1. Manuals
  2. Brands
  3. SMC Networks Manuals
  4. Switch
  5. SMC6224M
  6. Management manual

SMC Networks SMC TigerStack IV SMC6224M Management Manual

Tigerstack 10/100 24/48-port 10/100mbps stackable managed switch
Hide thumbs Also See for SMC TigerStack IV SMC6224M:
1
2
3
4
5
6
Table Of Contents
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
Table of Contents

Advertisement

Quick Links

See also: Installation Manual
TigerStack 10/100
24/48-Port 10/100Mbps
Stackable Managed Switch

Management Guide

◆ 24/48 auto-MDI/MDI-X 10BASE-T/100BASE-TX ports
◆ 2 Gigabit RJ-45 ports shared with 2 SFP transceiver slots
◆ 2 Gigabit stacking ports that act as Ethernet ports in
standalone mode
◆ Stacks up to 8 units (SMC6224M)
◆ Stacks up to 4 units (SMC6248M)
◆ Non-blocking switching architecture
◆ Spanning Tree Protocol and Rapid STP
◆ Up to four LACP or static 8-port trunks
◆ RADIUS and TACACS+ authentication
◆ Rate limiting for bandwidth management
◆ CoS support for four-level priority
◆ Full support for VLANs with GVRP
◆ IP Multicasting with IGMP Snooping
◆ Manageable via console, Web, SNMP/RMON
Management Guide
SMC6224M
SMC6248M

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the SMC TigerStack IV SMC6224M and is the answer not in the manual?

Questions and answers

Related Manuals for SMC Networks SMC TigerStack IV SMC6224M

Summary of Contents for SMC Networks SMC TigerStack IV SMC6224M

  • Page 1: Management Guide

    TigerStack 10/100 24/48-Port 10/100Mbps Stackable Managed Switch Management Guide ◆ 24/48 auto-MDI/MDI-X 10BASE-T/100BASE-TX ports ◆ 2 Gigabit RJ-45 ports shared with 2 SFP transceiver slots ◆ 2 Gigabit stacking ports that act as Ethernet ports in standalone mode ◆ Stacks up to 8 units (SMC6224M) ◆...
  • Page 3 TigerStack 10/100 Management Guide From SMC’s Tiger line of feature-rich workgroup LAN solutions 38 Tesla Irvine, CA 92618 Phone: (949) 679-8000 January 2005 Pub. # 149100005900...
  • Page 4 38 Tesla Irvine, CA 92618 All rights reserved. Trademarks: SMC is a registered trademark; and EZ Switch, TigerStack and TigerSwitch are trademarks of SMC Networks, Inc. Other product and company names are trademarks or registered trademarks of their respective holders.

  • Page 5: Limited Warranty

    IMITED ARRANTY Limited Warranty Statement: SMC Networks, Inc. (“SMC”) warrants its products to be free from defects in workmanship and materials, under normal use and service, for the applicable warranty term. All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized Reseller.
  • Page 6 * SMC will provide warranty service for one year following discontinuance from the active SMC price list. Under the limited lifetime warranty, internal and external power supplies, fans, and cables are covered by a standard one-year warranty from date of purchase. SMC Networks, Inc. 38 Tesla Irvine, CA 92618...

  • Page 7: Table Of Contents

    Connecting to the Switch ........
  • Page 8 Displaying Bridge Extension Capabilities ....3-15 Setting the Switch’s IP Address ......3-17 Manual Configuration .
  • Page 9 Filtering Addresses for Management Access ....3-75 Access Control Lists ........3-77 Configuring Access Control Lists .
  • Page 10 ONTENTS Displaying Basic VLAN Information ....3-148 Displaying Current VLANs ..... . . 3-149 Creating VLANs .
  • Page 11 Telnet Connection ........4-2 Entering Commands ........4-4 Keywords and Arguments .
  • Page 12 ONTENTS quit ..........4-31 System Management Commands .
  • Page 13 clear logging ........4-63 show logging .
  • Page 14 ONTENTS RADIUS Client ........4-96 radius-server host .
  • Page 15 MAC ACLs ........4-127 access-list mac .
  • Page 16 ONTENTS show rate-limit ........4-161 Link Aggregation Commands .
  • Page 17 Configuring VLAN Interfaces ......4-198 interface vlan ........4-198 switchport mode .
  • Page 18 ONTENTS map ip precedence (Interface Configuration) ..4-230 map ip dscp (Global Configuration) ....4-231 map ip dscp (Interface Configuration) ....4-231 show map ip port .
  • Page 19 PPENDICES Software Specifications ......A-1 Software Features ......... . . A-1 Management Features .
  • Page 20 ONTENTS...
  • Page 21 Table 1-1 Key Features ........1-1 Table 1-2 System Defaults .
  • Page 22 ABLES Table 4-21 SMTP Alert Commands ......4-66 Table 4-22 Time Commands ....... 4-71 Table 4-23 System Status Commands .
  • Page 23 Table 4-58 Priority Commands (Layer 2) ....4-220 Table 4-59 Default CoS Priority Levels ..... . 4-224 Table 4-60 Priority Commands (Layer 3 and 4) .
  • Page 24 ABLES...
  • Page 25 System Information ......3-12 Figure 3-4 Switch Information ......3-14 Figure 3-5 Bridge Extension Configuration .
  • Page 26 IGURES Figure 3-37 ACL Configuration - Extended IP ....3-83 Figure 3-38 ACL Configuration - MAC ..... . . 3-85 Figure 3-39 Binding a Port to an ACL .
  • Page 27 IGURES Figure 3-74 Queue Mode ....... . . 3-173 Figure 3-75 Configuring Queue Scheduling ....3-174 Figure 3-76 IP Precedence/DSCP Priority Status .
  • Page 28 IGURES xxiv...

  • Page 29: Introduction

    This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch. However, there are many options that you should configure to maximize the switch’s performance for your particular...

  • Page 30: Description Of Software Features

    Multicast Filtering Supports IGMP snooping and query Description of Software Features The switch provides a wide range of advanced performance enhancing features. Flow control eliminates the loss of packets due to bottlenecks caused by port saturation. Broadcast storm suppression prevents broadcast traffic storms from engulfing the network.
  • Page 31 Use the full-duplex mode on ports whenever possible to double the throughput of switch connections. Flow control should also be enabled to control network traffic during periods of congestion and prevent the loss of packets when port buffer thresholds are exceeded.
  • Page 32 Static Addresses – A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.
  • Page 33 STP-compliant mode if they detect STP protocol messages from attached devices. Virtual LANs – The switch supports up to 255 VLANs. A Virtual LAN is a collection of network nodes that share the same collision domain regardless of their physical location or connection point in the network.
  • Page 34 NTRODUCTION switch to restrict traffic to the VLAN groups to which a user has been assigned. By segmenting your network into VLANs, you can: • Eliminate broadcast storms which severely degrade performance in a flat network. • Simplify network management for node changes/moves by remotely configuring VLAN membership for any port, rather than having to manually change the network connection.

  • Page 35: System Defaults

    System Defaults The switch’s system defaults are provided in the configuration file “Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as the startup configuration file (page 3-23). The following table lists some of the basic system defaults.
  • Page 36 NTRODUCTION Function Management SNMP Port Configuration Rate Limiting Port Trunking Broadcast Storm Protection Spanning Tree Algorithm Address Table Table 1-2 System Defaults Parameter HTTP Server HTTP Port Number HTTP Secure Server HTTP Secure Port Number Community Strings Traps Admin Status Auto-negotiation Flow Control Input and output limits...
  • Page 37 Function Parameter Virtual LANs Default VLAN PVID Acceptable Frame Type Ingress Filtering Switchport Mode (Egress Mode) GVRP (global) GVRP (port interface) Traffic Ingress Port Priority Prioritization Weighted Round Robin IP Precedence Priority IP DSCP Priority IP Port Priority IP Settings IP Address Subnet Mask Default Gateway...
  • Page 38 NTRODUCTION 1-10...

  • Page 39: Initial Configuration

    (CLI). Note: The IP address for this switch is obtained via DHCP by default. To change this address, see “Setting an IP Address” on page 2-9. The switch’s HTTP web agent allows you to configure switch parameters, monitor port connections, and display statistics using a standard web browser such as Netscape Navigator version 6.2 and higher or Microsoft...

  • Page 40: Required Connections

    Configure any stack unit through the same IP address Required Connections The switch provides an RS-232 serial port that enables a connection to a PC or terminal for monitoring and configuring the switch. A null-modem console cable is provided with the switch.
  • Page 41 Attach a VT100-compatible terminal, or a PC running a terminal emulation program to the switch. You can use the console cable provided with this package, or use a null-modem cable that complies with the wiring assignments shown in the Installation Guide.

  • Page 42: Remote Connections

    IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol. The IP address for this switch is obtained via DHCP by default. To manually configure this address or enable dynamic address assignment via DHCP or BOOTP, see “Setting an IP Address”...

  • Page 43: Stack Operations

    Stack Operations You can stack up to eight SMC6224M units, four SMC6248M units, or four units when both switch types are stacked together. Refer to the Installation Guide for details on stacking these units. One unit in the stack acts as the Master for configuration tasks and firmware upgrade. All of the other units function in Slave mode.

  • Page 44: Recovering From Stack Failure Or Topology Change

    Master unit, or if a new segment now contains only one switch. In other words, a new segment will resume normal operation unless it contains more than one switch and the Master button is not depressed on any of these switches.

  • Page 45: Basic Configuration

    Access to both CLI levels are controlled by user names and passwords. The switch has a default user name and password for each level. To log into the CLI at the Privileged Exec level using the default user name and password, perform these steps: 1.

  • Page 46: Setting Passwords

    “username” command, record them and put them in a safe place. Passwords can consist of up to 8 alphanumeric characters and are case sensitive. To prevent unauthorized access to the switch, set the passwords as follows: 1. Open the console interface with the default user name and password “admin”...

  • Page 47: Setting An Ip Address

    DHCP address allocation servers on the network. Manual Configuration You can manually assign an IP address to the switch. You may also need to specify a default gateway that resides between this device and management stations that exist on another network segment. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods.

  • Page 48: Dynamic Configuration

    If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the switch will start broadcasting service requests as soon as it is powered on. To automatically configure the switch by communicating with BOOTP or...

  • Page 49: Enabling Snmp Management Access

    Enabling SNMP Management Access The switch can be configured to accept management commands from Simple Network Management Protocol (SNMP) applications such as SMC EliteView. You can configure the switch to (1) respond to SNMP requests or (2) generate SNMP traps. ASIC...

  • Page 50: Community Strings

    When SNMP management stations send requests to the switch (either to return information or to set a parameter), the switch provides the requested data or sets the specified parameter. The switch can also be configured to send information to SNMP managers (without being requested by the managers) through trap messages, which inform the manager that certain events have occurred.

  • Page 51: Trap Receivers

    “community-string” is the string associated with that host. Press <Enter>. 2. In order to configure the switch to send SNMP notifications, you must enter at least one snmp-server enable traps command. Type “snmp-server enable traps type,” where “type” is either authentication or link-up-down.

  • Page 52: Managing System Files

    Console# Managing System Files The switch’s flash memory supports three types of system files that can be managed by the CLI program, web interface, or SNMP. The switch’s file system allows files to be uploaded and downloaded, copied, deleted, and set as a start-up file.
  • Page 53 ANAGING YSTEM ILES Due to the size limit of the flash memory, the switch supports only two operation code files. However, you can have as many diagnostic code files and configuration files as available flash memory space allows. In the system flash memory, one file of each type must be set as the start-up file.
  • Page 54 NITIAL ONFIGURATION 2-16...

  • Page 55: Configuring The Switch

    Telnet. For more information on using the CLI, refer to Chapter 4 “Command Line Interface.” Prior to accessing the switch from a web browser, be sure you have first performed the following tasks: 1. Configure the switch with a valid IP address, subnet mask, and default gateway using an out-of-band serial connection, BOOTP or DHCP protocol.
  • Page 56 If you log in as “admin” (Privileged Exec level), you can change the settings on any page. 3. If the path between your management station and this switch does not pass through any device that uses the Spanning Tree Algorithm, then you can set the switch port attached to your management station to fast forwarding (i.e., enable Admin...

  • Page 57: Navigating The Web Browser Interface

    “admin.” Home Page When your web browser connects with the switch’s web agent, the home page is displayed as shown below. The home page displays the Main Menu on the left side of the screen and System Information on the right side.

  • Page 58: Configuration Options

    Panel Display The web agent displays an image of the switch’s ports. The Mode can be set to display different information for the ports, including Active (i.e., up or down), Duplex (i.e., half or full duplex, or Flow Control (i.e., with or without flow control).

  • Page 59: Main Menu

    Main Menu Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program. Menu System System Information...
  • Page 60 ONFIGURING THE WITCH Menu SNTP Configuration Clock Time Zone SNMP Configuration Security User Accounts Authentication Settings Configures authentication sequence, HTTPS Settings Host-Key Settings Settings Port Security 802.1X Information Configuration Port Configuration Statistics Configuration Port Binding Table 3-2 Main Menu (Continued) Description Configures SNTP client settings, including broadcast mode or a specified list of servers...
  • Page 61 Table 3-2 Main Menu (Continued) Menu IP Filter Port Port Information Trunk Information Port Configuration Trunk Configuration Trunk Membership LACP Configuration Aggregation Port Port Counters Port Internal Information Port Neighbors Information Port Broadcast Control Sets the broadcast storm threshold for each Trunk Broadcast Control Mirror Port...
  • Page 62 Configures individual port settings for STA Configures individual trunk settings for STA Enables GVRP VLAN registration protocol Displays information on the VLAN type supported by this switch Shows the current port members of each VLAN and whether or not the port is tagged or untagged...
  • Page 63 Table 3-2 Main Menu (Continued) Menu Static Membership by Port Port Configuration Trunk Configuration Private VLAN Information Configuration Association Port Information Port Configuration Trunk Information Trunk Configuration Priority Default Port Priority Default Trunk Priority Traffic Classes Traffic Classes Status Queue Mode Description Configures membership type for interfaces, including tagged, untagged or forbidden...

  • Page 64: Table 3-2 Main Menu

    VLAN Assigns ports that are attached to a neighboring multicast router Displays all multicast groups active on this switch, including multicast IP addresses and VLAN ID Indicates multicast addresses associated with the selected VLAN Page...

  • Page 65: Basic Configuration

    Field Attributes • System Name – Name assigned to the switch system. • Object ID – MIB II object ID for switch’s network management subsystem. (SMC6624M: 1.3.6.1.4.1.202.20.43; SMC6648M: 1.3.6.1.4.1.202.20.44) • Location – Specifies the system location. •...

  • Page 66: Figure 3-3 System Information

    ONFIGURING THE WITCH Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that allows access to the Command Line Interface via Telnet.) 3-12 Figure 3-3 System Information...

  • Page 67: Displaying Switch Hardware/Software Versions

    Switch Int Loopback test...PASS Done All Pass. Console# Displaying Switch Hardware/Software Versions Use the Switch Information page to display hardware/firmware version numbers for the main board and management software, as well as the power status of the system. Field Attributes Main Board •...

  • Page 68: Figure 3-4 Switch Information

    • Operation Code Version – Version number of runtime code. • Role – Shows that this switch is operating as Master or Slave. Expansion Slot • Expansion Slot 1/2 – Combination RJ-45/SFP ports. These additional parameters are displayed for the CLI.

  • Page 69: Displaying Bridge Extension Capabilities

    Extended Multicast Filtering Services – This switch does not support the filtering of individual multicast addresses based on GMRP (GARP Multicast Registration Protocol). • Traffic Classes – This switch provides mapping of user priorities to multiple traffic classes. (Refer to “Class of Service Configuration” on page 3-169.) •...

  • Page 70: Figure 3-5 Bridge Extension Configuration

    (VLAN-Tagged or Untagged) on each port. (Refer to “VLAN Configuration” on page 3-143.) • Local VLAN Capable – This switch does not support multiple local bridges outside of the scope of 802.1Q defined VLANs. • GMRP – GARP Multicast Registration Protocol (GMRP) allows network devices to register endstations with multicast groups.

  • Page 71: Setting The Switch's Ip Address

    • Management VLAN – ID of the configured VLAN (1-4094, no leading zeroes). By default, all ports on the switch are members of VLAN 1. However, the management station can be attached to a port belonging to any VLAN, as long as that VLAN has been assigned an IP address.

  • Page 72: Manual Configuration

    ONFIGURING THE WITCH Requests will be broadcast periodically by the switch for an IP address. (DHCP/BOOTP values can include the IP address, subnet mask, and default gateway.) • IP Address – Address of the VLAN interface that is allowed management access. Valid IP addresses consist of four numbers, 0 to 255, separated by periods.

  • Page 73: Using Dhcp/Bootp

    IP Address Mode to DHCP or BOOTP. Click Apply to save your changes. Then click Restart DHCP to immediately request a new address. Note that the switch will also broadcast a request for IP configuration settings on each power reset.
  • Page 74 Console# Renewing DCHP – DHCP may lease addresses to clients indefinitely or for a specific period of time. If the address expires or the switch is moved to another network segment, you will lose management access to the switch. In this case, you can reboot the switch or submit a client request to restart DHCP service via the CLI.

  • Page 75: Managing Firmware

    You can upload/download firmware to or from a TFTP server, or copy files to and from switch units in a stack. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation.

  • Page 76: Downloading System Software From A Server

    “opcode,” enter the file name of the software to download, select a file on the switch to overwrite or specify a new file name, then click Apply. If you replaced the current firmware used for startup and want to start using the new operation code, reboot the system via the System/Reset menu.

  • Page 77: Figure 3-9 Select Start-Up Operation File

    ASIC ONFIGURATION If you download to a new destination file, go to the System/File/Set Start-Up menu, mark the operation code file used at startup, and click Apply. To start the new firmware, reboot the system via the System/Reset menu. Figure 3-9 Select Start-Up Operation File To delete a file select System, File, Delete.

  • Page 78: Saving Or Restoring Configuration Settings

    File Transfer Method – The configuration copy operation includes these options: - file to file – Copies a file within the switch directory, assigning it a new name. - file to running-config – Copies a file in the switch to the running configuration.
  • Page 79 - tftp to startup-config – Copies a file from a TFTP server to the startup config. - file to unit – Copies a file from this switch to another unit in the stack. - unit to file – Copies a file from another unit in the stack to this switch.

  • Page 80: Downloading Configuration Settings From A Server

    Web – Click System, File, Copy. Select “tftp to startup-config” or “tftp to file” and enter the IP address of the TFTP server. Specify the name of the file to download and select a file on the switch to overwrite or specify a new file name, then click Apply.

  • Page 81: Figure 3-12 Setting The Startup Configuration Settings

    Figure 3-12 Setting the Startup Configuration Settings CLI – Enter the IP address of the TFTP server, specify the source file on the server, set the startup file name on the switch, and then restart the switch. Console#copy tftp startup-config TFTP server ip address: 192.168.1.19...

  • Page 82: Console Port Settings

    Console Port Settings You can access the onboard configuration program by attaching a VT100 compatible device to the switch’s serial console port. Management access through the console port is controlled by various parameters, including a password, timeouts, and basic communication settings. These parameters can be configured via the web or CLI interface.

  • Page 83: Figure 3-13 Console Port Settings

    • Speed – Sets the terminal line’s baud rate for transmit (to terminal) and receive (from terminal). Set the speed to match the baud rate of the device connected to the serial port. (Range: 9600, 19200, 38400, 57600, or 115200 baud; Default: 9600 bps) •...

  • Page 84: Telnet Settings

    TCP port number, timeouts, and a password. These parameters can be configured via the web or CLI interface. Command Attributes • Telnet Status – Enables or disables Telnet access to the switch. (Default: Enabled) 3-30 3 times Disabled...
  • Page 85 • Telnet Port Number – Sets the TCP port number for Telnet on the switch. (Default: 23) • Login Timeout – Sets the interval that the system waits for a user to log into the CLI. If a login attempt is not detected within the timeout interval, the connection is terminated for the session.

  • Page 86: Figure 3-14 Enabling Telnet

    ONFIGURING THE WITCH Web – Click System, Line, Telnet. Specify the connection parameters for Telnet access, then click Apply. CLI – Enter Line Configuration mode for a virtual terminal, then specify the connection parameters as required. To display the current virtual terminal settings, use the show line command from the Normal Exec level.

  • Page 87: Configuring Event Logging

    Configuring Event Logging The switch allows you to control the logging of error messages, including the type of events that are recorded in switch memory, logging to a remote System Log (syslog) server, and displays a list of recent event messages.

  • Page 88: Table 3-3 Logging Levels

    • RAM Level – Limits log messages saved to the switch’s temporary RAM memory for all levels up to the specified level. For example, if level 7 is specified, all messages from level 0 to level 7 will be logged to RAM.

  • Page 89: Remote Log Configuration

    Web – Click System, Log, System Logs. Specify System Log Status, set the level of event messages to be logged to RAM and flash memory, then click Apply. CLI – Enable system logging and then specify the level of messages to be logged to RAM and flash memory.
  • Page 90 The attribute specifies the facility type tag sent in syslog messages. (See RFC 3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to process messages, such as sorting or storing messages in the corresponding database.

  • Page 91: Figure 3-16 Remote Logs

    Web – Click System, Log, Remote Logs. To add an IP address to the Host IP List, type the new IP address in the Host IP Address box, and then click Add. To delete an IP address, click the entry in the Host IP List, and then click Remove.

  • Page 92: Displaying Log Messages

    Displaying Log Messages The Logs page allows you to scroll through the logged system and event messages. The switch can store up to 2048 log entries in temporary random access memory (RAM; i.e., memory flushed on power reset) and up to 4096 entries in permanent flash memory.

  • Page 93: Sending Simple Mail Transfer Protocol Alerts

    • SMTP Server List – Specifies a list of up to three recipient SMTP servers. The switch attempts to connect to the other listed servers if the first fails. Use the New SMTP Server text field and the Add/Remove buttons to configure the list.

  • Page 94: Figure 3-18 Enabling And Configuring Smtp Alerts

    ONFIGURING THE WITCH Web – Click System, Log, SMTP. Enable SMTP, specify a source email address, and select the minimum severity level. To add an IP address to the SMTP Server List, type the new IP address in the SMTP Server field and click Add.

  • Page 95: Resetting The System

    CLI – Enter the IP address of at least one SMTP server, set the syslog severity level to trigger an email message, and specify the switch (source) and up to five recipient (destination) email addresses. Enable SMTP with the logging sendmail command to complete the configuration. Use the show logging sendmail command to display the current SMTP configuration.

  • Page 96: Setting The System Clock

    You can also manually set the clock using the CLI. (See “calendar set” on page 4-76.) If the clock is not set, the switch will only record the time from the factory default set at the last bootup.

  • Page 97: Figure 3-20 Sntp Configuration

    • SNTP Server – Sets the IP address for up to three time servers. The switch attempts to update the time from the first server, if this fails it attempts an update from the next server in the sequence. Web – Select SNTP, Configuration. Modify any of the required parameters, and click Apply.

  • Page 98: Setting The Time Zone

    ONFIGURING THE WITCH Setting the Time Zone SNTP uses Coordinated Universal Time (or UTC, formerly Greenwich Mean Time, or GMT) based on the time at the Earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC.

  • Page 99: Simple Network Management Protocol

    The switch includes an onboard SNMP agent that continuously monitors the status of its hardware, as well as the traffic passing through its ports. A network management station can access this information using software such as SMC EliteView.

  • Page 100: Specifying Trap Managers And Trap Types

    Console(config)# Specifying Trap Managers and Trap Types Traps indicating status changes are issued by the switch to specified trap managers. You must specify trap managers so that key events are reported by this switch to your management station (using network management platforms such as SMC EliteView).

  • Page 101: Figure 3-23 Configuring Ip Trap Managers

    Command Attributes • Trap Manager Capability – This switch supports up to five trap managers. • Current – Displays a list of the trap managers currently configured. • Trap Manager IP Address – IP address of the host (the targeted recipient).

  • Page 102: User Authentication

    Console(config)#snmp-server host 192.168.1.19 private version 2c Console(config)#snmp-server enable traps authentication User Authentication You can restrict management access to this switch using the following options: • User Accounts – Manually configure access rights on the switch for specified users.

  • Page 103: Figure 3-24 Access Levels

    Command Attributes • Account List – Displays the current list of user accounts and associated access levels. (Defaults: admin, and guest) • New Account – Displays configuration settings for a new account. User Name – The name of the user. (Maximum length: 8 characters;...

  • Page 104: Configuring Local/Remote Logon Authentication

    Use the Authentication Settings menu to restrict management access based on specified user names and passwords. You can manually configure access rights on the switch, or you can use a remote access authentication server based on RADIUS or TACACS+ protocols.

  • Page 105: Command Usage

    • Authentication – Select the authentication, or authentication sequence required: - Local – User authentication is performed only locally by the switch. - Radius – User authentication is performed using a RADIUS server only. - TACACS – User authentication is performed using a TACACS+ server only.
  • Page 106 (Range: 1-30; Default: 2) - Timeout for a reply – The number of seconds the switch waits for a reply from the RADIUS server before it resends the request. (Range: 1-65535; Default: 5) •...

  • Page 107: Figure 3-25 Authentication Settings

    UTHENTICATION Web – Click Security, Authentication Settings. To configure local or remote authentication preferences, specify the authentication sequence (i.e., one to three methods), fill in the parameters for RADIUS or TACACS+ authentication if selected, and click Apply. Figure 3-25 Authentication Settings 3-53...

  • Page 108: Configuring Https

    Server port number: 200 Console# Configuring HTTPS You can configure the switch to enable the Secure Hypertext Transfer Protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Command Usage •...

  • Page 109: Table 3-4 Https System Support

    HTTPS Status – Allows you to enable/disable the HTTPS server feature on the switch. (Default: Enabled) • Change HTTPS Port Number – Specifies the UDP port number used for HTTPS connection to the switch’s web interface. (Default: Port 443) UTHENTICATION Operating System...

  • Page 110: Replacing The Default Secure-Site Certificate

    This is because the certificate has not been signed by an approved certification authority. If you want this warning to be replaced by a message confirming that the connection to the switch is secure, you must obtain a unique certificate and a private key and password from a recognized certification authority.

  • Page 111: Configuring The Secure Shell

    Source certificate file name: <certificate file name> Source private file name: <private key file name> Private password: <password for private key> Note: The switch must be reset for the new certificate to be activated. To reset the switch, type: Configuring the Secure Shell The Berkley-standard includes remote access tools originally designed for Unix systems.
  • Page 112 Authentication Settings page (page 3-50). If public key authentication is specified by the client, then you must configure authentication keys on both the client and the switch as described in the following section. Note that regardless of whether you use public key or password authentication, you still have to generate authentication keys on the switch (SSH Host Key Settings) and enable the SSH server (Authentication Settings).
  • Page 113 The switch compares the client's public key to those stored in memory. c. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. d. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch.

  • Page 114: Generating The Host Key Pair

    Generating the Host Key Pair A host public/private key pair is used to provide secure communications between an SSH client and the switch. After generating this key pair, you must provide the host public key to SSH clients and import the client’s public key to the switch as described in the proceeding section (Command Usage).

  • Page 115: Figure 3-27 Ssh Host-Key Settings

    the client to select either DES (56-bit) or 3DES (168-bit) for data encryption. • Save Host-Key from Memory to Flash – Saves the host key from RAM (i.e., volatile memory to flash memory. Otherwise, the host key pair is stored to RAM by default. Note that you must select this item prior to generating the host-key pair.

  • Page 116: Configuring The Ssh Server

    (Default: Disabled) • Version – The Secure Shell version number. Version 2.0 is displayed, but the switch supports management access via either SSH Version 1.5 or 2.0 clients. • SSH Authentication Timeout – Specifies the time interval in seconds that the SSH server waits for a response from a client during an authentication attempt.

  • Page 117: Figure 3-28 Ssh Server Settings

    SSH Server-Key Size – Specifies the SSH server key size. (Range: 512-896 bits; Default:768) - The server key is a private key that is never shared outside the switch. - The host key is shared with the SSH client, and is fixed at 1024 bits.

  • Page 118: Configuring Port Security

    Console#disconnect 0 Console# Configuring Port Security Port security is a feature that allows you to configure a switch port with one or more device MAC addresses that are authorized to access the network through that port. When port security is enabled on a port, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number.
  • Page 119 Any other device that attempts to use the port will be prevented from accessing the switch. Command Usage • A secure port has the following restrictions: - It cannot use port monitoring.

  • Page 120: Configuring 802.1X Port Authentication

    The IEEE 802.1X (dot1X) standard defines a port-based access control procedure that prevents unauthorized access to a network by requiring users to first submit credentials for authentication. Access to all switch ports in a network can be centrally controlled from a server, which means that authorized users can use the same credentials for authentication from any point within the network.

  • Page 121: Authentication Radius Server

    • 802.1X must be enabled globally for the switch. • Each switch port that will be used must be set to dot1X “Auto” mode. • Each client that needs to be authenticated must have dot1X client software installed and properly configured.

  • Page 122: Displaying 802.1X Global Settings

    ONFIGURING THE WITCH • The RADIUS server and 802.1X client support EAP. (The switch only supports EAPOL in order to pass the EAP packets from the server to the client.) • The RADIUS server and client also have to support the same EAP authentication type –...

  • Page 123: Configuring 802.1X Global Settings

    802.1X is disabled on port 26 Console# Configuring 802.1X Global Settings The 802.1X protocol includes port authentication. The 802.1X protocol must be enabled globally for the switch system before port settings are active. Command Attributes • 802.1X System Authentication Control – Sets the global setting for 802.1X.

  • Page 124: Configuring Port Settings For 802.1X

    • Re-authen – Sets the client to be re-authenticated after the interval specified by the Re-authentication Period. Re-authentication can be used to detect if a new device is plugged into a switch port. (Default: Disabled) 3-70 4-107...

  • Page 125: Figure 3-32 802.1X Port Configuration

    EAP request packet to the client before it times out the authentication session. (Range: 1-10; Default 2) • Quiet Period – Sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. (Range: 1-65535 seconds; Default: 60 seconds) •...
  • Page 126 ONFIGURING THE WITCH CLI – This example sets the 802.1X parameters on port 2. For a description of the additional fields displayed in this example, see “show dot1x” on page 4-112. Console(config)#interface ethernet 1/2 Console(config-if)#dot1x port-control auto Console(config-if)#dot1x re-authentication Console(config-if)#dot1x max-req 5 Console(config-if)#dot1x timeout quiet-period 30 Console(config-if)#dot1x timeout re-authperiod 1800 Console(config-if)#dot1x timeout tx-period 40...

  • Page 127: Displaying 802.1X Statistics

    Displaying 802.1X Statistics This switch can display statistics for dot1x protocol exchanges for any port. Parameter Rx EAPOL Start Rx EAPOL Logoff Rx EAPOL Invalid Rx EAPOL Total Rx EAP Resp/Id Rx EAP Resp/Oth Rx EAP LenError Rx Last EAPOLVer...

  • Page 128: Figure 3-33 Displaying 802.1X Port Statistics

    ONFIGURING THE WITCH Web – Select Security, 802.1X, Statistics. Select the required port and then click Query. Click Refresh to update the statistics. Figure 3-33 Displaying 802.1X Port Statistics CLI – This example displays the 802.1X statistics for port 4. Console#show dot1x statistics interface ethernet 1/4 Eth 1/4 Rx: EAPOL...

  • Page 129: Filtering Addresses For Management Access

    • If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager.

  • Page 130: Figure 3-34 Creating A Web Ip Filter List

    ONFIGURING THE WITCH • Start IP Address – A single IP address, or the starting address of a range. • End IP Address – The end address of a range. • Add/Remove Filtering Entry – Adds/removes an IP address from the list.

  • Page 131: Access Control Lists

    An ACL is a sequential list of permit or deny conditions that apply to IP addresses, MAC addresses, or other more specific criteria. This switch tests ingress or egress packets against the conditions in an ACL one by one. A packet will be accepted as soon as it matches a permit rule, or dropped as soon as it matches a deny rule.

  • Page 132: Setting The Acl Name And Type

    20. • This switch supports ACLs for ingress filtering only. However, you can only bind one IP ACL to any port and one MAC ACL globally for ingress filtering. In other words, only two ACLs can be bound to an interface - Ingress IP ACL and Ingress MAC ACL.

  • Page 133: Figure 3-35 Selecting Acl Type

    MAC: MAC ACL mode that filters packets based on the source or destination MAC address and the Ethernet frame type (RFC 1060). Web – Click Security, ACL, Configuration. Enter an ACL name in the Name field, select the list type (IP Standard, IP Extended, or MAC), and click Add to open the configuration page for the new list.

  • Page 134: Configuring A Standard Ip Acl

    ONFIGURING THE WITCH Configuring a Standard IP ACL Command Attributes • Action – An ACL can contain any combination of permit or deny rules. • Address Type – Specifies the source IP address. Use “Any” to include all possible addresses, “Host” to specify a specific host address in the Address field, or “IP”...

  • Page 135: Configuring An Extended Ip Acl

    Web – Specify the action (i.e., Permit or Deny). Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range. Then click Add.
  • Page 136 ONFIGURING THE WITCH to specify a range of addresses with the Address and SubMask fields. (Options: Any, Host, IP; Default: Any) • Source/Destination Address – Source or destination IP address. • Source/Destination Subnet Mask – Subnet mask for source or destination address.

  • Page 137: Figure 3-37 Acl Configuration - Extended Ip

    For example, use the code value and mask below to catch packets with the following flags set: SYN flag valid, use control-code 2, control bitmask 2 Both SYN and ACK valid, use control-code 18, control bitmask SYN valid and ACK invalid, use control-code 2, control bitmask Web –...

  • Page 138: Configuring A Mac Acl

    ONFIGURING THE WITCH 3. Permit all TCP packets from class C addresses 192.168.1.0 with the TCP control code set to “SYN.” Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any destination-port 80 Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any control-flag 2 2 Console(config-std-acl)# Configuring a MAC ACL Command Attributes...

  • Page 139: Figure 3-38 Acl Configuration - Mac

    Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or MAC). If you select “Host,” enter a specific address (e.g., 11-22-33-44-55-66). If you select “MAC,” enter a base address and a hexidecimal bitmask for an address range.

  • Page 140: Binding A Port To An Access Control List

    MAC access list to all the ports on the switch. Command Usage This switch only supports ACLs for ingress filtering. You can only bind one IP ACL to any port, and one MAC ACL globally, for ingress filtering. Command Attributes •...

  • Page 141: Figure 3-39 Binding A Port To An Acl

    Web – Click Security, ACL, Port Binding. Mark the Enabled field for the port you want to bind to an ACL, select the required ACL from the drop-down list, then click Apply. Figure 3-39 Binding a Port to an ACL CLI –...

  • Page 142: Port Configuration

    ONFIGURING THE WITCH Port Configuration Displaying Connection Status You can use the Port Information or Trunk Information pages to display the current connection status, including link state, speed/duplex mode, flow control, and auto-negotiation. Field Attributes (Web) • Name – Interface label. •...

  • Page 143: Figure 3-40 Displaying Port/Trunk Information

    Port type – Indicates the port type. (100BASE-TX, 1000BASE-T, or SFP) • MAC address – The physical layer address for this port. (To access this item on the web, see “Setting the Switch’s IP Address” on page 3-17.) Configuration: •...
  • Page 144 ONFIGURING THE WITCH - 10full - Supports 10 Mbps full-duplex operation - 100half - Supports 100 Mbps half-duplex operation - 100full - Supports 100 Mbps full-duplex operation - 1000full - Supports 1000 Mbps full-duplex operation - Sym - Transmits and receives pause frames for flow control - FC - Supports flow control •...

  • Page 145: Configuring Interface Connections

    CLI – This example shows the connection status for Port 5. Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: Mac address: Configuration: Name: Port admin: Speed-duplex: Capabilities: Broadcast storm: Broadcast storm limit: Flow control: Lacp: Port security: Max MAC count: Port security action:...
  • Page 146 - Sym (Gigabit only) - Check this item to transmit and receive pause frames, or clear it to auto-negotiate the sender and receiver for asymmetric pause frames. (The current switch chip only supports symmetric pause frames.) - FC - Supports flow control Flow control can eliminate frame loss by “blocking”...

  • Page 147: Creating Trunk Groups

    You can create up to four trunks at a time. The switch supports both static trunking and dynamic Link Aggregation Control Protocol (LACP). Static trunks have to be manually configured at both ends of the link, and the switches must comply with the Cisco EtherChannel standard.
  • Page 148 Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • You can create up to four trunks on a switch or stack, with up to eight ports per trunk. • The ports at both ends of a connection must be configured as trunk ports.

  • Page 149: Statically Configuring A Trunk

    However, note that the static trunks on this switch are Cisco EtherChannel compatible. • To avoid creating a loop in the network, be sure you add a static...

  • Page 150: Figure 3-42 Static Trunk Configuration

    Web – Click Port, Trunk Membership. Enter a trunk ID of 1-4 in the Trunk field, select any of the switch ports from the scroll-down port list, and click Add. After you have completed adding ports to the member list, click Apply.

  • Page 151: Enabling Lacp On Selected Ports

    CLI – This example creates trunk 2 with ports 1 and 2. Just connect these ports to two static trunk ports on another switch to form a trunk. Console(config)#interface port-channel 2 Console(config-if)#exit Console(config)#interface ethernet 1/1 Console(config-if)#channel-group 2 Console(config-if)#exit Console(config)#interface ethernet 1/2...

  • Page 152: Figure 3-43 Lacp Trunk Configuration

    ID. • If more than eight ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails.

  • Page 153: Configuring Lacp Parameters

    CLI – The following example enables LACP for ports 1 to 6. Just connect these ports to LACP-enabled trunk ports on another switch to form a trunk. Console(config)#interface ethernet 1/1 Console(config-if)#lacp Console(config-if)#exit Console(config)#interface ethernet 1/6 Console(config-if)#lacp Console(config-if)#end Console#show interfaces status port-channel 1...
  • Page 154 - Ports must be configured with the same system priority to join the same LAG. - System priority is combined with the switch’s MAC address to form the LAG identifier. This identifier is used to indicate a specific LAG during LACP negotiations with other systems.

  • Page 155: Figure 3-44 Lacp - Aggregation Port

    ONFIGURATION Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and Port Priority for the Port Actor. You can optionally configure these settings for the Port Partner. (Be aware that these settings only affect the administrative state of the partner, and will not take effect until the next time an aggregate link is formed with this device.) After you have completed setting the port LACP parameters, click Apply.
  • Page 156 ONFIGURING THE WITCH CLI – The following example configures LACP parameters for ports 1-4. Ports 1-4 are used as active members of the LAG. Console(config)#interface ethernet 1/1 Console(config-if)#lacp actor system-priority 3 Console(config-if)#lacp actor admin-key 120 Console(config-if)#lacp actor port-priority 128 Console(config-if)#exit Console(config)#interface ethernet 1/4 Console(config-if)#lacp actor system-priority 3 Console(config-if)#lacp actor admin-key 120...

  • Page 157: Displaying Lacp Port Counters

    Displaying LACP Port Counters You can display statistics for LACP protocol messages. Table 3-6 LACP Port Counters Field LACPDUs Sent LACPDUs Received Marker Sent Marker Received LACPDUs Unknown Pkts LACPDUs Illegal Pkts Web – Click Port, LACP, Port Counters Information. Select a member port to display the corresponding information.

  • Page 158: Displaying Lacp Settings And Status For The Local Side

    ONFIGURING THE WITCH CLI – The following example displays LACP counters. Console#show lacp counters Port channel : 1 ------------------------------------------------------------------- Eth 1/ 1 ------------------------------------------------------------------- LACPDUs Sent: LACPDUs Receive: Marker Sent: Marker Receive: LACPDUs Unknown Pkts: 0 LACPDUs Illegal Pkts: 0 Displaying LACP Settings and Status for the Local Side You can display configuration settings and the operational state for the local side of an link aggregation.
  • Page 159 Table 3-7 LACP Internal Configuration Information (Continued) Field Description Admin State, Administrative or operational values of the actor’s state Oper State parameters: • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner.

  • Page 160: Figure 3-46 Lacp - Port Internal Information

    ONFIGURING THE WITCH Web – Click Port, LACP, Port Internal Information. Select a port channel to display the corresponding information. Figure 3-46 LACP - Port Internal Information CLI – The following example displays the LACP configuration settings and operational state for the local side of port channel 1. Console#show lacp 1 internal Port channel : 1 -------------------------------------------------------------------...

  • Page 161: Displaying Lacp Settings And Status For The Remote Side

    Displaying LACP Settings and Status for the Remote Side You can display configuration settings and the operational state for the remote side of an link aggregation. Table 3-8 LACP Neighbor Configuration Information Field Description Partner Admin LAG partner’s system ID assigned by the user. System ID Partner Oper System LAG partner’s system ID assigned by the LACP protocol.

  • Page 162: Figure 3-47 Lacp - Port Neighbors Information

    ONFIGURING THE WITCH Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-47 LACP - Port Neighbors Information CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1. Console#show lacp 1 neighbors Port channel 1 neighbors -------------------------------------------------------------------...

  • Page 163: Setting Broadcast Storm Thresholds

    Command Usage • Broadcast Storm Control is enabled by default. • Broadcast control does not effect IP multicast traffic. • The specified threshold applies to all ports on the switch. Command Attributes • Port – Port number. • Trunk –...

  • Page 164: Figure 3-48 Port Broadcast Control

    ONFIGURING THE WITCH Web – Click Port, Port/Trunk Broadcast Control. Set the threshold, mark the Enabled field for the desired interface and click Apply. 3-110 Figure 3-48 Port Broadcast Control...

  • Page 165: Configuring Port Mirroring

    CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 600 octets per second for port 2 (which applies to all ports). Console(config)#interface ethernet 1/1 Console(config-if)#no switchport broadcast Console(config-if)#exit Console(config)#interface ethernet 1/2...

  • Page 166: Figure 3-49 Mirror Port Configuration

    ONFIGURING THE WITCH Command Attributes • Mirror Sessions – Displays a list of current mirror sessions. • Source Unit – The unit whose port traffic will be monitored. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) • Source Port – The port whose traffic will be monitored. (Range: 1-26/50) •...

  • Page 167: Configuring Rate Limits

    CLI – Use the interface command to select the monitor port, then use the port monitor command to specify the source port and traffic type. Console(config)#interface ethernet 1/10 Console(config-if)#port monitor ethernet 1/13 tx Console(config-if)# Configuring Rate Limits This function allows the network manager to control the maximum rate for traffic transmitted or received on a port.

  • Page 168: Rate Limit Configuration

    ONFIGURING THE WITCH Web – Click Port, Rate Limit, Granularity. Select the required rate limit granularity for Fast Ethernet and Gigabit Ethernet, and click apply. Figure 3-50 Rate Limit Granularity Configuration CLI - This example sets and displays Fast Ethernet and Gigabit Ethernet granularity.

  • Page 169: Showing Port Statistics

    RMON MIB. Interfaces and Ethernet-like statistics display errors on the traffic passing through each port. This information can be used to identify potential problems with the switch (such as a faulty port or unusually heavy loading). RMON statistics provide access to a broad range of statistics, including a total count of different frame types and sizes passing through each port.

  • Page 170: Table 3-9 Port Statistics

    ONFIGURING THE WITCH Note: RMON groups 2, 3 and 9 can only be accessed using SNMP management software such as SMC EliteView. Parameter Interface Statistics Received Octets Received Unicast Packets Received Multicast Packets Received Broadcast Packets Received Discarded Packets Received Unknown Packets Received Errors Transmit Octets...
  • Page 171 Table 3-9 Port Statistics (Continued) Parameter Transmit Multicast Packets Transmit Broadcast Packets Transmit Discarded Packets Transmit Errors Etherlike Statistics Alignment Errors Late Collisions FCS Errors Excessive Collisions Single Collision Frames The number of successfully transmitted frames for Internal MAC Transmit Errors Description The total number of packets that higher-level protocols...
  • Page 172 ONFIGURING THE WITCH Parameter Multiple Collision Frames Carrier Sense Errors SQE Test Errors Frames Too Long Deferred Transmissions A count of frames for which the first transmission Internal MAC Receive Errors RMON Statistics Drop Events Jabbers Received Bytes Collisions Received Frames Broadcast Frames 3-118 Table 3-9 Port Statistics (Continued)
  • Page 173 Table 3-9 Port Statistics (Continued) Parameter Multicast Frames CRC/Alignment Errors The number of CRC/alignment errors (FCS or Undersize Frames Oversize Frames Fragments 64 Bytes Frames 65-127 Byte Frames 128-255 Byte Frames 256-511 Byte Frames 512-1023 Byte Frames 1024-1518 Byte Frames 1519-1536 Byte Frames Description The total number of good frames received that were...

  • Page 174: Figure 3-52 Port Statistics

    ONFIGURING THE WITCH Web – Click Port, Port Statistics. Select the required interface, and click Query. You can also use the Refresh button at the bottom of the page to update the screen. 3-120 Figure 3-52 Port Statistics...
  • Page 175 CLI – This example shows statistics for port 13. Console#show interfaces counters ethernet 1/13 Ethernet 1/13 Iftable stats: Octets input: 868453, Octets output: 3492122 Unicast input: 7315, Unitcast output: 6658 Discard input: 0, Discard output: 0 Error input: 0, Error output: 0 Unknown protos input: 0, QLen output: 0 Extended iftable stats: Multi-cast input: 0, Multi-cast output: 17027...

  • Page 176: Address Table Settings

    Setting Static Addresses A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.

  • Page 177: Figure 3-53 Configuring A Static Address Table

    MAC address and VLAN, then click Add Static Address. Figure 3-53 Configuring a Static Address Table CLI – This example adds an address to the static address table, but sets it to be deleted when the switch is reset. Console(config)#mac-address-table static 00-e0-29-94-34-de interface ethernet 1/1 vlan 1 delete-on-reset...

  • Page 178: Displaying The Address Table

    Displaying the Address Table The Dynamic Address Table contains the MAC addresses learned by monitoring the source address for traffic entering the switch. When the destination address for inbound traffic is found in the database, the packets intended for that address are forwarded directly to the associated port.

  • Page 179: Figure 3-54 Configuring A Dynamic Address Table

    Web – Click Address Table, Dynamic Addresses. Specify the search type (i.e., mark the Interface, MAC Address, or VLAN checkbox), select the method of sorting the displayed addresses, and then click Query. Figure 3-54 Configuring a Dynamic Address Table CLI – This example also displays the address table entries for port 1. Console#show mac-address-table interface ethernet 1/1 Interface Mac Address --------- ----------------- ---- -----------------...

  • Page 180: Changing The Aging Time

    The Spanning Tree Algorithm (STA) can be used to detect and disable network loops, and to provide backup links between switches, bridges or routers. This allows the switch to interact with other bridging devices (that is, an STA-compliant switch, bridge or router) in your network to ensure...
  • Page 181 RSTP – Rapid Spanning Tree Protocol (IEEE 802.1w) STA uses a distributed algorithm to select a bridging device (STA-compliant switch, bridge or router) that serves as the root of the spanning tree network. It selects a root port on each bridging device (except for the root device) which incurs the lowest path cost when forwarding a packet from that device to the root device.

  • Page 182: Displaying Global Settings

    STA Information screen. Field Attributes • Spanning Tree State – Shows if the switch is enabled to participate in an STA-compliant network. • Bridge ID – A unique identifier for this bridge, consisting of the bridge priority and MAC address (where the address is taken from the switch system).
  • Page 183 Designated Root – The priority and MAC address of the device in the Spanning Tree that this switch has accepted as the root device. - Root Port – The number of the port on this switch that is closest to the root. This switch communicates with the root device through this port.

  • Page 184: Figure 3-56 Sta Information

    ONFIGURING THE WITCH • Root Forward Delay – The maximum time (in seconds) this device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a discarding state;...
  • Page 185 CLI – This command displays global STA settings, followed by settings for each port. Console#show spanning-tree Spanning-tree information --------------------------------------------------------------- Spanning tree mode Spanning tree enable/disable Priority Bridge Hello Time (sec.) Bridge Max Age (sec.) Bridge Forward Delay (sec.) Root Hello Time (sec.) Root Max Age (sec.) Root Forward Delay (sec.) Designated Root...

  • Page 186: Configuring Global Settings

    RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU (i.e., STP BPDU) after a port’s migration delay timer expires, the switch assumes it is connected to an 802.1D bridge and starts using only 802.1D BPDUs.
  • Page 187 • Priority – Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device. (Note that lower numeric values indicate higher priority.) - Default: 32768 - Range: 0-61440, in steps of 4096...
  • Page 188 ONFIGURING THE WITCH • Forward Delay – The maximum time (in seconds) this device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a discarding state;...

  • Page 189: Figure 3-57 Sta Configuration

    Web – Click Spanning Tree, STA, Configuration. Modify the required attributes, and click Apply. Figure 3-57 STA Configuration CLI – This example enables Spanning Tree Protocol, sets the mode to RSTP, and then configures the STA and RSTP parameters. Console(config)#spanning-tree Console(config)#spanning-tree mode rstp Console(config)#spanning-tree priority 45056 Console(config)#spanning-tree hello-time 5...

  • Page 190: Displaying Interface Settings

    - A port on a network segment with no other STA compliant bridging device is always forwarding. - If two ports of a switch are connected to the same segment and there is no other STA device attached to this segment, the port with the smaller ID forwards packets and the other is discarding.
  • Page 191 • Designated Port – The port priority and number of the port on the designated bridging device through which this switch must communicate with the root of the Spanning Tree. • Oper Link Type – The operational point-to-point status of the LAN segment attached to this interface.
  • Page 192 Priority – Defines the priority used for this port in the Spanning Tree Algorithm. If the path cost for all ports on a switch is the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.

  • Page 193: Figure 3-58 Sta Port Information

    - Point-to-Point – A connection to exactly one other bridge. - Shared – A connection to two or more bridges. - Auto – The switch automatically determines if the interface is attached to a point-to-point link or to shared media.

  • Page 194: Configuring Interface Settings

    ONFIGURING THE WITCH CLI – This example shows the STA attributes for port 5. Console#show spanning-tree ethernet 1/5 1/ 5 information -------------------------------------------------------------- Admin status Role State Path cost Priority Designated cost Designated port Designated root Designated bridge Fast forwarding Forward transitions Admin edge port Oper edge port Admin Link type...
  • Page 195 Priority – Defines the priority used for this port in the Spanning Tree Protocol. If the path cost for all ports on a switch are the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
  • Page 196 However, remember that Edge Port should only be enabled for ports connected to an end-node device. (Default: Disabled) • Migration – If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode.

  • Page 197: Vlan Configuration

    IEEE 802.1Q VLANs In large networks, routers are used to isolate broadcast traffic for each subnet into separate domains. This switch provides a similar service at Layer 2 by using VLANs to organize any group of network nodes into separate broadcast domains. VLANs confine broadcast traffic to the originating group, and can eliminate broadcast storms in large networks.

  • Page 198: Assigning Ports To Vlans

    Priority tagging Assigning Ports to VLANs Before enabling VLANs for the switch, you must first assign each port to the VLAN group(s) in which it will participate. By default all ports are assigned to VLAN 1 as untagged ports. Add a port as a tagged port if you...
  • Page 199 VLAN Classification – When the switch receives a frame, it classifies the frame in one of two ways. If the frame is untagged, the switch assigns the frame to an associated VLAN (based on the default VLAN ID of the receiving port).
  • Page 200 IEEE 802.1Q VLAN protocol, it can be configured to broadcast a message to your network indicating the VLAN groups it wants to join. When this switch receives these messages, it will automatically place the receiving port in the specified VLANs, and then forward the message to all other ports.

  • Page 201: Forwarding Tagged/Untagged Frames

    When forwarding a frame from this switch along a path that contains any VLAN-aware devices, the switch should include VLAN tags. When forwarding a frame from this switch along a path that does not contain any VLAN-aware devices (including the destination host), the switch must first strip off the VLAN tag before forwarding the frame.

  • Page 202: Enabling Or Disabling Gvrp (Global Setting)

    GVRP must be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. (Default: Disabled) Web – Click VLAN, 802.1Q VLAN, GVRP Status. Enable or disable GVRP, and click Apply.

  • Page 203: Displaying Current Vlans

    • Maximum Number of Supported VLANs – Maximum number of VLANs that can be configured on this switch. Web – Click VLAN, 802.1Q VLAN, Basic Information. Figure 3-61 VLAN Basic Information CLI – Enter the following command. Console#show bridge-ext Max support vlan numbers:...

  • Page 204: Figure 3-62 Displaying Current Vlans

    ONFIGURING THE WITCH • Status – Shows how this VLAN was added to the switch. - Dynamic GVRP: Automatically learned via GVRP. - Permanent: Added as a static entry. • Egress Ports – Shows all the VLAN port members. •...

  • Page 205: Creating Vlans

    Console# Creating VLANs Use the VLAN Static List to create or remove VLAN groups. To propagate information about VLAN groups used on this switch to external network devices, you must specify a VLAN ID for each of these groups. Command Attributes •...

  • Page 206: Figure 3-63 Configuring A Vlan Static List

    ONFIGURING THE WITCH • State (CLI) – Enables or disables the specified VLAN. - Active: VLAN is operational. - Suspend: VLAN is suspended; i.e., does not pass packets. • Add – Adds a new VLAN group to the current list. •...

  • Page 207: Adding Static Members To Vlans (Vlan Index)

    VLAN compliant devices, or untagged they are not connected to any VLAN-aware devices. Or configure a port as forbidden to prevent the switch from automatically adding it to a VLAN via the GVRP protocol. Notes: 1. You can also use the VLAN Static Membership by Port page to configure VLAN groups based on the port index (page 3-156).
  • Page 208 ONFIGURING THE WITCH • Membership Type – Select VLAN membership for each interface by marking the appropriate radio button for a port or trunk: - Tagged: Interface is a member of the VLAN. All packets transmitted by the port will be tagged, that is, carry a tag and therefore carry VLAN or CoS information.

  • Page 209: Figure 3-64 Configuring A Vlan Static Table

    Web – Click VLAN, 802.1Q VLAN, Static Table. Select a VLAN ID from the scroll-down list. Modify the VLAN name and status if required. Select the membership type by marking the appropriate radio button in the list of ports or trunks. Click Apply. Figure 3-64 Configuring a VLAN Static Table CLI –...

  • Page 210: Adding Static Members To Vlans (Port Index)

    ONFIGURING THE WITCH Adding Static Members to VLANs (Port Index) Use the VLAN Static Membership by Port menu to assign VLAN groups to the selected interface as a tagged member. Command Attributes • Interface – Port or trunk identifier. • Member –...

  • Page 211: Configuring Vlan Behavior For Interfaces

    Configuring VLAN Behavior for Interfaces You can configure VLAN behavior for specific interfaces, including the default VLAN identifier (PVID), accepted frame types, ingress filtering, GVRP status, and GARP timers. Command Usage • GVRP – GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network.
  • Page 212 • GVRP Status – Enables/disables GVRP for the interface. GVRP must be globally enabled for the switch before this setting can take effect. (See “Displaying Bridge Extension Capabilities” on page 3-15.) When disabled, any GVRP packets received on this port will be discarded and no GVRP registrations will be propagated from other ports.

  • Page 213: Figure 3-66 Vlan Port Configuration

    • Mode – Indicates VLAN membership mode for an interface. (Default: Hybrid) - 1Q Trunk – Specifies a port as an end-point for a VLAN trunk. A trunk is a direct link between two switches, so the port transmits tagged frames that identify the source VLAN. Note that frames belonging to the port’s default VLAN (i.e., associated with the PVID) are also transmitted as tagged frames.

  • Page 214: Private Vlans

    Console(config-if)# Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN. This switch supports two types of private VLANs: primary/secondary associated groups, and stand-alone isolated VLANs. A primary VLAN contains promiscuous ports that can communicate with all other ports in the private VLAN group, while a...

  • Page 215: Displaying Current Private Vlans

    VLAN). Then assign the promiscuous port and all host ports to an isolated VLAN. Displaying Current Private VLANs The Private VLAN Information page displays information on the private VLANs configured on the switch, including primary, community, and isolated VLANs, and their assigned interfaces. Command Attributes •...

  • Page 216: Figure 3-67 Private Vlan Information

    Web – Click VLAN, Private VLAN, Information. Select the desired port from the VLAN ID drop-down menu. CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and are associated with VLAN 6.

  • Page 217: Configuring Private Vlans

    Web – Click VLAN, Private VLAN, Configuration. Enter the VLAN ID number, select Primary, Isolated or Community type, then click Add. To remove a private VLAN from the switch, highlight an entry in the Current list box and then click Remove. Note that all member ports must be removed from the VLAN before it can be deleted.

  • Page 218: Associating Vlans

    ONFIGURING THE WITCH CLI – This example configures VLAN 5 as a primary VLAN, and VLAN 6 as a community VLAN and VLAN 7 as an isolated VLAN. Console(config)#vlan database Console(config-vlan)#private-vlan 5 primary Console(config-vlan)#private-vlan 6 community Console(config-vlan)#private-vlan 7 isolated Console(config-vlan)# Associating VLANs Each community VLAN must be associated with a primary VLAN.

  • Page 219: Displaying Private Vlan Interface Information

    Information menus to display the interfaces associated with private VLANs. Command Attributes • Port/Trunk – The switch interface. • PVLAN Port Type – Displays private VLAN port types. - Normal – The port is not configured in a private VLAN.

  • Page 220: Configuring Private Vlan Interfaces

    Information. Figure 3-70 Private VLAN Port Information CLI – This example shows the switch configured with primary VLAN 5 and community VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as host ports and associated with VLAN 6.
  • Page 221 - Host – The port is a community port or an isolated port. A community port can communicate with other ports in its own community VLAN and with designated promiscuous port(s). An isolated port can only communicate with the single designated promiscuous port in the isolated VLAN;...

  • Page 222: Figure 3-71 Private Vlan Port Configuration

    Apply. Figure 3-71 Private VLAN Port Configuration CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and associated with VLAN 6.

  • Page 223: Class Of Service Configuration

    Layer 2 Queue Settings Setting the Default Priority for Interfaces You can specify the default port priority for each interface on the switch. All untagged packets entering the switch are tagged with the specified default port priority, and then sorted into the appropriate priority queue at the output port.

  • Page 224: Figure 3-72 Port Priority Configuration

    ONFIGURING THE WITCH Command Attributes • Default Priority received on the specified interface. (Range: 0-7, Default: 0) • Number of Egress Traffic Classes – The number of queue buffers provided for each port. Web – Click Priority, Default Port Priority or Default Trunk Priority. Modify the default priority for any interface, then click Apply.

  • Page 225: Mapping Cos Values To Egress Queues

    The priority levels recommended in the IEEE 802.1p standard for various network applications are shown in the following table. However, you can map the priority levels to the switch’s output queues in any way that benefits application traffic for your own network.

  • Page 226: Figure 3-73 Traffic Classes

    Console# Note: Mapping specific values for CoS priorities is implemented as an interface configuration command, but any changes will apply to the all interfaces on the switch. 12. CLI shows Queue ID. 3-172 – Output queue buffer. (Range: 0-3, where 3 is the...

  • Page 227: Selecting The Queue Mode

    Selecting the Queue Mode You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.

  • Page 228: Setting The Service Weight For Traffic Classes

    WITCH Setting the Service Weight for Traffic Classes This switch uses the Weighted Round Robin (WRR) algorithm to determine the frequency at which it services each priority queue. As described in “Mapping CoS Values to Egress Queues” on page 3-171, the traffic classes are mapped to one of the four egress queues provided for each port.

  • Page 229: Layer 3/4 Priority Settings

    Because different priority information may be contained in the traffic, this switch maps priority values to the output queues in the following manner: • The precedence for priority mapping is IP Port Priority, IP Precedence or DSCP Priority, and then Default Port Priority.

  • Page 230: Selecting Ip Precedence/Dscp Priority

    ONFIGURING THE WITCH Selecting IP Precedence/DSCP Priority The switch allows you to choose between using IP Precedence or DSCP priority. Select one of the methods or disable this feature. Command Attributes • Disabled – Disables both priority services. (This is the default setting.) •...

  • Page 231: Table 3-12 Mapping Ip Precedence

    Table 3-12 Mapping IP Precedence Priority Level Traffic Type Network Control Internetwork Control Critical Flash Override Command Attributes • IP Precedence Priority Table – Shows the IP Precedence to CoS map. • Class of Service Value – Maps a CoS value to the selected IP Precedence value.

  • Page 232: Table 3-13 Mapping Dscp Priority Values

    ONFIGURING THE WITCH CLI – The following example globally enables IP Precedence service on the switch, maps IP Precedence value 1 to CoS value 0 (on port 1), and then displays the IP Precedence settings. Console(config)#map ip precedence Console(config)#interface ethernet 1/1...

  • Page 233: Figure 3-78 Mapping Ip Dscp Priority Values

    Table 3-13 Mapping DSCP Priority Values (Continued) IP DSCP Value 18, 20, 22, 24 26, 28, 30, 32, 34, 36 38, 40, 42 46, 56 Command Attributes • DSCP Priority Table – Shows the DSCP Priority to CoS map. • Class of Service Value –...

  • Page 234: Mapping Ip Port Priority

    ONFIGURING THE WITCH CLI – The following example globally enables DSCP Priority service on the switch, maps DSCP value 0 to CoS value 1 (on port 1), and then displays the DSCP Priority settings. Console(config)#map ip dscp Console(config)#interface ethernet 1/1...

  • Page 235: Figure 3-79 Ip Port Priority Status

    LASS OF ERVICE ONFIGURATION Web – Click Priority, IP Port Priority Status. Set IP Port Priority Status to Enabled. Figure 3-79 IP Port Priority Status Click Priority, IP Port Priority. Enter the port number for a network application in the IP Port Number box and the new CoS value in the Class of Service box, and then click Apply.

  • Page 236: Mapping Cos Values To Acls

    WITCH CLI – The following example globally enables IP Port Priority service on the switch, maps HTTP traffic on port 5 to CoS value 0, and then displays all the IP Port Priority settings for that port. Console(config)#map ip port...

  • Page 237: Figure 3-81 Acl Cos Priority

    • ACL CoS Priority Mapping – Displays the configured information. Web – Click Priority, ACL CoS Priority. Enable mapping for any port, select an ACL from the scroll-down list, then click Add. Figure 3-81 ACL CoS Priority CLI – This example assigns a CoS value of zero to packets matching rules within the specified ACL on port 24.

  • Page 238: Multicast Filtering

    It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service. This procedure is called multicast filtering.

  • Page 239: Layer 2 Igmp (Snooping And Query)

    IGMP querier, you can manually designate a known IGMP querier (i.e., a multicast router/switch) connected over the network to an interface on your switch (page 3-189). This interface will then join all the current multicast groups supported by the attached router/switch to ensure that multicast traffic is passed to all appropriate interfaces within the switch.
  • Page 240 This is also referred to as IGMP Snooping. (Default: Enabled) • Act as IGMP Querier — When enabled, the switch can serve as the Querier, which is responsible for asking hosts if they want to receive multicast traffic. (Default: Enabled) •...

  • Page 241: Figure 3-82 Igmp Configuration

    Notes: 1. All systems on the subnet must support the same version. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Timeout. Web – Click IGMP Snooping, IGMP Configuration. Adjust the IGMP settings as required, and then click Apply. (The default settings are shown below.) Figure 3-82 IGMP Configuration CLI –...

  • Page 242: Displaying Interfaces Attached To A Multicast Router

    VLAN ID – ID of configured VLAN (1-4094). • Multicast Router List – Multicast routers dynamically discovered by this switch or those that are statically assigned to an interface on this switch. Web – Click IGMP Snooping, Multicast Router Port Information. Select the required VLAN ID from the scroll-down list to display the associated multicast routers.

  • Page 243: Specifying Static Interfaces For A Multicast Router

    IGMP querier. Therefore, if the IGMP querier is a known multicast router/ switch connected over the network to an interface (port or trunk) on your switch, you can manually configure the interface (and a specified VLAN) to join all the current multicast groups supported by the attached router.

  • Page 244: Displaying Port Members Of Multicast Services

    ONFIGURING THE WITCH Web – Click IGMP Snooping, Static Multicast Router Port Configuration. Specify the interfaces attached to a multicast router, indicate the VLAN which will forward all the corresponding multicast traffic, and then click Add. After you have finished adding interfaces to the list, click Apply. Figure 3-84 Static Multicast Router Port Configuration CLI –...

  • Page 245: Figure 3-85 Ip Multicast Registration Table

    Web – Click IGMP Snooping, IP Multicast Registration Table. Select a VLAN ID and the IP address for a multicast service from the scroll-down lists. The switch will display all the interfaces that are propagating this multicast service. Figure 3-85 IP Multicast Registration Table CLI –...

  • Page 246: Assigning Ports To Multicast Services

    Query Parameters” on page 3-133. For certain applications that require tighter control, you may need to statically configure a multicast service on the switch. First add all the ports attached to participating hosts to a common VLAN, and then assign the multicast service to that VLAN group.

  • Page 247: Figure 3-86 Igmp Member Port Table

    Web – Click IGMP Snooping, IGMP Member Port Table. Specify the interface attached to a multicast service (via an IGMP-enabled switch or multicast router), indicate the VLAN that will propagate the multicast service, specify the multicast IP address, and click Add. After you have completed adding ports to the member list, click Apply.
  • Page 248 ONFIGURING THE WITCH 3-194...

  • Page 249: Command Line Interface

    Using the Command Line Interface Accessing the CLI When accessing the management interface for the switch over a direct connection to the server’s console port, or via a Telnet connection, the switch can be managed by entering command keywords and parameters at the prompt.

  • Page 250: Telnet Connection

    Note: The IP address for this switch is obtained via DHCP by default. To access the switch through a Telnet session, you must first set the IP address for the Master unit, and set the default gateway if you are managing the switch from a different IP subnet.
  • Page 251 After you configure the switch with an IP address, you can open a Telnet session by performing these steps: 1. From the remote host, enter the Telnet command and the IP address of the device you want to access. 2. At the prompt, enter the user name and system password. The CLI will display the “Vty-n#”...

  • Page 252: Entering Commands

    OMMAND NTERFACE Entering Commands This section describes how to enter CLI commands. Keywords and Arguments A CLI command is a series of keywords and arguments. Keywords identify a command, and arguments specify configuration parameters. For example, in the command “show interfaces status ethernet 1/5,” show interfaces and status are keywords, ethernet is an argument that specifies the interface type, and 1/5 specifies the unit/port.

  • Page 253: Command Completion

    Command Completion If you terminate input with a Tab key, the CLI will print the remaining characters of a partial keyword up to the point of ambiguity. In the “logging history” example, typing log followed by a tab will result in printing the command up to “logging.”...

  • Page 254: Showing Commands

    OMMAND NTERFACE Showing Commands If you enter a “?” at the command prompt, the system will display the first level of keywords for the current command class (Normal Exec or Privileged Exec) or configuration class (Global, ACL, Interface, Line or VLAN Database).

  • Page 255: Partial Keyword Lookup

    The command “show interfaces ?” will display the following information: Console#show interfaces ? counters status switchport Console# Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided. (Remember not to leave a space between the command and question mark.) For example “s?”...

  • Page 256: Understanding Command Modes

    You must be in Global Configuration mode to access any of the other configuration modes. Exec Commands When you open a new console session on the switch with the user name and password “guest,” the system enters the Normal Exec command mode (or guest mode), displaying the “Console>” command prompt.

  • Page 257: Configuration Commands

    Configuration commands are privileged level commands used to modify switch settings. These commands modify the running configuration only and are not saved when the switch is rebooted. To store the running configuration in non-volatile storage, use the copy running-config startup-config command.

  • Page 258: Table 4-2 Configuration Modes

    OMMAND NTERFACE • Line Configuration - These commands modify the console port and Telnet configuration, and include command such as parity and databits. • VLAN Configuration - Includes the command to create VLAN groups. To enter the Global Configuration mode, enter the command configure in Privileged Exec mode.

  • Page 259: Command Line Processing

    Command Line Processing Commands are not case sensitive. You can abbreviate commands and parameters as long as they contain enough letters to differentiate them from any other currently available commands or parameters. You can use the Tab key to complete partial commands, or enter a partial command followed by the “?”...

  • Page 260: Command Groups

    Controls system logs, system passwords, user name, browser management options, and a variety of other system information Manages code image or switch configuration files Configures logon access using local or remote authentication; also configures port security and IEEE 802.1X port access control...
  • Page 261 Configures the address table for filtering specified addresses, displays current entries, clears the table, or sets the aging time Spanning Tree Configures Spanning Tree settings for the switch VLANs Configures VLAN settings, and defines port membership for VLAN groups; also enables or...

  • Page 262: Line Commands

    OMMAND NTERFACE Line Commands You can access the onboard configuration program by attaching a VT100 compatible device to the server’s serial port. These commands are used to set communication parameters for the serial port or Telnet (i.e., a virtual terminal). Command line login...

  • Page 263: Line

    line This command identifies a specific line for configuration, and to process subsequent line configuration commands. Syntax line {console | vty} - console - Console terminal line. - vty - Virtual terminal for remote console access (i.e., Telnet). Default Setting There is no default line.

  • Page 264: Login

    Command Mode Line Configuration Command Usage • There are three authentication modes provided by the switch itself at login: • login selects authentication by a single global password as specified by the password line configuration command. When using this method, the management interface starts in Normal Exec (NE) mode.

  • Page 265: Password

    Example Console(config-line)#login local Console(config-line)# Related Commands username (4-35) password (4-17) password This command specifies the password for a line. Use the no form to remove the password. Syntax password {0 | 7} password no password - {0 | 7} - 0 means plain password, 7 means encrypted password - password - Character string that specifies the line password.

  • Page 266: Timeout Login Response

    OMMAND NTERFACE configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords. Example Console(config-line)#password 0 secret Console(config-line)# Related Commands login (4-16) password-thresh (4-20) timeout login response This command sets the interval that the system waits for a user to log into the CLI.

  • Page 267: Exec-Timeout

    Example To set the timeout to two minutes, enter this command: Console(config-line)#timeout login response 120 Console(config-line)# Related Commands silent-time (4-21) exec-timeout (4-14) exec-timeout This command sets the interval that the system waits until user input is detected. Use the no form to restore the default. Syntax exec-timeout [seconds] no exec-timeout...

  • Page 268: Password-Thresh

    OMMAND NTERFACE Example To set the timeout to two minutes, enter this command: Console(config-line)#exec-timeout 120 Console(config-line)# Related Commands silent-time (4-21) timeout login response (4-13) password-thresh This command sets the password intrusion threshold which limits the number of failed logon attempts. Use the no form to remove the threshold value.

  • Page 269: Silent-Time

    Example To set the password threshold to five attempts, enter this command: Console(config-line)#password-thresh 5 Console(config-line)# Related Commands silent-time (4-21) timeout login response (4-13) silent-time This command sets the amount of time the management console is inaccessible after the number of unsuccessful logon attempts exceeds the threshold set by the password-thresh command.

  • Page 270: Databits

    OMMAND NTERFACE databits This command sets the number of data bits per character that are interpreted and generated by the console port. Use the no form to restore the default value. Syntax databits {7 | 8} no databits - 7 - Seven data bits per character. - 8 - Eight data bits per character.

  • Page 271: Parity

    parity This command defines the generation of a parity bit. Use the no form to restore the default setting. Syntax parity {none | even | odd} no parity - none - No parity - even - Even parity - odd - Odd parity Default Setting No parity Command Mode...

  • Page 272: Stopbits

    OMMAND NTERFACE Default Setting 9600 Command Mode Line Configuration Command Usage Set the speed to match the baud rate of the device connected to the serial port. Some baud rates available on devices connected to the port might not be supported. The system indicates if the speed you selected is not supported.

  • Page 273: Disconnect

    disconnect This command terminates an SSH, Telnet, or console connection. Syntax disconnect session-id session-id – The session identifier for an SSH, Telnet or console connection. (Range: 0-4) Command Mode Privileged Exec Command Usage Specifying session identifier “0” will disconnect the console connection.

  • Page 274: General Commands

    OMMAND NTERFACE Example To show all lines, enter this command: Console#show line Console configuration: Password threshold: Interactive timeout: Disabled Login timeout: Disabled Silent time: Baudrate: Databits: Parity: Stopbits: VTY configuration: Password threshold: Interactive timeout: 600 sec Login timeout: 300 sec console# General Commands Command...

  • Page 275: Enable

    enable This command activates Privileged Exec mode. In privileged mode, additional commands are available, and certain commands display additional information. See “Understanding Command Modes” on page 4-8. Syntax enable [level] level - Privilege level to log into the device. The device has two predefined privilege levels: 0: Normal Exec, 15: Privileged Exec.

  • Page 276: Disable

    This command activates Global Configuration mode. You must enter this mode to modify any settings on the switch. You must also enter Global Configuration mode prior to enabling some of the other configuration modes, including Interface Configuration, Line Configuration, and VLAN Database Configuration.

  • Page 277: Show History

    Example Console#configure Console(config)# Related Commands end (4-30) show history This command shows the contents of the command history buffer. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The history buffer size is fixed at 10 Execution commands and 10 Configuration commands.

  • Page 278: Reload

    None Command Mode Privileged Exec Command Usage This command resets the entire system. Example This example shows how to reset the switch: Console#reload System will be restarted, continue <y/n>? y This command returns to Privileged Exec mode. Default Setting None...

  • Page 279: Exit

    Command Mode Global Configuration, Interface Configuration, Line Configuration, and VLAN Database Configuration. Example This example shows how to return to the Privileged Exec mode from the Interface Configuration mode: Console(config-if)#end Console# exit This command returns to the previous configuration mode or exit the configuration program.

  • Page 280: System Management Commands

    Secure Shell Event Logging Time (System Clock) 4-32 Configures information that uniquely identifies this switch Configures the basic user names and passwords for management access Configures IP addresses that are allowed management access Enables management access via a web browser...

  • Page 281: Device Designation Commands

    Table 4-8 Device Designation Commands Command Function prompt Customizes the prompt used in PE and NE mode GC hostname Specifies the host name for the switch snmp-server Sets the system contact string contact snmp-server Sets the system location string location prompt This command customizes the CLI prompt.

  • Page 282: Hostname

    User Access Commands The basic commands required for management access are listed in this section. This switch also includes other options for password checking via the console or a Telnet connection (page 4-14), user authentication via a remote authentication server (page 4-93), and host access authentication for specific ports (page 4-106).

  • Page 283: Username

    username This command adds named users, requires authentication at login, specifies or changes a user's password (or specify that no password is required), or specifies or changes a user's access level. Use the no form to remove a user name. Syntax username name {access-level level | nopassword | password {0 | 7} password}...

  • Page 284: Enable Password

    OMMAND NTERFACE Command Usage The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords.

  • Page 285: Ip Filter Commands

    Related Commands enable (4-27) authentication enable (4-95) IP Filter Commands Command management show management Displays the switch to be monitored or YSTEM Table 4-11 IP Filter Commands Function Configures IP addresses that are allowed management access configured from a browser...

  • Page 286: Management

    Global Configuration Command Usage • If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager.

  • Page 287: Show Management

    Console(config)#management all-client 192.168.1.25 192.168.1.30 Console(config)# show management This command displays the client IP addresses that are allowed management access to the switch through various protocols. Syntax show management {all-client | http-client | snmp-client | telnet-client} - all-client - Adds IP address(es) to the SNMP, web and Telnet groups.

  • Page 288: Web Server Commands

    Function ip http port Specifies the port to be used by the web browser interface ip http server Allows the switch to be monitored or configured from a browser ip http Enables HTTPS for encrypted communications GC secure-server ip http...

  • Page 289: Ip Http Port

    ip http port This command specifies the TCP port number used by the web browser interface. Use the no form to use the default port. Syntax ip http port port-number no ip http port port-number - The TCP port to be used by the browser interface. (Range: 1-65535) Default Setting Command Mode...

  • Page 290: Ip Http Secure-Server

    This command enables the secure hypertext transfer protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Use the no form to disable this function. Syntax [no] ip http secure-server...

  • Page 291: Ip Http Secure-Port

    (4-43) copy tftp https-certificate (4-86) ip http secure-port This command specifies the UDP port number used for HTTPS connection to the switch’s web interface. Use the no form to restore the default port. Syntax ip http secure-port port_number no ip http secure-port port_number –...

  • Page 292: Telnet Server Commands

    Telnet Server Commands Command ip telnet port ip telnet server Allows the switch to be monitored or configured ip telnet port This command specifies the TCP port number used by the Telnet interface. Use the no form to use the default port.

  • Page 293: Ip Telnet Server

    Default Setting Command Mode Global Configuration Example Console(config)#ip telnet port 123 Console(config)# Related Commands ip telnet server (4-45) ip telnet server This command allows this device to be monitored or configured from Telnet. Use the no form to disable this function. Syntax [no] ip telnet server Default Setting...

  • Page 294: Secure Shell Commands

    Telnet. When a client contacts the switch via the SSH protocol, the switch uses a public-key that the client must match along with a local user name and password for access authentication. SSH also encrypts all data...
  • Page 295 4-94. If public key authentication is specified by the client, then you must configure authentication keys on both the client and the switch as described in the following section. Note that regardless of whether you use public key or password authentication, you still have to generate authentication keys on the switch and enable the SSH server.
  • Page 296 SSH server on the switch. 6. Configure Challenge-Response Authentication – When an SSH client attempts to contact the switch, the SSH server uses the host key pair to negotiate a session key and encryption method. Only clients that have a private key corresponding to the public keys stored on the switch can gain access.

  • Page 297: Ip Ssh Server

    The client sends its public key to the switch. b. The switch compares the client's public key to those stored in memory. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client.

  • Page 298: Ip Ssh Timeout

    Global Configuration Command Usage The timeout specifies the interval the switch will wait for a response from the client during the SSH negotiation phase. Once an SSH session has been established, the timeout for user input is controlled by the exec-timeout command for vty sessions.

  • Page 299: Ip Ssh Authentication-Retries

    ip ssh authentication-retries This command configures the number of times the SSH server attempts to reauthenticate a user. Use the no form to restore the default setting. Syntax ip ssh authentication-retries count no ip ssh authentication-retries count – The number of authentication attempts permitted after which the interface is reset.

  • Page 300: Delete Public-Key

    OMMAND NTERFACE Command Usage • The server key is a private key that is never shared outside the switch. • The host key is shared with the SSH client, and is fixed at 1024 bits. Example Console(config)#ip ssh server-key size 512...

  • Page 301: Ip Ssh Crypto Zeroize

    Command Mode Privileged Exec Command Usage • This command stores the host key pair in memory (i.e., RAM). Use the ip ssh save host-key command to save the host key pair to flash memory. • Some SSH client programs automatically add the public key to the known hosts file as part of the configuration process.

  • Page 302: Ip Ssh Save Host-Key

    OMMAND NTERFACE Command Usage • This command clears the host key from volatile memory (RAM). Use the no ip ssh save host-key command to clear the host key from flash memory. • The SSH server must be disabled before you can execute this command.

  • Page 303: Show Ip Ssh

    show ip ssh This command displays the connection settings used when authenticating client access to the SSH server. Command Mode Privileged Exec Example Console#show ip ssh SSH Enabled - version 1.99 Negotiation timeout: 120 secs; Authentication retries: 3 Server key size: 768 bits Console# show ssh This command displays the current SSH server connections.

  • Page 304: Show Public-Key

    OMMAND NTERFACE Table 4-16 show ssh - display description (Continued) Field Description Encryption The encryption method is automatically negotiated between the client and server. Options for SSHv1.5 include: DES, 3DES Options for SSHv2.0 can include different algorithms for the client-to-server (ctos) and server-to-client (stoc): aes128-cbc-hmac-sha1 aes192-cbc-hmac-sha1 aes256-cbc-hmac-sha1...

  • Page 305: Command Mode

    Command Mode Privileged Exec Command Usage • If no parameters are entered, all keys are displayed. If the user keyword is entered, but no user name is specified, then the public keys for all users are displayed. • When an RSA key is displayed, the first field indicates the size of the host key (e.g., 1024), the second field is the encoded public exponent (e.g., 35), and the last string is the encoded modulus.

  • Page 306: Event Logging Commands

    This command controls logging of error messages, sending debug or error messages to switch memory. The no form disables the logging process. Syntax [no] logging on Default Setting None Command Mode...

  • Page 307: Logging History

    Related Commands logging history (4-59) clear logging (4-63) logging history This command limits syslog messages saved to switch memory based on severity. The no form returns the logging of syslog messages to the default level. Syntax logging history {flash | ram} level no logging history {flash | ram} - flash - Event history stored in flash memory (i.e., permanent...

  • Page 308: Logging Host

    OMMAND NTERFACE Level Severity Name alerts emergencies * There are only Level 2, 5 and 6 error messages for the current firmware release. Default Setting Flash: errors (level 3 - 0) RAM: warnings (level 6 - 0) Command Mode Global Configuration Command Usage The message level specified for flash memory must be a higher priority (i.e., numerically lower) than that specified for RAM.

  • Page 309: Logging Facility

    The command specifies the facility type tag sent in syslog messages. (See RFC 3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to sort messages or to store messages in the corresponding database.

  • Page 310: Logging Trap

    OMMAND NTERFACE logging trap This command enables the logging of system messages to a remote server, or limits the syslog messages saved to a remote server based on severity. Use this command without a specified level to enable remote logging. Use the no form to disable remote logging.

  • Page 311: Clear Logging

    Related Commands show logging (4-63) show logging This command displays the configuration settings for logging messages to local switch memory, to an SMTP event handler, or to a remote syslog server. Syntax show logging {flash | ram | sendmail | trap} - flash - Displays settings for storing event messages in flash memory (i.e., permanent memory).

  • Page 312: Default Setting

    OMMAND NTERFACE Default Setting None Command Mode Privileged Exec Example The following example shows that system logging is enabled, the message level for flash memory is “errors” (i.e., default level 3 - 0), the message level for RAM is “informational” (i.e., default level 6 - 0). Console#show logging flash Syslog logging: History logging in FLASH: level errors...

  • Page 313: Show Log

    Table 4-20 show logging trap - display description Field Syslog logging REMOTELOG status REMOTELOG facility type REMOTELOG level type REMOTELOG server IP address Related Commands show logging sendmail (4-70) show log This command displays the system and event messages stored in memory. Syntax show log {flash | ram} [login] [tail] - flash - Event history stored in flash memory (i.e., permanent...

  • Page 314: Command Usage

    OMMAND NTERFACE Command Usage This command shows the system and event messages stored in memory, including the time stamp, message level (page 4-59), program module, function, and event number. Example The following example shows sample messages stored in RAM. Console#show log ram [5] 00:01:06 2001-01-01 "STA root change notification."...

  • Page 315: Logging Sendmail Host

    • You can specify up to three SMTP servers for event handing. However, you must enter a separate command to specify each server. • To send email alerts, the switch first opens a connection, sends all the email alerts waiting in the queue one by one, and finally closes the connection.

  • Page 316: Logging Sendmail Level

    OMMAND NTERFACE Example Console(config)#logging sendmail host 192.168.1.200 Console(config)# logging sendmail level This command sets the severity threshold used to trigger alert messages. Syntax logging sendmail level level level - One of the system message levels (page 4-59). Messages sent include the selected level down to level 0. (Range: 0-7; Default: 7) Default Setting Level 7 Command Mode...

  • Page 317: Logging Sendmail Source-Email

    None Command Mode Global Configuration Command Usage You may use an symbolic email address that identifies the switch, or the address of an administrator responsible for the switch. Example This example will set the source email john@acme.com. Console(config)#logging sendmail source-email john@acme.com...

  • Page 318: Logging Sendmail

    OMMAND NTERFACE Command Mode Global Configuration Command Usage You can specify up to five recipients for alert messages. However, you must enter a separate command to specify each recipient. Example Console(config)#logging sendmail destination-email ted@this-company.com Console(config)# logging sendmail This command enables SMTP event handling. Use the no form to disable this function.

  • Page 319: Time Commands

    (NTP or SNTP). Maintaining an accurate time on the switch enables the system log to record meaningful dates and times for event entries. If the clock is not set, the switch will only record the time from the factory default set at the last bootup.

  • Page 320: Sntp Client

    Command Usage • The time acquired from time servers is used to record accurate dates and times for log events. Without SNTP, the switch only records the time starting from the factory default set at the last bootup (i.e., 00:00:00, Jan. 1, 2001).

  • Page 321: Sntp Server

    Global Configuration Command Usage This command specifies time servers from which the switch will poll for time updates when set to SNTP client mode. The client will poll the time servers in the order specified until a response is received. It issues time synchronization requests based on the interval set via the sntp poll command.

  • Page 322: Sntp Poll

    OMMAND NTERFACE sntp poll This command sets the interval between sending time requests when the switch is set to SNTP client mode. Use the no form to restore to the default. Syntax sntp poll seconds no sntp poll seconds - Interval between time requests. (Range: 16-16384 seconds)

  • Page 323: Clock Timezone

    SNTP server 137.92.140.80 0.0.0.0 0.0.0.0 Current server: 137.92.140.80 Console# clock timezone This command sets the time zone for the switch’s internal clock. Syntax clock timezone name hour hours minute minutes {before-utc | after-utc} • name - Name of timezone, usually an acronym. (Range: 1-29 characters) •...

  • Page 324: Calendar Set

    (4-74) calendar set This command sets the system clock. It may be used if there is no time server on your network, or if you have not configured the switch to receive signals from a time server. Syntax calendar set hour min sec {day month year | month day year} •...

  • Page 325: Show Calendar

    YSTEM Table 4-23 System Status Commands Function Displays the unit ID of a switch using its front-panel LED indicators Displays the contents of the configuration file (stored in flash memory) that is used to start up the system...

  • Page 326: Light Unit

    This command displays the unit ID of a switch using its front-panel LED indicators. Syntax light unit [unit] unit - specifies a unit in a switch stack to light the panel LEDs Default Setting None Command Mode Normal Exec, Privileged Exec...

  • Page 327: Table 4-7 System Management Commands

    - Users (names and access levels) - VLAN database (VLAN ID, name and state) - VLAN configuration settings for each interface - IP address configured for the switch - Spanning tree settings - Any configured settings for the console port and Telnet...

  • Page 328: Show Running-Config

    “!” symbols, and includes the configuration mode command, and corresponding commands. This command displays the following information: - MAC address for each switch in the stack - SNTP server settings - Local time zone - SNMP community strings...
  • Page 329 Example Console#show running-config building startup-config, please wait... phymap 00-30-f1-ce-2a-20 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 SNTP server 0.0.0.0 0.0.0.0 0.0.0.0 clock timezone hours 0 minute 0 after-UTC SNMP-server community private rw SNMP-server community public ro username admin access-level 15 username admin password 7 21232f297a57a5a743894a0e4a801fc3 username guest access-level 0 username guest password 7 084e0343a0486ff05530df6c705c8bb4...

  • Page 330: Show System

    • The POST results should all display “PASS.” If any POST test indicates “FAIL,” contact your distributor for assistance. Example Console#show system System description: 24-Port 10/100Mbps Stackable Managed Switch with 2 optional uplink modules System OID string: 1.3.6.1.4.1.202.20.43 System information...

  • Page 331: Show Users

    show users Shows all active console and Telnet sessions, including user name, idle time, and IP address of Telnet client. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The session used to execute this command is indicated by a “*” symbol next to the Line (i.e., session) index number.

  • Page 332: Jumbo Frame

    OMMAND NTERFACE Command Mode Normal Exec, Privileged Exec Command Usage See “Displaying Switch Hardware/Software Versions” on page 3-13 for detailed information on the items displayed by this command. Example Console#show version Unit 1 Serial number: Service tag: Hardware version: Module A type:...

  • Page 333: Flash/File Commands

    Command Mode Global Configuration Command Usage • This switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields.

  • Page 334: Copy

    This command moves (upload/download) a code image or configuration file between the switch’s flash memory and a TFTP server. When you save the system code or configuration settings to a file on a TFTP server, that file can later be downloaded to the switch to restore system operation. The success of the file transfer depends on the accessibility of the TFTP server and the quality of the network connection.
  • Page 335 • To replace the startup configuration, you must use startup-config as the destination. • Use the copy file unit command to copy a local file to another switch in the stack. Use the copy unit file command to copy a file from another switch in the stack.
  • Page 336 \Write to FLASH finish. Success. Console# This example shows how to copy a secure-site certificate from an TFTP server. It then reboots the switch to activate the certificate: Console#copy tftp https-certificate TFTP server ip address: 10.1.0.19 Source certificate file name: SS-certificate...

  • Page 337: Delete

    This example shows how to copy a public-key used by SSH from an TFTP server. Note that public key authentication via SSH is only supported for users configured locally on the switch: Console#copy tftp public-key TFTP server IP address: 192.168.1.19 Choose public key type: 1.

  • Page 338: Dir

    The type of file or image to display includes: - boot-rom - Boot ROM (or diagnostic) image file. - config - Switch configuration file. - opcode - Run-time operation code image file. - filename - Name of the configuration file or code image.

  • Page 339: Whichboot

    • File information is shown below: Column Heading file name file type startup size Example The following example shows how to display all file information: Console#dir 1: ------------------------------------- Unit2: D2218 V2260-S V2264-J Factory_Default_Config.cfg --------------------------------------------------------------------------- Console# whichboot This command displays which files were booted when the system powered Syntax whichboot [unit] unit - Stack unit.

  • Page 340: Boot System

    OMMAND NTERFACE Example This example shows the information displayed by the whichboot command. See the table under the dir command for a description of the file information displayed by this command. Console#whichboot file name ------------------------------------- Unit1: D2218 V2260-S Factory_Default_Config.cfg Console# boot system This command specifies the image used to start up the system.

  • Page 341: Authentication Commands

    (4-90) whichboot (4-91) Authentication Commands You can configure this switch to authenticate users logging into the system for management access using local or RADIUS authentication methods. You can also enable port-based authentication for network client access using IEEE 802.1X.

  • Page 342: Authentication Login

    OMMAND NTERFACE authentication login This command defines the login authentication method and precedence. Use the no form to restore the default. Syntax authentication login {[local] [radius] [tacacs]} no authentication login • local - Use local password. • radius - Use RADIUS server password. •...

  • Page 343: Authentication Enable

    Example Console(config)#authentication login radius Console(config)# Related Commands username - for setting the local user names and passwords (4-35) authentication enable This command defines the authentication method and precedence to use when changing from Exec command mode to Privileged Exec command mode with the enable command (see page 4-27).

  • Page 344: Related Commands

    RADIUS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch. Command radius-server host radius-server port...

  • Page 345: Radius-Server Host

    • port_number - RADIUS server UDP port used for authentication messages. (Range: 1-65535) • timeout - Number of seconds the switch waits for a reply before resending a request. (Range: 1-65535) • retransmit - Number of times the switch will try to authenticate logon access via the RADIUS server.

  • Page 346: Radius-Server Port

    OMMAND NTERFACE radius-server port This command sets the RADIUS server network port. Use the no form to restore the default. Syntax radius-server port port_number no radius-server port port_number - RADIUS server UDP port used for authentication messages. (Range: 1-65535) Default Setting 1812 Command Mode Global Configuration...

  • Page 347: Radius-Server Retransmit

    RADIUS server. Use the no form to restore the default. Syntax radius-server timeout number_of_seconds no radius-server timeout number_of_seconds - Number of seconds the switch waits for a reply before resending a request. (Range: 1-65535) Default Setting UTHENTICATION...

  • Page 348: Show Radius-Server

    OMMAND NTERFACE Command Mode Global Configuration Example Console(config)#radius-server timeout 10 Console(config)# show radius-server This command displays the current settings for the RADIUS server. Default Setting None Command Mode Privileged Exec Example Console#show radius-server Remote RADIUS server configuration: ***** Global settings Communication key with RADIUS server: Server port number: Retransmit times:...

  • Page 349: Tacacs+ Client

    TACACS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch. Command tacacs-server host tacacs-server port...

  • Page 350: Tacacs-Server Port

    OMMAND NTERFACE tacacs-server port This command specifies the TACACS+ server network port. Use the no form to restore the default. Syntax tacacs-server port port_number no tacacs-server port port_number - TACACS+ server TCP port used for authentication messages. (Range: 1-65535) Default Setting Command Mode Global Configuration Example...

  • Page 351: Show Tacacs-Server

    Port Security Commands These commands can be used to enable port security on a port. When using port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table for this port will be authorized to access the network.

  • Page 352: Port Security

    OMMAND NTERFACE Command port security mac-address-table static show mac-address-table port security This command enables or configures port security. Use the no form without any keywords to disable port security. Use the no form with the appropriate keyword to restore the default settings for a response to security violation or for the maximum number of allowed addresses.

  • Page 353: Command Usage

    Command Usage • If you enable port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table will be accepted.

  • Page 354: 802.1X Port Authentication

    OMMAND NTERFACE 802.1X Port Authentication The switch supports IEEE 802.1X (dot1x) port-based access control that prevents unauthorized access to the network by requiring users to first submit credentials for authentication. Client authentication is controlled centrally by a RADIUS server using EAP (Extensible Authentication Protocol).

  • Page 355: Dot1X System-Auth-Control

    Console(config)#dot1x default Console(config)# dot1x max-req This command sets the maximum number of times the switch port will retransmit an EAP request/identity packet to the client before it times out the authentication session. Use the no form to restore the default.

  • Page 356: Dot1X Port-Control

    OMMAND NTERFACE Default Command Mode Interface Configuration Example Console(config)#interface eth 1/2 Console(config-if)#dot1x max-req 2 Console(config-if)# dot1x port-control This command sets the dot1x mode on a port interface. Use the no form to restore the default. Syntax dot1x port-control {auto | force-authorized | force-unauthorized} no dot1x port-control •...

  • Page 357: Dot1X Operation-Mode

    dot1x operation-mode This command allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. Use the no form with no keywords to restore the default to single host. Use the no form with the multi-host max-count keywords to restore the default maximum count. Syntax dot1x operation-mode {single-host | multi-host [max-count count]}...

  • Page 358: Dot1X Re-Authenticate

    OMMAND NTERFACE dot1x re-authenticate This command forces re-authentication on all ports or a specific interface. Syntax dot1x re-authenticate [interface] interface • ethernet unit/port - unit - Stack unit. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number. (Range: 1-26) Command Mode Privileged Exec Example...

  • Page 359: Dot1X Timeout Quiet-Period

    This command sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. Use the no form to reset the default. Syntax dot1x timeout quiet-period seconds no dot1x timeout quiet-period seconds - The number of seconds.

  • Page 360: Dot1X Timeout Tx-Period

    Console(config)#interface eth 1/2 Console(config-if)#dot1x timeout re-authperiod 300 dot1x timeout tx-period This command sets the time that an interface on the switch waits during an authentication session before re-transmitting an EAP packet. Use the no form to reset to the default value.
  • Page 361 This command displays the following information: • Global 802.1X Parameters – Shows whether or not 802.1X port authentication is globally enabled on the switch. • 802.1X Port Summary – Displays the port access control parameters for each interface, including the following items: - Status - Operation Mode–...
  • Page 362 OMMAND NTERFACE - Max Count - Port-control - Supplicant - Current Identifier– The integer (0-255) used by the Authenticator • Authenticator State Machine - State - Reauth Count – Number of times connecting state is re-entered. • Backend State Machine - State - Request Count–...

  • Page 363: Table 4-27 Authentication Commands

    Example Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status disabled enabled 1/26 disabled 802.1X Port Details 802.1X is disabled on port 1/1 802.1X is enabled on port 1/2 reauth-enabled: Enable reauth-period: 1800 quiet-period: tx-period: supplicant-timeout: server-timeout: 10 reauth-max: max-req:...

  • Page 364: Access Control List Commands

    An ACL is a sequential list of permit or deny conditions that apply to IP addresses, MAC addresses, or other more specific criteria. This switch tests ingress or egress packets against the conditions in an ACL one by one. A packet will be accepted as soon as it matches a permit rule, or dropped as soon as it matches a deny rule.

  • Page 365: Ip Acls

    • This switch supports ACLs for ingress filtering only. You can only bind one IP ACL to any port and one MAC ACL globally for ingress filtering. In other words, only two ACLs can be bound to an interface - Ingress IP ACL and Ingress MAC ACL.

  • Page 366: Access-List Ip

    OMMAND NTERFACE Command Function show ip Displays the rules for configured IP ACLs access-list Adds a port to an IP ACL access-group show ip Shows port assignments for IP ACLs access-group map access-list Sets the CoS value and corresponding output queue for packets matching an ACL rule show map Shows CoS value mapped to an access list for...

  • Page 367: Command Usage

    Command Usage • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To create an ACL, you must add at least one rule to the list.

  • Page 368: Permit, Deny (Extended Acl)

    OMMAND NTERFACE Command Usage • New rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match” and 0 bits to indicate “ignore.” The bitmask is bitwise ANDed with the specified source IP address, and then compared with the address for each IP packet entering the port(s) to which this ACL has been assigned.
  • Page 369 [precedence precedence] [tos tos] [dscp dscp] [source-port sport [end]] [destination-port dport [end]] [control-flag control-flags flag-bitmask] • protocol-number – A specific protocol number. (Range: 0-255) • source – Source IP address. • destination – Destination IP address. • address-bitmask – Decimal number representing the address bits to match.
  • Page 370 OMMAND NTERFACE • The control-code bitmask is a decimal number (representing an equivalent bit mask) that is applied to the control code. Enter a decimal number, where the equivalent binary bit “1” means to match a bit and “0” means to ignore a bit. The following bits may be specified: 1 (fin) –...

  • Page 371: Show Ip Access-List

    Related Commands access-list ip (4-118) show ip access-list This command displays the rules for configured IP ACLs. Syntax show ip access-list {standard | extended} [acl_name] • standard – Specifies a standard IP ACL. • extended – Specifies an extended IP ACL. •...

  • Page 372: Show Ip Access-Group

    • If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. • You must configure a mask for an ACL rule before you can bind it to a port.

  • Page 373: Map Access-List Ip

    map access-list ip This command sets the output queue for packets matching an ACL rule. The specified CoS value is only used to map the matching packet to an output queue; it is not written to the packet itself. Use the no form to remove the CoS mapping.

  • Page 374: Show Map Access-List Ip

    OMMAND NTERFACE show map access-list ip This command shows the CoS value mapped to an IP ACL for the current interface. (The CoS value determines the output queue for packets matching an ACL rule.) Syntax show map access-list ip [interface] interface •...

  • Page 375: Mac Acls

    MAC ACLs Command access-list mac permit, deny show mac access-list mac access-group Adds a port to a MAC ACL show mac access-group map access-list show map access-list mac access-list mac This command adds a MAC access list and enters MAC ACL configuration mode.

  • Page 376: Permit, Deny (Mac Acl)

    OMMAND NTERFACE Command Usage • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To create an ACL, you must add at least one rule to the list.

  • Page 377: Related Commands

    • address-bitmask format). • vid – VLAN ID. (Range: 1-4094) • vid-end – Upper bound of VID range. (Range: 1-4094) • protocol – A specific Ethernet protocol number. (Range: 0-65535) • protocol-end – Upper bound of protocol range. (Range: 0-65535) Default Setting None Command Mode...

  • Page 378: Show Mac Access-List

    OMMAND NTERFACE show mac access-list This command displays the rules for configured MAC ACLs. Syntax show mac access-list [acl_name] acl_name – Name of the ACL. (Maximum length: 16 characters) Command Mode Privileged Exec Example Console#show mac access-list MAC access-list jerry: permit any host 00-e0-29-94-34-de ethertype 800 800 Console# Related Commands...

  • Page 379: Show Mac Access-Group

    • A port can only be bound to one ACL. • If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. Example...

  • Page 380: Show Map Access-List Mac

    OMMAND NTERFACE Default Setting None Command Mode Interface Configuration (Ethernet) Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown below.

  • Page 381: Acl Information

    Command Mode Privileged Exec Example Console#show map access-list mac Access-list to COS of Eth 1/5 Access-list M5 cos 0 Console# Related Commands map access-list mac (4-131) ACL Information Command show access-list show access-group Shows the ACLs assigned to each port show access-list This command shows all ACLs and associated rules, as well as all the user-defined masks.

  • Page 382: Show Access-Group

    OMMAND NTERFACE Example Console#show access-list IP standard access-list david: permit host 10.1.1.21 permit 168.92.0.0 255.255.15.0 IP extended access-list bob: permit 10.7.1.1 255.255.255.0 any permit 192.168.1.0 255.255.255.0 any destination-port 80 80 permit 192.168.1.0 255.255.255.0 any protocol tcp control-code 2 2 MAC access-list jerry: permit any host 00-30-29-94-34-de ethertype 800 800 IP extended access-list A6: deny tcp any any control-flag 2 2...

  • Page 383: Snmp Commands

    SNMP Commands Controls access to this switch from management stations using the Simple Network Management Protocol (SNMP), as well as the error types sent to trap managers. Command snmp-server community snmp-server contact snmp-server location snmp-server host Specifies the recipient of an SNMP...

  • Page 384: Snmp-Server Contact

    OMMAND NTERFACE • rw - Specifies read/write access. Authorized management stations are able to both retrieve and modify MIB objects. Default Setting • public - Read-only access. Authorized management stations are only able to retrieve MIB objects. • private - Read/write access. Authorized management stations are able to both retrieve and modify MIB objects.

  • Page 385: Snmp-Server Location

    Example Console(config)#snmp-server contact Paul Console(config)# Related Commands snmp-server location (4-137) snmp-server location This command sets the system location string. Use the no form to remove the location string. Syntax snmp-server location text no snmp-server location text - String that describes the system location. (Maximum length: 255 characters) Default Setting None...

  • Page 386: Snmp-Server Host

    Command Usage • If you do not enter an snmp-server host command, no notifications are sent. In order to configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. In order to enable multiple hosts, you must issue a separate snmp-server host command for each host.

  • Page 387: Snmp-Server Enable Traps

    For example, some notification types are always enabled. • The switch can send SNMP version 1 or version 2c notifications to a host IP address, depending on the SNMP version that the management station supports. If the snmp-server host command does not specify the SNMP version, the default is to send SNMP version 1 notifications.

  • Page 388: Show Snmp

    OMMAND NTERFACE Command Usage • If you do not enter an snmp-server enable traps command, no notifications controlled by this command are sent. In order to configure this device to send SNMP notifications, you must enter at least one snmp-server enable traps command. If you enter the command with no keywords, both authentication and link-up-down notifications are enabled.
  • Page 389 Example Console#show snmp SNMP traps: Authentication: enabled Link-up-down: enabled SNMP communities: 1. private, and the privilege is read-write 2. public, and the privilege is read-only 0 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name 0 Illegal operation for community name supplied 0 Encoding errors 0 Number of requested variables 0 Number of altered variables...

  • Page 390: Interface Commands

    OMMAND NTERFACE Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN. Command Function interface Configures an interface type and enters interface configuration mode description Adds a description to an interface configuration IC speed-duplex Configures the speed and duplex operation of a given interface when autonegotiation is disabled negotiation...

  • Page 391: Interface

    interface This command configures an interface type and enter interface configuration mode. Use the no form to remove a trunk. Syntax interface interface no interface port-channel channel-id interface • ethernet unit/port - unit - Stack unit. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number.

  • Page 392: Speed-Duplex

    OMMAND NTERFACE Default Setting None Command Mode Interface Configuration (Ethernet, Port Channel) Example The following example adds a description to port 24. Console(config)#interface ethernet 1/24 Console(config-if)#description RD-SW#3 Console(config-if)# speed-duplex This command configures the speed and duplex mode of a given interface when autonegotiation is disabled.

  • Page 393: Negotiation

    Syntax [no] negotiation Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • When auto-negotiation is enabled the switch will negotiate the best settings for a link based on the capabilities command. When NTERFACE OMMANDS 4-145...

  • Page 394: Capabilities

    • symmetric (Gigabit only) - When specified, the port transmits and receives pause frames; when not specified, the port will auto-negotiate to determine the sender and receiver for asymmetric pause frames. (The current switch ASIC only supports symmetric pause frames.) 4-146...

  • Page 395: Flowcontrol

    Command Usage When auto-negotiation is enabled with the negotiation command, the switch will negotiate the best settings for a link based on the capabilites command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands.

  • Page 396: Shutdown

    Command Usage • Flow control can eliminate frame loss by “blocking” traffic from end stations or segments connected directly to the switch when its buffers fill. When enabled, back pressure is used for half-duplex operation and IEEE 802.3x for full-duplex operation.

  • Page 397: Switchport Broadcast Packet-Rate

    Default Setting All interfaces are enabled. Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage This command allows you to disable a port due to abnormal behavior (e.g., excessive collisions), and then reenable it after the problem has been resolved. You may also want to disable a port for security reasons. Example The following example disables port 5.

  • Page 398: Clear Counters

    NTERFACE • This command can enable or disable broadcast storm control for the selected interface. However, the specified threshold value applies to all ports on the switch. Example The following shows how to configure broadcast storm control at 600 packets per second:...

  • Page 399: Show Interfaces Status

    Example The following example clears statistics on port 5. Console#clear counters ethernet 1/5 Console# show interfaces status This command displays the status for an interface. Syntax show interfaces status [interface] interface • ethernet unit/port - unit - Stack unit. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number.

  • Page 400: Show Interfaces Counters

    OMMAND NTERFACE Example Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: Mac address: Configuration: Name: Port admin: Speed-duplex: Capabilities: Broadcast storm: Broadcast storm limit: Flow control: Lacp: Port security: Max MAC count: Port security action: Current status: Link status: Port operation status:...

  • Page 401: Table 4-40 Interface Commands

    Command Mode Normal Exec, Privileged Exec Command Usage If no interface is specified, information on all interfaces is displayed. For a description of the items displayed by this command, see “Showing Port Statistics” on page 3-115. Example Console#show interfaces counters ethernet 1/7 Ethernet 1/7 Iftable stats: Octets input: 30658, Octets output: 196550...

  • Page 402: Show Interfaces Switchport

    OMMAND NTERFACE show interfaces switchport This command displays the administrative and operational status of the specified interfaces. Syntax show interfaces switchport [interface] interface • ethernet unit/port - unit - Stack unit. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number.

  • Page 403: Table 4-41 Interfaces Switchport Statistics

    Table 4-41 Interfaces Switchport Statistics Field Description Broadcast threshold Shows if broadcast storm suppression is enabled or disabled; if enabled it also shows the threshold level (page 4-149). Lacp status Shows if Link Aggregation Control Protocol has been enabled or disabled (page 4-164). Ingress/Egress rate Shows if rate limiting is enabled, and the current rate limit.

  • Page 404: Mirror Port Commands

    OMMAND NTERFACE Mirror Port Commands This section describes how to mirror traffic from a source port to a target port. Command port monitor show port monitor port monitor This command configures a mirror session. Use the no form to clear a mirror session.

  • Page 405: Show Port Monitor

    • You can only create a single mirror session. Example The following example configures the switch to mirror received packets from port 6 to 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 rx...

  • Page 406: Rate Limit Commands

    OMMAND NTERFACE Example The following shows mirroring configured from port 6 to port 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 rx Console(config-if)#end Console#show port monitor Port Mirroring ------------------------------------- Destination port(listen port):Eth1/11 Source port(monitored port) Mode Console# Rate Limit Commands This function allows the network manager to control the maximum rate for traffic transmitted or received on an interface.

  • Page 407: Rate-Limit

    rate-limit Use this command to define the rate limit level for a specific interface. Use this command without specifying a rate to restore the default rate limit level. Use the no form to restore the default status of disabled. Syntax rate-limit {input | output} level [rate] no rate-limit {input | output} •...

  • Page 408: Rate-Limit Granularity

    OMMAND NTERFACE rate-limit granularity Use this command to define the rate limit granularity for the Fast Ethernet ports, and the Gigabit Ethernet ports. Use the no form of this command to restore the default setting. Syntax rate-limit {fastethernet | gigabitethernet} granularity [granularity] no rate-limit {fastethernet | gigabitethernet} granularity •...

  • Page 409: Show Rate-Limit

    For static trunks, the switches have to comply with the Cisco EtherChannel standard. For dynamic trunks, the switches have to comply with LACP. This switch supports up to four trunks. For example, a trunk consisting of two 1000 Mbps ports can support an aggregate bandwidth of 4 Gbps when operating at full duplex.

  • Page 410: Guidelines For Creating Trunks

    OMMAND NTERFACE Table 4-44 Link Aggregation Commands Command Manual Configuration Commands interface port-channel channel-group Dynamic Configuration Command lacp lacp system-priority Configures a port's LACP lacp admin-key lacp admin-key lacp port-priority Trunk Status Display Command show interfaces status port-channel show lacp Guidelines for Creating Trunks General Guidelines –...

  • Page 411: Channel-Group

    • All the ports in a trunk have to be treated as a whole when moved from/to, added or deleted from a VLAN via the specified port-channel. • STP, VLAN, and IGMP settings can only be made for the entire trunk via the specified port-channel.

  • Page 412: Lacp

    • A trunk formed with another switch using LACP will automatically be assigned the next available port-channel ID. • If the target switch has also enabled LACP on the connected ports, the trunk will be activated automatically. • If more than eight ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails.
  • Page 413 Example The following shows LACP enabled on ports 11-13. Because LACP has also been enabled on the ports at the other end of the links, the show interfaces status port-channel 1 command shows that Trunk 1 has been established. Console(config)#interface ethernet 1/11 Console(config-if)#lacp Console(config-if)#exit Console(config)#interface ethernet 1/12...

  • Page 414: Lacp System-Priority

    • Port must be configured with the same system priority to join the same LAG. • System priority is combined with the switch’s MAC address to form the LAG identifier. This identifier is used to indicate a specific LAG during LACP negotiations with other systems.

  • Page 415: Lacp Admin-Key (Ethernet Interface)

    lacp admin-key (Ethernet Interface) This command configures a port's LACP administration key. Use the no form to restore the default setting. Syntax lacp {actor | partner} admin-key key [no] lacp {actor | partner} admin-key • actor - The local side an aggregate link. •...

  • Page 416: Lacp Admin-Key (Port Channel)

    {actor | partner} admin-key key [no] lacp {actor | partner} admin-key key - The port channel admin key is used to identify a specific link aggregation group (LAG) during local LACP setup on this switch. (Range: 0-65535) Default Setting...

  • Page 417: Lacp Port-Priority

    lacp port-priority This command configures LACP port priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} port-priority priority no lacp {actor | partner} port-priority • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. •...

  • Page 418: Show Lacp

    OMMAND NTERFACE show lacp This command displays LACP information. Syntax show lacp [port-channel] {counters | internal | neighbors | sysid} • port-channel - Local identifier for a link aggregation group. (Range: 1-4) • counters - Statistics for LACP protocol messages. •...

  • Page 419: Table 4-44 Link Aggregation Commands

    Example Console#show lacp 1 counters Port channel: 1 ------------------------------------------------------------------- Eth 1/ 1 ------------------------------------------------------------------- LACPDUs Sent : 21 LACPDUs Received : 21 Marker Sent : 0 Marker Received : 0 LACPDUs Unknown Pkts : 0 LACPDUs Illegal Pkts : 0 Table 4-45 show lacp counters - display description Field Description LACPDUs Sent...

  • Page 420: Table 4-46 Show Lacp Internal - Display Description

    OMMAND NTERFACE Console#show lacp 1 internal Port channel : 1 ------------------------------------------------------------------- Oper Key : 4 Admin Key : 0 Eth 1/1 ------------------------------------------------------------------- LACPDUs Internal : 30 sec LACP System Priority : 32768 LACP Port Priority : 32768 Admin Key : 4 Oper Key : 4 Admin State : defaulted, aggregation, long timeout, LACP-activity Oper State : distributing, collecting, synchronization,...
  • Page 421 Table 4-46 show lacp internal - display description (Continued) Field Description Admin State, Administrative or operational values of the actor’s state Oper State parameters: • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner.

  • Page 422: Table 4-47 Show Lacp Neighbors - Display Description

    OMMAND NTERFACE Console#show lacp 1 neighbors Port channel 1 neighbors ------------------------------------------------------------------- Eth 1/1 ------------------------------------------------------------------- Partner Admin System ID : 32768, 00-00-00-00-00-00 Partner Oper System ID : 32768, 00-00-00-00-00-01 Partner Admin Port Number : 1 Partner Oper Port Number : 1 Port Admin Priority : 32768 Port Oper Priority : 32768 Admin Key : 0...

  • Page 423: Address Table Commands

    32768 32768 32768 32768 Description A link aggregation group configured on this switch. LACP system priority for this channel group. System MAC address. Table 4-49 Address Table Commands Function Maps a static address to a port in a VLAN GC...

  • Page 424: Mac-Address-Table Static

    - port-channel channel-id (Range: 1-4) • vlan-id - VLAN ID (Range: 1-4094) • action - - delete-on-reset - Assignment lasts until the switch is reset. - permanent - Assignment is permanent. Default Setting No static addresses are defined. The default mode is permanent.

  • Page 425: Clear Mac-Address-Table Dynamic

    • A static address cannot be learned on another port until the address is removed with the no form of this command. Example Console(config)#mac-address-table static 00-e0-29-94-34-de interface ethernet 1/1 vlan 1 delete-on-reset Console(config)# clear mac-address-table dynamic This command removes any learned entries from the forwarding database and clears the transmit and receive counts for any static or system configured entries.
  • Page 426 OMMAND NTERFACE • vlan-id - VLAN ID (Range: 1-4094) • sort - Sort by address, vlan or interface. Default Setting None Command Mode Privileged Exec Command Usage • The MAC Address Table contains the MAC addresses associated with each interface. Note that the Type field may include the following types: - Learned - Dynamic address entries - Permanent - Static entry...

  • Page 427: Mac-Address-Table Aging-Time

    mac-address-table aging-time This command sets the aging time for entries in the address table. Use the no form to restore the default aging time. Syntax mac-address-table aging-time seconds no mac-address-table aging-time seconds - Aging time. (Range: 10-1000000 seconds; 0 to disable aging) Default Setting 300 seconds Command Mode...

  • Page 428: Spanning Tree Commands

    OMMAND NTERFACE Spanning Tree Commands This section includes commands that configure the Spanning Tree Algorithm (STA) globally for the switch, and commands that configure STA for the selected interface. Command spanning-tree spanning-tree mode Configures STP or RSTP spanning-tree forward-time spanning-tree...

  • Page 429: Spanning-Tree

    The Spanning Tree Algorithm (STA) can be used to detect and disable network loops, and to provide backup links between switches, bridges or routers. This allows the switch to interact with other bridging devices (that is, an STA-compliant switch, bridge or router) in your...

  • Page 430: Spanning-Tree Mode

    RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU after a port’s migration delay timer expires, the switch assumes it is connected to an 802.1D bridge and starts using only 802.1D BPDUs.

  • Page 431: Spanning-Tree Forward-Time

    This command configures the spanning tree bridge forward time globally for this switch. Use the no form to restore the default. Syntax spanning-tree forward-time seconds no spanning-tree forward-time seconds - Time in seconds. (Range: 4 - 30 seconds) The minimum value is the higher of 4 or [(max-age / 2) +1].

  • Page 432: Spanning-Tree Max-Age

    Console(config)#spanning-tree hello-time 5 Console(config)# spanning-tree max-age This command configures the spanning tree bridge maximum age globally for this switch. Use the no form to restore the default. Syntax spanning-tree max-age seconds no spanning-tree max-age seconds - Time in seconds. (Range: 6-40 seconds) The minimum value is the higher of 6 or [2 x (hello-time + 1)].

  • Page 433: Spanning-Tree Priority

    Console(config)#spanning-tree max-age 40 Console(config)# spanning-tree priority This command configures the spanning tree priority globally for this switch. Use the no form to restore the default. Syntax spanning-tree priority priority no spanning-tree priority priority - Priority of the bridge. (Range: 0 - 65535) (Range –...

  • Page 434: Spanning-Tree Pathcost Method

    OMMAND NTERFACE spanning-tree pathcost method This command configures the path cost method used for Rapid Spanning Tree. Use the no form to restore the default. Syntax spanning-tree pathcost method {long | short} no spanning-tree pathcost method • long - Specifies 32-bit based values that range from 0-200,000,000. •...

  • Page 435: Spanning-Tree Spanning-Disabled

    Default Setting Command Mode Global Configuration Command Usage This command limits the maximum transmission rate for BPDUs. Example Console(config)#spanning-tree transmission-limit 4 Console(config)# spanning-tree spanning-disabled This command disables the spanning tree algorithm for the specified interface. Use the no form to reenable the spanning tree algorithm for the specified interface.

  • Page 436: Spanning-Tree Cost

    OMMAND NTERFACE spanning-tree cost This command configures the spanning tree path cost for the specified interface. Use the no form to restore the default. Syntax spanning-tree cost cost no spanning-tree cost cost - The path cost for the port. (Range: 1-200,000,000)) The recommended range is: - Ethernet: 200,000-20,000,000 - Fast Ethernet: 20,000-2,000,000...

  • Page 437: Spanning-Tree Port-Priority

    • This command defines the priority for the use of a port in the Spanning Tree Algorithm. If the path cost for all ports on a switch are the same, the port with the highest priority (that is, lowest value) will be configured as an active link in the spanning tree.

  • Page 438: Spanning-Tree Portfast

    OMMAND NTERFACE Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.

  • Page 439: Spanning-Tree Link-Type

    Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command is used to enable/disable the fast spanning-tree mode for the selected port. In this mode, ports skip the Discarding and Learning states, and proceed straight to Forwarding. • Since end-nodes cannot cause forwarding loops, they can be passed through the spanning tree state changes more quickly than allowed by standard convergence time.

  • Page 440: Spanning-Tree Protocol-Migration

    • When automatic detection is selected, the switch derives the link type from the duplex mode. A full-duplex interface is considered a point-to-point link, while a half-duplex interface is assumed to be on a shared link.

  • Page 441: Show Spanning-Tree

    Command Usage If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the spanning-tree protocol-migration command at any time to manually re-check the appropriate BPDU format to send on the selected interfaces (i.e., RSTP or STP-compatible).
  • Page 442 OMMAND NTERFACE • For a description of the items displayed under “Spanning-tree information,” see “Configuring Global Settings” on page 3-132. For a description of the items displayed for specific interfaces, see “Displaying Interface Settings” on page 3-136. Example Console#show spanning-tree Spanning-tree information --------------------------------------------------------------- Spanning tree mode:...

  • Page 443: Vlan Commands

    VLAN Commands A VLAN is a group of ports that can be located anywhere in the network, but communicate as though they belong to the same physical segment. This section describes commands used to create VLAN groups, add port members, specify how VLAN tagging is used, and enable automatic VLAN registration for the selected interface.

  • Page 444: Vlan

    OMMAND NTERFACE Command Mode Global Configuration Command Usage • Use the VLAN database command mode to add, change, and delete VLANs. After finishing configuration changes, you can display the VLAN settings by entering the show vlan command. • Use the interface vlan command mode to define the port membership mode and add or remove ports from a VLAN.
  • Page 445 • no vlan vlan-id name removes the VLAN name. • no vlan vlan-id state returns the VLAN to the default state (i.e., active). • You can configure up to 255 VLANs on the switch. Example The following example adds a VLAN, using VLAN ID 105 and name RD5.

  • Page 446: Configuring Vlan Interfaces

    OMMAND NTERFACE Configuring VLAN Interfaces Table 4-53 Configuring VLAN Interfaces Command interface vlan switchport mode switchport acceptable-frame-types switchport ingress-filtering switchport native vlan switchport allowed vlan Configures the VLANs associated with switchport gvrp switchport forbidden vlan switchport priority default interface vlan This command enters interface configuration mode for VLANs, which is used to configure VLAN parameters for a physical interface.

  • Page 447: Switchport Mode

    Example The following example shows how to set the interface configuration mode to VLAN 1, and then assign an IP address to the VLAN: Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.254 255.255.255.0 Console(config-if)# Related Commands shutdown (4-148) switchport mode This command configures the VLAN membership mode for a port. Use the no form to restore the default.

  • Page 448: Switchport Acceptable-Frame-Types

    OMMAND NTERFACE Example The following shows how to set the configuration mode to port 1, and then set the switchport mode to hybrid: Console(config)#interface ethernet 1/1 Console(config-if)#switchport mode hybrid Console(config-if)# Related Commands switchport acceptable-frame-types (4-200) switchport acceptable-frame-types This command configures the acceptable frame types for a port. Use the no form to restore the default.

  • Page 449: Switchport Ingress-Filtering

    Related Commands switchport mode (4-199) switchport ingress-filtering This command enables ingress filtering for an interface. Use the no form to restore the default. Syntax [no] switchport ingress-filtering Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Ingress filtering only affects tagged frames. •...

  • Page 450: Switchport Native Vlan

    OMMAND NTERFACE switchport native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no form to restore the default. Syntax switchport native vlan vlan-id no switchport native vlan vlan-id - Default VLAN ID for a port. (Range: 1-4094, no leading zeroes) Default Setting VLAN 1...

  • Page 451: Switchport Allowed Vlan

    VLAN groups as a tagged member. • Frames are always tagged within the switch. The tagged/untagged parameter used when adding a VLAN to an interface tells the switch whether to keep or remove the tag from a frame on egress.

  • Page 452: Switchport Forbidden Vlan

    OMMAND NTERFACE • If a VLAN on the forbidden list for an interface is manually added to that interface, the VLAN is automatically removed from the forbidden list for that interface. Example The following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as tagged VLANs for port 1: Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 1,2,5,6 tagged...

  • Page 453: Displaying Vlan Information

    Example The following example shows how to prevent port 1 from being added to VLAN 3: Console(config)#interface ethernet 1/1 Console(config-if)#switchport forbidden vlan add 3 Console(config-if)# Displaying VLAN Information Command show vlan show interfaces status vlan show interfaces switchport show vlan This command shows VLAN information.

  • Page 454: Command Mode

    Console# Configuring Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN. This switch supports two types of private VLANs: primary/secondary associated groups, and stand-alone isolated VLANs. A primary VLAN contains promiscuous ports that can...

  • Page 455: Table 4-55 Private Vlan Commands

    This section describes commands used to configure private VLANs. Table 4-55 Private VLAN Commands Command Edit Private VLAN Groups private-vlan private-vlan association Associates a community VLAN with a Configure Private VLAN Interfaces switchport mode private-vlan switchport private-vlan host-association switchport private-vlan isolated switchport private-vlan mapping...

  • Page 456: Private-Vlan

    OMMAND NTERFACE Use the switchport private-vlan mapping command to assign a port to a primary VLAN. Use the show vlan private-vlan command to verify your configuration settings. To configure isolated VLANs, follow these steps: Use the private-vlan command to designate an isolated VLAN that will contain a single promiscuous port and one or more isolated ports.
  • Page 457 Default Setting None Command Mode VLAN Configuration Command Usage • Private VLANs are used to restrict traffic to ports within the same community or isolated VLAN, and channel traffic passing outside the community through promiscuous ports. When using community VLANs, they must be mapped to an associated “primary” VLAN that contains promiscuous ports.

  • Page 458: Private Vlan Association

    OMMAND NTERFACE private vlan association Use this command to associate a primary VLAN with a secondary (i.e., community) VLAN. Use the no form to remove all associations for the specified primary VLAN. Syntax private-vlan primary-vlan-id association {secondary-vlan-id | add secondary-vlan-id | remove secondary-vlan-id} no private-vlan primary-vlan-id association •...

  • Page 459: Switchport Mode Private-Vlan

    switchport mode private-vlan Use this command to set the private VLAN mode for an interface. Use the no form to restore the default setting. Syntax switchport mode private-vlan {host | promiscuous} no switchport mode private-vlan • host – This port type can subsequently be assigned to a community or isolated VLAN.

  • Page 460: Switchport Private-Vlan Host-Association

    OMMAND NTERFACE switchport private-vlan host-association Use this command to associate an interface with a secondary VLAN. Use the no form to remove this association. Syntax switchport private-vlan host-association secondary-vlan-id no switchport private-vlan host-association secondary-vlan-id - ID of secondary (i.e, community) VLAN. (Range: 1-4094, no leading zeroes).

  • Page 461: Switchport Private-Vlan Mapping

    Default Setting None Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage Host ports assigned to a isolated VLAN cannot pass traffic between group members, and must communicate with resources outside of the group via a promiscuous port. Example Console(config)#interface ethernet 1/3 Console(config-if)#switchport private-vlan isolated 3 Console(config-if)# switchport private-vlan mapping...

  • Page 462: Show Vlan Private-Vlan

    Console(config-if)#switchport private-vlan mapping 2 Console(config-if)# show vlan private-vlan Use this command to show the private VLAN configuration settings on this switch. Syntax show vlan private-vlan [community | isolated | primary] • community – Displays all community VLANs, along with their associated primary VLAN and assigned host interfaces.

  • Page 463: Gvrp And Bridge Extension Commands

    Configures forbidden VLANs for an show gvrp configuration garp timer show garp timer bridge-ext gvrp This command enables GVRP globally for the switch. Use the no form to disable it. Syntax [no] bridge-ext gvrp Default Setting Disabled...

  • Page 464: Show Bridge-Ext

    GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. This function should be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. Example Console(config)#bridge-ext gvrp...

  • Page 465: Switchport Gvrp

    switchport gvrp This command enables GVRP for a port. Use the no form to disable it. Syntax [no] switchport gvrp Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Example Console(config)#interface ethernet 1/6 Console(config-if)#switchport gvrp Console(config-if)# show gvrp configuration This command shows if GVRP is enabled.

  • Page 466: Garp Timer

    OMMAND NTERFACE Example Console#show gvrp configuration ethernet 1/6 Eth 1/ 6: GVRP configuration: Enabled Console# garp timer This command sets the values for the join, leave and leaveall timers. Use the no form to restore the timers’ default values. Syntax garp timer {join | leave | leaveall} timer_value no garp timer {join | leave | leaveall} •...

  • Page 467: Show Garp Timer

    • Timer values must meet the following restrictions: - leave >= (2 x join) - leaveall > leave Note: Set GVRP timers on all Layer 2 devices connected in the same network to the same values. Otherwise, GVRP may not operate successfully.

  • Page 468: Priority Commands

    Priority Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with four priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.

  • Page 469: Queue Mode

    Table 4-58 Priority Commands (Layer 2) (Continued) Command queue bandwidth queue cos map show queue mode Shows the current queue mode show queue bandwidth show queue cos-map show interfaces switchport queue mode This command sets the queue mode to strict priority or Weighted Round-Robin (WRR) for the class of service (CoS) priority queues.

  • Page 470: Command Usage

    OMMAND NTERFACE Command Usage You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.

  • Page 471: Queue Bandwidth

    If the incoming frame is an IEEE 802.1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used. • This switch provides eight priority queues for each port. It is configured to use Weighted Round Robin, which can be viewed with the show queue bandwidth command.

  • Page 472: Queue Cos-Map

    0 to 7, where 7 is the highest priority. Default Setting This switch supports Class of Service by using four priority queues, with Weighted Round Robin queuing for each port. Eight separate traffic classes are defined in IEEE 802.1p. The default priority levels are assigned according to recommendations in the IEEE 802.1p...

  • Page 473: Show Queue Mode

    Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • CoS values assigned at the ingress port are also used at the egress port. • This command sets the CoS priority for all interfaces. Example The following example shows how to map CoS values 0, 1 and 2 to egress queue 0, value 3 to egress queue 1, values 4 and 5 to egress queue 2, and values 6 and 7 to egress queue 3: Console(config)#interface ethernet 1/1...

  • Page 474: Show Queue Bandwidth

    OMMAND NTERFACE show queue bandwidth This command displays the weighted round-robin (WRR) bandwidth allocation for the four priority queues. Default Setting None Command Mode Privileged Exec Example Console#show queue bandwidth Queue ID Weight -------- ------ Console# show queue cos-map This command shows the class of service priority map. Syntax show queue cos-map [interface] interface...

  • Page 475: Priority Commands (Layer 3 And 4)

    Example Console#show queue cos-map ethernet 1/1 Information of Eth 1/1 CoS Value Priority Queue: 0 0 0 1 2 2 3 3 Console# Priority Commands (Layer 3 and 4) Table 4-60 Priority Commands (Layer 3 and 4) Command map ip port map ip port map ip precedence map ip precedence...

  • Page 476: Map Ip Port (Global Configuration)

    OMMAND NTERFACE map ip port (Global Configuration) This command enables IP port mapping (i.e., class of service mapping for TCP/UDP sockets). Use the no form to disable IP port mapping. Syntax [no] map ip port Default Setting Disabled Command Mode Global Configuration Command Usage The precedence for priority mapping is IP Port, IP Precedence or IP...

  • Page 477: Map Ip Precedence (Global Configuration)

    Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • This command sets the IP port priority for all interfaces. Example The following example shows how to map HTTP traffic to CoS value 0: Console(config)#interface ethernet 1/5 Console(config-if)#map ip port 80 cos 0 Console(config-if)#...

  • Page 478: Map Ip Precedence (Interface Configuration)

    OMMAND NTERFACE map ip precedence (Interface Configuration) This command sets IP precedence priority (i.e., IP Type of Service priority). Use the no form to restore the default table. Syntax map ip precedence ip-precedence-value cos cos-value no map ip precedence • precedence-value - 3-bit precedence value. (Range: 0-7) •...

  • Page 479: Map Ip Dscp (Global Configuration)

    map ip dscp (Global Configuration) This command enables IP DSCP mapping (i.e., Differentiated Services Code Point mapping). Use the no form to disable IP DSCP mapping. Syntax [no] map ip dscp Default Setting Disabled Command Mode Global Configuration Command Usage •...

  • Page 480: Table 4-62 Ip Dscp To Cos Values

    OMMAND NTERFACE Default Setting The DSCP default values are defined in the following table. Note that all the DSCP values that are not specified are mapped to CoS value 0. IP DSCP Value 10, 12, 14, 16 18, 20, 22, 24 26, 28, 30, 32, 34, 36 38, 40, 42 46, 56...

  • Page 481: Show Map Ip Port

    show map ip port Use this command to show the IP port priority map. Syntax show map ip port [interface] interface • ethernet unit/port - unit - Stack unit. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number. (Range: 1-26/50) •...

  • Page 482: Show Map Ip Precedence

    OMMAND NTERFACE show map ip precedence This command shows the IP precedence priority map. Syntax show map ip precedence [interface] interface • ethernet unit/port - unit - Stack unit. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number. (Range: 1-26/50) •...

  • Page 483: Show Map Ip Dscp

    show map ip dscp This command shows the IP DSCP priority map. Syntax show map ip dscp [interface] interface • ethernet unit/port - unit - Stack unit. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number. (Range: 1-26/50) •...

  • Page 484: Multicast Filtering Commands

    OMMAND NTERFACE Multicast Filtering Commands This switch uses IGMP (Internet Group Management Protocol) to query for any attached hosts that want to receive a specific multicast service. It identifies the ports containing hosts requesting a service and sends data out to those ports only. It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service.

  • Page 485: Ip Igmp Snooping

    This command enables IGMP snooping on this switch. Use the no form to disable it. Syntax [no] ip igmp snooping Default Setting Enabled Command Mode Global Configuration Example The following example enables IGMP snooping. Console(config)#ip igmp snooping...

  • Page 486: Ip Igmp Snooping Version

    • All systems on the subnet must support the same version. If there are legacy devices in your network that only support Version 1, you will also have to configure this switch to use Version 1. • Some commands are only enabled for IGMPv2, including ip igmp query-max-response-time and ip igmp query-timeout.

  • Page 487: Show Ip Igmp Snooping

    show ip igmp snooping This command shows the IGMP snooping configuration. Default Setting None Command Mode Privileged Exec Command Usage See “Configuring IGMP Snooping and Query Parameters” on page 3-185 for a description of the displayed items. Example The following shows the current IGMP snooping configuration: Console#show ip igmp snooping Service status: Querier status:...

  • Page 488: Table 4-65 Igmp Query Commands (Layer 2)

    OMMAND NTERFACE Command Mode Privileged Exec Command Usage Member types displayed include IGMP or USER, depending on selected options. Example The following shows the multicast entries learned through IGMP snooping for VLAN 1: Console#show mac-address-table multicast vlan 1 igmp-snooping VLAN M'cast IP addr. Member ports Type ---- --------------- ------------ ------- 224.1.2.3 Console#...

  • Page 489: Ip Igmp Snooping Querier

    This command enables the switch as an IGMP querier. Use the no form to disable it. Syntax [no] ip igmp snooping querier Default Setting Enabled Command Mode Global Configuration Command Usage If enabled, the switch will serve as querier if elected. The querier is responsible for asking hosts if they want to receive multicast traffic.

  • Page 490: Ip Igmp Snooping Query-Interval

    This command configures the query interval. Use the no form to restore the default. Syntax ip igmp snooping query-interval seconds no ip igmp snooping query-interval seconds - The frequency at which the switch sends IGMP host-query messages. (Range: 60-125) Default Setting 125 seconds Command Mode...

  • Page 491: Ip Igmp Snooping Query-Max-Response-Time

    Global Configuration Command Usage • The switch must be using IGMPv2 for this command to take effect. • This command defines the time after a query, during which a response is expected from a multicast client. If a querier has sent a number of...

  • Page 492: Ip Igmp Snooping Router-Port-Expire-Time

    - The time the switch waits after the previous querier stops before it considers the router port (i.e., the interface which had been receiving query packets) to have expired.

  • Page 493: Static Multicast Routing Commands

    Depending on your network connections, IGMP snooping may not always be able to locate the IGMP querier. Therefore, if the IGMP querier is a known multicast router/switch connected over the network to an interface (port or trunk) on your router, you can manually configure that interface to join all the current multicast groups.

  • Page 494: Show Ip Igmp Snooping Mrouter

    OMMAND NTERFACE Example The following shows how to configure port 11 as a multicast router port within VLAN 1: Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11 Console(config)# show ip igmp snooping mrouter This command displays information on statically configured and dynamically learned multicast router ports.

  • Page 495: Ip Interface Commands

    IP Interface Commands An IP addresses may be used for management access to the switch over your network. The IP address for this switch is obtained via DHCP by default. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server when it is powered on.
  • Page 496 VLAN 1). This defines the management VLAN, the only VLAN through which you can gain management access to the switch. If you assign an IP address to any other VLAN, the new IP address overrides the original IP address and this becomes the new management VLAN.

  • Page 497: Ip Default-Gateway

    This command establishes a static route between this switch and devices that exist on another network segment. Use the no form to remove the static route. Syntax ip default-gateway gateway no ip default-gateway gateway - IP address of the default gateway Default Setting No static route is established.

  • Page 498: Command Usage

    OMMAND NTERFACE Command Usage • This command issues a BOOTP or DHCP client request for any IP interface that has been set to BOOTP or DHCP mode via the ip address command. • DHCP requires the server to reassign the client’s last address if available.

  • Page 499: Show Ip Redirects

    • size - Number of bytes in a packet. (Range: 32-512, default: 32) The actual packet size will be eight bytes larger than the size specified because the switch adds header information. • count - Number of packets to send. (Range: 1-16, default: 5) Default Setting This command has no default for the host.
  • Page 500 OMMAND NTERFACE Command Usage • Use the ping command to see if another site on the network can be reached. • Following are some results of the ping command: - Normal response - The normal response occurs in one to ten seconds, depending on network traffic.

  • Page 501: Software Specifications

    PPENDIX OFTWARE PECIFICATIONS Software Features Authentication Local, RADIUS, TACACS, Port (802.1X), HTTPS, SSH, Port Security Access Control Lists IP, MAC (up to 88 lists) DHCP Client Port Configuration 100BASE-TX: 10/100 Mbps, half/full duplex 1000BASE-T: 10/100 Mbps at half/full duplex, 1000 Mbps at full duplex Flow Control Full Duplex: IEEE 802.3-2002 Half Duplex: Back pressure...

  • Page 502: Management Features

    OFTWARE PECIFICATIONS Spanning Tree Algorithm Spanning Tree Protocol (STP, IEEE 802.1D) Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) VLAN Support Up to 255 groups; port-based or tagged (802.1Q), GVRP for automatic VLAN learning, private VLANs Class of Service Supports four levels of priority and Weighted Round Robin Queueing (which can be configured by VLAN tag or port), Layer 3/4 priority mapping: IP Port, IP Precedence, IP DSCP Multicast Filtering...

  • Page 503: Standards

    RMON Groups 1, 2, 3, 9 (Statistics, History, Alarm, Event) Standards IEEE 802.1D Spanning Tree Protocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1w Rapid Spanning Tree Protocol IEEE 802.1X Port Authentication IEEE 802.3-2002 Ethernet, Fast Ethernet, Gigabit Ethernet Full-duplex flow control Link Aggregation Control Protocol IEEE 802.3ac VLAN tagging...

  • Page 504: Management Information Bases

    OFTWARE PECIFICATIONS Management Information Bases Bridge MIB (RFC 1493) Entity MIB (RFC 2737) Ether-like MIB (RFC 2665) Extended Bridge MIB (RFC 2674) Extensible SNMP Agents MIB (RFC 2742) Forwarding Table MIB (RFC 2096) IGMP MIB (RFC 2933) Interface Group MIB (RFC 2233) Interfaces Evolution MIB (RFC 2863) IP Multicasting related MIBs MAU MIB (RFC 2668)

  • Page 505: Troubleshooting

    IP interface to which it is connected. • If you are trying to connect to the switch via the IP address for a tagged VLAN group, your management station, and the ports connecting intermediate switches in the network, must be configured with the appropriate tag.
  • Page 506 • Be sure you have generated a public key on the switch, and exported this key to the SSH client. • Be sure you have set up an account on the switch for each SSH user, including user name, authentication level, and password.

  • Page 507: Using System Logs

    Using System Logs If a fault does occur, refer to the Installation Guide to ensure that the problem you encountered is actually caused by the switch. If the problem appears to be caused by the switch, follow these steps: 1. Enable logging.
  • Page 508 ROUBLESHOOTING...

  • Page 509: Glossary

    Access Control List (ACL) ACLs can limit network traffic and restrict access to certain users or devices by checking each packet for certain IP or MAC (i.e., Layer 2) information. Boot Protocol (BOOTP) used to provide bootup information for network devices, BOOTP is including IP address information, the address of the TFTP server that contains the devices system files, and the name of the boot file.
  • Page 510 EAPOL is a client authentication protocol used by this switch to verify the network access rights for any device that is plugged into the switch. A user name and password is requested by the switch, and then passed to an authentication server (e.g., RADIUS) for verification.
  • Page 511 IEEE 802.1X Port Authentication controls access to the switch ports by requiring users to first enter a user ID and password for authentication. IEEE 802.3ac Defines frame extensions for VLAN tagging.

  • Page 512: Ip Multicast Filtering

    Internet Group Management Protocol (IGMP) A protocol through which hosts can register with their local router for multicast services. If there is more than one multicast switch/router on a given subnetwork, one of the devices is made the “querier” and assumes responsibility for keeping track of group membership.

  • Page 513: Multicast Switching

    Multicast Switching A process whereby the switch filters incoming multicast frames for services for which no attached host has registered, or forwards them to all ports contained within the designated multicast VLAN group.

  • Page 514: Port Mirroring

    10% of that required by the older IEEE 802.1D STP standard. Secure Shell (SSH) A secure replacement for remote access functions, including Telnet. SSH can authenticate users with a cryptographic key, and encrypt data connections between management clients and the switch. Glossary-6...
  • Page 515 Simple Network Management Protocol (SNMP) The application protocol in the Internet suite of protocols which offers network management services. Simple Network Time Protocol (SNTP) allows a device to set its internal clock based on periodic updates SNTP from a Network Time Protocol (NTP) server. Updates can be requested from a specific NTP server, or can be received via broadcasts sent by NTP servers.

  • Page 516: Virtual Lan (Vlan)

    LOSSARY User Datagram Protocol (UDP) provides a datagram mode for packet-switched communications. It uses IP as the underlying transport mechanism to provide access to IP-like services. UDP packets are delivered just like IP packets – connection-less datagrams that may be discarded before reaching their targets. UDP is useful when TCP would be too complex, too slow, or just unnecessary.

  • Page 517: Index

    Numerics 802.1X, port authentication 3-66 acceptable frame type 3-157 Access Control List See ACL Extended IP 3-78 4-116 4-120 MAC 3-79 4-116 4-127 – 4-127 4-130 Standard IP 3-78 4-116 address table 3-122 4-175 aging time 3-126 4-179 BOOTP 3-19 4-247 BPDU 3-127 broadcast storm, threshold 3-109...
  • Page 518 NDEX GVRP global setting 4-215 interface configuration 3-158 GVRP, global setting 3-148 hardware version, displaying 3-13 HTTPS 3-54 4-42 HTTPS, secure server 3-54 IEEE 802.1D 3-127 4-182 IEEE 802.1w 3-127 4-182 IEEE 802.1X 3-66 4-106 IGMP groups, displaying 3-190 Layer 2 3-185 4-236 query 3-185 4-241...
  • Page 519 port priority configuring 3-169 4-220 default ingress 3-169 4-222 STA 3-138 4-189 port security, configuring 3-64 port, statistics 3-115 4-152 ports autonegotiation 3-92 4-145 broadcast storm threshold 3-109 4-149 capabilities 3-92 4-146 duplex mode 3-91 4-144 flow control 3-91 4-147 speed 3-91 4-144 ports, configuring 3-88...
  • Page 520 NDEX setting 3-22 4-92 static addresses, setting 3-122 statistics port 3-115 4-152 STP 3-132 4-182 STP Also see STA system clock, setting 3-42 System Logs 3-33 system software, downloading from server 3-22 4-86 TACACS+, logon authentication 3-50 4-101 time, setting 3-42 4-71 traffic class weights 3-174 trap manager 2-13...
  • Page 522 FOR TECHNICAL SUPPORT, CALL: From U.S.A. and Canada (24 hours a day, 7 days a week) (800) SMC-4-YOU; Phn: (949) 679-8000; Fax: (949) 679-1481 From Europe: Contact details can be found on www.smc-europe.com or www.smc.com INTERNET E-mail addresses: techsupport@smc.com european.techsupport@smc-europe.com Driver updates: http://www.smc.com/index.cfm?action=tech_support_drivers_downloads World Wide Web:...

This manual is also suitable for:

Smc6248m6248m int - annexe 1

Table of Contents