Page 1: Management Guide
TigerSwitch 10/100 24-Port 10/100 Mbps Fast Ethernet Managed Switch ◆ 24 auto-MDI/MDI-X 10/100BASE-TX ports ◆ 4 Gigabit RJ-45/SFP combination ports ◆ Non-blocking switching architecture ◆ Spanning Tree Protocol, and Rapid STP ◆ Up to 8 LACP or static trunks ◆ CoS support through four priority queues ◆...
Page 3 TigerSwitch 10/100 Management Guide From SMC’s Tiger line of feature-rich workgroup LAN solutions 20 Mason Irvine, CA 92618 Phone: (949) 679-8000 March 2007 Pub. # 149100033500A...
Page 4 Irvine, CA 92618 All rights reserved. Printed in Taiwan Trademarks: SMC is a registered trademark; and EZ Switch, TigerStack and TigerSwitch are trademarks of SMC Networks, Inc. Other product and company names are trademarks or registered trademarks of their respective holders.
Page 5 All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized Reseller. SMC may, at its own discretion, repair or replace any product not operating as warranted with a similar or functionally equivalent product, during the applicable warranty term.
Page 6 RIGHTS, WHICH MAY VARY FROM STATE TO STATE. NOTHING IN THIS WARRANTY SHALL BE TAKEN TO AFFECT YOUR STATUTORY RIGHTS. * SMC will provide warranty service for one year following discontinuance from the active SMC price list. Under the limited lifetime warranty, internal and external power supplies, fans, and cables are covered by a standard one-year warranty from date of purchase.
Page 7: Table Of Contents
Connecting to the Switch ........
Page 8 ONTENTS Manual Configuration ......3-21 Using DHCP/BOOTP ......3-22 Enabling Jumbo Frames .
Page 9 Generating the User Public Key Pair ....3-83 Configuring Port Security ......3-86 Configuring 802.1X Port Authentication .
Page 10 ONTENTS Configuring Global Settings ......3-149 Displaying Interface Settings ......3-153 Configuring Interface Settings .
Page 11 Switch Clustering ........
Page 12 ONTENTS Telnet Connection ........4-2 Entering Commands .
Page 13 quit ..........4-31 System Management Commands .
Page 14 ONTENTS clear logging ........4-62 show logging .
Page 15 radius-server host ....... . 4-95 radius-server port ....... . 4-96 radius-server key .
Page 16 ONTENTS show access-group ......4-123 SNMP Commands ........4-123 snmp-server .
Page 17 Link Aggregation Commands ....... 4-162 channel-group ........4-164 lacp .
Page 18 ONTENTS switchport mode ....... . 4-200 switchport acceptable-frame-types ....4-200 switchport ingress-filtering .
Page 19 ip igmp snooping ....... . 4-230 ip igmp snooping vlan static ..... . . 4-231 ip igmp snooping version .
Page 20 ....4-278 Switch Cluster Commands ........4-278 cluster .
Page 21 ONTENTS Glossary Index xvii...
Page 22 ONTENTS xviii...
Page 23 ABLES Table 1-1. Key Features ........1-1 Table 1-2.
Page 24 ABLES Table 4-21 SMTP Alert Commands ......4-65 Table 4-22 Time Commands ....... . . 4-70 Table 4-23 System Status Commands .
Page 25 Table 4-76 DHCP Snooping Commands ..... . 4-269 Table 4-77 Switch Cluster Commands ......4-279...
Page 26 ABLES xxii...
Page 27 System Information ......3-14 Figure 3-4. Switch Information ......3-16 Figure 3-5.
Page 28 IGURES Figure 3-37. SSH User Public-Key Settings ....3-85 Figure 3-38. Configuring Port Security ......3-88 Figure 3-39.
Page 29 Figure 3-94. IGMP Immediate Leave ......3-211 Figure 3-95. Mapping Multicast Switch Ports to VLANs ..3-212 Figure 3-96.
Page 30 IGURES Figure 3-111. IP Source Guard Port Configuration ....3-238 Figure 3-112. Static IP Source Guard Binding Configuration ..3-240 Figure 3-113. Dynamic IP Source Guard Binding Information ..3-241 Figure 3-114.
Page 31: Introduction
This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch. However, there are many options that you should configure to maximize the switch’s performance for your particular...
Page 32: Description Of Software Features
Multicast Filtering Supports IGMP snooping and query Description of Software Features The switch provides a wide range of advanced performance enhancing features. Flow control eliminates the loss of packets due to bottlenecks caused by port saturation. Broadcast storm suppression prevents broadcast traffic storms from engulfing the network.
Page 33 Use the full-duplex mode on ports whenever possible to double the throughput of switch connections. Flow control should also be enabled to control network traffic during periods of congestion and prevent the loss of packets when port buffer thresholds are exceeded.
Page 34 Static Addresses – A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.
Page 35 (CRC). This prevents bad frames from entering the network and wasting bandwidth. To avoid dropping frames on congested ports, the switch provides 1.5 MB for frame buffering. This buffer can queue packets awaiting transmission on congested networks.
Page 36 NTRODUCTION Virtual LANs – The switch supports up to 255 VLANs. A Virtual LAN is a collection of network nodes that share the same collision domain regardless of their physical location or connection point in the network. The switch supports tagged VLANs based on the IEEE 802.1Q standard.
Page 37: System Defaults
LAN or VLAN. The purpose is to keep the non-multicast group members from receiving unsolicited packets and to prevent a possible reduction in network performance. The switch uses IGMP Snooping and Query at Layer 2 and IGMP at Layer 3 to manage multicast group registration.
Page 38 NTRODUCTION Function Web Management HTTP Server SNMP Port Configuration Rate Limiting Port Trunking Broadcast Storm Protection Spanning Tree Protocol Address Table Virtual LANs Table 1-2. System Defaults (Continued) Parameter IP Filtering HTTP Port Number HTTP Secure Server HTTP Secure Port Number Community Strings Traps SNMP V3...
Page 39: Table 1-2. System Defaults
Table 1-2. System Defaults (Continued) Function Parameter Traffic Ingress Port Priority Prioritization Weighted Round Robin IP DSCP Priority IP Settings IP Address Subnet Mask Default Gateway DHCP BOOTP Multicast Filtering IGMP Snooping System Log Status Messages Logged Messages Logged to Flash SMTP Email Event Handler Alerts...
Page 40 NTRODUCTION 1-10...
Page 41: Initial Configuration
Web-based interface. A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI). Note: The IP address for this switch is unassigned by default. To change this address, see “Setting an IP Address” on page 2-6.
Page 42: Required Connections
• Display system information and statistics Required Connections The switch provides an RS-232 serial port that enables a connection to a PC or terminal for monitoring and configuring the switch. A null-modem console cable is provided with the switch. Attach a VT100-compatible terminal, or a PC running a terminal emulation program to the switch.
Page 43 DB-9 connector. 2. Connect the other end of the cable to the RS-232 serial port on the switch. 3. Make sure the terminal emulation software is set as follows: •...
Page 44: Remote Connections
IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol. The IP address for this switch is obtained via DHCP by default. To manually configure this address or enable dynamic address assignment via DHCP or BOOTP, see “Setting an IP Address”...
Page 45: Setting Passwords
Access to both CLI levels are controlled by user names and passwords. The switch has a default user name and password for each level. To log into the CLI at the Privileged Exec level using the default user name and password, perform these steps: 1.
Page 46: Setting An Ip Address
DHCP address allocation servers on the network. Manual Configuration You can manually assign an IP address to the switch. You may also need to specify a default gateway that resides between this device and management stations on another network segment. Valid IP addresses consist of four decimal numbers, 0 to 255, separated by periods.
Page 47: Dynamic Configuration
If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the switch will start broadcasting service requests as soon as it is powered on. To automatically configure the switch by communicating with BOOTP or...
Page 48 NITIAL ONFIGURATION 1. From the Global Configuration mode prompt, type “interface vlan 1” to access the interface-configuration mode. Press <Enter>. 2. At the interface-configuration mode prompt, use one of the following commands: • To obtain IP settings via DHCP, type “ip address dhcp” and press <Enter>.
Page 49: Enabling Snmp Management Access
Enabling SNMP Management Access The switch can be configured to accept management commands from Simple Network Management Protocol (SNMP) applications such as SMC EliteView. You can configure the switch to (1) respond to SNMP requests or (2) generate SNMP traps.
Page 50: Trap Receivers
NITIAL ONFIGURATION To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it is recommended that you change the default community strings. To configure a community string, complete the following steps: 1. From the Privileged Exec level global configuration mode prompt, type “snmp-server community string mode,”...
Page 51: Configuring Access For Snmp Version 3 Clients
Console(config)# For a more detailed explanation on how to configure the switch for access from SNMP v3 clients, refer to “Simple Network Management Protocol” on page 3-44, or refer to the specific CLI commands for SNMP starting on page 4-123.
Page 52: Managing System Files
Console# Managing System Files The switch’s flash memory supports three types of system files that can be managed by the CLI program, Web interface, or SNMP. The switch’s file system allows files to be uploaded and downloaded, copied, deleted, and set as a start-up file.
Page 53 ANAGING YSTEM ILES Due to the size limit of the flash memory, the switch supports only two operation code files. However, you can have as many diagnostic code files and configuration files as available flash memory space allows. In the system flash memory, one file of each type must be set as the start-up file.
Page 54 NITIAL ONFIGURATION 2-14...
Page 55: Configuring The Switch
Telnet. For more information on using the CLI, refer to Chapter 4 “Command Line Interface.” Prior to accessing the switch from a Web browser, be sure you have first performed the following tasks: 1. Configure the switch with a valid IP address, subnet mask, and default gateway using an out-of-band serial connection, BOOTP or DHCP protocol.
Page 56 If you log in as “admin” (Privileged Exec level), you can change the settings on any page. 3. If the path between your management station and this switch does not pass through any device that uses the Spanning Tree Algorithm, then you can set the switch port attached to your management station to fast forwarding (i.e., enable Admin...
Page 57: Navigating The Web Browser Interface
“admin.” Home Page When your web browser connects with the switch’s web agent, the home page is displayed as shown below. The home page displays the Main Menu on the left side of the screen and System Information on the right side.
Page 58: Configuration Options
Panel Display The web agent displays an image of the switch’s ports. The Mode can be set to display different information for the ports, including Active (i.e., up or down), Duplex (i.e., half or full duplex, or Flow Control (i.e., with or without flow control).
Page 59: Main Menu
Main Menu Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program. Menu System System Information...
Page 60 Table 3-2. Main Menu (Continued) Description Sends an SMTP client message to a participating server. Restarts the switch Configures SNTP client settings, including broadcast mode or a specified list of servers Sets the local time zone for the system clock...
Page 61 Table 3-2. Main Menu (Continued) Menu Port Security 802.1X Information Configuration Port Configuration Statistics Configuration Port Binding IP Filter Port Port Information Trunk Information Port Configuration Trunk Configuration Trunk Membership LACP Configuration Aggregation Port Port Counters Information Port Internal Information Description Configures per port security, including status, response for security breach, and...
Page 62 ONFIGURING THE WITCH Menu Port Neighbors Information Port Broadcast Control Trunk Broadcast Control Mirror Port Configuration Rate Limit Input Port Configuration Input Trunk Configuration Output Port Configuration Output Trunk Configuration Port Statistics Address Table Static Addresses Dynamic Addresses Address Aging Spanning Tree Information Configuration...
Page 63 Description Configures individual port settings for STA Configures individual trunk settings for Displays information on the VLAN type supported by this switch Shows the current port members of each VLAN and whether or not the port is tagged or untagged...
Page 64 ONFIGURING THE WITCH Menu Trunk Configuration Protocol VLAN Configuration Port Configuration Priority Default Port Priority Default Trunk Priority Traffic Classes Traffic Classes Status Queue Mode Queue Scheduling IP DSCP Priority Status Globally selects IP DSCP Priority, or IP DSCP Priority DiffServ Class Map Policy Map...
Page 65 VLAN ID Assigns ports that are attached to a neighboring multicast router Displays all multicast groups active on this switch, including multicast IP addresses and VLAN ID Indicates multicast addresses associated with the selected VLAN Configures IGMP profile group...
Page 66: Table 3-2. Main Menu
Adds a static addresses to the source-guard binding table Displays the source-guard binding table for a selected interface Globally enables clustering for the switch Adds switch Members to the cluster Displays cluster Member switch information Displays network Candidate switch...
Page 67: Basic Configuration
Field Attributes • System Name – Name assigned to the switch system. • Object ID – MIB II object ID for switch’s network management subsystem. • Location – Specifies the system location. • Contact – Administrator responsible for the system.
Page 68: Figure 3-3. System Information
ONFIGURING THE WITCH Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that allows access to the Command Line Interface via Telnet.) 3-14 Figure 3-3.
Page 69: Displaying Switch Hardware/Software Versions
CLI – Specify the hostname, location and contact information. Console(config)#hostname R&D 5 Console(config)#snmp-server location WC 9 Console(config)#snmp-server contact Geoff Console(config)#exit Console#show system System Description: SMC Networks SMC6128L2 System OID String: 1.3.6.1.4.1.259.6.10.94 System Information System Up Time: seconds System Name: System Location:...
Page 70: Figure 3-4. Switch Information
Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code. • Operation Code Version – Version number of runtime code. • Role – Displays the switch as a master or slave unit. Web – Click System, Switch Information. 3-16 Figure 3-4. Switch Information...
Page 71: Displaying Bridge Extension Capabilities
GMRP (GARP Multicast Registration Protocol). • Traffic Classes – This switch provides mapping of user priorities to multiple traffic classes. (Refer to “Displaying Private VLAN Interface Information” on page 3-181.) •...
Page 72: Figure 3-5. Bridge Extension Configuration
ONFIGURING THE WITCH • Configurable PVID Tagging – This switch allows you to override the default Port VLAN ID (PVID used in frame tags) and egress status (VLAN-Tagged or Untagged) on each port. (Refer to “VLAN Configuration” on page 3-161.) •...
Page 73: Setting The Switch's Ip Address
Setting the Switch’s IP Address This section describes how to configure an IP interface for management access over the network. The IP address for this switch is unassigned by default. To manually configure an address, you need to change the switch’s default settings (IP address 0.0.0.0 and netmask 255.0.0.0) to values that...
Page 74 (DHCP), or Boot Protocol (BOOTP). If DHCP/BOOTP is enabled, IP will not function until a reply has been received from the server. Requests will be broadcast periodically by the switch for an IP address. (DHCP/BOOTP values can include the IP address, subnet mask, and default gateway.)
Page 75: Manual Configuration
Manual Configuration Web – Click System, IP Configuration. Select the VLAN through which the management station is attached, set the IP Address Mode to “Static,” enter the IP address, subnet mask and gateway, then click Apply. Figure 3-6. Manual IP Configuration CLI –...
Page 76: Using Dhcp/Bootp
IP Address Mode to DHCP or BOOTP. Click Apply to save your changes. Then click Restart DHCP to immediately request a new address. Note that the switch will also broadcast a request for IP configuration settings on each power reset.
Page 77: Enabling Jumbo Frames
Console# Renewing DCHP – DHCP may lease addresses to clients indefinitely or for a specific period of time. If the address expires or the switch is moved to another network segment, you will lose management access to the switch. In this case, you can reboot the switch or submit a client request to restart DHCP service via the CLI.
Page 78: Managing Firmware
You can upload/download firmware to or from a TFTP server. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation. You can also set the switch to use new firmware without overwriting the previous version.
Page 79: Downloading System Software From A Server
“opcode,” enter the file name of the software to download, select a file on the switch to overwrite or specify a new file name, then click Apply. If you replaced the current firmware used for startup and want to start using the new operation code, reboot the system via the System/Reset menu.
Page 80: Figure 3-10. Setting The Startup Code
CLI – Enter the IP address of the TFTP server, select “config” or “opcode” file type, then enter the source and destination file names, set the new file to start up the system, and then restart the switch. Console#copy tftp file TFTP server ip address: 10.1.0.19...
Page 81: Saving Or Restoring Configuration Settings
File Transfer Method – The firmware copy operation includes these options. - file to file – Copies a file within the switch directory, assigning it a new name. - file to running-config – Copies a file in the switch to the running configuration.
Page 82: Downloading Configuration Settings From A Server
“tftp to file” and enter the IP address of the TFTP server. Specify the name of the file to download and select a file on the switch to overwrite or specify a new file name, then click Apply. Figure 3-12. Downloading Configuration Settings for Startup If you download to a new file name using “tftp to startup-config”...
Page 83: Console Port Settings
Figure 3-13. Setting the Startup Configuration Settings CLI – Enter the IP address of the TFTP server, specify the source file on the server, set the startup file name on the switch, and then restart the switch. Console#copy tftp startup-config TFTP server ip address: 192.168.1.19...
Page 84 ONFIGURING THE WITCH Command Attributes • Login Timeout – Sets the interval that the system waits for a user to log into the CLI. If a login attempt is not detected within the timeout interval, the connection is terminated for the session. (Range: 0-300 seconds;...
Page 85: Figure 3-14. Console Port Setting
Available in CLI only: • Password – Specifies a password for the line connection. When a connection is started on a line with password protection, the system prompts for the password. If you enter the correct password, the system shows a prompt. (Default: No password) •...
Page 86: Telnet Settings
These parameters can be configured via the web or CLI interface. Command Attributes • Telnet Status – Enables or disables Telnet access to the switch. (Default: Enabled) • Telnet Port Number – Sets the TCP port number for Telnet on the switch.
Page 87: Figure 3-15. Enabling Telnet
• Login Timeout – Sets the interval that the system waits for a user to log into the CLI. If a login attempt is not detected within the timeout interval, the connection is terminated for the session. (Range: 0-300 seconds; Default: 300 seconds) •...
Page 88: Configuring Event Logging
Configuring Event Logging The switch allows you to control the logging of error messages, including the type of events that are recorded in switch memory, logging to a remote System Log (syslog) server, and displays a list of recent event messages.
Page 89: System Log Configuration
RAM or flash memory. Severe error messages that are logged to flash memory are permanently stored in the switch to assist in troubleshooting network problems. Up to 4096 log entries can be stored in the flash memory, with the oldest entries being overwritten first when the available log memory (256 kilobytes) has been exceeded.
Page 90: Table 3-3. Logging Levels
(Default: Enabled) • Flash Level – Limits log messages saved to the switch’s permanent flash memory for all levels up to the specified level. For example, if level 3 is specified, all messages from level 0 to level 3 will be logged to flash.
Page 91: Remote Log Configuration
Web – Click System, Log, System Logs. Specify System Log Status, set the level of event messages to be logged to RAM and flash memory, then click Apply. CLI – Enable system logging and then specify the level of messages to be logged to RAM and flash memory.
Page 92: Figure 3-18. Remote Logs
The attribute specifies the facility type tag sent in syslog messages. (See RFC 3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to process messages, such as sorting or storing messages in the corresponding database.
Page 93: Simple Mail Transfer Protocol
CLI – Enter the syslog server host IP address, choose the facility type and set the logging trap. Console(config)#logging host 192.168.1.15 Console(config)#logging facility 23 Console(config)#logging trap 4 Console(config)#end Console#show logging trap Syslog logging: REMOTELOG status: REMOTELOG facility type: REMOTELOG level type: REMOTELOG server ip address: 192.168.1.15 REMOTELOG server ip address: 0.0.0.0 REMOTELOG server ip address: 0.0.0.0...
Page 94: Figure 3-19. Enabling And Configuring Smtp
ONFIGURING THE WITCH - Critical – Sends notification that a critical condition has occurred, such as memory allocation, or free memory error - resource exhausted. (Level 2) - Alert – Sends urgent notification that immediate action must be taken. (Level 1) - Emergency –...
Page 95: Resetting The System
Console(config)#logging sendmail Console# Resetting the System Web – Click System, Reset. Click the Reset button to reboot the switch. When prompted, confirm that you want reset the switch. CLI – Use the reload command to restart the switch. When prompted, confirm that you want to reset the switch.
Page 96: Setting The System Clock
You can also manually set the clock using the CLI. (See “calendar set” on page 4-74.) If the clock is not set, the switch will only record the time from the factory default set at the last bootup.
Page 97: Setting The Time Zone
Web – Select SNTP, Configuration. Modify any of the required parameters, and click Apply. Figure 3-21. SNTP Configuration CLI – This example configures the switch to operate as an SNTP unicast client and then displays the current time and settings. Console(config)#sntp client Console(config)#sntp poll 604-72 Console(config)#sntp server 10.1.0.19 137.82.140.80 128.250.36.2...
Page 98: Simple Network Management Protocol
ONFIGURING THE WITCH • Hours (0-13) – The number of hours before/after UTC. • Minutes (0-59) – The number of minutes before/after UTC. • Direction – Configures the time zone to be before (east) or after (west) UTC. Web – Select SNTP, Clock Time Zone. Set the offset for your time zone relative to the UTC, and click Apply.
Page 99 A network management station can access this information using software such as SMC EliteView. Access to the onboard agent from clients using SNMP v1 and v2c is controlled by community strings. To communicate with the switch, the management station must first submit a valid community string for authentication.
Page 100: Table 3-4 Snmpv3 Security Models And Levels
ONFIGURING THE WITCH Table 3-4 SNMPv3 Security Models and Levels Model Level noAuth NoPriv noAuth NoPriv noAuth NoPriv noAuth NoPriv noAuth NoPriv noAuth NoPriv noAuth NoPriv Auth NoPriv Auth Priv Note: The predefined default groups and view can be deleted from the system.
Page 101: Enabling The Snmp Agent
IP Trap Managers should be listed in this table. For security reasons, you should consider removing the default strings. Command Attributes • SNMP Community Capability – The switch supports up to five community strings. • Current – Displays a list of the community strings currently configured.
Page 102: Figure 3-24 Configuring Snmp Community Strings
ONFIGURING THE WITCH • Access Mode – Specifies the access rights for the community string: - Read-Only – Authorized management stations are only able to retrieve MIB objects. - Read/Write – Authorized management stations are able to both retrieve and modify MIB objects. Web –...
Page 103: Specifying Trap Managers And Trap Types
You must specify trap managers so that key events are reported by this switch to your management station (using network management platforms such as SMC EliteView). You can specify up to five management stations that will receive authentication failure messages and other notification messages from the switch.
Page 104 5. Specify a remote engine ID where the user resides (page 3-53). 6. Then configure a remote user (page 3-57). Command Attributes • Trap Manager Capability – This switch supports up to five trap managers. • Current – Displays a list of the trap managers currently configured.
Page 105: Figure 3-25 Configuring Snmp Trap Managers
- Retry times – The maximum number of times to resend an inform message if the recipient does not acknowledge receipt. (Range: 0-255; Default: 3) • Enable Authentication Traps specified IP trap managers whenever authentication of an SNMP request fails. (Default: Enabled) •...
Page 106: Configuring Snmpv3 Management Access
The engine ID is also used in combination with user passwords to generate the security keys for authenticating and encrypting SNMPv3 packets. A local engine ID is automatically generated that is unique to the switch. This is referred to as the default engine ID. If the local engine ID is deleted or changed, all SNMP users will be cleared.
Page 107: Specifying A Remote Engine Id
Web – Click SNMP, SNMPv3, Engine ID. Enter an ID of up to 26 hexadecimal characters and then click Save. CLI – This example sets an SNMPv3 engine ID. Console(config)#snmp-server engine-id local 12345abcdef Console(config)#exit Console#show snmp engine-id Local SNMP engineID: 12345abcdef000000000000000 Local SNMP engineBoots: 1 Console# Specifying a Remote Engine ID...
Page 108: Configuring Snmpv3 Users
ONFIGURING THE WITCH Web – Click SNMP, SNMPv3, Remote Engine ID. Enter an ID of up to 26 hexadecimal characters and then click Save. CLI – This example specifies a remote SNMPv3 engine ID. Console(config)#snmp-server engineID remote 54321 192.168.1.19 Console(config)#exit Console#show snmp engine-id Local SNMP engineID: 8000002a8000000000e8666672 Local SNMP engineBoots: 1...
Page 109 - AuthPriv – SNMP communications use both authentication and encryption (only available for the SNMPv3 security model). • Authentication Protocol – The method used for user authentication. (Options: MD5, SHA; Default: MD5) • Authentication Password – A minimum of eight plain text characters is required.
Page 110: Figure 3-28 Configuring Snmpv3 Users
ONFIGURING THE WITCH Web – Click SNMP, SNMPv3, Users. Click New to configure a user name. In the New User page, define a name and assign it to a group, then click Add to save the configuration and return to the User Name list. To delete a user, check the box next to the user name, then click Delete.
Page 111: Configuring Remote Snmpv3 Users
CLI – Use the snmp-server user command to configure a new user name and assign it to a group. Console(config)#snmp-server user chris group r&d v3 auth md5 greenpeace priv des56 einstien Console(config)#exit Console#show snmp user EngineId: 80000034030001f488f5200000 User Name: chris Authentication Protocol: md5 Privacy Protocol: des56 Storage Type: nonvolatile...
Page 112 ONFIGURING THE WITCH Command Attributes • User Name – The name of user connecting to the SNMP agent. (Range: 1-32 characters) • Group Name – The name of the SNMP group to which the user is assigned. (Range: 1-32 characters) •...
Page 113: Figure 3-29 Configuring Remote Snmpv3 Users
IMPLE ETWORK ANAGEMENT ROTOCOL Web – Click SNMP, SNMPv3, Remote Users. Click New to configure a user name. In the New User page, define a name and assign it to a group, then click Add to save the configuration and return to the User Name list. To delete a user, check the box next to the user name, then click Delete.
Page 114: Configuring Snmpv3 Groups
ONFIGURING THE WITCH CLI – Use the snmp-server user command to configure a new user name and assign it to a group. Console(config)#snmp-server user mark group r&d remote 192.168.1.19 v3 auth md5 greenpeace priv des56 einstien Console(config)#exit Console#show snmp user No user exist.
Page 115: Table 3-5 Supported Notification Messages
• Notify View – The configured view for notifications. (Range: 1-64 characters) Table 3-5 Supported Notification Messages Object Label Object ID RFC 1493 Traps newRoot 1.3.6.1.2.1.17.0.1 topologyChange 1.3.6.1.2.1.17.0.2 SNMPv2 Traps coldStart 1.3.6.1.6.3.1.1.5.1 IMPLE ETWORK ANAGEMENT ROTOCOL Description The newRoot trap indicates that the sending agent has become the new root of the Spanning...
Page 116 ONFIGURING THE WITCH Table 3-5 Supported Notification Messages (Continued) Object Label warmStart linkDown linkUp 3-62 Object ID 1.3.6.1.6.3.1.1.5.2 1.3.6.1.6.3.1.1.5.3 1.3.6.1.6.3.1.1.5.4 Description A warmStart trap signifies that the SNMPv2 entity, acting in an agent role, is reinitializing itself such that its configuration is unaltered.
Page 117 Table 3-5 Supported Notification Messages (Continued) Object Label Object ID authenticationFailure 1.3.6.1.6.3.1.1.5.5 RMON Events (V2) risingAlarm 1.3.6.1.2.1.16.0.1 fallingAlarm 1.3.6.1.2.1.16.0.2 Private Traps swPowerStatus 1.3.6.1.4.1.259.6.10.94.2.1.0.1 ChangeTrap swIpFilterRejectTrap 1.3.6.1.4.1.259.6.10.94.2.1.0.40 This trap is sent when an a. These are legacy notifications and therefore must be enabled in conjunction with the corresponding traps on the SNMP Configuration menu (page 3-51).
Page 118: Figure 3-30 Configuring Snmpv3 Groups
ONFIGURING THE WITCH Web – Click SNMP, SNMPv3, Groups. Click New to configure a new group. In the New Group page, define a name, assign a security model and level, and then select read and write views. Click Add to save the new group and return to the Groups list.
Page 119: Setting Snmpv3 Views
CLI – Use the snmp-server group command to configure a new group, specifying the security model and level, and restricting MIB access to defined read and write views. Console(config)#snmp-server group secure-users v3 priv read defaultview write defaultview notify defaultview Console(config)#exit Console#show snmp group Group Name: secure-users Security Model: v3...
Page 120: Figure 3-31 Configuring Snmpv3 Views
In the New View page, define a name and specify OID subtrees in the switch MIB to be included or excluded in the view. Click Back to save the new view and return to the SNMPv3 Views list. For a specific view, click on View OID Subtrees to display the current configuration, or click on Edit OID Subtrees to make changes to the view settings.
Page 121: User Authentication
Subtree OID: 1 View Type: included Storage Type: nonvolatile Row Status: active Console# User Authentication You can restrict management access to this switch using the following options: • User Accounts – Manually configure access rights on the switch for specified users. •...
Page 122: Configuring User Accounts
ONFIGURING THE WITCH • ACL - Access Control Lists (ACL) provide packet filtering for IP frames (based on address, protocol, Layer 4 protocol port number or TCP control code) or any frames (based on MAC address or Ethernet type). • IP Filter –...
Page 123: Configuring Local/Remote Logon Authentication
Use the Authentication Settings menu to restrict management access based on specified user names and passwords. You can manually configure access rights on the switch, or you can use a remote access authentication server based on RADIUS or TACACS+ protocols.
Page 124 Command Usage • By default, management access is always checked against the authentication database stored on the local switch. If a remote authentication server is used, you must specify the authentication sequence and the corresponding parameters for the remote authentication protocol. Local and remote logon authentication control management access via the console port, web browser, or Telnet.
Page 125 Authentication – Select the authentication, or authentication sequence required: - Local – User authentication is performed only locally by the switch. - Radius – User authentication is performed using a RADIUS server only. - TACACS – User authentication is performed using a TACACS+ server only.
Page 126 (Range: 1-30; Default: 2) - Timeout for a reply – The number of seconds the switch waits for a reply from the RADIUS server before it resends the request. (Range: 1-65535; Default: 5) •...
Page 127: Figure 3-33. Authentication Settings
Web – Click Security, Authentication Settings. To configure local or remote authentication preferences, specify the authentication sequence (i.e., one to three methods), fill in the parameters for RADIUS or TACACS+ authentication if selected, and click Apply. Figure 3-33. Authentication Settings CLI –...
Page 128: Configuring Https
ONFIGURING THE WITCH Configuring HTTPS You can configure the switch to enable the Secure Hypertext Transfer Protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Command Usage • Both the HTTP and HTTPS service can be enabled independently on the switch.
Page 129: Figure 3-34. Https Settings
(Default: Enabled) • Change HTTPS Port Number – Specifies the UDP port number used for HTTPS/SSL connection to the switch’s web interface. (Default: Port 443) • TFTP Server IP Address – Specifies the TFTP Server where the authorized certificate will be saved.
Page 130: Replacing The Default Secure-Site Certificate
Source certificate file name: <certificate file name> Source private file name: <private key file name> Private password: <password for private key> Note: The switch must be reset for the new certificate to be activated. To reset the switch, type: 3-76...
Page 131: Configuring The Secure Shell
Berkley remote access tools. SSH can also provide remote management access to this switch as a secure replacement for Telnet. When the client contacts the switch via the SSH protocol, the switch generates a public-key that the client uses along with a local user name and password for access authentication.
Page 132 51941746772984865468615717739390164779355942303577413098022737087794545240839 71752646358058176716709574804776117 3. Import Client’s Public Key to the Switch – Use the copy tftp public-key command (page 4-84) to copy a file containing the public key for all the SSH client’s granted management access to the switch. (Note that these...
Page 133: Configuring The Ssh Settings
The switch compares the client's public key to those stored in memory. c. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. d. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch.
Page 134: Figure 3-35. Ssh Server Settings
SSH Server-Key Size – Specifies the SSH server key size. (Range: 512-896 bits; Default:768) - The server key is a private key that is never shared outside the switch. - The host key is shared with the SSH client, and is fixed at 1024 bits.
Page 135: Generating The Host Key Pair
Generating the Host Key Pair A host public/private key pair is used to provide secure communications between an SSH client and the switch. After generating this key pair, you must provide the host public key to SSH clients and import the client’s public key to the switch as described in the proceeding section (Command Usage).
Page 136: Figure 3-36. Ssh Host-Key Settings
(Range: RSA, DSA, Both: Default: RSA) The SSH server uses RSA or DSA for key exchange when the client first establishes a connection with the switch, and then negotiates with the client to select either DES (56-bit) or 3DES (168-bit) for data encryption.
Page 137: Generating The User Public Key Pair
Generating the User Public Key Pair A user public/private key pair is used to provide secure communications between an SSH client and the switch. After generating this key pair, you must provide the user public key to SSH clients and import the client’s public key to the switch as described in the proceeding section (Command Usage).
Page 138 (i.e., public and private keys). (Range: RSA, DSA, Both: Default: RSA) The SSH server uses RSA or DSA for key exchange when the client first establishes a connection with the switch, and then negotiates with the client to select either DES (56-bit) or 3DES (168-bit) for data encryption.
Page 139: Figure 3-37. Ssh User Public-Key Settings
UTHENTICATION Web – Click Security, SSH, SSH User-Key Settings. Select the user type and public-key type from the drop-down box, enter the TFTP server IP address, input the source file name, and then click Copy Public Key. Figure 3-37. SSH User Public-Key Settings 3-85...
Page 140: Configuring Port Security
DMdAfjnte8MZZs= Console# Configuring Port Security Port security is a feature that allows you to configure a switch port with one or more device MAC addresses that are authorized to access the network through that port. When port security is enabled on a port, the switch stops learning new MAC addresses on the specified port.
Page 141 learning. Be sure you enable the learning function long enough to ensure that all valid VLAN members have been registered on the selected port. Note that you can also restrict the maximum number of addresses that can be learned by a port. To add new VLAN members at a later time, you can manually add secure addresses with the Static Address Table (page 3-140), or turn off port security to reenable the learning function long enough for new VLAN...
Page 142: Configuring 802.1X Port Authentication
Apply. CLI – This example sets the command mode to Port 5, sets the port security action to send a trap and disable the port, and then enables port security for the switch. Console(config)#interface ethernet 1/5 Console(config-if)#port security action trap-and-shutdown...
Page 143 UTHENTICATION Access to all switch ports in a network can be centrally controlled from a server, which means that authorized users can use the same credentials for authentication from any point within the network. This switch uses the Extensible Authentication Protocol over LANs...
Page 144: Displaying 802.1X Global Settings
RADIUS authentication must be enabled on the switch and the IP address of the RADIUS server specified. • Each switch port that will be used must be set to dot1x “Auto” mode. • Each client that needs to be authenticated must have dot1x client software installed and properly configured.
Page 145: Configuring 802.1X Global Settings
802.1X is disabled on port 1/28 Console# Configuring 802.1X Global Settings The 802.1X protocol provides port authentication. The 802.1X protocol must be enabled globally for the switch system before port settings are active. Command Attributes • 802.1X System Authentication Control – Sets the global setting for 802.1X.
Page 146: Configuring Port Settings For 802.1X
• Re-authen – Sets the client to be re-authenticated after the interval specified by the Re-authentication Period. Re-authentication can be used to detect if a new device is plugged into a switch port. (Default: Disabled) 3-92...
Page 147: Figure 3-41. 802.1X Port Configuration
EAP request packet to the client before it times out the authentication session. (Range: 1-10; Default 2) • Quiet Period – Sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. (Range: 1-65535 seconds; Default: 60 seconds) •...
Page 148 ONFIGURING THE WITCH Console(config)#interface ethernet 1/2 Console(config-if)#dot1x port-control auto Console(config-if)#dot1x re-authentication Console(config-if)#dot1x max-req 5 Console(config-if)#dot1x timeout quiet-period 30 Console(config-if)#dot1x timeout re-authperiod 1800 Console(config-if)#dot1x timeout tx-period 40 Console(config-if)#exit Console(config)#exit Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status disabled enabled 1/28...
Page 149: Displaying 802.1X Statistics
Displaying 802.1X Statistics This switch can display statistics for dot1x protocol exchanges for any port. Statistical Values Parameter Rx EXPOL Start Rx EAPOL Logoff Rx EAPOL Invalid Rx EAPOL Total Rx EAP Resp/Id Rx EAP Resp/Oth Rx EAP LenError Rx Last EAPOLVer...
Page 150: Figure 3-42. Displaying 802.1X Port Statistics
ONFIGURING THE WITCH Parameter Tx EAP Req/Id Tx EAP Req/Oth Web – Select Security, 802.1X, Statistics. Select the required port and then click Query. Click Refresh to update the statistics. Figure 3-42. Displaying 802.1X Port Statistics 3-96 Table 3-7. 802.1X Statistics (Continued) Descripton The number of EAP Req/Id frames that have been transmitted by this Authenticator.
Page 151: Access Control Lists
An ACL is a sequential list of permit or deny conditions that apply to IP addresses, MAC addresses, or other more specific criteria. This switch tests ingress or egress packets against the conditions in an ACL one by one. A packet will be accepted as soon as it matches a permit rule, or dropped as soon as it matches a deny rule.
Page 152: Setting The Acl Name And Type
Each ACL can have up to 60 rules. • This switch supports ACLs for ingress filtering only. However, you can only bind one IP ACL to any port for ingress filtering. In other words, only one ACL can be bound to an interface - Ingress IP ACL.
Page 153: Configuring A Standard Ip Acl
Web – Click Security, ACL, Configuration. Enter an ACL name in the Name field, select the list type (IP Standard, IP Extended, or MAC), and click Add to open the configuration page for the new list. Figure 3-43. Naming and Choosing ACLs CLI –...
Page 154: Configuring An Extended Ip Acl
ONFIGURING THE WITCH Web – Specify the action (i.e., Permit or Deny). Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range. Then click Add.
Page 155 of addresses with the Address and SubMask fields. (Options: Any, Host, IP; Default: Any) • Src/Dst IP Address – Source or destination IP address. • Src/Dst Subnet Mask – Subnet mask for source or destination address. (See the description for SubMask on page 3-99.) •...
Page 156: Figure 3-45. Configuring Extended Ip Acls
ONFIGURING THE WITCH For example, use the code value and mask below to catch packets with the following flags set: - SYN flag valid, use control-code 2, control bitmask 2 - Both SYN and ACK valid, use control-code 18, control bitmask 18 - SYN valid and ACK invalid, use control-code 2, control bitmask 18 Web –...
Page 157: Configuring A Mac Acl
3. Permit all TCP packets from class C addresses 192.168.1.0 with the TCP control code set to “SYN.” Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any Console(config-ext-acl)#permit 192.168.1.0 255.255.255.0 any dport 80 Console(config-ext-acl)#permit 192.168.1.0 255.255.255.0 any tcp control-code 2 2 Console(config-std-acl)# Configuring a MAC ACL Command Attributes •...
Page 158: Figure 3-46. Configuring Mac Acls
ONFIGURING THE WITCH - Tagged-eth2 – Tagged Ethernet II packets. - Tagged-802.3 – Tagged Ethernet 802.3 packets. Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or MAC). If you select "Host,"...
Page 159: Binding A Port To An Access Control List
Each ACL can have up to 60 rules. • This switch supports ACLs for ingress filtering only. However, you can only bind one IP or MAC ACL to any port for ingress filtering. In other words, only one ACL can be bound to an interface - Ingress IP or MAC ACL.
Page 160: Filtering Management Access
• If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager.
Page 161: Figure 3-48. Filtering Management Access
Command Attributes • Web IP Filter – Configures IP address(es) for the web group. • SNMP IP Filter – Configures IP address(es) for the SNMP group. • Telnet IP Filter – Configures IP address(es) for the Telnet group. • IP Filter List – IP address which are allowed management access to this interface.
Page 162: Port Configuration
ONFIGURING THE WITCH Port Configuration Displaying Connection Status You can use the Port Information or Trunk Information pages to display the current connection status, including link state, speed/duplex mode, flow control, and auto-negotiation. Field Attributes (Web) • Name – Interface label. •...
Page 163: Figure 3-49. Port Status Information
Port type – Indicates the port type. (1000BASE-T, 1000BASE-SX, 1000BASE-LX or 100BASE-FX) • MAC address – The physical layer address for this port. (To access this item on the web, see “Setting the Switch’s IP Address” on page 3-19.) Configuration: •...
Page 164 ONFIGURING THE WITCH • Capabilities – Specifies the capabilities to be advertised for a port during auto-negotiation. (To access this item on the web, see “Configuring Interface Connections” on page 3-48.) The following capabilities are supported. - 10half - Supports 10 Mbps half-duplex operation - 10full - Supports 10 Mbps full-duplex operation - 100half - Supports 100 Mbps half-duplex operation - 100full - Supports 100 Mbps full-duplex operation...
Page 165: Configuring Interface Connections
CLI – This example shows the connection status for Port 5. Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: 100TX Mac address: 00-30-f1-47-58-46 Configuration: Name: Port admin: Up Speed-duplex: Auto Capabilities: 10half, 10full, 100half, 100full Broadcast storm: Enabled Broadcast storm limit: 500 packets/second Flow control: Disabled...
Page 166 - Sym (Gigabit only) - Check this item to transmit and receive pause frames, or clear it to auto-negotiate the sender and receiver for asymmetric pause frames. (The current switch chip only supports symmetric pause frames.) - FC - Supports flow control - Flow control can eliminate frame loss by “blocking”...
Page 167: Creating Trunk Groups
Web – Click Port, Port Configuration or Trunk Configuration. Modify the required interface settings, and click Apply. Figure 3-50. Configuring Port Attributes CLI – Select the interface, and then enter the required settings. Console(config)#interface ethernet 1/13 Console(config-if)#description RD SW#13 Console(config-if)#shutdown Console(config-if)#no shutdown Console(config-if)#no negotiation Console(config-if)#speed-duplex 100half...
Page 168 Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • You can create up to 8 trunks on the switch, with up to eight ports per trunk. • The ports at both ends of a connection must be configured as trunk ports.
Page 169: Statically Configuring A Trunk
However, note that the static trunks on this switch are Cisco EtherChannel compatible. • To avoid creating a loop in the network, be sure you add a static...
Page 170: Figure 3-51. Static Trunk Configuration
Web – Click Port, Trunk Membership. Enter a trunk ID in the Trunk field, select any of the switch ports from the scroll-down port list, and click Add. After you have completed adding ports to the member list, click Apply.
Page 171: Enabling Lacp On Selected Ports
CLI – This example creates trunk 2 with ports 1 and 2. Just connect these ports to two static trunk ports on another switch to form a trunk. Console(config)#interface port-channel 2 Console(config-if)#exit Console(config)#interface ethernet 1/1 Console(config-if)#channel-group 1 Console(config-if)#exit Console(config)#interface ethernet 1/2...
Page 172: Figure 3-52. Lacp Port Configuration
ID. • If more than eight ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails.
Page 173: Configuring Lacp Parameters
CLI – The following example enables LACP for ports 1 to 6. Just connect these ports to LACP-enabled trunk ports on another switch to form a trunk. Console(config)#interface ethernet 1/1 Console(config-if)#lacp Console(config-if)#exit Console(config)#interface ethernet 1/6 Console(config-if)#lacp Console(config-if)#end Console#show interfaces status port-channel 1...
Page 174 - Ports must be configured with the same system priority to join the same LAG. - System priority is combined with the switch’s MAC address to form the LAG identifier. This identifier is used to indicate a specific LAG during LACP negotiations with other systems.
Page 175: Figure 3-53. Lacp Aggregation Port Configuration
ONFIGURATION Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and Port Priority for the Port Actor. You can optionally configure these settings for the Port Partner. (Be aware that these settings only affect the administrative state of the partner, and will not take effect until the next time an aggregate link is formed with this device.) After you have completed setting the port LACP parameters, click Apply.
Page 176: Displaying Lacp Port Counters
ONFIGURING THE WITCH CLI – The following example configures LACP parameters for ports 1-6. Ports 1-4 are used as active members of the LAG; ports 5 and 6 are set to backup mode. Console(config)#interface ethernet 1/1 Console(config-if)#lacp actor system-priority 3 Console(config-if)#lacp actor admin-key 120 Console(config-if)#lacp actor port-priority 128 Console(config-if)#exit...
Page 177: Figure 3-54. Displaying Lacp Port Counters Information
Table 3-8. LACP Port Counter Information (Continued) Field Description Marker Receive Number of valid Marker PDUs received by this channel group. Marker Unknown Pkts Number of frames received that either (1) Carry the Slow Protocols Ethernet Type value, but contain an unknown PDU, or (2) are addressed to the Slow Protocols group MAC Address, but do not carry the Slow Protocols Ethernet Type.
Page 178: Displaying Lacp Settings And Status For The Local Side
ONFIGURING THE WITCH CLI – The following example displays LACP counters for port channel 1. Console#show 1 lacp counters Channel group : 1 ------------------------------------------------------------------- Eth 1/ 1 ------------------------------------------------------------------- LACPDUs Sent : 21 LACPDUs Received : 21 Marker Sent : 0 Marker Received : 0 LACPDUs Unknown Pkts : 0 LACPDUs Illegal Pkts : 0...
Page 179 Field Description Admin State, Administrative or operational values of the actor’s state Oper State parameters: • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner.
Page 180: Figure 3-55. Displaying Lacp Port Information
ONFIGURING THE WITCH Web – Click Port, LACP, Port Internal Information. Select a port channel to display the corresponding information. Figure 3-55. Displaying LACP Port Information CLI – The following example displays the LACP configuration settings and operational state for the local side of port channel 1. Console#show 1 lacp internal Channel group : 1 -------------------------------------------------------------------...
Page 181: Displaying Lacp Settings And Status For The Remote
Displaying LACP Settings and Status for the Remote Side You can display configuration settings and the operational state for the remote side of an link aggregation. Neighbor Configuration Information Table 3-10. LACP Remote Side Settings Field Partner Admin System Partner Oper System Partner Admin Port Number Partner Oper...
Page 182: Figure 3-56. Displaying Remote Lacp Port Information
ONFIGURING THE WITCH Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-56. Displaying Remote LACP Port Information CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1. Console#show 1 lacp neighbors Channel group 1 neighbors -------------------------------------------------------------------...
Page 183: Setting Broadcast Storm Thresholds
• Broadcast Storm Control is enabled by default. • Broadcast control does not effect IP multicast traffic. • The specified threshold applies to each individual port on the switch. Command Attributes • Port – Port number. • Type – Indicates the port type. (100BASE-TX, 1000BASE-T, or SFP) •...
Page 184: Figure 3-57. Enabling Port Broadcast Control
ONFIGURING THE WITCH Web – Click Port, Port Broadcast Control or Trunk Broadcast Control. Set the threshold for each port, click Apply. Figure 3-57. Enabling Port Broadcast Control CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 500 packets per second for port 2.
Page 185: Configuring Port Mirroring
Configuring Port Mirroring You can mirror traffic from any source port to a target port for real-time analysis. You can then attach a logic analyzer or RMON probe to the target port and study the traffic crossing the source port in a completely unobtrusive manner.
Page 186: Configuring Rate Limits
This function allows the network manager to control the maximum rate for traffic received on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic coming into the switch. Packets that exceed the acceptable amount of traffic are dropped.
Page 187: Figure 3-59. Configuring Input Port Rate Limiting
Command Usage • Input and output rate limits can be enabled or disabled for individual interfaces. Command Attribute • Port/Trunk – Display the port number. • Input/Output Rate Limit Status– Enables or disables the rate limit (Default: Enabled) • Input/Output Rate Limit Level - Sets the rate limit level. Web - Click Port, Rate Limit, Input/Output Port/Trunk Configuration.
Page 188: Showing Port Statistics
RMON MIB. Interfaces and Ethernet-like statistics display errors on the traffic passing through each port. This information can be used to identify potential problems with the switch (such as a faulty port or unusually heavy loading). RMON statistics provide access to a broad range of statistics, including a total count of different frame types and sizes passing through each port.
Page 189 Table 3-11. Port Statistics (Continued) Parameter Received Discarded Packets Received Unknown Packets Received Errors Transmit Octets Transmit Unicast Packets Transmit Multicast Packets The total number of packets that higher-level Transmit Broadcast Packets Transmit Discarded Packets Transmit Errors Etherlike Statistics Description The number of inbound packets which were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a...
Page 190 ONFIGURING THE WITCH Parameter Alignment Errors Late Collisions FCS Errors Excessive Collisions Single Collision Frames Internal MAC Transmit Errors Multiple Collision Frames A count of successfully transmitted frames for which Carrier Sense Errors SQE Test Errors Frames Too Long Deferred Transmissions 3-136 Table 3-11.
Page 191 Table 3-11. Port Statistics (Continued) Parameter Internal MAC Receive Errors RMON Statistics Drop Events Jabbers Received Bytes Collisions Received Frames Broadcast Frames Multicast Frames CRC/Alignment Errors Undersize Frames Oversize Frames Description A count of frames for which reception on a particular interface fails due to an internal MAC sublayer receive error.
Page 192: Figure 3-60. Displaying Port Statistics
ONFIGURING THE WITCH Parameter Fragments 64 Bytes Frames 65-127 Byte Frames 128-255 Byte Frames 256-511 Byte Frames 512-1023 Byte Frames 1024-1518 Byte Frames 1519-1536 Byte Frames Web – Click Port, Port Statistics. Select the required interface, and click Query. You can also use the Refresh button at the bottom of the page to update the screen.
Page 193: Figure 3-61. Displaying Etherlike And Rmon Statistics
ONFIGURATION Figure 3-61. Displaying Etherlike and RMON Statistics 3-139...
Page 194: Address Table Settings
Setting Static Addresses A static address can be assigned to a specific interface on this switch. Static addresses are bound to the assigned interface and will not be moved. When a static address is seen on another interface, the address will be ignored and will not be written to the address table.
Page 195: Figure 3-62. Mapping Ports To Static Addresses
MAC address and VLAN, then click Add Static Address. Figure 3-62. Mapping Ports to Static Addresses CLI – This example adds an address to the static address table, but sets it to be deleted when the switch is reset. Console(config)#mac-address-table static 00-e0-29-94-34-de interface ethernet 1/1 vlan 1 delete-on-reset...
Page 196: Displaying The Address Table
Displaying the Address Table The Dynamic Address Table contains the MAC addresses learned by monitoring the source address for traffic entering the switch. When the destination address for inbound traffic is found in the database, the packets intended for that address are forwarded directly to the associated port.
Page 197: Figure 3-63. Displaying The Mac Dynamic Address Table
Web – Click Address Table, Dynamic Addresses. Specify the search type (i.e., mark the Interface, MAC Address, or VLAN checkbox), select the method of sorting the displayed addresses, and then click Query. Figure 3-63. Displaying the MAC Dynamic Address Table CLI –...
Page 198: Changing The Aging Time
The Spanning Tree Algorithm (STA) can be used to detect and disable network loops, and to provide backup links between switches, bridges or routers. This allows the switch to interact with other bridging devices (that is, an STA-compliant switch, bridge or router) in your network to ensure...
Page 199 RSTP – Rapid Spanning Tree Protocol (IEEE 802.1w) STA uses a distributed algorithm to select a bridging device (STA-compliant switch, bridge or router) that serves as the root of the spanning tree network. It selects a root port on each bridging device (except for the root device) which incurs the lowest path cost when forwarding a packet from that device to the root device.
Page 200: Displaying Global Settings
STA Information screen. Field Attributes • Spanning Tree State – Shows if the switch is enabled to participate in an STA-compliant network. • Bridge ID – A unique identifier for this bridge, consisting of the bridge priority and MAC address (where the address is taken from the switch system).
Page 201 Designated Root – The priority and MAC address of the device in the Spanning Tree that this switch has accepted as the root device. - Root Port – The number of the port on this switch that is closest to the root. This switch communicates with the root device through this port.
Page 202: Figure 3-65. Displaying The Spanning Tree Algorithm
ONFIGURING THE WITCH receive configuration messages at regular intervals. If the root port ages out STA information (provided in the last configuration message), a new root port is selected from among the device ports attached to the network. (References to “ports” in this section means “interfaces,” which includes both ports and trunks.) •...
Page 203: Configuring Global Settings
Path Cost Method: Note: The current root port and current root cost display as zero when this device is not connected to the network. Configuring Global Settings Global settings apply to the entire switch. Command Usage • Spanning Tree Protocol Uses RSTP for the internal state machine, but sends only 802.1D...
Page 204 RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU (i.e., STP BPDU) after a port’s migration delay timer expires, the switch assumes it is connected to an 802.1D bridge and starts using only 802.1D BPDUs.
Page 205 Root Device Configuration • Hello Time – Interval (in seconds) at which the root device transmits a configuration message. - Default: 2 - Minimum: 1 - Maximum: The lower of 10 or [(Max. Message Age / 2) -1] • Maximum Age – The maximum time (in seconds) a device can wait without receiving a configuration message before attempting to reconfigure.
Page 206 ONFIGURING THE WITCH Configuration Settings for RSTP The following attributes apply to RSTP: • Path Cost Method – The path cost is used to determine the best path between devices. The path cost method is used to determine the range of values that can be assigned to each interface.
Page 207: Displaying Interface Settings
- A port on a network segment with no other STA compliant bridging device is always forwarding. - If two ports of a switch are connected to the same segment and there is no other STA device attached to this segment, the port with the smaller ID forwards packets and the other is discarding.
Page 208 ONFIGURING THE WITCH - All ports are discarding when the switch is booted, then some of them change state to learning, and then to forwarding. • Forward Transitions – The number of times this port has transitioned from the Learning state to the Forwarding state.
Page 209 Priority – Defines the priority used for this port in the Spanning Tree Algorithm. If the path cost for all ports on a switch is the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
Page 210: Figure 3-67. Displaying Sta - Port Status Information
WITCH • Designated root – The priority and MAC address of the device in the Spanning Tree that this switch has accepted as the root device. • Fast forwarding – This field provides the same information as Admin Edge port, and is only included for backward compatibility with earlier products.
Page 211: Configuring Interface Settings
CLI – This example shows the STA attributes for port 5. Console#show spanning-tree ethernet 1/5 1/ 5 information -------------------------------------------------------------- Admin status Role State External path cost Internal path cost Priority Designated cost Designated port Designated root Designated bridge Fast forwarding Forward transitions Admin edge port Oper edge port...
Page 212 Priority – Defines the priority used for this port in the Spanning Tree Protocol. If the path cost for all ports on a switch are the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
Page 213 - Point-to-Point – A connection to exactly one other bridge. - Shared – A connection to two or more bridges. - Auto – The switch automatically determines if the interface is attached to a point-to-point link or to shared media. (This is the default setting.)
Page 214: Figure 3-68. Configuring Spanning Tree Algorithm Per Port
ONFIGURING THE WITCH • Migration – If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the Protocol Migration button to manually re-check the appropriate BPDU format (RSTP or STP-compatible) to send on the selected interfaces.
Page 215: Vlan Configuration
Overview In large networks, routers are used to isolate broadcast traffic for each subnet into separate domains. This switch provides a similar service at Layer 2 by using VLANs to organize any group of network nodes into separate broadcast domains. VLANs confine broadcast traffic to the originating group, and can eliminate broadcast storms in large networks.
Page 216: Assigning Ports To Vlans
VLAN Classification – When the switch receives a frame, it classifies the frame in one of two ways. If the frame is untagged, the switch assigns the frame to an associated VLAN (based on the default VLAN ID of the receiving port).
Page 217 IEEE 802.1Q VLAN protocol, it can be configured to broadcast a message to your network indicating the VLAN groups it wants to join. When this switch receives these messages, it will automatically place the receiving port in the specified VLANs, and then forward the message to all other ports.
Page 218: Forwarding Tagged/Untagged Frames
When forwarding a frame from this switch along a path that contains any VLAN-aware devices, the switch should include VLAN tags. When forwarding a frame from this switch along a path that does not contain any VLAN-aware devices (including the destination host), the switch must first strip off the VLAN tag before forwarding the frame.
Page 219: Displaying Basic Vlan Information
VLAN(s) indicated by the frame tag. However, when this switch receives an untagged frame from a VLAN-unaware device, it first decides where to forward the frame, and then inserts a VLAN tag reflecting the ingress port’s default VID. Displaying Basic VLAN Information The VLAN Basic Information page displays basic information on the VLAN type supported by the switch.
Page 220: Displaying Current Vlans
Up Time at Creation – Time this VLAN was created (i.e., System Up Time). • Status – Shows how this VLAN was added to the switch. - Dynamic GVRP: Automatically learned via GVRP. - Permanent: Added as a static entry.
Page 221: Figure 3-70. Displaying Vlan Information By Port Membership
Command Attributes (CLI) • VLAN – ID of configured VLAN (1-4093, no leading zeroes). • Type – Shows how this VLAN was added to the switch. - Dynamic: Automatically learned via GVRP. - Static: Added as a static entry. •...
Page 222: Creating Vlans
Console# Creating VLANs Use the VLAN Static List to create or remove VLAN groups. To propagate information about VLAN groups used on this switch to external network devices, you must specify a VLAN ID for each of these groups. Command Attributes •...
Page 223: Vlan C Onfiguration
• Remove – Removes a VLAN group from the current list. If any port is assigned to this group as untagged, it will be reassigned to VLAN group 1 as untagged. Web – Click VLAN, 802.1Q VLAN, Static List. To create a new VLAN, enter the VLAN ID and VLAN name, mark the Enable checkbox to activate the VLAN, and then click Add.
Page 224: Adding Static Members To Vlans (Vlan Index)
VLAN compliant devices, or untagged they are not connected to any VLAN-aware devices. Or configure a port as forbidden to prevent the switch from automatically adding it to a VLAN via the GVRP protocol. Notes: 1. You can also use the VLAN Static Membership by Port page to configure VLAN groups based on the port index (page 3-172).
Page 225: Figure 3-72. Configuring Vlan Port Attributes
- Untagged: Interface is a member of the VLAN. All packets transmitted by the port will be untagged, that is, not carry a tag and therefore not carry VLAN or CoS information. Note that an interface can only have one untagged VLAN, which must be the same as the Port VID.
Page 226: Adding Static Members To Vlans (Port Index)
ONFIGURING THE WITCH CLI – The following example adds tagged and untagged ports to VLAN 2. Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 2 tagged Console(config-if)#exit Console(config)#interface ethernet 1/2 Console(config-if)#switchport allowed vlan add 2 untagged Console(config-if)#exit Console(config)#interface ethernet 1/13 Console(config-if)#switchport allowed vlan add 2 tagged Adding Static Members to VLANs (Port Index) Use the VLAN Static Membership by Port menu to assign VLAN groups to the selected interface as a tagged member.
Page 227: Configuring Vlan Behavior For Interfaces
Figure 3-73. Assigning VLAN Port and Trunk Groups CLI – This example adds Port 3 to VLAN 1 as a tagged port, and removes Port 3 from VLAN 2. Console(config)#interface ethernet 1/3 Console(config-if)#switchport allowed vlan add 1 tagged Console(config-if)#switchport allowed vlan remove 2 Configuring VLAN Behavior for Interfaces You can configure VLAN behavior for specific interfaces, including the default VLAN identifier (PVID), accepted frame types, and ingress...
Page 228 ONFIGURING THE WITCH • Acceptable Frame Type – Sets the interface to accept all frame types, including tagged or untagged frames, or only tagged frames. When set to receive all frame types, any received frames that are untagged are assigned to the default VLAN. (Option: All, Tagged; Default: All) •...
Page 229: Figure 3-74. Configuring Vlan Ports
Web – Click VLAN, 802.1Q VLAN, Port Configuration or Trunk Configuration. Fill in the required settings for each interface, click Apply. Figure 3-74. Configuring VLAN Ports CLI – This example sets port 3 to accept only tagged frames, assigns PVID 3 as the native VLAN ID, and then sets the switchport mode to hybrid.
Page 230: Configuring Private Vlans
Internet, while the community ports provide restricted access to local users. Multiple primary VLANs can be configured on this switch, and multiple community VLANs can be associated with each primary VLAN. (Note that private VLANs and normal VLANs can exist simultaneously within the same switch.)
Page 231: Displaying Current Private Vlans
Displaying Current Private VLANs The Private VLAN Information page displays information on the private VLANs configured on the switch, including primary and community VLANs, and their assigned interfaces. Command Attributes • VLAN ID – ID of configured VLAN (1-4093), and VLAN type.
Page 232: Figure 3-75. Private Vlan Information
VLAN ID drop-down menu. Figure 3-75. Private VLAN Information CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and are associated with VLAN 6.
Page 233: Configuring Private Vlans
Web – Click VLAN, Private VLAN, Configuration. Enter the VLAN ID number, select Primary, or Community type, then click Add. To remove a private VLAN from the switch, highlight an entry in the Current list box and then click Remove. Note that all member ports must be removed from the VLAN before it can be deleted.
Page 234: Associating Vlans
ONFIGURING THE WITCH Associating VLANs Each community VLAN must be associated with a primary VLAN. Command Attributes • Primary VLAN ID - ID of primary VLAN (1-4093). • Association - Community VLANs associated with the selected primary VLAN. • Non-Association - Community VLANs not associated with the selected VLAN.
Page 235: Displaying Private Vlan Interface Information
Information menus to display the interface associated with private VLANs. Command Attributes • Port/Trunk - The switch interface. • PVLAN Port Type - Displays private VLAN port types. - Normal – The port is not configured in a private VLAN.
Page 236: Configuring Private Vlan Interfaces
Information. Figure 3-78. Private VLAN Port Information CLI – This example shows the switch configured with primary VLAN 5 and community VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as host ports and associated with VLAN 6.
Page 237: Figure 3-79. Private Vlan Port Configuration
- Host – The port is a community port. A community port can communicate with other ports in its own community VLAN and with designated promiscuous port(s). - Promiscuous – A promiscuous port can communicate with all the interfaces within a private VLAN. •...
Page 238: Configuring Protocol Vlans
ONFIGURING THE WITCH CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and associated with VLAN 6.
Page 239: Configuring Protocol Vlan System
Web – Click VLAN, Protocol VLAN, Configuration. Figure 3-80. Protocol VLAN Configuration Configuring Protocol VLAN System Use the Protocol VLAN System Configuration menu to set the protocol VLAN settings for the switch. Command Attributes • Protocol Group ID - Protocol Group ID assigned to the Protocol VLAN Group.
Page 240: Class Of Service Configuration
Setting the Default Priority for Interfaces You can specify the default port priority for each interface on the switch. All untagged packets entering the switch are tagged with the specified default port priority, and then sorted into the appropriate priority queue at the output port.
Page 241: Mapping Cos Values To Egress Queues
Console# Mapping CoS Values to Egress Queues This switch processes Class of Service (CoS) priority tagged traffic by using eight priority queues for each port, with service schedules based on strict or Weighted Round Robin (WRR). Up to eight separate traffic...
Page 242: Table 3-12. Egress Queue Priority Mapping
The priority levels recommended in the IEEE 802.1p standard for various network applications are shown in the following table. However, you can map the priority levels to the switch’s output queues in any way that benefits application traffic for your own network.
Page 243: Figure 3-83. Configuring Class Of Service
Priority Queue: 0 1 2 1 2 2 3 3 Note: Mapping specific values for CoS priorities is implemented as an interface configuration command, but any changes will apply to the all interfaces on the switch. LASS OF ERVICE ONFIGURATION...
Page 244: Enabling Cos
Web – Click Priority, Traffic Classes Status. Selecting the Queue Mode You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
Page 245: Setting The Service Weight For Traffic Classes
Console# Setting the Service Weight for Traffic Classes This switch uses the Weighted Round Robin (WRR) algorithm to determine the frequency at which it services each priority queue. As described in “Mapping CoS Values to Egress Queues” on page 3-187, the traffic classes are mapped to one of the four egress queues provided for each port.
Page 246: Mapping Layer 3/4 Priorities To Cos Values
Weight Mapping Layer 3/4 Priorities to CoS Values This switch supports one method of prioritizing layer 3/4 traffic to meet application requirements. Traffic priorities can be specified in the IP header of a frame using the number of the TCP port. When these service is enabled, the priorities are mapped to a Class of Service value by the switch, and the traffic then sent to the corresponding output queue.
Page 247: Selecting Ip Dscp Priority
The precedence for priority mapping is IP DSCP Priority, and then Default Port Priority. Selecting IP DSCP Priority The switch allows you to enable or disable IP DSCP priority. Command Attributes • IP DSCP Priority Status – Enables the priority services. Maps layer 3/4 priorities using Differentiated Services Code Point Mapping.
Page 248: Table 3-14. Mapping Dscp Priority
ONFIGURING THE WITCH Table 3-14. IP DSCP Value 10, 12, 14, 16 18, 20, 22, 24 26, 28, 30, 32, 34, 36 38, 40, 42 46, 56 Command Attributes • DSCP Priority Table – Shows the DSCP Priority to CoS map. •...
Page 249: Quality Of Service
CLI – The following example globally enables DSCP Priority service on the switch, maps DSCP value 0 to CoS value 1 (on port 1), and then displays the DSCP Priority settings. Console(config)#map ip dscp Console(config)#interface ethernet 1/1 Console(config-if)#map ip dscp 1 cos 0...
Page 250: Configuring Quality Of Service Parameters
ONFIGURING THE WITCH All switches or routers that access the Internet rely on class information to provide the same forwarding treatment to packets in the same class. Class information can be assigned by end hosts, or switches or routers along the path.
Page 251: Configuring A Class Map
or just reduce the DSCP service level for traffic exceeding the specified rate. 5. Use the “Service Policy” to assign a policy map to a specific interface. Configuring a Class Map A class map is used for matching packets to a specified class. Command Usage •...
Page 252 ONFIGURING THE WITCH • Remove Class – Removes the selected class. Class Configuration • Class Name – Name of the class map. (Range: 1-16 characters) • Type – Only one match command is permitted per class map, so the match-any field refers to the criteria specified by the lone match command.
Page 253: Figure 3-89. Configuring Class Maps
Figure 3-89. Configuring Class Maps CLI – This example creates a class map call “rd-class,” and sets it to match packets marked for DSCP service value 3. Console(config)#class-map rd_class match-any Console(config-cmap)#match ip dscp 3 Console(config-cmap)# UALITY OF ERVICE 3-199...
Page 254: Creating Qos Policies
MAC ACL, IP ACL (including Standard ACL and Extended ACL), IPv6 Standard ACL, and IPv6 Extended ACL. This limitation applies to each switch chip (ES4524D: ports 1-26, ES4548D: ports 1-25, ports 26-50). Also, note that the maximum number of classes that can be applied to a policy map is 16.
Page 255 Command Attributes Policy Map • Modify Name and Description – Configures the name and a brief description of a policy map. (Range: 1-16 characters for the name; 1-64 characters for the description) • Edit Classes – Opens the “Policy Rule Settings” page for the selected class entry.
Page 256 ONFIGURING THE WITCH • Remove Class – Deletes a class. - Policy Settings - • Class Name – Name of class map. • Action – Configures the service provided to ingress traffic by setting a CoS, DSCP, or IP Precedence value in a matching packet (as specified in Match Class Settings on page 3-147).
Page 257: Figure 3-90. Configuring Policy Maps
UALITY OF ERVICE Figure 3-90. Configuring Policy Maps 3-203...
Page 258: Attaching A Policy Map To Ingress Queues
ONFIGURING THE WITCH CLI – This example creates a policy map called “rd-policy,” sets the average bandwidth the 1 Mbps, the burst rate to 1522 bps, and the response to reduce the DSCP value for violating packets to 0. Console(config)#policy-map rd_policy#3 Console(config-pmap)#class rd_class#3 Console(config-pmap-c)#set ip dscp 4 Console(config-pmap-c)#police 100000 1522 exceed-action...
Page 259: Figure 3-91. Service Policy Settings
UALITY OF ERVICE Figure 3-91. Service Policy Settings CLI – This example applies a service policy to an ingress interface. Console(config)#interface ethernet 1/5 Console(config-if)#service-policy input rd_policy#3 Console(config-if)# 3-205...
Page 260: Multicast Filtering
It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service. This procedure is called multicast filtering.
Page 261: Layer 2 Igmp (Snooping And Query)
IGMP querier, you can manually designate a known IGMP querier (i.e., a multicast router/switch) connected over the network to an interface on your switch (page 3-213). This interface will then join all the current multicast groups supported by the attached router/switch to ensure that multicast traffic is passed to all appropriate interfaces within the switch.
Page 262 This is also referred to as IGMP Snooping. (Default: Enabled) • Act as IGMP Querier — When enabled, the switch can serve as the Querier, which is responsible for asking hosts if they want to receive multicast traffic. (Default: Enabled) •...
Page 263: Figure 3-92. Configuring Internet Group Management Protocol
• IGMP Version — Sets the protocol version for compatibility with other devices on the network. (Range: 1-2; Default: 2) Notes: 1. All systems on the subnet must support the same version. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Timeout.
Page 264: Enabling Igmp Filter Status
You can enable the IGMP filter status and set the IGMP profile configuration. Command Attributes • IGMP Filter — When enabled, the switch will filter network traffic/ (Default: Disabled) • Current — Displays the list of current IGMP profiles. •...
Page 265: Figure 3-94. Igmp Immediate Leave
IGMP immediate leave improves bandwidth management for all hosts in a switched network. Command Attributes • VLAN ID — ID of configured VLAN (1-4093) • Immediate Leave — Enable or disable IGMP immediate leave for the selected VLAN. Web – Click IGMP Snooping, IGMP Immediate Leave. Figure 3-94.
Page 266: Displaying Interfaces Attached To A Multicast Router
VLAN ID – ID of configured VLAN (1-4093). • Multicast Router List – Multicast routers dynamically discovered by this switch or those that are statically assigned to an interface on this switch. Web – Click IGMP Snooping, Multicast Router Port Information. Select the required VLAN ID from the scroll-down list to display the associated multicast routers.
Page 267: Specifying Static Interfaces For A Multicast Router
IGMP querier. Therefore, if the IGMP querier is a known multicast router/ switch connected over the network to an interface (port or trunk) on your switch, you can manually configure the interface (and a specified VLAN) to join all the current multicast groups supported by the attached router.
Page 268: Displaying Port Members Of Multicast Services
Web – Click IGMP Snooping, IP Multicast Registration Table. Select a VLAN ID and the IP address for a multicast service from the scroll-down lists. The switch will display all the interfaces that are propagating this multicast service. Figure 3-97. Displaying Port Members of Multicast Services...
Page 269: Assigning Ports To Multicast Services
Query Parameters” on page 3-207. For certain applications that require tighter control, you may need to statically configure a multicast service on the switch. First add all the ports attached to participating hosts to a common VLAN, and then assign the multicast service to that VLAN group.
Page 270: Igmp Filtering And Throttling
The IGMP filtering feature fulfills this requirement by restricting access to specified multicast services on a switch port and IGMP throttling limits the number of simultaneous multicast groups a port can join. 3-216...
Page 271: Configuring Igmp Profile Group
When the maximum number of groups is reached on a port, the switch can take one of two actions; either “deny” or “replace.” If the action is set to deny, any new IGMP join reports will be dropped.
Page 272: Figure 3-99. Igmp Profile Group Configuration
ONFIGURING THE WITCH • Access Mode – Sets the access mode of the profile; either permit or deny. • Current Multicast Address Range List – Lists multicast groups currently included in the profile. Select an entry and click the Remove button to delete it from the list.
Page 273: Configuring Igmp Filter And Throttling
When the maximum number of groups is reached on a port, the switch can take one of two actions; either “deny” or “replace.” If the action is set to deny, any new IGMP join reports will be dropped.
Page 274: Figure 3-100. Igmp Filter And Throttling Port Configuration
ONFIGURING THE WITCH • Current Multicast Groups – Sets the action to take when the maximum number of multicast groups for the interface has been exceeded. • Throttling Action Mode – Select deny or replace. - deny - The new multicast group join report is dropped. - replace - The new multicast group replaces an existing group.
Page 275: Multicast Vlan Registration
CLI – This example assigns IGMP profile number 19 to port 1, and then sets the throttling number and action. The current IGMP filtering and throttling settings for the interface are then displayed. Console(config)#interface ethernet 1/1 Console(config-if)#ip igmp filter 19 Console(config-if)#ip igmp max-groups 10 Console(config-if)#ip igmp max-groups action replace Console(config-if)#end...
Page 276 WITCH Satellite Services General Configuration Guidelines for MVR 1. Enable MVR globally on the switch, select the MVR VLAN, and add the multicast groups that will stream traffic to attached hosts (see “Configuring Global MVR Settings” on page 3-223). 2. Set the interfaces that will join the MVR as source ports or receiver ports (see “Configuring MVR Interface Status”...
Page 277: Configuring Global Mvr Settings
Configuring Global MVR Settings The global settings for Multicast VLAN Registration (MVR) include enabling or disabling MVR for the switch, selecting the VLAN that will serve as the sole channel for common multicast streams supported by the service provider, and assigning the multicast group address for each of these services to the MVR VLAN.
Page 278: Displaying Mvr Interface Status
Oper Status – Shows the link status. • MVR Status – Shows the MVR status. MVR status for source ports is “ACTIVE” if MVR is globally enabled on the switch. MVR status for receiver ports is “ACTIVE” only if there are subscribers receiving 3-224...
Page 279: Displaying Port Members Of Multicast Groups
multicast traffic from one of the MVR groups, or a multicast group has been statically assigned to an interface. • Immediate Leave – Shows if immediate leave is enabled or disabled. • Trunk Member – Shows if port is a trunk member (Port Information only).
Page 280: Figure 3-103. Mvr Group Ip Information
ONFIGURING THE WITCH • Group Port List – Shows the interfaces with subscribers for multicast services provided through the MVR VLAN. Web – Click MVR, Group IP Information. Figure 3-103. MVR Group IP Information CLI – This example following shows information about the interfaces associated with multicast groups assigned to the MVR VLAN.
Page 281: Configuring Mvr Interface Status
When immediate leave is disabled, the switch follows the standard rules by sending a group-specific query to the receiver port and waiting for a response to determine if there are any remaining subscribers for that multicast group before removing the port from the group list.
Page 282: Figure 3-104. Mvr Port Configuration
- Non-MVR – An interface that does not participate in the MVR VLAN. (This is the default type.) • Immediate Leave – Configures the switch to immediately remove an interface from a multicast stream as soon as it receives a leave message for that group.
Page 283: Assigning Static Multicast Groups To Interfaces
CLI – This example configures an MVR source port and receiver port, and then enables immediate leave on the receiver port. Console(config)#interface ethernet 1/1 Console(config-if)#mvr type source Console(config-if)#exit Console(config)#interface ethernet 1/2 Console(config-if)#mvr type receiver Console(config-if)#mvr immediate Console(config-if)# Assigning Static Multicast Groups to Interfaces For multicast streams that will run for a long term and be associated with a stable set of hosts, you can statically bind the multicast group to the participating interfaces.
Page 284: Dhcp Snooping
Console(config-if)# DHCP Snooping DHCP snooping allows a switch to protect a network from rogue DHCP servers or other devices which send port-related information to a DHCP server. This information can be useful in tracking an IP address back to a physical port.
Page 285 OFFER, ACK or NAK messages), the packet is dropped. - If the DHCP packet is from a client, such as a DECLINE or RELEASE message, the switch forwards the packet only if the corresponding entry is found in the binding table.
Page 286: Dhcp Snooping Configuration
The port(s) through which the switch submits a client request to the DHCP server must be configured as trusted. Note that the switch will not add a dynamic entry for itself to the binding table when it receives an ACK message from a DHCP server.
Page 287: Dhcp Snooping Vlan Configuration
DHCP Snooping Information Option Configuration DHCP provides a relay mechanism for sending information about the switch and its DHCP clients to the DHCP server. Known as DHCP Option 82, it allows compatible DHCP servers to use the information when assigning IP addresses, or to set other services or policies for clients.
Page 288 WITCH When the DHCP Snooping Information Option is enabled, clients can be identified by the switch port to which they are connected rather than just their MAC address. DHCP client-server exchange messages are then forwarded directly between the server and client without having to flood them to the entire VLAN.
Page 289: Dhcp Snooping Port Configuration
Console(config)# DHCP Snooping Port Configuration Configures switch ports as trusted or untrusted. An untrusted interface is an interface that is configured to receive messages from outside the network or firewall. A trusted interface is an interface that is configured to receive only messages from within the network.
Page 290: Dhcp Snooping Binding Information
ONFIGURING THE WITCH Web – Click DHCP Snooping, Information Option Configuration. Figure 3-109. DHCP Snooping Port Configuration CLI – This example shows how to enable the DHCP Snooping Trust Status for ports Console(config)#interface ethernet 1/5 Console(config-if)#ip dhcp snooping trust Console(config-if)# DHCP Snooping Binding Information Displays the DHCP snooping binding information.
Page 291: Ip Source Guard
Web – Click DHCP Snooping, DHCP Snooping Binding Information. Figure 3-110. DHCP Snooping Binding Information CLI – This example shows how to display the DHCP Snooping binding table entries Console#show ip dhcp snooping binding MacAddress Interface ----------------- --------------- ---------- -------------------- ---- --------- 11-22-33-44-55-66 192.168.0.99 Eth 1/5...
Page 292: Figure 3-111. Ip Source Guard Port Configuration
If no matching entry is found, the packet is dropped. Command Attributes • Filter Type – Configures the switch to filter inbound traffic based source IP address, or source IP address and corresponding MAC address. (Default: None) - None – Disables IP source guard filtering on the port.
Page 293: Static Ip Source Guard Binding Configuration
• Current Static Binding Table – The list of current static entries in the table. • Port – Switch port number. (Range: 1-28) • VLAN ID – ID of a configured VLAN (Range: 1-4093) • MAC Address – A valid unicast MAC address.
Page 294: Dynamic Ip Source Guard Binding Information
ONFIGURING THE WITCH Web – Click IP Source Guard, Static Configuration. Figure 3-112. Static IP Source Guard Binding Configuration CLI – This example shows how to configure a static source-guard binding on port 5 Console(config)#ip source-guard binding 11-22-33-44-55-66 vlan 1 192.168.0.99 interface ethernet 1/5 Console(config)# Dynamic IP Source Guard Binding Information...
Page 295: Figure 3-113. Dynamic Ip Source Guard Binding Information
Web – Click IP Source Guard, Dynamic Information. Figure 3-113. Dynamic IP Source Guard Binding Information CLI – This example shows how to configure a static source-guard binding on port 5 Console#show ip source-guard binding MacAddress IpAddress Interface ----------------- --------------- ---------- -------------------- ---- -------- 11-22-33-44-55-66 192.168.0.99 Console#...
Page 296: Switch Clustering
A switch cluster has a “Commander” unit that is used to manage all other “Member” switches in the cluster. The management station uses Telnet to communicate directly with the Commander throught its IP address, and the Commander manages Member switches using cluster “internal”...
Page 297: Figure 3-114. Cluster Configuration
Cluster Commander – Enables or disables the switch as a cluster Commander. • Role – Indicates the current role of the switch in the cluster; either Commander, Member, or Candidate. • Cluster IP Pool – An “internal” IP address pool that is used to assign IP addresses to Member switches in the cluster.
Page 298: Cluster Member Configuration
Candidate switch. (Range: 1-36) • MAC Address – Select a discoverd switch MAC address from the Candidate Table, or enter a specific MAC address of a known switch. Web – Click Cluster, Member Configuration. Figure 3-115. Cluster Member Configuration CLI – This example creates a new cluster Member by specifying the Candidate switch MAC address and setting a Member ID.
Page 299: Cluster Member Information
Cluster Member Information Displays current cluster Member switch information. Command Attributes • Member ID – The ID number of the Member switch. (Range: 1-36) • Role – Indicates the current status of the switch in the cluster. • IP Address – The internal cluster IP address assigned to the Member switch.
Page 300: Cluster Candidate Information
Role – Indicates the current status of Candidate switches in the network. • MAC Address – The MAC address of the Candidate switch. • Description – The system description string of the Candidate switch. Web – Click Cluster, Candidate Information.
Page 301: Command Line Interface
Using the Command Line Interface Accessing the CLI When accessing the management interface for the switch over a direct connection to the server’s console port, or via a Telnet connection, the switch can be managed by entering command keywords and parameters at the prompt.
Page 302: Telnet Connection
Note: The IP address for this switch is obtained via DHCP by default. To access the switch through a Telnet session, you must first set the IP address for the switch, and set the default gateway if you are managing the switch from a different IP subnet.
Page 303: Entering Commands
2. At the prompt, enter the user name and system password. The CLI will display the “Vty-n#” prompt for the administrator to show that you are using privileged access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you are using normal access mode (i.e., Normal Exec), where n indicates the number of the current Telnet session.
Page 304: Minimum Abbreviation
OMMAND NTERFACE • To enter multiple commands, enter each command in the required order. For example, to enable Privileged Exec command mode, and display the startup configuration, enter: Console>enable Console#show startup-config • To enter commands that require parameters, enter the required parameters after the command keyword.
Page 305: Showing Commands
Showing Commands If you enter a “?” at the command prompt, the system will display the first level of keywords for the current command class (Normal Exec or Privileged Exec) or configuration class (Global, ACL, Interface, Line, or VLAN Database). You can also display a list of valid keywords for a specific command.
Page 306: Partial Keyword Lookup
OMMAND NTERFACE The command “show interfaces ?” will display the following information: Console#show interfaces ? counters status switchport Console# Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided. (Remember not to leave a space between the command and question mark.) For example “s?”...
Page 307: Understanding Command Modes
You must be in Global Configuration mode to access any of the other configuration modes. Exec Commands When you open a new console session on the switch with the user name and password “guest,” the system enters the Normal Exec command mode (or guest mode), displaying the “Console>” command prompt.
Page 308: Configuration Commands
Configuration commands are privileged level commands used to modify switch settings. These commands modify the running configuration only and are not saved when the switch is rebooted. To store the running configuration in non-volatile storage, use the copy running-config startup-config command.
Page 309: Table 4-2 Configuration Commands
• Line Configuration - These commands modify the console port and Telnet configuration, and include command such as parity and databits. • VLAN Configuration - Includes the command to create VLAN groups. To enter the Global Configuration mode, enter the command configure in Privileged Exec mode.
Page 310: Command Line Processing
OMMAND NTERFACE Command Line Processing Commands are not case sensitive. You can abbreviate commands and parameters as long as they contain enough letters to differentiate them from any other currently available commands or parameters. You can use the Tab key to complete partial commands, or enter a partial command followed by the “?”...
Page 311: Command Groups
CLI name, browser management options, and a variety of other system information Manages code image or switch configuration files Configures logon access using local or remote authentication; also configures port security and IEEE 802.1X port access control...
Page 312 Configures the address table for filtering specified addresses, displays current entries, clears the table, or sets the aging time Configures Spanning Tree settings for the switch Configures VLAN settings, and defines port membership for VLAN groups; also enables or configures private VLANs Configures GVRP settings that permit automatic VLAN learning;...
Page 313 OMMAND ROUPS PE (Privileged Exec) VC (VLAN Database Configuration) 4-13...
Page 314: Line Commands
OMMAND NTERFACE Line Commands You can access the onboard configuration program by attaching a VT100 compatible device to the server’s serial port. These commands are used to set communication parameters for the serial port or Telnet (i.e., a virtual terminal). Command line login...
Page 315: Line
line This command identifies a specific line for configuration, and to process subsequent line configuration commands. Syntax line {console | vty} • console - Console terminal line. • vty - Virtual terminal for remote console access (i.e., Telnet). Default Setting There is no default line.
Page 316: Login
Command Mode Line Configuration Command Usage • There are three authentication modes provided by the switch itself at login: - login selects authentication by a single global password as specified by the password line configuration command. When using this method, the management interface starts in Normal Exec (NE) mode.
Page 317: Password
Example Console(config-line)#login local Console(config-line)# Related Commands username (4-35) password (4-17) password This command specifies the password for a line. Use the no form to remove the password. Syntax password {0 | 7} password no password • {0 | 7} - 0 means plain password, 7 means encrypted password •...
Page 318: Timeout Login Response
OMMAND NTERFACE Example Console(config-line)#password 0 secret Console(config-line)# Related Commands login (4-16) password-thresh (4-20) timeout login response This command sets the interval that the system waits for a user to log into the CLI. Use the no form to restore the default setting. Syntax timeout login response [seconds] no timeout login response...
Page 319: Exec-Timeout
exec-timeout This command sets the interval that the system waits until user input is detected. Use the no form to restore the default. Syntax exec-timeout [seconds] no exec-timeout seconds - Integer that specifies the number of seconds. (Range: 0 - 65535 seconds; 0: no timeout) Default Setting CLI: No timeout Telnet: 10 minutes...
Page 320: Password-Thresh
OMMAND NTERFACE password-thresh This command sets the password intrusion threshold which limits the number of failed logon attempts. Use the no form to remove the threshold value. Syntax password-thresh [threshold] no password-thresh threshold - The number of allowed password attempts. (Range: 1-120;...
Page 321: Silent-Time
silent-time This command sets the amount of time the management console is inaccessible after the number of unsuccessful logon attempts exceeds the threshold set by the password-thresh command. Use the no form to remove the silent time value. Syntax silent-time [seconds] no silent-time seconds - The number of seconds to disable console response.
Page 322: Parity
OMMAND NTERFACE Default Setting 8 data bits per character Command Mode Line Configuration Command Usage The databits command can be used to mask the high bit on input from devices that generate 7 data bits with parity. If parity is being generated, specify 7 data bits per character.
Page 323: Speed
Some baud rates available on devices connected to the port might not be supported. The system indicates if the speed you selected is not supported. If you select the “auto” option, the switch will automatically detect the baud rate configured on the attached terminal, and adjust the speed accordingly.
Page 324: Stopbits
OMMAND NTERFACE Example To specify 57600 bps, enter this command: Console(config-line)#speed 57600 Console(config-line)# stopbits This command sets the number of the stop bits transmitted per byte. Use the no form to restore the default setting. Syntax stopbits {1 | 2} •...
Page 325: Show Line
Command Usage Specifying session identifier “0” will disconnect the console connection. Specifying any other identifiers for an active session will disconnect an SSH or Telnet connection. Example Console#disconnect 1 Console# Related Commands show ssh (4-54) show users (4-81) show line This command displays the terminal line’s parameters.
Page 326: General Commands
OMMAND NTERFACE Example To show all lines, enter this command: Console#show line Console configuration: Password threshold: Interactive timeout: Disabled Login timeout: Disabled Silent time: Baudrate: Databits: Parity: Stopbits: VTY configuration: Password threshold: Interactive timeout: 600 sec Login timeout: 300 sec Console# General Commands Command...
Page 327: Enable
enable This command activates Privileged Exec mode. In privileged mode, additional commands are available, and certain commands display additional information. (See “Understanding Command Modes” on page 4-7.) Syntax enable [level] level - Privilege level to log into the device. The device has two predefined privilege levels: 0: Normal Exec, 15: Privileged Exec.
Page 328: Disable
This command activates Global Configuration mode. You must enter this mode to modify any settings on the switch. You must also enter Global Configuration mode prior to enabling some of the other configuration modes, including Interface Configuration, Line Configuration, and VLAN Database Configuration.
Page 329: Show History
Example Console#configure Console(config)# Related Commands end (4-30) show history This command shows the contents of the command history buffer. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The history buffer size is fixed at 10 Execution commands and 10 Configuration commands.
Page 330: Reload
None Command Mode Privileged Exec Command Usage This command resets the entire system. Example This example shows how to reset the switch: Console#reload System will be restarted, continue <y/n>? y This command returns to Privileged Exec mode. Default Setting None...
Page 331: Exit
Command Mode Global Configuration, Interface Configuration, Line Configuration, and VLAN Database Configuration. Example This example shows how to return to the Privileged Exec mode from the Interface Configuration mode: Console(config-if)#end Console# exit This command returns to the previous configuration mode or exit the configuration program.
Page 332: System Management Commands
SMTP Alerts Time (System Clock) Sets the system clock automatically via NTP/SNTP 4-32 Function Configures information that uniquely identifies this switch Configures the basic user names and passwords for management access Configures IP addresses that are allowed management access Enables management access via a web browser...
Page 333: Device Designation Commands
Table 4-8 Device Designation Commands Command Function prompt Customizes the prompt used in PE and NE mode hostname Specifies the host name for the switch snmp-server Sets the system contact string contact snmp-server Sets the system location string location prompt This command customizes the CLI prompt.
Page 334: Hostname
User Access Commands The basic commands required for management access are listed in this section. This switch also includes other options for password checking via the console or a Telnet connection (page 4-14), user authentication via a remote authentication server (page 4-91), and host access authentication for specific ports (page 4-104).
Page 335: Username
username This command adds named users, requires authentication at login, specifies or changes a user's password (or specify that no password is required), or specifies or changes a user's access level. Use the no form to remove a user name. Syntax username name {access-level level | no password | password {0 | 7} password}...
Page 336: Enable Password
OMMAND NTERFACE The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords.
Page 337: Ip Filter Commands
Displays the switch to be monitored or management This command specifies the client IP addresses that are allowed management access to the switch through various protocols. Use the no form to restore the default setting. Syntax [no] management {all-client | http-client | snmp-client | telnet-client} start-address [end-address] •...
Page 338: Default Setting
Global Configuration Command Usage • If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager.
Page 339: Show Management
This command displays the client IP addresses that are allowed management access to the switch through various protocols. Syntax show management {all-client | http-client | snmp-client | telnet-client} • all-client - Adds IP address(es) to the SNMP, web and Telnet groups.
Page 340: Web Server Commands
(4-41) 4-40 Table 4-12 Web Server Command Function Specifies the port to be used by the web browser interface Allows the switch to be monitored or configured from a browser Enables HTTPS/SSL for encrypted communications Mode Page 4-40...
Page 341: Ip Http Server
This command enables the secure hypertext transfer protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Use the no form to disable this function. Syntax [no] ip http secure-server...
Page 342: Table 4-13 Https System Support
Command Usage • Both HTTP and HTTPS service can be enabled independently on the switch. However, you cannot configure the HTTP and HTTPS servers to use the same UDP port. • If you enable HTTPS, you must indicate this in the URL that you specify in your browser: https://device[:port_number] •...
Page 343: Ip Http Secure-Port
This command specifies the UDP port number used for HTTPS/SSL connection to the switch’s web interface. Use the no form to restore the default port. Syntax ip http secure-port port_number no ip http secure-port port_number – The UDP port used for HTTPS/SSL.
Page 344: Telnet Server Commands
- The TCP port to be used by the browser interface. (Range: 1-65535) 4-44 Table 4-14 Telnet Server Commands Function Allows the switch to be monitored or configured from Telnet Specifies the port to be used by the Telnet interface Mode Page...
Page 345: Secure Shell Commands
Telnet. When a client contacts the switch via the SSH protocol, the switch uses a public-key that the client must match along with a local user name and password for access authentication. SSH also encrypts all data...
Page 346: Table 4-15 Secure Shell Commands
TACACS+ remote authentication server, as specified by the authentication login command on page 4-92. If public key authentication is specified by the client, then you must configure authentication keys on both the client and the switch as described in the 4-46 Table 4-15 Secure Shell Commands...
Page 347 76546801726272571413428762941301196195566782 59566410486957427888146206 519417467729848654686157177393901647793559423035774130980227370877945452408397 1752646358058176716709574804776117 3. Import Client’s Public Key to the Switch – Use the copy tftp public-key command to copy a file containing the public key for all the SSH client’s granted management access to the switch. (Note that these clients must be configured locally on the switch with the username command as described on page 4-35.) The clients are subsequently...
Page 348: Ip Ssh Server
The switch compares the client's public key to those stored in memory. c. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. d. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch.
Page 349: Ip Ssh Timeout
SSH sessions. • The SSH server uses DSA or RSA for key exchange when the client first establishes a connection with the switch, and then negotiates with the client to select either DES (56-bit) or 3DES (168-bit) for data encryption.
Page 350: Ip Ssh Authentication-Retries
OMMAND NTERFACE Command Usage The timeout specifies the interval the switch will wait for a response from the client during the SSH negotiation phase. Once an SSH session has been established, the timeout for user input is controlled by the exec-timeout command for vty sessions.
Page 351: Ip Ssh Server-Key Size
Command Mode Global Configuration Command Usage • The server key is a private key that is never shared outside the switch. • The host key is shared with the SSH client, and is fixed at 1024 bits. Example Console(config)#ip ssh server-key size 512...
Page 352: Ip Ssh Crypto Host-Key Generate
OMMAND NTERFACE Example Console#delete public-key admin dsa Console# ip ssh crypto host-key generate This command generates the host key pair (i.e., public and private). Syntax ip ssh crypto host-key generate [dsa | rsa] • dsa – DSA (Version 2) key type. •...
Page 353: Ip Ssh Crypto Zeroize
ip ssh crypto zeroize This command clears the host key from memory (i.e. RAM). Syntax ip ssh crypto zeroize [dsa | rsa] • dsa – DSA key type. • rsa – RSA key type. Default Setting Clears both the DSA and RSA key. Command Mode Privileged Exec Command Usage...
Page 354: Show Ip Ssh
OMMAND NTERFACE Default Setting Saves both the DSA and RSA key. Command Mode Privileged Exec Example Console#ip ssh save host-key dsa Console# Related Commands ip ssh crypto host-key generate (4-52) show ip ssh This command displays the connection settings used when authenticating client access to the SSH server.
Page 355: Table 4-7 System Management Commands
Table 4-16 show ssh - display description Field Description Session The session number. (Range: 0-3) Version The Secure Shell version number. State The authentication negotiation state. (Values: Negotiation-Started, Authentication-Started, Session-Started) Username The user name of the client. Encryption The encryption method is automatically negotiated between the client and server.
Page 356: Show Public-Key
OMMAND NTERFACE show public-key This command shows the public key for the specified user or for the host. Syntax show public-key [user [username]| host] username – Name of an SSH user. (Range: 1-8 characters) Default Setting Shows all public keys. Command Mode Privileged Exec Command Usage...
Page 357: Event Logging Commands
This command controls logging of error messages, sending debug or error messages to switch memory. The no form disables the logging process. Syntax [no] logging on Default Setting None Command Mode...
Page 358: Logging History
Related Commands logging history (4-58) clear logging (4-62) logging history This command limits syslog messages saved to switch memory based on severity. The no form returns the logging of syslog messages to the default level. Syntax logging history {flash | ram} level no logging history {flash | ram} •...
Page 359: Logging Host
Level Severity Name Description alerts emergencies * There are only Level 2, 5 and 6 error messages for the current firmware release. Default Setting Flash: errors (level 3 - 0) RAM: warnings (level 7 - 0) Command Mode Global Configuration Command Usage The message level specified for flash memory must be a higher priority (i.e., numerically lower) than that specified for RAM.
Page 360: Logging Facility
The command specifies the facility type tag sent in syslog messages. (See RFC 3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to sort messages or to store messages in the corresponding database.
Page 361: Logging Trap
logging trap This command enables the logging of system messages to a remote server, or limits the syslog messages saved to a remote server based on severity. Use this command without a specified level to enable remote logging. Use the no form to disable remote logging. Syntax logging trap [level] no logging trap...
Page 362: Clear Logging
Related Commands show log (4-64) show logging This command displays the configuration settings for logging messages to local switch memory, to an SMTP event handler, or to a remote syslog server. Syntax show logging {flash | ram | sendmail | trap} •...
Page 363: Table 4-19 Show Logging Flash/Ram - Display Description
Default Setting None Command Mode Privileged Exec Example The following example shows that system logging is enabled, the message level for flash memory is “errors” (i.e., default level 3 - 0), and the message level for RAM is “debugging” (i.e., default level 7 - 0). Console#show logging flash Syslog logging: History logging in FLASH: level errors...
Page 364: Show Log
OMMAND NTERFACE Table 4-20 show logging trap - display description Field Syslog logging REMOTELOG status REMOTELOG facility type REMOTELOG level type REMOTELOG server IP address Related Commands show logging sendmail (4-69) show log This command displays the log messages stored in local memory. Syntax show log {flash | ram} •...
Page 365: Smtp Alert Commands
Example The following example shows the event message stored in RAM. Console#show log ram [1] 00:01:30 2001-01-01 "VLAN 1 link-up notification." level: 6, module: 5, function: 1, and event no.: 1 [0] 00:01:30 2001-01-01 "Unit 1, Port level: 6, module: 5, function: 1, and event no.: 1 Console# SMTP Alert Commands These commands configure SMTP event handling, and forwarding of alert...
Page 366: Logging Sendmail Host
• You can specify up to three SMTP servers for event handing. However, you must enter a separate command to specify each server. • To send email alerts, the switch first opens a connection, sends all the email alerts waiting in the queue one by one, and finally closes the connection.
Page 367: Logging Sendmail Level
logging sendmail level This command sets the severity threshold used to trigger alert messages. Syntax logging sendmail level level level - One of the system message levels (page 4-58). Messages sent include the selected level down to level 0. (Range: 0-7; Default: 7) Default Setting Level 7 Command Mode...
Page 368: Logging Sendmail Destination-Email
Command Mode Global Configuration Command Usage You may use an symbolic email address that identifies the switch, or the address of an administrator responsible for the switch. Example This example will send email alerts for system errors from level 3 through 0.
Page 369: Logging Sendmail
logging sendmail This command enables SMTP event handling. Use the no form to disable this function. Syntax [no] logging sendmail Default Setting Enabled Command Mode Global Configuration Example Console(config)#logging sendmail Console(config)# show logging sendmail This command displays the settings for the SMTP event handler. Command Mode Normal Exec, Privileged Exec Example...
Page 370: Time Commands
(NTP or SNTP). Maintaining an accurate time on the switch enables the system log to record meaningful dates and times for event entries. If the clock is not set, the switch will only record the time from the factory default set at the last bootup.
Page 371: Sntp Server
Command Usage • The time acquired from time servers is used to record accurate dates and times for log events. Without SNTP, the switch only records the time starting from the factory default set at the last bootup (e.g., 00:00:00, Jan. 1, 2001).
Page 372: Sntp Poll
(4-72) show sntp (4-73) sntp poll This command sets the interval between sending time requests when the switch is set to SNTP client mode. Use the no form to restore to the default. Syntax sntp poll seconds no sntp poll seconds - Interval between time requests.
Page 373: Show Sntp
SNTP server 137.92.140.80 0.0.0.0 0.0.0.0 Current server: 137.92.140.80 Console# clock timezone This command sets the time zone for the switch’s internal clock. Syntax clock timezone name hour hours minute minutes {before-utc | after-utc} • name - Name of timezone, usually an acronym.
Page 374: Calendar Set
(4-73) calendar set This command sets the system clock. It may be used if there is no time server on your network, or if you have not configured the switch to receive signals from a time server. Syntax calendar set hour min sec {day month year | month day year} •...
Page 375: Show Calendar
Default Setting None Command Mode Privileged Exec Example This example shows how to set the system clock to 15:12:34, February 1st, 2002. Console#calendar set 15 12 34 1 February 2002 Console# show calendar This command displays the system clock. Default Setting None Command Mode Normal Exec, Privileged Exec...
Page 376: System Status Commands
OMMAND NTERFACE System Status Commands Command show running-config show system show users show version show startup-config This command displays the configuration file stored in non-volatile memory that is used to start up the system. Default Setting None Command Mode Privileged Exec Command Usage •...
Page 377: Show Running-Config
- IP address configured for the switch - Spanning tree settings - Any configured settings for the console port and Telnet Example Console#show startup-config building startup-config, please wait... username admin access-level 15 username admin password 0 admin username guest access-level 0...
Page 378 - Users (names, access levels, and encrypted passwords) - VLAN database (VLAN ID, name and state) - VLAN configuration settings for each interface - IP address configured for the switch - Spanning tree settings - Any configured settings for the console port and Telnet...
Page 379 Example Console#show running-config building running-config, please wait... phymap 00-30-f1-df-9c-a0 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 SNTP server 0.0.0.0 0.0.0.0 0.0.0.0 snmp-server community public ro snmp-server community private rw username admin access-level 15 username admin password 7 21232f297a57a5a743894a0e4a801fc3 username guest access-level 0 username guest password 7 084e0343a0486ff05530df6c705c8bb4 enable password level 15 7 1b3231655cebb7a1f783eddf27d254ca vlan database...
Page 380: Show System
“Displaying System Information” on page 3-13. • The POST results should all display “PASS.” If any POST test indicates “FAIL,” contact your distributor for assistance. Example Console#show system System description: SMC Networks SMC6128L2 System OID string: 1.3.6.1.4.1.259.6.10.94 System Information System Up Time: seconds...
Page 381: Show Users
show users Shows all active console and Telnet sessions, including user name, idle time, and IP address of Telnet client. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The session used to execute this command is indicated by a “*” symbol next to the Line (i.e., session) index number.
Page 382: Frame Size Commands
OMMAND NTERFACE Command Mode Normal Exec, Privileged Exec Command Usage See “Displaying Switch Hardware/Software Versions” on page 3-15 for detailed information on the items displayed by this command. Example Console#show version Unit 1 Serial Number: Hardware Version: EPLD Version: Number of Ports:...
Page 383 Command Mode Global Configuration Command Usage • This switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields.
Page 384: Flash/File Commands
This command moves (upload/download) a code image or configuration file between the switch’s flash memory and a TFTP server. When you save the system code or configuration settings to a file on a TFTP server, that file can later be downloaded to the switch to restore system operation. The success of the file transfer depends on the accessibility of the TFTP server and the quality of the network connection.
Page 385 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”) • Due to the size limit of the flash memory, the switch supports only two operation code files. • The maximum number of user-defined configuration files depends on available memory.
Page 386: L Ine I Nterface
\Write to FLASH finish. Success. Console# This example shows how to copy a secure-site certificate from an TFTP server. It then reboots the switch to activate the certificate: Console#copy tftp https-certificate TFTP server ip address: 10.1.0.19 Source certificate file name: SS-certificate...
Page 387: Delete
This example shows how to copy a public-key used by SSH from an TFTP server. Note that public key authentication via SSH is only supported for users configured locally on the switch. Console#copy tftp public-key TFTP server IP address: 192.168.1.19 Choose public key type: 1.
Page 388: Dir
The type of file or image to display includes: • boot-rom - Boot ROM (or diagnostic) image file. • config - Switch configuration file. • opcode - Run-time operation code image file. • filename - Name of the file or image. If this file exists but contains errors, information on this file cannot be shown.
Page 389: Whichboot
Command Usage • If you enter the command dir without any parameters, the system displays all files. • A colon (:) is required after the specified unit number. • File information is shown below: Column Heading file name file type startup size Example...
Page 390: Boot System
OMMAND NTERFACE Command Mode Privileged Exec Example This example shows the information displayed by the whichboot command. See the table under the dir command for a description of the file information displayed by this command. Console#whichboot -------------------------------- ----------------------- ------- ----------- Unit1: Console# boot system...
Page 391: Authentication Commands
(4-88) whichboot (4-89) Authentication Commands You can configure this switch to authenticate users logging into the system for management access using local or remote authentication methods. You can also enable port-based authentication for network client access using IEEE 802.1X.
Page 392: Authentication Login
OMMAND NTERFACE authentication login This command defines the login authentication method and precedence. Use the no form to restore the default. Syntax authentication login {[local] [radius] [tacacs]} no authentication login • local - Use local password. • radius - Use RADIUS server password. •...
Page 393: Authentication Enable
Example Console(config)#authentication login radius Console(config)# Related Commands username - for setting the local user names and passwords (4-35) authentication enable This command defines the authentication method and precedence to use when changing from Exec command mode to Privileged Exec command mode with the enable command (see page 4-27).
Page 394: Radius Client
RADIUS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch. Command radius-server host radius-server port...
Page 395: Radius-Server Host
• port_number - RADIUS server UDP port used for authentication messages. (Range: 1-65535) • timeout - Number of seconds the switch waits for a reply before resending a request. (Range: 1-65535) • retransmit - Number of times the switch will try to authenticate logon access via the RADIUS server.
Page 396: Radius-Server Port
OMMAND NTERFACE Example Console(config)#radius-server 1 host 192.168.1.20 port 181 timeout 10 retransmit 5 key green Console(config)# radius-server port This command sets the RADIUS server network port. Use the no form to restore the default. Syntax radius-server port port_number no radius-server port port_number - RADIUS server UDP port used for authentication messages.
Page 397: Radius-Server Retransmit
This command sets the number of retries. Use the no form to restore the default. Syntax radius-server retransmit number_of_retries no radius-server retransmit number_of_retries - Number of times the switch will try to authenticate logon access via the RADIUS server. (Range: 1 - 30) Default Setting Command Mode Global Configuration...
Page 398: Radius-Server Timeout
RADIUS server. Use the no form to restore the default. Syntax radius-server timeout number_of_seconds no radius-server timeout number_of_seconds - Number of seconds the switch waits for a reply before resending a request. (Range: 1-65535) Default Setting Command Mode...
Page 399: Tacacs+ Client
TACACS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch. Command tacacs-server host tacacs-server port...
Page 400: Tacacs-Server Port
OMMAND NTERFACE tacacs-server port This command specifies the TACACS+ server network port. Use the no form to restore the default. Syntax tacacs-server port port_number no tacacs-server port port_number - TACACS+ server TCP port used for authentication messages. (Range: 1-65535) Default Setting Command Mode Global Configuration Example...
Page 401: Show Tacacs-Server
Port Security Commands These commands can be used to enable port security on a port. When using port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table for this port will be authorized to access the network.
Page 402: Port Security
OMMAND NTERFACE Command port security mac-address-table static Maps a static address to a port in a show mac-address-table Displays entries in the port security This command enables or configures port security. Use the no form without any keywords to disable port security. Use the no form with the appropriate keyword to restore the default settings for a response to security violation or for the maximum number of allowed addresses.
Page 403 Command Usage • If you enable port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number. Only incoming traffic with source addresses already stored in the dynamic or static address table will be accepted.
Page 404: 802.1X Port Authentication
OMMAND NTERFACE 802.1X Port Authentication The switch supports IEEE 802.1X (dot1x) port-based access control that prevents unauthorized access to the network by requiring users to first submit credentials for authentication. Client authentication is controlled centrally by a RADIUS server using EAP (Extensible Authentication Protocol).
Page 405: Dot1X System-Auth-Control
This command enables IEEE 802.1X port authentication globally on the switch. Use the no form to restore the default. Syntax [no] dot1x system-auth-control Default Setting Disabled Command Mode Global Configuration Example Console(config)#dot1x system-auth-control Console(config)# dot1x default This command sets all configurable dot1x global and port settings to their default values.
Page 406: Dot1X Max-Req
OMMAND NTERFACE dot1x max-req This command sets the maximum number of times the switch port will retransmit an EAP request/identity packet to the client before it times out the authentication session. Use the no form to restore the default. Syntax...
Page 407: Dot1X Operation-Mode
Default force-authorized Command Mode Interface Configuration Example Console(config)#interface eth 1/2 Console(config-if)#dot1x port-control auto Console(config-if)# dot1x operation-mode This command allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. Use the no form with no keywords to restore the default to single host.
Page 408: Dot1X Re-Authenticate
OMMAND NTERFACE Similarly, a port can become unauthorized for all hosts if one attached host fails re-authentication or sends an EAPOL logoff message. Example Console(config)#interface eth 1/2 Console(config-if)#dot1x operation-mode multi-host max-count 10 Console(config-if)# dot1x re-authenticate This command forces re-authentication on all ports or a specific interface. Syntax dot1x re-authenticate [interface] interface...
Page 409: Dot1X Timeout Quiet-Period
This command sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. Use the no form to reset the default. Syntax dot1x timeout quiet-period seconds no dot1x timeout quiet-period seconds - The number of seconds.
Page 410: Dot1X Timeout Tx-Period
Console(config)#interface eth 1/2 Console(config-if)#dot1x timeout re-authperiod 300 Console(config-if)# dot1x timeout tx-period This command sets the time that the switch waits during an authentication session before re-transmitting an EAP packet. Use the no form to reset to the default value. Syntax...
Page 411 This command displays the following information: • Global 802.1X Parameters – Shows whether or not 802.1X port authentication is globally enabled on the switch. • 802.1X Port Summary – Displays the port access control parameters for each interface that has enabled 802.1X, including the following items: - Status–...
Page 412: Authentication Server
OMMAND NTERFACE • Authenticator State Machine - State – Current state (including initialize, disconnected, connecting, authenticating, authenticated, aborting, held, force_authorized, force_unauthorized). - Reauth Count – Number of times connecting state is re-entered. • Backend State Machine - State – Current state (including request, response, success, fail, timeout, idle, initialize).
Page 413: Access Control List Commands
An ACL is a sequential list of permit or deny conditions that apply to IP addresses, MAC addresses, or other more specific criteria. This switch tests ingress or egress packets against the conditions in an ACL one by one. A packet will be accepted as soon as it matches a permit rule, or dropped as soon as it matches a deny rule.
Page 414: Ip Acls
Each ACL can have up to 60 rules. • This switch supports ACLs for ingress filtering only. However, you can only bind one IP ACL to any port for ingress filtering. In other words, only one ACL can be bound to an interface - Ingress IP ACL.
Page 415: Access-List Ip
Table 4-34 IP ACL Commands (Continued) Command show ip access-list ip access-group show ip access-group map access-list ip show map access-list ip access-list ip This command adds an IP access list and enters configuration mode for standard or extended IP ACLs. Use the no form to remove the specified ACL.
Page 416: Permit, Deny (Standard Acl)
OMMAND NTERFACE the bottom of the list. To create an ACL, you must add at least one rule to the list. • To remove a rule, use the no permit or no deny command followed by the exact text of a previously configured rule. •...
Page 417: Permit, Deny (Extended Acl)
uses 1 bits to indicate “match” and 0 bits to indicate “ignore.” The bitmask is bitwise ANDed with the specified source IP address, and then compared with the address for each IP packet entering the port(s) to which this ACL has been assigned. Example This example configures one permit rule for the specific address 10.1.1.21 and another rule for the address range 168.92.16.x –...
Page 418: Show Ip Access-List
OMMAND NTERFACE • sport – Protocol • dport – Protocol • end – Upper bound of the protocol port range. (Range: 0-65535) Default Setting None Command Mode Extended ACL Command Usage • All new rules are appended to the end of the list. •...
Page 419: Ip Access-Group
Syntax show ip access-list {standard | extended} [acl_name] • standard – Specifies a standard IP ACL. • extended – Specifies an extended IP ACL. • acl_name – Name of the ACL. (Maximum length: 16 characters) Command Mode Privileged Exec Example Console#show ip access-list standard IP standard access-list david: permit host 10.1.1.21...
Page 420: Show Ip Access-Group
• If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. • You must configure a mask for an ACL rule before you can bind it to a port.
Page 421: Show Map Access-List Ip
Default Setting None Command Mode Interface Configuration (Ethernet) Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown in the following table.
Page 422: Acl Information
OMMAND NTERFACE • port - Port number. (Range: 1-28) Command Mode Privileged Exec Example Console#show map access-list ip Access-list to COS of Eth 1/24 Access-list ALS1 cos 0 Console# Related Commands map access-list ip (4-120) ACL Information Command show access-list show access-group show access-list This command shows all ACLs and associated rules, as well as all the...
Page 423: Show Access-Group
IP access-list jerry Console# SNMP Commands Controls access to this switch from management stations using the Simple Network Management Protocol (SNMP), as well as the error types sent to trap managers. SNMP Version 3 provides security features that cover message integrity, authentication, and encryption;...
Page 424 OMMAND NTERFACE v1, v2c or v3) and security level (i.e., authentication and privacy), and then assign SNMP users to these groups, along with their specific authentication and privacy passwords. Command snmp-server show snmp snmp-server community snmp-server contact Sets the system contact string snmp-server location snmp-server host...
Page 425: Snmp-Server
snmp-server This command enables the SNMPv3 engine and services for all management clients (i.e., versions 1, 2c, 3). Use the no form to disable the server. Syntax [no] snmp-server Default Setting Enabled Command Mode Global Configuration Example Console(config)#snmp-server Console(config)# show snmp This command can be used to check the status of SNMP communications.
Page 426 OMMAND NTERFACE Example Console#show snmp SNMP Agent: enabled SNMP traps: Authentication: enable Link-up-down: enable SNMP communities: 1. private, and the privilege is read-write 2. public, and the privilege is read-only 0 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name 0 Illegal operation for community name supplied 0 Encoding errors 0 Number of requested variables...
Page 427: Snmp-Server Community
snmp-server community This command defines the SNMP v1 and v2c community access string. Use the no form to remove the specified community string. Syntax snmp-server community string [ro|rw] no snmp-server community string • string - Community string that acts like a password and permits access to the SNMP protocol.
Page 428: Snmp-Server Location
OMMAND NTERFACE string - String that describes the system contact information. (Maximum length: 255 characters) Default Setting None Command Mode Global Configuration Example Console(config)#snmp-server contact Paul Console(config)# Related Commands snmp-server location (4-128) snmp-server location This command sets the system location string. Use the no form to remove the location string.
Page 429: Snmp-Server Host
snmp-server host This command specifies the recipient of a Simple Network Management Protocol notification operation. Use the no form to remove the specified host. Syntax snmp-server host host-addr [inform [retry retries | timeout seconds]] community-string [version {1 | 2c | 3 {auth | noauth | priv} [udp-port port]} no snmp-server host host-addr •...
Page 430 For example, some notification types are always enabled. • Notifications are issued by the switch as trap messages by default. The recipient of a trap message does not send a response to the switch. Traps are therefore not as reliable as inform messages, which include a request for acknowledgement of receipt.
Page 431 6. Specify a remote engine ID where the user resides (page 4-133). 7. Then configure a remote user (page 4-140). • The switch can send SNMP version 1, 2c, or 3 notifications to a host IP address, depending on the SNMP version that the management station supports.
Page 432: Snmp-Server Enable Traps
OMMAND NTERFACE Example Console(config)#snmp-server host 10.1.19.23 inform retries 10 timeout 30 batman version 2c udp-port 162 Console(config)# Related Commands snmp-server enable traps (4-132) snmp-server enable traps This command enables this device to send Simple Network Management Protocol traps or informs (i.e., SNMP notifications). Use the no form to disable SNMP notifications.
Page 433: Snmp-Server Engine-Id
• ip-address - The Internet address of the remote device. • engineid-string - String identifying the engine ID. (Range: 1-26 hexadecimal characters) Default Setting A unique engine ID is automatically generated by the switch based on its MAC address. Command Mode Global Configuration Command Usage •...
Page 434: Show Snmp Engine-Id
• A local engine ID is automatically generated that is unique to the switch. This is referred to as the default engine ID. If the local engineID is deleted or changed, all SNMP users will be cleared. You will need to reconfigure all existing users (page 4-140).
Page 435: Snmp-Server View
Example This example shows the default engine ID. Console#show snmp engine-id Local SNMP engineID: 8000002a8000000000e8666672 Local SNMP engineBoots: 1 Remote SNMP engineID 80000000030004e2b316c54321 Console# Table 4-38 show snmp engine-id - display description Field Local SNMP engineID Local SNMP engineBoots Remote SNMP engineID IP address snmp-server view...
Page 436: Show Snmp View
OMMAND NTERFACE Command Mode Global Configuration Command Usage • Views are used in the snmp-server group command to restrict user access to specified portions of the MIB tree. • The predefined view “defaultview” includes access to the entire MIB tree. Examples This view includes MIB-2.
Page 437: Snmp-Server Group
Example Console#show snmp view View Name: mib-2 Subtree OID: 1.2.2.3.6.2.1 View Type: included Storage Type: nonvolatile Row Status: active View Name: defaultview Subtree OID: 1 View Type: included Storage Type: nonvolatile Row Status: active Console# Table 4-39 show snmp view - display description Field View Name Subtree OID...
Page 438: Show Snmp Group
• For additional information on the notification messages supported by this switch, see “Supported Notification Messages” on page 3-61. Also, note that the authentication, link-up and link-down messages are legacy traps and must therefore be enabled in conjunction with the snmp-server enable traps command (page 4-132).
Page 439: Snmp C Ommands
Example Console#show snmp group Group Name: r&d Security Model: v3 Read View: defaultview Write View: daily Notify View: none Storage Type: nonvolatile Row Status: active Group Name: public Security Model: v1 Read View: defaultview Write View: none Notify View: none Storage Type: volatile Row Status: active Group Name: public...
Page 440: Snmp-Server User
OMMAND NTERFACE Table 4-40 show snmp group - display description (Continued) Field notifyview storage-type Row Status snmp-server user This command adds a user to an SNMP group, restricting the user to a specific SNMP Read and a Write View. Use the no form to remove a user from an SNMP group.
Page 441: Global Configuration
Command Mode Global Configuration Command Usage • The SNMP engine ID is used to compute the authentication/privacy digests from the password. You should therefore configure the engine ID with the snmp-server engine-id command before using this configuration command. • Before you configure a remote user, use the snmp-server engine-id command (page 4-133) to specify the engine ID for the remote device where the user resides.
Page 442: Show Snmp User
OMMAND NTERFACE show snmp user This command shows information on SNMP users. Command Mode Privileged Exec Example Console#show snmp user EngineId: 01000000000000000000000000 User Name: steve Authentication Protocol: md5 Privacy Protocol: des56 Storage Type: nonvolatile Row Status: active SNMP remote user EngineId: 80000000030004e2b316c54321 User Name: mark Authentication Protocol: mdt...
Page 443: Interface Commands
Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN. Command interface description speed-duplex negotiation capabilities flowcontrol shutdown clear counters show interfaces status Displays status for the specified show interfaces counters show interfaces switchport...
Page 444: Interface
OMMAND NTERFACE interface This command configures an interface type and enter interface configuration mode. Use the no form to remove a trunk. Syntax interface interface no interface port-channel channel-id • interface • ethernet unit/port - unit - Stack unit. (Always unit 1) - port - Port number.
Page 445: Speed-Duplex
Command Mode Interface Configuration (Ethernet, Port Channel) Example The following example adds a description to port 24. Console(config)#interface ethernet 1/24 Console(config-if)#description RD-SW#3 Console(config-if)# speed-duplex This command configures the speed and duplex mode of a given interface when autonegotiation is disabled. Use the no form to restore the default. Syntax speed-duplex {1000full | 100full | 100half | 10full | 10half} no speed-duplex...
Page 446: Negotiation
Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • When auto-negotiation is enabled the switch will negotiate the best settings for a link based on the capabilities command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands.
Page 447: Capabilities
• symmetric (Gigabit only) - When specified, the port transmits and receives pause frames; when not specified, the port will auto-negotiate to determine the sender and receiver for asymmetric pause frames. (The current switch ASIC only supports symmetric pause frames.) Default Setting •...
Page 448: Flowcontrol
Command Usage When auto-negotiation is enabled with the negotiation command, the switch will negotiate the best settings for a link based on the capabilites command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands.
Page 449: Shutdown
• To force flow control on or off (with the flowcontrol or no flowcontrol command), use the no negotiation command to disable auto-negotiation on the selected interface. • When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command. To enable flow control under auto-negotiation, “flowcontrol”...
Page 450: Clear Counters
OMMAND NTERFACE Command Usage This command allows you to disable a port due to abnormal behavior (e.g., excessive collisions), and then reenable it after the problem has been resolved. You may also want to disable a port for security reasons. Example The following example disables port 5.
Page 451: Show Interfaces Status
Example The following example clears statistics on port 5. Console#clear counters ethernet 1/5 Console# show interfaces status This command displays the status for an interface. Syntax show interfaces status [interface] interface • ethernet unit/port - unit - Stack unit. (Always unit 1) - port - Port number.
Page 452: Show Interfaces Counters
OMMAND NTERFACE Example Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: Mac address: Configuration: Name: Port admin: Speed-duplex: Capabilities: Broadcast storm: Broadcast storm limit: Flow control: LACP: Port security: Max MAC count: Port security action: Media type: Current status: Link status:...
Page 453: Table 4-42 Interface Commands
Command Usage If no interface is specified, information on all interfaces is displayed. For a description of the items displayed by this command, see “Showing Port Statistics” on page 3-134. Example Console#show interfaces counters ethernet 1/7 Ethernet 1/7 Iftable stats: Octets input: 30658, Octets output: 196550 Unicast input: 6, Unicast output: 5 Discard input: 0, Discard output: 0...
Page 454: Show Interfaces Switchport
OMMAND NTERFACE show interfaces switchport This command displays the administrative and operational status of the specified interfaces. Syntax show interfaces switchport [interface] interface • ethernet unit/port - unit - Stack unit. (Always unit 1) - port - Port number. (Range: 1-28) •...
Page 455: Table 4-43 Show Interfaces Switchport - Display Description
Table 4-43 show interfaces switchport - display description Field Description Broadcast threshold Shows if broadcast storm suppression is enabled or disabled; if enabled it also shows the threshold level (page 4-156). LACP status Shows if Link Aggregation Control Protocol has been enabled or disabled (page 4-164).
Page 456: Broadcast Commands
Global Configuration Command Usage • When broadcast traffic exceeds the specified threshold, packets above that threshold are dropped. • The specified threshold value applies to all ports on the switch. 4-156 Table 4-44 Broadcast Commands Function Configures the global threshold level...
Page 457: Switchport Broadcast
Example The following shows how to configure broadcast storm control at 600 packets per second: Console(config)#broadcast packet-rate 600 switchport broadcast This command enables broadcast storm control on an interface. Use the no form to disable broadcast storm control on an interface. Syntax [no] switchport broadcast Default Setting...
Page 458: Mirror Port Commands
OMMAND NTERFACE Mirror Port Commands This section describes how to mirror traffic from a source port to a target port. Command port monitor show port monitor Shows the configuration for a mirror port port monitor This command configures a mirror session. Use the no form to clear a mirror session.
Page 459: Show Port Monitor
However, you should avoid sending too much traffic to the destination port from multiple source ports. Example The following example configures the switch to mirror all packets from port 6 to 11. Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 both...
Page 460: Rate Limit Commands
OMMAND NTERFACE Example The following shows mirroring configured from port 6 to port 11. Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 Console(config-if)#end Console#show port monitor Port Mirroring ------------------------------------- Destination port(listen port):Eth1/1 Source port(monitored port) Mode Console# Rate Limit Commands This function allows the network manager to control the maximum rate for traffic received on an interface.
Page 461 • input – Input rate • rate – Percentage Default Setting 100 percent Command Mode Interface Configuration (Ethernet, Port Channel) Example Console(config)#interface ethernet 1/1 Console(config-if)#rate-limit input 600 Console(config-if)# IMIT OMMANDS 4-161...
Page 462: Link Aggregation Commands
For static trunks, the switches have to comply with the Cisco EtherChannel standard. For dynamic trunks, the switches have to comply with LACP. This switch supports up to six trunks. For example, a trunk consisting of two 1000 Mbps ports can support an aggregate bandwidth of 4 Gbps when operating at full duplex.
Page 463: Guidelines For Creating Trunks
Guidelines for Creating Trunks General Guidelines – • Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop. • A trunk can have up to 8 ports. • The ports at both ends of a connection must be configured as trunk ports.
Page 464: Channel-Group
• When configuring static trunks, the switches must comply with the Cisco EtherChannel standard. • Use no channel-group to remove a port group from a trunk. • Use no interfaces port-channel to remove a trunk from the switch. Example The following example creates trunk 1 and then adds port 11.
Page 465 • A trunk formed with another switch using LACP will automatically be assigned the next available port-channel ID. • If the target switch has also enabled LACP on the connected ports, the trunk will be activated automatically. • If more than eight ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails.
Page 466 OMMAND NTERFACE Example The following shows LACP enabled on ports 10-12. Because LACP has also been enabled on the ports at the other end of the links, the show interfaces status port-channel 1 command shows that Trunk1 has been established. Console(config)#interface ethernet 1/10 Console(config-if)#lacp Console(config-if)#exit...
Page 467: Lacp System-Priority
• Port must be configured with the same system priority to join the same LAG. • System priority is combined with the switch’s MAC address to form the LAG identifier. This identifier is used to indicate a specific LAG during LACP negotiations with other systems.
Page 468: Lacp Admin-Key (Ethernet Interface)
OMMAND NTERFACE lacp admin-key (Ethernet Interface) This command configures a port's LACP administration key. Use the no form to restore the default setting. Syntax lacp {actor | partner} admin-key key [no] lacp {actor | partner} admin-key • actor - The local side an aggregate link. •...
Page 469: Lacp Admin-Key (Port Channel)
Syntax lacp admin-key key [no] lacp admin-key key - The port channel admin key is used to identify a specific link aggregation group (LAG) during local LACP setup on this switch. (Range: 0-65535) Default Setting Command Mode Interface Configuration (Port Channel) Command Usage •...
Page 470: Lacp Port-Priority
OMMAND NTERFACE lacp port-priority This command configures LACP port priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} port-priority priority no lacp {actor | partner} port-priority • actor - The local side an aggregate link. •...
Page 471: Show Lacp
show lacp This command displays LACP information. Syntax show lacp [port-channel] {counters | internal | neighbors | sys-id} • port-channel - Local identifier for a link aggregation group. (Range: 1-6) • counters - Statistics for LACP protocol messages. • internal - Configuration settings and operational state for local side.
Page 472: Table 4-48 Show Lacp Counters - Display Description
OMMAND NTERFACE Table 4-48 show lacp counters - display description Field LACPDUs Sent LACPDUs Received Number of valid LACPDUs received on this channel Marker Sent Marker Received LACPDUs Unknown Pkts LACPDUs Illegal Pkts Console#show lacp internal Channel group : 1 ------------------------------------------------------------------- Oper Key: Admin Key: 0...
Page 473 Table 4-49 show lacp internal - display description (Continued) Field Description LACPDUs Number of seconds before invalidating received LACPDU Internal information. LACP System LACP system priority assigned to this port channel. Priority LACP Port LACP port priority assigned to this interface within the Priority channel group.
Page 474: Table 4-50 Show Lacp Neighbors - Display Description
OMMAND NTERFACE Console#show lacp 1 neighbors Channel group 1 neighbors ------------------------------------------------------------------- Eth 1/1 ------------------------------------------------------------------- Partner Admin System ID: Partner Oper System ID: Partner Admin Port Number: 2 Partner Oper Port Number: Port Admin Priority: Port Oper Priority: Admin Key: Oper Key: Admin State: Oper State: Table 4-50 show lacp neighbors - display description...
Page 475: Address Table Commands
32768 32768 32768 32768 32768 Description A link aggregation group configured on this switch. LACP system priority for this channel group. System MAC address. Table 4-52 Address Table Commands Function Maps a static address to a port in a VLAN...
Page 476: Mac-Address-Table Static
- port-channel channel-id (Range: 1-8) • vlan-id - VLAN ID (Range: 1-4093) • action - delete-on-reset - Assignment lasts until the switch is reset. - permanent - Assignment is permanent. Default Setting No static addresses are defined. The default mode is permanent.
Page 477: Clear Mac-Address-Table Dynamic
Command Usage The static address for a host device can be assigned to a specific port within a specific VLAN. Use this command to add static addresses to the MAC Address Table. Static addresses have the following characteristics: • Static addresses will not be removed from the address table when a given interface link is down.
Page 478: Show Mac-Address-Table
OMMAND NTERFACE show mac-address-table This command shows classes of entries in the bridge-forwarding database. Syntax show mac-address-table [address mac-address [mask]] [interface interface] [vlan vlan-id] [sort {address | vlan | interface}] • mac-address - MAC address. • mask - Bits to match in the address. •...
Page 479: Mac-Address-Table Aging-Time
Example Console#show mac-address-table Interface Mac Address --------- ----------------- ---- ----------------- Eth 1/ 1 00-00-00-00-00-17 Eth 1/ 1 00-E0-29-94-34-DE Console# mac-address-table aging-time This command sets the aging time for entries in the address table. Use the no form to restore the default aging time. Syntax mac-address-table aging-time seconds no mac-address-table aging-time...
Page 480: Show Mac-Address-Table Aging-Time
Console#show mac-address-table aging-time Aging time: 300 sec. Console# Spanning Tree Commands This section includes commands that configure the Spanning Tree Algorithm (STA) globally for the switch, and commands that configure STA for the selected interface. Command spanning-tree spanning-tree mode spanning-tree...
Page 481: Spanning-Tree
Enables fast forwarding for edge ports IC spanning-tree portfast spanning-tree link-type spanning-tree protocol-migration show spanning-tree spanning-tree This command enables the Spanning Tree Algorithm globally for the switch. Use the no form to disable it. Syntax [no] spanning-tree Default Setting Spanning tree is enabled. Command Mode...
Page 482: Spanning-Tree Mode
This example shows how to enable the Spanning Tree Algorithm for the switch. Console(config)#spanning-tree Console(config)# spanning-tree mode This command selects the spanning tree mode for this switch. Use the no form to restore the default. Syntax spanning-tree mode {stp | rstp} no spanning-tree mode •...
Page 483: Spanning-Tree Forward-Time
RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU after a port’s migration delay timer expires, the switch assumes that it is connected to an 802.1D bridge and starts using only 802.1D BPDUs.
Page 484: Spanning-Tree Hello-Time
Console(config)#spanning-tree forward-time 20 Console(config)# spanning-tree hello-time This command configures the spanning tree bridge hello time globally for this switch. Use the no form to restore the default. Syntax spanning-tree hello-time time no spanning-tree hello-time time - Time in seconds. (Range: 1-10 seconds).
Page 485: Spanning-Tree Max-Age
(4 -183) spanning-tree max-age (4 -185) spanning-tree max-age This command configures the spanning tree bridge maximum age globally for this switch. Use the no form to restore the default. Syntax spanning-tree max-age seconds no spanning-tree max-age seconds - Time in seconds. (Range: 6-40 seconds) The minimum value is the higher of 6 or [2 x (hello-time + 1)].
Page 486: Spanning-Tree Priority
OMMAND NTERFACE spanning-tree priority This command configures the spanning tree priority globally for this switch. Use the no form to restore the default. Syntax spanning-tree priority priority no spanning-tree priority priority - Priority of the bridge. (Range: 0 - 65535) (Range –...
Page 487: Spanning-Tree Transmission-Limit
Protocol. • short - Specifies 16-bit based values that range from 1-65535. This method is based on the IEEE 802.1 Spanning Tree Protocol. Default Setting Long method Command Mode Global Configuration Command Usage The path cost method is used to determine the best path between devices.
Page 488: Spanning-Tree Spanning-Disabled
OMMAND NTERFACE Example Console(config)#spanning-tree transmission-limit 4 Console(config)# spanning-tree spanning-disabled This command disables the spanning tree algorithm for the specified interface. Use the no form to reenable the spanning tree algorithm for the specified interface. Syntax [no] spanning-tree spanning-disabled Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel)
Page 489: Spanning-Tree Port-Priority
Default Setting • Ethernet – half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 • Fast Ethernet – half duplex: 200,000; full duplex: 100,000; trunk: 50,000 • Gigabit Ethernet – full duplex: 10,000; trunk: 5,000 Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage •...
Page 490: Spanning-Tree Edge-Port
• This command defines the priority for the use of a port in the Spanning Tree Algorithm. If the path cost for all ports on a switch are the same, the port with the highest priority (that is, lowest value) will be configured as an active link in the spanning tree.
Page 491: Spanning-Tree Portfast
of frame flooding required to rebuild address tables during reconfiguration events, does not cause the spanning tree to initiate reconfiguration when the interface changes state, and also overcomes other STA-related timeout problems. However, remember that Edge Port should only be enabled for ports connected to an end-node device.
Page 492: Spanning-Tree Link-Type
• When automatic detection is selected, the switch derives the link type from the duplex mode. A full-duplex interface is considered a...
Page 493: Spanning-Tree Protocol-Migration
Command Mode Privileged Exec Command Usage If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the spanning-tree protocol-migration command at any time to manually re-check the appropriate BPDU format to send on the selected interfaces (i.e., RSTP or STP-compatible).
Page 494: Show Spanning-Tree
Command Usage • Use the show spanning-tree command with no parameters to display the spanning tree configuration for the switch for the Common Spanning Tree (CST) and for every interface in the tree. • Use the show spanning-tree interface command to display the spanning tree configuration for an interface within the Common Spanning Tree (CST).
Page 495 Example Console#show spanning-tree Spanning-tree information --------------------------------------------------------------- Spanning tree mode: Spanning tree enabled/disabled: Instance: VLANs configuration: Priority: Bridge Hello Time (sec.): Bridge Max Age (sec.): Bridge Forward Delay (sec.): Root Hello Time (sec.): Root Max Age (sec.): Root Forward Delay (sec.): Max hops: Remaining hops: Designated Root:...
Page 496: Vlan Commands
OMMAND NTERFACE VLAN Commands A VLAN is a group of ports that can be located anywhere in the network, but communicate as though they belong to the same physical segment. This section describes commands used to create VLAN groups, add port members, specify how VLAN tagging is used, and enable automatic VLAN registration for the selected interface.
Page 497: Vlan
Command Mode Global Configuration Command Usage • Use the VLAN database command mode to add, change, and delete VLANs. After finishing configuration changes, you can display the VLAN settings by entering the show vlan command. • Use the interface vlan command mode to define the port membership mode and add or remove ports from a VLAN.
Page 498: Configuring Vlan Interfaces
• no vlan vlan-id name removes the VLAN name. • no vlan vlan-id state returns the VLAN to the default state (i.e., active). • You can configure up to 255 VLANs on the switch. Example The following example adds a VLAN, using VLAN ID 105 and name RD5.
Page 499: Interface Vlan
Command switchport native vlan switchport allowed vlan switchport gvrp switchport forbidden vlan switchport priority default interface vlan This command enters interface configuration mode for VLANs, which is used to configure VLAN parameters for a physical interface. Syntax interface vlan vlan-id vlan-id - ID of the configured VLAN.
Page 500: Switchport Mode
OMMAND NTERFACE switchport mode This command configures the VLAN membership mode for a port. Use the no form to restore the default. Syntax switchport mode {hybrid | access} no switchport mode • hybrid - Specifies a hybrid VLAN interface. The port may transmit tagged or untagged frames.
Page 501 • tagged - The port only receives tagged frames. Default Setting All frame types Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage When set to receive all frame types, any received frames that are untagged are assigned to the default VLAN. Example The following example shows how to restrict the traffic received on port 1 to tagged frames:...
Page 502: Switchport Ingress-Filtering
NTERFACE switchport ingress-filtering This command enables ingress filtering for an interface. Note: Although the ingress filtering command is available, the switch has ingress filtering permanently set to enable. Therefore, trying to disable the filtering with the "no switchport ingress-filtering” command will produce this error message: “Note: Failed to ingress-filtering on ethernet interface !”...
Page 503: Switchport Native Vlan
switchport native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no form to restore the default. Syntax switchport native vlan vlan-id no switchport native vlan vlan-id - Default VLAN ID for a port. (Range: 1-4093, no leading zeroes) Default Setting VLAN 1...
Page 504: Switchport Allowed Vlan
VLAN groups as a tagged member. • Frames are always tagged within the switch. The tagged/untagged parameter used when adding a VLAN to an interface tells the switch whether to keep or remove the tag from a frame on egress.
Page 505: Switchport Forbidden Vlan
• The interface can be added to a VLAN as an untagged member regardless of connected devices to this interface. The default setting is untagged VLAN 1. Note that each port can only have one untagged VLAN. If a second VLAN is defined for a port as untagged, the other VLAN that had untagged status will automatically be changed to tagged.
Page 506: Displaying Vlan Information
OMMAND NTERFACE Command Usage • This command prevents a VLAN from being automatically added to the specified interface via GVRP. • If a VLAN has been added to the set of allowed VLANs for an interface, then you cannot add it to the set of forbidden VLANs for that same interface.
Page 507: Configuring Private Vlans
Internet, while the community ports provide restricted access to local users. Multiple primary VLANs can be configured on this switch, and multiple community VLANs can be associated with each primary VLAN. (Note that private VLANs and normal VLANs can exist simultaneously within the same switch.)
Page 508: Table 4-58 Private Vlan Commands
OMMAND NTERFACE Command Edit Private VLAN Groups private-vlan private-vlan association Associates a community VLAN with a Configure Private VLAN Interfaces switchport mode private-vlan switchport private-vlan host-association switchport private-vlan mapping Display Private VLAN Information show vlan private-vlan Shows private VLAN information To configure primary/secondary associated groups, follow these steps: 1.
Page 509: Private-Vlan
private-vlan Use this command to create a primary or community VLAN. Use the no form to remove the specified private VLAN. Syntax private-vlan vlan-id {community | primary} no private-vlan vlan-id • vlan-id - ID of private VLAN. (Range: 1-4093, no leading zeroes). •...
Page 510: Private Vlan Association
OMMAND NTERFACE Example Console(config)#vlan database Console(config-vlan)#private-vlan 2 primary Console(config-vlan)#private-vlan 3 community Console(config)# private vlan association Use this command to associate a primary VLAN with a secondary (i.e., community) VLAN. Use the no form to remove all associations for the specified primary VLAN. Syntax private-vlan primary-vlan-id association {primary-vlan-id | add secondary-vlan-id | remove secondary-vlan-id}...
Page 511: Switchport Mode Private-Vlan
switchport mode private-vlan Use this command to set the private VLAN mode for an interface. Use the no form to restore the default setting. Syntax switchport mode private-vlan{host | promiscuous} no switchport mode private-vlan • host – This port type can subsequently be assigned to a community VLAN.
Page 512: Switchport Private-Vlan Mapping
OMMAND NTERFACE switchport private-vlan host-association secondary-vlan-id no switchport private-vlan host-association secondary-vlan-id - ID of secondary (i.e., community) VLAN. (Range: 1-4093, no leading zeroes). Default Setting None Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage All ports assigned to a secondary (i.e., community) VLAN can pass traffic between group members, but must communicate with resources outside of the group via promiscuous ports in the associated primary VLAN.
Page 513: Show Vlan Private-Vlan
Console(config-if)#switchport private-vlan mapping 2 Console(config-if)# show vlan private-vlan Use this command to show the private VLAN configuration settings on this switch. Syntax show vlan private-vlan mapping [community | primary] • community – Displays all community VLANs, along with their associated primary VLAN and assigned host interfaces.
Page 514: Gvrp And Bridge Extension Commands
Configures forbidden VLANs for show gvrp configuration garp timer show garp timer bridge-ext gvrp This command enables GVRP globally for the switch. Use the no form to disable it. Syntax [no] bridge-ext gvrp Default Setting Disabled...
Page 515: Show Bridge-Ext
GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. This function should be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. Example Console(config)#bridge-ext gvrp...
Page 516: Switchport Gvrp
OMMAND NTERFACE switchport gvrp This command enables GVRP for a port. Use the no form to disable it. Syntax [no] switchport gvrp Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Example Console(config)#interface ethernet 1/1 Console(config-if)#switchport gvrp Console(config-if)# show gvrp configuration This command shows if GVRP is enabled.
Page 517: Garp Timer
garp timer This command sets the values for the join, leave and leaveall timers. Use the no form to restore the timers’ default values. Syntax garp timer {join | leave | leaveall} timer_value no garp timer {join | leave | leaveall} •...
Page 518: Show Garp Timer
OMMAND NTERFACE Example Console(config)#interface ethernet 1/1 Console(config-if)#garp timer join 100 Console(config-if)# Related Commands show garp timer (4 -218) show garp timer This command shows the GARP timers for the selected interface. Syntax show garp timer [interface] interface • ethernet unit/port - unit - Stack unit.
Page 519: Priority Commands
Priority Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with eight priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.
Page 520: Queue Mode
Global Configuration Command Usage You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
Page 521: Switchport Priority Default
If the incoming frame is an IEEE 802.1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used. • This switch provides eight priority queues for each port. It is configured to use Weighted Round Robin, which can be viewed with the show queue bandwidth command.
Page 522: Queue Bandwidth
OMMAND NTERFACE Therefore, any inbound frames that do not have priority tags will be placed in queue 0 of the output port. (Note that if the output port is an untagged member of the associated VLAN, these frames are stripped of all VLAN tags prior to transmission.) Example The following example shows how to set a default priority on port 3 to 5 Console(config)#interface ethernet 1/3...
Page 523: Queue Cos-Map
0 to 7, where 7 is the highest priority. Default Setting This switch supports Class of Service by using eight priority queues, with Weighted Round Robin queuing for each port. Eight separate traffic classes are defined in IEEE 802.1p. The default priority levels are assigned according to recommendations in the IEEE 802.1p...
Page 524: Show Queue Mode
OMMAND NTERFACE Example The following example shows how to change the CoS assignments to a one-to-one mapping. Console(config)#interface ethernet 1/1 Console(config-if)#queue cos-map 0 0 Console(config-if)#queue cos-map 1 1 Console(config-if)#queue cos-map 2 2 Console(config-if)#exit Console#show queue cos-map ethernet 1/1 Information of Eth 1/1 Traffic Class : 0 1 2 3 4 5 6 7 Priority Queue: 0 1 2 3 4 5 6 7 Console#...
Page 525: Show Queue Cos-Map
Command Mode Privileged Exec Example Console#show queue bandwidth Information of Eth 1/1 Queue ID Weight -------- ------ show queue cos-map This command shows the class of service priority map. Syntax show queue cos-map [interface] interface • ethernet unit/port - unit - Stack unit. (Always unit 1) - port - Port number.
Page 526: Map Ip Dscp (Global Configuration)
OMMAND NTERFACE Priority Commands (Layer 3 and 4) Table 4-63 Priority Commands (Layer 3 and 4) Command map ip dscp map ip dscp map access-list ip show map ip dscp show map access-list map ip dscp (Global Configuration) This command enables IP DSCP mapping (i.e., Differentiated Services Code Point mapping).
Page 527: Map Ip Dscp (Interface Configuration)
map ip dscp (Interface Configuration) This command sets IP DSCP priority (i.e., Differentiated Services Code Point priority). Use the no form to restore the default table. Syntax map ip dscp dscp-value cos cos-value no map ip dscp • dscp-value - 8-bit DSCP value. (Range: 0-255) •...
Page 528: Show Map Ip Dscp
OMMAND NTERFACE Example The following example shows how to map IP DSCP value 1 to CoS value 0. Console(config)#interface ethernet 1/5 Console(config-if)#map ip dscp 1 cos 0 Console(config-if)# show map ip dscp This command shows the IP DSCP priority map. Syntax show map ip dscp [interface] interface...
Page 529: Multicast Filtering Commands
(Interface Configuration) (4 -227) Multicast Filtering Commands This switch uses IGMP (Internet Group Management Protocol) to query for any attached hosts that want to receive a specific multicast service. It identifies the ports containing hosts requesting a service and sends data out to those ports only.
Page 530: Igmp Snooping Commands
Shows the IGMP snooping and query show mac-address-table multicast ip igmp snooping This command enables IGMP snooping on this switch. Use the no form to disable it. Syntax [no] ip igmp snooping Default Setting Enabled...
Page 531: Ip Igmp Snooping Vlan Static
ip igmp snooping vlan static This command adds a port to a multicast group. Use the no form to remove the port. Syntax [no] ip igmp snooping vlan vlan-id static ip-address interface • vlan-id - VLAN ID (Range: 1-4093) • ip-address - IP address for multicast group •...
Page 532: Ip Igmp Snooping Version
• All systems on the subnet must support the same version. If there are legacy devices in your network that only support Version 1, you will also have to configure this switch to use Version 1. • Some commands are only enabled for IGMPv2, including ip igmp query-max-response-time and ip igmp query-timeout.
Page 533: Ip Igmp Snooping Immediate-Leave
IGMP group-specific query to the interface. Upon receiving a group-specific IGMPv2 leave message, the switch immediately removes the interface from the Layer 2 forwarding table entry for that multicast group, unless a multicast router was learned on the port.
Page 534: Show Mac-Address-Table Multicast
OMMAND NTERFACE Command Usage See “Configuring IGMP Snooping and Query Parameters” on page 3-207 for a description of the displayed items. Example The following shows the current IGMP snooping configuration: Console#show ip igmp snooping Service status: Querier status: Query count: Query interval: Query max response time: 10 sec Router port expire time: 300 sec...
Page 535: Igmp Query Commands (Layer 2)
This command enables the switch as an IGMP querier. Use the no form to disable it. Syntax [no] ip igmp snooping querier Default Setting Enabled Command Mode...
Page 536: Ip Igmp Snooping Query-Count
OMMAND NTERFACE Command Usage If enabled, the switch will serve as querier if elected. The querier is responsible for asking hosts if they want to receive multicast traffic. Example Console(config)#ip igmp snooping querier Console(config)# ip igmp snooping query-count This command configures the query count. Use the no form to restore the default.
Page 537: Ip Igmp Snooping Query-Interval
This command configures the query interval. Use the no form to restore the default. Syntax ip igmp snooping query-interval seconds no ip igmp snooping query-interval seconds - The frequency at which the switch sends IGMP host-query messages. (Range: 60-125) Default Setting 125 seconds Command Mode...
Page 538: Ip Igmp Snooping Query-Max-Response-Time
Global Configuration Command Usage • The switch must be using IGMPv2 for this command to take effect. • This command defines the time after a query, during which a response is expected from a multicast client. If a querier has sent a number of...
Page 539: Ip Igmp Snooping Router-Port-Expire-Time
- The time the switch waits after the previous querier stops before it considers the router port (i.e., the interface which had been receiving query packets) to have expired.
Page 540: Static Multicast Routing Commands
Depending on your network connections, IGMP snooping may not always be able to locate the IGMP querier. Therefore, if the IGMP querier is a known multicast router/switch connected over the network to an interface (port or trunk) on your router, you can manually configure that interface to join all the current multicast groups.
Page 541: Show Ip Igmp Snooping Mrouter
Example The following shows how to configure port 11 as a multicast router port within VLAN 1: Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11 Console(config)# show ip igmp snooping mrouter This command displays information on statically configured and dynamically learned multicast router ports. Syntax show ip igmp snooping mrouter [vlan vlan-id] vlan-id - VLAN ID (Range: 1-4093)
Page 542: Igmp Filtering And Throttling Commands
The IGMP filtering feature fulfills this requirement by restricting access to specified multicast services on a switch port and IGMP throttling limits the number of simultaneous multicast groups a port can join. Table 4-69 IGMP Filtering and Throttling Commands...
Page 543: Ip Igmp Filter (Global Configuration)
Global Configuration Command Usage • IGMP filtering enables you to assign a profile to a switch port that specifies multcast groups that are permitted or denied on the port. An IGMP filter profile can contain one or more, or a range of multicast addresses, but only one profile can be assigned to a port.
Page 544: Ip Igmp Profile
OMMAND NTERFACE ip igmp profile This command creates an IGMP filter profile number and enters IGMP profile configuration mode. Use the no form to delete a profile number. Syntax [no] ip igmp profile profile-number Default Setting Disabled Command Mode Global Configuration Command Usage A profile defines the multicast groups that a subscriber is permitted or denied to join.
Page 545: Range
• When the access mode is set to permit, IGMP join reports are processed when a multicast group falls within the controlled range. When the access mode is set to deny, IGMP join reports are only processed when a multicast group is not in the controlled range. Example Console(config)#ip igmp profile 19 Console(config-igmp-profile)#permit...
Page 546: Ip Igmp Filter (Interface Configuration)
NTERFACE ip igmp filter (Interface Configuration) This command assigns an IGMP filtering profile to an interface on the switch. Use the no form to remove a profile from an interface. Syntax [no] ip igmp filter profile-number • profile-number - An IGMP filter profile number. (Range:...
Page 547: Ip Igmp Max-Groups
When the maximum number of groups is reached on a port, the switch can take one of two actions; either “deny” or “replace.” If the action is set to deny, any new IGMP join reports will be dropped.
Page 548: Ip Igmp Max-Groups Action
Interface Configuration Command Usage When the maximum number of groups is reached on a port, the switch can take one of two actions; either “deny” or “replace.” If the action is set to deny, any new IGMP join reports will be dropped. If the action is set to replace, the switch randomly removes an existing group and replaces it with the new multicast group.
Page 549: Show Ip Igmp Profile
239.1.1.1 239.1.1.1 range 239.2.3.1 239.2.3.100 Console# show ip igmp profile This command displays IGMP filtering profiles created on the switch. Syntax show ip igmp profile [profile-number] • profile-number - An existing IGMP filter profile number. (Range: 1-4294967295) Default Setting...
Page 550: Show Ip Igmp Throttle Interface
OMMAND NTERFACE show ip igmp throttle interface This command displays the interface settings for IGMP throttling. Syntax show ip igmp throttle interface [interface] • interface • ethernet unit/port - unit - This is unit 1. - port - Port number. (Range: 1-28) •...
Page 551: Mvr (Global Configuration)
(Global Configuration) This command enables Multicast VLAN Registration (MVR) globally on the switch, statically configures MVR multicast group IP address(es) using the group keyword, or specifies the MVR VLAN identifier using the vlan keyword. Use the no form of this command without any keywords to globally disable MVR.
Page 552 OMMAND NTERFACE Default Setting • MVR is disabled. • No MVR group address is defined. • The default number of contiguous addresses is 0. • MVR VLAN ID is 1. Command Mode Global Configuration Command Usage • Use the mvr group command to statically configure all multicast group addresses that will join the MVR VLAN.
Page 553: Mvr (Interface Configuration)
• source - Configure the interface as an uplink port that can send and receive multicast data for the configured multicast groups. • immediate - Configures the switch to immediately remove an interface from a multicast stream as soon as it receives a leave message for that group.
Page 554 When immediate leave is disabled, the switch follows the standard rules by sending a group-specific query to the receiver port and waiting for a response to determine if there are any remaining subscribers for that multicast group before removing the port from the group list.
Page 555: Show Mvr
Example The following configures one source port and several receiver ports on the switch, enables immediate leave on one of the receiver ports, and statically assigns a multicast group to another receiver port: Console(config)#interface ethernet 1/5 Console(config-if)#mvr type source Console(config-if)#exit...
Page 556: Table 4-71 Show Mvr - Display Description
RECEIVER Console# 4-256 Description Shows if MVR is globally enabled on the switch. MVR environment are satisfied. traffic. Shows the maximum number of multicast groups which can assigned to the MVR VLAN. Shows the number of multicast groups currently assigned to the MVR VLAN.
Page 557: Table 4-73 Show Mvr Members - Display Description
Shows the MVR status and interface status. MVR status for source ports is “ACTIVE” if MVR is globally enabled on the switch. MVR status for receiver ports is “ACTIVE” only if there are subscribers receiving multicast traffic from one of the MVR groups, or a multicast group has been statically assigned to an interface.
Page 558: Ip Interface Commands
NTERFACE IP Interface Commands An IP addresses may be used for management access to the switch over your network. The IP address for this switch is obtained via DHCP by default. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server when it is powered on.
Page 559: Ip Address
• You can start broadcasting BOOTP or DHCP requests by entering an ip dhcp restart command, or by rebooting the switch. Note: Only one VLAN interface can be assigned an IP address (the default is VLAN 1). This defines the management VLAN,...
Page 560: Ip Dhcp Restart
OMMAND NTERFACE access to the switch. If you assign an IP address to any other VLAN, the new IP address overrides the original IP address and this becomes the new management VLAN. Example In the following example, the device is assigned an address in VLAN 1.
Page 561: Ip Default-Gateway
Dhcp. Console# Related Commands ip address (4 -259) ip default-gateway This command establishes a static route between this switch and devices that exist on another network segment. Use the no form to remove the static route. Syntax ip default-gateway gateway...
Page 562: Show Ip Interface
OMMAND NTERFACE Related Commands show ip redirects (4 -262) show ip interface This command displays the settings of an IP interface. Default Setting All interfaces Command Mode Privileged Exec Example Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: User specified.
Page 563: Ping
• size - Number of bytes in a packet. (Range: 32-512, default: 32) The actual packet size will be eight bytes larger than the size specified because the switch adds header information. • count - Number of packets to send. (Range: 1-16, default: 5) Default Setting This command has no default for the host.
Page 564: Ip Source Guard Commands
4-264 Table 4-75 IP Source Guard Commands Function Configures the switch to filter inbound traffic based on source IP address, or source IP address and corresponding MAC address Adds a static address to the source-guard binding table Shows whether source guard is enabled or...
Page 565: Ip Source-Guard
This command configures the switch to filter inbound traffic based source IP address, or source IP address and corresponding MAC address. Use the no form to disable this function. Syntax [no] ip source-guard {sip | sip-mac} • sip - Filters traffic based on IP addresses stored in the binding table.
Page 566 - If IP source guard if enabled on an interface for which IP source bindings (dynamically learned via DHCP snooping or manually configured) are not yet configured, the switch will drop all IP traffic on that port, except for DHCP packets.
Page 567: Ip Source-Guard Binding
ip source-guard binding This command adds a static address to the source-guard binding table. Use the no form to remove a static entry. Syntax ip source-guard mac-address vlan vlan-id ip-address interface ethernet unit/port no ip source-guard mac-address vlan vlan-id • mac-address - A valid unicast MAC address. •...
Page 568: Show Ip Source-Guard
OMMAND NTERFACE - If there is an entry with same VLAN ID and MAC address, and the type of entry is static IP source guard binding, then the new entry will replace the old one. - If there is an entry with same VLAN ID and MAC address, and the type of the entry is dynamic DHCP snooping binding, then the new entry will replace the old one and the entry type will be changed to static IP source guard binding.
Page 569: Show Ip Source-Guard Binding
Console# DHCP Snooping Commands DHCP snooping allows a switch to protect a network from rogue DHCP servers or other devices which send port-related information to a DHCP server. This information can be useful in tracking an IP address back to a physical port.
Page 570: Ip Dhcp Snooping
OMMAND NTERFACE Command ip dhcp snooping database flash show ip dhcp snooping show ip dhcp snooping binding ip dhcp snooping This command enables DHCP snooping globally. Use the no form to restore the default setting. Syntax [no] ip dhcp snooping Default Setting Disabled Command Mode...
Page 571 • When DHCP snooping is enabled, the rate limit for the number of DHCP messages that can be processed by the switch is 100 packets per second. Any DHCP packets in excess of this limit are dropped.
Page 572: Ip Dhcp Snooping Vlan
The port(s) through which the switch submits a client request to the DHCP server must be configured as trusted (ip dhcp snooping trust, page 4-273). Note that the switch will not add a dynamic entry for itself to the binding table when it receives an ACK message from a DHCP server.
Page 573: Ip Dhcp Snooping Trust
Command Usage • When DHCP snooping enabled globally using the ip dhcp snooping command (page 4-270), and enabled on a VLAN with this command, DHCP packet filtering will be performed on any untrusted ports within the VLAN as specified by the ip dhcp snooping trust command (page 4-273).
Page 574: Ip Dhcp Snooping Verify Mac-Address
• When an untrusted port is changed to a trusted port, all the dynamic DHCP snooping bindings associated with this port are removed. • Additional considerations when the switch itself is a DHCP client – The port(s) through which it submits a client request to the DHCP server must be configured as trusted.
Page 575: Ip Dhcp Snooping Information Option
Command Usage • DHCP provides a relay mechanism for sending information about the switch and its DHCP clients to the DHCP server. Known as DHCP Option 82, it allows compatible DHCP servers to use the information when assigning IP addresses, or to set other services or policies for clients.
Page 576: Ip Dhcp Snooping Information Policy
NTERFACE • When the DHCP Snooping Information Option is enabled, clients can be identified by the switch port to which they are connected rather than just their MAC address. DHCP client-server exchange messages are then forwarded directly between the server and client without having to flood them to the entire VLAN.
Page 577: Ip Dhcp Snooping Database Flash
This command can be used to store the currently learned dynamic DHCP snooping entries to flash memory. These entries will be restored to the snooping table when the switch is reset. However, note that the lease time shown for a dynamic entry that has been restored from flash memory will no longer be valid.
Page 578: Show Ip Dhcp Snooping Binding
11-22-33-44-55-66 192.168.0.99 Console# Switch Cluster Commands Switch Clustering is a method of grouping switches together to enable centralized management through a single unit. A switch cluster has a “Commander” unit that is used to manage all other “Member” switches in the cluster.
Page 579: Cluster
Global Configuration Command Usage • To create a switch cluster, first be sure that clustering is enabled on the switch (the default is enabled), then set the switch as a Cluster Commander. Set a Cluster IP Pool that does not conflict with any other IP subnets in the network.
Page 580: Cluster Commander
OMMAND NTERFACE • Switch clusters are limited to a single IP subnet (Layer 2 domain). • A switch can only be a Member of one cluster. • Configured switch clusters are maintained across power resets and network changes. Example Console(config)#cluster...
Page 581: Cluster Ip-Pool
IP subnet. Cluster IP addresses are assigned to switches when they become Members and are used for communication between Member switches and the Commander. • You cannot change the cluster IP pool when the switch is currently in Commander mode. Commander mode must first be disabled. Example Console(config)#cluster ip-pool 10.2.3.4...
Page 582: Cluster Member
OMMAND NTERFACE cluster member This command configures a Candidate switch as a cluster Member. Use the no form to remove a Member switch from the cluster. Syntax cluster member mac-address <mac-address> id <member-id> no cluster member mac-address <member-id> - mac-address - The MAC address of the Candidate switch.
Page 583: Show Cluster
Command Usage • This command only operates through a Telnet connection to the Commander switch. Managing cluster Members using the local console CLI on the Commander is not supported. • There is no need to enter the username and password for access to the Member switch CLI.
Page 584: Show Cluster Candidates
OMMAND NTERFACE Example Console#show cluster members Cluster Members: ID: 1 Role: Active member IP Address: 10.254.254.2 MAC Address: 00-12-cf-23-49-c0 Description: SMC6128L2 Console# show cluster candidates This command shows the discovered Candidate switches in the network. Command Mode Privileged Exec Example Console#show cluster candidates Cluster Candidates: Role...
Page 585 PPENDIX OFTWARE PECIFICATIONS Software Features Authentication Local, RADIUS, TACACS, Port (802.1X), HTTPS, SSH, Port Security Access Control Lists DHCP Client Port Configuration 1000BASE-T: 10/100 Mbps at half/full duplex, 1000 Mbps at full duplex 1000BASE-SX/LX/LH - 1000 Mbps at full duplex (SFP), Flow Control Full Duplex: IEEE 802.3x Half Duplex: Back pressure...
Page 586: Software Specifications
OFTWARE PECIFICATIONS Spanning Tree Algorithm Spanning Tree Protocol (STP, IEEE 802.1D) Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) VLAN Support Up to 255 groups; port-based, protocol-based, or tagged (802.1Q), GVRP for automatic VLAN learning, private VLANs Class of Service Supports eight levels of priority and Weighted Round Robin Queueing (which can be configured by VLAN tag or port), Layer 3/4 priority mapping: IP DSCP Multicast Filtering...
Page 587: Standards
RMON Groups 1, 2, 3, 9 (Statistics, History, Alarm, Event) Standards IEEE 802.1D Spanning Tree Protocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1v Protocol-based VLANs IEEE 802.1w Rapid Spanning Tree Protocol IEEE 802.1X Port Authentication IEEE 802.3-2005 Ethernet, Fast Ethernet, Gigabit Ethernet Link Aggregation Control Protocol (LACP)
Page 588 OFTWARE PECIFICATIONS Extended Bridge MIB (RFC 2674) Extensible SNMP Agents MIB (RFC 2742) Forwarding Table MIB (RFC 2096) IGMP MIB (RFC 2933) Interface Group MIB (RFC 2233) Interfaces Evolution MIB (RFC 2863) IP Multicasting related MIBs MAU MIB (RFC 2668) MIB II (RFC 1213) Port Access Entity MIB (IEEE 802.1X) Port Access Entity Equipment MIB...
Page 589: Troubleshooting
IP interface to which it is connected. • If you are trying to connect to the switch via the IP address for a tagged VLAN group, your management station, and the ports connecting intermediate switches in the network, must be configured with the appropriate tag.
Page 590 • Be sure you have generated a public key on the switch, and exported this key to the SSH client. • Be sure you have set up an account on the switch for each SSH user, including user name, authentication level, and password.
Page 591: Using System Logs
Using System Logs If a fault does occur, refer to the Installation Guide to ensure that the problem you encountered is actually caused by the switch. If the problem appears to be caused by the switch, follow these steps: 1. Enable logging.
Page 592 ROUBLESHOOTING...
Page 593 Access Control List (ACL) ACLs can limit network traffic and restrict access to certain users or devices by checking each packet for certain IP or MAC (i.e., Layer 2) information. Boot Protocol (BOOTP) BOOTP used to provide bootup information for network devices, including IP address information, the address of the TFTP server that contains the devices system files, and the name of the boot file.
Page 594 EAPOL is a client authentication protocol used by this switch to verify the network access rights for any device that is plugged into the switch. A user name and password is requested by the switch, and then passed to an authentication server (e.g., RADIUS) for verification.
Page 595 An IEEE standard for the Multiple Spanning Tree Protocol (MSTP) which provides independent spanning trees for VLAN groups. IEEE 802.1X Port Authentication controls access to the switch ports by requiring users to first enter a user ID and password for authentication. IEEE 802.3ac Defines frame extensions for VLAN tagging.
Page 596: Igmp Query
Internet Group Management Protocol (IGMP) A protocol through which hosts can register with their local router for multicast services. If there is more than one multicast switch/router on a given subnetwork, one of the devices is made the “querier” and assumes responsibility for keeping track of group membership.
Page 597: Multicast Switching
Multicast Switching A process whereby the switch filters incoming multicast frames for services for which no attached host has registered, or forwards them to all ports contained within the designated multicast VLAN group.
Page 598: Port Mirroring
10% of that required by the older IEEE 802.1D STP standard. Secure Shell (SSH) A secure replacement for remote access functions, including Telnet. SSH can authenticate users with a cryptographic key, and encrypt data connections between management clients and the switch. Glossary-6...
Page 599 Simple Mail Transfer Protocol (SMTP) A standard host-to-host mail transport protocol that operates over TCP, port 25. Simple Network Management Protocol (SNMP) The application protocol in the Internet suite of protocols which offers network management services. Simple Network Time Protocol (SNTP) allows a device to set its internal clock based on periodic updates SNTP from a Network Time Protocol (NTP) server.
Page 600 LOSSARY Trivial File Transfer Protocol (TFTP) A TCP/IP protocol commonly used for software downloads. User Datagram Protocol (UDP) provides a datagram mode for packet-switched communications. It uses IP as the underlying transport mechanism to provide access to IP-like services. UDP packets are delivered just like IP packets – connection-less datagrams that may be discarded before reaching their targets.
Page 601 Numerics 802.1x, port authentication 4-104 acceptable frame type 3-174 Access Control List See ACL Extended IP 3-98 4-113 4-117 Standard IP 3-98 4-113 address table 3-140 4-175 aging time 3-144 4-180 BOOTP 3-22 4-259 BPDU 3-145 broadcast storm, threshold 3-129 Class of Service See CoS CLI, showing commands 4-5 command line interface See CLI...
Page 602 NDEX HTTPS 3-74 4-41 HTTPS, secure server 3-74 IEEE 802.1D 3-145 4-182 IEEE 802.1w 3-145 4-182 IEEE 802.1x 4-104 IGMP groups, displaying 3-214 Layer 2 3-207 4-230 query 3-207 4-235 query, Layer 2 3-208 snooping 3-207 4-230 snooping, configuring 3-207 4-230 ingress filtering 3-174 4-202...
Page 603 4-156 capabilities 3-111 4-147 duplex mode 3-111 4-145 flow control 3-111 4-148 speed 3-111 4-145 ports, configuring 3-108 ports, mirroring 3-131 4-158 priority, default port ingress 3-186 problems, troubleshooting B-1 protocol migration 3-160 queue weights 3-191 4-222 RADIUS, logon authentication 3-69 4-94 rate limits, setting 3-132 remote logging 4-61...
Page 604 NDEX trunk configuration 3-113 LACP 3-117 4-164 static 3-115 4-164 upgrading software 3-25 user password 3-68 4-35 –??, VLANs 3-161 4-196 adding static members 3-170 4-204 creating 3-168 4-197 description 3-161 displaying basic information 3-165 4-215 displaying port members 3-166 egress mode 3-174 4-200 interface configuration 3-173...
Page 606 PRC: Taiwan: Asia Pacific: Korea: Japan: Australia: India: If you are looking for further contact information, please visit www.smc.com. 20 Mason Irvine, CA 92618 Phone: (949) 679-8000 (800) SMC-4-YOU 34-91-352-00-40 44 (0) 871 277 98 02 33 (0) 1 55 64 04 55...

This manual is also suitable for:

6128l2 - annexe 1

SMC Networks TigerSwitch SMC6128L2 Management Manual

Table of Contents

XVIII

1 Introduction

2 Initial Configuration

3 Configuring the Switch

4 Command Line Interface

Software Specifications

Troubleshooting

Quick Links

Management Guide

Chapters

Related Manuals for SMC Networks TigerSwitch SMC6128L2

Summary of Contents for SMC Networks TigerSwitch SMC6128L2