SMC Networks SMC8624/48T Management Manual

Tigerswitch 10/100/1000 gigabit ethernet switch

Table of Contents

Quick Links

Download this manual

TigerSwitch 10/100/1000

Gigabit Ethernet Switch

◆ 24/48 auto-MDI/MDI-X 10/100/1000BASE-T ports

◆ 4 ports shared with 4 SFP transceiver slots

◆ Non-blocking switching architecture

◆ Support for a redundant power unit

◆ Spanning Tree Protocol, Rapid STP, and Multiple STP

◆ Up to six LACP or static 8-port trunks

◆ Layer 2/3/4 CoS support through 8 priority queues

◆ Layer 3/4 traffic priority with IP Precedence and IP DSCP

◆ Full support for VLANs with GVRP

◆ IGMP multicast filtering and snooping

◆ Support for jumbo frames up to 9 KB

◆ Manageable via console, Web, and SNMP/RMON

Management Guide

SMC8624/48T

Table of Contents

Need help?

Do you have a question about the SMC8624/48T and is the answer not in the manual?

Questions and answers

Summary of Contents for SMC Networks SMC8624/48T

Page 1: Management Guide
◆ Layer 3/4 traffic priority with IP Precedence and IP DSCP ◆ Full support for VLANs with GVRP ◆ IGMP multicast filtering and snooping ◆ Support for jumbo frames up to 9 KB ◆ Manageable via console, Web, and SNMP/RMON Management Guide SMC8624/48T...
Page 3 TigerSwitch 10/100/1000 Management Guide From SMC’s Tiger line of feature-rich workgroup LAN solutions 38 Tesla Irvine, CA 92618 Phone: (949) 679-8000 April 2004 Pub. # 150200041000A...
Page 4 Information furnished by SMC Networks, Inc. (SMC) is believed to be accurate and reliable. However, no responsibility is assumed by SMC for its use, nor for any infringements of patents or other rights of third parties which may result from its use. No license is granted by implication or oth- erwise under any patent or patent rights of SMC.
Page 5: Limited Warranty
IMITED ARRANTY Limited Warranty Statement: SMC Networks, Inc. (“SMC”) warrants its products to be free from defects in workmanship and materials, under normal use and service, for the applicable warranty term. All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized Reseller.
Page 6 * SMC will provide warranty service for one year following discontinuance from the active SMC price list. Under the limited lifetime warranty, internal and external power supplies, fans, and cables are covered by a standard one-year warranty from date of purchase. SMC Networks, Inc. 38 Tesla Irvine, CA 92618...
Page 7: Table Of Contents
Connecting to the Switch ........
Page 8 ONTENTS Setting the Switch’s IP Address ......3-17 Manual Configuration ......3-19 Using DHCP/BOOTP .
Page 9 Filtering Management Access ....... . 3-78 Port Configuration ......... 3-80 Displaying Connection Status .
Page 10 ONTENTS Adding Static Members to VLANs (Port Index) ..3-153 Configuring VLAN Behavior for Interfaces ....3-154 Configuring Private VLANs ......3-158 Enabling Private VLANs .
Page 11 Entering Commands ........4-4 Keywords and Arguments .
Page 12 ONTENTS System Management Commands ......4-32 Device Designation Commands ......4-33 prompt .
Page 13 SMTP Alert Commands ....... 4-65 logging sendmail host ......4-66 logging sendmail level .
Page 14 ONTENTS radius-server retransmit ......4-97 radius-server timeout ......4-98 show radius-server .
Page 15 MAC ACLs ........4-135 access-list mac .
Page 16 ONTENTS Interface Commands ........4-167 interface .
Page 17 Spanning Tree Commands ........4-205 spanning-tree ........4-206 spanning-tree mode .
Page 18 ONTENTS Displaying VLAN Information ......4-242 show vlan ........4-242 Configuring Protocol-based VLANs .
Page 19 Multicast Filtering Commands ....... 4-272 IGMP Snooping Commands ......4-272 ip igmp snooping .
Page 20 ABLES Table 1-1. Key Features ........1-1 Table 1-2.
Page 21 ABLES Table 4-22. RADIUS Client Commands ......4-95 Table 4-23. TACACS+ Client Commands ..... . 4-99 Table 4-24.
Page 22 System Information ......3-13 Figure 3-4. Switch Information ......3-15 Figure 3-5.
Page 23 IGURES Figure 3-37. Configuring Port Attributes ..... . 3-86 Figure 3-38. Static Trunk Configuration ..... . . 3-88 Figure 3-39.
Page 24 Figure 3-80. Configuring Internet Group Management Protocol . . 3-184 Figure 3-81. Mapping Multicast Switch Ports to VLANs ..3-185 Figure 3-82. Static Multicast Router Port Configuration ..3-186 Figure 3-83.
Page 25: Introduction
This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch. However, there are many options that you should configure to maximize the switch’s performance for your particular...
Page 26: Description Of Software Features
Multicast Filtering Supports IGMP snooping and query Description of Software Features The switch provides a wide range of advanced performance enhancing features. Flow control eliminates the loss of packets due to bottlenecks caused by port saturation. Broadcast storm suppression prevents broadcast traffic storms from engulfing the network.
Page 27 Use the full-duplex mode on ports whenever possible to double the throughput of switch connections. Flow control should also be enabled to control network traffic during periods of congestion and prevent the loss of packets when port buffer thresholds are exceeded.
Page 28 Static Addresses – A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.
Page 29 ESCRIPTION OF OFTWARE EATURES To avoid dropping frames on congested ports, the switch provides 1 MB for frame buffering. This buffer can queue packets awaiting transmission on congested networks. Spanning Tree Protocol – The switch supports these spanning tree protocols: Spanning Tree Protocol (STP, IEEE 802.1D) –...
Page 30 NTRODUCTION Virtual LANs – The switch supports up to 255 VLANs. A Virtual LAN is a collection of network nodes that share the same collision domain regardless of their physical location or connection point in the network. The switch supports tagged VLANs based on the IEEE 802.1Q standard.
Page 31: System Defaults
System Defaults The switch’s system defaults are provided in the configuration file “Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as the startup configuration file (page 3-25). The following table lists some of the basic system defaults.
Page 32 NTRODUCTION Function Port Configuration Rate Limiting Port Trunking Broadcast Storm Protection Spanning Tree Protocol Address Table Table 1-2. System Defaults Parameter Admin Status Auto-negotiation Flow Control Port Capability Input and output limits Static Trunks LACP (all ports) Status Broadcast Limit Rate Status Fast Forwarding (Edge Port) Disabled Aging Time...
Page 33: Table 1-2. System Defaults
Table 1-2. System Defaults Function Parameter Virtual LANs Default VLAN PVID Acceptable Frame Type Ingress Filtering Switchport Mode (Egress Mode) GVRP (global) GVRP (port interface) Traffic Ingress Port Priority Prioritization Weighted Round Robin IP Precedence Priority IP DSCP Priority IP Settings IP Address Subnet Mask Default Gateway...
Page 34 NTRODUCTION 1-10...
Page 35: Initial Configuration
Web-based interface. A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI). Note: The IP address for this switch is unassigned by default. To change this address, see “Setting an IP Address” on page 2-6.
Page 36: Required Connections
• Display system information and statistics Required Connections The switch provides an RS-232 serial port that enables a connection to a PC or terminal for monitoring and configuring the switch. A null-modem console cable is provided with the switch. Attach a VT100-compatible terminal, or a PC running a terminal emulation program to the switch.
Page 37 DB-9 connector. 2. Connect the other end of the cable to the RS-232 serial port on the switch. 3. Make sure the terminal emulation software is set as follows: •...
Page 38: Remote Connections
The onboard configuration program can be accessed using Telnet from any computer attached to the network. The switch can also be managed by any computer using a web browser (Internet Explorer 5.0 or above, or Netscape Navigator 6.2 or above), or from a network computer using...
Page 39: Setting Passwords
Access to both CLI levels are controlled by user names and passwords. The switch has a default user name and password for each level. To log into the CLI at the Privileged Exec level using the default user name and password, perform these steps: 1.
Page 40: Setting An Ip Address
DHCP address allocation servers on the network. Manual Configuration You can manually assign an IP address to the switch. You may also need to specify a default gateway that resides between this device and management stations on another network segment. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods.
Page 41: Dynamic Configuration
Before you can assign an IP address to the switch, you must obtain the following information from your network administrator: • IP address for the switch • Default gateway for the network • Network mask for this network To assign an IP address to the switch, complete the following steps: 1.
Page 42 ONFIGURATION If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the switch will start broadcasting service requests as soon as it is powered on. To automatically configure the switch by communicating with BOOTP or...
Page 43: Enabling Snmp Management Access
When SNMP management stations send requests to the switch (either to return information or to set a parameter), the switch provides the requested data or sets the specified parameter. The switch can also be configured to send information to SNMP managers (without being requested by the managers) through trap messages, which inform the manager that certain events have occurred.
Page 44 If there are no community strings, then SNMP management access to the switch is disabled. To prevent unauthorized access to the switch via SNMP, it is recommended that you change the default community strings. To configure a community string, complete the following steps: 1.
Page 45: Trap Receivers
“community-string” is the string associated with that host. Press <Enter>. 2. In order to configure the switch to send SNMP notifications, you must enter at least one snmp-server enable traps command. Type “snmp-server enable traps type,” where “type” is either authentication or link-up-down.
Page 46: Managing System Files
Diagnostic Code — Software that is run during system boot-up, also known as POST (Power On Self-Test). Due to the size limit of the flash memory, the switch supports only two operation code files. However, you can have as many diagnostic code files and configuration files as available flash memory space allows.
Page 47 ANAGING YSTEM ILES Note that configuration files should be downloaded using a file name that reflects the contents or usage of the file settings. If you download directly to the running-config, the system will reboot, and the settings will have to be copied from the running-config to a permanent file.
Page 48 NITIAL ONFIGURATION 2-14...
Page 49: Configuring The Switch
Telnet. For more information on using the CLI, refer to Chapter 4 “Command Line Interface.” Prior to accessing the switch from a Web browser, be sure you have first performed the following tasks: 1. Configure the switch with a valid IP address, subnet mask, and default gateway using an out-of-band serial connection, BOOTP or DHCP protocol.
Page 50 If you log in as “admin” (Privileged Exec level), you can change the settings on any page. 3. If the path between your management station and this switch does not pass through any device that uses the Spanning Tree Algorithm, then you can set the switch port attached to your management station to fast forwarding (i.e., enable Admin...
Page 51: Navigating The Web Browser Interface
“admin.” Home Page When your web browser connects with the switch’s web agent, the home page is displayed as shown below. The home page displays the Main Menu on the left side of the screen and System Information on the right side.
Page 52: Configuration Options
Panel Display The web agent displays an image of the switch’s ports. The Mode can be set to display different information for the ports, including Active (i.e., up or down), Duplex (i.e., half or full duplex, or Flow Control (i.e., with or without flow control).
Page 53: Main Menu
Main Menu Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program. Menu System System Information...
Page 54 ONFIGURING THE WITCH Menu Settings Host-Key Settings Port Security 802.1x Information Configuration Port Configuration Statistics Configuration Mask Configuration Port Binding IP Filter Port Port Information Trunk Information Port Configuration Trunk Configuration Trunk Membership Table 3-2. Main Menu Description Configures Secure Shell server settings Generates the host key pair (public and private) Configures per port security, including...
Page 55 Menu LACP Configuration Aggregation Port Port Counters Information Port Internal Information Port Neighbors Information Port Broadcast Control Trunk Broadcast Control Mirror Port Configuration Rate Limit Input Port Configuration Input Trunk Configuration Output Port Configuration Output Trunk Configuration Port Statistics Address Table Static Addresses Dynamic Addresses AVIGATING THE...
Page 56 ONFIGURING THE WITCH Menu Address Aging Spanning Tree Information Configuration Port Information Trunk Information Port Configuration Trunk Configuration MSTP VLAN Configuration Configures priority and VLANs for a Port Information Trunk Information Port Configuration Trunk Configuration Table 3-2. Main Menu Description Sets timeout for dynamically learned entries Displays STA values used for the bridge Configures global bridge settings for STA,...
Page 57 Description Enables GVRP VLAN registration protocol Displays information on the VLAN type supported by this switch Shows the current port members of each VLAN and whether or not the port is tagged or untagged Used to create or remove VLAN groups...
Page 58 ONFIGURING THE WITCH Menu Traffic Classes Status Queue Mode Queue Scheduling IP Precedence/ DSCP Priority Status IP Precedence Priority IP DSCP Priority IP Port Priority Status IP Port Priority ACL CoS Priority ACL Marker IGMP Snooping IGMP Configuration Multicast Router Port Information Static Multicast Router Port Configuration...
Page 59 Cache AVIGATING THE Table 3-2. Main Menu Description Displays all multicast groups active on this switch, including multicast IP addresses and VLAN ID Indicates multicast addresses associated with the selected VLAN Enables DNS; configures domain name and domain list; and specifies IP address of...
Page 60: Basic Configuration
Field Attributes • System Name – Name assigned to the switch system. • Object ID – MIB II object ID for switch’s network management subsystem. • Location – Specifies the system location. • Contact – Administrator responsible for the system.
Page 61: Figure 3-3. System Information
CLI – Specify the hostname, location and contact information. Console(config)#hostname R&D 5 Console(config)#snmp-server location WC 9 Console(config)#snmp-server contact Geoff Console(config)#exit Console#show system System description: SMC Networks SMC8624T System information System Up time: 0 days, 2 hours, 3 minutes, and 47.49 seconds System Name System Location System Contact...
Page 62: Displaying Switch Hardware/Software Versions
Loader Version – Version number of loader code. • Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code. • Operation Code Version – Version number of runtime code. • Role – Shows that this switch is operating as Master (i.e., operating stand-alone). 3-14...
Page 63: Figure 3-4. Switch Information
Web – Click System, Switch Information. Figure 3-4. Switch Information CLI – Use the following command to display version information. Console#show version Unit1 Serial number Hardware version Number of ports Main power status Redundant power status :not present Agent(master) Unit id...
Page 64: Displaying Bridge Extension Capabilities
Extended Multicast Filtering Services – This switch does not support the filtering of individual multicast addresses based on GMRP (GARP Multicast Registration Protocol). • Traffic Classes – This switch provides mapping of user priorities to multiple traffic classes. (Refer to “Class of Service Configuration” on page 3-163.) •...
Page 65: Setting The Switch's Ip Address
Setting the Switch’s IP Address This section describes how to configure an IP interface for management access over the network. The IP address for this switch is unassigned by default. To manually configure an address, you need to change the switch’s default settings (IP address 0.0.0.0 and netmask 255.0.0.0) to values that...
Page 66 • Management VLAN – ID of the configured VLAN (1-4094, no leading zeroes). By default, all ports on the switch are members of VLAN 1. However, the management station can be attached to a port belonging to any VLAN, as long as that VLAN has been assigned an IP address.
Page 67: Manual Configuration
Manual Configuration Web – Click System, IP Configuration. Select the VLAN through which the management station is attached, set the IP Address Mode to “Static,” enter the IP address, subnet mask and gateway, then click Apply. Figure 3-6. Manual IP Configuration CLI –...
Page 68: Using Dhcp/Bootp
IP Address Mode to DHCP or BOOTP. Click Apply to save your changes. Then click Restart DHCP to immediately request a new address. Note that the switch will also broadcast a request for IP configuration settings on each power reset.
Page 69 Console# Renewing DCHP – DHCP may lease addresses to clients indefinitely or for a specific period of time. If the address expires or the switch is moved to another network segment, you will lose management access to the switch. In this case, you can reboot the switch or submit a client request to restart DHCP service via the CLI.
Page 70: Managing Firmware
You can upload/download firmware to or from a TFTP server. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation. You can also set the switch to use new firmware without overwriting the previous version.
Page 71: Figure 3-8. Operation Code Image File Transfer
Transfer from Server. To start the new firmware, reboot the system via the System/Reset menu.
Page 72: Saving Or Restoring Configuration Settings
CLI – Enter the IP address of the TFTP server, select “config” or “opcode” file type, then enter the source and destination file names, set the new file to start up the system, and then restart the switch. Console#copy tftp file TFTP server ip address: 10.1.0.19...
Page 73: Downloading Configuration Settings From A Server
To use the new settings, reboot the system via the System/Reset menu. Figure 3-11. Selecting the Startup Configuration File CLI – Enter the IP address of the TFTP server, specify the source file on the server, set the startup file name on the switch, and then restart the switch 3-25...
Page 74: Resetting The System
-Write to FLASH finish. Success. Console#reload If you download the startup configuration file under a new file name, you can set this file as the startup file at a later time, and then restart the switch. Console#config Console(config)#boot system config: startup-new Console(config)#exit...
Page 75: Setting The System Clock
You can also manually set the clock using the CLI. (See “calendar set” on page 4-76.) If the clock is not set, the switch will only record the time from the factory default set at the last bootup.
Page 76: Figure 3-13. Sntp Configuration
ONFIGURING THE WITCH Command Attributes • SNTP Client – Configures the switch to operate as an SNTP unicast client. This mode requires at least one time server to be specified in the SNTP Server field. • SNTP Broadcast Client – Configures the switch to operate as an SNTP broadcast client.
Page 77: Setting The Time Zone
Setting the Time Zone SNTP uses Coordinated Universal Time (or UTC, formerly Greenwich Mean Time, or GMT) based on the time at the Earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC.
Page 78: Simple Network Management Protocol
SMC EliteView or HP OpenView. Access rights to the onboard agent are controlled by community strings. To communicate with the switch, the management station must first submit a valid community string for authentication. The options for configuring community strings, trap functions, and restricting access to clients with specified IP addresses are described in the following sections.
Page 79: Specifying Trap Managers And Trap Types
Console(config)# Specifying Trap Managers and Trap Types Traps indicating status changes are issued by the switch to specified trap managers. You must specify trap managers so that key events are reported by this switch to your management station (using network management platforms such as SMC EliteView or HP OpenView).
Page 80: Figure 3-16. Specifying Trap Managers And Trap Types
ONFIGURING THE WITCH Command Attributes • Trap Manager Capability – This switch supports up to five trap managers. • Trap Manager IP Address – Internet address of the host (the targeted recipient). • Trap Manager Community String – Community string sent with the notification operation.
Page 81: User Authentication
User Authentication You can restrict management access to this switch using the following options: • Passwords – Manually configure access rights on the switch for specified users. • Authentication Settings – Use remote authentication to configure access rights. • HTTPS Settings – Provide a secure web connection.
Page 82: Configuring Local/Remote Logon Authentication
Use the Authentication Settings menu to restrict management access based on specified user names and passwords. You can manually configure access rights on the switch, or you can use a remote access authentication server based on RADIUS or TACACS+ protocols.
Page 83: Command Usage
Command Usage • By default, management access is always checked against the authentication database stored on the local switch. If a remote authentication server is used, you must specify the authentication sequence and the corresponding parameters for the remote authentication protocol. Local and remote logon authentication control management access via the console port, web browser, or Telnet.
Page 84 (Range: 1-30; Default: 2) - Timeout for a reply – The number of seconds the switch waits for a reply from the RADIUS server before it resends the request. (Range: 1-65535; Default: 5)
Page 85: Figure 3-18. Setting Local, Radius And Tacacs Authentication
Do not use blank spaces in the string. (Maximum length: 20 characters) Note: The local switch user database has to be set up by manually entering user names and passwords using the CLI. (See “username” on page 4-35.) Web –...
Page 86: Configuring Https
Server port number: 200 Console(config)# Configuring HTTPS You can configure the switch to enable the Secure Hypertext Transfer Protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Command Usage •...
Page 87: Table 3-3. Https Support
(Default: Enabled) • Change HTTPS Port Number – Specifies the UDP port number used for HTTPS/SSL connection to the switch’s web interface. (Default: Port 443) Web – Click Security, HTTPS Settings. Enable HTTPS and specify the port number, then click Apply.
Page 88: Replacing The Default Secure-Site Certificate
Source certificate file name: <certificate file name> Source private file name: <private key file name> Private password: <password for private key> Note: The switch must be reset for the new certificate to be activated. To reset the switch, type: 3-40...
Page 89: Configuring The Secure Shell
Berkley remote access tools. SSH can also provide remote management access to this switch as a secure replacement for Telnet. When the client contacts the switch via the SSH protocol, the switch generates a public-key that the client uses along with a local user name and password for access authentication.
Page 90 51941746772984865468615717739390164779355942303577413098022737087794545240839 71752646358058176716709574804776117 3. Import Client’s Public Key to the Switch – Use the copy tftp public-key command (page 4-86) to copy a file containing the public key for all the SSH client’s granted management access to the switch. (Note that these...
Page 91: Generating The Host Key Pair
The switch compares the client's public key to those stored in memory. c. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. d. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch.
Page 92: Field Attributes
(Range: RSA, DSA, Both: Default: RSA) The SSH server uses RSA or DSA for key exchange when the client first establishes a connection with the switch, and then negotiates with the client to select either DES (56-bit) or 3DES (168-bit) for data encryption.
Page 93: Figure 3-20. Ssh Host-Key Settings
UTHENTICATION Web – Click Security, SSH, Host-Key Settings. Select the host-key type from the drop-down box, select the option to save the host key from memory to flash (if required) prior to generating the key, and then click Generate. Figure 3-20. SSH Host-Key Settings 3-45...
Page 94: Configuring The Ssh Server
(Default: Enabled) • Version – The Secure Shell version number. Version 2.0 is displayed, but the switch supports management access via either SSH Version 1.5 or 2.0 clients. • SSH Authentication Timeout – Specifies the time interval in seconds that the SSH server waits for a response from a client during an authentication attempt.
Page 95: Figure 3-21. Ssh Server Settings
SSH Server-Key Size – Specifies the SSH server key size. (Range: 512-896 bits) - The server key is a private key that is never shared outside the switch. - The host key is shared with the SSH client, and is fixed at 1024 bits.
Page 96: Configuring Port Security
Console#disconnect 0 Console# Configuring Port Security Port security is a feature that allows you to configure a switch port with one or more device MAC addresses that are authorized to access the network through that port. When port security is enabled on a port, the switch stops learning new MAC addresses on the specified port.
Page 97 To add new VLAN members at a later time, you can manually add secure addresses with the Static Address Table (page 3-112), or turn off port security to reenable the learning function long enough for new VLAN members to be registered. Learning may then be disabled again, if desired, for security.
Page 98: Figure 3-22. Configuring Port Security
Apply. CLI – This example sets the command mode to Port 5, sets the port security action to send a trap and disable the port, and then enables port security for the switch. Console(config)#interface ethernet 1/5 Console(config-if)#port security action trap-and-shutdown...
Page 99: Configuring 802.1X Port Authentication
Access to all switch ports in a network can be centrally controlled from a server, which means that authorized users can use the same credentials for authentication from any point within the network.
Page 100: Displaying 802.1X Global Settings
RADIUS authentication must be enabled on the switch and the IP address of the RADIUS server specified. • Each switch port that will be used must be set to dot1x “Auto” mode. • Each client that needs to be authenticated must have dot1x client software installed and properly configured.
Page 101: Figure 3-23. 802.1X Information
Supplicant timeout – The time the switch waits for a client response to an EAP request. • Server timeout – The time the switch waits for a response from the authentication server (RADIUS) to an authentication request. • Re-authentication Max Count – The number of times the switch will attempt to re-authenticate a connected client before the port becomes unauthorized.
Page 102 ONFIGURING THE WITCH CLI – This example shows the default protocol settings for 802.1x. For a description of the additional entries displayed in the CLI, See “show dot1x” on page 4-111. Console#show dot1x Global 802.1X Parameters reauth-enabled: yes reauth-period: quiet-period: tx-period: supp-timeout: server-timeout: 30...
Page 103: Configuring 802.1X Global Settings
(Range: 1-10; Default 2) • Timeout for Quiet Period – Sets the time that a switch port waits after the dot1X Max Request Count has been exceeded before attempting to acquire a new client. (Range: 1-65535 seconds; Default: 60 seconds) •...
Page 104: Configuring Port Authorization Mode
ONFIGURING THE WITCH Web – Select Security, 802.1x, Configuration. Enable dot1x globally for the switch, modify any of the parameters required, and then click Apply. CLI – This enables re-authentication and sets all of the global parameters for 802.1x. Console(config)#dot1x re-authentication...
Page 105: Figure 3-25. 802.1X Port Configuration
• Max Count – The maximum number of hosts that can connect to a port when the Multi-Host operation mode is selected. (Range: 1-20; Default: 5) • Mode – Sets the authentication mode to one of the following options: - Auto – Requires a dot1x-aware client to be authorized by the authentication server.
Page 106: Displaying 802.1X Statistics
2, and allows up to ten clients to connect to this port. Console(config)#interface ethernet 1/2 Console(config-if)#dot1x port-control auto Console(config-if)#dot1x operation-mode multi-host max-count 10 Console(config-if)# Displaying 802.1x Statistics This switch can display statistics for dot1x protocol exchanges for any port. Statistical Values Parameter Rx EXPOL Start Rx EAPOL Logoff...
Page 107: Figure 3-26. 802.1X Statistics
Parameter Tx EAPOL Total Tx EAP Req/Id Tx EAP Req/Oth Web – Select Security, 802.1X, Statistics. Select the required port and then click Query. Click Refresh to update the statistics. Figure 3-26. 802.1x Statistics Table 3-4. 802.1x Statistics Descripton The number of EAPOL frames of any type that have been transmitted by this Authenticator.
Page 108: Configuring Access Control Lists
An ACL is a sequential list of permit or deny conditions that apply to IP addresses, MAC addresses, or other more specific criteria. This switch tests ingress or egress packets against the conditions in an ACL one by one. A packet will be accepted as soon as it matches a permit rule, or dropped as soon as it matches a deny rule.
Page 109: Setting The Acl Name And Type
ACL must be deny rules. Otherwise, the bind operation will fail. • The switch does not support the explicit “deny any any” rule for the egress IP ACL or the egress MAC ACLs. If these rules are included in ACL, and you attempt to bind the ACL to an interface for egress checking, the bind operation will fail.
Page 110: Figure 3-27. Naming And Choosing Acls
ONFIGURING THE WITCH Command Attributes • Name – Name of the ACL. (Maximum length: 16 characters) • Type – There are three filtering modes: - Standard: IP ACL mode that filters packets based on the source IP address. - Extended: IP ACL mode that filters packets based on source or destination IP address, as well as protocol type and protocol port number.
Page 111: Configuring A Standard Ip Acl
Configuring a Standard IP ACL Command Attributes • Action – An ACL can contain all permit rules or all deny rules. (Default: Permit rules) • IP – Specifies the source IP address. Use “Any” to include all possible addresses, “Host” to specify a specific host address in the Address field, or “IP”...
Page 112: Configuring An Extended Ip Acl
ONFIGURING THE WITCH CLI – This example configures one permit rule for the specific address 10.1.1.21 and another rule for the address range 168.92.16.x – 168.92.31.x using a bitmask. Console(config-std-acl)#permit host 10.1.1.21 Console(config-std-acl)#permit 168.92.16.0 255.255.240.0 Console(config-std-acl)# Configuring an Extended IP ACL Command Attributes •...
Page 113 • Control Bitmask – Decimal number representing the code bits to match. The control bitmask is a decimal number (for an equivalent binary bit mask) that is applied to the control code. Enter a decimal number, where the equivalent binary bit “1” means to match a bit and “0” means to ignore a bit.
Page 114: Figure 3-29. Configuring Extended Ip Acls
ONFIGURING THE WITCH Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range.
Page 115: Configuring A Mac Acl
3. Permit all TCP packets from class C addresses 192.168.1.0 with the TCP control code set to “SYN.” Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any Console(config-ext-acl)#permit 192.168.1.0 255.255.255.0 any dport 80 Console(config-ext-acl)#permit 192.168.1.0 255.255.255.0 any tcp control-code 2 2 Console(config-std-acl)# Configuring a MAC ACL Command Attributes •...
Page 116 ONFIGURING THE WITCH • Packet Format – This attribute includes the following packet types: Any – Any Ethernet packet type. Untagged-eth2 – Untagged Ethernet II packets. Untagged-802.3 – Untagged Ethernet 802.3 packets. Tagged-eth2 – Tagged Ethernet II packets. Tagged-802.3 – Tagged Ethernet 802.3 packets. Command Usage Egress MAC ACLs only work for destination-mac-known packets, not for multicast, broadcast, or destination-mac-unknown packets.
Page 117: Figure 3-30. Configuring Mac Acls
Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or MAC). If you select “Host,” enter a specific address (e.g., 11-22-33-44-55-66). If you select “MAC,” enter a base address and a hexidecimal bitmask for an address range.
Page 118: Configuring Acl Masks
Configuring ACL Masks You can specify optional masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/filter packets matching the permit/deny rules specified in an ingress ACL. You can also configure up to seven user-defined masks for an ingress or egress ACL.
Page 119: Configuring An Ip Acl Mask
Web – Click Security, ACL, Mask Configuration. Click Edit for one of the basic mask types to open the configuration page. Figure 3-31. Choosing ACL Types CLI – This example creates an IP ingress mask, and then adds two rules. Each rule is checked in order of precedence to look for a match in the ACL entries.
Page 120 ONFIGURING THE WITCH subnet), or “IP” to specify a range of addresses. (Options: Any, Host, IP; Default: Any) • Src/Dst IP Bitmask – Source or destination address of rule must match this bitmask. (See the description for SubMask on page 3-63.) •...
Page 121: Figure 3-32. Configuring An Ip Based Acl
CCESS ONTROL ISTS Web – Configure the mask to match the required rules in the IP ingress or egress ACLs. Set the mask to check for any source or destination address, a specific host address, or an address range. Include other criteria to search for in the rules, such as a protocol type or one of the service types.
Page 122: Configuring A Mac Acl Mask
ONFIGURING THE WITCH Console(config)#access-list ip standard A2 Console(config-std-acl)#permit 10.1.1.0 255.255.255.0 Console(config-std-acl)#deny 10.1.1.1 255.255.255.255 Console(config-std-acl)#exit Console(config)#access-list ip mask-precedence in Console(config-ip-mask-acl)#mask host any Console(config-ip-mask-acl)#mask 255.255.255.0 any Console(config-ip-mask-acl)# Configuring a MAC ACL Mask This mask defines the fields to check in the packet header. Command Usage You must configure a mask for an ACL rule before you can bind it to a port.
Page 123: Figure 3-33. Configuring A Mac Based Acl
CCESS ONTROL ISTS Web – Configure the mask to match the required rules in the MAC ingress or egress ACLs. Set the mask to check for any source or destination address, a host address, or an address range. Use a bitmask to search for specific VLAN ID(s) or Ethernet type(s).
Page 124: Binding A Port To An Access Control List
• This switch supports ACLs for both ingress and egress filtering. However, you can only bind one IP ACL and one MAC ACL to any port for ingress filtering, and one IP ACL and one MAC ACL to any port for egress filtering.
Page 125: Figure 3-34. Mapping Acls To Port Ingress/Egress Queues
ACL must be deny rules. Otherwise, the bind operation will fail. • The switch does not support the explicit “deny any any” rule for the egress IP ACL or the egress MAC ACLs. If these rules are included in ACL, and you attempt to bind the ACL to an interface for egress checking, the bind operation will fail.
Page 126: Filtering Management Access
• If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager.
Page 127: Figure 3-35. Filtering Management Access
Command Attributes • Web IP Filter – Configures IP address(es) for the web group. • SNMP IP Filter – Configures IP address(es) for the SNMP group. • Telnet IP Filter – Configures IP address(es) for the Telnet group. • IP Filter List – IP address which are allowed management access to this interface.
Page 128: Port Configuration
ONFIGURING THE WITCH Port Configuration Displaying Connection Status You can use the Port Information or Trunk Information pages to display the current connection status, including link state, speed/duplex mode, flow control, and auto-negotiation. Field Attributes (Web) • Name – Interface label. •...
Page 129: Figure 3-36. Port Status Information
Port type – Indicates the port type. (1000BASE-T, 1000BASE-SX, 1000BASE-LX or 100BASE-FX) • MAC address – The physical layer address for this port. (To access this item on the web, see “Setting the Switch’s IP Address” on page 3-17.) Configuration: •...
Page 130 ONFIGURING THE WITCH • Capabilities – Specifies the capabilities to be advertised for a port during auto-negotiation. (To access this item on the web, see “Configuring Interface Connections” on page 3-48.) The following capabilities are supported. - 10half - Supports 10 Mbps half-duplex operation - 10full - Supports 10 Mbps full-duplex operation - 100half - Supports 100 Mbps half-duplex operation - 100full - Supports 100 Mbps full-duplex operation...
Page 131 CLI – This example shows the connection status for Port 5. Console#show interfaces status ethernet 1/5 Information of Eth 1/13 Basic information: Port type: 1000T Mac address: 00-30-f1-47-58-46 Configuration: Name: Port admin: Up Speed-duplex: Auto Capabilities: 10half, 10full, 100half, 100full, 1000full, Broadcast storm: Enabled Broadcast storm limit: 500 packets/second Flow control: Disabled...
Page 132: Configuring Interface Connections
- Sym (Gigabit only) - Check this item to transmit and receive pause frames, or clear it to auto-negotiate the sender and receiver for asymmetric pause frames. (The current switch chip only supports symmetric pause frames.) - FC - Supports flow control...
Page 133 - Flow control can eliminate frame loss by “blocking” traffic from end stations or segments connected directly to the switch when its buffers fill. When enabled, back pressure is used for half-duplex operation and IEEE 802.3x for full-duplex operation. (Avoid using flow control on a port connected to a hub unless it is actually required to solve a problem.
Page 134: Creating Trunk Groups
ONFIGURING THE WITCH Web – Click Port, Port Configuration or Trunk Configuration. Modify the required interface settings, and click Apply. Figure 3-37. Configuring Port Attributes CLI – Select the interface, and then enter the required settings. Console(config)#interface ethernet 1/13 Console(config-if)#description RD SW#13 Console(config-if)#shutdown Console(config-if)#no shutdown Console(config-if)#no negotiation...
Page 135 Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • You can create up to six trunks on the switch, with up to eight ports per trunk. • The ports at both ends of a connection must be configured as trunk ports.
Page 136: Statically Configuring A Trunk
Web – Click Port, Trunk Membership. Enter a trunk ID of 1-6 in the Trunk field, select any of the switch ports from the scroll-down port list, and click Add. After you have completed adding ports to the member list, click Apply.
Page 137: Enabling Lacp On Selected Ports
CLI – This example creates trunk 2 with ports 1 and 2. Just connect these ports to two static trunk ports on another switch to form a trunk. Console(config)#interface port-channel 2 Console(config-if)#exit Console(config)#interface ethernet 1/1 Console(config-if)#channel-group 1 Console(config-if)#exit Console(config)#interface ethernet 1/2...
Page 138: Figure 3-39. Lacp Port Configuratio
ID. • If more than four ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails.
Page 139: Configuring Lacp Parameters
CLI – The following example enables LACP for ports 1 to 6. Just connect these ports to LACP-enabled trunk ports on another switch to form a trunk. Console(config)#interface ethernet 1/1 Console(config-if)#lacp Console(config-if)#exit Console(config)#interface ethernet 1/6 Console(config-if)#lacp Console(config-if)#end Console#show interfaces status port-channel 1...
Page 140 - Ports must be configured with the same system priority to join the same LAG. - System priority is combined with the switch’s MAC address to form the LAG identifier. This identifier is used to indicate a specific LAG during LACP negotiations with other systems.
Page 141: Figure 3-40. Lacp Aggregation Port Configuration
ONFIGURATION Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and Port Priority for the Port Actor. You can optionally configure these settings for the Port Partner. (Be aware that these settings only affect the administrative state of the partner, and will not take effect until the next time an aggregate link is formed with this device.) After you have completed setting the port LACP parameters, click Apply.
Page 142: Displaying Lacp Port Counters
ONFIGURING THE WITCH CLI – The following example configures LACP parameters for ports 1-6. Ports 1-4 are used as active members of the LAG; ports 5 and 6 are set to backup mode. Console(config)#interface ethernet 1/1 Console(config-if)#lacp actor system-priority 3 Console(config-if)#lacp actor admin-key 120 Console(config-if)#lacp actor port-priority 128 Console(config-if)#exit...
Page 143: Figure 3-41. Displaying Lacp Port Counters Information
Table 3-5. LACP Port Counter Information Field Description Marker Received Number of valid Marker PDUs received by this channel group. LACPDUs Unknown Number of frames received that either (1) Carry the Slow Pkts Protocols Ethernet Type value, but contain an unknown PDU, or (2) are addressed to the Slow Protocols group MAC Address, but do not carry the Slow Protocols Ethernet Type.
Page 144: Displaying Lacp Settings And Status For The Local Side
ONFIGURING THE WITCH CLI – The following example displays LACP counters for port channel 1. Console#show 1 lacp counters Channel group : 1 ------------------------------------------------------------------- Eth 1/ 1 ------------------------------------------------------------------- LACPDUs Sent : 21 LACPDUs Received : 21 Marker Sent : 0 Marker Received : 0 LACPDUs Unknown Pkts : 0 LACPDUs Illegal Pkts : 0...
Page 145 Field Description Admin State, Administrative or operational values of the actor’s state parameters: Oper State • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner.
Page 146: Figure 3-42. Displaying Lacp Port Information
ONFIGURING THE WITCH Web – Click Port, LACP, Port Internal Information. Select a port channel to display the corresponding information. Figure 3-42. Displaying LACP Port Information CLI – The following example displays the LACP configuration settings and operational state for the local side of port channel 1. Console#show 1 lacp internal Channel group : 1 -------------------------------------------------------------------...
Page 147: Displaying Lacp Settings And Status For The Remote Side
Displaying LACP Settings and Status for the Remote Side You can display configuration settings and the operational state for the remote side of an link aggregation. Neighbor Configuration Information Table 3-7. LACP Remote Side Settings Field Partner Admin System Partner Oper System Partner Admin Port Number Partner Oper...
Page 148: Figure 3-43. Displaying Remote Lacp Port Information
ONFIGURING THE WITCH Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-43. Displaying Remote LACP Port Information CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1. Console#show 1 lacp neighbors Channel group 1 neighbors -------------------------------------------------------------------...
Page 149: Setting Broadcast Storm Thresholds
The default threshold is 500 packets per second. • Broadcast control does not effect IP multicast traffic. • The specified threshold applies to all ports on the switch. Command Attributes • Protect Status – Shows whether or not broadcast storm control has been enabled.
Page 150: Figure 3-44. Enabling Port Broadcast Control
ONFIGURING THE WITCH Web – Click Port, Port Broadcast Control. Set the threshold any port, click Apply. Figure 3-44. Enabling Port Broadcast Control CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 600 packets per second for port 2.
Page 151: Configuring Port Mirroring
Configuring Port Mirroring You can mirror traffic from any source port to a target port for real-time analysis. You can then attach a logic analyzer or RMON probe to the target port and study the traffic crossing the source port in a completely unobtrusive manner.
Page 152: Configuring Rate Limits
Rate limiting is configured on interfaces at the edge of a network to limit traffic coming out of the switch. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped.
Page 153: Figure 3-46. Configuring Output Port Rate Limiting
Command Attribute Rate Limit – Sets the output rate limit for an interface. Default Status – Disabled Default Rate – 1000 Mbps Range – 1 - 1000 Mbps Web - Click Rate Limit, Input/Output Port/Trunk Configuration. Set the Input Rate Limit Status or Output Rate Limit Status, then set the rate limit for the individual interfaces, and click Apply.
Page 154: Showing Port Statistics
RMON MIB. Interfaces and Ethernet-like statistics display errors on the traffic passing through each port. This information can be used to identify potential problems with the switch (such as a faulty port or unusually heavy loading). RMON statistics provide access to a broad range of statistics, including a total count of different frame types and sizes passing through each port.
Page 155 Parameter Received Discarded Packets Received Unknown Packets Received Errors Transmit Octets Transmit Unicast Packets Transmit Multicast Packets The total number of packets that higher-level Transmit Broadcast Packets Transmit Discarded Packets Transmit Errors Etherlike Statistics Table 3-8. Port Statistics Description The number of inbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.
Page 156 ONFIGURING THE WITCH Parameter Alignment Errors Late Collisions FCS Errors Excessive Collisions Single Collision Frames Internal MAC Transmit Errors Multiple Collision Frames A count of successfully transmitted frames for which Carrier Sense Errors SQE Test Errors Frames Too Long Deferred Transmissions 3-108 Table 3-8.
Page 157 Parameter Internal MAC Receive Errors RMON Statistics Drop Events Jabbers Received Bytes Collisions Received Frames Broadcast Frames Multicast Frames CRC/Alignment Errors Undersize Frames Oversize Frames Table 3-8. Port Statistics Description A count of frames for which reception on a particular interface fails due to an internal MAC sublayer receive error.
Page 158: Figure 3-47. Displaying Port Statistics
ONFIGURING THE WITCH Parameter Fragments 64 Bytes Frames 65-127 Byte Frames 128-255 Byte Frames 256-511 Byte Frames 512-1023 Byte Frames 1024-1518 Byte Frames 1519-1536 Byte Frames Web – Click Port, Port Statistics. Select the required interface, and click Query. You can also use the Refresh button at the bottom of the page to update the screen.
Page 159: Figure 3-48. Displaying Etherlike And Rmon Statistics
ONFIGURATION Figure 3-48. Displaying Etherlike and RMON Statistics 3-111...
Page 160: Address Table Settings
Setting Static Addresses A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.
Page 161: Figure 3-49. Mapping Ports To Static Addresses
MAC address and VLAN, then click Add Static Address. Figure 3-49. Mapping Ports to Static Addresses CLI – This example adds an address to the static address table, but sets it to be deleted when the switch is reset. Console(config)#mac-address-table static 00-e0-29-94-34-de interface ethernet 1/1 vlan 1 delete-on-reset...
Page 162: Displaying The Address Table
Displaying the Address Table The Dynamic Address Table contains the MAC addresses learned by monitoring the source address for traffic entering the switch. When the destination address for inbound traffic is found in the database, the packets intended for that address are forwarded directly to the associated port.
Page 163: Changing The Aging Time
CLI – This example also displays the address table entries for port 1. Console#show mac-address-table interface ethernet 1/1 Interface Mac Address --------- ----------------- ---- ----------------- Eth 1/ 1 00-E0-29-94-34-DE Eth 1/ 1 00-20-9C-23-CD-60 Console# Changing the Aging Time You can set the aging time for entries in the dynamic address table. Command Attributes Aging Time –...
Page 164: Spanning Tree Algorithm Configuration
The Spanning Tree Algorithm (STA) can be used to detect and disable network loops, and to provide backup links between switches, bridges or routers. This allows the switch to interact with other bridging devices (that is, an STA-compliant switch, bridge or router) in your network to ensure...
Page 165: Displaying Global Settings
RSTP node in the Common Spanning Tree (CST). Displaying Global Settings You can display a summary of the current bridge STA information that applies to the entire switch using the STA Information screen. 3-117...
Page 166: Field Attributes
Designated Root – The priority and MAC address of the device in the Spanning Tree that this switch has accepted as the root device. - Root Port – The number of the port on this switch that is closest to the root. This switch communicates with the root device through this port.
Page 167 These additional parameters are only displayed for the CLI: • Spanning tree mode – Specifies the type of spanning tree used on this switch: - STP: Spanning Tree Protocol (IEEE 802.1D) - RSTP: Rapid Spanning Tree (IEEE 802.1w) - MSTP: Multiple Spanning Tree (IEEE 802.1s) •...
Page 168: Figure 3-52. Displaying The Spanning Tree Algorithm
ONFIGURING THE WITCH that would make it return to a discarding state; otherwise, temporary data loops might result. • Root Hold Time – The interval (in seconds) during which no more than two bridge configuration protocol data units shall be transmitted by this node.
Page 169: Configuring Global Settings
Path Cost Method Note: The current root port and current root cost display as zero when this device is not connected to the network. Configuring Global Settings Global settings apply to the entire switch. Command Usage • Spanning Tree Protocol Uses RSTP for the internal state machine, but sends only 802.1D...
Page 170 RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU (i.e., STP BPDU) after a port’s migration delay timer expires, the switch assumes it is connected to an 802.1D bridge and starts using only 802.1D BPDUs.
Page 171 • Priority – Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device. (Note that lower numeric values indicate higher priority.) - Default: 32768 - Range: 0-61440, in steps of 4096...
Page 172 (Range: 1-10; Default: 3) Configuration Settings for MSTP • Max Instance Numbers – The maximum number of MSTP instances to which this switch can be assigned. (Default: 65) • Region Revision* – The revision for this MSTI. (Range: 0-65535; Default: 0) * The MST name and revision number are both required to uniquely identify an MST region.
Page 173: Figure 3-53. Configuring The Spanning Tree Algorithm
• Maximum Hop Count – The maximum number of hops allowed in the MST region before a BPDU is discarded. (Range: 1-40; Default: 20) * The MST name and revision number are both required to uniquely identify an MST region. Web –...
Page 174: Displaying Interface Settings
ONFIGURING THE WITCH CLI – This example enables Spanning Tree Protocol, sets the mode to MST, and then configures the STA and MSTP parameters. Console(config)#spanning-tree Console(config)#spanning-tree mode mst Console(config)#spanning-tree priority 40000 Console(config)#spanning-tree hello-time 5 Console(config)#spanning-tree max-age 38 Console(config)#spanning-tree forward-time 20 Console(config)#spanning-tree pathcost method long Console(config)#spanning-tree transmission-limit 4 Console(config)#Console(config)#spanning-tree mst-configuration 3-213...
Page 175 - A port on a network segment with no other STA compliant bridging device is always forwarding. - If two ports of a switch are connected to the same segment and there is no other STA device attached to this segment, the port with the smaller ID forwards packets and the other is discarding.
Page 176 ONFIGURING THE WITCH • Port Role – Roles are assigned according to whether the port is part of the active topology connecting the bridge to the root bridge (i.e., root port), connecting a LAN through the bridge to the root bridge (i.e., designated port), or is the MSTI regional root (i.e., master port);...
Page 177 Priority – Defines the priority used for this port in the Spanning Tree Algorithm. If the path cost for all ports on a switch is the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
Page 178: Configuring Interface Settings
ONFIGURING THE WITCH Web – Click Spanning Tree, STA, Port Information or STA Trunk Information. Figure 3-54. Displaying STA - Port Status Information CLI – This example shows the STA attributes for port 5. Console#show spanning-tree ethernet 1/5 1/ 5 information -------------------------------------------------------------- Admin status Role...
Page 179 Priority – Defines the priority used for this port in the Spanning Tree Protocol. If the path cost for all ports on a switch are the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
Page 180 - Point-to-Point – A connection to exactly one other bridge. - Shared – A connection to two or more bridges. - Auto – The switch automatically determines if the interface is attached to a point-to-point link or to shared media. (This is the default setting.)
Page 181: Configuring Multiple Spanning Trees
• Migration – If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the Protocol Migration button to manually re-check the appropriate BPDU format (RSTP or STP-compatible) to send on the selected interfaces.
Page 182 By default all VLANs are assigned to the Internal Spanning Tree (MST Instance 0) that connects all bridges and LANs within the MST region. This switch supports up to 65 instances. You should try to group VLANs which cover the same general area of your network. However,...
Page 183: Figure 3-56. Configuring Multiple Spanning Trees
• VLAN ID – VLAN to assign to this selected MST instance. (Range: 1-4094) The other global attributes are described under “Displaying Global Settings,” page 3-121. The attributes displayed by the CLI for individual interfaces are described under “Displaying Interface Settings,” page 3-126. Web –...
Page 184: Each Port
ONFIGURING THE WITCH CLI – This displays STA settings for instance 1, followed by settings for each port. Console#show spanning-tree mst 2 Spanning-tree information --------------------------------------------------------------- Spanning tree mode Spanning tree enable/disable Instance Vlans configuration Priority Bridge Hello Time (sec.) Bridge Max Age (sec.) Bridge Forward Delay (sec.) Root Hello Time (sec.) Root Max Age (sec.)
Page 185: Displaying Interface Settings For Mstp
CLI – This example sets the priority for MSTI 1, and adds VLANs 1-5 to this MSTI. Console(config)#spanning-tree mst-configuration Console(config-mst)#mst 1 priority 4096 Console(config-mstp)#mst 1 vlan 1-5 Console(config-mst)# Displaying Interface Settings for MSTP The MSTP Port Information and MSTP Trunk Information pages display the current status of ports and trunks in the selected MST instance.
Page 186 ONFIGURING THE WITCH CLI – This displays STA settings for instance 0, followed by settings for each port. The settings for instance 0 are global settings that apply to the IST (page 3-117), the settings for other instances only apply to the local spanning tree.
Page 187: Configuring Interface Settings For Mstp
Priority – Defines the priority used for this port in the Spanning Tree Protocol. If the path cost for all ports on a switch are the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
Page 188: Figure 3-58. Mstp Port Configuration
ONFIGURING THE WITCH • MST Path Cost – This parameter is used by the MSTP to determine the best path between devices. Therefore, lower values should be assigned to ports attached to faster media, and higher values assigned to ports with slower media. (Path cost takes precedence over port priority.) Note that when the Path Cost Method is set to short (page 3-63), the maximum path cost is 65,535.
Page 189: Vlan Configuration
Overview In large networks, routers are used to isolate broadcast traffic for each subnet into separate domains. This switch provides a similar service at Layer 2 by using VLANs to organize any group of network nodes into separate broadcast domains. VLANs confine broadcast traffic to the originating group, and can eliminate broadcast storms in large networks.
Page 190: Assigning Ports To Vlans
Priority tagging Assigning Ports to VLANs Before enabling VLANs for the switch, you must first assign each port to the VLAN group(s) in which it will participate. By default all ports are assigned to VLAN 1 as untagged ports. Add a port as a tagged port if you...
Page 191 VLAN Classification – When the switch receives a frame, it classifies the frame in one of two ways. If the frame is untagged, the switch assigns the frame to an associated VLAN (based on the default VLAN ID of the receiving port).
Page 192 IEEE 802.1Q VLAN protocol, it can be configured to broadcast a message to your network indicating the VLAN groups it wants to join. When this switch receives these messages, it will automatically place the receiving port in the specified VLANs, and then forward the message to all other ports.
Page 193: Forwarding Tagged/Untagged Frames
When forwarding a frame from this switch along a path that contains any VLAN-aware devices, the switch should include VLAN tags. When forwarding a frame from this switch along a path that does not contain any VLAN-aware devices (including the destination host), the switch must first strip off the VLAN tag before forwarding the frame.
Page 194: Enabling Or Disabling Gvrp (Global Setting)
The VLAN Basic Information page displays basic information on the VLAN type supported by the switch. Field Attributes • VLAN Version Number* – The VLAN version used by this switch as specified in the IEEE 802.1Q standard. • Maximum VLAN ID – Maximum VLAN ID recognized by this switch.
Page 195: Displaying Current Vlans
Up Time at Creation – Time this VLAN was created (i.e., System Up Time). • Status – Shows how this VLAN was added to the switch. - Dynamic GVRP: Automatically learned via GVRP. - Permanent: Added as a static entry.
Page 196: Figure 3-61. Displaying Vlan Information By Port Membership
Command Attributes (CLI) • VLAN – ID of configured VLAN (1-4094, no leading zeroes). • Type – Shows how this VLAN was added to the switch. - Dynamic: Automatically learned via GVRP. - Static: Added as a static entry. •...
Page 197: Creating Vlans
Console# Creating VLANs Use the VLAN Static List to create or remove VLAN groups. To propagate information about VLAN groups used on this switch to external network devices, you must specify a VLAN ID for each of these groups. Command Attributes •...
Page 198: Figure 3-62. Creating Virtual Lans
ONFIGURING THE WITCH • Remove – Removes a VLAN group from the current list. If any port is assigned to this group as untagged, it will be reassigned to VLAN group 1 as untagged. Web – Click VLAN, 802.1Q VLAN, Static List. To create a new VLAN, enter the VLAN ID and VLAN name, mark the Enable checkbox to activate the VLAN, and then click Add.
Page 199: Adding Static Members To Vlans (Vlan Index)
VLAN compliant devices, or untagged they are not connected to any VLAN-aware devices. Or configure a port as forbidden to prevent the switch from automatically adding it to a VLAN via the GVRP protocol. Notes: 1. You can also use the VLAN Static Membership by Port page to configure VLAN groups based on the port index (page 3-153).
Page 200: Figure 3-63. Configuring Vlan Port Attributes
ONFIGURING THE WITCH • Membership Type – Select VLAN membership for each interface by marking the appropriate radio button for a port or trunk: - Tagged: Interface is a member of the VLAN. All packets transmitted by the port will be tagged, that is, carry a tag and therefore carry VLAN or CoS information.
Page 201: Adding Static Members To Vlans (Port Index)
CLI – The following example adds tagged and untagged ports to VLAN 2. Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 2 tagged Console(config-if)#exit Console(config)#interface ethernet 1/2 Console(config-if)#switchport allowed vlan add 2 untagged Console(config-if)#exit Console(config)#interface ethernet 1/13 Console(config-if)#switchport allowed vlan add 2 tagged Adding Static Members to VLANs (Port Index) Use the VLAN Static Membership by Port menu to assign VLAN groups to the selected interface as a tagged member.
Page 202: Figure 3-64. Assigning Vlan Port And Trunk Groups
ONFIGURING THE WITCH Figure 3-64. Assigning VLAN Port and Trunk Groups CLI – This example adds Port 3 to VLAN 1 as a tagged port, and removes Port 3 from VLAN 2. Console(config)#interface ethernet 1/3 Console(config-if)#switchport allowed vlan add 1 tagged Console(config-if)#switchport allowed vlan remove 2 Configuring VLAN Behavior for Interfaces You can configure VLAN behavior for specific interfaces, including the...
Page 203 • GVRP Status – Enables/disables GVRP for the interface. GVRP must be globally enabled for the switch before this setting can take effect. (See “Displaying Bridge Extension Capabilities” on page 3-16.) When disabled, any GVRP packets received on this port will be discarded and no GVRP registrations will be propagated from other ports.
Page 204 ONFIGURING THE WITCH • GARP Join Timer* – The interval between transmitting requests/ queries to participate in a VLAN group. (Range: 20-1000 centiseconds; Default: 20) • GARP Leave Timer* – The interval a port waits before leaving a VLAN group. This time should be set to more than twice the join time. This ensures that after a Leave or LeaveAll message has been issued, the applicants can rejoin before the port actually leaves the group.
Page 205: Figure 3-65. Configuring Vlan Ports
Web – Click VLAN, 802.1Q VLAN, Port Configuration or VLAN Trunk Configuration. Fill in the required settings for each interface, click Apply. Figure 3-65. Configuring VLAN Ports CLI – This example sets port 3 to accept only tagged frames, assigns PVID 3 as the native VLAN ID, enables GVRP, sets the GARP timers, and then sets the switchport mode to hybrid.
Page 206: Configuring Private Vlans
VLAN. Data traffic on downlink ports can only be forwarded to, and from, uplink ports. (Note that private VLANs and normal VLANs can exist simultaneously within the same switch.) Enabling Private VLANs Use the Private VLAN Status page to enable/disable the Private VLAN function.
Page 207: Configuring Uplink And Downlink Ports
Use the Private VLAN Link Status page to set ports as downlink or uplink ports. Ports designated as downlink ports can not communicate with any other ports on the switch except for the uplink ports. Uplink ports can communicate with any other ports on the switch and with any designated downlink ports.
Page 208: Configuring Protocol Groups
ONFIGURING THE WITCH To avoid these problems, you can configure this switch with protocol-based VLANs that divide the physical network into logical VLAN groups for each required protocol. When a frame is received at a port, its VLAN membership can then be determined based on the protocol type being used by the inbound packets.
Page 209: Mapping Protocols To Vlans
Web – Click VLAN, Protocol VLAN, Configuration. Enter a protocol group ID, frame type and protocol type, then click Apply. Figure 3-68. Protocil VLAN Configuration CLI – The following creates protocol group 1, and then specifies Ethernet frames with IP and ARP protocol types. Console(config)#protocol-vlan protocol-group 1 add frame-type ethernet protocol-type ip Console(config)#protocol-vlan protocol-group 1...
Page 210: Figure 3-69. Mapping Protocols To Vlans
ONFIGURING THE WITCH • When a frame enters a port that has been assigned to a protocol VLAN, it is processed in the following manner: - If the frame is tagged, it will be processed according to the standard rules applied to tagged frames. - If the frame is untagged and the protocol type matches, the frame is forwarded to the appropriate VLAN.
Page 211: Class Of Service Configuration
Setting the Default Priority for Interfaces You can specify the default port priority for each interface on the switch. All untagged packets entering the switch are tagged with the specified default port priority, and then sorted into the appropriate priority queue at the output port.
Page 212: Figure 3-70. Configuring Class Of Service Per Port
ONFIGURING THE WITCH Command Attributes • Default Priority* – The priority that is assigned to untagged frames received on the specified interface. (Range: 0 - 7, Default: 0) • Number of Egress Traffic Classes – The number of queue buffers provided for each port.
Page 213: Mapping Cos Values To Egress Queues
The priority levels recommended in the IEEE 802.1p standard for various network applications are shown in the following table. However, you can map the priority levels to the switch’s output queues in any way that benefits application traffic for your own network.
Page 214: Figure 3-71. Configuring Ports And Trunks For Class Of Service
Traffic Class : 0 1 2 3 4 5 6 7 Priority Queue: 0 1 2 3 4 5 6 7 Note: Mapping specific values for CoS priorities is implemented as an interface configuration command, but any changes will apply to the all interfaces on the switch. 3-166 3-168 3-260...
Page 215: Selecting The Queue Mode
Selecting the Queue Mode You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
Page 216: Setting The Service Weight For Traffic Classes
WITCH Setting the Service Weight for Traffic Classes This switch uses the Weighted Round Robin (WRR) algorithm to determine the frequency at which it services each priority queue. As described in “Mapping CoS Values to Egress Queues” on page 3-165, the traffic classes are mapped to one of the four egress queues provided for each port.
Page 217: Mapping Layer 3/4 Priorities To Cos Values
Because different priority information may be contained in the traffic, this switch maps priority values to the output queues in the following manner: • The precedence for priority mapping is IP Port Priority, IP Precedence or DSCP Priority, and then Default Port Priority.
Page 218: Selecting Ip Precedence/Dscp Priority
ONFIGURING THE WITCH Selecting IP Precedence/DSCP Priority The switch allows you to choose between using IP Precedence or DSCP priority. Select one of the methods or disable this feature. Command Attributes • Disabled – Disables both priority services. (This is the default setting.) •...
Page 219: Mapping Ip Precedence
Mapping IP Precedence The Type of Service (ToS) octet in the IPv4 header includes three precedence bits defining eight different priority levels ranging from highest priority for network control packets to lowest priority for routine traffic. The default IP Precedence values are mapped one-to-one to Class of Service values (i.e., Precedence value 0 maps to CoS value 0, and so forth).
Page 220: Figure 3-75. Mapping Ip Precedence To Class Of Service Values
Figure 3-75. Mapping IP Precedence to Class of Service Values CLI – The following example globally enables IP Precedence service on the switch, maps IP Precedence value 1 to CoS value 0 (on port 1), and then displays the IP Precedence settings.*...
Page 221: Mapping Dscp Priority
Mapping DSCP Priority The DSCP is six bits wide, allowing coding for up to 64 different forwarding behaviors. The DSCP replaces the ToS bits, but it retains backward compatibility with the three precedence bits so that non-DSCP compliant, ToS-enabled devices, will not conflict with the DSCP mapping. Based on network policies, different kinds of traffic can be marked for different kinds of forwarding.
Page 222: Figure 3-76. Mapping Ip Dscp Priority To Class Of Service Values
Figure 3-76. Mapping IP DSCP Priority to Class of Service Values CLI – The following example globally enables DSCP Priority service on the switch, maps DSCP value 0 to CoS value 1 (on port 1), and then displays the DSCP Priority settings.
Page 223: Mapping Ip Port Priority
Mapping IP Port Priority You can also map network applications to Class of Service values based on the IP port number (i.e., TCP/UDP port number) in the frame header. Some of the more common TCP service ports include: HTTP: 80, FTP: 21, Telnet: 23 and POP3: 110.
Page 224: Figure 3-78. Ip Port Priority Mapping
Number box and the new CoS value in the Class of Service box, and then click Add IP Port. CLI – The following example globally enables IP Port Priority service on the switch, maps HTTP traffic (on port 1) to CoS value 0, and then displays the IP Port Priority settings. Console(config)#map ip port...
Page 225: Mapping Cos Values To Acls
Mapping CoS Values to ACLs Use the ACL CoS Mapping page to set the output queue for packets matching an ACL rule as shown in the following table. Note that the specified CoS value is only used to map the matching packet to an output queue;...
Page 226: Changing Priorities Based On Acl Rules
You can change traffic priorities for frames matching the defined ACL rule. (This feature is commonly referred to as ACL packet marking.) This switch can change the IEEE 802.1p priority, IP Precedence, or DSCP Priority of IP frames; or change the IEEE 802.1p priority of Layer 2 frames.
Page 227 Precedence or six bits for Differentiated Services Code Point (DSCP) service. Note that the IP frame header can include either the IP Precedence or DSCP priority type. • The precedence for priority mapping by this switch is IP Precedence or DSCP Priority, and then 802.1p priority. Command Attributes •...
Page 228: Figure 3-79. Changing Priorities Based On Acl Rules
ONFIGURING THE WITCH Web – Click Priority, ACL Marker. Select a port and an ACL rule. To specify a ToS priority, mark the Precedence/DSCP check box, select Precedence or DSCP from the scroll-down box, and enter a priority. To specify an 802.1p priority, mark the 802.1p Priority check box, and enter a priority.
Page 229: Multicast Filtering
It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service. This procedure is called multicast filtering.
Page 230: Layer 2 Igmp (Snooping And Query)
IGMP querier, you can manually designate a known IGMP querier (i.e., a multicast router/switch) connected over the network to an interface on your switch (page 3-186). This interface will then join all the current multicast groups supported by the attached router/switch to ensure that multicast traffic is passed to all appropriate interfaces within the switch.
Page 231 This is also referred to as IGMP Snooping. (Default: Enabled) • Act as IGMP Querier — When enabled, the switch can serve as the Querier, which is responsible for asking hosts if they want to receive multicast traffic. (Default: Enabled) •...
Page 232: Figure 3-80. Configuring Internet Group Management Protocol
ONFIGURING THE WITCH • IGMP Version — Sets the protocol version for compatibility with other devices on the network. (Range: 1-2; Default: 2) Notes: 1. All systems on the subnet must support the same version. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Timeout.
Page 233: Displaying Interfaces Attached To A Multicast Router
VLAN ID – ID of configured VLAN (1-4094). • Multicast Router List – Multicast routers dynamically discovered by this switch or those that are statically assigned to an interface on this switch. Web – Click IGMP Snooping, Multicast Router Port Information. Select the required VLAN ID from the scroll-down list to display the associated multicast routers.
Page 234: Specifying Static Interfaces For A Multicast Router
IGMP querier. Therefore, if the IGMP querier is a known multicast router/ switch connected over the network to an interface (port or trunk) on your switch, you can manually configure the interface (and a specified VLAN) to join all the current multicast groups supported by the attached router.
Page 235: Displaying Port Members Of Multicast Services
CLI – This example configures port 11 as a multicast router port within VLAN 1. Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11 3-282 Console(config)#exit Console#show ip igmp snooping mrouter vlan 1 VLAN M'cast Router Port Type ---- ------------------ ------- Eth 1/11 Static Displaying Port Members of Multicast Services You can display the port members associated with a specified VLAN and...
Page 236: Assigning Ports To Multicast Services
Query Parameters” on page 3-182. For certain applications that require tighter control, you may need to statically configure a multicast service on the switch. First add all the ports attached to participating hosts to a common VLAN, and then assign the multicast service to that VLAN group.
Page 237: Figure 3-84. Specifying Multicast Port Membership
Web – Click IGMP Snooping, IGMP Member Port Table. Specify the interface attached to a multicast service (via an IGMP-enabled switch or multicast router), indicate the VLAN that will propagate the multicast service, specify the multicast IP address, and click Add. After you have completed adding ports to the member list, click Apply.
Page 238: Configuring Domain Name Service
IP addresses using static table entries or by redirection to other name servers on the network. When a client device designates this switch as a DNS server, the client will attempt to resolve host names into IP addresses by forwarding DNS queries to the switch, and waiting for a response.
Page 239 • When an incomplete host name is received by the DNS server on this switch and a domain name list has been specified, the switch will work through the domain list, appending each domain name in the list to the host name, and checking with the specified name servers for a match.
Page 240: Figure 3-85. Configuring Dns
ONFIGURING THE WITCH Web – Select DNS, General Configuration. Set the default domain name or list of domain names, specify one or more name servers to use to use for address resolution, enable domain lookup status, and click Apply. 3-192 Figure 3-85.
Page 241: Configuring Static Dns Host To Address Entries
CLI - This example sets a default domain name and a domain list. However, remember that if a domain list is specified, the default domain name is not used. Console(config)#ip domain-name sample.com Console(config)#ip domain-list sample.com.uk Console(config)#ip domain-list sample.com.jp Console(config)#ip name-server 192.168.1.55 10.1.0.55 Console(config)#ip domain-lookup Console#show dns Domain Lookup Status:...
Page 242: Field Attributes
ONFIGURING THE WITCH Field Attributes • Host Name – Name of a host device that is mapped to one or more IP addresses. (Range: 1-64 characters) • IP Address – Internet address(es) associated with a host name. (Range: 1-8 addresses) •...
Page 243: Displaying The Dns Cache
Console(config)#ip host rd5 192.168.1.55 10.1.0.55 Console(config)#ip host rd6 10.1.0.55 Console#show host Hostname Inet address 10.1.0.55 192.168.1.55 Alias 1.rd6 Displaying the DNS Cache You can display entries in the DNS cache that have been learned via the designated name servers. Field Attributes •...
Page 244: Figure 3-87. Displaying The Dns Cache
ONFIGURING THE WITCH Web – Select DNS, Cache. Figure 3-87. Displaying the DNS Cache CLI - This example displays all the resource records learned from the designated name servers. Console#show dns cache FLAG www.microsoft.akadns.net www.microsoft.akadns.net www.microsoft.akadns.net www.microsoft.akadns.net www.microsoft.akadns.net www.passportimages.com Console# 3-196 TYPE CNAME...
Page 245: Command Line Interface
Using the Command Line Interface Accessing the CLI When accessing the management interface for the switch over a direct connection to the server’s console port, or via a Telnet connection, the switch can be managed by entering command keywords and parameters at the prompt.
Page 246: Telnet Connection
(1). Note: The IP address for this switch is unassigned by default. To access the switch through a Telnet session, you must first set the IP address for the switch, and set the default gateway if you are managing the switch from a different IP subnet.
Page 247 After you configure the switch with an IP address, you can open a Telnet session by performing these steps: 1. From the remote host, enter the Telnet command and the IP address of the device you want to access. 2. At the prompt, enter the user name and system password. The CLI will display the “Vty-0#”...
Page 248: Entering Commands
OMMAND NTERFACE Entering Commands This section describes how to enter CLI commands. Keywords and Arguments A CLI command is a series of keywords and arguments. Keywords identify a command, and arguments specify configuration parameters. For example, in the command “show interfaces status ethernet 1/5,” show interfaces and status are keywords, ethernet is an argument that specifies the interface type, and 1/5 specifies the unit/port.
Page 249: Command Completion
Command Completion If you terminate input with a Tab key, the CLI will print the remaining characters of a partial keyword up to the point of ambiguity. In the “logging history” example, typing log followed by a tab will result in printing the command up to “logging.”...
Page 250: Showing Commands
RADIUS server information The system configuration of running SNMP statistics Sntp Specify spanning-tree Secure shell The system configuration of starting up Information of system Login by tacacs server Display information about terminal lines System hardware and software status Switch VLAN Virtual Interface...
Page 251: Partial Keyword Lookup
The command “show interfaces ?” will display the following information: Console#show interfaces ? counters status switchport Console# Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided. (Remember not to leave a space between the command and question mark.) For example “s?”...
Page 252: Understanding Command Modes
You must be in Global Configuration mode to access any of the other configuration modes. Exec Commands When you open a new console session on the switch with the user name and password “guest,” the system enters the Normal Exec command mode (or guest mode), displaying the “Console>” command prompt.
Page 253: Configuration Commands
Configuration commands are privileged level commands used to modify switch settings. These commands modify the running configuration only and are not saved when the switch is rebooted. To store the running configuration in non-volatile storage, use the copy running-config startup-config command.
Page 254: Table 4-2. Configuration Commands
OMMAND NTERFACE • Interface Configuration - These commands modify the port configuration such as speed-duplex and negotiation. • Line Configuration - These commands modify the console port and Telnet configuration, and include command such as parity and databits. • VLAN Configuration - Includes the command to create VLAN groups.
Page 255: Mode Command
Mode Command VLAN vlan database MSTP spanning-tree mst-configuration For example, you can use the following commands to enter interface configuration mode, and then return to Privileged Exec mode. Console(config)#interface ethernet 1/5 Console(config-if)#exit Console(config)# Command Line Processing Commands are not case sensitive. You can abbreviate commands and parameters as long as they contain enough letters to differentiate them from any other currently available commands or parameters.
Page 256: Command Groups
CLI name, browser management options, and a variety of other system information Manages code image or switch configuration files Configures logon access using local or remote authentication; also configures port security and IEEE 802.1x port access control...
Page 257 Configures the address table for filtering specified addresses, displays current entries, clears the table, or sets the aging time Spanning Tree Configures Spanning Tree settings for the switch VLANs Configures VLAN settings, and defines port membership for VLAN groups; also enables or...
Page 258: Line Commands
OMMAND NTERFACE The access mode shown in the following tables is indicated by these abbreviations: NE (Normal Exec) PE (Privileged Exec) GC (Global Configuration) ACL (Access Control List Configuration) Line Commands You can access the onboard configuration program by attaching a VT100 compatible device to the server’s serial port.
Page 259: Line
Command stopbits* disconnect show line * These commands only apply to the serial port. line This command identifies a specific line for configuration, and to process subsequent line configuration commands. Syntax line {console | vty} • console - Console terminal line. •...
Page 260: Login
Command Mode Line Configuration Command Usage • There are three authentication modes provided by the switch itself at login: - login selects authentication by a single global password as specified by the password line configuration command. When using this method, the management interface starts in Normal Exec (NE) mode.
Page 261: Password
• This command controls login authentication via the switch itself. To configure user names and passwords for remote authentication servers, you must use the RADIUS or TACACS software installed on those servers. Example Console(config-line)#login local Console(config-line)# Related Commands username (4-35)
Page 262: Exec-Timeout
OMMAND NTERFACE • The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords.
Page 263: Password-Thresh
Example To set the timeout to two minutes, enter this command: Console(config-line)#exec-timeout 120 Console(config-line)# password-thresh This command sets the password intrusion threshold which limits the number of failed logon attempts. Use the no form to remove the threshold value. Syntax password-thresh [threshold] no password-thresh threshold - The number of allowed password attempts.
Page 264: Silent-Time
OMMAND NTERFACE Related Commands silent-time (4-20) silent-time This command sets the amount of time the management console is inaccessible after the number of unsuccessful logon attempts exceeds the threshold set by the password-thresh command. Use the no form to remove the silent time value. Syntax silent-time [seconds] no silent-time...
Page 265: Databits
databits This command sets the number of data bits per character that are interpreted and generated by the console port. Use the no form to restore the default value. Syntax databits {7 | 8} no databits • 7 - Seven data bits per character. •...
Page 266: Parity
OMMAND NTERFACE parity This command defines the generation of a parity bit. Use the no form to restore the default setting. Syntax parity {none | even | odd} no parity • none - No parity • even - Even parity •...
Page 267: Speed
Some baud rates available on devices connected to the port might not be supported. The system indicates if the speed you selected is not supported. If you select the “auto” option, the switch will automatically detect the baud rate configured on the attached terminal, and adjust the speed accordingly.
Page 268: Stopbits
OMMAND NTERFACE stopbits This command sets the number of the stop bits transmitted per byte. Use the no form to restore the default setting. Syntax stopbits {1 | 2} • 1 - One stop bit • 2 - Two stop bits Default Setting 1 stop bit Command Mode...
Page 269: Show Line
Example Console#disconnect 1 Console# Related Commands show ssh (4-55) show users (4-83) show line This command displays the terminal line’s parameters. Syntax show line [console | vty] • console - Console terminal line. • vty - Virtual terminal for remote console access (i.e., Telnet). Default Setting Shows all lines Command Mode...
Page 270: General Commands
OMMAND NTERFACE General Commands Command Function enable Activates privileged mode disable Returns to normal mode from privileged mode PE configure Activates global configuration mode show history Shows the command history buffer reload Restarts the system Returns to Privileged Exec mode exit Returns to the previous configuration mode, or exits the CLI...
Page 271: Disable
This command returns to Normal Exec mode from privileged mode. In normal access mode, you can only display basic information on the switch's configuration or Ethernet statistics. To gain access to all commands, you must use the privileged mode. (See “Understanding Command Modes”...
Page 272: Configure
This command activates Global Configuration mode. You must enter this mode to modify any settings on the switch. You must also enter Global Configuration mode prior to enabling some of the other configuration modes, including Interface Configuration, Line Configuration, VLAN Database Configuration, and Multiple Spanning Tree Configuration.
Page 273: Reload
Command Mode Normal Exec, Privileged Exec Command Usage The history buffer size is fixed at 10 Execution commands and 10 Configuration commands. Example In this example, the show history command lists the contents of the command history buffer: Console#show history Execution command history: 2 config 1 show history...
Page 274: End
None Command Mode Privileged Exec Command Usage This command resets the entire system. Example This example shows how to reset the switch: Console#reload System will be restarted, continue <y/n>? y This command returns to Privileged Exec mode. Default Setting None...
Page 275: Exit
exit This command returns to the previous configuration mode or exit the configuration program. Default Setting None Command Mode Example This example shows how to return to the Privileged Exec mode from the Global Configuration mode, and then quit the CLI session: Console(config)#exit Console#exit Press ENTER to start session...
Page 276: System Management Commands
Clock) System Status Frame Size 4-32 Function Configures information that uniquely identifies this switch Configures the basic user names and passwords for management access Configures IP addresses that are allowed management access Enables management access via a Web browser Provides secure replacement for Telnet...
Page 277: Device Designation Commands
Global Configuration Example Console(config)#prompt RD2 RD2(config)# YSTEM Function Customizes the prompt used in PE and NE mode Specifies the host name for the switch Sets the system contact string Sets the system location string ANAGEMENT OMMANDS Mode Page 4-33 4-34...
Page 278: Hostname
User Access Commands The basic commands required for management access are listed in this section. This switch also includes other options for password checking via the console or a Telnet connection (page 4-14), user authentication via a remote authentication server (page 4-93), and host access authentication for specific ports (page 4-104).
Page 279: Username
username This command adds named users, requires authentication at login, specifies or changes a user's password (or specify that no password is required), or specifies or changes a user's access level. Use the no form to remove a user name. Syntax username name {access-level level | no password | password {0 | 7} password}...
Page 280: Enable Password
OMMAND NTERFACE Command Usage The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords.
Page 281: Ip Filter Commands
Console(config)#enable password level 15 0 admin Console(config)# Related Commands enable (4-26) IP Filter Commands Command management show management Displays the switch to be monitored or YSTEM Table 4-10. IP Filter Commands Function Configures IP addresses that are allowed management access configured from a browser...
Page 282: Management
Global Configuration Command Usage • If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager.
Page 283: Show Management
Console(config)#management all-client 192.168.1.25 192.168.1.30 Console# show management This command displays the client IP addresses that are allowed management access to the switch through various protocols. Syntax show management {all-client | http-client | snmp-client | telnet-client} • all-client - Adds IP address(es) to the SNMP, Web and Telnet groups.
Page 284: Web Server Commands
End ip address 192.168.1.19 192.168.1.30 Table 4-11. Web Server Command Function Specifies the port to be used by the Web browser interface Allows the switch to be monitored or configured from a browser Enables HTTPS/SSL for encrypted communications Mode Page 4-41 4-41...
Page 285: Ip Http Port
ip http port This command specifies the TCP port number used by the Web browser interface. Use the no form to use the default port. Syntax ip http port port-number no ip http port port-number - The TCP port to be used by the browser interface. (Range: 1-65535) Default Setting Command Mode...
Page 286: Ip Http Secure-Server
This command enables the secure hypertext transfer protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s Web interface. Use the no form to disable this function. Syntax [no] ip http secure-server...
Page 287: Related Commands
• When you start HTTPS, the connection is established in this way: - The client authenticates the server using the server’s digital certificate. - The client and server negotiate a set of security protocols to use for the connection. - The client and server generate session keys for encrypting and decrypting data.
Page 288: Ip Http Secure-Port
OMMAND NTERFACE ip http secure-port This command specifies the UDP port number used for HTTPS/SSL connection to the switch’s Web interface. Use the no form to restore the default port. Syntax ip http secure-port port_number no ip http secure-port port_number – The UDP port used for HTTPS/SSL.
Page 289: Secure Shell Commands
Telnet. When a client contacts the switch via the SSH protocol, the switch uses a public-key that the client must match along with a local user name and password for access authentication. SSH also encrypts all data...
Page 290 4-94. If public key authentication is specified by the client, then you must configure authentication keys on both the client and the switch as described in the following section. Note that regardless of whether you use public key or password authentication, you still have to generate authentication keys on the switch and enable the SSH server.
Page 291 SSH server on the switch. 6. Configure Challenge-Response Authentication – When an SSH client attempts to contact the switch, the SSH server uses the host key pair to negotiate a session key and encryption method. Only clients that have a private key corresponding to the public keys stored on the switch can gain access.
Page 292: Ip Ssh Server
OMMAND NTERFACE 9. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. 10. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch.
Page 293: Ip Ssh Timeout
Global Configuration Command Usage The timeout specifies the interval the switch will wait for a response from the client during the SSH negotiation phase. Once an SSH session has been established, the timeout for user input is controlled by the exec-timeout command for vty sessions.
Page 294: Ip Ssh Authentication-Retries
OMMAND NTERFACE Related Commands exec-timeout (4-18) show ip ssh (4-54) ip ssh authentication-retries Use this command to configure the number of times the SSH server attempts to reauthenticate a user. Use the no form to restore the default setting. Syntax ip ssh authentication-retries count no ip ssh authentication-retries count –...
Page 295: Ip Ssh Server-Key Size
Command Mode Global Configuration Command Usage • The server key is a private key that is never shared outside the switch. • The host key is shared with the SSH client, and is fixed at 1024 bits. Example Console(config)#ip ssh server-key size 512...
Page 296: Ip Ssh Crypto Host-Key Generate
OMMAND NTERFACE Command Mode Privileged Exec Example Console#delete public-key admin dsa Console# ip ssh crypto host-key generate Use this command to generate the host key pair (i.e., public and private). Syntax ip ssh crypto host-key generate [dsa | rsa] • dsa – DSA key type. •...
Page 297: Ip Ssh Crypto Zeroize
Related Commands ip ssh crypto zeroize (4-53) ip ssh save host-key (4-54) ip ssh crypto zeroize Use this command to clear the host key from memory (i.e. RAM). Syntax ip ssh crypto zeroize [dsa | rsa] • dsa – DSA key type. •...
Page 298: Ip Ssh Save Host-Key
OMMAND NTERFACE ip ssh save host-key Use this command to save host key from RAM to flash memory. Syntax ip ssh save host-key [dsa | rsa] • dsa – DSA key type. • rsa – RSA key type. Default Setting Saves both the DSA and RSA key.
Page 299: Show Ssh
show ssh Use this command to display the current SSH server connections. Command Mode Privileged Exec Example Console#show ssh Connection Version State Console# Field Description Session The session number. (Range: 0-3) Version The Secure Shell version number. State The authentication negotiation state. (Values: Negotiation-Started, Authentication-Started, Session-Started) Username...
Page 300: Show Public-Key
OMMAND NTERFACE Field Description Encryption The encryption method is automatically negotiated between the client and server. Options for SSHv1.5 include: DES, 3DES Options for SSHv2.0 can include different algorithms for the client-to-server (ctos) and server-to-client (stoc): aes128-cbc-hmac-sha1 aes192-cbc-hmac-sha1 aes256-cbc-hmac-sha1 3des-cbc-hmac-sha1 blowfish-cbc-hmac-sha1 aes128-cbc-hmac-md5 aes192-cbc-hmac-md5...
Page 301: Default Setting
Default Setting Shows all public keys. Command Mode Privileged Exec Command Usage • If no parameters are entered, all keys are displayed. If the user keyword is entered, but no user name is specified, then the public keys for all users are displayed.
Page 302: Event Logging Commands
This command controls logging of error messages, sending debug or error messages to switch memory. The no form disables the logging process. Syntax [no] logging on Default Setting None Command Mode...
Page 303: Logging History
Related Commands logging history (4-59) clear logging (4-62) logging history This command limits syslog messages saved to switch memory based on severity. The no form returns the logging of syslog messages to the default level. Syntax logging history {flash | ram} level no logging history {flash | ram} •...
Page 304: Logging Host
OMMAND NTERFACE Name alerts emergencies * There are only Level 2, 5 and 6 error messages for the current firmware release. Default Setting Flash: errors (level 3 - 0) RAM: warnings (level 7 - 0) Command Mode Global Configuration Command Usage The message level specified for flash memory must be a higher priority (i.e., numerically lower) than that specified for RAM.
Page 305: Logging Facility
The command specifies the facility type tag sent in syslog messages. (See RFC 3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to sort messages or to store messages in the corresponding database.
Page 306: Logging Trap
OMMAND NTERFACE logging trap This command enables the logging of system messages to a remote server, or limits the syslog messages saved to a remote server based on severity. Use this command without a specified level to enable remote logging. Use the no form to disable remote logging.
Page 307: Show Logging
Command Mode Privileged Exec Example Console#clear logging Console# Related Commands show logging (4-63) show logging This command displays the logging configuration, along with any system and event messages stored in memory. Syntax show logging {flash | ram | sendmail | trap} •...
Page 308: L Ine I Nterface
OMMAND NTERFACE Console#show logging flash Syslog logging: Enable History logging in FLASH: level errors [0] 0:0:5 1/1/1 "PRI_MGR_InitDefault function fails." level: 3, module: 13, function: 0, and event no.: 0 Console#show logging ram Syslog logging: Enable History logging in RAM: level debugging [0] 0:0:5 1/1/1 PRI_MGR_InitDefault function fails."...
Page 309: Smtp Alert Commands
Field REMOTELOG level type REMOTELOG server IP address Related Commands show logging sendmail (4-69) SMTP Alert Commands Configures SMTP event handling, and forwarding of alert messages to the specified SMTP servers and email recipients. Command logging sendmail host Specifies SMTP servers that will be sent logging sendmail level logging sendmail...
Page 310: Logging Sendmail Host
• You can specify up to three SMTP servers for event handing. However, you must enter a separate command to specify each server. • To send email alerts, the switch first opens a connection, sends all the email alerts waiting in the queue one by one, and finally closes the connection.
Page 311: Logging Sendmail Level
logging sendmail level This command sets the severity threshold used to trigger alert messages. Syntax logging sendmail level level level - One of the system message levels (page 4-59). Messages sent include the selected level down to level 0. (Range: 0-7; Default: 7) Default Setting Level 7 Command Mode...
Page 312: Logging Sendmail Destination-Email
Command Mode Global Configuration Command Usage You may use an symbolic email address that identifies the switch, or the address of an administrator responsible for the switch. Example This example will send email alerts for system errors from level 3 through 0.
Page 313: Logging Sendmail
Example Console(config)#logging sendmail destination-email ted@this-company.com Console(config)# logging sendmail This command enables SMTP event handling. Use the no form to disable this function. Syntax [no] logging sendmail Default Setting Disabled Command Mode Global Configuration Example Console(config)#logging sendmail Console(config)# show logging sendmail This command displays the settings for the SMTP event handler.
Page 314: Time Commands
Accepts time from specified time servers Accepts time from any time broadcast server GC Shows current SNTP configuration settings Sets the time zone for the switch’s internal clock Sets the system date and time Displays the current date and time setting...
Page 315: Sntp Server
Global Configuration Command Usage This command specifies time servers from which the switch will poll for time updates when set to SNTP client mode. The client will poll the time servers in the order specified until a response is received. It issues time synchronization requests based on the interval set via the sntp poll command.
Page 316: Sntp Poll
OMMAND NTERFACE sntp poll This command sets the interval between sending time requests when the switch is set to SNTP client mode. Use the no form to restore to the default. Syntax sntp poll seconds no sntp poll seconds - Interval between time requests. (Range: 16-16384 seconds)
Page 317: Global Configuration
Command Usage • The time acquired from time servers is used to record accurate dates and times for log events. Without SNTP, the switch only records the time starting from the factory default set at the last bootup (e.g., 00:00:00, Jan. 1, 2001).
Page 318: Sntp Broadcast Client
Normal Exec, Privileged Exec Command Usage This command displays the current time, the poll interval used for sending time synchronization requests (when the switch is set to SNTP client mode), and the current SNTP mode (i.e., client or broadcast). Example...
Page 319: Clock Timezone
This command sets the time zone for the switch’s internal clock. Syntax clock timezone name hour hours minute minutes {before-utc | after-utc} • name - Name of timezone, usually an acronym. (Range: 1-29 characters) • hours - Number of hours before/after UTC. (Range: 1-12 hours) •...
Page 320: Calendar Set
NTERFACE calendar set This command sets the system clock. It may be used if there is no time server on your network, or if you have not configured the switch to receive signals from a time server. Syntax calendar set hour min sec {day month year | month day year} •...
Page 321: System Status Commands
Example Console#show calendar 15:12:34 February 1 2002 Console# System Status Commands Command show startup-config show running-config show system show users show version show startup-config This command displays the configuration file stored in non-volatile memory that is used to start up the system. Default Setting None Command Mode...
Page 322 OMMAND NTERFACE Command Usage • Use this command in conjunction with the show running-config command to compare the information in running memory to the information stored in non-volatile memory. • This command displays settings for key command modes. Each mode group is separated by “!”...
Page 323 Example Console#show startup-config building startup-config, please wait... username admin access-level 15 username admin password 0 admin username guest access-level 0 username guest password 0 guest enable password level 15 0 super snmp-server community public ro snmp-server community private rw vlan database vlan 1 name DefaultVlan media ethernet state active spanning-tree mst-configuration interface ethernet 1/1...
Page 324: Show Running-Config
OMMAND NTERFACE show running-config This command displays the configuration information currently in use. Default Setting None Command Mode Privileged Exec Command Usage • Use this command in conjunction with the show startup-config command to compare the information in running memory to the information stored in non-volatile memory.
Page 325 Example Console#show running-config building running-config, please wait... snmp-server community private rw snmp-server community public ro username admin access-level 15 username admin password 7 21232f297a57a5a743894a0e4a801fc3 username guest access-level 0 username guest password 7 084e0343a0486ff05530df6c705c8bb4 enable password level 15 7 1b3231655cebb7a1f783eddf27d254ca vlan database vlan 1 name DefaultVlan media ethernet state active spanning-tree mst-configuration interface ethernet 1/1...
Page 326: Show System
• The POST results should all display “PASS.” If any POST test indicates “FAIL,” contact your distributor for assistance. Example Console#show system System description: SMC Networks SMC8648T System OID string: 1.3.6.1.4.1.202.20.37 System information System Up time: 0 days, 2 hours, 3 minutes, and 47.49 seconds...
Page 327: Show Users
show users Shows all active console and Telnet sessions, including user name, idle time, and IP address of Telnet client. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The session used to execute this command is indicated by a “*” symbol next to the Line (i.e., session) index number.
Page 328: Jumbo Frame
OMMAND NTERFACE Command Usage See “Displaying Switch Hardware/Software Versions” on page 3-14 for detailed information on the items displayed by this command. Example Console#show version Unit1 Serial number Hardware version Number of ports Main power status Redundant power status :not present...
Page 329: Flash/File Commands
Command Usage • This switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields.
Page 330: Copy
This command moves (upload/download) a code image or configuration file between the switch’s flash memory and a TFTP server. When you save the system code or configuration settings to a file on a TFTP server, that file can later be downloaded to the switch to restore system operation. The success of the file transfer depends on the accessibility of the TFTP server and the quality of the network connection.
Page 331 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”) • Due to the size limit of the flash memory, the switch supports only two operation code files. • The maximum number of user-defined configuration files depends on available memory.
Page 332 OMMAND NTERFACE Example The following example shows how to upload the configuration settings to a file on the TFTP server: Console#copy file tftp Choose file type: 1. config: 2. opcode: <1-2>: 1 Source file name: startup TFTP server ip address: 10.1.0.99 Destination file name: startup.01 TFTP completed.
Page 333: Delete
This example shows how to copy a secure-site certificate from an TFTP server. It then reboots the switch to activate the certificate: Console#copy tftp https-certificate TFTP server ip address: 10.1.0.19 Source certificate file name: SS-certificate Source private file name: SS-private Private password: ******** Success.
Page 334: Dir
The type of file or image to display includes: • boot-rom - Boot ROM (or diagnostic) image file. • config - Switch configuration file. • opcode - Run-time operation code image file. • filename - Name of the file or image. If this file exists but contains errors, information on this file cannot be shown.
Page 335: Whichboot
Command Mode Privileged Exec Command Usage • If you enter the command dir without any parameters, the system displays all files. • File information is shown below: Column Heading file name file type startup size Example The following example shows how to display all file information. Console#dir -------------------------------- -------------- ------- ----------- Factory_Default_Config.cfg...
Page 336: Boot System
OMMAND NTERFACE Example This example shows the information displayed by the whichboot command. See the table under the dir command for a description of the file information displayed by this command. Console#whichboot file name ----------------- -------------- ------- ----------- diag_0060 Boot-Rom image run_0200 Operation Code startup Console#...
Page 337: Authentication Commands
(4-90) whichboot (4-91) Authentication Commands You can configure this switch to authenticate users logging into the system for management access using local or RADIUS authentication methods. You can also enable port-based authentication for network client access using IEEE 802.1x.
Page 338: Authentication Login
OMMAND NTERFACE authentication login This command defines the login authentication method and precedence. Use the no form to restore the default. Syntax authentication login {[local] [radius] [tacacs]} no authentication login • local - Use local password. • radius - Use RADIUS server password. •...
Page 339: Radius Client
RADIUS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch. Command radius-server host radius-server port...
Page 340: Radius-Server Port
OMMAND NTERFACE Default Setting 10.1.0.1 Command Mode Global Configuration Example Console(config)#radius-server host 192.168.1.25 Console(config)# radius-server port This command sets the RADIUS server network port. Use the no form to restore the default. Syntax radius-server port port_number no radius-server port port_number - RADIUS server UDP port used for authentication messages.
Page 341: Radius-Server Key
This command sets the number of retries. Use the no form to restore the default. Syntax radius-server retransmit number_of_retries no radius-server retransmit number_of_retries - Number of times the switch will try to authenticate logon access via the RADIUS server. (Range: 1 - 30) Default Setting UTHENTICATION OMMANDS...
Page 342: Radius-Server Timeout
RADIUS server. Use the no form to restore the default. Syntax radius-server timeout number_of_seconds no radius-server timeout number_of_seconds - Number of seconds the switch waits for a reply before resending a request. (Range: 1-65535) Default Setting Command Mode...
Page 343: Tacacs+ Client
TACACS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch. Command tacacs-server host tacacs-server port...
Page 344: Tacacs-Server Port
OMMAND NTERFACE Command Mode Global Configuration Example Console(config)#tacacs-server host 192.168.1.25 Console(config)# tacacs-server port This command specifies the TACACS+ server network port. Use the no form to restore the default. Syntax tacacs-server port port_number no tacacs-server port port_number - TACACS+ server TCP port used for authentication messages.
Page 345: Tacacs-Server Key
tacacs-server key This command sets the TACACS+ encryption key. Use the no form to restore the default. Syntax tacacs-server key key_string no tacacs-server key key_string - Encryption key used to authenticate logon access for the client. Do not use blank spaces in the string. (Maximum length: 20 characters) Default Setting None...
Page 346: Port Security Commands
OMMAND NTERFACE Port Security Commands These commands can be used to disable the learning function or manually specify secure addresses for a port. You may want to leave port security off for an initial training period (i.e., enable the learning function) to register all the current VLAN members on the selected port, and then enable port security to ensure that the port will drop any incoming frames with a source MAC address that is unknown or has been previously learned from...
Page 347 • To use port security, first allow the switch to dynamically learn the <source MAC address, VLAN> pair for frames received on a port for an initial training period, and then enable port security to stop address learning.
Page 348: 802.1X Port Authentication
(4-201) show mac-address-table (4-202) 802.1x Port Authentication The switch supports IEEE 802.1x (dot1x) port-based access control that prevents unauthorized access to the network by requiring users to first submit credentials for authentication. Client authentication is controlled centrally by a RADIUS server using EAP (Extensible Authentication Protocol).
Page 349: Authentication Dot1X Default
Example Console(config)#authentication dot1x default radius Console(config)# UTHENTICATION Function Sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client Sets the time period after which a connected client must be...
Page 350: Dot1X Default
Console(config)#dot1x default Console(config)# dot1x max-req This command sets the maximum number of times the switch port will retransmit an EAP request/identity packet to the client before it times out the authentication session. Use the no form to restore the default.
Page 351: Dot1X Port-Control
dot1x port-control This command sets the dot1x mode on a port interface. Use the no form to restore the default. Syntax dot1x port-control {auto | force-authorized | force-unauthorized} no dot1x port-control • auto – Requires a dot1x-aware connected client to be authorized by the RADIUS server.
Page 352: Dot1X Operation-Mode
OMMAND NTERFACE dot1x operation-mode This command allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. Use the no form with no keywords to restore the default to single host. Use the no form with the multi-host max-count keywords to restore the default maximum count.
Page 353: Dot1X Re-Authentication
Console(config)#dot1x re-authentication Console(config)# dot1x timeout quiet-period This command sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. Use the no form to reset the default. Syntax...
Page 354: Dot1X Timeout Re-Authperiod
Example Console(config)#dot1x timeout re-authperiod 300 Console(config)# dot1x timeout tx-period This command sets the time that the switch waits during an authentication session before re-transmitting an EAP packet. Use the no form to reset to the default value. Syntax dot1x timeout tx-period seconds no dot1x timeout tx-period seconds - The number of seconds.
Page 355: Show Dot1X
This command displays the following information: • Global 802.1X Parameters – Displays the global port access control parameters that can be configured for this switch as described in the preceding pages, including reauth-enabled (page 4-109), reauth-period (page 4-110), quiet-period (page 4-109), tx-period (page 4-110), and max-req (page 4-106).
Page 356 OMMAND NTERFACE • 802.1X Port Summary – Displays the port access control parameters for each interface, including the following items: - Status– Administrative state for port access control. - Mode– Dot1x port control mode (page 4-107). - Authorized– Authorization status (yes or n/a - not authorized). •...
Page 357: Table 4-20. Authentication Commands
Example Console#show dot1x Global 802.1X Parameters reauth-enabled: yes reauth-period: quiet-period: tx-period: supp-timeout: server-timeout: 30 reauth-max: max-req: 802.1X Port Summary Port Name Status disabled enabled 1/25 disabled 1/26 disabled 802.1X Port Details 802.1X is disabled on port 1 802.1X is enabled on port 1/2 Status Unauthorized Operation mode...
Page 358: Access Control List Commands
An ACL is a sequential list of permit or deny conditions that apply to IP addresses, MAC addresses, or other more specific criteria. This switch tests ingress or egress packets against the conditions in an ACL one by one. A packet will be accepted as soon as it matches a permit rule, or dropped as soon as it matches a deny rule.
Page 359 • The switch does not support the explicit “deny any any” rule for the egress IP ACL or the egress MAC ACLs. If these rules are included in an ACL, and you attempt to bind the ACL to an interface for egress checking, the bind operation will fail.
Page 360: Masks For Access Control Lists
Masks for Access Control Lists You can specify optional masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/filter packets matching the permit/deny rules specified in an ingress ACL. You can also configure up to seven user-defined masks for an ACL.
Page 361 Table 4-27. IP ACL Commands Command Function permit, deny Filters packets meeting the specified criteria, including source and destination IP address, TCP/UDP port number, protocol type, and TCP control code show ip access-list Displays the rules for configured IP ACLs access-list ip Accesses the IP Mask mode used to mask-precedence...
Page 362: Access-List Ip
OMMAND NTERFACE access-list ip This command adds an IP access list and enters configuration mode for standard or extended IP ACLs. Use the no form to remove the specified ACL. Syntax [no] access-list ip {standard | extended} acl_name • standard – Specifies an ACL that filters packets based on the source IP address.
Page 363: Permit, Deny (Standard Acl)
Related Commands permit, deny 4-119 ip access-group (4-129) show ip access-list (4-123) permit, deny (Standard ACL) This command adds a rule to a Standard IP ACL. The rule sets a filter condition for packets emanating from the specified source. Use the no form to remove a rule.
Page 364: Permit, Deny (Extended Acl)
OMMAND NTERFACE Example This example configures one permit rule for the specific address 10.1.1.21 and another rule for the address range 168.92.16.x – 168.92.31.x using a bitmask. Console(config-std-acl)#permit host 10.1.1.21 Console(config-std-acl)#permit 168.92.16.0 255.255.240.0 Console(config-std-acl)# Related Commands access-list ip (4-118) permit, deny (Extended ACL) This command adds a rule to an Extended IP ACL.
Page 365 • address-bitmask – Decimal number representing the address bits to match. • host – Keyword followed by a specific IP address. • precedence – IP precedence level. (Range: 0-7) • tos – Type of Service level. (Range: 0-15) • dscp – DSCP priority level. (Range: 0-64) •...
Page 366 OMMAND NTERFACE • The control-code bitmask is a decimal number (representing an equivalent bit mask) that is applied to the control code. Enter a decimal number, where the equivalent binary bit “1” means to match a bit and “0” means to ignore a bit. The following bits may be specified: - 1 (fin) –...
Page 367: Show Ip Access-List
Related Commands access-list ip (4-118) show ip access-list This command displays the rules for configured IP ACLs. Syntax show ip access-list {standard | extended} [acl_name] • standard – Specifies a standard IP ACL. • extended – Specifies an extended IP ACL. •...
Page 368 OMMAND NTERFACE Default Setting Default system mask: Filter inbound packets according to specified IP ACLs. Command Mode Global Configuration Command Usage • A mask can only be used by all ingress ACLs or all egress ACLs. • The precedence of the ACL rules applied to a packet is not determined by order of the rules, but instead by the order of the masks;...
Page 369: Mask (Ip Acl)
mask (IP ACL) This command defines a mask for IP ACLs. This mask defines the fields to check in the IP header. Use the no form to remove a mask. Syntax [no] mask [protocol] {any | host | source-bitmask} {any | host | destination-bitmask} [precedence] [tos] [dscp] [source-port [port-bitmask]] [destination-port [port-bitmask]] [control-flag [flag-bitmask]]...
Page 370: Command Usage
OMMAND NTERFACE Command Usage • Packets crossing a port are checked against all the rules in the ACL until a match is found. The order in which these packets are checked is determined by the mask, and not the order in which the ACL rules were entered.
Page 371: Table 4-26. Access Control List Commands
This shows how to create a standard ACL with an ingress mask to deny access to the IP host 171.69.198.102, and permit access to any others. Console(config)#access-list ip standard A2 Console(config-std-acl)#permit any Console(config-std-acl)#deny host 171.69.198.102 Console(config-std-acl)#end Console#show access-list IP standard access-list A2: deny host 171.69.198.102 permit any Console#configure...
Page 372: Show Access-List Ip Mask-Precedence
ACL. Note that once the ACL is bound to an interface (i.e., the ACL is active), the order in which the rules are displayed is determined by the associated mask. Switch(config)#access-list ip extended 6 Switch(config-ext-acl)#permit any any Switch(config-ext-acl)#deny tcp any any control-flag 2 2 Switch(config-ext-acl)#end Console#show access-list IP extended access-list A6: permit any any...
Page 373: Ip Access-Group
• If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. • You must configure a mask for an ACL rule before you can bind it to a port.
Page 374: Show Ip Access-Group
OMMAND NTERFACE Example Console(config)#int eth 1/25 Console(config-if)#ip access-group standard david in Console(config-if)# Related Commands show ip access-list (4-123) show ip access-group This command shows the ports assigned to IP ACLs. Command Mode Privileged Exec Example Console#show ip access-group Interface ethernet 1/25 IP standard access-list david Console# Related Commands...
Page 375 Default Setting None Command Mode Interface Configuration (Ethernet) Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown in the following table.
Page 376: Show Map Access-List Ip
OMMAND NTERFACE show map access-list ip This command shows the CoS value mapped to an IP ACL for the current interface. (The CoS value determines the output queue for packets matching an ACL rule.) Syntax show map access-list ip [interface] interface ethernet unit/port •...
Page 377: Match Access-List Ip
To specify the DSCP priority, use the set dscp keywords. Note that the IP frame header can include either the IP Precedence or DSCP priority type. • The precedence for priority mapping by this switch is IP Precedence or DSCP Priority, and then 802.1p priority. CCESS...
Page 378: Show Marking
OMMAND NTERFACE Example Console(config)#interface ethernet 1/12 Console(config-if)#match access-list ip bill set dscp 0 Console(config-if)# Related Commands show marking (4-134) show marking This command displays the current configuration for packet marking. Command Mode Privileged Exec Example Console#show marking Interface ethernet 1/12 match access-list IP bill set DSCP 0 match access-list MAC a set priority 0 Console#...
Page 379: Mac Acls
MAC ACLs Command access-list mac permit, deny show mac access-list Displays the rules for configured access-list mac mask-precedence mask show access-list mac mask-precedence mac access-group show mac access-group map access-list mac show map access-list match access-list mac Changes the 802.1p priority the show marking CCESS Table 4-28.
Page 380: Access-List Mac
OMMAND NTERFACE access-list mac This command adds a MAC access list and enters MAC ACL configuration mode. Use the no form to remove the specified ACL. Syntax [no] access-list mac acl_name acl_name – Name of the ACL. (Maximum length: 16 characters) Default Setting None Command Mode...
Page 381: Permit, Deny (Mac Acl)
permit, deny (MAC ACL) This command adds a rule to a MAC ACL. The rule filters packets matching a specified MAC source or destination address (i.e., physical layer address), or Ethernet protocol type. Use the no form to remove a rule. Syntax [no] {permit | deny}{any | host source | source address-bitmask} {any | host destination | destination address-bitmask}[vid vid vid-bitmask]...
Page 382: Related Commands
OMMAND NTERFACE • vid-bitmask* – VLAN bitmask. (Range: 1-4095) • protocol – A specific Ethernet protocol number. (Range: 600-fff hex.) • protocol-bitmask* – Protocol bitmask. (Range: 600-fff hex.) * For all bitmasks, “1” means care and “0” means ignore. Default Setting None Command Mode MAC ACL...
Page 383: Show Mac Access-List
show mac access-list This command displays the rules for configured MAC ACLs. Syntax show mac access-list [acl_name] acl_name – Name of the ACL. (Maximum length: 16 characters) Command Mode Privileged Exec Example Console#show mac access-list MAC access-list jerry: permit any host 00-e0-29-94-34-de ethertype 0800 Console# Related Commands permit, deny 4-137...
Page 384: Command Usage
OMMAND NTERFACE Command Usage • You must configure a mask for an ACL rule before you can bind it to a port or set the queue or frame priorities associated with the rule. • A mask can only be used by all ingress ACLs or all egress ACLs. •...
Page 385 • vid-bitmask – VLAN ID of rule must match this bitmask. • ethertype – Check the Ethernet type field. • ethertype-bitmask – Ethernet type of rule must match this bitmask. Default Setting None Command Mode MAC Mask Command Usage • Up to seven masks can be assigned to an ingress or egress ACL. •...
Page 386 OMMAND NTERFACE Example This example shows how to create an Ingress MAC ACL and bind it to a port. You can then see that the order of the rules have been changed by the mask. Console(config)#access-list mac M4 Console(config-mac-acl)#permit any any Console(config-mac-acl)#deny tagged-eth2 00-11-11-11-11-11 ff-ff-ff-ff-ff-ff any vid 3 Console(config-mac-acl)#end...
Page 387: Show Access-List Mac Mask-Precedence
This example creates an Egress MAC ACL. Console(config)#access-list mac M5 Console(config-mac-acl)#deny tagged-802.3 host 00-11-11-11-11-11 any Console(config-mac-acl)#deny tagged-eth2 00-11-11-11-11-11 ff-ff-ff-ff-ff-ff any vid 3 ethertype 0806 Console(config-mac-acl)#end Console#show access-list MAC access-list M5: deny tagged-802.3 host 00-11-11-11-11-11 any deny tagged-eth2 host 00-11-11-11-11-11 any vid 3 ethertype 0806 Console(config)#access-list mac mask-precedence out Console(config-mac-mask-acl)#mask pktformat ff-ff-ff-ff-ff-ff any Console(config-mac-mask-acl)#exit...
Page 388: Mac Access-Group
• A port can only be bound to one ACL. • If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. Example...
Page 389: Show Mac Access-Group
show mac access-group This command shows the ports assigned to MAC ACLs. Command Mode Privileged Exec Example Console#show mac access-group Interface ethernet 1/5 MAC access-list M5 out Console# Related Commands mac access-group (4-144) map access-list mac This command sets the output queue for packets matching an ACL rule. The specified CoS value is only used to map the matching packet to an output queue;...
Page 390: Show Map Access-List Mac
OMMAND NTERFACE Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown below. Priority Queue Example...
Page 391: Match Access-List Mac
Example Console#show map access-list mac Access-list to COS of Eth 1/5 Access-list M5 cos 0 Console# Related Commands map access-list mac (4-145) match access-list mac This command changes the IEEE 802.1p priority of a Layer 2 frame matching the defined ACL rule. (This feature is commonly referred to as ACL packet marking.) Use the no form to remove the ACL marker.
Page 392: Show Access-List
OMMAND NTERFACE Related Commands show marking (4-134) ACL Information Command show access-list show access-group show access-list This command shows all ACLs and associated rules, as well as all the user-defined masks. Command Mode Privileged Exec Command Usage Once the ACL is bound to an interface (i.e., the ACL is active), the order in which the rules are displayed is determined by the associated mask.
Page 393: Table 4-30. Snmp Commands
Interface ethernet 1/25 IP standard access-list david MAC access-list jerry Console# SNMP Commands Control access to this switch from management stations using the Simple Network Management Protocol (SNMP), as well as the error types sent to trap managers. Command snmp community...
Page 394: Snmp Community
OMMAND NTERFACE snmp community This command defines the community access string for the Simple Network Management Protocol. Use the no form to remove the specified community string. Syntax snmp community string [ro|rw] no snmp community string • string - Community string that acts like a password and permits access to the SNMP protocol.
Page 395: Snmp Contact
snmp contact This command sets the system contact string. Use the no form to remove the system contact information. Syntax snmp contact string no snmp contact string - String that describes the system contact information. (Maximum length: 255 characters) Default Setting None Command Mode Global Configuration...
Page 396: Snmp Host
OMMAND NTERFACE Command Mode Global Configuration Example Console(config)#snmp location WC-19 Console(config)# Related Commands snmp contact (4-151) snmp host This command specifies the recipient of a Simple Network Management Protocol notification operation. Use the no form to remove the specified host. Syntax snmp host host-addr community-string [version {1 | 2c}] no snmp host host-addr...
Page 397: Command Usage
For example, some notification types are always enabled. • The switch can send SNMP version 1 or version 2c notifications to a host IP address, depending on the SNMP version that the management station supports. If the snmp-server host command does not specify the SNMP version, the default is to send SNMP version 1 notifications.
Page 398: Snmp Enable Traps
OMMAND NTERFACE snmp enable traps This command enables this device to send Simple Network Management Protocol traps (SNMP notifications). Use the no form to disable SNMP notifications. Syntax [no] snmp enable traps [authentication | link-up-down] • authentication - Keyword to issue authentication failure traps. •...
Page 399: Show Snmp
Related Commands snmp host (4-152) show snmp This command checks the status of SNMP communications. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage This command provides information on the community access strings, counter information for SNMP input and output protocol data units, and whether or not SNMP logging has been enabled with the snmp enable traps command.
Page 400 OMMAND NTERFACE Example Console#show snmp System Contact: Paul System Location: WC-19 SNMP traps: Authentication: enable Link-up-down: enable SNMP communities: 1. alpha, and the privilege is read-write 2. private, and the privilege is read-write 3. public, and the privilege is read-only 328 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name...
Page 401: Dns Commands
DNS Commands These commands are used to configure Domain Naming System (DNS) services. You can manually configure entries in the DNS domain name to IP address mapping table, configure default domain names, or specify one or more name servers to use for domain name to address translation. Note that domain name services will not be enabled until at least one name server is specified with the ip name-server command and domain lookup is enabled with the ip domain-lookup command...
Page 402: Ip Host
OMMAND NTERFACE ip host This command creates a static entry in the DNS table that maps a host name to an IP address. Use the no form to remove an entry. Syntax [no] ip host name address1 [address2 … address8] •...
Page 403: Clear Host
clear host This command deletes entries from the DNS table. Syntax clear host {name | *} • name - Name of the host. (Range: 1-64 characters) • * - Removes all entries. Default Setting None Command Mode Privileged Exec Example This example clears all static entries from the DNS table.
Page 404: Ip Domain-List
OMMAND NTERFACE Command Mode Global Configuration Example Console(config)#ip domain-name sample.com Console(config)#end Console#show dns Domain Lookup Status: DNS disabled Default Domain Name: sample.com Domain Name List: Name Server List: Console# Related Commands ip domain-list (4-160) ip name-server (4-162) ip domain-lookup (4-163) ip domain-list This command defines a list of domain names that can be appended to incomplete host names (i.e., host names passed from a client that are not...
Page 405 • Domain names are added to the end of the list one at a time. • When an incomplete host name is received by the DNS server on this switch, it will work through the domain list, appending each domain name in the list to the host name, and checking with the specified name servers for a match.
Page 406: Ip Name-Server
OMMAND NTERFACE ip name-server This command specifies the address of one or more domain name servers to use for name-to-address resolution. Use the no form to remove a name server from this list. Syntax [no] ip name-server server-address1 [server-address2 … server-address6] •...
Page 407: Ip Domain-Lookup
Related Commands ip domain-name (4-159) ip domain-lookup (4-163) ip domain-lookup This command enables DNS host name-to-address translation. Use the no form to disable DNS. Syntax [no] ip domain-lookup Default Setting Disabled Command Mode Global Configuration Command Usage • At least one name server must be specified before you can enable DNS. •...
Page 408: Show Hosts
OMMAND NTERFACE Related Commands ip domain-name (4-159) ip name-server (4-162) show hosts This command displays the static host name-to-address mapping table. Command Mode Privileged Exec Example Note that a host name will be displayed as an alias if it is mapped to the same address(es) as a previously configured entry.
Page 409: Show Dns
show dns This command displays the configuration of the DNS server. Command Mode Privileged Exec Example Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: sample.com Domain Name List: sample.com.jp sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# show dns cache This command displays entries in the DNS cache.
Page 410: Clear Dns Cache
OMMAND NTERFACE Field FLAG TYPE DOMAIN clear dns cache This command clears all entries in the DNS cache. Command Mode Privileged Exec Example Console#clear dns cache Console#show dns cache FLAG Console# 4-166 Description The entry number for each resource record. The flag is always “4”...
Page 411 DNS C OMMANDS 4-167...
Page 412: Interface Commands
OMMAND NTERFACE Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN. Command interface description speed-duplex negotiation capabilities flowcontrol combo-forced-mode shutdown switchport broadcast packet-rate clear counters show interfaces status Displays status for the specified show interfaces counters show interfaces...
Page 413: Interface
interface This command configures an interface type and enter interface configuration mode. Use the no form to remove a trunk. Syntax interface interface no interface port-channel channel-id • interface - ethernet unit/port - unit - This is device 1. - port - Port number. •...
Page 414: Speed-Duplex
OMMAND NTERFACE Default Setting None Command Mode Interface Configuration (Ethernet, Port Channel) Example The following example adds a description to port 24. Console(config)#interface ethernet 1/24 Console(config-if)#description RD-SW#3 Console(config-if)# speed-duplex This command configures the speed and duplex mode of a given interface when autonegotiation is disabled.
Page 415: Negotiation
Command Usage • To force operation to the speed and duplex mode specified in a speed-duplex command, use the no negotiation command to disable auto-negotiation on the selected interface. • When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command. To set the speed/duplex mode under auto-negotiation, the required mode must be specified in the capabilities list for an interface.
Page 416 OMMAND NTERFACE Command Usage • When auto-negotiation is enabled the switch will negotiate the best settings for a link based on the capabilities command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands.
Page 417: Capabilities
Command Usage When auto-negotiation is enabled with the negotiation command, the switch will negotiate the best settings for a link based on the capabilites command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands.
Page 418: Flowcontrol
Command Usage • Flow control can eliminate frame loss by “blocking” traffic from end stations or segments connected directly to the switch when its buffers fill. When enabled, back pressure is used for half-duplex operation and IEEE 802.3x for full-duplex operation.
Page 419: Combo-Forced-Mode
• When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command. To enable flow control under auto-negotiation, “flowcontrol” must be included in the capabilities list for any port • Avoid using flow control on a port connected to a hub unless it is actually required to solve a problem.
Page 420: Shutdown
NTERFACE Default Setting sfp-preferred-auto Command Mode Interface Configuration (Ethernet) Example This forces the switch to use the built-in RJ-45 port for the combination port 21. Console(config)#interface ethernet 1/21 Console(config-if)#combo-forced-mode copper-forced Console(config-if)# shutdown This command disables an interface. To restart a disabled interface, use the no form.
Page 421: Switchport Broadcast Packet-Rate
• This command can enable or disable broadcast storm control for the selected interface. However, the specified threshold value applies to all ports on the switch. Example The following shows how to configure broadcast storm control at 600...
Page 422: Clear Counters
OMMAND NTERFACE clear counters This command clears statistics on an interface. Syntax clear counters interface interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) Default Setting None Command Mode Privileged Exec Command Usage Statistics are only initialized for a power reset.
Page 423: Show Interfaces Status
show interfaces status This command displays the status for an interface. Syntax show interfaces status [interface] • interface - ethernet unit/port - unit - This is device 1. - port - Port number. - port-channel channel-id (Range: 1-6) - vlan vlan-id (Range: 1-4094) Default Setting Shows the status for all interfaces.
Page 424: Show Interfaces Counters
OMMAND NTERFACE Example Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: 1000T Mac address: 00-00-AB-CD-00-01 Configuration: Name: Port admin: Up Speed-duplex: Auto Capabilities: 10half, 10full, 100half, 100full, 1000full, Broadcast storm: Enabled Broadcast storm limit: 500 packets/second Flow control: Disabled Lacp: Disabled Port security: Disabled...
Page 425: Table 4-32. Interface Commands
Command Mode Normal Exec, Privileged Exec Command Usage If no interface is specified, information on all interfaces is displayed. For a description of the items displayed by this command, see “Showing Port Statistics” on page 3-106. Example Console#show interfaces counters ethernet 1/7 Ethernet 1/7 Iftable stats: Octets input: 30658, Octets output: 196550...
Page 426: Show Interfaces Switchport
OMMAND NTERFACE show interfaces switchport This command displays the administrative and operational status of the specified interfaces. Syntax show interfaces switchport [interface] • interface - ethernet unit/port - unit - This is device 1. - port - Port number. - port-channel channel-id (Range: 1-6) Default Setting Shows all interfaces.
Page 427 Field Description Broadcast threshold Shows if broadcast storm suppression is enabled or disabled; if enabled it also shows the threshold level (page 4-176). Lacp status Shows if Link Aggregation Control Protocol has been enabled or disabled (page 4-190). Ingress/Egress rate Shows if rate limiting is enabled, and the current rate limit.
Page 428: Mirror Port Commands
[rx | tx | both] no port monitor interface • interface - ethernet unit/port (source port) - unit - Switch (unit 1). - port - Port number. • rx - Mirror received packets. • tx - Mirror transmitted packets.
Page 429: Show Port Monitor
However, you should avoid sending too much traffic to the destination port from multiple source ports. Example The following example configures the switch to mirror all packets from port 6 to 11. Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 both...
Page 430: Rate Limit Commands
OMMAND NTERFACE Command Usage This command displays the currently configured source port, destination port, and mirror mode (i.e., RX, TX, RX/TX). Example The following shows mirroring configured from port 6 to port 11. Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 Console(config-if)#end Console#show port monitor Port Mirroring...
Page 431: Rate-Limit
rate-limit This command defines the rate limit for a specific interface. Use this command without specifying a rate to restore the default rate. Use the no form to restore the default status of disabled. Syntax rate-limit {input | output} [rate] no rate-limit {input | output} •...
Page 432: Link Aggregation Commands
For static trunks, the switches have to comply with the Cisco EtherChannel standard. For dynamic trunks, the switches have to comply with LACP. This switch supports up to six trunks. For example, a trunk consisting of two 1000 Mbps ports can support an aggregate bandwidth of 4 Gbps when operating at full duplex.
Page 433 Guidelines for Creating Trunks General Guidelines • Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • A trunk can have up to eight ports. • The ports at both ends of a connection must be configured as trunk ports.
Page 434: Channel-Group
• When configuring static trunks, the switches must comply with the Cisco EtherChannel standard. • Use no channel-group to remove a port group from a trunk. • Use no interfaces port-channel to remove a trunk from the switch. Example The following example creates trunk 1 and then adds port 11.
Page 435: Lacp
• A trunk formed with another switch using LACP will automatically be assigned the next available port-channel ID. • If the target switch has also enabled LACP on the connected ports, the trunk will be activated automatically. • If more than four ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails.
Page 436 OMMAND NTERFACE Example The following shows LACP enabled on ports 11-13. Because LACP has also been enabled on the ports at the other end of the links, the show interfaces status port-channel 1 command shows that Trunk1 has been established. Console(config)#interface ethernet 1/11 Console(config-if)#lacp Console(config-if)#exit...
Page 437: Lacp System-Priority
• Port must be configured with the same system priority to join the same LAG. • System priority is combined with the switch’s MAC address to form the LAG identifier. This identifier is used to indicate a specific LAG during LACP negotiations with other systems.
Page 438: Lacp Admin-Key (Ethernet Interface)
OMMAND NTERFACE lacp admin-key (Ethernet Interface) This command configures a port's LACP administration key. Use the no form to restore the default setting. Syntax lacp {actor | partner} admin-key key [no] lacp {actor | partner} admin-key • actor - The local side an aggregate link. •...
Page 439: Lacp Admin-Key (Port Channel)
Syntax lacp admin-key key [no] lacp admin-key key - The port channel admin key is used to identify a specific link aggregation group (LAG) during local LACP setup on this switch. (Range: 0-65535) Default Setting Command Mode Interface Configuration (Port Channel) Command Usage •...
Page 440: Lacp Port-Priority
OMMAND NTERFACE Example Console(config)#interface port channel 1 Console(config-if)#lacp admin-key 3 Console(config-if)# lacp port-priority This command configures LACP port priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} port-priority priority no lacp {actor | partner} port-priority •...
Page 441: Show Lacp
Example Console(config)#interface ethernet 1/5 Console(config-if)#lacp actor port-priority 128 show lacp This command displays LACP information. Syntax show lacp [port-channel] {counters | internal | neighbors | sys-id} • port-channel - Local identifier for a link aggregation group. (Range: 1-6) • counters - Statistics for LACP protocol messages. •...
Page 442 OMMAND NTERFACE Field LACPDUs Sent LACPDUs Received Number of valid LACPDUs received on this channel Marker Sent Marker Received LACPDUs Unknown Pkts LACPDUs Illegal Pkts Number of frames that carry the Slow Protocols Ethernet Console#show lacp internal Channel group : 1 ------------------------------------------------------------------- Oper Key : 4 Admin Key : 0...
Page 443 Field Description LACPDUs Number of seconds before invalidating received LACPDU Internal information. LACP System LACP system priority assigned to this port channel. Priority LACP Port LACP port priority assigned to this interface within the Priority channel group. Admin State, Administrative or operational values of the actor’s state parameters: Oper State •...
Page 444 OMMAND NTERFACE Console#show lacp 1 neighbors Channel group 1 neighbors ------------------------------------------------------------------- Eth 1/1 ------------------------------------------------------------------- Partner Admin System ID : 32768, 00-00-00-00-00-00 Partner Oper System ID : 32768, 00-00-00-00-00-01 Partner Admin Port Number : 1 Partner Oper Port Number : 1 Port Admin Priority : 32768 Port Oper Priority : 32768 Admin Key : 0...
Page 445: Address Table Commands
32768 32768 32768 32768 32768 Description A link aggregation group configured on this switch. LACP system priority for this channel group. Table 4-36. Adress Table Commands Function Maps a static address to a port in a VLAN Removes any learned entries...
Page 446: Mac-Address-Table Static
- port-channel channel-id (Range: 1-6) • vlan-id - VLAN ID (Range: 1-4094) • action - delete-on-reset - Assignment lasts until the switch is reset. - permanent - Assignment is permanent. Default Setting No static addresses are defined. The default mode is permanent.
Page 447: Clear Mac-Address-Table Dynamic
Example Console(config)#mac-address-table static 00-e0-29-94-34-de interface ethernet 1/1 vlan 1 delete-on-reset clear mac-address-table dynamic This command removes any learned entries from the forwarding database and clears the transmit and receive counts for any static or system configured entries. Default Setting None Command Mode Privileged Exec Example...
Page 448: Mac-Address-Table Aging-Time
OMMAND NTERFACE Default Setting None Command Mode Privileged Exec Command Usage • The MAC Address Table contains the MAC addresses associated with each interface. Note that the Type field may include the following types: - Learned - Dynamic address entries - Permanent - Static entry - Delete-on-reset - Static entry to be deleted when system is reset •...
Page 449: Show Mac-Address-Table Aging-Time
Default Setting 300 seconds Command Mode Global Configuration Command Usage The aging time is used to age out dynamically learned forwarding information. Example Console(config)#mac-address-table aging-time 100 Console(config)# show mac-address-table aging-time This command shows the aging time for entries in the address table. Default Setting None Command Mode...
Page 450: Spanning Tree Commands
OMMAND NTERFACE Spanning Tree Commands This section includes commands that configure the Spanning Tree Algorithm (STA) globally for the switch, and commands that configure STA for the selected interface. Command spanning-tree spanning-tree mode spanning-tree forward-time spanning-tree hello-time Configures the spanning tree bridge...
Page 451: Spanning-Tree
This command enables the Spanning Tree Algorithm globally for the switch. Use the no form to disable it. Syntax [no] spanning-tree Default Setting Spanning tree is enabled. Table 4-37. Spanning Tree Commands...
Page 452: Spanning-Tree Mode
This example shows how to enable the Spanning Tree Algorithm for the switch. Console(config)#spanning-tree Console(config)# spanning-tree mode This command selects the spanning tree mode for this switch. Use the no form to restore the default. Syntax spanning-tree mode {stp | rstp | mstp} no spanning-tree mode •...
Page 453: Command Usage
RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU after a port’s migration delay timer expires, the switch assumes that it is connected to an 802.1D bridge and starts using only 802.1D BPDUs.
Page 454: Spanning-Tree Forward-Time
OMMAND NTERFACE Example The following example configures the switch to use Rapid Spanning Tree. Console(config)#spanning-tree mode rstp Console(config)# spanning-tree forward-time This command configures the spanning tree bridge forward time globally for this switch. Use the no form to restore the default.
Page 455: Spanning-Tree Hello-Time
Console(config)#spanning-tree hello-time 5 Console(config)# spanning-tree max-age This command configures the spanning tree bridge maximum age globally for this switch. Use the no form to restore the default. Syntax spanning-tree max-age seconds no spanning-tree max-age seconds - Time in seconds. (Range: 6-40 seconds) The minimum value is the higher of 6 or [2 x (hello-time + 1)].
Page 456: Spanning-Tree Priority
Console(config)#spanning-tree max-age 40 Console(config)# spanning-tree priority This command configures the spanning tree priority globally for this switch. Use the no form to restore the default. Syntax spanning-tree priority priority no spanning-tree priority priority - Priority of the bridge. (Range: 0 - 65535) (Range –...
Page 457: Spanning-Tree Pathcost Method
Command Usage Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device. Example Console(config)#spanning-tree priority 40000 Console(config)#...
Page 458: Spanning-Tree Transmission-Limit
Console(config)#spanning-tree transmission-limit 4 Console(config)# spanning-tree mst-configuration Use this command to change to Multiple Spanning Tree (MST) configuration mode. Default Setting • No VLANs are mapped to any MST instance. • The region name is set the switch’s MAC address. 4-213...
Page 459: Related Commands
Command Mode Global Configuration Example Console(config)#spanning-tree mst configuration Console(config-mstp)# Related Commands mst vlan (4 -214) mst priority (4 -215) name (4 -216) revision (4 -217) max-hops (4 -218) mst vlan This command adds VLANs to a spanning tree instance. Use the no form to remove the specified VLANs.
Page 460: Mst Priority
• By default all VLANs are assigned to the Internal Spanning Tree (MSTI 0) that connects all bridges and LANs within the MST region. This switch supports up to 58 instances. You should try to group VLANs which cover the same general area of your network. However,...
Page 461: Name
However, if all devices have the same priority, the device with the lowest MAC address will then become the root device. • You can set this switch to act as the MSTI root device by specifying a priority of 0, or as the MSTI alternate device by specifying a priority of 16384.
Page 462: Revision
The MST region name and revision number (page 4-217) are used to designate a unique MST region. A bridge (i.e., spanning-tree compliant device such as this switch) can only belong to one MST region. And all bridges in the same region must be configured with the same MST instances.
Page 463: Max-Hops
Example Console(config-mstp)#revision 1 Console(config-mstp)# Related Commands name (4 -216) max-hops This command configures the maximum number of hops in the region before a BPDU is discarded. Use the no form to restore the default. Syntax max-hops hop-number hop-number - Maximum hop number for multiple spanning tree.
Page 464: Spanning-Tree Spanning-Disabled
OMMAND NTERFACE spanning-tree spanning-disabled This command disables the spanning tree algorithm for the specified interface. Use the no form to reenable the spanning tree algorithm for the specified interface. Syntax [no] spanning-tree spanning-disabled Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel) Example This example disables the spanning tree algorithm for port 5.
Page 465: Spanning-Tree Port-Priority
Default Setting • Ethernet – half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 • Fast Ethernet – half duplex: 200,000; full duplex: 100,000; trunk: 50,000 • Gigabit Ethernet – full duplex: 10,000; trunk: 5,000 Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage •...
Page 466: Spanning-Tree Edge-Port
• This command defines the priority for the use of a port in the Spanning Tree Algorithm. If the path cost for all ports on a switch are the same, the port with the highest priority (that is, lowest value) will be configured as an active link in the spanning tree.
Page 467: Spanning-Tree Portfast
Command Usage • You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.
Page 468: Spanning-Tree Link-Type
OMMAND NTERFACE Command Usage • This command is used to enable/disable the fast spanning-tree mode for the selected port. In this mode, ports skip the Discarding and Learning states, and proceed straight to Forwarding. • Since end-nodes cannot cause forwarding loops, they can be passed through the spanning tree state changes more quickly than allowed by standard convergence time.
Page 469: Spanning-Tree Mst Cost
• When automatic detection is selected, the switch derives the link type from the duplex mode. A full-duplex interface is considered a point-to-point link, while a half-duplex interface is assumed to be on a shared link.
Page 470 OMMAND NTERFACE Default Setting • Ethernet – half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 • Fast Ethernet – half duplex: 200,000; full duplex: 100,000; trunk: 50,000 • Gigabit Ethernet – full duplex: 10,000; trunk: 5,000 Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage •...
Page 471: Spanning-Tree Mst Port-Priority
Command Usage • This command defines the priority for the use of an interface in the multiple spanning-tree. If the path cost for all interfaces on a switch are the same, the interface with the highest priority (that is, lowest value) will be configured as an active link in the spanning tree.
Page 472: Spanning-Tree Protocol-Migration
Command Mode Privileged Exec Command Usage If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the spanning-tree protocol-migration command at any time to manually re-check the appropriate BPDU format to send on the selected interfaces (i.e., RSTP or STP-compatible).
Page 473: Show Spanning-Tree
Command Usage • Use the show spanning-tree command with no parameters to display the spanning tree configuration for the switch for the Common Spanning Tree (CST) and for every interface in the tree. • Use the show spanning-tree interface command to display the spanning tree configuration for an interface within the Common Spanning Tree (CST).
Page 474 OMMAND NTERFACE Example Console#show spanning-tree Spanning-tree information --------------------------------------------------------------- Spanning-tree information --------------------------------------------------------------- Spanning tree mode Spanning tree enable/disable Instance Vlans configuration Priority Bridge Hello Time (sec.) Bridge Max Age (sec.) Bridge Forward Delay (sec.) Root Hello Time (sec.) Root Max Age (sec.) Root Forward Delay (sec.) Max hops Remaining hops...
Page 475: Show Spanning-Tree Mst Configuration
show spanning-tree mst configuration This command shows the multiple spanning tree configuration. Syntax show spanning-tree mst configuration Command Mode Privileged Exec Example Console#show spanning-tree mst configuration Mstp Configuration Information -------------------------------------------------------------- Configuration name:XSTP REGION 0 Revision level:0 Instance Vlans -------------------------------------------------------------- Console# PANNING OMMANDS 4-230...
Page 476: Vlan Commands
OMMAND NTERFACE VLAN Commands A VLAN is a group of ports that can be located anywhere in the network, but communicate as though they belong to the same physical segment. This section describes commands used to create VLAN groups, add port members, specify how VLAN tagging is used, and enable automatic VLAN registration for the selected interface.
Page 477: Vlan Database
vlan database This command enters VLAN database mode. All commands in this mode will take effect immediately. Default Setting None Command Mode Global Configuration Command Usage • Use the VLAN database command mode to add, change, and delete VLANs. After finishing configuration changes, you can display the VLAN settings by entering the show vlan command.
Page 478: Vlan
• no vlan vlan-id deletes the VLAN. • no vlan vlan-id name removes the VLAN name. • no vlan vlan-id state returns the VLAN to the default state (i.e., active). • You can configure up to 255 VLANs on the switch. 4-233...
Page 479: Interface Vlan
Example The following example adds a VLAN, using VLAN ID 105 and name RD5. The VLAN is activated by default. Console(config)#vlan database Console(config-vlan)#vlan 105 name RD5 media ethernet Console(config-vlan)# Related Commands show vlan (4 -242) Configuring VLAN Interfaces Table 4-40. Configuring VLAN Interfaces Command interface vlan switchport mode...
Page 480: Interface Vlan
OMMAND NTERFACE interface vlan This command enters interface configuration mode for VLANs, which is used to configure VLAN parameters for a physical interface. Syntax interface vlan vlan-id vlan-id - ID of the configured VLAN. (Range: 1-4094, no leading zeroes) Default Setting None Command Mode Global Configuration...
Page 481: Switchport Mode
switchport mode This command configures the VLAN membership mode for a port. Use the no form to restore the default. Syntax switchport mode {trunk | hybrid} no switchport mode • trunk - Specifies a port as an end-point for a VLAN trunk. A trunk is a direct link between two switches, so the port transmits tagged frames that identify the source VLAN.
Page 482: Switchport Acceptable-Frame-Types
OMMAND NTERFACE switchport acceptable-frame-types This command configures the acceptable frame types for a port. Use the no form to restore the default. Syntax switchport acceptable-frame-types {all | tagged} no switchport acceptable-frame-types • all - The port accepts all frames, tagged or untagged. •...
Page 483: Switchport Ingress-Filtering
switchport ingress-filtering This command enables ingress filtering for an interface. Use the no form to restore the default. Syntax [no] switchport ingress-filtering Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Ingress filtering only affects tagged frames. •...
Page 484: Switchport Native Vlan
OMMAND NTERFACE switchport native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no form to restore the default. Syntax switchport native vlan vlan-id no switchport native vlan vlan-id - Default VLAN ID for a port. (Range: 1-4094, no leading zeroes) Default Setting VLAN 1...
Page 485: Switchport Allowed Vlan
VLAN groups as a tagged member. • Frames are always tagged within the switch. The tagged/untagged parameter used when adding a VLAN to an interface tells the switch whether to keep or remove the tag from a frame on egress.
Page 486: Switchport Forbidden Vlan
OMMAND NTERFACE • If a VLAN on the forbidden list for an interface is manually added to that interface, the VLAN is automatically removed from the forbidden list for that interface. Example The following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as tagged VLANs for port 1.
Page 487: Displaying Vlan Information
Example The following example shows how to prevent port 1 from being added to VLAN 3. Console(config)#interface ethernet 1/1 Console(config-if)#switchport forbidden vlan add 3 Console(config-if)# Displaying VLAN Information Table 4-41. Displaying VLAN Information Command show vlan show interfaces status vlan show interfaces switchport show vlan...
Page 488: Configuring Protocol-Based Vlans
VLANs, including security and easy accessibility. To avoid these problems, you can configure this switch with protocol-based VLANs that divide the physical network into logical VLAN groups for each required protocol. When a frame is received at a port, its VLAN membership can then be determined based on the protocol type in use by the inbound packets.
Page 489: Protocol-Vlan Protocol-Group (Configuring Groups)
To configure protocol-based VLANs, follow these steps: 1. First configure VLAN groups for the protocols you want to use (page -233). Although not mandatory, we suggest configuring a separate VLAN for each major protocol running on your network. Do not add port members at this time. 2.
Page 490: Protocol-Vlan Protocol-Group (Configuring Interfaces)
OMMAND NTERFACE Example The following creates protocol group 1, and specifies Ethernet frames with IP and ARP protocol types. Console(config)#protocol-vlan protocol-group 1 add frame_type ethernet protocol-type ip Console(config)#protocol-vlan protocol-group 1 add frame_type ethernet protocol-type arp Console(config)# protocol-vlan protocol-group (Configuring Interfaces) This command maps a protocol group to a VLAN for the current interface.
Page 491: Show Protocol-Vlan Protocol-Group
• When a frame enters a port that has been assigned to a protocol VLAN, it is processed in the following manner: - If the frame is tagged, it will be processed according to the standard rules applied to tagged frames. - If the frame is untagged and the protocol type matches, the frame is forwarded to the appropriate VLAN.
Page 492: Show Interfaces Protocol-Vlan Protocol-Group
OMMAND NTERFACE Example This shows protocol group 1 configured for IP over Ethernet. Console#show protocol-vlan protocol-group ProtocolGroup ID ------------------ ------------- --------------- Console# show interfaces protocol-vlan protocol-group This command shows the mapping from protocol groups to VLANs for the selected interfaces. Syntax show interfaces protocol-vlan protocol-group [interface] •...
Page 493: Configuring Private Vlans
VLAN. Data traffic on the downlink ports can only be forwarded to, and from, the uplink port. • Private VLANs and normal VLANs can exist simultaneously within the same switch. Table 4-43. Private VLAN Commands Function Enables and configured private...
Page 494: Show Pvlan
OMMAND NTERFACE • Entering the pvlan command without any parameters enables the private VLAN. Entering no pvlan disables the private VLAN. Example This example enables the private VLAN, and then sets port 24 as the uplink and ports 1-8 as the downlinks. Console(config)#pvlan Console(config)#pvlan up-link ethernet 1/24 down-link ethernet 1/5-8 Console(config)#...
Page 495: Gvrp And Bridge Extension Commands
Configures forbidden VLANs for show gvrp configuration garp timer show garp timer bridge-ext gvrp This command enables GVRP globally for the switch. Use the no form to disable it. Syntax [no] bridge-ext gvrp Default Setting Disabled...
Page 496: Show Bridge-Ext
GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. This function should be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. Example Console(config)#bridge-ext gvrp...
Page 497: Switchport Gvrp
switchport gvrp This command enables GVRP for a port. Use the no form to disable it. Syntax [no] switchport gvrp Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Example Console(config)#interface ethernet 1/1 Console(config-if)#switchport gvrp Console(config-if)# show gvrp configuration This command shows if GVRP is enabled.
Page 498: Garp Timer
OMMAND NTERFACE Example Console#show gvrp configuration ethernet 1/7 Eth 1/ 7: Gvrp configuration: Enabled Console# garp timer This command sets the values for the join, leave and leaveall timers. Use the no form to restore the timers’ default values. Syntax garp timer {join | leave | leaveall} timer_value no garp timer {join | leave | leaveall} •...
Page 499: Show Garp Timer
• Timer values are applied to GVRP for all the ports on all VLANs. • Timer values must meet the following restrictions: - leave >= (2 x join) - leaveall > leave Note: Set GVRP timers on all Layer 2 devices connected in the same network to the same values.
Page 500: Priority Commands (Layer 2)
Priority Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with eight priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.
Page 501: Queue Bandwidth
Priority Commands (Layer 2) Command switchport priority default queue mode queue bandwidth queue cos map show queue mode show queue bandwidth show queue cos-map Shows the class-of-service map show interfaces switchport switchport priority default This command sets a priority for incoming untagged frames. Use the no form to restore the default value.
Page 502 If the incoming frame is an IEEE 802.1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used. • This switch provides eight priority queues for each port. It is configured to use Weighted Round Robin, which can be viewed with the show queue bandwidth command.
Page 503: Queue Mode
Global Configuration Command Usage You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
Page 504: Queue Bandwidth
OMMAND NTERFACE queue bandwidth This command assigns weighted round-robin (WRR) weights to the eight class of service (CoS) priority queues. Use the no form to restore the default weights. Syntax queue bandwidth weight1...weight4 no queue bandwidth weight1...weight4 - The ratio of weights for queues 0 - 3 determines the weights used by the WRR scheduler.
Page 505: Queue Cos-Map
0 to 7, where 7 is the highest priority. Default Setting This switch supports Class of Service by using eight priority queues, with Weighted Round Robin queuing for each port. Eight separate traffic classes are defined in IEEE 802.1p. The default priority levels are assigned according to recommendations in the IEEE 802.1p...
Page 506: Related Commands
OMMAND NTERFACE Example The following example shows how to change the CoS assignments to a one-to-one mapping. Console(config)#interface ethernet 1/1 Console(config-if)#queue cos-map 0 0 Console(config-if)#queue cos-map 1 1 Console(config-if)#queue cos-map 2 2 Console(config-if)#exit Console#show queue cos-map ethernet 1/1 Information of Eth 1/1 Traffic Class : 0 1 2 3 4 5 6 7 Priority Queue: 0 1 2 3 4 5 6 7 Information of Eth 1/2...
Page 507: Show Queue Bandwidth
show queue bandwidth This command displays the weighted round-robin (WRR) bandwidth allocation for the eight priority queues. Default Setting None Command Mode Privileged Exec Example Console#show queue bandwidth Information of Eth 1/1 Queue ID Weight -------- ------ Console# show queue cos-map This command shows the class of service priority map.
Page 508: Priority Commands (Layer 3 And 4)
OMMAND NTERFACE Default Setting None Command Mode Privileged Exec Example Console#show queue cos-map ethernet 1/1 Information of Eth 1/1 CoS Value Priority Queue: 2 0 1 3 4 5 6 7 Console# Priority Commands (Layer 3 and 4) Table 4-47. Priority Commands (Layer 3 and 4) Command map ip port map ip port...
Page 509: Map Ip Port (Global Configuration)
map ip port (Global Configuration) Use this command to enable IP port mapping (i.e., class of service mapping for TCP/UDP sockets). Use the no form to disable IP port mapping. Syntax map ip port no map ip port Default Setting Disabled Command Mode Global Configuration...
Page 510: Map Ip Precedence (Global Configuration)
OMMAND NTERFACE Default Setting None Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • This command sets the IP port priority for all interfaces. Example The following example shows how to map HTTP traffic to CoS value 0: Console(config)#interface ethernet 1/5...
Page 511: Map Ip Precedence (Interface Configuration)
Example The following example shows how to enable IP precedence mapping globally: Console(config)#map ip precedence Console(config)# map ip precedence (Interface Configuration) This command sets IP precedence priority (i.e., IP Type of Service priority). Use the no form to restore the default table. Syntax map ip precedence ip-precedence-value cos cos-value no map ip precedence...
Page 512: Map Ip Dscp (Global Configuration)
OMMAND NTERFACE Example The following example shows how to map IP precedence value 1 to CoS value 0: Console(config)#interface ethernet 1/5 Console(config-if)#map ip precedence 1 cos 0 Console(config-if)# map ip dscp (Global Configuration) This command enables IP DSCP mapping (i.e., Differentiated Services Code Point mapping).
Page 513: Map Ip Dscp (Interface Configuration)
map ip dscp (Interface Configuration) This command sets IP DSCP priority (i.e., Differentiated Services Code Point priority). Use the no form to restore the default table. Syntax map ip dscp dscp-value cos cos-value no map ip dscp • dscp-value - 8-bit DSCP value. (Range: 0-255) •...
Page 514: Show Map Ip Port
OMMAND NTERFACE Example The following example shows how to map IP DSCP value 1 to CoS value 0. Console(config)#interface ethernet 1/5 Console(config-if)#map ip dscp 1 cos 0 Console(config-if)# show map ip port Use this command to show the IP port priority map. Syntax show map ip port [interface] interface...
Page 515: Show Map Ip Precedence
Related Commands map ip port (Global Configuration) (4 -264) map ip port (Interface Configuration) (4 -264) show map ip precedence This command shows the IP precedence priority map. Syntax show map ip precedence [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number.
Page 516: Show Map Ip Dscp
OMMAND NTERFACE Related Commands map ip precedence (Global Configuration) (4 -265) map ip precedence (Interface Configuration) (4 -266) show map ip dscp This command shows the IP DSCP priority map. Syntax show map ip dscp [interface] interface • ethernet unit/port - unit - This is device 1.
Page 517: Multicast Filtering Commands
(Interface Configuration) (4 -268) Multicast Filtering Commands This switch uses IGMP (Internet Group Management Protocol) to query for any attached hosts that want to receive a specific multicast service. It identifies the ports containing hosts requesting a service and sends data out to those ports only.
Page 518: Ip Igmp Snooping
Command show ip igmp snooping Shows the IGMP snooping and query show mac-address-table multicast ip igmp snooping This command enables IGMP snooping on this switch. Use the no form to disable it. Syntax [no] ip igmp snooping Default Setting Enabled...
Page 519: Ip Igmp Snooping Vlan Static
ip igmp snooping vlan static This command adds a port to a multicast group. Use the no form to remove the port. Syntax [no] ip igmp snooping vlan vlan-id static ip-address interface • vlan-id - VLAN ID (Range: 1-4094) • ip-address - IP address for multicast group •...
Page 520: Ip Igmp Snooping Version
• All systems on the subnet must support the same version. If there are legacy devices in your network that only support Version 1, you will also have to configure this switch to use Version 1. • Some commands are only enabled for IGMPv2, including ip igmp query-max-response-time and ip igmp query-timeout.
Page 521: Show Ip Igmp Snooping
show ip igmp snooping This command shows the IGMP snooping configuration. Default Setting None Command Mode Privileged Exec Command Usage See “Configuring IGMP Snooping and Query Parameters” on page 3-182 for a description of the displayed items. Example The following shows the current IGMP snooping configuration: Console#show ip igmp snooping Service status: Enabled Querier status: Enabled...
Page 522: Ip Igmp Snooping Querier
OMMAND NTERFACE Default Setting None Command Mode Privileged Exec Command Usage Member types displayed include IGMP or USER, depending on selected options. Example The following shows the multicast entries learned through IGMP snooping for VLAN 1: Console#show mac-address-table multicast vlan 1 igmp-snooping VLAN M'cast IP addr.
Page 523: Ip Igmp Snooping Querier
This command enables the switch as an IGMP querier. Use the no form to disable it. Syntax [no] ip igmp snooping querier Default Setting Enabled Command Mode Global Configuration Command Usage If enabled, the switch will serve as querier if elected. The querier is responsible for asking hosts if they want to receive multicast traffic.
Page 524: Ip Igmp Snooping Query-Interval
This command configures the query interval. Use the no form to restore the default. Syntax ip igmp snooping query-interval seconds no ip igmp snooping query-interval seconds - The frequency at which the switch sends IGMP host-query messages. (Range: 60-125) Default Setting 125 seconds 4-279...
Page 525: Ip Igmp Snooping Query-Max-Response-Time
Global Configuration Command Usage • The switch must be using IGMPv2 for this command to take effect. • This command defines the time after a query, during which a response is expected from a multicast client. If a querier has sent a number of...
Page 526: Ip Igmp Snooping Router-Port-Expire-Time
- The time the switch waits after the previous querier stops before it considers the router port (i.e., the interface which had been receiving query packets) to have expired.
Page 527: Static Multicast Routing Commands
Related Commands ip igmp snooping version (4 -275) Static Multicast Routing Commands Table 4-51. Static Multicast Routing Commands Command ip igmp snooping vlan mrouter show ip igmp snooping mrouter ip igmp snooping vlan mrouter This command statically configures a multicast router port. Use the no form to remove the configuration.
Page 528: Show Ip Igmp Snooping Mrouter
Depending on your network connections, IGMP snooping may not always be able to locate the IGMP querier. Therefore, if the IGMP querier is a known multicast router/switch connected over the network to an interface (port or trunk) on your router, you can manually configure that interface to join all the current multicast groups.
Page 529: Ip Interface Commands
There are no IP addresses assigned to this switch by default. You must manually configure a new address to manage the switch over your network or to connect the switch to existing IP subnets. You may also need to a establish a default gateway between this device and management stations or other devices that exist on another network segment.
Page 530: Ip Address
Command Usage • You must assign an IP address to this device to gain management access over the network or to connect the switch to existing IP subnets. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server.
Page 531: Ip Dhcp Restart
Note: Before you can change the IP address, you must first clear the current address with the no form of this command. Example In the following example, the device is assigned an address in VLAN 1. Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.5 255.255.255.0 Console(config-if)# Related Commands ip dhcp restart (4 -286)
Page 532: Related Commands
Dhcp. Console# Related Commands ip address (4 -285) ip default-gateway This command establishes a static route between this switch and devices that exist on another network segment. Use the no form to remove the static route. Syntax ip default-gateway gateway...
Page 533: Show Ip Interface
Related Commands show ip redirects (4 -288) show ip interface This command displays the settings of an IP interface. Default Setting All interfaces Command Mode Privileged Exec Example Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: User specified.
Page 534: Ping
• size - Number of bytes in a packet. (Range: 32-512, default: 32) The actual packet size will be eight bytes larger than the size specified because the switch adds header information. Default Setting This command has no default for the host.
Page 535 Example Console#ping 10.1.0.9 Type ESC to abort. PING to 10.1.0.9, by 5 32-byte payload ICMP packets, timeout is 5 seconds response time: 10 ms response time: 10 ms response time: 10 ms response time: 10 ms response time: 0 ms Ping statistics for 10.1.0.9: 5 packets transmitted, 5 packets received (100%), 0 packets lost (0%) Approximate round trip times:...
Page 536 OMMAND NTERFACE 4-291...
Page 537: Software Specifications
OFTWARE Software Features Authentication Local, RADIUS, TACACS, Port (802.1x), HTTPS, SSH, Port Security Access Control Lists IP, MAC (up to 32 lists) DHCP Client Port Configuration SMC8624T 10/100/100BASE-T Ports 1-24 1000BASE-T: 10/100 Mbps, half/full duplex 1000 Mbps, full duplex SFP Ports 21-24 1000BASE-X: 1000 Mbps, full duplex SMC8648T 10/100/100BASE-T Ports 1-48...
Page 538: Port Mirroring
OFTWARE PECIFICATIONS Port Mirroring Multiple source ports, one destination port Rate Limits Input Limit Output limit Range (configured per port) Port Trunking Static trunks (Cisco EtherChannel compliant) Dynamic trunks (Link Aggregation Control Protocol) Spanning Tree Protocol Spanning Tree Protocol (STP, IEEE 802.1D) Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s) VLAN Support...
Page 539: Management Features
Management Features In-Band Management Telnet, Web-based HTTP or HTTPS, SNMP manager, or Secure Shell Out-of-Band Management RS-232 DB-9 console port Software Loading TFTP in-band or XModem out-of-band SNMP Management access via MIB database Trap management to specified hosts RMON Groups 1, 2, 3, 9 (Statistics, History, Alarm, Event) Standards IEEE 802.3 Ethernet, IEEE 802.3u Fast Ethernet...
Page 540: Management Information Bases
OFTWARE PECIFICATIONS HTTPS ICMP (RFC 792) IGMP (RFC 1112) IGMPv2 (RFC 2236) RADIUS+ (RFC 2618) RMON (RFC 1757 groups 1,2,3,9)SNTP (RFC 2030) SNMP (RFC 1157) SNMPv2 (RFC 1907) SSH (Version 2.0) Management Information Bases Bridge MIB (RFC 1493) Entity MIB (RFC 2737) Ethernet MIB (RFC 2665) Ether-like MIB (RFC 1643) Extended Bridge MIB (RFC 2674)
Page 541: Troubleshooting
• Check that you have a valid network connection to the switch and that the port you are using has not been disabled. • Check network cabling between the management station and the switch.
Page 542 ROUBLESHOOTING...
Page 543: Glossary
Access Control List (ACL) ACLs can limit network traffic and restrict access to certain users or devices by checking each packet for certain IP or MAC (i.e., Layer 2) information. Boot Protocol (BOOTP) BOOTP used to provide bootup information for network devices, including IP address information, the address of the TFTP server that contains the devices system files, and the name of the boot file.
Page 544 EAPOL is a client authentication protocol used by this switch to verify the network access rights for any device that is plugged into the switch. A user name and password is requested by the switch, and then passed to an authentication server (e.g., RADIUS) for verification.
Page 545: Igmp Snooping
An IEEE standard for the Multiple Spanning Tree Protocol (MSTP) which provides independent spanning trees for VLAN groups. IEEE 802.1x Port Authentication controls access to the switch ports by requiring users to first enter a user ID and password for authentication. IEEE 802.3ac Defines frame extensions for VLAN tagging.
Page 546: Ip Multicast Filtering
Internet Group Management Protocol (IGMP) A protocol through which hosts can register with their local router for multicast services. If there is more than one multicast switch/router on a given subnetwork, one of the devices is made the “querier” and assumes responsibility for keeping track of group membership.
Page 547: Multicast Switching
Multicast Switching A process whereby the switch filters incoming multicast frames for services for which no attached host has registered, or forwards them to all ports contained within the designated multicast VLAN group.
Page 548: Port Trunk
A secure replacement for remote access functions, including Telnet. SSH can authenticate users with a cryptographic key, and encrypt data connections between management clients and the switch. Simple Mail Transfer Protocol (SMTP) A standard host-to-host mail transport protocol that operates over TCP, port 25.
Page 549 Simple Network Management Protocol (SNMP) The application protocol in the Internet suite of protocols which offers network management services. Simple Network Time Protocol (SNTP) allows a device to set its internal clock based on periodic updates SNTP from a Network Time Protocol (NTP) server. Updates can be requested from a specific NTP server, or can be received via broadcasts sent by NTP servers.
Page 550: Virtual Lan (Vlan)
LOSSARY User Datagram Protocol (UDP) provides a datagram mode for packet-switched communications. It uses IP as the underlying transport mechanism to provide access to IP-like services. UDP packets are delivered just like IP packets – connection-less datagrams that may be discarded before reaching their targets. UDP is useful when TCP would be too complex, too slow, or just unnecessary.
Page 551: Index
Numerics 802.1x, port authentication 4-104 acceptable frame type 3-155 Access Control List See ACL Extended IP 3-62 4-114 4-120 MAC 3-62 4-114 4-135 – 4-136 4-139 Standard IP 3-62 4-114 address table 3-112 4-200 aging time 3-115 4-204 BOOTP 3-20 4-285 BPDU 3-117 broadcast storm, threshold 3-101...
Page 552 NDEX edge port, STA 3-129 3-132 event logging 4-58 firmware displaying version 3-14 upgrading 3-22 4-86 GARP VLAN Registration Protocol See GVRP gateway, default 3-18 4-287 GVRP global setting 3-146 4-250 interface configuration 3-155 hardware version, displaying 3-14 HTTPS 3-38 4-42 HTTPS, secure server 3-38 IEEE 802.1D 3-116...
Page 553 multicast groups 3-187 displaying 4-276 static 3-187 4-274 4-276 multicast services configuring 3-188 4-274 displaying 3-187 4-276 multicast, static router port 3-186 password, line 4-17 passwords 2-5 administrator setting 3-33 path cost 3-118 3-128 method 3-124 4-212 STA 3-118 3-128 4-212 port authentication 4-104 port priority...
Page 554 NDEX interface settings 3-126 – 4-219 4-227 4-228 link type 3-129 3-132 path cost 3-118 3-128 path cost method 3-124 port priority 3-129 4-220 protocol migration 3-133 transmission limit 3-124 standards, IEEE A-3 startup files creating 3-25 4-86 displaying 3-22 4-77 setting 3-22 4-92...
Page 556 Fax 7 (095) 789 35 73 86-10-6235-4958; Fax 86-10-6235-4962 886-2-8797-8006; Fax 886-2-8797-6288 (65) 238 6556; Fax (65) 238 6466 82-2-553-0860; Fax 82-2-553-7202 81-45-224-2332; Fax 81-45-224-2331 61-2-8875-7887; Fax 61-2-8875-7777 91-22-8204437; Fax 91-22-8204443 Model Number: SMC8624/48T Pub. Number: 150200041000A Revision Number: F1.1.0.4 E042004-R01...

This manual is also suitable for:

8648t - annexe 1

SMC Networks SMC8624/48T Management Manual

1 Introduction

2 Initial Configuration

3 Configuring the Switch

4 Command Line Interface

Quick Links

Management Guide

Need help?

Questions and answers

Related Manuals for SMC Networks SMC8624/48T

Summary of Contents for SMC Networks SMC8624/48T