Page 1 Part No. 060191-10, Rev. B April 2004 OmniStack 6300-24 ® Users Guide...
Page 2 For more information on Alcatel’s Service Programs, see our web page at www.ind.alcatel.com, call us at 1-800-995-2696, or email us at support@ind.alcatel.com. This Manual documents OmniStack 6300-24 hardware and software. The functionality described in this Manual is subject to change without notice. Copyright 2004 by Alcatel Internetworking, Inc.
Page 3 Warning This equipment has been tested and found to comply with the limits for Class A digital device pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment.
Page 5: Table Of Contents
Contents Chapter 1: Introduction Key Features Description of Software Features System Defaults Chapter 2: Initial Configuration Connecting to the Switch Configuration Options Required Connections Remote Connections Basic Configuration Console Connection Setting Passwords Setting an IP Address Manual Configuration Dynamic Configuration Enabling SNMP Management Access Community Strings Trap Receivers...
Page 6 Contents Telnet Settings Configuring Event Logging System Logs System Logs Configuration Remote Logs Configuration Sending Simple Mail Transfer Protocol Alerts Resetting the System Setting the System Clock Configuring SNTP Setting the Time Zone Simple Network Management Protocol Enabling SNMP Setting Community Access Strings Specifying Trap Managers and Trap Types Configuring SNMPv3 Management Access Setting an Engine ID...
Page 7 Port Configuration Displaying Connection Status Configuring Interface Connections Creating Trunk Groups Statically Configuring a Trunk Enabling LACP on Selected Ports Configuring LACP Parameters Displaying LACP Port Counters Displaying LACP Settings and Status for the Local Side Displaying LACP Settings and Status for the Remote Side Setting Broadcast Storm Thresholds Configuring Port Mirroring Configuring Rate Limits...
Page 8 Contents Mapping Protocols to VLANs Class of Service Configuration Setting the Default Priority for Interfaces Mapping CoS Values to Egress Queues Selecting the Queue Mode Setting the Service Weight for Traffic Classes Mapping Layer 3/4 Priorities to CoS Values Selecting IP Precedence/DSCP Priority Mapping IP Precedence Mapping DSCP Priority Mapping IP Port Priority...
Page 9 Understanding Command Modes Exec Commands Configuration Commands Command Line Processing Command Groups Line Commands line login password timeout login response exec-timeout password-thresh silent-time databits parity speed stopbits disconnect show line General Commands enable disable configure show history reload exit quit System Management Commands Device Designation Commands prompt...
Page 10 Contents ip ssh timeout ip ssh authentication-retries ip ssh server-key size delete public-key ip ssh crypto host-key generate ip ssh crypto zeroize ip ssh save host-key show ip ssh show ssh show public-key Event Logging Commands logging on logging history logging host logging facility logging trap...
Page 11 whichboot boot system Authentication Commands Authentication Sequence authentication login authentication enable RADIUS Client radius-server host radius-server port radius-server key radius-server retransmit radius-server timeout show radius-server TACACS+ Client tacacs-server host tacacs-server port tacacs-server key show tacacs-server Port Security Commands port security 802.1x Port Authentication authentication dot1x default dot1x default...
Page 12 Contents match access-list ip show marking MAC ACLs access-list mac permit, deny (MAC ACL) show mac access-list access-list mac mask-precedence mask (MAC ACL) show access-list mac mask-precedence mac access-group show mac access-group map access-list mac show map access-list mac match access-list mac ACL Information show access-list show access-group...
Page 13 show dns show dns cache clear dns cache Interface Commands interface description speed-duplex negotiation capabilities flowcontrol combo-forced-mode shutdown switchport broadcast packet-rate clear counters show interfaces status show interfaces counters show interfaces switchport Mirror Port Commands port monitor show port monitor AMAP Configuration amap enable amap run...
Page 14 Contents spanning-tree forward-time spanning-tree hello-time spanning-tree max-age spanning-tree priority spanning-tree pathcost method spanning-tree transmission-limit spanning-tree mst-configuration mst vlan mst priority name revision max-hops spanning-tree spanning-disabled spanning-tree cost spanning-tree port-priority spanning-tree edge-port spanning-tree portfast spanning-tree link-type spanning-tree mst cost spanning-tree mst port-priority spanning-tree protocol-migration show spanning-tree show spanning-tree mst configuration...
Page 15 GVRP and Bridge Extension Commands bridge-ext gvrp show bridge-ext switchport gvrp show gvrp configuration garp timer show garp timer Priority Commands Priority Commands (Layer 2) switchport priority default queue mode queue bandwidth queue cos-map show queue mode show queue bandwidth show queue cos-map Priority Commands (Layer 3 and 4) map ip port (Global Configuration)
Page 16 Contents IGMP Query Commands (Layer 2) ip igmp snooping querier ip igmp snooping query-count ip igmp snooping query-interval ip igmp snooping query-max-response-time ip igmp snooping router-port-expire-time Static Multicast Routing Commands ip igmp snooping vlan mrouter show ip igmp snooping mrouter IP Interface Commands Basic IP Configuration ip address...
Page 17 Tables Table 1-1. Key Features Table 1-2. System Defaults Table 3-4. Main Menu Table 3-2. Configuration Options Table 3-1. SNMPv3 Security Models and Levels Table 3-22. Compatible Operating Systems Table 3-30. 802.1X Statistics Table 3-45. LACP Port Counters Information Table 3-47. LACP Settings - Local Side Table 3-49.
Page 18: Table
Tables Table 4-27. Authentication Sequence Table 4-28. RADIUS Commands Table 4-29. TACACS+ Commands Table 4-30. Port Security Commands Table 4-31. 802.1X Port Authentication Commands Table 4-32. ACL Information Table 4-33. IP ACLs Table 4-34. Priority Queue Mapping Table 4-35. MAC ACLs Table 4-36.
Page 19: Table
Table 4-67. Quality of Service Commands Table 4-68. Multicast Filtering Commands Table 4-69. IGMP Snooping Commands Table 4-70. IGMP Query Commands (Layer 2) Table 4-71. Static Multicast Routing Commands Table 4-72. IP Configuration Table B-1. Troubleshooting Chart 4-210 4-218 4-218 4-222 4-225 4-227...
Page 20: Table
Tables...
Page 21 Figures Figure 3-1. Home Page Figure 3-3. Ports Panel Figure 3-5. System Information Figure 3-6. Switch Information Figure 3-7. Bridge Exentsion Configuration Figure 3-8. IP Configuration Figure 3-9. Selecting DHCP Mode Figure 3-10. Enabling Jumbo Frame Support Figure 3-11. Transfering an Operation Code Image File from a Server Figure 3-12.
Page 22: Table
Figures Figure 3-36. ACL Mask Configuration Figure 3-37. ACL IP Mask Configuration Figure 3-38. ACL MAC Mask Configuration Figure 3-39. ACL Port Binding Figure 3-12. Filtering IP Addresses Figure 3-40. Port Information Figure 3-41. Port Configuration Figure 3-42. Trunk Membership Figure 3-43.
Page 23 Figure 3-84. Port Priority Configuration Figure 3-87. Traffic Classes Figure 3-88. Selecting the Queue Mode Figure 3-89. Queue Scheduling Figure 3-90. IP Precedence/DSCP Priority Status Figure 3-92. Assigning CoS Values to IP Precedence Figure 3-94. Mapping IP DSCP Priority Figure 3-13. Globally Enabling the IP Port Priority Status Figure 3-14.
Page 24 Figures xxiv...
Page 25: Chapter 1: Introduction
Chapter 1: Introduction This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch.
Page 26: Description Of Software Features
Introduction Feature Description AMAP Configures Alcatel Mapping Adjacency Protocol (AMAP) parameters and displays information on attached AMAP-aware devices Description of Software Features The switch provides a wide range of advanced performance enhancing features. Flow control eliminates the loss of packets due to bottlenecks caused by port saturation.
Page 27 Description of Software Features Rate Limiting – This feature controls the maximum rate for traffic transmitted or received on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic into or out of the network. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped.
Page 28 Introduction older IEEE 802.1D STP standard. It is intended as a complete replacement for STP, but can still interoperate with switches running the older standard by automatically reconfiguring ports to STP-compliant mode if they detect STP protocol messages from attached devices. Multiple Spanning Tree Protocol (MSTP, IEEE 802.1s) –...
Page 29: System Defaults
Multicast Filtering – Specific multicast traffic can be assigned to its own VLAN to ensure that it does not interfere with normal network traffic and to guarantee real-time delivery by setting the required priority level for the designated VLAN. The switch uses IGMP Snooping and Query to manage multicast group registration.
Page 30 Introduction Function Parameter SNMP Community Strings Traps IP Filtering Port Configuration Admin Status Auto-negotiation Flow Control Port Capability AMAP Status Common Phase Timeout Interval Discovery Phase Timeout Interval Rate Limiting Input and output limits Port Trunking Static Trunks LACP (all ports) Broadcast Storm Status Protection...
Page 31 Function Parameter Virtual LANs Default VLAN PVID Acceptable Frame Type Ingress Filtering Switchport Mode (Egress Mode) GVRP (global) GVRP (port interface) Traffic Prioritization Ingress Port Priority Weighted Round Robin IP Precedence Priority IP DSCP Priority IP Settings IP Address Subnet Mask Default Gateway DHCP BOOTP...
Page 32 Introduction...
Page 33: Chapter 2: Initial Configuration
Chapter 2: Initial Configuration Connecting to the Switch Configuration Options The switch includes a built-in network management agent. The agent offers a variety of management options, including SNMP, RMON and a Web-based interface. A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI).
Page 34: Required Connections
Initial Configuration • Set broadcast storm control on any port • Display system information and statistics Required Connections The switch provides an RS-232 serial port that enables a connection to a PC or terminal for monitoring and configuring the switch. A null-modem console cable is provided with the switch.
Page 35: Remote Connections
Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you must first configure it with a valid IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol. The IP address for this switch is unassigned by default. To manually configure this address or enable dynamic address assignment via DHCP or BOOTP, see “Setting an IP Address”...
Page 36: Setting Passwords
Initial Configuration Setting Passwords Note: If this is your first time to log into the CLI program, you should define new passwords for both default user names using the “username” command, record them and put them in a safe place. Passwords can consist of up to 8 alphanumeric characters and are case sensitive.
Page 37: Dynamic Configuration
Before you can assign an IP address to the switch, you must obtain the following information from your network administrator: • IP address for the switch • Default gateway for the network • Network mask for this network To assign an IP address to the switch, complete the following steps: From the Privileged Exec level global configuration mode prompt, type “interface vlan 1”...
Page 38: Enabling Snmp Management Access
Initial Configuration Wait a few minutes, and then check the IP configuration settings by typing the “show ip interface” command. Press <Enter>. Then save your configuration changes by typing “copy running-config startup-config.” Enter the startup file name and press <Enter>. Console(config)#interface vlan 1 Console(config-if)#ip address dhcp Console(config-if)#end...
Page 39: Trap Receivers
To configure a community string, complete the following steps: From the Privileged Exec level global configuration mode prompt, type “snmp-server community string mode,” where “string” is the community access string and “mode” is rw (read/write) or ro (read only). Press <Enter>. (Note that the default mode is read only.) To remove an existing string, simply type “no snmp-server community string,”...
Page 40: Managing System Files
Initial Configuration Enter the name of the start-up file. Press <Enter>. Console#copy running-config startup-config Startup configuration file name []: startup \Write to FLASH Programming. \Write to FLASH finish. Success. Console# Managing System Files The switch’s flash memory supports three types of system files that can be managed by the CLI program, Web interface, or SNMP.
Page 41: Chapter 3: Configuring The Switch
Chapter 3: Configuring the Switch Using the Web Interface This switch provides an embedded HTTP Web agent. Using a Web browser you can configure the switch and view statistics to monitor network activity. The Web agent can be accessed by any computer on the network using a standard Web browser (Internet Explorer 5.0 or above, or Netscape Navigator 6.2 or above).
Page 42: Navigating The Web Browser Interface
Configuring the Switch Navigating the Web Browser Interface To access the web-browser interface you must first enter a user name and password. The administrator has Read/Write access to all configuration parameters and statistics. The default user name and password for the administrator is “admin.” Home Page When your web browser connects with the switch’s web agent, the home page is displayed as shown below.
Page 43: Panel Display
Table 3-2. Configuration Options Button Revert Refresh Apply Apply Changes Notes: 1. To ensure proper screen refresh, be sure that Internet Explorer 5.x is configured as follows: Under the menu “Tools / Internet Options / General / Temporary Internet Files / Settings,” the setting for item “Check for newer versions of stored pages”...
Page 44 Configuring the Switch Menu Jumbo Frame File Firmware Configuration Line Console Telnet Logs System Logs Remote Logs SMTP Reset SNTP Configuration Clock Time Zone SNMP Configuration Agent Status SNMPv3 Engine ID Users Groups Views Security Passwords Authentication Settings HTTPS Settings Settings Host-Key Settings Table 3-4.
Page 45 Menu Port Security 802.1x Information Configuration Port Configuration Statistics Configuration Mask Configuration Port Binding IP Filtering Port Port Information Trunk Information Port Configuration Trunk Configuration Trunk Membership LACP Configuration Aggregation Port Port Counters Information Port Internal Information Port Neighbors Information Displays settings and operational state for remote side Port Broadcast Control Trunk Broadcast Control Mirror Port Configuration...
Page 46 Configuring the Switch Menu Port Statistics Alcatel AMAP Settings Information Address Table Static Addresses Dynamic Addresses Address Aging Spanning Tree Information Configuration Port Information Trunk Information Port Configuration Trunk Configuration MSTP VLAN Configuration Port Information Trunk Information Port Configuration Trunk Configuration VLAN 802.1Q VLAN GVRP Status...
Page 47 Menu Port Configuration Trunk Configuration Private VLAN Status Link Status Protocol VLAN Configuration Port Configuration Priority Default Port Priority Default Trunk Priority Traffic Classes Traffic Classes Status Queue Mode Queue Scheduling IP Precedence/ DSCP Priority Status IP Precedence Priority IP DSCP Priority IP Port Priority Status IP Port Priority ACL CoS Priority...
Page 48: Basic Configuration
Configuring the Switch Menu IGMP Snooping IGMP Configuration Multicast Router Port Information Static Multicast Router Port Configuration IP Multicast Registration Table IGMP Member Port Table General Configuration Static Host Table Cache Basic Configuration Displaying System Information You can easily identify the system by displaying the device name, location and contact information.
Page 49: Figure 3-5. System Information
Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that allows access to the Command Line Interface via Telnet.) Figure 3-5. System Information CLI –...
Page 50: Displaying Switch Hardware/Software Versions
Configuring the Switch Displaying Switch Hardware/Software Versions Use the Switch Information page to display hardware/firmware version numbers for the main board and management software, as well as the power status of the system. Field Attributes Main Board • Serial Number – The serial number of the switch. •...
Page 51: Displaying Bridge Extension Capabilities
CLI – Use the following command to display version information. Console#show version Unit1 Serial number Hardware version Number of ports Main power status Redundant power status :not present Agent(Primary) Unit id Loader version Boot rom version Operation code version :10.31.23.17 Console# Displaying Bridge Extension Capabilities The Bridge MIB includes extensions for managed devices that support Multicast...
Page 52: Setting The Switch's Ip Address
Configuring the Switch Web – Click System, Bridge Extension. Figure 3-7. Bridge Exentsion Configuration CLI – Enter the following command. Console#show bridge-ext Max support vlan numbers: 255 Max support vlan ID: 4094 Extended multicast filtering services: No Static entry individual port: Yes VLAN learning: IVL Configurable PVID tagging: Yes Local VLAN capable: Yes...
Page 53: Manual Configuration
• IP Address Mode – Specifies whether IP functionality is enabled via manual configuration (Static), Dynamic Host Configuration Protocol (DHCP), or Boot Protocol (BOOTP). If DHCP/BOOTP is enabled, IP will not function until a reply has been received from the server. Requests will be broadcast periodically by the switch for an IP address.
Page 54: Using Dhcp/Bootp
Configuring the Switch Using DHCP/BOOTP If your network provides DHCP/BOOTP services, you can configure the switch to be dynamically configured by these services. Web – Click System, IP Configuration. Specify the VLAN to which the management station is attached, set the IP Address Mode to DHCP or BOOTP. Click Apply to save your changes.
Page 55: Enabling Jumbo Frames
CLI – Enter the following command to restart DHCP service. Console#ip dhcp restart client Console# Enabling Jumbo Frames The switch provides more efficient throughput for large sequential data transfers by supporting jumbo frames up to 9000 bytes. Compared to standard Ethernet frames that run only up to 1.5 KB, using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields.
Page 56: Downloading System Software From A Server
Configuring the Switch • File Name – The file name should not contain slashes (\ or /), the leading letter of the file name should not be a period (.), and the maximum length for file names on the TFTP server is 127 characters or 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”) •...
Page 57: Saving Or Restoring Configuration Settings
CLI – Enter the IP address of the TFTP server, select “config” or “opcode” file type, then enter the source and destination file names, set the new file to start up the system, and then restart the switch. Console#copy tftp file TFTP server ip address: 10.1.0.19 Choose file type: 1.
Page 58: Console Port Settings
Configuring the Switch If you download to a new file name, then select the new file from the drop-down box for Startup Configuration File, and press Apply Changes. To use the new settings, reboot the system via the System/Reset menu. Figure 3-14.
Page 59 • Password Threshold – Sets the password intrusion threshold, which limits the number of failed logon attempts. When the logon attempt threshold is reached, the system interface becomes silent for a specified amount of time (set by the Silent Time parameter) before allowing the next logon attempt. (Range: 0-120; Default: 3 attempts) •...
Page 60: Figure 3-1. Console Port Settings
Configuring the Switch Web – Click System, Line, Console. Specify the console port connection parameters as required, then click Apply. Figure 3-1. Console Port Settings CLI – Enter Line Configuration mode for the console, then specify the connection parameters as required. To display the current console port settings, use the show line command from the Normal Exec level.
Page 61: Telnet Settings
Telnet Settings You can access the onboard configuration program over the network using Telnet (i.e., a virtual terminal). Management access via Telnet can be enabled/disabled and other various parameters set, including the TCP port number, timeouts, and a password. These parameters can be configured via the Web or CLI interface. Command Attributes •...
Page 62: Figure 3-2. Telnet Settings
Configuring the Switch Web – Click System, Line, Telnet. Specify the connection parameters for Telnet access, then click Apply. CLI – Enter Line Configuration mode for a virtual terminal, then specify the connection parameters as required. To display the current virtual terminal settings, use the show line command from the Normal Exec level.
Page 63: Configuring Event Logging
Configuring Event Logging The switch allows you to control the logging of error messages, including the type of events that are recorded in switch memory, logging to a remote System Log (syslog) server, and displays a list of recent event messages. System Logs The system can be configured to send debug and error messages to a logging process.
Page 64: System Logs Configuration
Configuring the Switch Web – Click System, Log, Logs. Figure 3-3. Logging Information CLI – Type "show logging ram" to display log messages in the RAM buffer. Console#show logging ram Syslog logging: Enable History logging in RAM: level debugging [3] 0:0:58 1/1/1 "VLAN 1 link-up notification."...
Page 65: Remote Logs Configuration
• RAM Level – Limits log messages saved to the switch’s temporary RAM memory for all levels up to the specified level. For example, if level 7 is specified, all messages from level 0 to level 7 will be logged to RAM. (Default: 6) Web –...
Page 66: Figure 3-5. Enabling Remote Logging And Adding Host Ip Addresses
Configuring the Switch • Host IP List – Displays the list of remote server IP addresses that receive the syslog messages. The maximum number of host IP addresses allowed is five. • Host IP Address – Specifies a new server IP address to add to the Host IP List. Web –...
Page 67: Sending Simple Mail Transfer Protocol Alerts
Sending Simple Mail Transfer Protocol Alerts To alert system administrators of problems, the switch can use SMTP (Simple Mail Transfer Protocol) to send email messages when triggered by logging events of a specified level. The messages are sent to specified SMTP servers on the network and can be retrieved using POP or IMAP clients.
Page 68: Figure 3-6. Enabling And Configuring Smtp Alerts
Configuring the Switch Web – Click System, Log, SMTP. Enable SMTP, specify a source email address, and select the minimum severity level. To add an IP address to the SMTP Server List, type the new IP address in the SMTP Server text box and then click Add. To delete an IP address, click the entry in the SMTP Server List and then click Remove.
Page 69: Resetting The System
to complete the configuration. Use the show logging sendmail command to display the current SMTP configuration. Console(config)#logging sendmail host 192.168.1.4 Console(config)#logging sendmail level 3 Console(config)#logging sendmail source-email Matrix-V-Series@this-company.com Console(config)#logging sendmail destination-email chris@this-company.com Console(config)#logging sendmail Console(config)#exit Console#show logging sendmail SMTP servers ----------------------------------------------- Active SMTP server: 0.0.0.0 SMTP minimum severity level: 4...
Page 70: Configuring Sntp
Configuring the Switch This switch acts as an SNTP client in unicast mode: Unicast – The switch periodically sends a request for a time update to a configured time server. You can configure up to three time server IP addresses. The switch will attempt to poll each server in the configured sequence.
Page 71: Setting The Time Zone
Setting the Time Zone SNTP uses Coordinated Universal Time (or UTC, formerly Greenwich Mean Time, or GMT) based on the time at the Earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC.
Page 72 Configuring the Switch standard presentation of the information controlled by the agent. SNMP defines both the format of the MIB specifications and the protocol used to access this information over the network. The switch includes an onboard agent that supports SNMP versions 1, 2c, and 3. This agent continuously monitors the status of the switch hardware, as well as the traffic passing through its ports.
Page 73: Enabling Snmp
Enabling SNMP Enables the SNMP agent on the switch for all versions (1, 2c, and 3). Command Attributes • SNMP Agent Status – Enables SNMP on the switch. Figure 3-7. Enabling the SNMP Agent CLI – The following example enalbes SNMP on the switch. Console(config)#snmp-server Console(config)# Setting Community Access Strings...
Page 74: Specifying Trap Managers And Trap Types
Configuring the Switch Web – Click SNMP, Configuration. Add new community strings as required, select the access rights from the Access Mode drop-down list, then click Add. Figure 3-18. SNMP Configuration CLI – The following example adds the string “spiderman” with read/write access. Console(config)#snmp-server community spiderman rw Console(config)# Specifying Trap Managers and Trap Types...
Page 75: Configuring Snmpv3 Management Access
Web – Click SNMP, Configuration. Enter the IP address and community string for each managment station that will receive trap messages, specify the UDP port and SNMP version, and then click Add. Select the trap types required using the check boxes for Authentication and Link-up/down traps, and then click Apply.
Page 76: Configuring Snmpv3 Users
Configuring the Switch A local engine ID is automatically generated that is unique to the switch. This is referred to as the default engine ID. If the local engine ID is deleted or changed, all SNMP users will be cleared. You will need to reconfigure all existing users. A new engine ID can be specified by entering 1 to 26 hexadecimal characters.
Page 77: Figure 3-9. Configuring Snmpv3 Users
• Level – The security level used for the user: - noAuthNoPriv – There is no authentication or encryption used in SNMP communications. - AuthNoPriv – SNMP communications use authentication, but the data is not encrypted (only available for the SNMPv3 security model). - AuthPriv –...
Page 78: Configuring Snmpv3 Groups
Configuring the Switch CLI – Use the snmp-server user command to configure a new user name and assign it to a group. Console(config)#snmp-server user chris group r&d v3 auth md5 greenpeace priv des56 einstien Console(config)#exit Console#show snmp user EngineId: 80000034030001f488f5200000 User Name: chris Authentication Protocol: md5 Privacy Protocol: des56...
Page 79: Figure 3-10. Configuring Snmpv3 Groups
Web – Click SNMP, SNMPv3, Groups. Click New to configure a new group. In the New Group page, define a name, assign a security model and level, and then select read and write views. Click Add to save the new group and return to the Groups list. To delete a group, check the box next to the group name, then click Delete.
Page 80: Setting Snmpv3 Views
Configuring the Switch Setting SNMPv3 Views SNMPv3 views are used to restrict user access to specified portions of the MIB tree. The predefined view “defaultview” includes access to the entire MIB tree. Command Attributes • View Name – The name of the SNMP view. (Range: 1-64 characters) •...
Page 81: User Authentication
CLI – Use the snmp-server view command to configure a new view. This example view includes the MIB-2 interfaces table, and the wildcard mask selects all index entries. Console(config)#snmp-server view ifEntry.a 1.3.6.1.2.1.2.2.1.1.* included Console(config)#exit Console#show snmp view View Name: ifEntry.a Subtree OID: 1.3.6.1.2.1.2.2.1.1.* View Type: included Storage Type: nonvolatile...
Page 82: Configuring Local/Remote Logon Authentication
Configuring the Switch Command Attributes • User Name* – The name of the user. (Maximum length: 8 characters) • Access Level* – Specifies the user level. (Options: Normal and Privileged) • Password – Specifies the user password. (Range: 0-8 characters plain text, case sensitive) * CLI only.
Page 83 a database of multiple user name/password pairs with associated privilege levels for each user that requires management access to the switch. RADIUS uses UDP while TACACS+ uses TCP. UDP only offers best effort delivery, while TCP offers a connection-oriented transport. Also, note that RADIUS encrypts only the password in the access-request packet from the client to the server, while TACACS+ encrypts the entire body of the packet.
Page 84: Figure 3-21. Authentication Settings
Configuring the Switch • TACACS Settings - Server IP Address – Address of the TACACS+ server. (Default: 10.11.12.13) - Server Port Number – Network (TCP) port of TACACS+ server used for authentication messages. (Range: 1-65535; Default: 49) - Secret Text String – Encryption key used to authenticate logon access for client.
Page 85: Configuring Https
CLI – Specify all the required parameters to enable logon authentication. Console(config)#authentication login radius Console(config)#radius-server host 192.168.1.25 Console(config)#radius-server port 181 Console(config)#radius-server key green Console(config)#radius-server retransmit 5 Console(config)#radius-server timeout 10 Console#show radius-server Server IP address: 192.168.1.25 Communication key with radius server: Server port number: 181 Retransmit times: 5 Request timeout: 10...
Page 86: Replacing The Default Secure-Site Certificate
Configuring the Switch • To specify a secure-site certificate, see “Replacing the Default Secure-site Certificate” on page 3-46. Command Attributes • HTTPS Status – Allows you to enable/disable the HTTPS server feature on the switch. (Default: Enabled) • Change HTTPS Port Number – Specifies the UDP port number used for HTTPS/ SSL connection to the switch’s web interface.
Page 87: Configuring The Secure Shell
When you have obtained these, place them on your TFTP server, and use the following command at the switch's command-line interface to replace the default (unrecognized) certificate with an authorized one: Console#copy tftp https-certificate TFTP server ip address: <server ip-address> Source certificate file name: <certificate file name>...
Page 88 Configuring the Switch Otherwise, you need to manually create a known hosts file on the management station and place the host public key in it. An entry for a public key in the known hosts file would appear similar to the following example: 10.1.0.54 1024 35 15684995401867669259333946775054617325313674890836547254 15020245593199868544358361651999923329781766065830956 10825913212890233 76546801726272571413428762941301196195566782 59566410486957427888146206...
Page 89: Generating The Host Key Pair
The SSH server supports up to four client sessions. The maximum number of client sessions includes both current Telnet sessions and SSH sessions. Generating the Host Key Pair A host public/private key pair is used to provide secure communications between an SSH client and the switch.
Page 90: Figure 3-24. Secure Shell Host-Key Settings
Configuring the Switch Web – Click Security, SSH Host-Key Settings. Select the host-key type from the drop-down box, select the option to save the host key from memory to flash (if required) prior to generating the key, and then click Generate. Figure 3-24.
Page 91: Configuring The Ssh Server
Configuring the SSH Server The SSH server includes basic settings for authentication. Field Attributes • SSH Server Status – Allows you to enable/disable the SSH server on the switch. (Default: Enabled) • Version – The Secure Shell version number. Version 2.0 is displayed, but the switch supports management access via either SSH Version 1.5 or 2.0 clients.
Page 92: Configuring Port Security
Configuring the Switch CLI – This example enables SSH, sets the authentication parameters, and displays the current configuration. It shows that the administrator has made a connection via SHH, and then disables this connection. Console(config)#ip ssh server Console(config)#ip ssh timeout 100 Console(config)#ip ssh authentication-retries 5 Console(config)#ip ssh server-key size 512 Console(config)#end...
Page 93: Figure 3-26. Configuring Port Security
Command Attributes • Port – Port number. • Name – Descriptive text (page 4-131). • Action – Indicates the action to be taken when a port security violation is detected: - None: No action should be taken. (This is the default.) - Trap: Send an SNMP trap message.
Page 94: Configuring 802.1X Port Authentication
Configuring the Switch Configuring 802.1x Port Authentication Network switches can provide open and easy access to network resources by simply attaching a client PC. Although this automatic configuration and access is a desirable feature, it also allows unauthorized personnel to easily intrude and possibly gain access to sensitive network data.
Page 95: Displaying 802.1X Global Settings
• The RADIUS server and client also have to support the same EAP authentication type – MD5. (Some clients have native support in Windows, otherwise the dot1x client must support it.) Displaying 802.1x Global Settings The dot1x protocol includes global parameters that control the client authentication process that runs between the client and the switch (i.e., authenticator), as well as the client identity lookup process that runs between the switch and authentication server.
Page 96 Configuring the Switch CLI – This example shows the default protocol settings for 802.1x. For a description of the additional entries displayed in the CLI, See “show dot1x” on page 4-81. Console#show dot1x Global 802.1X Parameters reauth-enabled: yes reauth-period: quiet-period: tx-period: supp-timeout: server-timeout: 30...
Page 97: Configuring 802.1X Global Settings
Configuring 802.1x Global Settings The dot1x protocol includes global parameters that control the client authentication process that runs between the client and the switch (i.e., authenticator), as well as the client identity lookup process that runs between the switch and authentication server.
Page 98: Configuring Port Authorization Mode
Configuring the Switch CLI – This enables re-authentication and sets all of the global parameters for 802.1x. Console(config)#dot1x re-authentication Console(config)#dot1x max-req 5 Console(config)#dot1x timeout quiet-period 40 Console(config)#dot1x timeout re-auth 5 Console(config)#dot1x timeout tx-period 40 Console(config)#authentication dot1x default radius Console(config)# Configuring Port Authorization Mode When dot1x is enabled, you need to specify the dot1x authentication mode configured for each port.
Page 99: Displaying 802.1X Statistics
Web – Click Security, 802.1x, Port Configuration. Select the authentication mode from the drop-down box and click Apply. Figure 3-29. 802.1X Port Configuration CLI – This example sets the authentication mode to enable 802.1x on port 2, and allows up to ten clients to connect to this port. Console(config)#interface ethernet 1/2 Console(config-if)#dot1x port-control auto Console(config-if)#dot1x operation-mode multi-host max-count 10...
Page 100: Figure 3-31. 802.1X Statistics
Configuring the Switch Parameter Rx Last EAPOLSrc Tx EAPOL Total Tx EAP Req/Id Tx EAP Req/Oth Web – Select Security, 802.1x, Statistics. Select the required port and then click Query. Click Refresh to update the statistics. Figure 3-31. 802.1X Statistics CLI –...
Page 101: Access Control Lists
Access Control Lists Access Control Lists (ACL) provide packet filtering for IP frames (based on address, protocol, Layer 4 protocol port number or TCP control code) or any frames (based on MAC address or Ethernet type). To filter incoming packets, first create an access list, add the required rules, specify a mask to modify the precedence in which the rules are checked, and then bind the list to a specific port.
Page 102: Setting The Acl Name And Type
Configuring the Switch Setting the ACL Name and Type Use the ACL Configuration page to designate the name and type of an ACL. Command Attributes • Name – Name of the ACL. (Maximum length: 16 characters) • Type – There are three filtering modes: - Standard: IP ACL mode that filters packets based on the source IP address.
Page 103: Configuring An Extended Ip Acl
• SubMask – A subnet mask containing four integers from 0 to 255, each separated by a period. The mask uses 1 bits to indicate “match” and 0 bits to indicate “ignore.” The mask is bitwise ANDed with the specified source IP address, and compared with the address for each IP packet entering the port(s) to which this ACL has been assigned.
Page 104 Configuring the Switch • Service Type – Packet priority settings based on the following criteria: - Precedence – IP precedence level. (Range: 0-7) - TOS – Type of Service level. (Range: 0-15) - DSCP – DSCP priority level. (Range: 0-64) •...
Page 105: Figure 3-34. Configuring An Extended Acl
Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range.
Page 106: Configuring A Mac Acl
Configuring the Switch Configuring a MAC ACL Command Attributes • Action – An ACL can contain all permit rules or all deny rules. (Default: Permit rules) • Source/Destination MAC – Use “Any” to include all possible addresses, “Host” to indicate a specific MAC address, or “MAC” to specify an address range with the Address and Bitmask fields.
Page 107: Figure 3-35. Configuring A Mac Acl
Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or MAC). If you select “Host,” enter a specific address (e.g., 11-22-33-44-55-66). If you select “MAC,” enter a base address and a hexidecimal bitmask for an address range. Set any other required criteria, such as VID, Ethernet type, or packet format.
Page 108: Configuring Acl Masks
Configuring the Switch Configuring ACL Masks You must specify masks that control the order in which ACL rules are checked. The switch includes two system default masks that pass/filter packets matching the permit/deny rules specified in an ingress ACL. You can also configure up to seven user-defined masks for an ingress or egress ACL.
Page 109: Configuring An Ip Acl Mask
Configuring an IP ACL Mask This mask defines the fields to check in the IP header. Command Usage • Masks that include an entry for a Layer 4 protocol source port or destination port can only be applied to packets with a header length of exactly five bytes. Command Attributes •...
Page 110: Figure 3-37. Acl Ip Mask Configuration
Configuring the Switch Web – Configure the mask to match the required rules in the IP ingress or egress ACLs. Set the mask to check for any source or destination address, a specific host address, or an address range. Include other criteria to search for in the rules, such as a protocol type or one of the service types.
Page 111: Configuring A Mac Acl Mask
Configuring a MAC ACL Mask This mask defines the fields to check in the packet header. Command Usage You must configure a mask for an ACL rule before you can bind it to a port. Command Attributes • Source/Destination MAC – Use “Any” to match any address, “Host” to specify the host address for a single node, or “MAC”...
Page 112: Binding A Port To An Access Control List
Configuring the Switch CLI – This example shows how to create an Ingress MAC ACL and bind it to a port. You can then see that the order of the rules have been changed by the mask. Console(config)#access-list mac M4 Console(config-mac-acl)#permit any any Console(config-mac-acl)#deny tagged-eth2 00-11-11-11-11-11 ff-ff-ff-ff-ff-ff any vid 3...
Page 113: Filtering Ip Addresses For Management Access
Web – Click Security, ACL, Port Binding. Mark the Enable field for the port you want to bind to an ACL for ingress or egress traffic, select the required ACL from the drop-down list, then click Apply. Figure 3-39. ACL Port Binding CLI –...
Page 114: Figure 3-12. Filtering Ip Addresses
Configuring the Switch • When entering addresses for the same group (i.e., SNMP, web or Telnet), the switch will not accept overlapping address ranges. When entering addresses for different groups, the switch will accept overlapping address ranges. • You cannot delete an individual address from a specified range. You must delete the entire range, and reenter the addresses.
Page 115: Port Configuration
Port Configuration Displaying Connection Status You can use the Port Information or Trunk Information pages to display the current connection status, including link state, speed/duplex mode, flow control, and auto-negotiation. Field Attributes (Web) • Name – Interface label. • Type – Indicates the port type. (1000BASE-T, 1000BASE-SX, 1000BASE-LX or 100BASE-FX) •...
Page 116 Configuring the Switch Field Attributes (CLI) Basic information: • Port type – Indicates the port type. (1000BASE-T, 1000BASE-SX, 1000BASE-LX or 100BASE-FX) • MAC address – The physical layer address for this port. (To access this item on the web, see “Setting the Switch’s IP Address” on page 3-12.) Configuration: •...
Page 117: Configuring Interface Connections
CLI – This example shows the connection status for Port 5. Console#show interfaces status ethernet 1/5 Information of Eth 1/13 Basic information: Port type: 1000T Mac address: 00-30-f1-47-58-46 Configuration: Name: Port admin: Up Speed-duplex: Auto Capabilities: 10half, 10full, 100half, 100full, 1000full, Broadcast storm: Enabled Broadcast storm limit: 500 packets/second Flow control: Disabled...
Page 118: Figure 3-41. Port Configuration
Configuring the Switch (The current switch chip only supports symmetric pause frames.) - FC - Supports flow control Flow control can eliminate frame loss by “blocking” traffic from end stations or segments connected directly to the switch when its buffers fill. When enabled, back pressure is used for half-duplex operation and IEEE 802.3x for full-duplex operation.
Page 119: Creating Trunk Groups
CLI – Select the interface, and then enter the required settings. Console(config)#interface ethernet 1/13 Console(config-if)#description RD SW#13 Console(config-if)#shutdown Console(config-if)#no shutdown Console(config-if)#no negotiation Console(config-if)#speed-duplex 100half Console(config-if)#flowcontrol Console(config-if)#negotiation Console(config-if)#capabilities 100half Console(config-if)#capabilities 100full Console(config-if)#capabilities flowcontrol Console(config-if)#exit Console(config)#interface ethernet 1/21 Console(config-if)#combo-forced-mode copper-forced Console(config-if)# Creating Trunk Groups You can create multiple links between devices that work as one virtual, aggregate link.
Page 120: Statically Configuring A Trunk
Configuring the Switch • The ports at both ends of a trunk must be configured in an identical manner, including communication mode (i.e., speed, duplex mode and flow control), VLAN assignments, and CoS settings. • All the ports in a trunk have to be treated as a whole when moved from/to, added or deleted from a VLAN.
Page 121: Enabling Lacp On Selected Ports
CLI – This example creates trunk 2 with ports 1 and 2. Just connect these ports to two static trunk ports on another switch to form a trunk. Console(config)#interface port-channel 2 Console(config-if)#exit Console(config)#interface ethernet 1/1 Console(config-if)#channel-group 1 Console(config-if)#exit Console(config)#interface ethernet 1/2 Console(config-if)#channel-group 1 Console(config-if)#end Console#show interfaces status port-channel 1...
Page 122: Figure 3-43. Lacp Configuration
Configuring the Switch Web – Click Port, LACP, Configuration. Select any of the switch ports from the scroll-down port list and click Add. After you have completed adding ports to the member list, click Apply. Figure 3-43. LACP Configuration CLI – The following example enables LACP for ports 1 to 6. Just connect these ports to LACP-enabled trunk ports on another switch to form a trunk.
Page 123: Configuring Lacp Parameters
Configuring LACP Parameters Dynamically Creating a Port Channel – Ports assigned to a common port channel must meet the following criteria: • Ports must have the same LACP System Priority. • Ports must have the same LACP port Admin Key. •...
Page 124 Configuring the Switch Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and Port Priority for the Port Actor. You can optionally configure these settings for the Port Partner. (Be aware that these settings only affect the administrative state of the partner, and will not take effect until the next time an aggregate link is formed with this device.) After you have completed setting the port LACP parameters, click Apply.
Page 125: Displaying Lacp Port Counters
CLI – The following example configures LACP parameters for ports 1-6. Ports 1-4 are used as active members of the LAG; ports 5 and 6 are set to backup mode. Console(config)#interface ethernet 1/1 Console(config-if)#lacp actor system-priority 3 Console(config-if)#lacp actor admin-key 120 Console(config-if)#lacp actor port-priority 128 Console(config-if)#exit Console(config)#interface ethernet 1/6...
Page 126: Displaying Lacp Settings And Status For The Local Side
Configuring the Switch Web – Click Port, LACP, Port Counters Information. Select a member port to display the corresponding information. Figure 3-46. LACP Port Counters Information CLI – The following example displays LACP counters for port channel 1. Console#show 1 lacp counters Channel group : 1 ------------------------------------------------------------------------- Eth 1/ 1...
Page 127: Figure 3-48. Lacp Settings - Local Side
Table 3-47. LACP Settings - Local Side Field Description LACP Port Priority LACP port priority assigned to this interface within the channel group. Admin State, Administrative or operational values of the actor’s state parameters: Oper State • Expired – The actor’s receive machine is in the expired state; •...
Page 128: Displaying Lacp Settings And Status For The Remote Side
Configuring the Switch CLI – The following example displays the LACP configuration settings and operational state for the local side of port channel 1. Console#show 1 lacp internal Channel group : 1 ------------------------------------------------------------------------- Oper Key : 4 Admin Key : 0 Eth 1/1 ------------------------------------------------------------------------- LACPDUs Internal : 30 sec...
Page 129: Figure 3-50. Lacp Port Settings - Remote Side
Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-50. LACP Port Settings - Remote Side CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1. Console#show 1 lacp neighbors Channel group 1 neighbors -------------------------------------------------------------------------...
Page 130: Setting Broadcast Storm Thresholds
Configuring the Switch Setting Broadcast Storm Thresholds Broadcast storms may occur when a device on your network is malfunctioning, or if application programs are not well designed or properly configured. If there is too much broadcast traffic on your network, performance can be severely degraded or everything can come to complete halt.
Page 131: Configuring Port Mirroring
CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 600 packets per second for port 2. Console(config)#interface ethernet 1/1 Console(config-if)#no switchport broadcast Console(config-if)#exit Console(config)#interface ethernet 1/2 Console(config-if)#switchport broadcast packet-rate 600 Console(config-if)#end Console#show interfaces switchport ethernet 1/2...
Page 132: Configuring Rate Limits
Configuring the Switch Web – Click Port, Mirror. Specify the source port, the traffic type to be mirrored, and the monitor port, then click Add. Figure 3-52. Mirror Port Configuration CLI – Use the interface command to select the monitor port, then use the port monitor command to specify the source port.
Page 133: Showing Port Statistics
Web - Click Rate Limit, Input/Output Port/Trunk Configuration. Set the Input Rate Limit Status or Output Rate Limit Status, then set the rate limit for the individual interfaces, and click Apply. Figure 3-53. Output Rate Limit Port Configuration CLI - This example sets the rate limit for input and output traffic passing through port 1 to 600 Mbps.
Page 134 Configuring the Switch Statistical Values Parameter Interface Statistics Received Octets Received Unicast Packets Received Multicast Packets Received Broadcast Packets Received Discarded Packets Received Unknown Packets Received Errors Transmit Octets Transmit Unicast Packets Transmit Multicast Packets Transmit Broadcast Packets Transmit Discarded Packets Transmit Errors Etherlike Statistics Alignment Errors...
Page 135 Table 3-54. Displaying Port Statistics Parameter Excessive Collisions Single Collision Frames Internal MAC Transmit Errors Multiple Collision Frames Carrier Sense Errors SQE Test Errors Frames Too Long Deferred Transmissions Internal MAC Receive Errors RMON Statistics Drop Events Jabbers Received Bytes Collisions Received Frames Broadcast Frames...
Page 136 Configuring the Switch Parameter Fragments 64 Bytes Frames 65-127 Byte Frames 128-255 Byte Frames 256-511 Byte Frames 512-1023 Byte Frames 1024-1518 Byte Frames 1519-1536 Byte Frames Web – Click Port, Port Statistics. Select the required interface, and click Query. You can also use the Refresh button at the bottom of the page to update the screen.
Page 137 Port Configuration Figure 3-55. Displaying Port Statistics 3-97...
Page 138: Alcatel Mapping Adjacency Protocol (Amap)
Configuring the Switch CLI – This example shows statistics for port 13. Console#show interfaces counters ethernet 1/13 Ethernet 1/13 Iftable stats: Octets input: 868453, Octets output: 3492122 Unicast input: 7315, Unitcast output: 6658 Discard input: 0, Discard output: 0 Error input: 0, Error output: 0 Unknown protos input: 0, QLen output: 0 Extended iftable stats: Multi-cast input: 0, Multi-cast output: 17027...
Page 139: Displaying Amap Detected Devices
• Common – The port has detected an adjacent switch and periodically sends “Hello” packets to determine that it is still present. • Passive – A port enters this state if there is no response to a Discovery “hello” packet. This is a receive-only state and no “Hello” packets are transmitted. If a “Hello”...
Page 140: Address Table Settings
Configuring the Switch Web – Click Alcatel, AMAP, Information. Figure 3-57. AMAP Information CLI – There is no equvilent CLI command to display detected devices. Address Table Settings Switches store the addresses for all known devices. This information is used to pass traffic directly between the inbound and outbound ports.
Page 141: Displaying The Address Table
Web – Click Address Table, Static Addresses. Specify the interface, the MAC address and VLAN, then click Add Static Address. Figure 3-58. Setting a Static Address Table CLI – This example adds an address to the static address table, but sets it to be deleted when the switch is reset.
Page 142: Changing The Aging Time
Configuring the Switch Web – Click Address Table, Dynamic Addresses. Specify the search type (i.e., mark the Interface, MAC Address, or VLAN checkbox), select the method of sorting the displayed addresses, and then click Query. Figure 3-59. Setting a Dynamic Address Table CLI –...
Page 143: Spanning Tree Algorithm Configuration
Web – Click Address Table, Address Aging. Specify the new aging time, click Apply. CLI – This example sets the aging time to 400 seconds. Console(config)#mac-address-table aging-time 400 Console(config)# Spanning Tree Algorithm Configuration The Spanning Tree Algorithm (STA) can be used to detect and disable network loops, and to provide backup links between switches, bridges or routers.
Page 144: Displaying Global Settings
Configuring the Switch Once a stable network topology has been established, all bridges listen for Hello BPDUs (Bridge Protocol Data Units) transmitted from the Root Bridge. If a bridge does not get a Hello BPDU after a predefined interval (Maximum Age), the bridge assumes that the link to the Root Bridge is down.
Page 145 • Forward Delay – The maximum time (in seconds) the root device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a discarding state;...
Page 146: Figure 3-62. Sta Information
Configuring the Switch • Root Hold Time – The interval (in seconds) during which no more than two bridge configuration protocol data units shall be transmitted by this node. • Max hops – The max number of hop counts for the MST region. •...
Page 147: Configuring Global Settings
Configuring Global Settings Global settings apply to the entire switch. Command Usage • Spanning Tree Protocol Uses RSTP for the internal state machine, but sends only 802.1D BPDUs. This creates one spanning tree instance for the entire network. If multiple VLANs are implemented on a network, the path between specific VLAN members may be inadvertently disabled to prevent network loops, thus isolating group members.
Page 148 Configuring the Switch • Priority – Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device.
Page 149 Configuration Settings for RSTP The following attributes apply to both RSTP and MSTP: • Path Cost Method – The path cost is used to determine the best path between devices. The path cost method is used to determine the range of values that can be assigned to each interface.
Page 150 Configuring the Switch Web – Click Spanning Tree, STA, Configuration. Modify the required attributes, and click Apply. Figure 3-63. STA Configuration 3-110...
Page 151: Displaying Interface Settings
CLI – This example enables Spanning Tree Protocol, sets the mode to MST, and then configures the STA and MSTP parameters. Console(config)#spanning-tree Console(config)#spanning-tree mode mst Console(config)#spanning-tree priority 40000 Console(config)#spanning-tree hello-time 5 Console(config)#spanning-tree max-age 38 Console(config)#spanning-tree forward-time 20 Console(config)#spanning-tree pathcost method long Console(config)#spanning-tree transmission-limit 4 Console(config)#Console(config)#spanning-tree mst-configuration Console(config-mstp)#revision 1...
Page 152 Configuring the Switch • Oper Link Type – The operational point-to-point status of the LAN segment attached to this interface. This parameter is determined by manual configuration or by auto-detection, as described for Admin Link Type in STA Port Configuration on page 3-114.
Page 153 • Internal path cost – The path cost for the MST. See the proceeding item. • Priority – Defines the priority used for this port in the Spanning Tree Algorithm. If the path cost for all ports on a switch is the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree.
Page 154: Configuring Interface Settings
Configuring the Switch CLI – This example shows the STA attributes for port 5. Console#show spanning-tree ethernet 1/5 1/ 5 information -------------------------------------------------------------- Admin status : enable Role : disable State : discarding External path cost : 10000 Internal path cost : 10000 Priority : 128...
Page 155 • Priority – Defines the priority used for this port in the Spanning Tree Protocol. If the path cost for all ports on a switch are the same, the port with the highest priority (i.e., lowest value) will be configured as an active link in the Spanning Tree. This makes a port with higher priority less likely to be blocked if the Spanning Tree Protocol is detecting network loops.
Page 156: Configuring Multiple Spanning Trees
Configuring the Switch Web – Click Spanning Tree, STA, Port Configuration or Trunk Configuration. Modify the required attributes, then click Apply. Figure 3-66. STA Port Configuration CLI – This example sets STA attributes for port 7. Console(config)#interface ethernet 1/7 Console(config-if)#no no spanning-tree spanning-disabled Console(config-if)#spanning-tree port-priority 0 Console(config-if)#spanning-tree cost 50 Console(config-if)#spanning-tree link-type auto...
Page 157 To ensure that the MSTI maintains connectivity across the network, you must configure a related set of bridges with the same MSTI settings. Command Attributes • MST Instance – Instance identifier of this spanning tree. (Default: 0) • Priority – The priority of a spanning tree instance. (Range: 0-61440 in steps of 4096;...
Page 158 Configuring the Switch CLI – This displays STA settings for instance 1, followed by settings for each port. Console#show spanning-tree mst 2 Spanning-tree information --------------------------------------------------------------- Spanning tree mode Spanning tree enable/disable Instance Vlans configuration Priority Bridge Hello Time (sec.) Bridge Max Age (sec.) Bridge Forward Delay (sec.) Root Hello Time (sec.) Root Max Age (sec.)
Page 159: Displaying Interface Settings For Mstp
Spanning Tree Algorithm Configuration Displaying Interface Settings for MSTP The MSTP Port Information and MSTP Trunk Information pages display the current status of ports and trunks in the selected MST instance. Field Attributes • MST Instance ID – Instance identifier to configure. (Range: 0-57; Default: 0) The other attributes are described under “Displaying Interface Settings,”...
Page 160 Configuring the Switch CLI – This displays STA settings for instance 0, followed by settings for each port. The settings for instance 0 are global settings that apply to the IST (page 3-104), the settings for other instances only apply to the local spanning tree. Console#show spanning-tree mst 0 Spanning-tree information ---------------------------------------------------------------...
Page 161: Configuring Interface Settings For Mstp
Configuring Interface Settings for MSTP You can configure the STA interface settings for an MST Instance using the MSTP Port Configuration and MSTP Trunk Configuration pages. Field Attributes The following attributes are read-only and cannot be changed: • STA State – Displays current state of this port within the Spanning Tree. (See Displaying Interface Settings on page 3-111 for additional information.) •...
Page 162: Vlan Configuration
Configuring the Switch Web – Click Spanning Tree, MSTP, Port Configuration or Trunk Configuration. Enter the priority and path cost for an interface, and click Apply. Figure 3-69. MSTP Port Configuration CLI – This example sets the MSTP attributes for port 4. Console(config)#interface ethernet 1/4 Console(config-if)#spanning-tree mst port-priority 0 Console(config-if)#spanning-tree mst cost 50...
Page 163: Assigning Ports To Vlans
VLANs inherently provide a high level of network security since traffic must pass through a configured Layer 3 link to reach a different VLAN. This switch supports the following VLAN features: • Up to 255 VLANs based on the IEEE 802.1Q standard •...
Page 164 Configuring the Switch Port Overlapping – Port overlapping can be used to allow access to commonly shared network resources among different VLAN groups, such as file servers or printers. Untagged VLANs – Untagged (or static) VLANs are typically used to reduce broadcast traffic and to increase security.
Page 165: Forwarding Tagged/Untagged Frames
Note: If you have host devices that do not support GVRP, you should configure static or untagged VLANs for the switch ports connected to these devices (as described in “Adding Static Members to VLANs (VLAN Index)” on page 3-130). But you can still enable GVRP on these edge switches, as well as on the core switches in the network.
Page 166: Displaying Basic Vlan Information
Configuring the Switch Web – Click VLAN, 802.1Q VLAN, GVRP Status. Enable or disable GVRP, and click Apply. CLI – This example enables GVRP for the switch. Console(config)#bridge-ext gvrp Console(config)# Displaying Basic VLAN Information The VLAN Basic Information page displays basic information on the VLAN type supported by the switch.
Page 167: Displaying Current Vlans
CLI – Enter the following command. Console#show bridge-ext Max support vlan numbers: 255 Max support vlan ID: 4094 Extended multicast filtering services: No Static entry individual port: Yes VLAN learning: IVL Configurable PVID tagging: Yes Local VLAN capable: Yes Traffic classes: Enabled Global GVRP status: Disabled GMRP: Disabled Console#...
Page 168: Figure 3-74. Vlan Current Table
Configuring the Switch Web – Click VLAN, 802.1Q VLAN, Current Table. Select any ID from the scroll-down list. Figure 3-74. VLAN Current Table Command Attributes (CLI) • VLAN – ID of configured VLAN (1-4094, no leading zeroes). • Type – Shows how this VLAN was added to the switch. - Dynamic: Automatically learned via GVRP.
Page 169: Creating Vlans
Creating VLANs Use the VLAN Static List to create or remove VLAN groups. To propagate information about VLAN groups used on this switch to external network devices, you must specify a VLAN ID for each of these groups. Command Attributes •...
Page 170: Adding Static Members To Vlans (Vlan Index)
Configuring the Switch CLI – This example creates a new VLAN. Console(config)#vlan database Console(config-vlan)#vlan 2 name R&D media ethernet state active Console(config-vlan)#end Console#show vlan VLAN Type Name ---- ------- ---------------- --------- ---------------------------------- Static DefaultVlan Static Console(config-vlan)# Adding Static Members to VLANs (VLAN Index) Use the VLAN Static Table to configure port members for the selected VLAN index.
Page 171: Figure 3-76. Vlan Static Table
• Membership Type – Select VLAN membership for each interface by marking the appropriate radio button for a port or trunk: - Tagged: Interface is a member of the VLAN. All packets transmitted by the port will be tagged, that is, carry a tag and therefore carry VLAN or CoS information. - Untagged: Interface is a member of the VLAN.
Page 172: Adding Static Members To Vlans (Port Index)
Configuring the Switch Adding Static Members to VLANs (Port Index) Use the VLAN Static Membership by Port menu to assign VLAN groups to the selected interface as a tagged member. Command Attributes • Interface – Port or trunk identifier. • Member – VLANs for which the selected interface is a tagged member. •...
Page 173: Configuring Vlan Behavior For Interfaces
Configuring VLAN Behavior for Interfaces You can configure VLAN behavior for specific interfaces, including the default VLAN identifier (PVID), accepted frame types, ingress filtering, GVRP status, and GARP timers. Command Usage • GVRP – GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network.
Page 174 Configuring the Switch • GARP Leave Timer* – The interval a port waits before leaving a VLAN group. This time should be set to more than twice the join time. This ensures that after a Leave or LeaveAll message has been issued, the applicants can rejoin before the port actually leaves the group.
Page 175: Configuring Private Vlans
CLI – This example sets port 3 to accept only tagged frames, assigns PVID 3 as the native VLAN ID, enables GVRP, sets the GARP timers, and then sets the switchport mode to hybrid. Console(config)#interface ethernet 1/3 Console(config-if)#switchport acceptable-frame-types tagged Console(config-if)#switchport ingress-filtering Console(config-if)#switchport native vlan 3 Console(config-if)#switchport gvrp...
Page 176: Configuring Uplink And Downlink Ports
Configuring the Switch Configuring Uplink and Downlink Ports Use the Private VLAN Link Status page to set ports as downlink or uplink ports. Ports designated as downlink ports can not communicate with any other ports on the switch except for the uplink ports. Uplink ports can communicate with any other ports on the switch and with any designated downlink ports.
Page 177: Configuring Protocol Groups
Configuring Protocol Groups Create a protocol group for one or more protocols. Command Attributes • Protocol Group ID – Group identifier of this protocol group. (Range: 1-2147483647) • Frame Type – Frame type used by this protocol. (Options: Ethernet, RFC_1042, LLC_other) •...
Page 178 Configuring the Switch • When a frame enters a port that has been assigned to a protocol VLAN, it is processed in the following manner: - If the frame is tagged, it will be processed according to the standard rules applied to tagged frames.
Page 179: Class Of Service Configuration
Class of Service Configuration Class of Service (CoS) allows you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with eight priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.
Page 180: Figure 3-84. Port Priority Configuration
Configuring the Switch Web – Click Priority, Default Port Priority or Default Trunk Priority. Modify the default priority for any interface, then click Apply. Figure 3-84. Port Priority Configuration CLI – This example assigns a default priority of 5 to port 3. Console(config)#interface ethernet 1/3 Console(config-if)#switchport priority default 5 Console(config-if)#end...
Page 181: Mapping Cos Values To Egress Queues
Mapping CoS Values to Egress Queues This switch processes Class of Service (CoS) priority tagged traffic by using eight priority queues for each port, with service schedules based on strict or Weighted Round Robin (WRR). Up to eight separate traffic priorities are defined in IEEE 802.1p.
Page 182: Figure 3-87. Traffic Classes
Configuring the Switch Web – Click Priority, Traffic Classes. Mark an interface and click Select to display the current mapping of CoS values to output queues. Assign priorities to the traffic classes (i.e., output queues) for the selected interface, then click Apply. CLI –...
Page 183: Selecting The Queue Mode
Selecting the Queue Mode You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
Page 184: Priority Queues
Configuring the Switch Web – Click Priority, Queue Scheduling. Select the interface, highlight a traffic class (i.e., output queue), enter a weight, then click Apply. Figure 3-89. Queue Scheduling CLI – The following example shows how to assign WRR weights to each of the priority queues.
Page 185: Mapping Layer 3/4 Priorities To Cos Values
Mapping Layer 3/4 Priorities to CoS Values This switch supports several common methods of prioritizing layer 3/4 traffic to meet application requirements. Traffic priorities can be specified in the IP header of a frame, using the priority bits in the Type of Service (ToS) octet or the number of the TCP port.
Page 186: Mapping Ip Precedence
Configuring the Switch Mapping IP Precedence The Type of Service (ToS) octet in the IPv4 header includes three precedence bits defining eight different priority levels ranging from highest priority for network control packets to lowest priority for routine traffic. The default IP Precedence values are mapped one-to-one to Class of Service values (i.e., Precedence value 0 maps to CoS value 0, and so forth).
Page 187: Mapping Dscp Priority
CLI – The following example globally enables IP Precedence service on the switch, maps IP Precedence value 1 to CoS value 0 (on port 1), and then displays the IP Precedence settings. Console(config)#map ip precedence Console(config)#interface ethernet 1/1 Console(config-if)#map ip precedence 1 cos 0 Console(config-if)#end Console#show map ip precedence ethernet 1/1 Precedence mapping status: disabled...
Page 188: Figure 3-94. Mapping Ip Dscp Priority
Configuring the Switch Note: IP DSCP settings apply to all interfaces. Web – Click Priority, IP DSCP Priority. Select an entry from the DSCP table, enter a value in the Class of Service Value field, then click Apply. Figure 3-94. Mapping IP DSCP Priority CLI –...
Page 189: Mapping Ip Port Priority
Mapping IP Port Priority You can also map network applications to Class of Service values based on the IP port number (i.e., TCP/UDP port number) in the frame header. Some of the more common TCP service ports include: HTTP: 80, FTP: 21, Telnet: 23 and POP3: 110. Command Attributes •...
Page 190: Mapping Cos Values To Acls
Configuring the Switch CLI – The following example globally enables IP Port Priority service on the switch, maps HTTP traffic on port 5 to CoS value 0, and then displays all the IP Port Priority settings for that port. Console(config)#map ip port Console(config)#interface ethernet 1/5 Console(config-if)#map ip port 80 cos 0 Console(config-if)#end...
Page 191: Changing Priorities Based On Acl Rules
Web – Click Priority, ACL CoS Priority. Enable mapping for any port, select an ACL from the scroll-down list, then click Apply. Figure 3-96. ACL CoS Priority CLI – This example assigns a CoS value of zero to packets matching rules within the specified ACL on port 24.
Page 192: Figure 3-97. Acl Marker
Configuring the Switch Command Attributes • Port – Port identifier. • Name – Name of ACL. • Type – Type of ACL (IP or MAC). • Precedence – IP Precedence value. (Range: 0-7) • DSCP – Differentiated Services Code Point value. (Range: 0-63) •...
Page 193: Quality Of Service
Quality of Service The commands described in this section are used to configure Quality of Service (QoS) classification criteria and service policies. Differentiated Services (DiffServ) provides policy-based management mechanisms used for prioritizing network resources to meet the requirements of specific traffic types on a per hop basis. Each packet is classified upon entry into the network based on access lists, IP Precedence or DSCP values, or VLAN lists.
Page 194: Configuring A Class Map
Configuring the Switch Use the Policy Map page to specify a policy map. Then use the Class Map page to configure a policy map. And finally, use the set and police commands to specify the match criteria, where the: - set - classifies the service that an IP packet will receive. - police - defines the maximum throughput, burst rate, drop rate, and the action that results from a policy violation.
Page 195: Figure 3-98. Configuring Class Maps
Web – Click QoS, DiffServ, then click Add Class to create a new class, or Edit Rules to change the rules of an existing class. Figure 3-98. Configuring Class Maps CLI - This example creates a class map call “rd-class,” and sets it to match packets marked for DSCP service value 3.
Page 196: Creating Qos Policies
Configuring the Switch Creating QoS Policies This function creates a policy map that can be attached to multiple interfaces. Create a policy map, specify the name of the policy map, and then use the class parameters to configure policies for traffic that matches criteria defined in a class map.
Page 197 Policy Table - Policy Name — Name of policy map. - Class Name — Name of class map. - Action — Classification of IP traffic by CoS, DSCP, or IP Precedence. - Meter — Defines the maximum throughput, burst rate, and the action that results from a policy violation.
Page 198 Configuring the Switch Web – Click QoS, DiffServ, Policy Map to display the list of existing policy maps. To add a new policy map click Add Policy. To configure the policy rule settings click Edit Classes. Figure 3-99. Configuring Policy Maps 3-158...
Page 199: Attaching A Policy Map To Ingress And Egress Queues
CLI – This example creates a policy map called “rd-policy,” sets the average bandwidth the 1 Mbps, the burst rate to 1522 bps, and the response to drop any violating packets. Console(config)#policy-map rd_policy Console(config-pmap)#class rd_class Console(config-pmap-c)#set ip dscp 3 Console(config-pmap-c)#police 100000 1522 exceed-action drop Console(config-pmap-c)# Attaching a Policy Map to Ingress and Egress Queues This function applies a policy map defined in the Policy Map, Policy Rule Settings...
Page 200: Multicast Filtering
Configuring the Switch Multicast Filtering Multicasting is used to support real-time applications such as videoconferencing or streaming audio. A multicast server does not have to establish a separate connection with each client. It merely broadcasts its service to the network, and any hosts that want to receive the multicast register with their local multicast switch/ router.
Page 201: Configuring Igmp Snooping And Query Parameters
Configuring IGMP Snooping and Query Parameters You can configure the switch to forward multicast traffic intelligently. Based on the IGMP query and report messages, the switch forwards traffic only to the ports that request multicast traffic. This prevents the switch from broadcasting the traffic to all ports and possibly disrupting network performance.
Page 202: Displaying Interfaces Attached To A Multicast Router
Configuring the Switch Web – Click IGMP Snooping, IGMP Configuration. Adjust the IGMP settings as required, and then click Apply. (The default settings are shown below.) Figure 3-101. IGMP Configuration CLI – This example modifies the settings for multicast filtering, and then displays the current status.
Page 203: Specifying Static Interfaces For A Multicast Router
Web – Click IGMP Snooping, Multicast Router Port Information. Select the required VLAN ID from the scroll-down list to display the associated multicast routers. Figure 3-102. Multicast Router Port Information CLI – This example shows that Port 11 has been statically configured as a port attached to a multicast router.
Page 204: Displaying Port Members Of Multicast Services
Configuring the Switch Web – Click IGMP Snooping, Static Multicast Router Port Configuration. Specify the interfaces attached to a multicast router, indicate the VLAN which will forward all the corresponding multicast traffic, and then click Add. After you have finished adding interfaces to the list, click Apply.
Page 205: Assigning Ports To Multicast Services
Web – Click IGMP Snooping, IP Multicast Registration Table. Select a VLAN ID and the IP address for a multicast service from the scroll-down lists. The switch will display all the interfaces that are propagating this multicast service. Figure 3-104. IP Multicast Registration Table CLI –...
Page 206: Configuring Domain Name Service
Configuring the Switch Command Attribute • Interface – Activates the Port or Trunk scroll down list. • VLAN ID – Selects the VLAN to propagate all multicast traffic coming from the attached multicast router/switch. • Multicast IP – The IP address for a specific multicast service •...
Page 207: Configuring General Dns Server Parameters
Configuring General DNS Server Parameters Command Usage • To enable DNS service on this switch, first configure one or more name servers, and then enable domain lookup status. • To append domain names to incomplete host names received from a DNS client (i.e., not formatted with dotted notation), you can specify a default domain name or a list of domain names to be tried in sequential order.
Page 208: Figure 3-106. Dns Configuration
Configuring the Switch Web – Select DNS, General Configuration. Set the default domain name or list of domain names, specify one or more name servers to use to use for address resolution, enable domain lookup status, and click Apply. Figure 3-106. DNS Configuration CLI - This example sets a default domain name and a domain list.
Page 209: Configuring Static Dns Host To Address Entries
Configuring Static DNS Host to Address Entries You can manually configure static entries in the DNS table that are used to map domain names to IP addresses. Command Usage • Static entries may be used for local devices connected directly to the attached network, or for commonly used resources located elsewhere on the network.
Page 210: Figure 3-107. Dns Static Host Table
Configuring the Switch Web – Select DNS, Static Host Table. Enter a host name and one or more corresponding addresses, then click Apply. Figure 3-107. DNS Static Host Table CLI - This example maps two address to a host name, and then configures an alias host name for the same addresses.
Page 211: Displaying The Dns Cache
Displaying the DNS Cache You can display entries in the DNS cache that have been learned via the designated name servers. Field Attributes • No – The entry number for each resource record. • Flag – The flag is always “4” indicating a cache entry and therefore unreliable. •...
Page 212 Configuring the Switch CLI - This example displays all the resource records learned from the designated name servers. Console#show dns cache FLAG TYPE CNAME CNAME CNAME CNAME CNAME ALIAS CNAME ALIAS CNAME ALIAS CNAME Console# 3-172 207.46.134.222 207.46.134.190 207.46.134.155 207.46.249.222 207.46.249.27 POINTER TO:4 207.46.68.27...
Page 213: Chapter 4: Command Line Interface
Chapter 4: Command Line Interface This chapter describes how to use the Command Line Interface (CLI). Using the Command Line Interface Accessing the CLI When accessing the management interface for the switch over a direct connection to the server’s console port, or via a Telnet connection, the switch can be managed by entering command keywords and parameters at the prompt.
Page 214 After entering the Telnet command, the login screen displays: Username: admin Password: CLI session with the OmniStack 6300-24 is opened. To end the CLI session, enter [Exit]. Vty-0# Note: You can open up to four sessions to the device via Telnet.
Page 215: Entering Commands
Entering Commands This section describes how to enter CLI commands. Keywords and Arguments A CLI command is a series of keywords and arguments. Keywords identify a command, and arguments specify configuration parameters. For example, in the command “show interfaces status ethernet 1/5,” show interfaces and status are keywords, ethernet is an argument that specifies the interface type, and 1/5 specifies the unit/port.
Page 216: Showing Commands
Command Line Interface Showing Commands If you enter a “?” at the command prompt, the system will display the first level of keywords for the current command class (Normal Exec or Privileged Exec) or configuration class (Global, ACL, Interface, Line, VLAN Database, or MSTP). You can also display a list of valid keywords for a specific command.
Page 217: Partial Keyword Lookup
Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided. (Remember not to leave a space between the command and question mark.) For example “s?” shows all the keywords starting with “s.” Console#show s? snmp sntp...
Page 218: Exec Commands
“super” (page 4-26). To enter Privileged Exec mode, enter the following user names and passwords: Username: admin Password: [admin login password] CLI session with the OmniStack 6300-24 is opened. To end the CLI session, enter [Exit]. Console# Username: guest Password: [guest login password] CLI session with the OmniStack 6300-24 is opened.
Page 219: Command Line Processing
To enter the Global Configuration mode, enter the command configure in Privileged Exec mode. The system prompt will change to “Console(config)#” which gives you access privilege to all Global Configuration commands. Console#configure Console(config)# To enter the other modes, at the configuration prompt type one of the following commands.
Page 220 Command Line Interface Keystroke Ctrl-F Ctrl-K Ctrl-L Ctrl-N Ctrl-P Ctrl-R Ctrl-U Ctrl-W Esc-B Esc-D Esc-F Delete key or backspace key Table 4-3. Keystroke Commands Function Shifts cursor to the right one character. Deletes all characters from the cursor to the end of the line. Repeats current command line on a new line.
Page 221: Command Groups
Command Groups The system commands can be broken down into the functional groups shown below Command Group Description Line Sets communication parameters for the serial port and Telnet, including baud rate and console time-out General Basic commands for entering privileged access mode, restarting the system, or quitting the CLI System Management Controls system logs, system passwords, user name, browser...
Page 222: Line Commands
Command Line Interface The access mode shown in the following tables is indicated by these abbreviations: NE (Normal Exec) PE (Privileged Exec) GC (Global Configuration) ACL (Access Control List Configuration) Line Commands You can access the onboard configuration program by attaching a VT100 compatible device to the server’s serial port.
Page 223: Login
Default Setting There is no default line. Command Mode Global Configuration Command Usage Telnet is considered a virtual terminal connection and will be shown as “Vty” in screen displays such as show users. However, the serial communication parameters (e.g., databits) do not affect Telnet connections. Example To enter console line mode, enter the following command: Console(config)#line console...
Page 224: Password
Command Line Interface Command Usage • There are three authentication modes provided by the switch itself at login: - login selects authentication by a single global password as specified by the password line configuration command. When using this method, the management interface starts in Normal Exec (NE) mode.
Page 225: Timeout Login Response
Command Usage • When a connection is started on a line with password protection, the system prompts for the password. If you enter the correct password, the system shows a prompt. You can use the password-thresh command to set the number of times a user can enter an incorrect password before the system terminates the line connection and returns the terminal to the idle state.
Page 226: Exec-Timeout
Command Line Interface Example To set the timeout to two minutes, enter this command: Console(config-line)#timeout login response 120 Console(config-line)# exec-timeout This command sets the interval that the system waits until user input is detected. Use the no form to restore the default. Syntax exec-timeout [seconds] no exec-timeout...
Page 227: Silent-Time
Command Mode Line Configuration Command Usage • When the logon attempt threshold is reached, the system interface becomes silent for a specified amount of time before allowing the next logon attempt. (Use the silent-time command to set this interval.) When this threshold is reached for Telnet, the Telnet logon interface shuts down.
Page 228: Databits
Command Line Interface databits This command sets the number of data bits per character that are interpreted and generated by the console port. Use the no form to restore the default value. Syntax databits {7 | 8} no databits • 7 - Seven data bits per character. •...
Page 229: Speed
Command Usage Communication protocols provided by devices such as terminals and modems often require a specific parity bit setting. Example To specify no parity, enter this command: Console(config-line)#parity none Console(config-line)# speed This command sets the terminal line’s baud rate. This command sets both the transmit (to terminal) and receive (from terminal) speeds.
Page 230: Disconnect
Command Line Interface Default Setting 1 stop bit Command Mode Line Configuration Example To specify 2 stop bits, enter this command: Console(config-line)#stopbits 2 Console(config-line)# disconnect Use this command to terminate an SSH, Telnet, or console connection. Syntax disconnect session-id session-id – The session identifier for an SSH, Telnet or console connection.
Page 231: Enable
Command Mode Normal Exec, Privileged Exec Example To show all lines, enter this command: Console#show line Console configuration: Password threshold: 3 times Interactive timeout: Disabled Silent time: Disabled Baudrate: 9600 Databits: 8 Parity: none Stopbits: 1 Vty configuration: Password threshold: 3 times Interactive timeout: 65535 Console# General Commands...
Page 232: Disable
Command Line Interface Default Setting Level 15 Command Mode Normal Exec Command Usage • “super” is the default password required to change the command mode from Normal Exec to Privileged Exec. (To set this password, see the enable password command on page 4-26.) •...
Page 233: Show History
prior to enabling some of the other configuration modes, including Interface Configuration, Line Configuration, VLAN Database Configuration, and Multiple Spanning Tree Configuration. See “Understanding Command Modes” on page 4-5. Default Setting None Command Mode Privileged Exec Example Console#configure Console(config)# Related Commands end (4-22) show history This command shows the contents of the command history buffer.
Page 234: Reload
Command Line Interface modes. In this example, the !2 command repeats the second command in the Execution history buffer (config). Console#!2 Console#config Console(config)# reload This command restarts the system. Note: When the system is restarted, it will always run the Power-On Self-Test. It will also retain all configuration information stored in non-volatile memory by the copy running-config startup-config command.
Page 235: Quit
Default Setting None Command Mode Example This example shows how to return to the Privileged Exec mode from the Global Configuration mode, and then quit the CLI session: Console(config)#exit Console#exit Press ENTER to start session User Access Verification Username: quit This command exits the configuration program.
Page 236: Device Designation Commands
Command Line Interface Table 4-7. System Management Commands Command Group Function IP Filter Configures IP addresses that are allowed management access Web Server Enables management access via a Web browser Secure Shell Provides secure replacement for Telnet Event Logging Controls logging of error messages SMTP Alerts Configures SMTP email alerts Time (System Clock)
Page 237: Hostname
hostname This command specifies or modifies the host name for this device. Use the no form to restore the default host name. Syntax hostname name no hostname name - The name of this host. (Maximum length: 255 characters) Default Setting None Command Mode Global Configuration...
Page 238: Enable Password
Command Line Interface • {0 | 7} - 0 means plain password, 7 means encrypted password. • password password - The authentication password for the user. (Maximum length: 8 characters plain text, 32 encrypted, case sensitive) Default Setting • The default access level is Normal Exec. •...
Page 239: Ip Filter Commands
Command Mode Global Configuration Command Usage • You cannot set a null password. You will have to enter a password to change the command mode from Normal Exec to Privileged Exec with the enable command (page 4-19). • The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server.
Page 240: Show Management
Command Line Interface Command Mode Global Configuration Command Usage • If anyone tries to access a management interface on the switch from an invalid address, the switch will reject the connection, enter an event message in the system log, and send a trap message to the trap manager. •...
Page 241: Web Server Commands
Example Console#show management all-client Management Ip Filter Http-Client: Start ip address ----------------------------------------------- 1. 192.168.1.19 2. 192.168.1.25 Snmp-Client: Start ip address ----------------------------------------------- 1. 192.168.1.19 2. 192.168.1.25 Telnet-Client: Start ip address ----------------------------------------------- 1. 192.168.1.19 2. 192.168.1.25 Console# Web Server Commands Command Function ip http port Specifies the port to be used by the Web browser interface ip http server...
Page 242: Ip Http Server
Command Line Interface Example Console(config)#ip http port 769 Console(config)# Related Commands ip http server (4-30) ip http server This command allows this device to be monitored or configured from a browser. Use the no form to disable this function. Syntax [no] ip http server Default Setting Enabled...
Page 243: Ip Http Secure-Port
• When you start HTTPS, the connection is established in this way: - The client authenticates the server using the server’s digital certificate. - The client and server negotiate a set of security protocols to use for the connection. - The client and server generate session keys for encrypting and decrypting data.
Page 244: Secure Shell Commands
Command Line Interface Command Usage • You cannot configure the HTTP and HTTPS servers to use the same port. • If you change the HTTPS port number, clients attempting to connect to the HTTPS server must specify the port number in the URL, in this format: https://device:port_number Example Console(config)#ip http secure-port 1000...
Page 245 Command Function disconnect Terminates a line connection show ip ssh Displays the status of the SSH server and the configured values for authentication timeout and retries show ssh Displays the status of current SSH sessions show public-key Shows the public key for the specified user or for the host show users Shows SSH users, including privilege level and public key type PE The SSH server on this switch supports both password and public key...
Page 246: Ip Ssh Server
Command Line Interface 00609025394840848271781943722884025331159521348610229029789827213532671 31629432532818915045306393916643 steve@192.168.1.19 Set the Optional Parameters – Set other optional parameters, including the authentication timeout, the number of retries, and the server key size. Enable SSH Service – Use the ip ssh server command to enable the SSH server on the switch.
Page 247: Ip Ssh Timeout
Example Console#ip ssh crypto host-key generate dsa Console#configure Console(config)#ip ssh server Console(config)# Related Commands ip ssh crypto host-key generate (4-37) show ssh (4-39) ip ssh timeout Use this command to configure the timeout for the SSH server. Use the no form to restore the default setting.
Page 248: Ip Ssh Authentication-Retries
Command Line Interface ip ssh authentication-retries Use this command to configure the number of times the SSH server attempts to reauthenticate a user. Use the no form to restore the default setting. Syntax ip ssh authentication-retries count no ip ssh authentication-retries count –...
Page 249: Delete Public-Key
delete public-key Use this command to delete the specified user’s public key. Syntax delete public-key username [dsa | rsa] • username – Name of an SSH user. (Range: 1-8 characters) • dsa – DSA public key type. • rsa – RSA public key type. Default Setting Deletes both the DSA and RSA key.
Page 250: Ip Ssh Crypto Zeroize
Command Line Interface Related Commands ip ssh crypto zeroize (4-38) ip ssh save host-key (4-38) ip ssh crypto zeroize Use this command to clear the host key from memory (i.e. RAM). Syntax ip ssh crypto zeroize [dsa | rsa] • dsa – DSA key type. •...
Page 251: Show Ip Ssh
Example Console#ip ssh save host-key dsa Console# Related Commands ip ssh crypto host-key generate (4-37) show ip ssh Use this command to display the connection settings used when authenticating client access to the SSH server. Command Mode Privileged Exec Example Console#show ip ssh SSH Enabled - version 1.99 Negotiation timeout: 120 secs;...
Page 252: Show Public-Key
Command Line Interface Field Description Encryption The encryption method is automatically negotiated between the client and server. Options for SSHv1.5 include: DES, 3DES Options for SSHv2.0 can include different algorithms for the client-to-server (ctos) and server-to-client (stoc): aes128-cbc-hmac-sha1 aes192-cbc-hmac-sha1 aes256-cbc-hmac-sha1 3des-cbc-hmac-sha1 blowfish-cbc-hmac-sha1 aes128-cbc-hmac-md5...
Page 253: Event Logging Commands
Example Console#show public-key host Host: RSA: 1024 35 1568499540186766925933394677505461732531367489083654725415020245593199868 5443583616519999233297817660658309586108259132128902337654680172627257141 3428762941301196195566782595664104869574278881462065194174677298486546861 5717739390164779355942303577413098022737087794545240839717526463580581767 16709574804776117 DSA: ssh-dss AAAB3NzaC1kc3MAAACBAPWKZTPbsRIB8ydEXcxM3dyV/yrDbKStIlnzD/Dg0h2Hxc YV44sXZ2JXhamLK6P8bvuiyacWbUW/a4PAtp1KMSdqsKeh3hKoA3vRRSy1N2XFfAKxl5fwFfv JlPdOkFgzLGMinvSNYQwiQXbKTBH0Z4mUZpE85PWxDZMaCNBPjBrRAAAAFQChb4vsdfQGNIjw bvwrNLaQ77isiwAAAIEAsy5YWDC99ebYHNRj5kh47wY4i8cZvH+/p9cnrfwFTMU01VFDly3IR 2G395NLy5Qd7ZDxfA9mCOfT/yyEfbobMJZi8oGCstSNOxrZZVnMqWrTYfdrKX7YKBw/Kjw6Bm iFq7O+jAhf1Dg45loAc27s6TLdtny1wRq/ow2eTCD5nekAAACBAJ8rMccXTxHLFAczWS7EjOy DbsloBfPuSAb4oAsyjKXKVYNLQkTLZfcFRu41bS2KV5LAwecsigF/+DjKGWtPNIQqabKgYCw2 o/dVzX4Gg+yqdTlYmGA7fHGm8ARGeiG4ssFKy4Z6DmYPXFum1Yg0fhLwuHpOSKdxT3kk475S7 Console# Event Logging Commands Table 4-16. Event Logging Commands Command Function logging on Controls logging of error messages logging history Limits syslog messages saved to switch memory based on severity...
Page 254: Logging History
Command Line Interface Command Usage The logging process controls error messages saved to switch memory. You can use the logging history command to control the type of error messages that are stored. Example Console(config)#logging on Console(config)# Related Commands logging history (4-42) clear logging (4-44) logging history This command limits syslog messages saved to switch memory based on severity.
Page 255: Logging Host
Command Mode Global Configuration Command Usage The message level specified for flash memory must be a higher priority (i.e., numerically lower) than that specified for RAM. Example Console(config)#logging history ram 0 Console(config)# logging host This command adds a syslog server host IP address that will receive logging messages.
Page 256: Logging Trap
Command Line Interface Command Mode Global Configuration Command Usage The command specifies the facility type tag sent in syslog messages. (See RFC 3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to sort messages or to store messages in the corresponding database.
Page 257: Show Logging
Command Mode Privileged Exec Example Console#clear logging Console# Related Commands show logging (4-45) show logging This command displays the logging configuration, along with any system and event messages stored in memory. Syntax show logging {flash | ram | sendmail | trap} •...
Page 258: Smtp Alert Commands
Command Line Interface Table 4-18. System Logging Parameters Field Description Syslog logging Shows if system logging has been enabled via the logging on command. History logging in FLASH The message level(s) reported based on the logging history command. History logging in RAM The message level(s) reported based on the logging history command.
Page 259: Logging Sendmail Host
Command Function logging sendmail Enables SMTP event handling show logging sendmail Displays SMTP event handler settings logging sendmail host This command specifies SMTP servers that will be sent alert messages. Use the no form to remove an SMTP server. Syntax [no] logging sendmail host ip_address ip_address - IP address of an SMTP server that will be sent alert messages for event handling.
Page 260: Logging Sendmail Source-Email
Command Line Interface Command Mode Global Configuration Command Usage The specified level indicates an event threshold. All events at this level or higher will be sent to the configured email recipients. (For example, using Level 7 will report all events from level 7 to level 0.) Example This example will send email alerts for system errors from level 3 through 0.
Page 261: Logging Sendmail
Command Mode Global Configuration Command Usage You can specify up to five recipients for alert messages. However, you must enter a separate command to specify each recipient. Example Console(config)#logging sendmail destination-email ted@this-company.com Console(config)# logging sendmail This command enables SMTP event handling. Use the no form to disable this function.
Page 262: Time Commands
Command Line Interface Time Commands The system clock can be dynamically set by polling a set of specified time servers (NTP or SNTP). Command Function sntp client Accepts time from specified time servers sntp server Specifies one or more time servers sntp poll Sets the interval at which the client polls for time show sntp...
Page 263: Sntp Server
Example Console(config)#sntp server 10.1.0.19 Console(config)#sntp poll 60 Console(config)#sntp client Console(config)#end Console#show sntp Current time: Dec 23 02:52:44 2002 Poll interval: 60 Current mode: unicast Console# Related Commands sntp server (4-51) sntp poll (4-52) show sntp (4-52) sntp server This command sets the IP address of the servers to which SNTP time requests are issued.
Page 264: Sntp Poll
Command Line Interface sntp poll This command sets the interval between sending time requests when the switch is set to SNTP client mode. Use the no form to restore to the default. Syntax sntp poll seconds no sntp poll seconds - Interval between time requests. (Range: 16-16384 seconds) Default Setting 16 seconds Command Mode...
Page 265: Clock Timezone
clock timezone This command sets the time zone for the switch’s internal clock. Syntax clock timezone name hour hours minute minutes {before-utc | after-utc} • name - Name of timezone, usually an acronym. (Range: 1-29 characters) • hours - Number of hours before/after UTC. (Range: 1-12 hours) •...
Page 266: Show Calendar
Command Line Interface Default Setting None Command Mode Privileged Exec Example This example shows how to set the system clock to 15:12:34, February 1st, 2002. Console#calendar set 15:12:34 1 February 2002 Console# show calendar This command displays the system clock. Default Setting None Command Mode...
Page 267 Command Usage • Use this command in conjunction with the show running-config command to compare the information in running memory to the information stored in non-volatile memory. • This command displays settings for key command modes. Each mode group is separated by “!” symbols, and includes the configuration mode command, and corresponding commands.
Page 268: Command Line Interface
Command Line Interface Example Console#show startup-config building startup-config, please wait... sntp server 0.0.0.0 0.0.0.0 0.0.0.0 snmp-server community public ro snmp-server community private rw snmp-server group DefaultROGroup v1 read defaultview write none snmp-server group DefaultROGroup v2c read defaultview write none snmp-server group DefaultRWGroup v1 read defaultview write defaultview snmp-server group DefaultRWGroup v2c read defaultview write defaultview snmp-server view defaultview 1 included username admin access-level 15...
Page 269: Show Running-Config
show running-config This command displays the configuration information currently in use. Default Setting None Command Mode Privileged Exec Command Usage • Use this command in conjunction with the show startup-config command to compare the information in running memory to the information stored in non-volatile memory.
Page 270: Command Line Interface
Command Line Interface Example Console#show running-config building running-config, please wait... sntp server 0.0.0.0 0.0.0.0 0.0.0.0 snmp-server community public ro snmp-server community private rw snmp-server group DefaultROGroup v1 read defaultview write none snmp-server group DefaultROGroup v2c read defaultview write none snmp-server group DefaultRWGroup v1 read defaultview write defaultview snmp-server group DefaultRWGroup v2c read defaultview write defaultview snmp-server view defaultview 1 included username admin access-level 15...
Page 271: Show System
show system This command displays system information. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage • For a description of the items shown by this command, refer to “Displaying System Information” on page 3-8. • The POST results should all display “PASS.” If any POST test indicates “FAIL,”...
Page 272: Show Users
Command Line Interface show users Shows all active console and Telnet sessions, including user name, idle time, and IP address of Telnet client. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The session used to execute this command is indicated by a “*” symbol next to the Line (i.e., session) index number.
Page 273: Frame Size Commands
Example Console#show version Unit1 Serial number Hardware version Number of ports Main power status Redundant power status :not present Agent(Primary) Unit id Loader version Boot rom version Operation code version :1.0.0.3 Console# Frame Size Commands Command Function jumbo frame Enables support for jumbo frames jumbo frame This command enables support for jumbo frames.
Page 274: Flash/File Commands
Command Line Interface Example Console(config)#jumbo frame Console(config)# Flash/File Commands These commands are used to manage the system code or configuration files. Command Function copy Copies a code image or a switch configuration to or from flash memory or a TFTP server delete Deletes a file or code image Displays a list of files in flash memory...
Page 275: Default Setting
Default Setting None Command Mode Privileged Exec Command Usage • The system prompts for data required to complete the copy command. • The destination file name should not contain slashes (\ or /), the leading letter of the file name should not be a period (.), and the maximum length for file names on the TFTP server is 127 characters or 31 characters for files on the switch.
Page 276: Delete
Command Line Interface The following example shows how to download a configuration file: Console#copy tftp startup-config TFTP server ip address: 10.1.0.99 Source configuration file name: startup.01 Startup configuration file name [startup]: Write to FLASH Programming. \Write to FLASH finish. Success. Console# This example shows how to copy a secure-site certificate from an TFTP server.
Page 277: Dir
Command Usage • If the file type is used for system startup, then this file cannot be deleted. • “Factory_Default_Config.cfg” cannot be deleted. Example This example shows how to delete the test2.cfg configuration file from flash memory. Console#delete test2.cfg Console# Related Commands dir (4-65) delete public-key (4-64)
Page 278: Whichboot
Command Line Interface Example The following example shows how to display all file information: Console#dir -------------------------------- -------------- ------- ----------- diag2.0.2.2 Boot-Rom image Factory_Default_Config.cfg startup-config ------------------------------------------------------------------- Console# whichboot This command displays which files were booted when the system powered up. Default Setting None Command Mode Privileged Exec...
Page 279: Authentication Commands
Default Setting None Command Mode Global Configuration Command Usage • A colon (:) is required after the specified file type. • If the file contains an error, it cannot be set as the default file. Example Console(config)#boot system config: startup Console(config)# Related Commands dir (4-65)
Page 280: Authentication Login
Command Line Interface authentication login This command defines the login authentication method and precedence. Use the no form to restore the default. Syntax authentication login {[local] [radius] [tacacs]} no authentication login • local - Use local password. • radius - Use RADIUS server password. •...
Page 281: Authentication Enable
authentication enable This command defines the authentication method and precedence to use when changing from Exec command mode to Privileged Exec command mode with the enable command (see page 4-19). Use the no form to restore the default. Syntax authentication enable {[local] [radius] [tacacs]} no authentication enable •...
Page 282: Radius Client
Command Line Interface RADIUS Client Remote Authentication Dial-in User Service (RADIUS) is a logon authentication protocol that uses software running on a central server to control access to RADIUS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch.
Page 283: Radius-Server Key
Command Mode Global Configuration Example Console(config)#radius-server port 181 Console(config)# radius-server key This command sets the RADIUS encryption key. Use the no form to restore the default. Syntax radius-server key key_string no radius-server key key_string - Encryption key used to authenticate logon access for client. Do not use blank spaces in the string.
Page 284: Radius-Server Timeout
Command Line Interface radius-server timeout This command sets the interval between transmitting authentication requests to the RADIUS server. Use the no form to restore the default. Syntax radius-server timeout number_of_seconds no radius-server timeout number_of_seconds - Number of seconds the switch waits for a reply before resending a request.
Page 285: Tacacs+ Client
TACACS+ Client Terminal Access Controller Access Control System (TACACS+) is a logon authentication protocol that uses software running on a central server to control access to TACACS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch.
Page 286: Tacacs-Server Key
Command Line Interface Command Mode Global Configuration Example Console(config)#tacacs-server port 181 Console(config)# tacacs-server key This command sets the TACACS+ encryption key. Use the no form to restore the default. Syntax tacacs-server key key_string no tacacs-server key key_string - Encryption key used to authenticate logon access for the client.
Page 287: Port Security Commands
Port Security Commands These commands can be used to disable the learning function or manually specify secure addresses for a port. You may want to leave port security off for an initial training period (i.e., enable the learning function) to register all the current VLAN members on the selected port, and then enable port security to ensure that the port will drop any incoming frames with a source MAC address that is unknown or has been previously learned from another port.
Page 288: 802.1X Port Authentication
Command Line Interface • To use port security, first allow the switch to dynamically learn the <source MAC address, VLAN> pair for frames received on a port for an initial training period, and then enable port security to stop address learning. Be sure you enable the learning function long enough to ensure that all valid VLAN members have been registered on the selected port.
Page 289: Authentication Dot1X Default
Table 4-31. 802.1X Port Authentication Commands Command Function dot1x timeout quiet-period Sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client dot1x timeout re-authperiod Sets the time period after which a connected client must be re-authenticated dot1x timeout tx-period Sets the time period during an authentication session that...
Page 290: Dot1X Max-Req
Command Line Interface dot1x max-req This command sets the maximum number of times the switch port will retransmit an EAP request/identity packet to the client before it times out the authentication session. Use the no form to restore the default. Syntax dot1x max-req count no dot1x max-req...
Page 291: Dot1X Operation-Mode
dot1x operation-mode This command allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. Use the no form with no keywords to restore the default to single host. Use the no form with the multi-host max-count keywords to restore the default maximum count.
Page 292: Dot1X Re-Authentication
Command Line Interface dot1x re-authentication This command enables periodic re-authentication globally for all ports. Use the no form to disable re-authentication. Syntax [no] dot1x re-authentication Command Mode Global Configuration Example Console(config)#dot1x re-authentication Console(config)# dot1x timeout quiet-period This command sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client.
Page 293: Dot1X Timeout Tx-Period
Command Mode Global Configuration Example Console(config)#dot1x timeout re-authperiod 300 Console(config)# dot1x timeout tx-period This command sets the time that the switch waits during an authentication session before re-transmitting an EAP packet. Use the no form to reset to the default value. Syntax dot1x timeout tx-period seconds no dot1x timeout tx-period...
Page 294 Command Line Interface Command Usage This command displays the following information: • Global 802.1X Parameters – Displays the global port access control parameters that can be configured for this switch as described in the preceding pages, including reauth-enabled (page 4-80), reauth-period (page 4-80), quiet-period (page 4-80), tx-period (page 4-81), and max-req (page 4-78).
Page 295: Access Control List Commands
Example Console#show dot1x Global 802.1X Parameters reauth-enabled: yes reauth-period: quiet-period: tx-period: supp-timeout: server-timeout: 30 reauth-max: max-req: 802.1X Port Summary Port Name Status disabled disabled 1/23 disabled 1/24 disabled 802.1X Port Details 802.1X is disabled on port 1 802.1X is enabled on port 24 Console# Access Control List Commands Access Control Lists (ACL) provide packet filtering for IP frames (based on address,...
Page 296 Command Line Interface • MAC ACL mode (MAC-ACL) filters packets based on the source or destination MAC address and the Ethernet frame type (RFC 1060). The following restrictions apply to ACLs: • This switch supports ACLs for both ingress and egress filtering. However, you can only bind one IP ACL and one MAC ACL to any port for ingress filtering, and one IP ACL and one MAC ACL to any port for egress filtering.
Page 297: Ip Acls
IP ACLs Command Function access-list ip Creates an IP ACL and enters configuration mode permit, deny Filters packets matching a specified source IP address permit, deny Filters packets meeting the specified criteria, including source and destination IP address, TCP/UDP port number, protocol type, and TCP control code show ip access-list Displays the rules for configured IP ACLs...
Page 298: Permit, Deny (Standard Acl)
Command Line Interface Command Usage • An egress ACL must contain all deny rules. • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To create an ACL, you must add at least one rule to the list.
Page 299: Permit, Deny (Extended Acl)
Example This example configures one permit rule for the specific address 10.1.1.21 and another rule for the address range 168.92.16.x – 168.92.31.x using a bitmask. Console(config-std-acl)#permit host 10.1.1.21 Console(config-std-acl)#permit 168.92.16.0 255.255.240.0 Console(config-std-acl)# Related Commands access-list ip (4-85) permit, deny (Extended ACL) This command adds a rule to an Extended IP ACL.
Page 300 Command Line Interface Default Setting None Command Mode Extended ACL Command Usage • All new rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match”...
Page 301: Show Ip Access-List
This permits all TCP packets from class C addresses 192.168.1.0 with the TCP control code set to “SYN.” Console(config-ext-acl)#permit 192.168.1.0 255.255.255.0 any tcp control-code 2 2 Console(config-ext-acl)# Related Commands access-list ip (4-85) show ip access-list This command displays the rules for configured IP ACLs. Syntax show ip access-list {standard | extended} [acl_name] •...
Page 302: Mask (Ip Acl)
Command Line Interface Command Mode Global Configuration Command Usage • A mask can only be used by all ingress ACLs or all egress ACLs. • The precedence of the ACL rules applied to a packet is not determined by order of the rules, but instead by the order of the masks; i.e., the first mask that matches a rule will determine the rule that is applied to a packet.
Page 303: Command Mode
Default Setting None Command Mode IP Mask Command Usage • Packets crossing a port are checked against all the rules in the ACL until a match is found. The order in which these packets are checked is determined by the mask, and not the order in which the ACL rules were entered. •...
Page 304 Command Line Interface This shows how to create a standard ACL with an ingress mask to deny access to the IP host 171.69.198.102, and permit access to any others. Console(config)#access-list ip standard A2 Console(config-std-acl)#permit any Console(config-std-acl)#deny host 171.69.198.102 Console(config-std-acl)#end Console#show access-list IP standard access-list A2: deny host 171.69.198.102 permit any...
Page 305: Show Access-List Ip Mask-Precedence
This is a more comprehensive example. It denies any TCP packets in which the SYN bit is ON, and permits all other packets. It then sets the ingress mask to check the deny rule first, and finally binds port 1 to this ACL. Note that once the ACL is bound to an interface (i.e., the ACL is active), the order in which the rules are displayed is determined by the associated mask.
Page 306: Ip Access-Group
Command Line Interface Related Commands mask (IP ACL) (4-90) ip access-group This command binds a port to an IP ACL. Use the no form to remove the port. Syntax [no] ip access-group acl_name {in | out} • acl_name – Name of the ACL. (Maximum length: 16 characters) •...
Page 307: Map Access-List Ip
Related Commands ip access-group (4-94) map access-list ip This command sets the output queue for packets matching an ACL rule. The specified CoS value is only used to map the matching packet to an output queue; it is not written to the packet itself. Use the no form to remove the CoS mapping. Syntax [no] map access-list ip acl_name cos cos-value •...
Page 308: Show Map Access-List Ip
Command Line Interface show map access-list ip This command shows the CoS value mapped to an IP ACL for the current interface. (The CoS value determines the output queue for packets matching an ACL rule.) Syntax show map access-list ip [interface] interface •...
Page 309: Show Marking
Command Usage • You must configure an ACL mask before you can change frame priorities based on an ACL rule. • Traffic priorities may be included in the IEEE 802.1p priority tag. This tag is also incorporated as part of the overall IEEE 802.1Q VLAN tag. To specify this priority, use the set priority keywords.
Page 310: Mac Acls
Command Line Interface MAC ACLs Command Function access-list mac Creates a MAC ACL and enters configuration mode permit, deny Filters packets matching a specified source and destination address, packet format, and Ethernet type show mac access-list Displays the rules for configured MAC ACLs access-list mac Changes to the mode for configuring access control masks GC mask-precedence...
Page 311: Permit, Deny (Mac Acl)
• To remove a rule, use the no permit or no deny command followed by the exact text of a previously configured rule. • An ACL can contain up to 32 rules. Example Console(config)#access-list mac jerry Console(config-mac-acl)# Related Commands permit, deny 4-99 mac access-group (4-104) show mac access-list (4-100) permit, deny (MAC ACL)
Page 312: Show Mac Access-List
Command Line Interface • any – Any MAC source or destination address. • host – A specific MAC address. • source – Source MAC address. • destination – Destination MAC address range with bitmask. • address-bitmask* – Bitmask for MAC address (in hexidecimal format). •...
Page 313: Access-List Mac Mask-Precedence
Command Mode Privileged Exec Example Console#show mac access-list MAC access-list jerry: permit any 00-e0-29-94-34-de ethertype 0800 Console# Related Commands permit, deny 4-99 mac access-group (4-104) access-list mac mask-precedence This command changes to MAC Mask mode used to configure access control masks.
Page 314 Command Line Interface mask (MAC ACL) This command defines a mask for MAC ACLs. This mask defines the fields to check in the packet header. Use the no form to remove a mask. Syntax [no] mask [pktformat] {any | host | source-bitmask} {any | host | destination-bitmask} [vid [vid-bitmask]] [ethertype [ethertype-bitmask]] •...
Page 315 Example This example shows how to create an Ingress MAC ACL and bind it to a port. You can then see that the order of the rules have been changed by the mask. Console(config)#access-list mac M4 Console(config-mac-acl)#permit any any Console(config-mac-acl)#deny tagged-eth2 00-11-11-11-11-11 ff-ff-ff-ff-ff-ff any vid 3 Console(config-mac-acl)#end Console#show access-list...
Page 316: Show Access-List Mac Mask-Precedence
Command Line Interface show access-list mac mask-precedence This command shows the ingress or egress rule masks for MAC ACLs. Syntax show access-list mac mask-precedence [in | out] • in – Ingress mask precedence for ingress ACLs. • out – Egress mask precedence for egress ACLs. Command Mode Privileged Exec Example...
Page 317: Show Mac Access-Group
Related Commands show mac access-list (4-100) show mac access-group This command shows the ports assigned to MAC ACLs. Command Mode Privileged Exec Example Console#show mac access-group Interface ethernet 1/5 MAC access-list M5 out Console# Related Commands mac access-group (4-104) map access-list mac This command sets the output queue for packets matching an ACL rule.
Page 318: Show Map Access-List Mac
Command Line Interface Example Console(config)#int eth 1/5 Console(config-if)#map access-list mac M5 cos 0 Console(config-if)# Related Commands queue cos-map (4-200) show map access-list mac (4-106) show map access-list mac This command shows the CoS value mapped to a MAC ACL for the current interface.
Page 319: Acl Information
Default Setting None Command Mode Interface Configuration (Ethernet) Command Usage You must configure an ACL mask before you can change frame priorities based on an ACL rule. Example Console(config)#interface ethernet 1/12 Console(config-if)#match access-list mac a set priority 0 Console(config-if)# Related Commands show marking (4-97) ACL Information Command...
Page 320: Show Access-Group
Command Line Interface Example Console#show access-list IP standard access-list david: permit host 10.1.1.21 permit 168.92.0.0 0.0.15.255 IP extended access-list bob: permit 10.7.1.1 0.0.0.255 any permit 192.168.1.0 0.0.0.255 any dport 80 permit 192.168.1.0 0.0.0.255 any protocol tcp control-code 2 2 MAC access-list jerry: permit any 00-30-29-94-34-de ethertype 800 IP extended access-list A6: deny tcp any any control-flag 2 2...
Page 321: Snmp-Server Community
Command Function snmp-server location Sets the system location string snmp-server host Specifies the recipient of an SNMP notification operation snmp-server enable traps Enables the device to send SNMP traps (i.e., SNMP notifications) show snmp Displays the status of SNMP communications snmp-server Enables the SNMPv3 server snmp-server engineID...
Page 322: Snmp-Server Contact
Command Line Interface Example Console(config)#snmp-server community alpha rw Console(config)# snmp-server contact This command sets the system contact string. Use the no form to remove the system contact information. Syntax snmp-server contact string no snmp-server contact string - String that describes the system contact information. (Maximum length: 255 characters) Default Setting None...
Page 323: Snmp-Server Host
Example Console(config)#snmp-server location WC-19 Console(config)# Related Commands snmp-server contact (4-110) snmp-server host This command specifies the recipient of a Simple Network Management Protocol notification operation. Use the no form to remove the specified host. Syntax snmp-server host host-addr community-string [version {1 | 2c}] [udp-port port] no snmp-server host host-addr - host-addr - Internet address of the host (the targeted recipient).
Page 324: Snmp-Server Enable Traps
Command Line Interface Example Console(config)#snmp-server host 10.1.19.23 batman Console(config)# Related Commands snmp-server enable traps (4-112) snmp-server enable traps This command enables this device to send Simple Network Management Protocol traps (SNMP notifications). Use the no form to disable SNMP notifications. Syntax [no] snmp-server enable traps [authentication | link-up-down] •...
Page 325: Show Snmp
show snmp This command checks the status of SNMP communications. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage This command provides information on the community access strings, counter information for SNMP input and output protocol data units, and whether or not SNMP logging has been enabled with the snmp-server enable traps command.
Page 326: Snmp-Server
Command Line Interface snmp-server Use this command to enable the SNMP v3 engine. Use the no form to disable the engine. Default Setting Enabled Command Mode Global Configuration Example Console(config)#snmp-server Console(config)# snmp-server engine-id Use this command to configure an identification string for the SNMP v3 engine. Use the no form to restore the default.
Page 327: Show Snmp Engine-Id
show snmp engine-id Use this command to show the SNMP engine ID. Command Mode Privileged Exec Example This example shows the default engine ID. Console#show snmp engine-id Local SNMP engineID: 8000002a8000000000e8666672 Local SNMP engineBoots: 1 Field Description Local SNMP engineID String identifying the engine ID.
Page 328: Show Snmp View
Command Line Interface Examples This view includes MIB-2. Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included Console(config)# This view includes the MIB-2 interfaces table, ifDescr. The wildcard is used to select all the index values in this table. Console(config)#snmp-server view ifEntry.2 1.3.6.1.2.1.2.2.1.*.2 included Console(config)# This view includes the MIB-2 interfaces table, and the mask selects all index entries.
Page 329: Snmp-Server Group
snmp-server group Use this command to add an SNMP group, mapping SNMP users to SNMP views. Use the no form to remove an SNMP group. Syntax snmp-server group groupname {v1 | v2c | v3 {auth | noauth | priv}} [read readview] [write writeview] no snmp-server group groupname •...
Page 330 Command Line Interface Example Console#show snmp group groupname: r&d security model: v3 readview: v2defaultview writeview: daily notifyview: none storage-type: permanent row status: active groupname: DefaultROGroup security model: v1 readview: v2defaultview writeview: none notifyview: none storage-type: permanent row status: active groupname: DefaultROGroup security model: v2c readview: v2defaultview writeview: none...
Page 331: Snmp-Server User
snmp-server user Use this command to add a user to an SNMP group, restricting the user to a specific SNMP Read and a Write View. Use the no form to remove a user from an SNMP group. Syntax snmp-server user username groupname {v1 | v2c | v3 [encrypted] [auth {md5 | sha} auth-password [priv des56 priv-password]] no snmp-server user username •...
Page 332: Dhcp Commands
Command Line Interface Example Console#show snmp user EngineId: 01000000000000000000000000 User Name: steve Authentication Protocol: md5 Privacy Protocol: des56 Storage Type: nonvolatile Row Status: active Console# Field Description EngineId String identifying the engine ID. User Name Name of user connecting to the SNMP agent. Authentication Protocol The authentication protocol used with SNMPv3.
Page 333: Ip Dhcp Restart Client
Command Mode Interface Configuration (VLAN) Command Usage This command is used to include a client identifier in all communications with the DHCP server. The identifier type depends on the requirements of your DHCP server. Example Console(config)#interface vlan 2 Console(config-if)#ip dhcp client-identifier hex 00-00-e8-66-65-72 Console(config-if)# Related Commands ip dhcp restart client (4-121)
Page 334: Dns Commands
Command Line Interface DNS Commands These commands are used to configure Domain Naming System (DNS) services. You can manually configure entries in the DNS domain name to IP address mapping table, configure default domain names, or specify one or more name servers to use for domain name to address translation.
Page 335: Clear Host
Command Usage Servers or other network devices may support one or more connections via multiple IP addresses. If more than one IP address is associated with a host name using this command, a DNS client can try each address in succession, until it establishes a connection with the target device.
Page 336: Ip Domain-List
Command Line Interface Default Setting None Command Mode Global Configuration Example Console(config)#ip domain-name sample.com Console(config)#end Console#show dns Domain Lookup Status: DNS disabled Default Domain Name: .sample.com Domain Name List: Name Server List: Console# Related Commands ip domain-list (4-124) ip name-server (4-125) ip domain-lookup (4-126) ip domain-list This command defines a list of domain names that can be appended to incomplete...
Page 337: Ip Name-Server
Example This example adds two domain names to the current list and then displays the list. Console(config)#ip domain-list sample.com.jp Console(config)#ip domain-list sample.com.uk Console(config)#end Console#show dns Domain Lookup Status: DNS disabled Default Domain Name: .sample.com Domain Name List: .sample.com.jp .sample.com.uk Name Server List: Console# Related Commands ip domain-name (4-123)
Page 338: Ip Domain-Lookup
Command Line Interface Example This example adds two domain-name servers to the list and then displays the list. Console(config)#ip domain-server 192.168.1.55 10.1.0.55 Console(config)#end Console#show dns Domain Lookup Status: DNS disabled Default Domain Name: .sample.com Domain Name List: .sample.com.jp .sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console#...
Page 339: Show Hosts
Example This example enables DNS and then displays the configuration. Console(config)#ip domain-lookup Console(config)#end Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: .sample.com Domain Name List: .sample.com.jp .sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# Related Commands ip domain-name (4-123) ip name-server (4-125) show hosts This command displays the static host name-to-address mapping table.
Page 340: Show Dns Cache
Command Line Interface Example Console#show dns Domain Lookup Status: DNS enabled Default Domain Name: sample.com Domain Name List: sample.com.jp sample.com.uk Name Server List: 192.168.1.55 10.1.0.55 Console# show dns cache This command displays entries in the DNS cache. Command Mode Privileged Exec Example Console#show dns cache FLAG...
Page 341: Interface Commands
Example Console#clear dns cache Console#show dns cache FLAG TYPE Console# Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN. Command Function interface Configures an interface type and enters interface configuration mode description Adds a description to an interface configuration...
Page 342: Interface
Command Line Interface interface This command configures an interface type and enter interface configuration mode. Use the no form to remove a trunk. Syntax interface interface no interface port-channel channel-id interface • ethernet unit/port - unit - This is device 1. - port - Port number.
Page 343: Description
description This command adds a description to an interface. Use the no form to remove the description. Syntax description string no description string - Comment or a description to help you remember what is attached to this interface. (Range: 1-64 characters) Default Setting None Command Mode...
Page 344: Negotiation
Command Line Interface Command Usage • To force operation to the speed and duplex mode specified in a speed-duplex command, use the no negotiation command to disable auto-negotiation on the selected interface. • When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command.
Page 345: Capabilities
Example The following example configures port 11 to use autonegotiation. Console(config)#interface ethernet 1/11 Console(config-if)#negotiation Console(config-if)# Related Commands capabilities (4-133) speed-duplex (4-131) capabilities This command advertises the port capabilities of a given interface during autonegotiation. Use the no form with parameters to remove an advertised capability, or the no form without parameters to restore the default values.
Page 346: Flowcontrol
Command Line Interface Example The following example configures Ethernet port 5 capabilities to 100half, 100full and flow control. Console(config)#interface ethernet 1/5 Console(config-if)#capabilities 100half Console(config-if)#capabilities 100full Console(config-if)#capabilities flowcontrol Console(config-if)# Related Commands negotiation (4-132) speed-duplex (4-131) flowcontrol (4-134) flowcontrol This command enables flow control. Use the no form to disable flow control. Syntax [no] flowcontrol Default Setting...
Page 347: Combo-Forced-Mode
Example The following example enables flow control on port 5. Console(config)#interface ethernet 1/5 Console(config-if)#flowcontrol Console(config-if)#no negotiation Console(config-if)# Related Commands negotiation (4-132) capabilities (flowcontrol, symmetric) (4-133) combo-forced-mode This command forces the port type selected for combination ports 21 - 24. Use the no form to restore the default mode.
Page 348: Switchport Broadcast Packet-Rate
Command Line Interface Default Setting All interfaces are enabled. Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage This command allows you to disable a port due to abnormal behavior (e.g., excessive collisions), and then reenable it after the problem has been resolved.
Page 349: Clear Counters
Example The following shows how to configure broadcast storm control at 600 packets per second: Console(config)#interface ethernet 1/5 Console(config-if)#switchport broadcast packet-rate 600 Console(config-if)# clear counters This command clears statistics on an interface. Syntax clear counters interface interface • ethernet unit/port - unit - This is device 1.
Page 350: Show Interfaces Status
Command Line Interface show interfaces status This command displays the status for an interface. Syntax show interfaces status [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) •...
Page 351: Show Interfaces Counters
show interfaces counters This command displays interface statistics. Syntax show interfaces counters [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) Default Setting Shows the counters for all interfaces. Command Mode Normal Exec, Privileged Exec Command Usage...
Page 352: Show Interfaces Switchport
Command Line Interface show interfaces switchport This command displays the administrative and operational status of the specified interfaces. Syntax show interfaces switchport [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) Default Setting Shows all interfaces.
Page 353: Mirror Port Commands
Table 4-43. Interfaces Switchport Parameters Field Description Acceptable frame type Shows if acceptable VLAN frames include all types or tagged frames only (page 4-183). Native VLAN Indicates the default Port VLAN ID (page 4-184). Priority for untagged traffic Indicates the default priority for untagged frames (page 4-197). Gvrp status Shows if GARP VLAN Registration Protocol is enabled or disabled (page 4-194).
Page 354: Show Port Monitor
Command Line Interface Command Usage • You can mirror traffic from any source port to a destination port for real-time analysis. You can then attach a logic analyzer or RMON probe to the destination port and study the traffic crossing the source port in a completely unobtrusive manner.
Page 355: Amap Configuration
Example The following shows mirroring configured from port 6 to port 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 Console(config-if)#end Console#show port monitor Port Mirroring ------------------------------------- Destination port(listen port):Eth1/1 Source port(monitored port) Mode Console# AMAP Configuration The AMAP protocol discovers adjacent switches by sending and receiving AMAP “Hello”...
Page 356: Amap Enable
Command Line Interface amap enable This command enables AMAP on the switch. Use the amap disable command to disable the feature. Syntax amap {enable | disable} • enable – Enables AMAP • disable – Disables AMAP Default Setting Enabled Command Mode Global Configuration Example Console(config)#amap enable...
Page 357: Amap Common Timer
Command Mode Global Configuration Example Console(config)#amap discovery timer 3000 Console(config)# amap common timer This command sets the time (in seconds) that switch ports in the Common state wait before sending a “Hello” packet to an adjacent switch. If there is no reply packet from an adjacent switch after two timeout intervals, the switch entry for the port will be removed and port will revert to the Discovery state.
Page 358: Rate Limit Commands
Command Line Interface Rate Limit Commands This function allows the network manager to control the maximum rate for traffic transmitted or received on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic into or out of the network. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped.
Page 359: Link Aggregation Commands
Link Aggregation Commands Ports can be statically grouped into an aggregate link (i.e., trunk) to increase the bandwidth of a network connection or to ensure fault recovery. Or you can use the Link Aggregation Control Protocol (LACP) to automatically negotiate a trunk link between this switch and another network device.
Page 360: Channel-Group
Command Line Interface Dynamically Creating a Port Channel – Ports assigned to a common port channel must meet the following criteria: • Ports must have the same LACP system priority. • Ports must have the same port admin key (Ethernet Interface). •...
Page 361: Lacp
lacp This command enables 802.3ad Link Aggregation Control Protocol (LACP) for the current interface. Use the no form to disable it. Syntax [no] lacp Default Setting Disabled Command Mode Interface Configuration (Ethernet) Command Usage • The ports on both ends of an LACP trunk must be configured for full duplex, either by forced mode or auto-negotiation.
Page 362: Lacp System-Priority
Command Line Interface Example The following shows LACP enabled on ports 11-13. Because LACP has also been enabled on the ports at the other end of the links, the show interfaces status port-channel 1 command shows that Trunk1 has been established. Console(config)#interface ethernet 1/11 Console(config-if)#lacp Console(config-if)#exit...
Page 363: Lacp Admin-Key (Ethernet Interface)
Command Usage • Port must be configured with the same system priority to join the same LAG. • System priority is combined with the switch’s MAC address to form the LAG identifier. This identifier is used to indicate a specific LAG during LACP negotiations with other systems.
Page 364: Lacp Admin-Key (Port Channel)
Command Line Interface • Once the remote side of a link has been established, LACP operational settings are already in use on that side. Configuring LACP settings for the partner only applies to its administrative state, not its operational state, and will only take effect the next time an aggregate link is established with the partner.
Page 365: Lacp Port-Priority
lacp port-priority This command configures LACP port priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} port-priority priority no lacp {actor | partner} port-priority • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. •...
Page 366 Command Line Interface Default Setting Port Channel: all Command Mode Privileged Exec Example Console#show lacp 1 counters Channel group : 1 ------------------------------------------------------------------------- Eth 1/ 1 ------------------------------------------------------------------------- LACPDUs Sent : 21 LACPDUs Received : 21 Marker Sent : 0 Marker Received : 0 LACPDUs Unknown Pkts : 0 LACPDUs Illegal Pkts : 0 Field...
Page 367 Field Description Oper Key Current operational value of the key for the aggregation port. Admin Key Current administrative value of the key for the aggregation port. LACPDUs Internal Number of seconds before invalidating received LACPDU information. LACP System Priority LACP system priority assigned to this port channel. LACP Port Priority LACP port priority assigned to this interface within the channel group.
Page 368 Command Line Interface Table 4-50. LACP Neighbours Information Field Description Partner Admin System ID LAG partner’s system ID assigned by the user. Partner Oper System ID LAG partner’s system ID assigned by the LACP protocol. Partner Admin Current administrative value of the port number for the protocol Partner. Port Number Partner Oper Operational port number assigned to this aggregation port by the port’s protocol...
Page 369: Address Table Commands
Address Table Commands These commands are used to configure the address table for filtering specified addresses, displaying current entries, clearing the table, or setting the aging time. Command Function mac-address-table static Maps a static address to a port in a VLAN clear mac-address-table Removes any learned entries from the forwarding database PE dynamic...
Page 370: Clear Mac-Address-Table Dynamic
Command Line Interface Command Usage The static address for a host device can be assigned to a specific port within a specific VLAN. Use this command to add static addresses to the MAC Address Table. Static addresses have the following characteristics: •...
Page 371: Mac-Address-Table Aging-Time
Default Setting None Command Mode Privileged Exec Command Usage • The MAC Address Table contains the MAC addresses associated with each interface. Note that the Type field may include the following types: - Learned - Dynamic address entries - Permanent - Static entry - Delete-on-reset - Static entry to be deleted when system is reset •...
Page 372: Show Mac-Address-Table Aging-Time
Command Line Interface Example Console(config)#mac-address-table aging-time 100 Console(config)# show mac-address-table aging-time This command shows the aging time for entries in the address table. Default Setting None Command Mode Privileged Exec Example Console#show mac-address-table aging-time Aging time: 300 sec. Console# Spanning Tree Commands This section includes commands that configure the Spanning Tree Algorithm (STA) globally for the switch, and commands that configure STA for the selected interface.
Page 373: Spanning-Tree
Command Function spanning-tree Disables spanning tree for an interface spanning-disabled spanning-tree cost Configures the spanning tree path cost of an interface spanning-tree port-priority Configures the spanning tree priority of an interface spanning-tree edge-port Enables fast forwarding for edge ports spanning-tree portfast Sets an interface to fast forwarding spanning-tree link-type Configures the link type for RSTP/MSTP...
Page 374: Spanning-Tree Mode
Command Line Interface Example This example shows how to enable the Spanning Tree Algorithm for the switch: Console(config)#spanning-tree Console(config)# spanning-tree mode This command selects the spanning tree mode for this switch. Use the no form to restore the default. Syntax spanning-tree mode {stp | rstp no spanning-tree mode •...
Page 375: Spanning-Tree Forward-Time
• Multiple Spanning Tree Protocol - To allow multiple spanning trees to operate over the network, you must configure a related set of bridges with the same MSTP configuration, allowing them to participate in a specific set of spanning tree instances. - A spanning tree instance can exist only on bridges that have compatible VLAN instance assignments.
Page 376: Spanning-Tree Hello-Time
Command Line Interface spanning-tree hello-time This command configures the spanning tree bridge hello time globally for this switch. Use the no form to restore the default. Syntax spanning-tree hello-time time no spanning-tree hello-time time - Time in seconds. (Range: 1-10 seconds). The maximum value is the lower of 10 or [(max-age / 2) -1].
Page 377: Spanning-Tree Priority
Command Usage This command sets the maximum time (in seconds) a device can wait without receiving a configuration message before attempting to reconfigure. All device ports (except for designated ports) should receive configuration messages at regular intervals. Any port that ages out STA information (provided in the last configuration message) becomes the designated port for the attached LAN.
Page 378: Spanning-Tree Pathcost Method
Command Line Interface spanning-tree pathcost method This command configures the path cost method used for Rapid Spanning Tree and Multiple Spanning Tree. Use the no form to restore the default. Syntax spanning-tree pathcost method {long | short} no spanning-tree pathcost method •...
Page 379: Spanning-Tree Mst-Configuration
Example Console(config)#spanning-tree transmission-limit 4 Console(config)# spanning-tree mst-configuration Use this command to change to Multiple Spanning Tree (MST) configuration mode. Default Setting • No VLANs are mapped to any MST instance. • The region name is set the switch’s MAC address. Command Mode Global Configuration Example...
Page 380: Mst Priority
Command Line Interface Command Usage • Use this command to group VLANs into spanning tree instances. MSTP generates a unique spanning tree for each instance. This provides multiple pathways across the network, thereby balancing the traffic load, preventing wide-scale disruption when a bridge node in a single instance fails, and allowing for faster convergence of a new topology for the failed instance.
Page 381: Name
• You can set this switch to act as the MSTI root device by specifying a priority of 0, or as the MSTI alternate device by specifying a priority of 16384. Example Console(config-mstp)#mst 1 priority 4096 Console(config-mstp)# name This command configures the name for the multiple spanning tree region in which this switch is located.
Page 382: Max-Hops
Command Line Interface Command Mode MST Configuration Command Usage The MST region name (page 4-169) and revision number are used to designate a unique MST region. A bridge (i.e., spanning-tree compliant device such as this switch) can only belong to one MST region. And all bridges in the same region must be configured with the same MST instances.
Page 383: Spanning-Tree Spanning-Disabled
spanning-tree spanning-disabled This command disables the spanning tree algorithm for the specified interface. Use the no form to reenable the spanning tree algorithm for the specified interface. Syntax [no] spanning-tree spanning-disabled Default Setting Enabled Command Mode Interface Configuration (Ethernet, Port Channel) Example This example disables the spanning tree algorithm for port 5.
Page 384: Spanning-Tree Port-Priority
Command Line Interface • Path cost takes precedence over port priority. • When the spanning-tree pathcost method (page 4-166) is set to short, the maximum value for path cost is 65,535. Example Console(config)#interface ethernet 1/5 Console(config-if)#spanning-tree cost 50 Console(config-if)# spanning-tree port-priority This command configures the priority for the specified interface.
Page 385: Spanning-Tree Portfast
Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.
Page 386: Spanning-Tree Link-Type
Command Line Interface • Since end-nodes cannot cause forwarding loops, they can be passed through the spanning tree state changes more quickly than allowed by standard convergence time. Fast forwarding can achieve quicker convergence for end-node workstations and servers, and also overcome other STA related timeout problems.
Page 387: Spanning-Tree Mst Cost
Example Console(config)#interface ethernet ethernet 1/5 Console(config-if)#spanning-tree link-type point-to-point spanning-tree mst cost This command configures the path cost on a spanning instance in the Multiple Spanning Tree. Use the no form to restore the default. Syntax spanning-tree mst instance_id cost cost no spanning-tree mst instance_id cost •...
Page 388: Spanning-Tree Mst Port-Priority
Command Line Interface spanning-tree mst port-priority This command configures the interface priority on a spanning instance in the Multiple Spanning Tree. Use the no form to restore the default. Syntax spanning-tree mst instance_id port-priority priority no spanning-tree mst instance_id port-priority •...
Page 389: Show Spanning-Tree
Command Mode Privileged Exec Command Usage If at any time the switch detects STP BPDUs, including Configuration or Topology Change Notification BPDUs, it will automatically set the selected interface to forced STP-compatible mode. However, you can also use the spanning-tree protocol-migration command at any time to manually re-check the appropriate BPDU format to send on the selected interfaces (i.e., RSTP or STP-compatible).
Page 390: Show Spanning-Tree Mst Configuration
Command Line Interface • For a description of the items displayed under “Spanning-tree information,” see “Configuring Global Settings” on page 3-107. For a description of the items displayed for specific interfaces, see “Displaying Interface Settings” on page 3-111. Example Console#show spanning-tree Spanning-tree information --------------------------------------------------------------- Spanning tree mode...
Page 391: Vlan Commands
Command Mode Privileged Exec Example Console#show spanning-tree mst configuration Mstp Configuration Information -------------------------------------------------------------- Configuration name:00 30 f1 ab 77 7c Revision level:0 Instance Vlans -------------------------------------------------------------- 1-4094 Console# VLAN Commands A VLAN is a group of ports that can be located anywhere in the network, but communicate as though they belong to the same physical segment.
Page 392: Vlan Database
Command Line Interface vlan database This command enters VLAN database mode. All commands in this mode will take effect immediately. Default Setting None Command Mode Global Configuration Command Usage • Use the VLAN database command mode to add, change, and delete VLANs. After finishing configuration changes, you can display the VLAN settings by entering the show vlan command.
Page 393: Configuring Vlan Interfaces
Command Mode VLAN Database Configuration Command Usage • no vlan vlan-id deletes the VLAN. • no vlan vlan-id name removes the VLAN name. • no vlan vlan-id state returns the VLAN to the default state (i.e., active). • You can configure up to 255 VLANs on the switch. Example The following example adds a VLAN, using VLAN ID 105 and name RD5.
Page 394: Switchport Mode
Command Line Interface Default Setting None Command Mode Global Configuration Example The following example shows how to set the interface configuration mode to VLAN 1, and then assign an IP address to the VLAN: Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.254 255.255.255.0 Console(config-if)# Related Commands shutdown (4-135)
Page 395: Switchport Acceptable-Frame-Types
Related Commands switchport acceptable-frame-types (4-183) switchport acceptable-frame-types This command configures the acceptable frame types for a port. Use the no form to restore the default. Syntax switchport acceptable-frame-types {all | tagged} no switchport acceptable-frame-types • all - The port accepts all frames, tagged or untagged. •...
Page 396: Switchport Native Vlan
Command Line Interface Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Ingress filtering only affects tagged frames. • If ingress filtering is disabled and a port receives frames tagged for VLANs for which it is not a member, these frames will be flooded to all other ports (except for those VLANs explicitly forbidden on this port).
Page 397: Switchport Allowed Vlan
Example The following example shows how to set the PVID for port 1 to VLAN 3: Console(config)#interface ethernet 1/1 Console(config-if)#switchport native vlan 3 Console(config-if)# switchport allowed vlan This command configures VLAN groups on the selected interface. Use the no form to restore the default.
Page 398: Switchport Forbidden Vlan
Command Line Interface Example The following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as tagged VLANs for port 1: Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 1,2,5,6 tagged Console(config-if)# switchport forbidden vlan This command configures forbidden VLANs.
Page 399: Displaying Vlan Information
Displaying VLAN Information Table 4-57. Displaying VLAN Information Command Function show vlan Shows VLAN information show interfaces status vlan Displays status for the specified VLAN interface show interfaces switchport Displays the administrative and operational status of an interface show vlan This command shows VLAN information.
Page 400: Protocol-Vlan Protocol-Group (Configuring Groups)
Command Line Interface When a frame is received at a port, its VLAN membership can then be determined based on the protocol type in use by the inbound packets. Command Function protocol-vlan protocol-group Create a protocol group, specifying the supported protocols GC protocol-vlan protocol-group Maps a protocol group to a VLAN show protocol-vlan Shows the configuration of protocol groups...
Page 401: Protocol-Vlan Protocol-Group (Configuring Interfaces)
Example The following creates protocol group 1, and specifies Ethernet frames with IP and ARP protocol types: Console(config)#protocol-vlan protocol-group 1 add frame-type ethernet protocol-type ip Console(config)#protocol-vlan protocol-group 1 add frame-type ethernet protocol-type arp Console(config)# protocol-vlan protocol-group (Configuring Interfaces) This command maps a protocol group to a VLAN for the current interface. Use the no form to remove the protocol mapping for this interface.
Page 402: Show Protocol-Vlan Protocol-Group
Command Line Interface Example The following example maps the traffic entering Port 1 which matches the protocol type specified in protocol group 1 to VLAN 2. Console(config)#interface ethernet 1/1 Console(config-if)#protocol-vlan protocol-group 1 vlan 2 Console(config-if)# show protocol-vlan protocol-group This command shows the frame and protocol type associated with protocol groups. Syntax show protocol-vlan protocol-group [group-id] group-id - Group identifier for a protocol group.
Page 403: Configuring Private Vlans
Command Mode Privileged Exec Example This shows that traffic entering Port 1 that matches the specifications for protocol group 1 will be mapped to VLAN 2: Console#show interfaces protocol-vlan protocol-group Port ProtocolGroup ID ---------- ------------------ ----------- Eth 1/1 Console# Configuring Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN.
Page 404: Show Pvlan
Command Line Interface • Entering the pvlan command without any parameters enables the private VLAN. Entering no pvlan disables the private VLAN. Example This example enables the private VLAN, and then sets port 24 as the uplink and ports 1-8 as the downlinks. Console(config)#pvlan Console(config)#pvlan up-link ethernet 1/24 down-link ethernet 1/1-8 Console(config)#...
Page 405: Bridge-Ext Gvrp
bridge-ext gvrp This command enables GVRP globally for the switch. Use the no form to disable it. Syntax [no] bridge-ext gvrp Default Setting Disabled Command Mode Global Configuration Command Usage GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network.
Page 406: Switchport Gvrp
Command Line Interface switchport gvrp This command enables GVRP for a port. Use the no form to disable it. Syntax [no] switchport gvrp Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Example Console(config)#interface ethernet 1/1 Console(config-if)#switchport gvrp Console(config-if)# show gvrp configuration This command shows if GVRP is enabled.
Page 407: Garp Timer
garp timer This command sets the values for the join, leave and leaveall timers. Use the no form to restore the timers’ default values. Syntax garp timer {join | leave | leaveall} timer_value no garp timer {join | leave | leaveall} •...
Page 408: Show Garp Timer
Command Line Interface show garp timer This command shows the GARP timers for the selected interface. Syntax show garp timer [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) Default Setting Shows all GARP timers.
Page 409: Priority Commands
Priority Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with eight priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.
Page 410: Queue Mode
Command Line Interface Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • The default priority applies for an untagged frame received on a port set to accept all frame types (i.e, receives both untagged and tagged frames).
Page 411: Queue Bandwidth
Command Usage You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue.
Page 412: Queue Cos-Map
Command Line Interface queue cos-map This command assigns class of service (CoS) values to the priority queues (i.e., hardware output queues 0 - 7). Use the no form set the CoS map to the default values. Syntax queue cos-map queue_id [cos1 ... cosn] no queue cos-map •...
Page 413: Show Queue Mode
Related Commands show queue cos-map (4-202) show queue mode This command shows the current queue mode. Default Setting None Command Mode Privileged Exec Example Console#sh queue mode Queue mode: strict Console# show queue bandwidth This command displays the weighted round-robin (WRR) bandwidth allocation for the eight priority queues.
Page 414: Show Queue Cos-Map
Command Line Interface show queue cos-map This command shows the class of service priority map. Syntax show queue cos-map [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) Default Setting None Command Mode...
Page 415: Map Ip Port (Global Configuration)
map ip port (Global Configuration) Use this command to enable IP port mapping (i.e., class of service mapping for TCP/UDP sockets). Use the no form to disable IP port mapping. Syntax [no] map ip port Default Setting Disabled Command Mode Global Configuration Command Usage The precedence for priority mapping is IP Port, IP Precedence or IP DSCP,...
Page 416: Map Ip Precedence (Global Configuration)
Command Line Interface Example The following example shows how to map HTTP traffic to CoS value 0: Console(config)#interface ethernet 1/5 Console(config-if)#map ip port 80 cos 0 Console(config-if)# map ip precedence (Global Configuration) This command enables IP precedence mapping (i.e., IP Type of Service). Use the no form to disable IP precedence mapping.
Page 417: Map Ip Dscp (Global Configuration)
Default Setting The list below shows the default priority mapping. IP Precedence Value CoS Value Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. •...
Page 418: Map Ip Dscp (Interface Configuration)
Command Line Interface Example The following example shows how to enable IP DSCP mapping globally: Console(config)#map ip dscp Console(config)# map ip dscp (Interface Configuration) This command sets IP DSCP priority (i.e., Differentiated Services Code Point priority). Use the no form to restore the default table. Syntax map ip dscp dscp-value cos cos-value no map ip dscp...
Page 419: Map Access-List Ip
Example The following example shows how to map IP DSCP value 1 to CoS value 0: Console(config)#interface ethernet 1/5 Console(config-if)#map ip dscp 1 cos 0 Console(config-if)# map access-list ip This command sets the output queue for packets matching an ACL rule. The specified CoS value is only used to map the matching packet to an output queue;...
Page 420: Show Map Ip Port
Command Line Interface show map ip port Use this command to show the IP port priority map. Syntax show map ip port [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number. • port-channel channel-id (Range: 1-6) Default Setting None Command Mode...
Page 421: Show Map Ip Dscp
Command Mode Privileged Exec Example Console#show map ip precedence ethernet 1/5 Precedence mapping status: disabled Port Precedence COS --------- ---------- --- Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Eth 1/ 5 Console# Related Commands...
Page 422: Quality Of Service Commands
Command Line Interface Example Console#show map ip dscp ethernet 1/1 DSCP mapping status: disabled Port DSCP COS --------- ---- --- Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Eth 1/ 1 Console# Related Commands map ip dscp (Global Configuration) (4-205)
Page 423: Class-Map
To create a service policy for a specific category or ingress traffic, follow these steps: Use the class-map command to designate a class name for a specific category of traffic, and enter the Class Map configuration mode. Use the match command to select a specify type of traffic based on an access list, a list of DSCP or IP Precedence values, or a list of VLANs.
Page 424: Match
Command Line Interface • The class map is used with a policy map (page 4-213) to create a service policy (page 4-216) for a specific interface that defines packet classification, service tagging, and bandwidth policing. • After entering the Class Map configuration mode, use the match command (page 4-212) to specify the required classification criteria.
Page 425: Policy-Map
Example This example creates a class map called “rd-class,” and sets it to match packets marked for DSCP service value 3: Console(config)#class-map rd_class Console(config-cmap)#match ip dscp 3 Console(config-cmap)# policy-map This command creates a policy map that can be attached to multiple interfaces, and enters Policy Map configuration mode.
Page 426: Class
Command Line Interface class This command defines a traffic classification upon which a policy can act, and enters Policy Map Class configuration mode. Use the no form to delete a class map and return to Policy Map configuration mode. Syntax [no] class class-map-name class-map-name - Name of the class map.
Page 427: Police
Default Setting None Command Mode Policy Map Class Configuration Example This example sets the DSCP value to 3 for all traffic assigned to this policy class. Console(config)#policy-map rd_policy Console(config-pmap-c)#class rd_class Console(config-pmap-c)#set ip dscp 3 Console(config-pmap-c)# police This command defines an policer for classified traffic. Use the no form to remove a policer.
Page 428: Service-Policy
Command Line Interface Example This example creates a policer that sets the maximum burst rate to 20 Kbytes, the average rate to 1522 bps, and the response to drop any violating packets. Console(config)#policy-map rd_policy Console(config-pmap)#class rd_class Console(config-pmap-c)#set ip dscp 3 Console(config-pmap-c)#police 1000 1522 exceed-action drop Console(config-pmap-c)# service-policy...
Page 429: Show Policy-Map
Command Mode Privileged Exec Example Console#show class-map Class Map match-any rd_class Match ip dscp 3 Console# show policy-map This command displays the QoS policy maps which define classification criteria for incoming traffic, and may include policers for bandwidth limitations. Syntax show policy-map [policy-map-name [class class-map-name]] •...
Page 430: Multicast Filtering Commands
Command Line Interface Command Mode Privileged Exec Example Console#show policy-map ethernet 1/1 Policy Map rd_policy class rd_class set ip dscp 3 Console# Multicast Filtering Commands This switch uses IGMP (Internet Group Management Protocol) to query for any attached hosts that want to receive a specific multicast service. It identifies the ports containing hosts requesting a service and sends data out to those ports only.
Page 431: Ip Igmp Snooping Vlan Static
Default Setting Enabled Command Mode Global Configuration Example The following example enables IGMP snooping. Console(config)#ip igmp snooping Console(config)# ip igmp snooping vlan static This command adds a port to a multicast group. Use the no form to remove the port. Syntax [no] ip igmp snooping vlan vlan-id static ip-address interface •...
Page 432: Ip Igmp Snooping Version
Command Line Interface ip igmp snooping version This command configures the IGMP snooping version. Use the no form to restore the default. Syntax ip igmp snooping version {1 | 2} no ip igmp snooping version • 1 - IGMP Version 1 •...
Page 433: Show Mac-Address-Table Multicast
Example The following shows the current IGMP snooping configuration: Console#show ip igmp snooping Service status: Enabled Querier status: Enabled Query count: 2 Query interval: 125 sec Query max response time: 10 sec Router port expire time: 300 sec IGMP snooping version: Version 2 Console# show mac-address-table multicast This command shows known multicast addresses.
Page 434: Igmp Query Commands (Layer 2)
Command Line Interface IGMP Query Commands (Layer 2) Table 4-70. IGMP Query Commands (Layer 2) Command Function ip igmp snooping querier Allows this device to act as the querier for IGMP snooping GC ip igmp snooping Configures the query count query-count ip igmp snooping Configures the query interval...
Page 435: Ip Igmp Snooping Query-Interval
Default Setting 2 times Command Mode Global Configuration Command Usage The query count defines how long the querier waits for a response from a multicast client before taking action. If a querier has sent a number of queries defined by this command, but a client has not responded, a countdown timer is started using the time defined by ip igmp snooping query-max- response-time.
Page 436: Ip Igmp Snooping Query-Max-Response-Time
Command Line Interface ip igmp snooping query-max-response-time This command configures the query report delay. Use the no form to restore the default. Syntax ip igmp snooping query-max-response-time seconds no ip igmp snooping query-max-response-time seconds - The report delay advertised in IGMP queries. (Range: 5-30) Default Setting 10 seconds Command Mode...
Page 437: Static Multicast Routing Commands
Default Setting 300 seconds Command Mode Global Configuration Command Usage The switch must use IGMPv2 for this command to take effect. Example The following shows how to configure the default timeout to 300 seconds: Console(config)#ip igmp snooping router-port-expire-time 300 Console(config)# Related Commands ip igmp snooping version (4-220) Static Multicast Routing Commands...
Page 438: Show Ip Igmp Snooping Mrouter
Command Line Interface Command Usage Depending on your network connections, IGMP snooping may not always be able to locate the IGMP querier. Therefore, if the IGMP querier is a known multicast router/switch connected over the network to an interface (port or trunk) on your router, you can manually configure that interface to join all the current multicast groups.
Page 439: Ip Interface Commands
IP Interface Commands There are no IP addresses assigned to this switch by default. You must manually configure a new address to manage the switch over your network or to connect the switch to existing IP subnets. You may also need to a establish a default gateway between this device and management stations or other devices that exist on another network segment.
Page 440: Ip Default-Gateway
Command Line Interface Command Usage • You must assign an IP address to this device to gain management access over the network or to connect the switch to existing IP subnets. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server.
Page 441: Ip Dhcp Restart
Example The following example defines a default gateway for this device: Console(config)#ip default-gateway 10.1.1.254 Console(config)# Related Commands show ip redirects (4-230) ip dhcp restart Use this command to submit a BOOTP or DCHP client request. Default Setting None Command Mode Privileged Exec Command Usage •...
Page 442: Show Ip Redirects
Command Line Interface Command Mode Privileged Exec Example Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: User specified. Console# Related Commands show ip redirects (4-230) show ip redirects This command shows the default gateway configured for this device. Default Setting None Command Mode...
Page 443 Command Usage • Use the ping command to see if another site on the network can be reached. • Following are some results of the ping command: - Normal response - The normal response occurs in one to ten seconds, depending on network traffic.
Page 444 Command Line Interface 4-232...
Page 445: Appendix A: Software Specifications
Appendix A: Software Specifications Software Features Authentication Local, RADIUS, TACACS, Port (802.1x), HTTPS, SSH, Port Security Access Control Lists IP, MAC (up to 32 lists) AMAP Alcatel Mapping Adjacency Protocol SNMPv3 Management access via MIB database Trap management to specified hosts DHCP Client DNS Server Port Configuration...
Page 446: Management Features
Software Specifications VLAN Support Up to 255 groups; port-based, protocol-based, or tagged (802.1Q), GVRP for automatic VLAN learning, private VLANs Class of Service Supports eight levels of priority and Weighted Round Robin Queueing (which can be configured by VLAN tag or port), Layer 3/4 priority mapping: IP Precedence, IP DSCP Multicast Filtering IGMP Snooping (Layer 2)
Page 447: Management Information Bases
Management Information Bases IEEE 802.1D Spanning Tree Protocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1s Multiple Spanning Tree Protocol IEEE 802.1w Rapid Spanning Tree Protocol IEEE 802.1x Port Authentication ARP (RFC 826) DHCP (RFC 1541) HTTPS ICMP (RFC 792) IGMP (RFC 1112) IGMPv2 (RFC 2236) RADIUS+ (RFC 2618)
Page 448 Software Specifications SNMP Target MIB, SNMP Notification MIB (RFC 2573) SNMP User-Based SM MIB (RFC 2574) SNMP View Based ACM MIB (RFC 2575) SNMP Community MIB (RFC 2576)
Page 449: Appendix B: Troubleshooting
Appendix B: Troubleshooting Symptom Action Cannot connect using Telnet, • Be sure you have configured the agent with a valid IP address, subnet Web browser, or SNMP software • If you are trying to connect to the agent via the IP address for a tagged •...
Page 450 Troubleshooting...
Page 451: Glossary
Glossary Access Control List (ACL) ACLs can limit network traffic and restrict access to certain users or devices by checking each packet for certain IP or MAC (i.e., Layer 2) information. Boot Protocol (BOOTP) used to provide bootup information for network devices, including IP BOOTP is address information, the address of the TFTP server that contains the devices system files, and the name of the boot file.
Page 452 Glossary GARP VLAN Registration Protocol (GVRP) Defines a way for switches to exchange VLAN information in order to register necessary VLAN members on ports along the Spanning Tree so that VLANs defined in each switch can work automatically over a Spanning Tree network. Generic Attribute Registration Protocol (GARP) GARP is a protocol that can be used by endstations and switches to register and propagate multicast group membership information in a switched environment so...
Page 453 Glossary IEEE 802.3x Defines Ethernet frame start/stop requests and timers used for flow control on full-duplex links. IGMP Snooping Listening to IGMP Query and IGMP Report packets transferred between IP Multicast Routers and IP Multicast host groups to identify IP Multicast group members. IGMP Query On each subnetwork, one IGMP-capable device will act as the querier —...
Page 454 Glossary Management Information Base (MIB) An acronym for Management Information Base. It is a set of database objects that contains information about a specific device. An algorithm that is used to create digital signatures. It is intended for use with 32 bit machines and is safer than the MD4 algorithm, which has been broken.
Page 455 Glossary Remote Monitoring (RMON) RMON provides comprehensive network monitoring capabilities. It eliminates the polling required in standard SNMP, and can set alarms on a variety of traffic conditions, including specific error types. Rapid Spanning Tree Protocol (RSTP) reduces the convergence time for network topology changes to about 10% of RSTP that required by the older IEEE 802.1D STP standard.
Page 456 Glossary Trivial File Transfer Protocol (TFTP) A TCP/IP protocol commonly used for software downloads. User Datagram Protocol (UDP) provides a datagram mode for packet-switched communications. It uses IP as the underlying transport mechanism to provide access to IP-like services. UDP packets are delivered just like IP packets –...
Page 457: Index
Index Numerics 802.1x, port authentication 3-54, 4-76 acceptable frame type 3-133, 4-183 Access Control List See ACL Extended IP 3-62, 4-83, 4-85, 4-87 MAC 3-62, 4-84, 4-98, 4-98–4-100 Standard IP 3-62, 4-83, 4-85, 4-86 address table 3-100, 4-157 aging time 3-102, 4-160 BOOTP 3-14, 3-15, 4-227 BPDU 3-104 broadcast storm, threshold 3-90, 4-136...
Page 458 hardware version, displaying 3-10, 4-60 HTTPS 3-45, 4-30 HTTPS, secure server 3-45, 4-30 IEEE 802.1D 3-103, 4-162 IEEE 802.1s 4-162 IEEE 802.1w 3-103, 4-162 IEEE 802.1x 3-54, 4-76 IGMP groups, displaying 3-164, 4-221 Layer 2 3-160, 4-218 query 3-160, 4-222 query, Layer 2 3-161, 4-222 snooping 3-160, 4-218 snooping, configuring 3-161, 4-218...
Page 459 problems, troubleshooting B-1 protocol migration 3-115, 4-176 queue weights 3-143, 4-199 RADIUS, logon authentication 3-42, 4-70 rate limits, setting 3-92, 4-146 remote logging 4-44 restarting the system 3-29, 4-22 RSTP 3-103, 4-162 global configuration 3-104, 4-162 secure shell 3-47, 4-32 Secure Shell configuration 3-47, 4-35, 4-36 serial port...
Page 460 VLANs 3-122–3-136, 4-179–4-192 adding static members 3-130, 3-132, 4-185 creating 3-129, 4-180 description 3-122 displaying basic information 3-126, 4-193 displaying port members 3-127, 4-187 egress mode 3-134, 4-182 Index-4 interface configuration 3-133, 4-183–4-186 private 3-135, 4-191 protocol 3-136, 4-187 Web interface access requirements 3-1 configuration buttons 3-2 home page 3-2...
Page 462 F1.0.0.6 E042004-R02 060191-10...

Alcatel OmniStack 6300-24 User Manual

Table of Contents

Figures

Chapter 1: Introduction

Chapter 2: Initial Configuration

Chapter 3: Configuring the Switch

Chapter 4: Command Line Interface

Appendix A: Software Specifications

Appendix B: Troubleshooting

Quick Links

Chapters

Related Manuals for Alcatel OmniStack 6300-24

Summary of Contents for Alcatel OmniStack 6300-24