEEE 802.1X Port Authentication controls access to the SMC6824MPE switch ports by requiring users to first enter a user ID and password for authentication. IEEE 802.3ac Defines frame extensions for VLAN tagging.
Page 598: Igmp Query
Internet Group Management Protocol (IGMP) A protocol through which hosts can register with their local router for multicast services. If there is more than one multicast switch/router on a given subnetwork, one of the devices is made the “querier” and assumes responsibility for keeping track of group membership.
Page 599: Link Aggregation
MD5 Message-Digest Algorithm A process whereby the switch filters incoming multicast frames for services for which no attached host has registered, or forwards them to all ports contained within the designated multicast VLAN group.
Page 600: Remote Monitoring (Rmon)
A secure replacement for remote access functions, including Telnet. SSH can authenticate users with a cryptographic key, and encrypt data connections between management clients and the switch. Simple Mail Transfer Protocol (SMTP) A standard host-to-host mail transport protocol that operates over TCP, port 25.
Page 601 Simple Network Time Protocol (SNTP) SNTP allows a device to set its internal clock based on periodic updates from a Network Time Protocol (NTP) server. Updates can be requested from a specific NTP server, or can be received via broadcasts sent by NTP servers. Spanning Tree Algorithm (STA) A technology that checks your network for any loops.
Page 602: Virtual Lan (Vlan)
LOSSARY Virtual LAN (VLAN) A Virtual LAN is a collection of network nodes that share the same collision domain regardless of their physical location or connection point in the network. A VLAN serves as a logical workgroup with no physical barriers, and allows users to share information and resources as though located on the same LAN.
Page 603: Index
Numerics 802.1X configure 3-88 4-110 port authentication 3-88 Access Control Lists See ACL configuration guidelines 3-98 Extended IP 3-99 4-120 4-125 MAC 3-99 4-120 4-138 Standard IP 3-99 4-120 address table 3-151 4-200 aging time 3-154 4-204 BOOTP 3-22 4-280 BPDU 3-155 4-207 broadcast storm, threshold 3-135...
Page 604 NDEX hardware version, displaying 3-15 HTTPS, secure server 3-75 IEEE 802.1D 3-155 4-207 IEEE 802.1s 3-155 4-207 IEEE 802.1w 3-155 4-207 IEEE 802.1X 3-88 4-110 IGMP configuring 3-220 4-269 description of protocol 3-220 Layer 2 3-220 3-221 query 3-221 3-222 4-273 snooping 3-221 4-269...
Page 605 power budgets port 3-147 4-93 port priority 3-150 4-94 Power over Ethernet configuring 2-15 priority, default port ingress 3-202 priority, STA 3-167 4-221 RADIUS, logon authentication 3-72 4-100 rate limits, setting 3-138 remote logging 3-37 4-60 RSTP 3-155 4-207 global configuration 3-161 Secure Shell See SSH serial port, configuring 3-30 SNMP...
Page 606 NDEX Web interface access requirements 3-1 configuration buttons 3-4 home page 3-3 menu list 3-6 panel display 3-5 Index-4...
Page 608 FOR TECHNICAL SUPPORT, CALL: From U.S.A. and Canada (24 hours a day, 7 days a week) (800) SMC-4-YOU; (949) 679-8000; Fax: (949) 679-1481 From Europe (8:00 AM - 5:30 PM UK Time) 44 (0) 118 974 8700; Fax: 44 (0) 118 974 8701 INTERNET E-mail addresses: techsupport@smc.com...

This manual is also suitable for:

Smc6824mpe Smc6826mpe 6824m - annexe 1 6826mpe - annexe 1 Tigerstack iii 10/100 Smc6824mpe series ... Show all