Enterasys® SecureStack™ C3 Stackable Switches Configuration Guide Firmware Version 6.03.xx.
Notice Enterasys Networks reserves the right to make changes in specifications and other information contained in this document and its web site without prior notice. The reader should in all cases consult Enterasys Networks to determine whether any such changes have been made. The hardware, firmware, or software described in this document is subject to change without notice.
Enterasys Networks, Inc. Firmware License Agreement BEFORE OPENING OR UTILIZING THE ENCLOSED PRODUCT, CAREFULLY READ THIS LICENSE AGREEMENT. This document is an agreement (“Agreement”) between the end user (“You”) and Enterasys Networks, Inc.
If the Program is exported from the United States pursuant to the License Exception TSR under the U.S.
10. ENFORCEMENT. You acknowledge and agree that any breach of Sections 2, 4, or 9 of this Agreement by You may cause Enterasys irreparable damage for which recovery of money damages would be inadequate, and that Enterasys may be entitled to seek timely injunctive relief to protect Enterasys’ rights under this Agreement in addition to any and all remedies available at law. 11. ASSIGNMENT.
Contents About This Guide Using This Guide ..........................................................................................................................................xxxiii Structure of This Guide .................................................................................................................................xxxiii Related Documents ......................................................................................................................................
set system password history .............................................................................................................. 3-7 show system lockout .......................................................................................................................... 3-7 set system lockout .............................................................................................................................. 3-8 Setting Basic Switch Properties ........................................
Managing Switch Configuration and Files .................................................................................................... 3-39 Configuration Persistence Mode ............................................................................................................ 3-39 Purpose .................................................................................................................................................. 3-39 Commands ....................................................
Chapter 5: Configuring System Power and PoE Commands ..................................................................................................................................................... 5-1 show inlinepower ................................................................................................................................ 5-1 set inlinepower threshold....................................................................................................................
clear lldp port trap ............................................................................................................................. 6-32 clear lldp port med-trap..................................................................................................................... 6-33 clear lldp port location-info................................................................................................................ 6-33 clear lldp port network-policy ...................................
show port trap................................................................................................................................... 7-24 set port trap ...................................................................................................................................... 7-25 show linkflap ..................................................................................................................................... 7-25 set linkflap globalstate .............................
Chapter 8: SNMP Configuration SNMP Configuration Summary ...................................................................................................................... 8-1 SNMPv1 and SNMPv2c ........................................................................................................................... 8-2 SNMPv3 ...................................................................................................................................................
show snmp notify .............................................................................................................................. 8-31 set snmp notify ................................................................................................................................. 8-32 clear snmp notify .............................................................................................................................. 8-33 show snmp notifyfilter .......................................
set spantree backuproot ................................................................................................................... 9-22 clear spantree backuproot ................................................................................................................ 9-22 show spantree tctrapsuppress.......................................................................................................... 9-23 set spantree tctrapsuppress .......................................................
set spantree lptrapenable ................................................................................................................. 9-50 show spantree lptrapenable ............................................................................................................. 9-51 clear spantree lptrapenable .............................................................................................................. 9-51 set spantree disputedbpduthreshold ..............................................
clear gvrp ........................................................................................................................................ 10-24 set garp timer.................................................................................................................................. 10-24 clear garp timer...............................................................................................................................
show port priority .............................................................................................................................. 12-2 set port priority.................................................................................................................................. 12-3 clear port priority............................................................................................................................... 12-3 Configuring Priority to Transmit Queue Mapping .........
set logging server ............................................................................................................................. 14-3 clear logging server .......................................................................................................................... 14-4 show logging default......................................................................................................................... 14-4 set logging default ..............................................
clear sntp poll-timeout .................................................................................................................... 14-35 set timezone ................................................................................................................................... 14-36 show sntp interface......................................................................................................................... 14-37 set sntp interface ................................................
Chapter 16: DHCP Server Configuration DHCP Overview ........................................................................................................................................... 16-1 DHCP Relay Agent ................................................................................................................................ 16-1 DHCP Server .........................................................................................................................................
show dhcp pool configuration ......................................................................................................... 16-29 Chapter 17: DHCP Snooping and Dynamic ARP Inspection DHCP Snooping Overview ........................................................................................................................... 17-1 DHCP Message Processing ...................................................................................................................
show interface .................................................................................................................................. 19-2 interface............................................................................................................................................ 19-3 show ip interface............................................................................................................................... 19-4 ip address .............................................
split-horizon poison........................................................................................................................... 20-7 passive-interface .............................................................................................................................. 20-8 receive-interface ............................................................................................................................... 20-9 redistribute..................................................
create.............................................................................................................................................. 20-43 address........................................................................................................................................... 20-44 priority............................................................................................................................................. 20-45 advertise-interval .............................
ipv6 mtu .......................................................................................................................................... 22-12 Neighbor Cache and Neighbor Discovery Commands ............................................................................... 22-14 clear ipv6 neighbors ....................................................................................................................... 22-14 ipv6 nd dad attempts .........................................................
show ipv6 dhcp interface ................................................................................................................ 24-14 show ipv6 dhcp statistics ................................................................................................................ 24-16 clear ipv6 dhcp statistics................................................................................................................. 24-17 show ipv6 dhcp pool .........................................................
show ipv6 ospf................................................................................................................................ 25-29 show ipv6 ospf area........................................................................................................................ 25-31 show ipv6 ospf abr.......................................................................................................................... 25-32 show ipv6 ospf asbr ..................................................
clear macauthentication portquietperiod......................................................................................... 26-31 set macauthentication macinitialize ................................................................................................ 26-31 set macauthentication reauthentication .......................................................................................... 26-32 set macauthentication portreauthenticate..............................................................
set maclock agefirstarrival .............................................................................................................. 26-65 clear maclock agefirstarrival ........................................................................................................... 26-66 set maclock move ........................................................................................................................... 26-66 set maclock trap ...........................................................
clear tacacs interface...................................................................................................................... 27-12 Chapter 28: sFlow Configuration Overview ....................................................................................................................................................... 28-1 Using sFlow in Your Network ................................................................................................................. 28-1 Definitions .......
6-3 6-4 6-5 7-1 7-2 7-3 7-4 7-5 7-6 7-7 8-1 8-2 8-3 8-4 8-5 8-6 8-7 8-8 8-9 8-10 8-11 9-1 10-1 10-2 10-3 11-1 11-2 11-3 14-1 14-2 14-3 14-4 14-5 14-6 14-7 14-8 15-1 15-2 15-3 18-1 18-2 19-1 19-2 20-1 20-2 20-3 20-4 20-5 20-6 20-7 20-8 20-9 20-10 20-11 20-12 20-13 xxx show ciscodp port info Output Details ................................................................................................ 6-9 show lldp port local-info Output Details ...............................................................
22-1 22-2 22-3 22-4 22-5 24-1 24-2 25-1 25-2 25-3 25-4 25-5 25-6 25-7 25-8 25-9 25-10 25-11 25-12 25-13 26-1 26-2 26-3 26-4 26-5 26-6 26-7 26-8 27-1 28-1 28-2 A-1 A-2 show ipv6 neighbor Output Details ................................................................................................. 22-25 show ipv6 route Output Details....................................................................................................... 22-26 show ipv6 route preferences Output Details........................
xxxii
About This Guide Welcome to the Enterasys® SecureStack™ C3 Configuration Guide. This manual explains how to access the device’s Command Line Interface (CLI) and how to use it to configure SecureStack C3 switch devices. Important Notice Depending on the firmware version used in your C3 device, some features described in this document may not be supported. Refer to the Release Notes shipped with your device to determine which features are supported.
Structure of This Guide Chapter 5, Configuring System Power and PoE, describes the commands used to review and set system power and PoE parameters on devices that offer Power over Ethernet. Chapter 6, Discovery Protocol Configuration provides how to configure discovery protocols supported by the device.
Related Documents Chapter 20, IPv4 Routing Protocol Configuration, describes how to configure IPv4 routing and routing protocols, including RIP, OSPF, DVMRP, IRDP, and VRRP. Chapter 21, IPv6 Management, describes the commands used to configure IPv6 at the switch level. Chapter 22, IPv6 Configuration, describes the commands used to configure IPv6 at the routing level. Chapter 23, IPv6 Proxy Routing, describes how to enable IPv6 proxy routing and how to configure a mixed C2/C3 stack for IPv6 proxy routing.
Conventions Used in This Guide Conventions Used in This Guide The following conventions are used in the text of this document: Convention Description Bold font Indicates mandatory keywords, parameters or keyboard keys. italic font Indicates complete document titles. Courier font Used for examples of information displayed on the screen. Courier font in italics Indicates a user-supplied value, either required or optional. [] Square brackets indicate an optional value.
Getting Help Getting Help For additional support related to this switch or document, contact Enterasys Networks using one of the following methods: World Wide Web http://www.enterasys.com/support 1-800-872-8440 (toll-free in U.S. and Canada) or 1-978-684-1000 Phone For the Enterasys Networks Support toll-free number in your country: http://www.enterasys.com/support/contact/ support@enterasys.com Internet mail To expedite your message, type [C-SERIES] in the subject line.
Getting Help xxxviii About This Guide
1 Introduction This chapter provides an overview of the SecureStack C3’s unique features and functionality, an overview of the tasks that may be accomplished using the CLI interface, an overview of ways to manage the switch, factory default settings, and information about how to use the Command Line Interface to configure the switch. For information about... Refer to page...
Factory Default Settings • Remotely using an SNMP management station. • In‐band through a Telnet connection. • In‐band using the Enterasys NetSight® management application. • Remotely using WebView™, Enterasys Networks’ embedded web server application. The Installation Guide for your SecureStack C3 device provides setup instructions for connecting a terminal or modem to the switch. Factory Default Settings The following tables list factory default settings available on the SecureStack C3 switch.
Factory Default Settings Table 1-1 Default Settings for Basic Switch Operation (Continued) Feature Default Setting Link aggregation control protocol (LACP) Enabled. Link aggregation admin key Set to 32768 for all ports. Link aggregation flow regeneration Disabled. Link aggregation system priority Set to 32768 for all ports. Link aggregation outport algorithm Set to DIP-SIP.
Factory Default Settings Table 1-1 Default Settings for Basic Switch Operation (Continued) Feature Default Setting SNMP Enabled. SNTP Disabled. Spanning Tree Globally enabled and enabled on all ports. Spanning Tree edge port administrative status Edge port administrative status begins with the value set to false initially after the device is powered up. If a Spanning Tree BDPU is not received on the port within a few seconds, the status setting changes to true.
Factory Default Settings Table 1-2 Default Settings for Router Operation (Continued) Output... What it displays... Area authentication (OSPF) Disabled. Area default cost (OSPF) Set to 1. Area NSSA (OSPF) None configured. Area range (OSPF) None configured. ARP table No permanent entries configured. ARP timeout Set to 14,400 seconds. Authentication key (RIP and OSPF) None configured. Authentication mode (RIP and OSPF) None configured. Dead interval (OSPF) Set to 40 seconds.
Using the Command Line Interface Table 1-2 Default Settings for Router Operation (Continued) Output... What it displays... Split horizon Enabled for RIP packets without poison reverse. Stub area (OSPF) None configured. Telnet Enabled. Telnet port (IP) Set to port number 23. Timers (OSPF) SPF delay set to 5 seconds. SPF holdtime set to 10 seconds. Transmit delay (OSPF) Set to 1 second. VRRP Disabled.
Using the Command Line Interface Connecting Using Telnet Once the SecureStack C3 device has a valid IP address, you can establish a Telnet session from any TCP/IP based node on the network. For information about setting the switch’s IP address, refer to “set ip address” on page 3‐11. To establish a Telnet session: 1. Telnet to the switch’s IP address. 2.
Using the Command Line Interface Navigating the Command Line Interface Getting Help with CLI Syntax The SecureStack C3 switch allows you to display usage and syntax information for individual commands by typing help or ? after the command. CLI Command Defaults Descriptions Each command description in this guide includes a section entitled “Defaults” which contains different information from the factory default settings on the switch described in Table 1‐1.
Using the Command Line Interface Entering a question mark (?) without a space after a partial keyword will display a list of commands that begin with the partial keyword. Figure 1‐4 shows how to use this function for all commands beginning with co: Figure 1-4 Performing a Partial Keyword Lookup C3(rw)->co? configure C3(su)->co copy Note: At the end of the lookup display, the system will repeat the command you entered without the ?.
Using the Command Line Interface Figure 1-6 Abbreviating a Command C3(su)->sh net Active Internet connections (including servers) Proto Recv-Q Send-Q Local Address Foreign Address ----- ------ ------ --------------------- --------------------TCP 0 0 10.21.73.13.23 134.141.190.94.51246 TCP 0 275 10.21.73.13.23 134.141.192.119.4724 TCP 0 0 *.80 *.* TCP 0 0 *.23 *.* UDP 0 0 10.21.73.13.1030 134.141.89.113.514 UDP 0 0 *.161 *.* UDP 0 0 *.1025 *.* UDP 0 0 *.123 *.
2 Configuring Switches in a Stack This chapter provides information about configuring SecureStack C3 switches in a stack. For information about ... Refer to page ...
Installing a New Stackable System of Up to Eight Units • The console port on the manager switch remains active for out‐of‐band (local) switch management, but the console port on each member switch is deactivated. This enables you to set the IP address and system password using a single console port. Now each switch can be configured locally using only the manager’s console port, or inband using a remote device and the CLI set of commands described in this section.
Installing Previously-Configured Systems in a Stack Installing Previously-Configured Systems in a Stack If member units in a stack have been previous members of a different stack, you may need to configure the renumbering of the stack as follows: 1. Stack the units in the method desired, and connect the stack cables. 2. Power up only the unit you wish to be manager. 3.
Creating a Virtual Switch Configuration To create a virtual switch configuration in a stack environment: 1. Display the types of switches supported in the stack, using the show switch switchtype command (page 2‐7). 2. Using the output of the show switch switchtype command, determine the switch index (SID) of the model of switch being configured. 3. Add the virtual switch to the stack using the set switch member command (page 2‐11).
Considerations About Using Clear Config in a Stack Considerations About Using Clear Config in a Stack When using the clear config command (page 3‐51) to clear configuration parameters in a stack, it is important to remember the following: • Use clear config to clear config parameters without clearing stack unit IDs. This command WILL NOT clear stack parameters or the IP address and avoids the process of renumbering the stack.
Stacking Configuration and Management Commands Stacking Configuration and Management Commands Purpose To review, individually configure and manage switches in a SecureStack C3 stack. Commands For information about... Refer to page...
show switch switchtype Examples This example shows how to display information about all switch units in the stack: C3(rw)->show switch Management Preconfig Plugged-in Switch Code Switch Status Model ID Model ID Status Version ------ ------------ ------------- ------------- --------------------- -------1 Mgmt Switch C3G124-24 C3G124-24 OK 06.03.xx.xxxx 2 Stack Member C3G124-24 C3G124-24 OK 06.03.xx.xxxx 3 Stack Member C3G124-24 C3G124-24 OK 06.03.xx.xxxx 4 Stack Member C3G124-24 C3G124-24 OK 06.03.xx.
show switch stack-ports Parameters switchindex (Optional) Specifies the switch index (SID) of the switch type to display. Defaults None. Mode Switch command, read‐only.
set switch Parameters unit (Optional) Specifies the switch unit ID, an integer ranging from 1 to 8. Defaults None. Mode Switch command, read‐only.
set switch copy-fw Examples This example shows how to assign priority 3 to switch 5: C3(su)->set switch 5 priority 3 This example shows how to renumber switch 5 to switch 7: C3(su)->set switch 5 renumber 7 set switch copy-fw Use this command to replicate the code image file from the management switch to other switch(es) in the stack.
set switch movemanagement Mode Switch command, read‐write. Example This example shows how to assign the name “FirstUnit” to switch unit 1 in the stack: C3(su)->set switch description 1 FirstUnit set switch movemanagement Use this command to move management switch functionality from one switch to another. Syntax set switch movemanagement fromunit tounit Parameters fromunit Specifies the unit number of the current management switch.
clear switch member Mode Switch command, read‐write. Usage Refer to “Creating a Virtual Switch Configuration” on page 2‐3 for more information about how to add a virtual switch to a stack. Example This example shows how to specify a switch as unit 1 with a switch ID of 1: C3(su)->set switch member 1 1 clear switch member Use this command to remove a member entry from the stack. Syntax clear switch member unit Parameters unit Specifies the unit number of the switch. Defaults None.
3 Basic Configuration At startup, the SecureStack C3 switch is configured with many defaults and standard features. This chapter describes how to customize basic system settings to adapt to your work environment. For information about... Refer to page...
Setting User Accounts and Passwords Table 3-2 Optional CLI Setup Commands Refer to page... Task CLI commands Save the active configuration. save config 3-41 Enable or disable SSH. set ssh enable | disable 26-77 Enable or disable Telnet. set telnet {enable | disable} [inbound | outbound | all] 3-37 Enable or disable HTTP management (WebView). set webview {enable | disable} 3-53 Enable or disable SNMP port link traps.
show system login show system login Use this command to display user login account information. Syntax show system login Parameters None. Defaults None. Mode Switch command, super user. Example This example shows how to display login account information.
set system login set system login Use this command to create a new user login account, or to disable or enable an existing account. The SecureStack C3 switch supports up to 16 user accounts, including the admin account, which cannot be deleted. Syntax set system login username {super-user | read-write | read-only} {enable | disable} Parameters username Specifies a login name for a new or existing user.
set password Parameters username Specifies the login name of the account to be cleared. Note: The default admin (su) account cannot be deleted. Defaults None. Mode Switch command, super user. Example This example shows how to remove the “netops” user account: C3(su)->clear system login netops set password Use this command to change system default passwords or to set a new login password on the CLI. Syntax set password [username] Parameters username (Only available to users with super‐user access.
set system password length Examples This example shows how a super‐user would change the Read‐Write password from the system default (blank string): C3(su)->set password rw Please enter new password: ******** Please re-enter new password: ******** Password changed. C3(su)-> This example shows how a user with Read‐Write access would change his password: C3(su)->set password Please enter old password: ******** Please enter new password: ******** Please re-enter new password: ******** Password changed.
set system password history Parameters days Specifies the number of days user passwords will remain valid before aging out. Valid values are 1 to 365. disable Disables password aging. Defaults None. Mode Switch command, super user. Example This example shows how to set the system password age time to 45 days: C3(su)->set system password aging 45 set system password history Use this command to set the number of previously used user login passwords that will be checked for password duplication.
set system lockout Parameters None. Defaults None. Mode Switch command, super user. Example This example shows how to display user lockout settings. In this case, switch defaults have not been changed: C3(su)->show system lockout Lockout attempts: 3 Lockout time: 15 minutes. Table 3‐3 provides an explanation of the command output. These settings are configured with the set system lockout command (“set system lockout” on page 3‐8).
Setting Basic Switch Properties Usage Once a user account is locked out, it can only be re‐enabled by a super user with the set system login command (page 3‐4). If the default admin super user account has been locked out, you can wait until the lock out time has expired or you can reset the switch in order to re‐enable the admin account.
show ip address For information about... Refer to page... clear summertime 3-24 set prompt 3-24 show banner motd 3-25 set banner motd 3-25 clear banner motd 3-26 show version 3-26 set system name 3-27 set system location 3-28 set system contact 3-28 set width 3-29 set length 3-29 show logout 3-30 set logout 3-30 show console 3-31 set console baud 3-31 show ip address Use this command to display the system IP address and subnet mask. Syntax show ip address Parameters None.
set ip address set ip address Use this command to set the system IP address, subnet mask and default gateway. Note: The C3 does not support the ability for a user to configure the host's gateway to be a local routed interface IP. The host's gateway must exist on a different device in the network if one is configured. Syntax set ip address ip-address [mask ip-mask] [gateway ip-gateway] Parameters ip‐address Sets the IP address for the system.
show ip protocol Mode Switch command, read‐write. Example This example shows how to clear the system IP address: C3(rw)->clear ip address show ip protocol Use this command to display the method used to acquire a network IP address for switch management. Syntax show ip protocol Parameters None. Defaults None. Mode Switch command, read‐only.
show system Mode Switch command, read‐write. Example This example shows how to set the method used to acquire a network IP address to DHCP. C3(su)->set ip protocol dhcp show system Use this command to display system information, including contact information, power and fan tray status and uptime. Syntax show system Parameters None. Defaults None. Mode Switch command, read‐only.
show system hardware The following table provides an explanation of the command output. Table 3-4 show system Output Details Output What It Displays... System contact Contact person for the system. Default of a blank string can be changed with the set system contact command (“set system contact” on page 3-28). System location Where the system is located. Default of a blank string can be changed with the set system location command (“set system location” on page 3-28).
show system utilization Mode Switch command, read‐only. Example This example shows how to display the system’s hardware configuration. Please note that the information you see displayed may differ from this example. C3(su)->show system hardware SLOT 1 HARDWARE INFORMATION --------------------------Model: Serial Number: Vendor ID: Base MAC Address: Hardware Version: FirmWare Version: Boot Code Version: 777777777777 0xbc00 00:11:88:B1:76:C0 BCM56514 REV 1 01.00.00.0052 01.00.
set system utilization This example shows how to display the system’s overall memory usage: C3(ro)->show system utilization storage Storage Utilization: Type Description Size(Kb) Available (Kb) --------------------------------------------------------------RAM RAM device 262144 97173 Flash Images, Config, Other 31095 8094 This example shows how to display information about the processes running on the system. Only partial output is shown.
clear system utilization C3(rw)->set system utilization threshold 750 clear system utilization Use this command to reset the CPU utilization threshold to the default of 80%. Syntax clear system utilization Parameters None. Defaults The default threshold value is 80%. Mode Switch command, read‐write. Example This example resets the CPU utilization threshold to the default. C3(rw)->show system utilization cpu CPU Utilization Threshold Traps enable: Threshold = 75.
set system enhancedbuffermode Defaults None. Mode Switch command, read‐write. Example This example shows how to display enhanced buffer mode status: C3(su)->show system enhancedbuffermode enable Optimized system buffer distribution Disable set system enhancedbuffermode Use this command to enable or disable enhanced buffer mode, which optimizes buffer distribution into a single CoS queue operation for standalone switches or non‐stacked switches.
clear system temperature Parameters syslog enable | disable Enables or disables logging high temperature alerts to the system log when the system transitions into an alarm state. trap enable | disable Enables or disables sending high temperature alerts by means of SNMP traps when the system transitions into an alarm state. overtemp‐threshold value Sets the thermal threshold as a percentage of the maximum rated for the specific platform. Value can range from 0 to 100%.
show time Mode Switch command, read‐write. Usage This command resets all the high temperature parameters to their default values: • Syslog alerts are disabled by default. • Trap alerts are disabled by default. • Overtemp threshold is 100% by default. Example This example resets all high temperature parameters to their defaults. C3(su)->clear system temperature show time Use this command to display the current time of day in the system clock. Syntax show time Parameters None. Defaults None.
show summertime Parameters [mm/dd/yyyy] [hh:mm:ss] Sets the time in: month, day, year and/or 24‐hour format At least one set of time parameters must be entered. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the system clock to 7:50 a.m: C3(su)->set time 7:50:00 show summertime Use this command to display daylight savings time settings. Syntax show summertime Parameters None. Defaults None. Mode Switch command, read‐only.
set summertime set summertime Use this command to enable or disable the daylight savings time function. Syntax set summertime {enable | disable} [zone] Parameters enable | disable Enables or disables the daylight savings time function. zone (Optional) Applies a name to the daylight savings time settings. Defaults If a zone name is not specified, none will be applied. Mode Switch command, read‐only.
set summertime recurring Mode Switch command, read‐write. Example This example shows how to set a daylight savings time start date of April 4, 2004 at 2 a.m. and an ending date of October 31, 2004 at 2 a.m. with an offset time of one hour: C3(su)->set summertime date April 4 2004 02:00 October 31 2004 02:00 60 set summertime recurring Use this command to configure recurring daylight savings time settings.
clear summertime clear summertime Use this command to clear the daylight savings time configuration. Syntax clear summertime Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the daylight savings time configuration: C3(su)->clear summertime set prompt Use this command to modify the command prompt. Syntax set prompt prompt_string Parameters prompt_string Specifies a text string for the command prompt.
show banner motd show banner motd Use this command to show the banner message of the day that will display at session login. Syntax show banner motd Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the banner message of the day: C3(rw)->show banner motd This system belongs to XYZ Corporation. Use of this system is strictly limited to authorized personnel.
clear banner motd C3(rw)->set banner motd "\tThis system belongs to XYZ Corporation.\nUse of this system is strictly limited to authorized personnel." clear banner motd Use this command to clear the banner message of the day displayed at session login to a blank string. Syntax clear banner motd Parameters None. Defaults None. Mode Switch command, read‐write.
set system name Model -------------C3G124-48P Serial # ----------------001188021035 Versions ------------------Hw:BCM5665 REV 17 Bp:01.00.29 Fw:6.03.xx.xxxx BuFw:03.01.13 PoE:500_3 Table 3‐5 provides an explanation of the command output. Table 3-5 show version Output Details Output Field What It Displays... Model Switch’s model number. Serial # Serial number of the switch. Versions • Hw: Hardware version number. • Bp: BootPROM version. • Fw: Current firmware version number.
set system location set system location Use this command to identify the location of the system. Syntax set system location [string] Parameters string (Optional) Specifies a text string that indicates where the system is located. Note: A location string containing a space in the text must be enclosed in quotes as shown in the example below. Defaults If string is not specified, the location name will be cleared. Mode Switch command, read‐write.
set width Example This example shows how to set the system contact string: C3(su)->set system contact “Joe Smith” set width Use this command to set the number of columns for the terminal connected to the switch’s console port. Syntax set width screenwidth [default] Parameters screenwidth Sets the number of terminal columns. Valid values are 50 to 150. default (Optional) Makes this setting persistent for all future sessions (written to NV‐RAM). Defaults None. Mode Switch command, read‐write.
show logout Defaults None. Mode Switch command, read‐write. Example This example shows how to set the terminal length to 50: C3(su)->set length 50 show logout Use this command to display the time (in seconds) an idle console or Telnet CLI session will remain connected before timing out. Syntax show logout Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the CLI logout setting: C3(su)->show logout Logout currently set to: 10 minutes.
show console Mode Switch command, read‐write. Example This example shows how to set the system timeout to 10 minutes: C3(su)->set logout 10 show console Use this command to display console settings. Syntax show console [baud] [bits] [flowcontrol] [parity] [stopbits] Parameters baud (Optional) Displays the input/output baud rate. bits (Optional) Displays the number of bits per character. flowcontrol (Optional) Displays the type of flow control. parity (Optional) Displays the type of parity.
Downloading a Firmware Image Defaults None. Mode Switch command, read‐write. Example This example shows how to set the console port baud rate to 19200: C3(su)->set console baud 19200 Downloading a Firmware Image You can upgrade the operational firmware in the SecureStack C3 switch without physically opening the switch or being in the same location. There are two ways to download firmware to the switch: • Via TFTP download.
Downloading a Firmware Image 1 - Start operational code. 2 - Start Boot Menu. Select (1, 2):2 Password: ************* 2. Before the boot up completes, type 2 to select “Start Boot Menu”. Use “administrator” for the Password. Note: The “Boot Menu” password “administrator” can be changed using boot menu option 11. Boot Menu Version 01.00.29 05-09-2005 Options available 1 - Start operational code 2 - Change baud rate 3 - Retrieve event log using XMODEM (64KB).
Downloading a Firmware Image The following Enterasys Header is in the image: MD5 Checksum....................fe967970996c4c8c43a10cd1cd7be99a Boot File Identifier............0x0517 Header Version..................0x0100 Image Type......................0x82 Image Offset....................0x004d Image length....................0x006053b3 Ident Strings Length............0x0028 Ident Strings................... C2G124-24 C2G124-48 C2H124-48 C2K124_24 Image Version Length............0x7 Image Version Bytes.....
Reviewing and Selecting a Boot Firmware Image 7. Reboot the system using the reset command (page 3‐50). Caution: If you do not follow the steps above, you may lose remote connectivity to the switch. Reviewing and Selecting a Boot Firmware Image Purpose To display and set the image file the switch loads at startup. The C3 switch allows you to download and store a backup image, which can be selected as the startup image by using the commands described in this section. Commands For information about...
set boot system set boot system Use this command to set the firmware image the switch loads at startup. Syntax set boot system filename Parameters filename Specifies the name of the firmware image file. Defaults None. Mode Switch command, read‐write. Usage This command allows you to set the firmware image to be loaded at startup.
Starting and Configuring Telnet Starting and Configuring Telnet Purpose To enable or disable Telnet, and to start a Telnet session to a remote host. The SecureStack C3 switch allows a total of four inbound and / or outbound Telnet session to run simultaneously. Commands For information about... Refer to page... show telnet 3-37 set telnet 3-37 telnet 3-38 show telnet Use this command to display the status of Telnet on the switch. Syntax show telnet Parameters None. Defaults None.
telnet Parameters enable | disable Enables or disables Telnet services. inbound | outbound | all (Optional) Specifies inbound service (the ability to Telnet to this switch), outbound service (the ability to Telnet to other devices), or all (both inbound and outbound). Defaults If not specified, both inbound and outbound Telnet service will be enabled. Mode Switch command, read‐write.
Managing Switch Configuration and Files Managing Switch Configuration and Files Configuration Persistence Mode The default state of configuration persistence mode is “auto,” which means that when CLI configuration commands are entered, or when a configuration file stored on the switch is executed, the configuration is saved to NVRAM automatically at the following intervals: • On a standalone unit, the configuration is checked every two minutes and saved if there has been a change.
show snmp persistmode For information about... Refer to page... clear tftp timeout 3-47 set tftp retry 3-48 clear tftp retry 3-48 show snmp persistmode Use this command to display the configuration persistence mode setting. Syntax show snmp persistmode Parameters None. Defaults None. Mode Switch command, read‐only. Usage By default, the mode is set to “auto save,” which automatically saves configuration changes at specific intervals.
save config Parameters auto Sets the configuration persistence mode to automatic. This is the default state. manual Sets the configuration persistence mode to manual. In order to make configuration changes persistent, the save config command must be issued as described in “save config” on page 3‐41. This mode is useful for reverting back to old configurations. Defaults None. Mode Switch command, read‐write.
show file Parameters filename (Optional) Specifies the file name or directory to list. Defaults If filename is not specified, all files in the system will be displayed. Mode Switch command, read‐only. Example This example shows how to list all the configuration and image files in the system. The display indicates which image file is the Active file and which image file is the Boot file that will be used the next time the system reboots.
show config Defaults None. Mode Switch command, read‐only. Example This example shows how to display a text file named “myconfig” in the configs/ directory. Note that only a portion of the file is shown in this example. C3(rw)->show file configs/myconfig ...
configure Parameters all (Optional) Displays default and non‐default configuration settings. facility (Optional) Specifies the exact name of one facility for which to show configuration. For example, enter “router” to show only router configuration. outfile (Optional) Specifies that the current configuration will be written to a text file in the configs/ directory. configs/filename Specifies a filename in the configs/ directory to display.
copy Parameters filename Specifies the path and file name of the configuration file to execute. append (Optional) Appends the configuration file contents to the current configuration. This is equivalent to typing the contents of the config file directly into the CLI and can be used, for example, to make incremental adjustments to the current configuration.
delete Examples This example shows how to download an image via TFTP: C3(su)->copy tftp://10.1.192.34/version01000 system:image This example shows how to download a configuration file to the configs directory: C3(su)->copy tftp://10.1.192.1/Jan1_2004.cfg configs/Jan1_2004.cfg This example shows how to upload a configuration file from the configs directory using SFTP. C3(su)->copy configs/Jan1_2009.cfg sftp://user:passwd@10.1.192.1/Jan1_2009.
set tftp timeout Mode Switch command, read‐only. Usage The TFTP timeout value can be set with the set tftp timeout command. The TFTP retry value can be set with the set tftp retry command. Example This example shows the output of this command. C3(ro)->show tftp settings TFTP packet timeout (seconds): 2 TFTP max retry: 5 set tftp timeout Use this command to configure how long TFTP will wait for a reply of either an acknowledgement packet or a data packet during a data transfer.
set tftp retry Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the timeout value to the default of 2 seconds. C3(rw)-> clear tftp timeout set tftp retry Use this command to configure how many times TFTP will resend a packet, either an acknowledgement packet or a data packet. Syntax set tftp retry retry Parameters retry Specifies the number of times a packet will be resent. The valid range is from 1 to 1000. Default value is 5 retries. Defaults None.
Clearing and Closing the CLI Mode Switch command, read‐write. Example This example shows how to clear the retry value to the default of 5 retries. C3(rw)-> clear tftp retry Clearing and Closing the CLI Purpose To clear the CLI screen or to close your CLI session. Commands For information about... Refer to page... cls 3-49 exit 3-50 cls (clear screen) Use this command to clear the screen for the current CLI session. Syntax cls Parameters None. Defaults None. Mode Switch command, read‐only.
exit exit Use either of these commands to leave a CLI session. Syntax exit Parameters None. Defaults None. Mode Switch command, read‐only. Usage By default, switch timeout occurs after 15 minutes of user inactivity, automatically closing your CLI session. Use the set logout command (page 3‐30) to change this default. Example This example shows how to exit a CLI session: C3(su)->exit Resetting the Switch Purpose To reset one or more switches, and to clear the user‐defined configuration parameters.
clear config Defaults If no unit ID is specified, the entire system will be reset. Mode Switch command, read‐write. Usage A SecureStack C3 switch can also be reset with the RESET button located on its front panel. For information on how to do this, refer to the SecureStack C3 Installation Guide shipped with your switch. Examples This example shows how to reset the system: C3(su)->reset Are you sure you want to reload the stack? (y/n) y Saving Configuration to stacking members Reloading all switches.
Using and Configuring WebView • Use clear config to clear configuration parameters without clearing stack unit IDs. This command WILL NOT clear stack parameters and avoids the process of re‐numbering the stack. • Use clear config all when it is necessary to clear all configuration parameters, including stack unit IDs (if applicable) and switch priority values. • Use the clear ip address command to clear the IP address.
set webview Defaults None. Mode Switch command, read‐only. Example This example shows how to display WebView status: C3(rw)->show webview WebView is Enabled. set webview Use this command to enable or disable WebView on the switch. Syntax set webview {enable | disable} Parameters enable | disable Enable or disable WebView on the switch. Defaults None. Mode Switch command, read‐write.
set ssl Defaults None. Mode Switch command, read‐only. Example This example shows how to display SSL status: C3(rw)->show ssl SSL status: Enabled set ssl Use this command to enable or disable the use of WebView over SSL port 443. By default, SSL is disabled on the switch. This command can also be used to reinitialize the hostkey that is used for encryption.
Gathering Technical Support Information Gathering Technical Support Information Purpose To gather common technical support information. Command For information about... Refer to page... show support 3-55 show support Use this command to display switch information for troubleshooting. Syntax show support Parameters None. Defaults None. Mode Switch command, read‐only. Usage This command initiates a number of show commands to easily gather basic information from an installed device.
Configuring Hostprotect Configuring Hostprotect Purpose This feature enables rate limiting of host bound traffic on SecureStack C3 switches, to assist in the prevention of Denial of Service issues. When enabled, the hostprotect functionality applies a 64 kbps meter to control plane traffic, such as BPDUs or LACP packets, destined for the host processor. Commands For information about... Refer to page...
clear system hostprotect Parameters enable Enables hostprotect mode. disable Disables hostprotect mode. Defaults This feature is disabled by default. Mode Switch command, read‐write. Usage Hostprotect uses hardware resources that are also used for priority queues (see “Configuring Priority to Transmit Queue Mapping” on page 12‐4), so if hostprotect is enabled, priority queues are limited.
clear system hostprotect Usage Changing the hostprotect status requires a reset of the switch or stack of switches. If more than two priority queue mappings exist and you execute this command to reset the hostprotect status to enabled, the command will not complete and you will get a warning message. Example This example attempts to return the hostprotect status to the default, but the command cannot complete because more than two priority queue mappings exist.
4 Activating Licensed Features In order to enable the C3 advanced features, such as Advanced Routing, you must purchase and activate a license key. If you have purchased a license, you can proceed to activate your license as described in this section. If you wish to obtain a permanent or evaluation license, use the Enterasys Customer Portal or contact the Enterasys Networks Sales Department. Note: All members of a stack must be licensed in order to support licensed features in a stack environment.
Clearing, Showing, and Applying Licenses 2. Optionally, note the serial numbers of the switches in the stack. You can use the show system hardware command (page 3‐14) to display the switch serial numbers. Note: Since license keys are applied to the correct stack member switch automatically, based on the switch serial number that is part of the license string, you should know the serial numbers of the switches in order to enable the licenses of the member switches first, before the master unit. 3.
set license set license Use this command to activate the SecureStack C3 licensed features. Syntax set license type feature DBV expiration key hostid Parameters type Specifies the type of license. For the SecureStack C3, the value in this field is always INCREMENT. feature The name of the feature being licensed. DBV A date‐related string generated as part of the license. expiration Indicates whether the license is a permanent or an evaluation license.
show license show license Use this command to display license key information for switches with activated licenses. Syntax show license [unit number] Parameters unit number (Optional) Specifies the switch for which to display license information. Refer to Chapter 2, Configuring Switches in a Stack, for more information about stack unit IDs, or numbers. Defaults If no unit number is specified, license key information for all switches in the stack is displayed. Mode Switch command, read‐only.
clear license Example This example shows how to clear the advrouter licensed feature : C3(rw)->clear license featureId advrouter SecureStack C3 Configuration Guide 4-5
clear license 4-6 Activating Licensed Features
5 Configuring System Power and PoE Important Notice The commands in this section apply only to PoE-equipped devices. Consult the Installation Guide for your product to determine if it is PoE-equipped. The commands in this chapter allow you to review and set system power and PoE (Power over Ethernet) parameters, including the power available to the system, the usage threshold for each module, whether or not SNMP trap messages will be sent when power status changes, and per‐ port PoE settings.
set inlinepower threshold Example This example shows how to display system power properties: C3(su)->show inlinepower Detection Mode : auto Unit ---1 Status -----auto Power(W) -------375 Consumption(W) -------------0.00 Usage(%) -------0.00 Threshold(%) -----------80 Trap ---enable Table 5‐1 provides an explanation of the command output. Table 5-1 show inlinepower Output Details Output What It Displays... Detection Mode Displays the PD detection mode used by the switch.
set inlinepower trap Usage The threshold is expressed as a percentage of the available PoE power. When this threshold is reached, a trap will be sent if traps are enabled with the set inlinepower trap command.
show port inlinepower Parameters auto Specifies that the switch will use the standard 802.3af detection method first. If that fails, then the switch will use the legacy (pre 802.3af standard) capacitance method of detection. ieee Specifies that the switch will only use the standard 802.3af detection method. Defaults Default detection mode is auto. Mode Switch command, read‐write. Usage This command is used to specify how the switch should detect PDs connected to its ports.
set port inlinepower C3(su)->show port inlinepower ge.2.1 Port ---ge.2.1 Type ---wireless Admin ----auto Oper ---searching Priority -------low Class ----0 Power(W) -------15.4 set port inlinepower Use this command to configure PoE parameters on one or more ports. Syntax set port inlinepower port-string {[admin {off | auto}] [priority {critical | high | low}] [type type]} Parameters port‐string Specifies the port(s) on which to configure PoE.
set port inlinepower 5-6 Configuring System Power and PoE
6 Discovery Protocol Configuration This chapter describes how to configure discovery protocols. For more extensive configuration information, refer to the “Configuring Neighbor Discovery” feature guide on the Enterasys Networks web site: http://www.enterasys.com/support/manuals For information about... Refer to page...
show cdp show cdp Use this command to display the status of the CDP discovery protocol and message interval on one or more ports. Syntax show cdp [port-string] Parameters port‐string (Optional) Displays CDP status for a specific port. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, all CDP information will be displayed. Mode Switch command, read‐only.
set cdp state Table 6-1 show cdp Output Details (Continued) Output Field What It Displays... CDP Authentication Code Authentication code for CDP discovery protocol. The default of 00-00-00-00-00-0000-00 can be reset using the set cdp auth command. For details, refer to “set cdp auth” on page 6-4. CDP Transmit Frequency Frequency (in seconds) at which CDP messages can be transmitted. The default of 60 seconds can be reset with the set cdp interval command.
set cdp auth set cdp auth Use this command to set a global CDP authentication code. Syntax set cdp auth auth-code Parameters auth‐code Specifies an authentication code for the CDP protocol. This can be up to 16 hexadecimal values separated by commas. Defaults None. Mode Switch command, read‐write. Usage The authentication code value determines a switch’s CDP domain. If two or more switches have the same CDP authentication code, they will be entered into each other’s CDP neighbor tables.
set cdp hold-time Example This example shows how to set the CDP interval frequency to 15 seconds: C3(su)->set cdp interval 15 set cdp hold-time Use this command to set the hold time value for CDP discovery protocol configuration messages. Syntax set cdp hold-time hold-time Parameters hold‐time Specifies the hold time value for CDP messages in seconds.Valid values are from 15 to 600. Defaults None. Mode Switch command, read‐write.
show neighbors Mode Switch command, read‐write. Example This example shows how to reset the CDP state to auto‐enabled: C3(su)->clear cdp state show neighbors This command displays Neighbor Discovery information for either the CDP or Cisco DP protocols. Syntax show neighbors [port-string] Parameters port‐string (Optional) Specifies the port or ports for which to display Neighbor Discovery information. Defaults If no port is specified, all Neighbor Discovery information is displayed.
Configuring Cisco Discovery Protocol Configuring Cisco Discovery Protocol Purpose To review and configure the Cisco discovery protocol. Discovery protocols are used to discover network topology. When enabled, they allow Cisco devices to send periodic PDUs about themselves to neighboring devices. Specifically, this feature enables recognizing PDUs from Cisco phones. A table of information about detected phones is kept by the switch and can be queried by the network administrator.
show ciscodp port info Device ID : 001188554A60 Last Change : WED NOV 08 13:19:56 2006 Table 6‐2 provides an explanation of the command output. Table 6-2 show ciscodp Output Details Output Field What It Displays... CiscoDP Whether Cisco DP is globally enabled or disabled. Auto indicates that Cisco DP will be globally enabled only if Cisco DP PDUs are received. Default setting of auto-enabled can be reset with the set ciscodp status command.
set ciscodp status Table 6-3 show ciscodp port info Output Details Output Field What It Displays... Port Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 7-1. State Whether Cisco DP is enabled, disabled or auto-enabled on the port. Default state of enabled can be changed using the set ciscodp port command. vvid Whether a voice VLAN ID has been set on this port.
set ciscodp holdtime Parameters seconds Specifies the number of seconds between Cisco DP PDU transmissions. Valid values are from 5 to 254 seconds. Defaults None. Mode Switch command, read‐write. Example This example shows how to set the Cisco DP timer to 120 seconds. C3(su)->set ciscodp timer 120 set ciscodp holdtime Use this command to set the time to live (TTL) for Cisco discovery protocol PDUs.
set ciscodp port Parameters status Sets the CiscoDP port operational status. disable Does not transmit or process CiscoDP PDUs. enable Transmits and processes CiscoDP PDUs. vvid Sets the port voice VLAN for CiscoDP PDU transmission. vlan‐id Specifies the VLAN ID, range 1‐4093. none No voice VLAN will be used in CiscoDP PDUs. This is the default. dot1p Instructs attached phone to send 802.1p tagged frames. untagged Instructs attached phone to send untagged frames.
clear ciscodp • If the switch port is configured to a Cisco DP trust state of untrusted (trusted no), this setting is communicated to the Cisco IP phone instructing it to overwrite the 802.1p tag of traffic transmitted by the device connected to it to 0, by default, or to the value specified by the cos parameter of this command. • There is a one‐to‐one correlation between the value set with the cos parameter and the 802.1p value assigned to ingressed traffic by the Cisco IP phone.
Configuring Link Layer Discovery Protocol and LLDP-MED Examples This example shows how to clear all the Cisco DP parameters back to the default settings. C3(rw)->clear ciscodp This example shows how to clear the Cisco DP status on port ge.1.5. C3(rw)->clear ciscodp port status ge.1.
Configuring Link Layer Discovery Protocol and LLDP-MED Commands The commands used to review and configure the CDP discovery protocol are listed below. For information about... Refer to page...
show lldp Step Task Command(s) 1. Configure global system LLDP parameters set lldp tx-interval set lldp hold-multiplier set lldp trap-interval set lldp med-fast-repeat clear lldp 2. Enable/disable specific ports to: • • • Transmit and process received LLDPDUs Send LLDP traps Send LLDP-MED traps set/clear lldp port status set/clear lldp port trap set/clear lldp port med-trap 3. Configure an ECS ELIN value for specific ports set/clear lldp port location-info 4.
show lldp port status show lldp port status Use this command to display the LLDP status of one or more ports. The command lists the ports that are enabled to send and receive LLDP PDUs. Ports are enabled or disabled with the set lldp port status command. Syntax show lldp port status [port-string] Parameters port‐string (Optional) Displays LLDP status for one or a range of ports. Defaults If port‐string is not specified, LLDP status information will be displayed for all ports.
show lldp port tx-tlv Example This example shows how to display LLDP port trap information for all ports. C3(ro)->show lldp port trap Trap-Enabled Ports : MED Trap-Enabled Ports: show lldp port tx-tlv Use this command to display information about which optional TLVs have been configured to be transmitted on ports. Ports are configured to send optional TLVs with the set lldp port tx‐tlv command.
show lldp port local-info Parameters port‐string (Optional) Displays port location information for one or a range of ports. Defaults If port‐string is not specified, port location configuration information will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display port location information for three ports. C3(ro)->show lldp port location-info ge.1.1-3 Ports -------ge.1.1 ge.1.2 ge.1.
show lldp port local-info Mgmt Addr : 10.21.64.100 Chassis ID : 00-E0-63-93-74-A5 Sys Name : LLDP PoE test Chassis Sys Desc : Enterasys Networks, Inc. Sys Cap Supported/Enabled : bridge,router/bridge Auto-Neg Supported/Enabled Auto-Neg Advertised : yes/yes : 10BASE-T, 10BASE-TFD, 100BASE-TX, 100BASE-TXFD, 1000BASE-TFD, Bpause Operational Speed/Duplex/Type : 100 full tx Max Frame Size (bytes) : 1522 Vlan Id : 1 LAG Supported/Enabled/Id : no/no/0 Protocol Id : Spanning Tree v-3 (IEEE802.
show lldp port local-info Table 6-4 6-20 show lldp port local-info Output Details (Continued) Output Field What it Displays... Auto-Neg Supported/Enabled IEEE 802.3 Extensions MAC-PHY Configuration/Status TLV. Autonegotiation supported and enabled settings should be the same on the two systems attached to the same link. Auto-Neg Advertised IEEE 802.3 Extensions MAC-PHY Configuration/Status TLV. Lists the configured advertised values on the port. Operational Speed/Duplex/ Type IEEE 802.
show lldp port remote-info Table 6-4 show lldp port local-info Output Details (Continued) Output Field What it Displays... PoE Power Limit (mW) LLDP-MED Extensions Extended Power via MDI TLV. Displayed only when a port has PoE capabilities. Indicates the total power the port is capable of sourcing over a maximum length cable, based on its current configuration, in milli-Watts. PoE Power Priority LLDP-MED Extensions Extended Power via MDI TLV. Displayed only when a port has PoE capabilities.
show lldp port network-policy Hardware Revision Firmware Revision Software Revision Serial Number Manufacturer Model Number : : : : : : 4610D01A b10d01b2_7.bin a10d01b2_7.bin 05GM42004348 Avaya 4610 Note that the information fields displayed by the show lldp port remote‐info command will vary, depending on the type of remote device that is connected to the port. Table 6‐5 describes the output fields that are unique to the remote system information database.
set lldp tx-interval softphone‐voice Displays information about only the softphone voice application type. video‐conferencing Displays information about only the video conferencing application type. streaming‐video Displays information about only the streaming video application type. video‐signaling Displays information about only the video signaling application type. port‐string (Optional) Displays information about LLDP network policy for one or a range of ports.
set lldp hold-multiplier Defaults None. Mode Switch command, read‐write. Example This example sets the transmit interval to 20 seconds. C3(rw)->set lldp tx-interval 20 set lldp hold-multiplier Use this command to set the time‐to‐live value used in LLDP frames sent by this device. The time‐ to‐live for LLDPDU data is calculated by multiplying the transmit interval by the hold multiplier value.
set lldp med-fast-repeat Parameters frequency Specifies the minimum time between LLDP trap transmissions, in seconds. The value can range from 5 to 3600 seconds. The default value is 5 seconds. Defaults None. Mode Switch command, read‐write. Example This example sets the minimum interval between LLDP traps to 10 seconds.
set lldp port status set lldp port status Use this command to enable or disable transmitting and processing received LLDPDUs on a port or range of ports. Syntax set lldp port status {tx-enable | rx-enable | both | disable} port-string Parameters tx‐enable Enables transmitting LLDPDUs on the specified ports. rx‐enable Enables receiving and processing LLDPDUs from remote systems on the specified ports. both Enables both transmitting and processing received LLDPDUs on the specified ports.
set lldp port med-trap Mode Switch command, read‐write. Example This example enables transmitting LLDP traps on ports ge.1.1 through ge.1.6. C3(rw)->set lldp port trap enable ge.1.1-6 set lldp port med-trap Use this command to enable or disable sending an LLDP‐MED notification when a change in the topology has been sensed on the port (that is, a remote endpoint device has been attached or removed from the port).
set lldp port tx-tlv Defaults None. Mode Switch command, read‐write. Example After you configure a location information value, you must also configure the port to send the Location Information TLV with the set lldp port tx‐tlv command. This example configures the ELIN identifier 5551234567 on ports ge.1.1 through ge.1.6 and then configures the ports to send the Location Information TLV. C3(rw)->set lldp port location-info 5551234567 ge.1.1-6 C3(rw)->set lldp port tx-tlv med-loc ge.1.
set lldp port tx-tlv gvrp GVRP information defined by Protocol Identity IEEE 802.1 Extensions TLV. If LACP is enabled on the port, value sent includes version of protocol being used. mac‐phy MAC‐PHY Configuration/Status IEEE 802.3 Extensions TLV. Value sent includes the operational MAU type, duplex, and speed of the port. poe Power via MDI IEEE 802.3 Extensions TLV. Values sent include whether pair selection can be controlled on port, and the power class supplied by the port.
set lldp port network-policy set lldp port network-policy Use this command to configure LLDP network policies for a set of applications on a port or range of ports. The policies configured with this command are sent in LLDPDUs as LLDP‐MED Network Policy TLVs. Multiple Network Policy TLVs can be sent in a single LLDPDU.
clear lldp port‐string Specifies the port or range of ports to be affected. Defaults None. Mode Switch command, read‐write. Usage This feature allows administrators to quickly provision LLDP end‐points via the switch. LLDP clients will use these LLDP network policy parameters for traffic originating from the end‐point.
clear lldp port status Defaults None. Mode Switch command, read‐write. Example This example returns the transmit interval to the default value of 30 seconds. C3(rw)->clear lldp tx-interval clear lldp port status Use this command to return the port status to the default value of both (both transmitting and processing received LLDPDUs are enabled). Syntax clear lldp port status port-string Parameters port‐string Specifies the port or range of ports to be affected. Defaults None.
clear lldp port med-trap Mode Switch command, read‐write. Example This example returns port ge.1.1 to the default LLDP trap state of disabled. C3(rw)->clear lldp port trap ge.1.1 clear lldp port med-trap Use this command to return the port LLDP‐MED trap setting to the default value of disabled. Syntax clear lldp port med-trap port-string Parameters port‐string Specifies the port or range of ports to be affected. Defaults None. Mode Switch command, read‐write. Example This example returns port ge.1.
clear lldp port network-policy Example This example returns the location information ELIN value on port ge.1.1 to the default value of null. C3(rw)->clear lldp port location-info elin ge.1.1 clear lldp port network-policy Use this command to return LLDP network policy for a set of applications on a port or range of ports to default values.
clear lldp port tx-tlv Example This example returns all network policy values for all applications on port ge.1.1 to their default values. C3(rw)->clear lldp port network-policy all state tag vid cos dscp ge.1.1 clear lldp port tx-tlv Use this command to clear the optional LLDP and LLDP‐MED TLVs to be transmitted in LLDPDUs by the specified port or ports to the default value of disabled.
clear lldp port tx-tlv med‐pol Disables the LLDP‐MED Network Policy TLV from being transmitted in LLDPDUs. med‐loc Disables the LLDP‐MED Location Identification TLV from being transmitted in LLDPDUs. med‐poe Disables the LLDP‐MED Extended Power via MDI TLV from being transmitted in LLDPDUs. Only valid for PoE‐enabled ports. port‐string Specifies the port or range of ports to be affected. Defaults None. Mode Switch command, read‐write.
7 Port Configuration This chapter describes the Port Configuration set of commands and how to use them. For information about... Refer to page...
Reviewing Port Status Where port number depends on the device. The highest valid port number is dependent on the number of ports in the device and the port type. Port Slot/Unit Parameters Used in the CLI The “unit” parameter is often used interchangeably with “module” in the standalone switch CLI to indicate a module slot location. Examples Note: You can use a wildcard (*) to indicate all of an item. For example, fe.3.* would represent all 100Mbps Ethernet (fe) ports in slot 3, and ge.
show port show port Use this command to display whether or not one or more ports are enabled for switching. Syntax show port [port-string] Parameters port‐string (Optional) Displays operational status for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, operational status information for all ports will be displayed. Mode Switch command, read‐only.
show port counters -----------ge.3.14 (truncated) -------------- Status ------up Status ------up -------- ------- ------------N/A N/A BaseT RJ45 Table 7‐1 provides an explanation of the command output. Table 7-1 show port status Output Details Output Field What It Displays... Port Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 7-1. Alias (truncated) Alias configured for the port.
show port counters Examples This example shows how to display all counter statistics, including MIB2 network traffic and traffic through the device for ge.3.1: C3(su)->show port counters ge.3.1 MIB2 Interface: 1 Port: ge.3.
clear port counters clear port counters Use this command to clear port counter statistics for a port or range of ports. Syntax clear port counters [port-string] Parameters port‐string (Optional) Specifies the port or range of ports to clear port counter statistics. Defaults If no port‐string is specified, port counters are cleared for all ports. Mode Switch command, read‐write Example This example clears the port counters for ge.3.1. C3(rw)->clear port counters ge3.
Disabling / Enabling and Naming Ports Since running the cable diagnostics may momentarily interrupt packet flow, a warning message is displayed and you are prompted to continue. Example This example shows the cable status for 1 GE port ge.1.31. C3(su)->show port cablestatus ge.1.31 Warning: port(s) will be offline momentarily. Do you want to continue (y/n) [n]?y Port Status --------- --------ge.1.31 Normal Length ------3(m)-5(m) Table 7‐3 provides an explanation of the command output.
set port disable set port disable Use this command to administratively disable one or more ports. When this command is executed, in addition to disabling the physical Ethernet link, the port will no longer learn entries in the forwarding database. Syntax set port disable port-string Parameters port‐string Specifies the port(s) to disable. For a detailed description of possible port‐ string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None.
show port alias show port alias Use this command to display the alias name for one or more ports. Syntax show port alias [port-string] Parameters port‐string (Optional) Displays alias name(s) for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, aliases for all ports will be displayed. Mode Switch command, read‐only.
set port alias Examples This example shows how to assign the alias “Admin” to ge.3.3: C3(rw)->set port alias ge.3.3 Admin This example shows how to clear the alias for ge.3.3: C3(rw)->set port alias ge.3.
Setting Speed and Duplex Mode Setting Speed and Duplex Mode Purpose To review and set the operational speed in Mbps and the default duplex mode: Half, for half duplex, or Full, for full duplex for one or more ports. Note: These settings only take effect on ports that have auto-negotiation disabled. Commands For information about... Refer to page...
set port speed set port speed Use this command to set the default speed of one or more ports. This setting only takes effect on ports that have auto‐negotiation disabled. Syntax set port speed port-string {10 | 100 | 1000} Parameters port‐string Specifies the port(s) for which to a speed value will be set. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. 10 | 100 | 1000 Specifies the port speed.
set port duplex Example This example shows how to display the default duplex setting for Ethernet port 14 in slot 3: C3(su)->show port duplex ge.3.14 default duplex mode is full on port ge.3.14. set port duplex Use this command to set the default duplex type for one or more ports. This command will only take effect on ports that have auto‐negotiation disabled. Syntax set port duplex port-string {full | half} Parameters port‐string Specifies the port(s) for which duplex type will be set.
Enabling / Disabling Jumbo Frame Support Enabling / Disabling Jumbo Frame Support Purpose To review, enable, and disable jumbo frame support on one or more ports. This allows Gigabit Ethernet ports to transmit frames up to 10 KB in size. Commands For information about... Refer to page... show port jumbo 7-14 set port jumbo 7-15 clear port jumbo 7-15 show port jumbo Use this command to display the status of jumbo frame support and maximum transmission units (MTU) on one or more ports.
set port jumbo set port jumbo Use this command to enable or disable jumbo frame support on one or more ports. Syntax set port jumbo {enable | disable}[port-string] Parameters enable | disable Enables or disables jumbo frame support. port‐string (Optional) Specifies the port(s) on which to disable or enable jumbo frame support. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1.
Setting Auto-Negotiation and Advertised Ability Setting Auto-Negotiation and Advertised Ability Purpose To review, disable or enable auto‐negotiation, and to configure port advertisement for speed and duplex. During auto‐negotiation, the port “tells” the device at the other end of the segment what its capabilities and mode of operation are. If auto‐negotiation is disabled, the port reverts to the values specified by default speed, default duplex, and the port flow control commands.
set port negotiation Mode Switch command, read‐only. Example This example shows how to display auto‐negotiation status for 1‐Gigabit Ethernet port 14 in slot 3: C3(su)->show port negotiation ge.3.14 auto-negotiation is enabled on port ge.3.14. set port negotiation Use this command to enable or disable auto‐negotiation on one or more ports. Syntax set port negotiation port-string {enable | disable} Parameters port‐string Specifies the port(s) for which to enable or disable auto‐negotiation.
set port advertise Mode Switch command, read‐only. Example This example shows how to display advertisement status for Gigabit ports 13 and 14: C3(su)->show port advertise ge.1.13-14 ge.1.13 capability advertised remote ------------------------------------------------10BASE-T yes yes yes 10BASE-TFD yes yes yes 100BASE-TX yes yes yes 100BASE-TXFD yes yes yes 1000BASE-T no no no 1000BASE-TFD yes yes yes pause yes yes no ge.1.
clear port advertise Mode Switch command, read‐write. Example This example shows how to configure port 1 to advertise 1000BASE‐T full duplex: C3(su)->set port advertise ge.1.1 1000tfd clear port advertise Use this command to configure a port to not advertise a specific speed/duplex capability when auto‐negotiating with another port. Syntax clear port advertise {port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd | pause} Parameters port‐string Clear advertisements for specific port(s).
show port mdix show port mdix Use this command to display the status of cable connection type configuration mode for one or more ports. Switch ports can automatically detect and configure the required cable type, either straight through (MDI) or cross‐over (MDIX), or the ports can be configured to only allow one type of cable type, either MDI or MDIX. Syntax show port mdix {all|auto|forced-auto|mdi|mdix} [port-string] Parameters all Display information about all ports.
set port mdix mdi Configure ports to use MDI mode only. mdix Configure ports to use MDIX mode only. port‐string (Optional) Specify the port or ports to configure. Defaults If port‐string is not entered, all ports on the switch are configured. Mode Switch command, read‐write. Usage By default, Enterasys Networks switch devices are configured to automatically detect the cable type connection, straight through (MDI) or cross‐over (MDIX), required by the cable connected to the port.
Setting Flow Control Setting Flow Control Purpose To review, enable or disable port flow control. Flow control is used to manage the transmission between two devices as specified by IEEE 802.3x to prevent receiving ports from being overwhelmed by frames from transmitting devices. Commands For information about... show flowcontrol 7-22 set flowcontrol 7-22 show flowcontrol Use this command to display the flow control state. Syntax show flowcontrol Parameters None. Defaults None.
set flowcontrol Defaults None. Mode Switch command, read‐write.
Setting Port Link Traps and Link Flap Detection Setting Port Link Traps and Link Flap Detection Purpose To disable or re‐enable link traps, display link trap status, and to configure the link flapping detection function. By default, all ports are enabled to send SNMP trap messages indicating changes to their link status (up or down).
set port trap Defaults If port‐string is not specified, the trap status for all ports will be displayed. Mode Switch command, read‐write. Example This example shows how to display link trap status for ge.3.1 through 4: C3(su)->show port trap ge.3.1-4 Link traps enabled on port ge.3.1. Link traps enabled on port ge.3.2. Link traps enabled on port ge.3.3. Link traps enabled on port ge.3.4.
show linkflap Parameters globalstate Displays the global enable state of link flap detection. portstate Displays the port enable state of link flap detection. parameters Displays the current value of settable link flap detection parameters. metrics Displays linkflap detection metrics. portsupported Displays ports which can support the link flap detection function. actsupported Displays link flap detection actions supported by system hardware.
show linkflap Examples This example shows how to display the global status of the link trap detection function: C3(rw)->show linkflap globalstate Linkflap feature globally disabled This example shows how to display ports disabled by link flap detection due to a violation: C3(rw)->show linkflap downports Ports currently held DOWN for Linkflap violations: None.
set linkflap globalstate Table 7-5 show linkflap metrics Output Details (Continued) Output Field What it displays... TimeElapsed Time (in seconds) since the last link down event. Violations Number of link flap violations on listed ports since system start. set linkflap globalstate Use this command to globally enable or disable the link flap detection function.
set linkflap interval Mode Switch command, read‐write. Example This example shows how to enable the link trap monitoring on all ports. C3(rw)->set linkflap portstate enable set linkflap interval Use this command to set the time interval (in seconds) for accumulating link down transitions. Syntax set linkflap interval port-string interval-value Parameters port‐string Specifies the port(s) on which to set the link flap interval. interval‐value Specifies an interval in seconds.
clear linkflap action Defaults None. Mode Switch mode, read‐write. Example This example shows how to set the link flap violation action on port ge.1.4 to generating a Syslog entry. C3(rw)->set linkflap action ge.1.4 gensyslogentry clear linkflap action Use this command to clear reactions to a link flap violation. Syntax clear linkflap action [port-string] {disableInterface | gensyslogentry | gentrap | all} Parameters port‐string (Optional) Specifies the port(s) on which to clear the link flap action.
set linkflap downtime Parameters port‐string Specifies the port(s) on which to set the link flap action trigger count. threshold‐value Specifies the number of link down transitions necessary to trigger the link flap action. A minimum of 1 must be configured. Defaults None. Mode Switch mode, read‐write. Example This example shows how to set the link flap threshold on port ge.1.4 to 5. C3(rw)->set linkflap threshold ge.1.
clear linkflap Parameters port‐string (Optional) Specifies the ports to make operational. Defaults If port‐string is not specified, all ports disabled by a link flap violation will be made operational. Mode Switch mode, read‐write. Example This example shows how to make disabled port ge.1.4 operational. C3(rw)->clear linkflap down ge.1.4 clear linkflap Use this command to clear all link flap options and / or statistics on one or more ports.
Configuring Broadcast Suppression Configuring Broadcast Suppression Purpose To review and set the broadcast suppression threshold for one or more ports. This feature limits the number of received broadcast frames the switch will accept per port. Broadcast suppression thresholds apply only to broadcast traffic—multicast traffic is not affected. By default, a broadcast suppression threshold of 14881 packets per second (pps) will be used, regardless of actual port speed.
set port broadcast ge.1.2 ge.1.3 ge.1.4 0 0 0 50 40 14881 set port broadcast Use this command to set the broadcast suppression threshold, in packets per second, on one or more ports. This sets a threshold on the broadcast traffic that is received and switched out to other ports. Syntax set port broadcast port-string threshold-val Parameters port‐string Select the ports for which to configure broadcast suppression thresholds.
clear port broadcast Parameters port‐string Select the ports for which to clear broadcast suppression thresholds. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example clears the broadcast threshold limit to 14881 pps for ports 1 through 5: C3(su)->clear port broadcast ge.1.
Port Mirroring Port Mirroring Caution: Port mirroring configuration should be performed only by personnel who are knowledgeable about the effects of port mirroring and its impact on network operation. The SecureStack C3 device allows you to mirror (or redirect) the traffic being switched on a port for the purposes of network traffic analysis and connection assurance. When port mirroring is enabled, one port becomes a monitor port for another port within the device.
Port Mirroring • On switches on the path from the source port to the remote destination, egress tagging has to be enabled on potential egress ports for the mirror VLAN. With the introduction of remote port mirroring: • Configured mirror destination ports will NOT lose their switching or routing properties as they do on SecureStack A2, B2, or C2 products. • On switches where the mirror VLAN has been configured, any traffic on that VLAN will be flooded on the VLAN.
show port mirroring Port Mirroring ============== Source Port = ge.1.3 Target Port = ge.1.2 Frames Mirrored = Rx and Tx Port Mirroring status disabled 4. When you are ready to enable this instance, enter MIB option 1 (active) and perform an SNMP Set operation. 5. (Optional) Use the CLI to verify the port mirroring instance has been enabled. To delete a port mirroring instance: 1. Select a previously created port mirroring instance in your MIB browser. 2.
set port mirroring Mode Switch command, read‐only. Example This example shows how to display port mirroring information. In this case, ge.1.4 is configured as a source port and ge.1.11 is a target and mirroring has been enabled between these ports: C3(su)->show port mirroring Port Mirroring ============== Source Port = ge.1.4 Target Port = ge.1.11 Frames Mirrored = Rx and Tx Port Mirroring status enabled.
clear port mirroring Example This example shows how to create and enable port mirroring with ge.1.4 as the source port, and ge.1.11 as the target port: C3(su)->set port mirroring create ge.1.4 ge.1.11 clear port mirroring Use this command to clear a port mirroring relationship. Syntax clear port mirroring source destination Parameters source Specifies the source port of the mirroring configuration to be cleared.
clear mirror vlan Mode Switch command, read‐write. Usage Refer to “Remote Port Mirroring” on page 7‐36 for information about configuring mirror VLANs. Use the show port mirroring command to display the VLANs configured for remote port mirroring. Example The following example assigns a VLAN for mirroring traffic and then shows the configured port mirroring with the show port mirror command. C3(su)->set mirror vlan 2 C3(su)->show port mirroring Port Mirroring ============== Source Port = ge.1.
Link Aggregation Control Protocol (LACP) Link Aggregation Control Protocol (LACP) Caution: Link aggregation configuration should only be performed by personnel who are knowledgeable about Spanning Tree and Link Aggregation, and fully understand the ramifications of modifications beyond device defaults. Otherwise, the proper operation of the network could be at risk.
Link Aggregation Control Protocol (LACP) • A means of identifying the set of capabilities associated with each port and with each aggregator, as understood by a given device. • A means of identifying a LAG and its associated aggregator. Note: The path cost of a LAG port will be displayed as zero when it is not an active link. LACP Terminology Table 7‐6 defines key terminology used in LACP configuration.
Link Aggregation Control Protocol (LACP) is, will block redundant paths). For information about building static aggregations, refer to set lacp static (page 7‐48). Each SecureStack C3 module provides six virtual link aggregator ports, which are designated in the CLI as lag.0.1 through lag.0.6. Each LAG can have up to eight associated physical ports. Once underlying physical ports (for example, fe.x.x, or ge.x.
show lacp For information about... Refer to page... set lacp singleportlag 7-50 clear lacp singleportlag 7-49 show port lacp 7-51 set port lacp 7-52 clear port lacp 7-54 show lacp Use this command to display information about one or more aggregator ports. Syntax show lacp [port-string] Parameters port‐string (Optional) Displays LACP information for specific LAG port(s). Valid port designations are lag.0.1 ‐ 6.
set lacp Table 7-7 show lacp Output Details Output Field What It Displays... Global Link Aggregation state Shows if LACP is enabled or disabled on the switch. Single Port LAGs Displays if the single port LAG feature has been enabled on the switch. See “set lacp singleportlag” on page 7-50 for more about single port LAG. Aggregator LAG port designation. Each SecureStack C3 module provides 6 virtual link aggregator ports, which are designated in the CLI as lag.0.1 through lag.0.6.
set lacp asyspri set lacp asyspri Use this command to set the LACP system priority. Syntax set lacp asyspri value Parameters asyspri Sets the system priority to be used in creating a LAG (Link Aggregation Group) ID. Valid values are 0 to 65535. value Specifies a system priority value. Valid values are 0 to 65535, with precedence given to lower values. Defaults None. Mode Switch command, read‐write. Usage LACP uses this value to determine aggregation precedence.
clear lacp Usage LACP will use this value to form an oper key. Only underlying physical ports with oper keys matching those of their aggregators will be allowed to aggregate. The default admin key value for all LAG ports is 32768. Example This example shows how to set the LACP admin key to 2000 for LAG port 6: C3(su)->set lacp aadminkey lag.0.6 2000 clear lacp Use this command to clear LACP system priority or admin key settings.
clear lacp static key (Optional) Specifies the new member port and LAG port aggregator admin key value. Only ports with matching keys are allowed to aggregate. Valid values are 0 ‐ 65535. Note: This key value must be unique. If ports other than the desired underlying physical ports share the same admin key value, aggregation will fail or undesired aggregations will form. port‐string Specifies the member port(s) to add to the LAG.
set lacp singleportlag set lacp singleportlag Use this command to enable or disable the formation of single port LAGs. Syntax set lacp singleportlag {enable | disable} Parameters disable | enable Enables or disables the formation of single port LAGs. Defaults None. Mode Switch command, read‐write. Usage When single port LAGs are enabled, Link Aggregration Groups can be formed when only one port is receiving protocol transmissions from a partner.
show port lacp Example This example shows how to reset the single port LAG function back to disabled: C3(su)->clear lacp singleportlag show port lacp Use this command to display link aggregation information for one or more underlying physical ports. Syntax show port lacp port port-string {[status {detail | summary}] | [counters]} Parameters port port‐string Displays LACP information for specific port(s).
set port lacp Port Instance: ge.1.
set port lacp aadminstate lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire Sets the port’s actor LACP administrative state to allow for: lacpactive ‐ Transmitting LACP PDUs. lacptimeout ‐ Transmitting LACP PDUs every 1 sec. vs 30 sec. (default). lacpagg ‐ Aggregation on this port. lacpsync ‐ Transition to synchronization state. lacpcollect ‐ Transition to collection state. lacpdist ‐ Transition to distribution state. lacpdef ‐ Transition to defaulted state.
clear port lacp Mode Switch command, read‐write. Usage LACP commands and parameters beginning with an “a” (such as aadminkey) set actor values. Corresponding commands and parameters beginning with a “p” (such as padminkey) set corresponding partner values. Actor refers to the local device participating in LACP negotiation, while partner refers to its remote device partner at the other end of the negotiation.
clear port lacp padminport Deletes a partner port from the LACP configuration. padminstate lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire | all Clears the port’s specific partner admin state, or all partner admin state(s). Defaults None. Mode Switch command, read‐write.
Configuring Protected Ports Configuring Protected Ports The Protected Port feature is used to prevent ports from forwarding traffic to each other, even when they are on the same VLAN. Ports may be designated as either protected or unprotected. Ports are unprotected by default. Multiple groups of protected ports are supported. Protected Port Operation Ports that are configured to be protected cannot forward traffic to other protected ports in the same group, regardless of having the same VLAN membership.
show port protected Example This example shows how to assign ports ge.1.1 through ge.1.3 to protected port group 1: C3(rw)->set port protected ge.1.1-3 1 show port protected Use this command to display information about the ports configured for protected mode. Syntax show port protected [port-string] | [group-id] Parameters port‐string (Optional) Specifies the port or ports for which to display information. group‐id (Optional) Specifies the id of the group for which to display information.
set port protected name Mode Switch command, read‐write. Example This example shows how to clear protected ports ge.1.1 through ge.1.3: C3(rw)->clear port protected ge.1.1-3 set port protected name Use this command to assign a name to a protected port group id. Syntax set port protected name group-id name Parameters group‐id Specifies the id of this group. Id can range from 0 to 2. name Specifies a name for the group. The name can be up to 32 characters in length. Defaults None.
clear port protected name Example This example shows how to show the name of protected port group 1: C3(ro)->show port protected name 1 Group ID Group Name ----------------------------1 group1 clear port protected name Use this command to clear the name of a protected group. Syntax clear port protected name group-id Parameters group‐id Specifies the id of the group for which to clear the name. Id can range from 0 to 2. Defaults None. Mode Switch command, read‐write.
clear port protected name 7-60 Port Configuration
8 SNMP Configuration This chapter describes the Simple Network Management Protocol (SNMP) set of commands and how to use them. For information about... Refer to page...
SNMP Configuration Summary SNMPv1 and SNMPv2c The components of SNMPv1 and SNMPv2c network management fall into three categories: • Managed devices (such as a switch). • SNMP agents and MIBs, including SNMP traps, community strings, and Remote Monitoring (RMON) MIBs, which run on managed devices. • SNMP network management applications, such as the Enterasys NetSight application, which communicate with agents to get statistics and alerts from the managed devices.
Reviewing SNMP Statistics Table 8-1 SNMP Security Levels Model Security Level Authentication Encryption How It Works v1 NoAuthNoPriv Community string None Uses a community string match for authentication. v2c NoAuthNoPriv Community string None Uses a community string match for authentication. v3 NoAuthNoPriv User name None Uses a user name match for authentication. AuthNoPriv MD5 or SHA None Provides authentication based on the HMAC-MD5 or HMAC-SHA algorithms.
show snmp engineid Commands For information about... Refer to page... show snmp engineid 8-4 show snmp counters 8-5 show snmp engineid Use this command to display the SNMP local engine ID. This is the SNMP v3 engine’s administratively unique identifier. Syntax show snmp engineid Parameters None. Defaults None. Mode Switch command, read‐only.
show snmp counters show snmp counters Use this command to display SNMP traffic counter values. Syntax show snmp counters Parameters None. Defaults None. Mode Switch command, read‐only.
show snmp counters usmStatsUnknownEngineIDs usmStatsWrongDigests usmStatsDecryptionErrors = 0 = 0 = 0 Table 8‐3 provides an explanation of the command output. Table 8-3 8-6 show snmp counters Output Details Output Field What It Displays... snmpInPkts Number of messages delivered to the SNMP entity from the transport service. snmpOutPkts Number of SNMP messages passed from the SNMP protocol entity to the transport service.
show snmp counters Table 8-3 show snmp counters Output Details (Continued) Output Field What It Displays... snmpOutBadValues Number of SNMP PDUs generated by the SNMP protocol entity with the value of the error-status field as "badValue." snmpOutGenErrs Number of SNMP PDUs generated by the SNMP protocol entity with the value of the error-status field as "genErr." snmpOutGetRequests Number of SNMP Get-Request PDUs generated by the SNMP protocol entity.
Configuring SNMP Users, Groups, and Communities Configuring SNMP Users, Groups, and Communities Purpose To review and configure SNMP users, groups, and v1 and v2 communities. These are defined as follows: • User — A person registered in SNMPv3 to access SNMP management. • Group — A collection of users who share the same SNMP access privileges. • Community — A name used to authenticate SNMPv1 and v2 users. Commands For information about... Refer to page...
set snmp user If user is not specified, information about all SNMP users will be displayed. If remote is not specified, user information about the local SNMP engine will be displayed. If not specified, user information for all storage types will be displayed. Mode Switch command, read‐only.
set snmp user Parameters user Specifies a name for the SNMPv3 user. remote remoteid (Optional) Registers the user on a specific remote SNMP engine. encryption des | aes (Optional) Specifies the encryption type for this user. AES refers to the Advanced Encryption Standard using a 128 bit key size. privacy privpassword (Optional) Specifies an encryption password. Minimum of 8 characters. Required if encryption is specified.
clear snmp user clear snmp user Use this command to remove a user from the SNMPv3 security‐model list. Syntax clear snmp user user [remote remote] Parameters user Specifies an SNMPv3 user to remove. remote remote (Optional) Removes the user from a specific remote SNMP engine. Defaults If remote is not specified, the user will be removed from the local SNMP engine. Mode Switch command, read‐write.
set snmp group Mode Switch command, read‐only. Example This example shows how to display SNMP group information: C3(su)->show snmp group --- SNMP group information --Security model = SNMPv1 Security/user name = public Group name = Anyone Storage type = nonVolatile Row status = active Security model Security/user name Group name Storage type Row status = = = = = SNMPv1 public.router1 Anyone nonVolatile active Table 8‐5 provides an explanation of the command output.
clear snmp group Mode Switch command, read‐write. Example This example shows how to create an SNMP group called “anyone”, assign a user named “public” and assign SNMPv3 security to the group: C3(su)->set snmp group anyone user public security-model usm clear snmp group Use this command to clear SNMP group settings globally or for a specific SNMP group and user. Syntax clear snmp group groupname user [security-model {v1 | v2c | usm}] Parameters groupname Specifies the SNMP group to be cleared.
set snmp community Mode Switch command, read‐only. Example This example shows how to display information about the SNMP “public” community name. For a description of this output, refer to set snmp community (page 8‐14). C3(su)->show snmp community public --- Configured community strings --Name Security name Context Transport tag Storage type Status = = = = = = ********* public nonVolatile active set snmp community Use this command to configure an SNMP community group.
clear snmp community Usage When you configure a community name, if you don’t specify a context with the context parameter, the default (NULL) context is applied. If you want to change a configured context back to the default (NULL )context, enter a hyphen as the value of the context parameter, as shown in the Examples below. Examples This example shows how to set an SNMP community name called “vip.
show snmp access Commands For information about... Refer to page... show snmp access 8-16 set snmp access 8-18 clear snmp access 8-19 show snmp access Use this command to display access rights and security levels configured for SNMP one or more groups.
show snmp access Example This example shows how to display SNMP access information: C3(su)->show snmp Group = Security model = Security level = Read View = Write View = Notify View = Context match = Storage type = Row status = access SystemAdmin USM noAuthNoPriv All Group Security model Security level Read View Write View Notify View Context match Storage type Row status NightOperator USM noAuthNoPriv All = = = = = = = = = All exact match nonVolatile active All exact match nonVolatile active Table 8
set snmp access set snmp access Use this command to set an SNMP access configuration. Syntax set snmp access groupname security-model {v1 | v2c | usm} [noauthentication | authentication | privacy] [context context] [exact | prefix] [read read] [write write] [notify notify] [volatile | nonvolatile] Parameters groupname Specifies a name for an SNMPv3 group. security‐model v1 | v2c | usm Specifies SNMP version 1, 2c or 3 (usm).
clear snmp access clear snmp access Use this command to clear the SNMP access entry of a specific group, including its set SNMP security‐model, and level of security. Syntax clear snmp access groupname security-model {v1 | v2c | usm} [noauthentication | authentication | privacy] [context context] Parameters groupname Specifies the name of the SNMP group for which to clear access. security‐model v1 | v2c | usm Specifies the security model to be cleared for the SNMP access group.
show snmp view show snmp view Use this command to display the MIB configuration for SNMPv3 view‐based access (VACM). Syntax show snmp view [viewname] [subtree oid-or-mibobject] [volatile | nonvolatile | read-only] Parameters viewname (Optional) Displays information for a specific MIB view. subtree oid‐or‐mibobject (Optional) Displays information for a specific MIB subtree when viewname is specified. volatile | nonvolatile | read‐only (Optional) Displays entries for a specific storage type.
show snmp context Table 8-7 show snmp view Output Details Output Field What It Displays... View Name Name assigned to a MIB view. Subtree OID Name identifying a MIB subtree. Subtree mask Bitmask applied to a MIB subtree. View Type Whether or not subtree use must be included or excluded for this view. Storage type Whether storage is in nonVolatile or Volatile memory Row status Status of this entry: active, notInService, or notReady.
clear snmp view Parameters viewname viewname Specifies a name for a MIB view. subtree subtree Specifies a MIB subtree name. mask mask (Optional) Specifies a bitmask for a subtree. included | excluded (Optional) Specifies subtree use (default) or no subtree use. volatile | nonvolatile (Optional) Specifies the use of temporary or permanent (default) storage. Defaults If not specified, mask will be set to 255.255.255.255 If not specified, subtree use will be included.
Configuring SNMP Target Parameters Configuring SNMP Target Parameters Purpose To review and configure SNMP target parameters. This controls where and under what circumstances SNMP notifications will be sent. A target parameter entry can be bound to a target IP address allowed to receive SNMP notification messages with the set snmp targetaddr command (“set snmp targetaddr” on page 8‐27). Commands For information about... Refer to page...
set snmp targetparams Target Parameter Name Security Name Message Proc. Model Security Level Storage type Row status = = = = = = v2cExampleParams public SNMPv2c noAuthNoPriv nonVolatile active Target Parameter Name Security Name Message Proc. Model Security Level Storage type Row status = = = = = = v3ExampleParams CharlieDChief USM authNoPriv nonVolatile active Table 8‐8 provides an explanation of the command output. Table 8-8 show snmp targetparams Output Details Output Field What It Displays...
clear snmp targetparams noauthentication | authentication | privacy (Optional) Specifies the SNMP security level applied to this target parameter as no authentication, authentication (without privacy) or privacy. Privacy specifies that messages sent on behalf of the user are protected from disclosure. volatile | nonvolatile (Optional) Specifies the storage type applied to this target parameter. Defaults None. If not specified, security level will be set to noauthentication.
Configuring SNMP Target Addresses Configuring SNMP Target Addresses Purpose To review and configure SNMP target addresses which will receive SNMP notification messages. An address configuration can be linked to optional SNMP transmit, or target, parameters (such as timeout, retry count, and UDP port) set with the set snmp targetparams command (page 8‐24). Commands For information about... Refer to page...
set snmp targetaddr Row status = active Table 8‐9 provides an explanation of the command output. Table 8-9 show snmp targetaddr Output Details Output Field What It Displays... Target Address Name Unique identifier in the snmpTargetAddressTable. Tag List Tags a location to the target address as a place to send notifications. IP Address Target IP address. UDP Port# Number of the UDP port of the target host to use. Target Mask Target IP address mask.
clear snmp targetaddr taglist taglist (Optional) Specifies a list of SNMP notify tag values. This tags a location to the target address as a place to send notifications. List must be enclosed in quotes and tag values must be separated by a space (for example, “tag 1 tag 2”). volatile | nonvolatile (Optional) Specifies temporary (default), or permanent storage for SNMP entries. Defaults If not specified, udpport will be set to 162. If not specified, mask will be set to 255.255.255.
Configuring SNMP Notification Parameters Example This example shows how to clear SNMP target address entry “tr”: C3(su)->clear snmp targetaddr tr Configuring SNMP Notification Parameters About SNMP Notify Filters Profiles indicating which targets should not receive SNMP notification messages are kept in the NotifyFilter table. If this table is empty, meaning that no filtering is associated with any SNMP target, then no filtering will take place.
show newaddrtrap show newaddrtrap Use this command to display the global and port‐specific status of the SNMP new MAC addresses trap function. Syntax show newaddrtrap [port-string] Parameters port‐string (Optional) Displays the status of the new MAC addresses trap function on specific ports. Defaults If port‐string is not specified, the status of the new MAC addresses trap function will be displayed for all ports. Mode Switch command, read‐only.
show snmp notify Parameters port‐string (Optional) Enable or disable the new MAC addresses trap function on specific ports. enable | disable Enable or disable the new MAC addresses trap function. If entered without the port‐string parameter, enables or disables the function globally. When entered with the port‐string parameter, enables or disables the function on specific ports. Defaults If port‐string is not specified, the trap function is set globally. Mode Switch mode, read‐write.
set snmp notify Example This example shows how to display the SNMP notify information: C3(su)->show snmp notify --- SNMP notifyTable information --Notify name = 1 Notify Tag = Console Notify Type = trap Storage type = nonVolatile Row status = active Notify name Notify Tag Notify Type Storage type Row status = = = = = 2 TrapSink trap nonVolatile active Table 8‐10 provides an explanation of the command output. Table 8-10 show snmp notify Output Details Output Field What It Displays...
clear snmp notify If not specified, storage type will be set to nonvolatile. Mode Switch command, read‐write. Example This example shows how to set an SNMP notify configuration with a notify name of “hello” and a notify tag of “world”. Notifications will be sent as trap messages and storage type will automatically default to permanent: C3(su)->set snmp notify hello tag world trap clear snmp notify Use this command to clear an SNMP notify configuration.
set snmp notifyfilter Parameters profile (Optional) Displays a specific notify filter. subtree oid‐or‐ mibobject (Optional) Displays a notify filter within a specific subtree. volatile | nonvolatile | read‐ only (Optional) Displays notify filter entries of a specific storage type. Defaults If no parameters are specified, all notify filter information will be displayed. Mode Switch command, read‐only. Usage See “About SNMP Notify Filters” on page 8‐29 for more information about notify filters.
clear snmp notifyfilter included | excluded (Optional) Specifies that subtree is included or excluded. volatile | nonvolatile (Optional) Specifies a storage type. Defaults If not specified, mask is not set. If not specified, subtree will be included. If storage type is not specified, nonvolatile (permanent) will be applied. Mode Switch command, read‐write. Usage See “About SNMP Notify Filters” on page 8‐29 for more information about notify filters.
show snmp notifyprofile show snmp notifyprofile Use this command to display SNMP notify profile information. This associates target parameters to an SNMP notify filter to determine who should not receive SNMP notifications. Syntax show snmp notifyprofile [profile] [targetparam targetparam] [volatile | nonvolatile | read-only] Parameters profile (Optional) Displays a specific notify profile. targetparam targetparam (Optional) Displays entries for a specific target parameter.
clear snmp notifyprofile Parameters profile Specifies an SNMP filter notify name. targetparam targetparam Specifies an associated entry in the SNMP Target Params Table. volatile | nonvolatile (Optional) Specifies a storage type. Defaults If storage type is not specified, nonvolatile (permanent) will be applied. Mode Switch command, read‐write. Example This example shows how to create an SNMP notify profile named area51 and associate a target parameters entry.
Creating a Basic SNMP Trap Configuration occur. The following configuration example shows how to use CLI commands to associate SNMP notification parameters with security and authorization criteria (target parameters), and map the parameters to a management target address. Note: This example illustrates how to configure an SNMPv2 trap notification. Creating an SNMPv1 or v3 Trap, or an SNMPv3 Inform notification would require using the same commands with different parameters, where appropriate.
Configuring the SNMP Management Interface How SNMP Will Use This Configuration In order to send a trap/notification requested by a MIB code, the SNMP agent requires the equivalent of a trap “door”, a “key” to unlock the door, and a “procedure” for crossing the doorstep. To determine if all these elements are in place, the SNMP agent proceeds as follows: 1. Determines if the “keys” for trap “doors” do exist.
set snmp interface Defaults None. Mode Switch mode, read‐only. Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the SNMP agent. C3(rw)->show snmp interface loopback 1 192.168.10.1 set snmp interface Use this command to specify the interface used for the source IP address of the SNMP agent when generating SNMP traps.
clear snmp interface Example This example configures an IP address on VLAN interface 100 and then sets that interface as the SNMP agent source IP address. C3(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0 C3(rw)->router(Config-if(Vlan 100))#exit C3(rw)->router(Config)#exit C3(rw)->router#exit C3(rw)->router>exit C3(rw)->set snmp interface vlan 100 C3(rw)->show snmp interface vlan 100 192.168.10.
clear snmp interface 8-42 SNMP Configuration
9 Spanning Tree Configuration This chapter describes the Spanning Tree Configuration set of commands and how to use them. For information about... Refer to page...
Spanning Tree Configuration Summary MSTP The IEEE 802.1s Multiple Spanning Tree Protocol (MSTP) builds upon 802.1D and RSTP by optimizing utilization of redundant links between switches in a network. When redundant links exist between a pair of switches running single STP, one link is forwarding while the others are blocking for all traffic flowing between the two switches. The blocking links are effectively used only if the forwarding link goes down.
Configuring Spanning Tree Bridge Parameters listening if it fails to get a response. This protects against misconfiguration and protocol failure by the connected bridge. The Disputed BPDU mechanism protects against looping in situations where there is one way communication. A disputed BPDU is one in which the flags field indicates a designated role and learning and the priority vector is worse than that already held by the port. If a disputed BPDU is received, the port is forced to the listening state.
Configuring Spanning Tree Bridge Parameters Commands For information about... 9-4 Refer to page...
show spantree stats For information about... Refer to page...
show spantree stats Mode Switch command, read‐only.
set spantree Table 9-1 show spantree Output Details (Continued) Output What It Displays... Bridge Hello Time Amount of time (in seconds) the bridge sends BPDUs. This is a default value, or is assigned using the set spantree hello command. For details, refer to “set spantree hello” on page 9-18. Bridge Forward Delay Amount of time (in seconds) the bridge spends in listening or learning mode. This is a default value, or is assigned using the set spantree fwddelay command.
set spantree version Defaults None. Mode Switch command, read‐only. Example This example shows how to display Spanning Tree version information for the device: C3(su)->show spantree version Force Version is mstp set spantree version Use this command to set the version of the Spanning Tree protocol to MSTP (Multiple Spanning Tree Protocol), RSTP (Rapid Spanning Tree Protocol) or to STP 802.1D‐compatible.
clear spantree version clear spantree version Use this command to reset the Spanning Tree version to MSTP mode. Syntax clear spantree version Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the Spanning Tree version: C3(su)->clear spantree version show spantree bpdu-forwarding Use this command to display the Spanning Tree BPDU forwarding mode. Syntax show spantree bpdu-forwarding Parameters None. Defaults None.
set spantree bpdu-forwarding set spantree bpdu-forwarding Use this command to enable or disable Spanning Tree BPDU forwarding. By default BPDU forwarding is disabled. Syntax set spantree bpdu-forwarding {disable | enable} Parameters disable | enable Disables or enables BPDU forwarding;. Defaults By default BPDU forwarding is disabled. Mode Switch command, read‐write. Usage The Spanning Tree protocol must be disabled (set spantree disable) for this feature to take effect.
set spantree bridgeprioritymode set spantree bridgeprioritymode Use this command to set the Spanning Tree bridge priority mode to 802.1D (legacy) or 802.1t. Syntax set spantree bridgeprioritymode {8021d | 8021t} Parameters 8021d Sets the bridge priority mode to use 802.1D (legacy) values, which are 0 ‐ 65535. 8021t Sets the bridge priority mode to use 802.1t values, which are 0 to 61440, in increments of 4096. Values will automatically be rounded up or down, depending on the 802.
show spantree mstilist Example This example shows how to reset the bridge priority mode to 802.1t: C3(rw)->clear spantree bridgeprioritymode show spantree mstilist Use this command to display a list of Multiple Spanning Tree (MST) instances configured on the device. Syntax show spantree mstilist Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display a list of MST instances.
clear spantree msti Example This example shows how to create an MST instance 2: C3(su)->set spantree msti sid 2 create clear spantree msti Use this command to delete one or more Multiple Spanning Tree instances. Syntax clear spantree msti [sid sid] Parameters sid sid (Optional) Deletes a specific multiple Spanning Tree ID. Defaults If sid is not specified, all MST instances will be cleared. Mode Switch command, read‐write.
set spantree mstmap FID: 1 SID: 0 set spantree mstmap Use this command to map one or more filtering database IDs (FIDs) to a SID. Since VLANs are mapped to FIDs, this essentially maps one or more VLAN IDs to a Spanning Tree (SID). Note: Since any MST maps that are associated with GVRP-generated VLANs will be removed from the configuration if GVRP communication is lost, it is recommended that you only create MST maps on statically-created VLANs.
show spantree vlanlist Example This example shows how to map FID 2 back to SID 0: C3(su)->clear spantree mstmap 2 show spantree vlanlist Use this command to display the Spanning Tree ID(s) assigned to one or more VLANs. Syntax show spantree vlanlist [vlan-list] Parameters vlan‐list (Optional) Displays SIDs assigned to specific VLAN(s). Defaults If not specified, SID assignment will be displayed for all VLANs. Mode Switch command, read‐only.
set spantree mstcfgid Example This example shows how to display the MST configuration identifier elements. In this case, the default revision level of 0, and the default configuration name (a string representing the bridge MAC address) have not been changed.
set spantree priority Mode Switch command, read‐write. Example This example shows how to reset the MST configuration identifier elements to default values: C3(su)->clear spantree mstcfgid set spantree priority Use this command to set the device’s Spanning Tree priority. Syntax set spantree priority priority [sid] Parameters priority Specifies the priority of the bridge. Valid values are from 0 to 61440 (in increments of 4096), with 0 indicating highest priority and 61440 lowest priority.
set spantree hello Parameters sid (Optional) Resets the priority on a specific Spanning Tree. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. Defaults If sid is not specified, priority will be reset on Spanning Tree 0. Mode Switch command, read‐write.
set spantree maxage Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to globally reset the Spanning Tree hello time: C3(su)->clear spantree hello set spantree maxage Use this command to set the bridge maximum aging time. Syntax set spantree maxage agingtime Parameters agingtime Specifies the maximum number of seconds that the system retains the information received from other bridges through STP. Valid values are 6 ‐ 40. Defaults None.
clear spantree maxage clear spantree maxage Use this command to reset the maximum aging time for a Spanning Tree to the default value of 20 seconds. Syntax clear spantree maxage Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to globally reset the maximum aging time: C3(su)->clear spantree maxage set spantree fwddelay Use this command to set the Spanning Tree forward delay.
clear spantree fwddelay C3(su)->set spantree fwddelay 16 clear spantree fwddelay Use this command to reset the Spanning Tree forward delay to the default setting of 15 seconds. Syntax clear spantree fwddelay Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to globally reset the bridge forward delay: C3(su)->clear spantree fwddelay show spantree backuproot Use this command to display the backup root status for an MST instance.
set spantree backuproot set spantree backuproot Use this command to enable or disable the Spanning Tree backup root function on the switch. Syntax set spantree backuproot sid {disable | enable} Parameters sid Specifies the Spanning Tree instance on which to enable or disable the backup root function.Valid values are 0 ‐ 4094. disable | enable Enables or disables the backup root function. Defaults None. Mode Switch command, read‐write.
show spantree tctrapsuppress Example This example shows how to reset the backup root function to disabled on SID 2: C3(rw)->clear spantree backuproot 2 show spantree tctrapsuppress Use this command to display the status of topology change trap suppression on Rapid Spanning Tree edge ports. Syntax show spantree tctrapsuppress Parameters None. Defaults None. Mode Switch command, read‐only.
clear spantree tctrapsuppress Usage By default, RSTP non‐edge (bridge) ports that transition to forwarding or blocking cause the switch to issue a topology change trap. When topology change trap suppression is enabled, which is the device default, edge ports (such as end station PCs) are prevented from sending topology change traps. This is because there is usually no need for network management to monitor edge port STP transition states, such as when PCs are powered on.
show spantree spanguard Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the protocol state migration machine on port 20: C3(su)->set spantree protomigration ge.1.20 show spantree spanguard Use this command to display the status of the Spanning Tree SpanGuard function. Syntax show spantree spanguard Parameters None. Defaults None. Mode Switch command, read‐only.
clear spantree spanguard Mode Switch command, read‐write. Usage SpanGuard is designed to disable, or lock out an “edge” port when an unexpected BPDU is received. The port can be configured to be re‐enabled after a set time period, or only after manual intervention. A port can be defined as an edge (user) port using the set spantree adminedge command, described in “set spantree adminedge” on page 9‐40.
show spantree spanguardtimeout show spantree spanguardtimeout Use this command to display the Spanning Tree SpanGuard timeout setting. Syntax show spantree spanguardtimeout Parameters None. Defaults None. Mode Switch command, read‐only.
clear spantree spanguardtimeout clear spantree spanguardtimeout Use this command to reset the Spanning Tree SpanGuard timeout to the default value of 300 seconds. Syntax clear spantree spanguardtimeout Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the SpanGuard timeout to 300 seconds: C3(rw)->clear spantree spanguardtimeout show spantree spanguardlock Use this command to display the SpanGuard lock status of one or more ports.
clear / set spantree spanguardlock clear / set spantree spanguardlock Use either of these commands to unlock one or more ports locked by the Spanning Tree SpanGuard function. When SpanGuard is enabled, it locks ports that receive BPDUs when those ports have been defined as edge (user) ports (as described in “set spantree adminedge” on page 9‐40). Syntax clear spantree spanguardlock port-string set spantree spanguardlock port-string Parameters port‐string Specifies port(s) to unlock.
set spantree spanguardtrapenable set spantree spanguardtrapenable Use this command to enable or disable the sending of an SNMP trap message when SpanGuard has locked a port. Syntax set spantree spanguardtrapenable {disable | enable} Parameters disable | enable Disables or enables sending SpanGuard traps. By default, sending traps is enabled. Defaults None. Mode Switch command, read‐write.
show spantree legacypathcost show spantree legacypathcost Use this command to display the default Spanning Tree path cost setting. Syntax show spantree legacypathcost Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the default Spanning Tree path cost setting. C3(su)->show spantree legacypathcost Legacy Path Cost is disabled. set spantree legacypathcost Use this command to enable or disable legacy (802.1D) path cost values.
clear spantree legacypathcost clear spantree legacypathcost Use this command to set the Spanning Tree default value for legacy path cost to 802.1t values. Syntax clear spantree legacypathcost Defaults None. Mode Switch command, read‐write. Example This example clears the legacy path cost to 802.1t values. C3(rw)->clear spantree legacypathcost show spantree autoedge Use this command to display the status of automatic edge port detection. Syntax show spantree autoedge Parameters None. Defaults None.
clear spantree autoedge Parameters disable | enable Disables or enables automatic edge port detection. Defaults None. Mode Switch command, read‐write. Example This example shows how to disable automatic edge port detection: C3(rw)->set spantree autoedge disable clear spantree autoedge Use this command to reset automatic edge port detection to the default state of enabled. Syntax clear spantree autoedge Parameters None. Defaults None. Mode Switch command, Read‐Write.
Configuring Spanning Tree Port Parameters Configuring Spanning Tree Port Parameters Purpose To display and set Spanning Tree port parameters. Commands For information about... Refer to page...
clear spantree portadmin Example This example shows how to disable Spanning Tree on ge.1.5: C3(rw)->set spantree portadmin ge.1.5 disable clear spantree portadmin Use this command to reset the default Spanning Tree admin status to enable on one or more ports. Syntax clear spantree portadmin port-string Parameters port‐string Resets the default admin status on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1.
show spantree portpri Example This example shows how to display port admin status for ge.1.1: C3(ro)->show spantree portadmin port ge.1.1 Port ge.1.1 has portadmin set to enabled show spantree portpri Use this command to show the Spanning Tree priority for one or more ports. Port priority is a component of the port ID, which is one element used in determining Spanning Tree port roles.
clear spantree portpri Parameters port‐string Specifies the port(s) for which to set Spanning Tree port priority. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. priority Specifies a number that represents the priority of a link in a Spanning Tree bridge. Valid values are from 0 to 240 (in increments of 16) with 0 indicating high priority. sid sid (Optional) Sets port priority for a specific Spanning Tree identifier.
show spantree adminpathcost show spantree adminpathcost Use this command to display the admin path cost for a port on one or more Spanning Trees. Syntax show spantree adminpathcost [port port-string] [sid sid] Parameters port port‐string (Optional) Displays the admin path cost value for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1.
clear spantree adminpathcost Example This example shows how to set the admin path cost to 200 for ge.3.2 on SID 1: C3(su)->set spantree adminpathcost ge.3.2 200 sid 1 clear spantree adminpathcost Use this command to reset the Spanning Tree default value for port admin path cost to 0. Syntax clear spantree adminpathcost port-string [sid sid] Parameters port‐string Specifies the port(s) for which to reset admin path cost.
set spantree adminedge Mode Switch command, read‐only. Example This example shows how to display the edge port status for ge.3.2: C3(su)->show spantree adminedge port ge.3.2 Port ge.3.2 has a Port Admin Edge of Edge-Port set spantree adminedge Use this command to set the edge port administrative status on a Spanning Tree port. Syntax set spantree adminedge port-string {true | false} Parameters port‐string Specifies the edge port.
show spantree operedge Parameters port‐string Specifies port(s) on which to reset edge port status. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset ge.1.11 as a non‐edge port: C3(su)->clear spantree adminedge ge.1.11 show spantree operedge Use this command to display the Spanning Tree edge port operating status for a port.
Configuring Spanning Tree Loop Protect Parameters Configuring Spanning Tree Loop Protect Parameters Purpose To display and set Spanning Tree Loop Protect parameters, including the global parameters of Loop Protect threshold, window, enabling traps, and disputed BPDU threshold, as well as per port and port/SID parameters. See “Loop Protect” on page 9‐2 for more information about the Loop Protect feature. Commands For information about... 9-42 Refer to page...
set spantree lp set spantree lp Use this command to enable or disable the Loop Protect feature per port and optionally, per SID. The Loop Protect feature is disabled by default. See “Loop Protect” on page 2. for more information. Syntax set spantree lp port-string {enable | disable} [sid sid] Parameters port‐string Specifies port(s) on which to enable or disable the Loop Protect feature. enable | disable Enables or disables the feature on the specified port.
clear spantree lp Defaults If no port‐string is specified, status is displayed for all ports. If no SID is specified, SID 0 is assumed. Mode Switch command, read‐only. Example This example shows how to display Loop Protect status on ge.2.3: C3(su)->show spantree lp port ge.2.3 LoopProtect is disabled on port ge.2.3 , SI clear spantree lp Use this command to return the Loop Protect status per port and optionally, per SID, to its default state of disabled.
clear spantree lplock Parameters port‐string (Optional) Specifies port(s) for which to display the Loop Protect lock status. sid sid (Optional) Specifies the specific Spanning Tree(s) for which to display the Loop Protect lock status. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed. Defaults If no port‐string is specified, status is displayed for all ports. If no SID is specified, SID 0 is assumed. Mode Switch command, read‐only.
set spantree lpcapablepartner set spantree lpcapablepartner Use this command to specify per port whether the link partner is Loop Protect capable. See “Loop Protect” on page 2. for more information. Syntax set spantree lpcapablepartner port-string {true | false} Parameters port‐string Specifies port(s) for which to configure a Loop Protect capable link partner. true | false Specifies whether the link partner is capable (true) or not (false). Defaults None. Mode Switch command, read‐write.
clear spantree lpcapablepartner Defaults If no port‐string is specified, Loop Protect capability for link partners is displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display the Loop Protect partner capability for ge.1.1: C3(rw)->show spantree lpcapablepartner port ge.1.1 Link partner of port ge.1.
show spantree lpthreshold Defaults None. The default event threshold is 3. Mode Switch command, read‐write. Usage The LoopProtect event threshold is a global integer variable that provides protection in the case of intermittent failures. The default value is 3. If the event counter reaches the threshold within a given period (the event window), then the port, for the given SID, becomes locked (that is, held indefinitely in the blocking state). If the threshold is 0, the ports are never locked.
set spantree lpwindow Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the Loop Protect event threshold to the default of 3: C3(rw)->clear spantree lpthreshold set spantree lpwindow Use this command to set the Loop Protect event window value in seconds. Syntax set spantree lpwindow value Parameters value Specifies the number of seconds that comprise the period during which Loop Protect events are counted. The default event window is 180 seconds. Defaults None.
clear spantree lpwindow Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the current Loop Protect window value: C3(rw)->show spantree lpwindow The Loop Protect event window is set to 120 seconds clear spantree lpwindow Use this command to reset the Loop Protect event window to the default value of 180 seconds. Syntax clear spantree lpwindow Parameters None. Defaults None. Mode Switch command, read‐write.
show spantree lptrapenable Defaults None. Mode Switch command, read‐write. Usage Loop Protect traps are sent when a Loop Protect event occurs, that is, when a port goes to listening due to not receiving BPDUs. The trap indicates port, SID and loop protection status. Example This example shows how to enable sending of Loop Protect traps: C3(rw)->set spantree lptrapenable enable show spantree lptrapenable Use this command to display the current status of Loop Protect event notification.
set spantree disputedbpduthreshold Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the Loop Protect event notification state to the default of disabled. C3(rw)->clear spantree lptrapenable set spantree disputedbpduthreshold Use this command to set the disputed BPDU threshold, which is the number of disputed BPDUs that must be received on a given port/SID until a disputed BPDU trap is sent.
show spantree disputedbpduthreshold Example This example shows how to set the disputed BPDU threshold value to 5: C3(rw)->set spantree disputedbpduthreshold 5 show spantree disputedbpduthreshold Use this command to display the current value of the disputed BPDU threshold. Syntax show spantree disputedbpduthreshold Parameters None. Defaults None. Mode Switch command, read‐only.
show spantree nonforwardingreason show spantree nonforwardingreason Use this command to display the reason for placing a port in a non‐forwarding state due to an exceptional condition. Syntax show spantree nonforwardingreason port-string [sid sid] Parameters port‐string Specifies port(s) for which to display the non‐forwarding reason. sid sid (Optional) Specifies the specific Spanning Tree(s) for which to display the non‐forwarding reason. Valid values are 0 ‐ 4094. If not specified, SID 0 is assumed.
10 802.1Q VLAN Configuration This chapter describes the SecureStack C3 system’s capabilities to implement 802.1Q virtual LANs (VLANs). For information about... Refer to page...
VLAN Configuration Summary Creating a Secure Management VLAN By default at startup, there is one VLAN configured on the SecureStack C3 device. It is VLAN ID 1, the DEFAULT VLAN. The default community name, which determines remote access for SNMP management, is set to “public” with read‐write access. If the SecureStack C3 device is to be configured for multiple VLANs, it may be desirable to configure a management‐only VLAN. This allows a station connected to the management VLAN to manage the device.
Viewing VLANs Viewing VLANs Purpose To display a list of VLANs currently configured on the device, to determine how one or more VLANs were created, the ports allowed and disallowed to transmit traffic belonging to VLAN(s), and if those ports will transmit the traffic with a VLAN tag included. Command For information about... Refer to page... show vlan 10-3 show vlan Use this command to display all information related to one or more VLANs.
show vlan VLAN Type: Default Egress Ports ge.1.1-10, ge.2.1-4, ge.3.1-7, Forbidden Egress Ports None. Untagged Ports ge.1.1-10, ge.2.1-4, ge.3.1-7, Table 10‐2 provides an explanation of the command output. Table 10-2 10-4 show vlan Output Details Output Field What It Displays... VLAN VLAN ID. NAME Name assigned to the VLAN. Status Whether it is enabled or disabled. VLAN Type Whether it is permanent (static) or dynamic. Egress Ports Ports configured to transmit frames for this VLAN.
Creating and Naming Static VLANs Creating and Naming Static VLANs Purpose To create a new static VLAN, or to enable or disable existing VLAN(s). Commands For information about... Refer to page... set vlan 10-5 set vlan name 10-6 clear vlan 10-6 clear vlan name 10-7 set vlan Use this command to create a new static IEEE 802.1Q VLAN, or to enable or disable an existing VLAN.
set vlan name set vlan name Use this command to set or change the ASCII name for a new or existing VLAN. Syntax set vlan name vlan-list vlan-name Parameters vlan‐list Specifies the VLAN ID of the VLAN(s) to be named. vlan‐name Specifies the string used as the name of the VLAN (1 to 32 characters). Defaults None. Mode Switch command, read‐write.
clear vlan name clear vlan name Use this command to remove the name of a VLAN from the VLAN list. Syntax clear vlan name vlan-list Parameters vlan‐list Specifies the VLAN ID of the VLAN(s) for which the name will be cleared. Defaults None. Mode Switch command, read‐write.
Assigning Port VLAN IDs (PVIDs) and Ingress Filtering Assigning Port VLAN IDs (PVIDs) and Ingress Filtering Purpose To assign default VLAN IDs to untagged frames on one or more ports, to configure VLAN ingress filtering and constraints, and to set the frame discard mode. Commands For information about... Refer to page...
set port vlan ge.2.5 is set to 1 ge.2.6 is set to 1 set port vlan Use this command to configure the PVID (port VLAN identifier) for one or more ports. Syntax set port vlan port-string pvid [modify-egress | no-modify-egress] Parameters port‐string Specifies the port(s) for which to configure a VLAN identifier. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. pvid Specifies the VLAN ID of the VLAN to which port(s) will be added.
show port ingress filter Parameters port‐string Specifies the port(s) to be reset to the host VLAN ID 1. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset ports ge.1.3 through 11 to a VLAN ID of 1 (Host VLAN): C3(su)->clear port vlan ge.1.
set port ingress filter set port ingress filter Use this command to discard all frames received with a VLAN ID that don’t match the port’s VLAN egress list. Syntax set port ingress-filter port-string {disable | enable} Parameters port‐string Specifies the port(s) on which to enable of disable ingress filtering. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. disable | enable Disables or enables ingress filtering. Defaults None.
set port discard Mode Switch command, read‐only. Example This example shows how to display the frame discard mode for ge.2.7. In this case, the port has been set to discard all tagged frames: C3(su)->show port discard ge.2.7 Port Discard Mode ------------ ------------ge.2.7 tagged set port discard Use this command to set the frame discard mode on one or more ports.
Configuring the VLAN Egress List Configuring the VLAN Egress List Purpose To assign or remove ports on the egress list of a particular VLAN. This determines which ports on the switch will be eligible to transmit frames for a particular VLAN. For example, ports 1, 5, 7, 8 could be allowed to transmit frames belonging to VLAN 20 and ports 7,8, 9, 10 could be allowed to transmit frames tagged with VLAN 30 (a port can belong to multiple VLAN Egress lists).
set vlan forbidden Mode Switch command, read‐write. Example This example shows you how to show VLAN egress information for ge.1.1 through 3. In this case, all three ports are allowed to transmit VLAN 1 frames as tagged and VLAN 10 frames as untagged. Both are static VLANs: C3(su)->show port egress ge.1.1-3 Port Vlan Egress Registration Number Id Status Status ------------------------------------------------------ge.1.1 1 tagged static ge.1.1 10 untagged static ge.1.2 1 tagged static ge.1.
set vlan egress set vlan egress Use this command to add ports to the VLAN egress list for the device, or to prevent one or more ports from participating in a VLAN. This determines which ports will transmit frames for a particular VLAN. Syntax set vlan egress vlan-list port-string [untagged | forbidden | tagged] Parameters vlan‐list Specifies the VLAN where a port(s) will be added to the egress list. port‐string Specifies one or more ports to add to the VLAN egress list of the specified vlan‐list.
show vlan dynamicegress Syntax clear vlan egress vlan-list port-string [forbidden] Parameters vlan‐list Specifies the number of the VLAN from which a port(s) will be removed from the egress list. port‐string Specifies one or more ports to be removed from the VLAN egress list of the specified vlan‐list. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1.
set vlan dynamicegress Example This example shows how to display the dynamic egress status for VLANs 50‐55: C3(rw)->show vlan dynamicegress 50-55 VLAN 50 is disabled VLAN 51 is disabled VLAN 52 is disabled VLAN 53 is enabled VLAN 54 is enabled VLAN 55 is enabled set vlan dynamicegress Use this command to administratively set the dynamic egress status for one or more VLANs.
Setting the Host VLAN Setting the Host VLAN Purpose To configure a host VLAN that only select devices are allowed to access. This secures the host port for management‐only tasks. Note: The host port is the management entity of the device. Refer to “Creating a Secure Management VLAN” on page 10-2 for more information. Commands For information about... show host vlan 10-18 set host vlan 10-18 clear host vlan 10-19 show host vlan Use this command to display the current host VLAN.
clear host vlan Parameters vlan‐id Specifies the number of the VLAN to set as the host VLAN. Defaults None. Mode Switch command, read‐write. Usage The host VLAN should be a secure VLAN where only designated users are allowed access. For example, a host VLAN could be specifically created for device management. This would allow a management station connected to the management VLAN to manage all ports on the device and make management secure by preventing management via ports assigned to other VLANs.
Enabling/Disabling GVRP (GARP VLAN Registration Protocol) Enabling/Disabling GVRP (GARP VLAN Registration Protocol) About GARP VLAN Registration Protocol (GVRP) The following sections describe the device operation when its ports are operating under the Generic Attribute Registration Protocol (GARP) application – GARP VLAN Registration Protocol (GVRP). Overview The purpose of GVRP is to dynamically create VLANs across a switched network.
Enabling/Disabling GVRP (GARP VLAN Registration Protocol) Figure 10-1 Example of VLAN Propagation via GVRP Switch 3 Switch 2 R 2D 1 3 1 D R Switch 1 1 R 2 End Station A D 3 D 1 R D Switch 4 1 R Switch 5 R = Port registered as a member of VLAN Blue = Port declaring VLAN Blue Purpose To dynamically create VLANs across a switched network.
show gvrp show gvrp Use this command to display GVRP configuration information. Syntax show gvrp [port-string] Parameters port‐string (Optional) Displays GVRP configuration information for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, GVRP configuration information will be displayed for all ports and the device. Mode Switch command, read‐only.
set gvrp Example This example shows how to display GARP timer information on ports 1 through 10 in slot 1: Note: For a functional description of the terms join, leave, and leaveall timers, refer to the standard IEEE 802.1Q documentation, which is not supplied with this device. C3(su)->show garp timer ge.1.1-10 Port based GARP Configuration: (Timer units are centiseconds) Port Number Join Leave Leaveall ----------- ---------- ---------- ---------ge.1.1 20 60 1000 ge.1.2 20 60 1000 ge.1.3 20 60 1000 ge.1.
clear gvrp Mode Switch command, read‐write. Examples This example shows how to enable GVRP globally on the device: C3(su)->set gvrp enable This example shows how to disable GVRP globally on the device: C3(su)->set gvrp disable This example shows how to enable GVRP on ge.1.3: C3(su)->set gvrp enable ge.1.3 clear gvrp Use this command to clear GVRP status or on one or more ports. Syntax clear gvrp [port-string] Parameters port‐string (Optional) Clears GVRP status on specific port(s).
clear garp timer leaveall timer‐ value Sets the GARP leaveall timer in centiseconds (Refer to 802.1Q standard.) port‐string Specifies the port(s) on which to configure GARP timer settings. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Usage The setting of these timers is critical and should only be changed by personnel familiar with the 802.
clear garp timer Example The example shows how to reset the GARP leave timer to 60 centiseconds. C3(su)->clear garp timer leave ge.1.1 10-26 802.
11 Policy Classification Configuration This chapter describes the Policy Classification set of commands and how to use them. For information about... Refer to page...
Configuring Policy Profiles Configuring Policy Profiles Purpose To review, create, change and remove user profiles that relate to business‐driven policies for managing network resources. Note: B3, C3, and G3 devices support profile-based CoS traffic rate limiting only. Policy rules specifying CoS will only rate limit on D2, C2 and B2 devices, including when C2 and B2 devices are configured on mixed stacks containing B3 and C3 devices. Commands For information about... Refer to page...
show policy profile CoS Status Egress Vlans Forbidden Vlans Untagged Vlans Rule Precedence Admin Profile Usage Oper Profile Usage Dynamic Profile Usage : Disable : none : none : none : 1-31 :MACSource(1),MACDest(2),Unknown(3), :Unknown(4),Unknown(5),Unknown(6), :Unknown(7),Unknown(8),Unknown(9), :Unknown(10),Unknown(11),IPSource(12), :IPDest(13),IPFrag(14),UDPSrcPort(15), :UDPDestPort(16),TCPSrcPort(17),TCPDestPort(18), :ICMPType(19),Unknown(20),IPTOS(21), :IPProto(22),Unknown(23),Unknown(24), :Ether(25)
set policy profile set policy profile Use this command to create a policy profile entry. Syntax set policy profile profile-index [name name] [pvid-status {enable | disable}] [pvid pvid] [cos-status {enable | disable}] [cos cos] [egress-vlans egressvlans][forbidden-vlans forbidden-vlans] [untagged-vlans untagged-vlans] [precedence precedence-list] [append] [clear] Parameters profile‐index Specifies an index number for the policy profile. Valid values are 1 ‐ 255.
clear policy profile Defaults If optional parameters are not specified, none will be applied. Mode Switch command, read‐write. Example This example shows how to create a policy profile 1 named “netadmin” with PVID override enabled for PVID 10, and Class‐of‐Service override enabled for CoS 5.
Configuring Classification Rules Configuring Classification Rules Purpose To review, create, assign, and unassign classification rules to policy profiles. This maps user profiles to protocol‐based frame filtering policies. Note: B3, C3, and G3 devices support profile-based CoS traffic rate limiting only. Policy rules specifying CoS will only rate limit on D2, C2 and B2 devices, including when C2 and B2 devices are configured on mixed stacks containing B3 and C3 devices. Commands For information about...
show policy rule tcpsourceport Displays TCP source port rules. udpdestport Displays UDP destination port rules. udpsourceport Displays UDP source port rules. data Displays rules for a predefined classifier. This value is dependent on the classification type entered. Refer to Table 11‐3 for valid values for each classification type. mask mask (Optional) Displays rules for a specific data mask. Refer to Table 11‐3 for valid values for each classification type and data value.
show policy capability |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |admin|Port |ge.1.1 |ge.1.2 |ge.1.3 |ge.1.4 |ge.1.5 |ge.1.6 |ge.1.7 |ge.1.8 |ge.1.9 |ge.1.10 |ge.1.11 |ge.1.12 |16|ge.1.1 |16|ge.1.2 |16|ge.1.3 |16|ge.1.4 |16|ge.1.5 |16|ge.1.6 |16|ge.1.7 |16|ge.1.8 |16|ge.1.9 |16|ge.1.10 |16|ge.1.11 |16|ge.1.
show policy capability Mode Switch command, read‐only. Usage Use this command to display detailed policy classification capabilities supported by your SecureStack C3 device. The output of this command shows a table listing classifiable traffic attributes and the type of actions, by rule type, that can be executed relative to each attribute. Above the table is a list of all the actions possible on this device. The left‐most column of the table lists all possible classifiable traffic attributes.
set policy rule |Ether II packet type | | | X | X | X | X | | | |LLC DSAP/SSAP/CTRL | | | | | | | | | |VLAN tag | | | | | | | | | |Replace tci | | | | | | | | | |Port string | X | X | X | X | X | X | | | ============================================================= | | | | | set policy rule Use this command to assign incoming untagged frames to a specific policy profile and to VLAN or Class‐of‐Service classification rules.
set policy rule profile‐index Specifies a policy profile number to which this rule will be assigned. Policy profiles are configured with the set policy profile command as described in “set policy profile” on page 11‐4. Valid profile‐index values are 1‐ 255. ether Specifies that the rule should apply to traffic with the specified type field in Ethernet II packet. ipproto Specifies that the rule should apply to traffic with the specified Protocol field in IP packet.
set policy rule Usage An admin rule can be used to map incoming tagged frames to a policy role (profile). There can be only one admin rule configured per system (stack). Typically, this rule is used to implement the “User + IP phone” legacy feature. Refer to “Configuring User + IP Phone Authentication” on page 26‐48 for more information.
clear policy rule This example shows how to use Table 11‐3 to assign a rule to policy profile 1 that will drop IP source traffic from IP address 1.2.3.4. If mask 32 is not specified as shown, a default mask of 48 bits (IP address + port) would be applied: C3(su)->set policy rule 1 ipsourcesocket 1.2.3.4 mask 32 drop clear policy rule Use this command to delete policy classification rule entries.
clear policy all-rules Defaults When applicable, data and mask must be specified for individual rules to be cleared. Mode Switch command, read‐write. Examples This example shows how to delete Ethernet II Type 1526 classification rule entries associated with policy profile 1 from all ports. C3(su)->clear policy rule 1 ether 1526 This example shows how to remove a rule from policy profile 5 that will forward UDP frames from source port 45.
Assigning Ports to Policy Profiles Assigning Ports to Policy Profiles Note: Refer to Appendix A, Policy and Authentication Capacities for information about policy limits for this platform. Purpose To assign and unassign ports to policy profiles. Commands For information about... Refer to page... set policy port 11-15 clear policy port 11-16 set policy port Use this command to assign ports to a policy profile.
clear policy port clear policy port Use this command to remove a policy profile from one or more ports. Syntax clear policy port port-string profile-index Parameters port‐string Specifies the port(s) from which to remove the policy profile. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. profile‐index Specifies the ID of the policy profile (role) to which the port(s) will be added.
Configuring Policy Class of Service (CoS) Configuring Policy Class of Service (CoS) Note: It is recommended that you use Enterasys Networks NMS Policy Manager as an alternative to CLI for configuring policy-based CoS on the switches. The SecureStack C3 supports Class of Service (CoS), which allows you to assign mission‐critical data to a higher priority through the device by delaying less critical traffic during periods of congestion.
Configuring Policy Class of Service (CoS) ---------------------------------------------------------------------Port Group Name :Default Port Group :0 Port Type :0 Assigned Ports :none ---------------------------------------------------------------------Port Group Name :Users Port Group :1 Port Type :0 Assigned Ports :ge.1.1-46 ---------------------------------------------------------------------Port Group Name :Uplink Port Group :2 Port Type :0 Assigned Ports :ge.1.
Configuring Policy Class of Service (CoS) 2.0 2.0 2.0 4. 97 98 99 irl irl irl none none none In the CoS settings table, configure a CoS setting for CoS index 1, which has a priority of 0. We enter the IRL reference, created in the previous step.
set cos state Commands For information about... Refer to page...
show cos state Example This example shows how to enable Class of Service: C3(rw)->set cos state enable show cos state Use this command to display the Class of Service enable state. Syntax show cos state Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to show the Class of Service enable state: C3(rw)->show cos state Class-of-Service application is enabled clear cos state Use this command to set CoS state back to its default setting of disabled.
set cos settings set cos settings Use this command to configure a Class of Service entry in the CoS settings table. Syntax set cos settings cos-index priority priority [tos-value tos-value] [irl-reference irl-reference] Parameters cos‐index Specifies a Class of Service entry. Valid values are 0 to 255. priority priority Specifies an 802.1d priority value. Valid values are 0 to 7, with 0 being the lowest priority. See Usage section below for more information.
clear cos settings Example This example shows how to create CoS entry 8 with a priority value of 3: C3(rw)->set cos settings 8 priority 3 clear cos settings Use this command to clear Class of Service entry settings. Syntax clear cos settings cos-list {[all] | [priority] [tos-value] [irl-reference]} Parameters cos‐list Specifies a Class of Service entry to clear. all Clears all settings associated with this entry. priority Clears the priority value associated with this entry.
set cos port-config Example This example shows how to show all CoS settings: C3(su)->show cos settings CoS Index Priority ToS IRL --------- ---------- ------- ------0 0 48 * 1 1 * * 2 2 * * 3 3 * * 4 4 * * 5 5 * * 6 6 * * 7 7 * * flood-ctrl ---------enabled enabled enabled enabled enabled enabled enabled enabled set cos port-config Use this command to create a port group for inbound rate limiting or flood control and add or remove ports from the group.
show cos port-config through 7) can be configured. Currently, only one port type (type 0) is supported. This port type supports 100 limiters. Additional port groups may be created for flexibility. Ports assigned to a new port group must be mutually exclusive from the other port group entries—ports are automatically removed from the default port group—and must be comprised of the same port type as defined by the port group.
clear cos port-config Example This example shows all inbound rate limiting port groups. Note that ports ge.1.1 through ge.1.48 were removed from the default port group 0.0 when they were added to port groups 1.0 and 2.0.
set cos port-resource irl Mode Switch command, read‐write. Usage The default port group 0.0 cannot be deleted. Example This example deletes all IRL Port Groups except for the Default group 0.0: C3(su)->clear cos port-config irl all set cos port-resource irl Use this command to set the inbound rate limit parameters for a specific IRL resource for a specific port group.
set cos port-resource flood-ctrl Usage CoS port resources are where actual physical rate limiters are configured. Resources map directly to the number of rate limiters supported by the port type. (Port type 0 supports 100 IRL resources.) Resources exist for each port group and are indexed as group#.port‐type.irl‐index. Port resources are not initially configured as rate limiting. Inbound rate limiting, or rate policing, simply drops or clips traffic inbound if a configured rate is exceeded.
show cos port-resource Usage CoS port resources are where actual physical rate limiters are configured. This command can be used to create up to three different flood control limit resources for the port‐type index of 0. The resources are assigned to specific ports with the set cos port‐config command. Example This example creates a port resource broadcast rate limiter of 5 packets per second for the port group type index of 1.0 (group # 1 of port‐type index 0). C3(su)->set cos port-resource flood-ctrl 1.
clear cos port-resource irl ----------- -------- ---- ---- ---------2.0 1 irl kbps 10000 --------------- -----drop none This example displays the flood control resources configured for group 1.0. C3(su)->show cos port-resource flood-ctrl 1.0 '?' after the rate value indicates an invalid rate value Group Index --------1.0 1.0 1.
clear cos port-resource flood-ctrl clear cos port-resource flood-ctrl Use this command to clear flood control port resources to default values. Syntax clear cos port-resource flood-ctrl {all | group-type-index {unicast | multicast | broadcast | all [rate]}} Parameters all Clear all flood control resources for all port groups. group‐type‐index Specifies a port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7.
show cos reference Parameters irl Specifies that an IRL reference is being configured. group‐type‐index Specifies an inbound rate limiting port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. reference IRL reference number associated with this entry.
clear cos reference Parameters irl (Optional) Specifies that inbound rate limiting reference information should be displayed. group‐type‐index (Optional) Specifies an inbound rate limiting port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0.
show cos unit group‐type‐index Specifies an inbound rate limiting port group/type index. Valid entries are in the form of group#.port‐type. Valid values for group# can range from 0 to 7. Valid values for port‐type can range from 0 to 1, although only port type 0 is currently supported. For example, port group 3 would be specified as 3.0. reference Clear a specific reference for the specified port group. Defaults None. Mode Switch command, read‐write.
clear cos all-entries Port Type --------0 Type ---irl Unit ---Kbps Maximum Rate -----------1000000 Minimum Rate -----------64 Granularity ----------1 This examples shows flood control unit information.
show cos port-type Defaults If no parameters are specified, inbound rate limiting and flood control information for all port types is displayed. Mode Switch command, read‐only. Usage The C3 implementation provides one default port type (0) for designating available inbound rate limiting or flood control resources. Port type 0 includes all ports. The port type 0 IRL description is “C3 100 IRL,” which indicates that this port type provides a maximum of 100 inbound rate limiting resources per port group.
12 Port Priority Configuration This chapter describes the Port Priority set of commands and how to use them. Refer to the “Configuring QoS” Feature Guide for detailed information about configuring quality of service on the SecureStack C3. The Enterasys Networks firmware Feature Guides are available at: http://www.enterasys.com/support/manuals For information about... Refer to page...
Configuring Port Priority Configuring Port Priority Purpose To view or configure port priority characteristics as follows: • Display or change the port default Class‐of Service (CoS) transmit priority (0 through 7) of each port for frames that are received (ingress) without priority information in their tag header. • Display the current traffic class mapping‐to‐priority of each port. • Set each port to transmit frames according to 802.1D (802.1p) priority set in the frame header.
set port priority set port priority Use this command to set the 802.1D (802.1p) Class‐of‐Service transmit priority (0 through 7) on each port. A port receiving a frame without priority information in its tag header is assigned a priority according to the priority setting on the port. For example, if the priority of a port is set to 5, the frames received through that port without a priority indicated in their tag header are classified as a priority 5.
Configuring Priority to Transmit Queue Mapping Defaults None. Mode Switch command, read‐write. Example This example shows how to reset ge.1.11 to the default priority: C3(rw)->clear port priority ge.1.11 Configuring Priority to Transmit Queue Mapping Purpose To perform the following: • View the current priority to transmit queue mapping of each physical port.
set port priority-queue Defaults If port‐string is not specified, priority queue information for all ports will be displayed. Mode Switch command, read‐only. Example This example shows how to display priority queue information for ge.1.1. In this case, frames with a priority of 0 are associated with transmit queue 1; frames with 1 or 2 priority, are associated with transmit queue 0; and so forth: C3(su)->show Port P0 --------- -ge.1.1 1 port priority-queue ge.1.
clear port priority-queue Example This example shows how to set priority 5 frames received on ge.2.12 to transmit on queue 0. C3(su)->set port priority-queue ge.2.12 5 0 clear port priority-queue Use this command to reset port priority queue settings back to defaults for one or more ports. Syntax clear port priority-queue port-string Parameters port‐string Specifies the port for which to clear priority‐to‐queue mappings.
Configuring Quality of Service (QoS) Configuring Quality of Service (QoS) Refer to the “Configuring QoS” Feature Guide for detailed information about configuring quality of service on the SecureStack C3. The Enterasys Networks firmware Feature Guides are available at: http://www.enterasys.com/support/manuals Purpose Eight transmit queues are implemented in the switch hardware for each port.
set port txq Example This example shows how to display the current algorithm and transmit queue weights configured on port ge.1.10: C3(su)->show port txq ge.1.10 Port Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7 ------- --- --- --- --- --- --- --- --- ge.1.10 WRR 10 10 15 20 25 20 0 0 set port txq Use this command to set QoS transmit queue arbitration values for physical ports.
clear port txq clear port txq Use this command to clear port transmit queue values back to their default values. Syntax clear port txq port-string Parameters port‐string Clears transmit queue values on specific port(s) back to their default values. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Only physical ports can be configured with this command. LAG ports cannot be configured.
clear port txq 12-10 Port Priority Configuration
13 IGMP Configuration This chapter describes the IGMP Configuration set of commands and how to use them. For information about... Refer to page... IGMP Overview 13-1 Configuring IGMP at Layer 2 13-2 Configuring IGMP on Routing Interfaces 13-10 IGMP Overview About IP Multicast Group Management The Internet Group Management Protocol (IGMP) runs between hosts and their immediately neighboring multicast device.
Configuring IGMP at Layer 2 About Multicasting Multicasting is used to support real‐time applications such as video conferences or streaming audio. A multicast server does not have to establish a separate connection with each client. It merely broadcasts its service to the network, and any hosts that want to receive the multicast register with their local multicast switch/router.
show igmpsnooping show igmpsnooping Use this command to display IGMP snooping information. Syntax show igmpsnooping Parameters None. Defaults None. Mode Switch command, read‐only. Usage Configured information is displayed whether or not IGMP snooping is enabled. Status information is displayed only when the function is enabled. For information on enabling IGMP on the system, refer to “set igmpsnooping adminmode” on page 13‐3.
set igmpsnooping interfacemode Usage In order for IGMP snooping to be enabled on one or all ports, it must be globally enabled on the device with this command, and then enabled on a port(s) using the set igmpsnooping interface mode command as described in “set igmpsnooping interfacemode” on page 13‐4. Note: IGMP snooping cannot be controlled via WebView.
set igmpsnooping maxresponse Parameters time Specifies the IGMP group membership interval. Valid values are 2 ‐ 3600 seconds. This value works together with the set igmpsnooping maxresponsetime command to remove ports from an IGMP group and must be greater than the max response time value. Defaults None. Mode Switch command, read‐write.
set igmpsnooping mcrtrexpiretime Example This example shows how to set the IGMP maximum response time to 100 seconds: C3(su)->set igmpsnooping maxresponse 100 set igmpsnooping mcrtrexpiretime Use this command to configure the IGMP multicast router expiration time for the system. Syntax set igmpsnooping mcrtrexpire time Parameters time Specifies the IGMP multicast router expiration time. Valid values are 0 ‐ 3600 seconds. A value of 0 will configure the system with an infinite expiration time.
set igmpsnooping remove-static If modify is not specified, a new entry is created. Mode Switch command, read‐write. Usage Use this command to create and configure static Layer 2 IGMP entries. Currently, up to 100 static groups can be configured. A total of 256 dynamic and static IGMP groups are supported. Example This example creates an IGMP entry for the multicast group with IP address of 233.11.22.33 configured on VLAN 20 configured with the port ge.1.1. C3(su)->set igmpsnooping add-static 233.11.22.
show igmpsnooping mfdb Parameters vlan‐list Specifies the VLAN for which to display static IGMP ports. group group (Optional) Specifies the IGMP group for which to display static IGMP ports. Defaults If no group is specified, information for all groups is displayed. Mode Switch command, read‐only. Example This example displays the static IGMP ports for VLAN 20.
clear igmpsnooping clear igmpsnooping Use this command to clear all IGMP snooping entries. Syntax clear igmpsnooping Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to clear all IGMP snooping entries: C3(su)->clear igmpsnooping Are you sure you want to clear all IGMP snooping entries? (y/n) y IGMP Snooping Entries Cleared.
Configuring IGMP on Routing Interfaces Configuring IGMP on Routing Interfaces Router: The commands covered in this section can be executed only when the device is in router mode. For details on how to enable router configuration modes, refer to “Enabling Router Configuration Modes” on page 18-2. Purpose To configure IGMP on routing interfaces. Commands For information about... Refer to page...
ip igmp enable Usage Enabling IGMP on a routing interface requires both the ip igmp command (page 13‐10), which enables it on the router, and the ip igmp enable command (page 13‐11), which enables it on an interface. Once these commands are executed, the device will start sending and processing IGMP multicast traffic. IGMP is disabled by default, both globally and on a per interface basis.
show ip igmp interface Parameters version Specifies the IGMP version number to run on the router. Valid values are 1, 2, or 3. Defaults None. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the IGMP version to version 1 on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp version 1 show ip igmp interface Use this command to display information about one or more IGMP routing interfaces.
show ip igmp groups show ip igmp groups Use this command to display a list of IGMP streams and client connection ports. Syntax show ip igmp groups Parameters None. Defaults None. Mode Any router mode. Example This example shows how to display information about IGMP groups: C3(su)->router#show ip igmp groups REGISTERED MULTICAST GROUP DETAILS Multicast IP Address Last Reporter Up Time Expiry Time Host Timer --------------- --------------- ------- ------------ -----------228.1.1.1 12.12.12.
ip igmp query-max-response-time ip igmp query-max-response-time Use this command to set the maximum response time interval advertised in IGMPv2 queries. The no form of this command resets the IGMP maximum response time to the default value of 100 (one tenth of a second). Syntax ip igmp query-max-response-time time no ip igmp query-max-response-time Parameters time Specifies the IGMP maximum response time interval. Valid values are from 0 to 255 tenths of a second.
ip igmp startup-query-count Example This example shows how to set the IGMP startup query interval to 100 seconds on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp startup-query-interval 100 ip igmp startup-query-count Use this command to set the number of IGMP queries sent out on startup, separated by the startup‐query‐interval as described in ip igmp startup‐query‐interval (page 13‐14).
ip igmp last-member-query-count Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the IGMP last member query interval to 10 seconds on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip igmp last-member-query-interval 10 ip igmp last-member-query-count Use this command to set the number of group‐specific queries sent before assuming there are no local members.
ip igmp robustness Defaults None. Mode Interface configuration: C3 (su)‐>router(Config‐if(Vlan 1))# Usage This value determines how many times IGMP messages will be sent. A higher number will mean that end stations will be more likely to see the packet. After the robustness value is reached, IGMP will assume there is no response to queries.
ip igmp robustness 13-18 IGMP Configuration
14 Logging and Network Management This chapter describes switch‐related logging and network management commands and how to use them. Note: The commands in this chapter pertain to network management of the SecureStack C3 device from the switch CLI only. For information on router-related network management tasks, including reviewing router ARP tables and IP traffic, refer to Chapter 19. For information about... Refer to page...
show logging server For information about... Refer to page... clear logging default 14-6 show logging application 14-6 set logging application 14-7 clear logging application 14-9 show logging local 14-9 set logging local 14-10 clear logging local 14-10 show logging buffer 14-11 show logging interface 14-11 set logging interface 14-12 clear logging interface 14-13 show logging server Use this command to display the Syslog configuration for a particular server.
set logging server Table 14-1 show logging server Output Details Output Field What It Displays... IP Address Syslog server’s IP address. For details on setting this using the set logging server command, refer to “set logging server” on page 14-3. Facility Syslog facility that will be encoded in messages sent to this server. Valid values are: local0 to local7. Severity Severity level at which the server is logging messages. Description Text string description of this facility/server.
clear logging server Defaults If ip‐addr is not specified, an entry in the Syslog server table will be created with the specified index number and a message will display indicating that no IP address has been assigned. If not specified, facility, severity and port will be set to defaults configured with the set logging default command (“set logging default” on page 14‐5). If state is not specified, the server will not be enabled or disabled. Mode Switch command, read‐write.
set logging default Defaults None. Mode Switch command, read‐only. Example This command shows how to display the Syslog server default values. For an explanation of the command output, refer back to Table 14‐1 on page 14‐3. C3(su)->show logging default Defaults: Facility Severity Port ----------------------------------------local4 warning(5) 514 set logging default Use this command to set logging default values.
clear logging default Example This example shows how to set the Syslog default facility name to local2 and the severity level to 4 (error logging): C3(su)->set logging default facility local2 severity 4 clear logging default Use this command to reset logging default values. Syntax clear logging default {[facility] [severity] [port]} Parameters facility (Optional) Resets the default facility name to local4.
set logging application Parameters mnemonic (Optional) Displays severity level for one application configured for logging. Mnemonics will vary depending on the number and types of applications running on your system. Sample mnemonics and their corresponding applications are listed in Table 14‐3 on page 14‐8. Note: Mnemonic values are case sensitive and must be typed as they appear in Table 14-3. all (Optional) Displays severity level for all applications configured for logging.
set logging application Parameters mnemonic Specifies a case sensitive mnemonic abbreviation of an application to be logged. This parameter will vary depending on the number and types of applications running on your system. To display a complete list, use the show logging application command as described in “show logging application” on page 14‐6. Sample mnemonics and their corresponding applications are listed in Table 14‐3 on page 14‐8.
clear logging application Example This example shows how to set the severity level for SNMP to 4 so that error conditions will be logged for that application. C3(rw)->set logging application SNMP level 4 clear logging application Use this command to reset the logging severity level for one or all applications to the default value of 6 (notifications of significant conditions).
set logging local Example This example shows how to display the state of message logging. In this case, logging to the console is enabled and logging to a persistent file is disabled. C3(su)->show logging local Syslog Console Logging enabled Syslog File Logging disabled set logging local Use this command to configure log messages to the console and a persistent file.
show logging buffer Example This example shows how to clear local logging: C3(su)->clear logging local show logging buffer Use this command to display the last 256 messages logged. By default, critical failures and user login and logout timestamps are displayed. Syntax show logging buffer Parameters None. Defaults None. Mode Switch command, read‐only.
set logging interface Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the system logging. C3(rw)->show logging interface loopback 1 192.168.10.1 set logging interface Use this command to specify the interface used for the source IP address of the system logging.
clear logging interface C3(rw)->router(Config)#exit C3(rw)->router#exit C3(rw)->router>exit C3(rw)->set logging interface vlan 100 C3(rw)->show logging interface vlan 100 192.168.10.1 clear logging interface Use this command to clear the interface used for the source IP address of the system logging back to the default of the Host interface. Syntax clear logging interface Parameters None. Defaults None. Mode Switch command, read‐write.
Monitoring Network Events and Status Monitoring Network Events and Status Purpose To display switch events and command history, to set the size of the history buffer, and to display and disconnect current user sessions. Commands For information about... Refer to page... history 14-14 show history 14-15 set history 14-15 ping 14-16 show users 14-16 disconnect 14-17 show netstat 14-17 history Use this command to display the contents of the command history buffer.
show history show history Use this command to display the size (in lines) of the history buffer. Syntax show history Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the size of the history buffer: C3(su)->show history History buffer size: 20 set history Use this command to set the size of the history buffer. Syntax set history size [default] Parameters size Specifies the size of the history buffer in lines. Valid values are 1 to 100.
ping ping Use this command to send ICMP echo‐request packets to another node on the network from the switch CLI. Syntax ping host Parameters host Specifies the IP address of the device to which the ping will be sent. Defaults None. Mode Switch command, read‐write. Examples This example shows how to ping IP address 134.141.89.29. In this case, this host is alive: C3(su)->ping 134.141.89.29 134.141.89.29 is alive In this example, the host at IP address is not responding: C3(su)->ping 134.141.89.
disconnect C3(su)->show users Session User Location -------- ----- -------------------------* telnet rw 134.141.192.119 telnet rw 134.141.192.18 disconnect Use this command to close an active console port or Telnet session from the switch CLI. Syntax disconnect {ip-addr | console} Parameters ip‐addr Specifies the IP address of the Telnet session to be disconnected. This address is displayed in the output shown in “show users” on page 12‐15. console Closes an active console port. Defaults None.
show netstat Example The following example shows the output of this command. C3(su)->show netstat Prot Local Address ---- ----------------------------TCP 127.0.0.1.2222 TCP 0.0.0.0.80 TCP 0.0.0.0.23 TCP 10.1.56.17.23 UDP 0.0.0.0.17185 UDP 127.0.0.1.49152 UDP 0.0.0.0.161 UDP 0.0.0.0.* UDP 0.0.0.0.514 Foreign Address ----------------------------0.0.0.0.* 0.0.0.0.* 0.0.0.0.* 134.141.99.104.47718 0.0.0.0.* 127.0.0.1.17185 0.0.0.0.* 0.0.0.0.* 0.0.0.0.* The following table describes the output of this command.
Managing Switch Network Addresses and Routes Managing Switch Network Addresses and Routes Purpose To display or delete switch ARP table entries, and to display MAC address information. Commands For information about... Refer to page...
set arp Example This example shows how to display the ARP table: C3(su)->show arp LINK LEVEL ARP TABLE IP Address Phys Address Flags Interface ----------------------------------------------------10.20.1.1 00-00-5e-00-01-1 S host 134.142.21.194 00-00-5e-00-01-1 S host 134.142.191.192 00-00-5e-00-01-1 S host 134.142.192.18 00-00-5e-00-01-1 S host 134.142.192.119 00-00-5e-00-01-1 S host ----------------------------------------------------- Table 14‐5 provides an explanation of the command output.
clear arp clear arp Use this command to delete a specific entry or all entries from the switch’s ARP table. Syntax clear arp {ip-address | all} Parameters ip‐address | all Specifies the IP address in the ARP table to be cleared, or clears all ARP entries. Defaults None. Mode Switch command, read‐write. Example This example shows how to delete entry 10.1.10.10 from the ARP table: C3(su)->clear arp 10.1.10.
show mac ‐v (Optional) Displays verbose output, including the size and destination of each response. host Specifies the host to which the route of an IP packet will be traced. Defaults If not specified, waittime will be set to 5 seconds. If not specified, first‐ttl will be set to 1 second. If not specified, max‐ttl will be set to 30 seconds. If not specified, port will be set to 33434. If not specified, nqueries will be set to 3. If ‐r is not specified, normal host routing tables will be used.
show mac agetime Defaults If no parameters are specified, all MAC addresses for the device will be displayed. Mode Switch command, read‐only. Example This example shows how to display MAC address information for ge.3.1: C3(su)->show mac port ge.3.1 MAC Address FID Port Type ----------------- ---- ------------- -------00-09-6B-0F-13-E6 15 ge.3.
set mac agetime Defaults None. Mode Switch command, read‐only. Example This example shows how to display the MAC timeout period: C3(su)->show mac agetime Aging time: 300 seconds set mac agetime Use This command to set the timeout period for aging learned MAC entries. Syntax set mac agetime time Parameters time Specifies the timeout period in seconds for aging learned MAC addresses. Valid values are 10 to 1,000,000 seconds. Default value is 300 seconds. Defaults None. Mode Switch command, read‐only.
set mac algorithm Mode Switch command, read‐only. Example This example shows how to reset the MAC timeout period to the default value of 300 seconds. C3(su)->clear mac agetime set mac algorithm Use this command to set the MAC algorithm mode, which determines the hash mechanism used by the device when performing Layer 2 lookups on received frames.
clear mac algorithm Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows the output of this command. C3(su)->show mac algorithm Mac hashing algorithm is mac-crc16-upperbits. clear mac algorithm Use this command to return the MAC hashing algorithm to the default value of mac‐crc16‐ upperbits. Syntax clear mac algorithm Parameters None. Defaults None. Mode Switch command, read‐write. Example This example resets the MAC hashing algorithm to the default value.
clear mac address Parameters mac‐address Specifies the multicast MAC address. The MAC address can be formatted as xx:xx:xx:xx:xx:xx or xx‐xx‐xx‐xx‐xx‐xx. vlan‐id Specifies the VLAN ID containing the ports. port‐string Specifies the port or range of ports the multicast MAC address can be learned on or flooded to. append | clear Appends or clears the port or range of ports from the egress port list. Defaults If no port‐string is defined, the command will apply to all ports.
show mac unreserved-flood show mac unreserved-flood Use this command to display the state of multicast flood protection. Syntax show mac unreserved-flood Parameters None. Defaults None. Mode Switch command, read‐write. Example This example displays the status of multicast flood protection. C3(su)->show mac unreserved-flood mac unreserved flood is disabled. set mac unreserved-flood Use this command to enable or disable multicast flood protection.
Configuring Simple Network Time Protocol (SNTP) Example This example enables multicast flood protection. C3(su)->set mac unreserved-flood enable Configuring Simple Network Time Protocol (SNTP) Purpose To configure the Simple Network Time Protocol (SNTP), which synchronizes device clocks in a network. Note: A management IP (host, routing interface, or loopback) address must be configured for SNTP to work.. Commands For information about... Refer to page...
show sntp Parameters None. Defaults None. Mode Switch command, read‐only.
set sntp client Table 14-7 show sntp Output Details (Continued) Output Field What It Displays... Last SNTP Update Date and time of most recent SNTP update. Last SNTP Request Date and time of most recent SNTP request. Last SNTP Status Whether or not broadcast reception or unicast transmission and reception was successful. SNTP-Server IP address(es) of SNTP server(s). Precedence Precedence level of SNTP server in relation to its peers. Highest precedence is 1 and lowest is 10.
set sntp server Defaults None. Mode Switch command, read‐write. Example This example shows how to clear the SNTP client’s operational mode: C3(su)->clear sntp client set sntp server Use this command to add a server from which the SNTP client will retrieve the current time when operating in unicast mode. Up to 10 servers can be set as SNTP servers. Syntax set sntp server ip-address [precedence] Parameters ip‐address Specifies the SNTP server’s IP address.
set sntp poll-interval Defaults None. Mode Switch command, read‐write. Example This example shows how to remove the server at IP address 10.21.1.100 from the SNTP server list: C3(su)->clear sntp server 10.21.1.100 set sntp poll-interval Use this command to set the poll interval between SNTP unicast requests. Syntax set sntp poll-interval value Parameters value The poll interval is 2 to the power of value in seconds, where value can range from 6 to 10. Defaults None. Mode Switch command, read‐write.
set sntp poll-retry Mode Switch command, read‐write. Example This example shows how to clear the SNTP poll interval: C3(su)->clear sntp poll-interval set sntp poll-retry Use this command to set the number of poll retries to a unicast SNTP server. Syntax set sntp poll-retry retry Parameters retry Specifies the number of retries. Valid values are 0 to 10. Defaults None. Mode Switch command, read‐write.
set sntp poll-timeout Example This example shows how to clear the number of SNTP poll retries: C3(su)->clear sntp poll-retry set sntp poll-timeout Use this command to set the poll timeout (in seconds) for a response to a unicast SNTP request. Syntax set sntp poll-timeout timeout Parameters timeout Specifies the poll timeout in seconds. Valid values are 1 to 30. Defaults None. Mode Switch command, read‐write.
set timezone set timezone Use this command to configure the current timezone as an offset from UTC. Syntax set timezone name [hours] [minutes] Parameters name The name of the timezone. Typically, this name is a standard abbreviation such as EST (Eastern Standard Time) or EDT (Eastern Daylight Time). hours (Optional) Specifies the offset in hours from UTC. The value can range from ‐13 to 13. The default is 0 hours. minutes (Optional) Specifies additional offset in minutes from UTC.
show sntp interface SNTP-Server Precedence Status ------------------------------------------192.255.255.254 2 Active show sntp interface Use this command to display the interface used for the source IP address of the SNTP client. Syntax show sntp interface Parameters None. Defaults None. Mode Switch mode, read‐only. Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the SNTP client.
clear sntp interface Usage This command allows you to configure the source IP address used by the SNTP application when generating packets for management purposes. Any of the management interfaces, including VLAN routing interfaces, can be configured as the source IP address used in packets generated by the SNTP client. An interface must have an IP address assigned to it before it can be set by this command. If no interface is specified, then the IP address of the Host interface will be used.
clear sntp interface Example This command returns the interface used for the source IP address of the SNTP client back to the default of the Host interface. C3(rw)->show sntp interface vlan 100 192.168.10.
Configuring Node Aliases Configuring Node Aliases The node alias feature enables administrators to determine the MAC address and location of a given end‐station (or node) using the node’s Layer 3 alias information (IP address) as a key. With this method, it is possible to determine that, for instance, IP address 123.145.2.23 is located on switch 5 port 3.
set nodealias ----------ge.2.1 ge.2.2 ge.2.3 ge.2.4 ge.2.5 ge.2.6 ge.2.7 ge.2.8 ge.2.9 ----------16 47 47 47 47 47 47 47 4000 -----------0 0 2 0 0 2 0 0 1 -----Enable Enable Enable Enable Enable Enable Enable Enable Enable Table 14‐8 provides an explanation of the command output. Table 14-8 show nodealias config Output Details Output Field What It Displays... Port Number Port designation. Max Entries Maximum number of alias entries configured for this port.
clear nodealias config Itʹs important to make sure that inter‐switch links are not learning node/alias information, as it would slow down searches by the NetSight Compass and ASM tools and give inaccurate results. Example This example shows how to disable the node alias agent on ge.1.3: C3(su)->set nodealias disable ge.1.3 clear nodealias config Use this command to reset node alias state to enabled and clear the maximum entries value.
15 RMON Configuration This chapter describes the commands used to configure RMON on a SecureStack C3 switch. For information about... Refer to page...
Design Considerations Table 15-1 RMON Group History RMON Monitoring Group Functions and Commands (Continued) What It Does... What It Monitors... CLI Command(s) Records periodic statistical samples from a network. Sample period, number of samples and item(s) sampled.
Statistics Group Commands • RMON Packet Capture/Filter Sampling and Port Mirroring cannot be enabled on the same interface concurrently. • You can capture a total of 100 packets on an interface, no more and no less. – The captured frames will be as close to sequential as the hardware will allow. – Only one interface can be configured for capturing at a time. – Once 100 frames have been captured by the hardware, the application will stop without manual intervention.
show rmon stats show rmon stats Use this command to display RMON statistics measured for one or more ports. Syntax show rmon stats [port-string] Parameters port‐string (Optional) Displays RMON statistics for specific port(s). Defaults If port‐string is not specified, RMON stats will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display RMON statistics for Gigabit Ethernet port 1 in switch 1. : C3(su)->show rmon stats ge.1.1 Port: ge.1.
clear rmon stats Defaults If owner is not specified, monitor will be applied. Mode Switch command, read‐write. Example This example shows how to configure RMON statistics entry 2 for ge.1.20: C3(rw)->set rmon stats 2 ge.1.20 clear rmon stats Use this command to delete one or more RMON statistics entries. Syntax clear rmon stats {index-list | to-defaults} Parameters index‐list Specifies one or more stats entries to be deleted, causing them to disappear from any future RMON queries.
History Group Commands History Group Commands Purpose To display, configure, and clear RMON history properties and statistics. Commands For information about... Refer to page... show rmon history 15-6 set rmon history 15-7 clear rmon history 15-7 show rmon history Use this command to display RMON history properties and statistics. The RMON history group records periodic statistical samples from a network.
set rmon history Sample 2779 Drop Events Octets Packets Broadcast Pkts Multicast Pkts CRC Align Errors = = = = = = Interval Start: 1 days 0 hours 2 minutes 22 seconds 0 Undersize Pkts = 0 0 Oversize Pkts = 0 0 Fragments = 0 0 Jabbers = 0 0 Collisions = 0 0 Utilization(%) = 0 set rmon history Use this command to configure an RMON history entry. Syntax set rmon history index [port-string] [buckets buckets] [interval interval] [owner owner] Parameters index‐list Specifies an index number for this entry.
clear rmon history Parameters index‐list Specifies one or more history entries to be deleted, causing them to disappear from any future RMON queries. to‐defaults Resets all history entries to default values. This will cause entries to reappear in RMON queries. Defaults None. Mode Switch command, read‐write.
Alarm Group Commands Alarm Group Commands Purpose To display, configure, and clear RMON alarm entries and properties. Commands For information about... Refer to page... show rmon alarm 15-9 set rmon alarm properties 15-10 set rmon alarm status 15-11 clear rmon alarm 15-12 show rmon alarm Use this command to display RMON alarm entries. The RMON alarm group periodically takes statistical samples from RMON variables and compares them with previously configured thresholds.
set rmon alarm properties Table 15-2 show rmon alarm Output Details Output Field What It Displays... Index Index number for this alarm entry. Owner Text string identifying who configured this entry. Status Whether this event entry is enabled (valid) or disabled. Variable MIB object to be monitored. Sample Type Whether the monitoring method is an absolute or a delta sampling. Startup Alarm Whether alarm generated when this entry is first enabled is rising, falling, or either.
set rmon alarm status startup rising | falling | either (Optional) Specifies the type of alarm generated when this event is first enabled as: • Rising ‐ Sends alarm when an RMON event reaches a maximum threshold condition is reached, for example, more than 30 collisions per second. • Falling ‐ Sends alarm when RMON event falls below a minimum threshold condition, for example when the network is behaving normally again. • Either ‐ Sends alarm when either a rising or falling threshold is reached.
clear rmon alarm Parameters index Specifies an index number for this entry. Maximum number or entries is 50. Maximum value is 65535. enable Enables this alarm entry. Defaults None. Mode Switch command, read‐write. Usage An RMON alarm entry can be created using this command, configured using the set rmon alarm properties command (“set rmon alarm properties” on page 15‐10), then enabled using this command.
Event Group Commands Event Group Commands Purpose To display and clear RMON events, and to configure RMON event properties. Commands For information about... Refer to page... show rmon event 15-13 set rmon event properties 15-14 set rmon event status 15-15 clear rmon event 15-15 show rmon event Use this command to display RMON event entry properties. Syntax show rmon event [index] Parameters index (Optional) Displays RMON properties and log entries for a specific entry index ID.
set rmon event properties Table 15-3 show rmon event Output Details Output Field What It Displays... Index Index number for this event entry. Owner Text string identifying who configured this entry. Status Whether this event entry is enabled (valid) or disabled. Description Text string description of this event. Type Whether the event notification will be a log entry, and SNMP trap, both, or none. Community SNMP community name if message type is set to trap.
set rmon event status Example This example shows how to create and enable an RMON event entry called “STP topology change” that will send both a log entry and an SNMP trap message to the “public” community: C3(rw)->set rmon event properties 2 description "STP topology change" type both community public owner Manager set rmon event status Use this command to enable an RMON event entry. An event entry describes the parameters of an RMON event that can be triggered.
clear rmon event Defaults None. Mode Switch command, read‐write.
Filter Group Commands Filter Group Commands The packet capture and filter function is disabled by default. Only one interface can be configured for capturing and filtering at a time. When packet capture is enabled on an interface, the SecureStack C3 switch will capture 100 frames as close to sequentially as possible. These 100 frames will be placed into a buffer for inspection. If there is data in the buffer when the function is started, the buffer will be overwritten.
set rmon channel Example This example shows how to display RMON channel information for ge.2.12: C3(rw)->show rmon channel ge.2.12 Port ge.2.12 Channel index= 628 EntryStatus= valid ---------------------------------------------------------Control off AcceptType matched OnEventIndex 0 OffEventIndex 0 EventIndex 0 Status ready Matches 4498 Description Thu Dec 16 12:57:32 EST 2004 Owner NetSight smith set rmon channel Use this command to configure an RMON channel entry.
clear rmon channel Example This example shows how to create an RMON channel entry: C3(rw)->set rmon channel 54313 ge.2.12 accept failed control on description "capture all" clear rmon channel Use this command to clear an RMON channel entry. Syntax clear rmon channel index Parameters index Specifies the channel entry to be cleared. Defaults None. Mode Switch command, read‐write.
set rmon filter C3(rw)->show rmon filter Index= 55508 Channel Index= 628 EntryStatus= valid ---------------------------------------------------------Data Offset 0 PktStatus 0 PktStatusMask 0 PktStatusNotMask 0 Owner ETS,NAC-D ----------------------------Data ff ff ff ff ff ff ----------------------------DataMask ff ff ff ff ff ff ----------------------------DataNotMask 00 00 00 00 00 00 set rmon filter Use this command to configure an RMON filter entry.
clear rmon filter Mode Switch command, read‐write. Example This example shows how to create RMON filter 1 and apply it to channel 9: C3(rw)->set rmon filter 1 9 offset 30 data 0a154305 dmask ffffffff clear rmon filter Use this command to clear an RMON filter entry. Syntax clear rmon filter {index index | channel channel} Parameters index index | channel channel Clears a specific filter entry, or all entries belonging to a specific channel. Defaults None. Mode Switch command, read‐write.
Packet Capture Commands Packet Capture Commands Note that packet capture filter is sampling only and does not guarantee receipt of back‐to‐back packets. Purpose To display RMON capture entries, configure, enable, or disable capture entries, and clear capture entries. Commands For information about... Refer to page... show rmon capture 15-22 set rmon capture 15-23 clear rmon capture 15-24 show rmon capture Use this command to display RMON capture entries and associated buffer control entries.
set rmon capture Owner monitor captureEntry= 1 Buff.
clear rmon capture Mode Switch command, read‐write. Example This example shows how to create RMON capture entry 1 to “listen” on channel 628: C3(rw)->set rmon capture 1 628 clear rmon capture Use this command to clears an RMON capture entry. Syntax clear rmon capture index Parameters index Specifies the capture entry to be cleared. Defaults None. Mode Switch command, read‐write.
16 DHCP Server Configuration This chapter describes the commands to configure the IPv4 DHCP server functionality on a SecureStack C3 switch. For information about... Refer to page...
DHCP Overview address, the MAC address to which it is assigned, the lease expiration, and whether the address assignment is dynamic (automatic) or static (manual). The DHCP lease database is stored in flash memory.
Configuring General DHCP Server Parameters set port vlan ge.1.1-10 6 2. Create a routed interface for the VLAN in router configuration mode. In the following example, an IP address is associated with routed interface VLAN 6: In router configuration mode: interface vlan 6 no shutdown ip address 6.6.1.1 255.255.0.0 3. Enable DHCP server functionality on the system with the set dhcp enable command. 4. Create the DHCP address pool.
set dhcp For information about... Refer to page... clear dhcp conflict 16-6 set dhcp exclude 16-7 clear dhcp exclude 16-7 set dhcp ping 16-8 clear dhcp ping 16-8 show dhcp binding 16-9 clear dhcp binding 16-9 show dhcp server statistics 16-10 clear dhcp server statistics 16-10 set dhcp Use this command to enable or disable the DHCP server functionality on the SecureStack C3. Syntax set dhcp {enable | disable} Parameters enable | disable Enables or disables DHCP server functionality.
set dhcp conflict logging Defaults None. Mode Switch command, read‐write. Example This example enables address allocation for BOOTP clients. C3(rw)->set dhcp bootp enable set dhcp conflict logging Use this command to enable conflict logging. By default, conflict logging is enabled. Use the clear dhcp conflict logging command to disable conflict logging. Syntax set dhcp conflict logging Parameters None. Defaults None. Mode Switch command, read‐write.
clear dhcp conflict Mode Read‐only. Example This example displays conflict information for all addresses. Note that ping is the only detection method used. C3(ro)->show dhcp conflict IP address ----------192.0.0.2 192.0.0.3 192.0.0.4 192.0.0.
set dhcp exclude set dhcp exclude Use this command to configure the IP addresses that the DHCP server should not assign to DHCP clients. Multiple address ranges can be configured but the ranges cannot overlap. Up to 128 non‐ overlapping address ranges can be excluded. Syntax set dhcp exclude low-ipaddr [high-ipaddr] Parameters low‐ipaddr Specifies the first IP address in the address range to be excluded from assignment.
set dhcp ping Example This example clears the previously excluded range of IP addresses between 192.168.1.88 through 192.168.1.100. C3(rw)->clear dhcp exclude 192.168.1.88 192.168.1.100 set dhcp ping Use this command to configure the number of ping packets the DHCP server sends to an IP address before assigning the address to a requesting client. Syntax set dhcp ping packets number Parameters packets number Specifies the number of ping packets to be sent.
show dhcp binding Example This example resets the number of ping packets sent back to the default value. C3(rw)->clear dhcp ping packets show dhcp binding Use this command to display binding information for one or all IP addresses. Syntax show dhcp binding [ip-address] Parameters ip‐address (Optional) Specifies the IP address for which to display binding information. Defaults If no IP address is specified, binding information for all addresses is displayed. Mode Read‐only.
show dhcp server statistics Mode Switch command, read‐write. Example This example deletes the DHCP address binding for IP address 192.168.1.1. C3(rw)->clear dhcp binding 192.168.1.1 show dhcp server statistics Use this command to display DHCP server statistics. Syntax show dhcp server statistics Parameters None. Defaults None. Mode Read‐only. Example This example displays server statistics.
clear dhcp server statistics Parameters None. Defaults None. Mode Switch command, read‐write. Example This example clears all DHCP server counters.
Configuring IP Address Pools Configuring IP Address Pools Manual Pool Configuration Considerations • The subnet of the IP address being issued should be on the same subnet as the ingress interface (that is, the subnet of the host IP address of the switch, or if routing interfaces are configured, the subnet of the routing interface).
set dhcp pool For information about... Refer to page...
clear dhcp pool clear dhcp pool Use this command to delete a DHCP server pool of addresses. Syntax clear dhcp pool poolname Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. Defaults None. Mode Switch command, read‐write. Example This example deletes the address pool named “auto1.” C3(rw)->clear dhcp pool auto1 set dhcp pool network Use this command to configure the subnet number and mask for an automatic DHCP address pool.
clear dhcp pool network Examples This example configures the IP subnet 172.20.28.0 with a prefix length of 24 for the automatic DHCP pool named “auto1.” Alternatively, the mask could have been specified as 255.255.255.0. C3(rw)->set dhcp pool auto1 network 172.20.28.0 24 This example limits the scope of 255 addresses created for the Class C network 172,20.28.0 by the previous example, by excluding addresses 172.20.28.80 – 100. C3(rw)->set dhcp exclude 172.20.28.80 172.20.28.
clear dhcp pool hardware-address Defaults If no type is specified, Ethernet is assumed. Mode Switch command, read‐write. Example This example specifies 0001.f401.2710 as the Ethernet MAC address for the manual address pool named “manual1.” Alternatively, the MAC address could have be entered as 00:01:f4:01:27:10. C3(rw)->set dhcp pool manual1 hardware-address 0001.f401.
clear dhcp pool host mask (Optional) Specifies the subnet mask in dotted quad notation. prefix‐length (Optional) Specifies the subnet mask as an integer. Defaults If a mask or prefix is not specified, the class A, B, or C natural mask will be used. Mode Switch command, read‐write. Example This example shows how to configure the minimum requirements for a manual binding address pool.
clear dhcp pool client-identifier Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. id Specifies the unique client identifier for this client. The value must be entered in xx:xx:xx:xx:xx:xx format. Defaults None. Mode Switch command, read‐write. Usage The client identifier is formed by concatenating the media type and the MAC address.
set dhcp pool client-name set dhcp pool client-name Use this command to assign a name to a DHCP client when creating an address pool for manual binding. Syntax set dhcp pool poolname client-name name Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. name Specifies the name to be assigned to this client. Client names may be up to 31 characters in length. Defaults None. Mode Switch command, read‐write.
set dhcp pool bootfile set dhcp pool bootfile Use this command to specify a default boot image for the DHCP clients who will be served by the address pool being configured. Syntax set dhcp pool poolname bootfile filename Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. filename Specifies the boot image file name. Defaults None. Mode Switch command, read‐write. Example This example sets the boot image filename for address pool named “auto1.
set dhcp pool next-server set dhcp pool next-server Use this command to specify the file server from which the default boot image is to be loaded by the client. Syntax set dhcp pool poolname next-server ip-address Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. ip‐address Specifies the IP address of the file server the DHCP client should contact to load the default boot image. Defaults None. Mode Switch command, read‐write.
set dhcp pool lease set dhcp pool lease Use this command to specify the duration of the lease for an IP address assigned by the DHCP server from the address pool being configured. Syntax set dhcp pool poolname lease {days [hours [minutes]] | infinite} Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. days Specifies the number of days an address lease will remain valid. Value can range from 0 to 59.
set dhcp pool default-router Mode Switch command, read‐write. Example This example restores the default lease duration of one day for address pool “auto1.” C3(rw)->clear dhcp pool auto1 lease set dhcp pool default-router Use this command to specify a default router list for the DHCP clients served by the address pool being configured. Up to 8 default routers can be configured. Syntax set dhcp pool poolname default-router address [address2 ...
set dhcp pool dns-server Mode Switch command, read‐write. Example This example removes the default router from the address pool “auto1.” C3(rw)->clear dhcp pool auto1 default-router set dhcp pool dns-server Use this command to specify one or more DNS servers for the DHCP clients served by the address pool being configured. Up to 8 DNS servers can be configured. Syntax set dhcp pool poolname dns-server address [address2 ... address8] Parameters poolname Specifies the name of the address pool.
set dhcp pool domain-name Mode Switch command, read‐write. Example This example removes the DNS server list from the address pool “auto1.” C3(rw)->clear dhcp pool auto1 dns-server set dhcp pool domain-name Use this command to specify a domain name to be assigned to DHCP clients served by the address pool being configured. Syntax set dhcp pool poolname domain-name domain Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length.
set dhcp pool netbios-name-server Mode Switch command, read‐write. Example This example removes the domain name from the address pool “auto1.” C3(rw)->clear dhcp pool auto1 domain-name set dhcp pool netbios-name-server Use this command to assign one or more NetBIOS name servers for the DHCP clients served by the address pool being configured. Up to 8 NetBIOS name servers can be configured. Syntax set dhcp pool poolname netbios-name-server address [address2 ...
set dhcp pool netbios-node-type Mode Switch command, read‐write. Example This example removes the NetBIOS name server list from the address pool auto1. C3(rw)->clear dhcp pool auto1 netbios-name-server set dhcp pool netbios-node-type Use this command to specify a NetBIOS node (server) type for the DHCP clients served by the address pool being configured. Syntax set dhcp pool poolname netbios-node-type {b-node | h-node | p-node | m-node} Parameters poolname Specifies the name of the address pool.
set dhcp pool option Defaults None. Mode Switch command, read‐write. Example This example removes the NetBIOS node type from the address pool “auto1.” C3(rw)->clear dhcp pool auto1 netbios-node-type set dhcp pool option Use this command to configure DHCP options, described in RFC 2132. Syntax set dhcp pool poolname option code {ascii string | hex string-list | ip addresslist} Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length.
clear dhcp pool option clear dhcp pool option Use this command to remove a DHCP option from the address pool being configured. Syntax clear dhcp pool poolname option code Parameters poolname Specifies the name of the address pool. Pool names may be up to 31 characters in length. code Specifies the DHCP option code, as defined in RFC 2132. Value can range from 1 to 254. Defaults None. Mode Switch command, read‐write. Example This example removes option 19 from address pool “auto1.
show dhcp pool configuration 16-30 Network Lease Time Default Routers 192.0.0.0 255.255.255.0 1 days 0 hrs 0 mins 192.0.0.1 Pool: static1 Pool Type Client Name Client Identifier Host Lease Time Option Manual appsvr1 01:00:01:f4:01:27:10 10.1.1.1 255.0.0.0 infinite 19 hex 01 Pool: static2 Pool Type Hardware Address Hardware Address Type Host Lease Time Manual 00:01:f4:01:27:10 ieee802 192.168.10.1 255.255.255.
17 DHCP Snooping and Dynamic ARP Inspection This chapter describes two security features: • DHCP snooping, which monitors DHCP messages between a DHCP client and DHCP server to filter harmful DHCP messages and to build a database of authorized address bindings • Dynamic ARP inspection, which uses the bindings database created by the DHCP snooping feature to reject invalid and malicious ARP packets For information about... Refer to page...
DHCP Snooping Overview the hardware forwards client messages and copies server messages to the CPU so DHCP snooping can learn the binding. The DHCP snooping application processes incoming DHCP messages. For DHCP RELEASE and DHCP DECLINE messages, the application compares the receive interface and VLAN with the clientʹs interface and VLAN in the bindings database. If the interfaces do not match, the application logs the event and drops the message.
DHCP Snooping Overview switch is rebooting, when the switch receives a DHCP DISCOVERY or REQUEST message, the clientʹs binding will go to a tentative binding state. Rate Limiting To protect the switch against DHCP attacks when DHCP snooping is enabled, the snooping application enforces a rate limit for DHCP packets received on untrusted interfaces. DHCP snooping monitors the receive rate on each interface separately.
DHCP Snooping Commands DHCP Snooping Commands For information about... Refer to page...
set dhcpsnooping vlan Example The following example enables DHCP snooping globally. C3(rw)->set dhcpsnooping enable set dhcpsnooping vlan Use this command to enable or disable DHCP snooping on a VLAN or range of VLANs. Syntax set dhcpsnooping vlan vlan-range {enable | disable} Parameters vlan‐range Specifies the VLAN or range of VLANs on which DHCP snooping is to be enabled or disabled. enable | disable Enables or disables DHCP snooping for the specified VLANs.
set dhcpsnooping trust Mode Switch command, read‐write. Usage When a switch learns of new bindings or when it loses bindings, the switch updates the entries in the bindings database according to the write delay timer. The switch also updates the entries in the binding file. The frequency at which the file is updated is based on the delay configured with this command, and the updates are batched. Example The following example specifies that the stored database should be updated once an hour.
set dhcpsnooping binding Example This example configures port ge.1.1 as a trusted port. C3(rw)->set dhcpsnooping trust port ge.1.1 enable set dhcpsnooping binding Use this command to add a static DHCP binding to the DHCP snooping database. Syntax set dhcpsnooping binding mac-address vlan vlan-id ipaddr port port-string Parameters mac‐address Specifies the MAC address of the binding entry. vlan vlan‐id Specifies the VLAN of the binding entry. ipaddr Specifies the IP address of the binding entry.
set dhcpsnooping log-invalid Parameters enable Enables verification of the source MAC address in client messages against the client hardware address. disable Disables verification of the source MAC address in client messages against the client hardware address. Defaults Source MAC address verification is enabled by default. Mode Switch command, read‐write.
set dhcpsnooping limit clientʹs interface and VLAN in the bindings database. If the interfaces do not match, the application logs the event if logging has been enabled. Use the show dhcpsnooping command to display the status (enabled or disabled) of logging invalid packets for each interface in an enabled VLAN. The show dhcpsnooping statistics command shows the actual number of server messages received on untrusted ports. Example This example enables logging of invalid DHCP messages on port ge.1.
show dhcpsnooping Usage To protect the switch from DHCP attacks when DHCP snooping is enabled, the snooping application enforces a rate limit for DHCP packets received on untrusted interfaces. DHCP snooping monitors the receive rate on each interface separately. If the receive rate exceeds the configured limit, DHCP snooping brings down the interface. You can re‐enable the interface with the set port enable command. Both the rate and the burst interval can be configured.
show dhcpsnooping database 3 Interface Trusted Log Invalid Pkts ----------- ---------- ---------------- ge.1.47 Yes No ge.1.48 No No lag.0.1 No No show dhcpsnooping database Use this command to display DHCP snooping database configuration parameters. Syntax show dhcpsnooping database Parameters None. Defaults None. Mode Switch command, read‐write. Usage This command displays where the database file is stored (locally) and what the write delay value is.
show dhcpsnooping binding Defaults None. Mode Switch command, read‐write. Usage This command displays the trust state and rate limiting parameters configured on the specified ports. Example This example shows the output of the show dhcpsnooping port command. C3(su)->show dhcpsnooping port ge.1.1 Interface Trust State Rate Limit ---------- ------------- ------------- --------------- ge.1.
show dhcpsnooping statistics MAC Address IP Address VLAN Interface Type Lease (min) ----------- ----------------- --------------- ---- ----------- ------- 00:02:B3:06:60:80 192.168.10.10 3 ge.1.1 STATIC 00:0F:FE:00:13:04 192.168.20.1 5 ge.1.30 DYNAMIC 1440 show dhcpsnooping statistics Use this command to display DHCP snooping statistics for untrusted ports. Syntax show dhcpsnooping statistics Parameters None. Defaults None. Mode Switch command, read‐write.
clear dhcpsnooping binding clear dhcpsnooping binding Use this command to remove bindings from the DHCP snooping bindings database. Syntax clear dhcpsnooping binding [port port-string | mac mac-addr] Parameters port port‐string (Optional) Specifies the entry or entries to remove by port identifier. mac mac‐addr (Optional) Specifies the entry to remove by MAC address. Defaults If no parameters are entered, all bindings (static and dynamic) are removed. Mode Switch command, read‐write.
clear dhcpsnooping limit Syntax clear dhcpsnooping database [write-delay] Parameters write‐delay (Optional) Specifies that the write delay value should be returned to the default value of 300 seconds. Defaults None. Mode Switch command, read‐write. Usage This command will set the database write delay value to the default of 300 seconds. Example This example sets the database storage location to the default of local.
Dynamic ARP Inspection Overview intercepts traffic for other stations by poisoning the ARP caches of its unsuspecting neighbors. ARP poisoning is a tactic where an attacker injects false ARP packets into the subnet, normally by broadcasting ARP responses in which the attacker claims to be someone else. By poisoning the ARP cache, a malicious user can intercept the traffic intended for other hosts on the network. The Dynamic ARP Inspection application performs ARP packet validation.
Dynamic ARP Inspection Overview Logging Invalid Packets By default, DAI writes a log message to the normal buffered log for each invalid ARP packet it drops. You can configure DAI to not log invalid packets for specific VLANs. Packet Forwarding DAI forwards valid ARP packets whose destination MAC address is not local. The ingress VLAN could be a switching or routing VLAN. ARP requests are flooded in the VLAN. ARP responses are unicast toward their destination.
Dynamic ARP Inspection Overview Basic Configuration The following basic configuration does not change the default rate limiting parameters. Procedure 17-2 Basic Dynamic ARP Inspection Configuration Step Task Command(s) 1. Configure DHCP snooping. Refer to Procedure 17-1 on page 17-3. 2. Enable ARP inspection on the VLANs where clients are connected, and optionally, enable logging of invalid ARP packets. set arpinspection vlan vlan-range [logging] 3.
Dynamic ARP Inspection Overview Example Configuration T Note: This example applies only to platforms that support routing. The following example configures DHCP snooping and dynamic ARP inspection in a routing environment using RIP. The example configures two interfaces on the switch, configuring RIP on both interfaces, assigning each to a different VLAN, and then enabling DHCP snooping and dynamic ARP inspection on them: • Interface ge.1.
Dynamic ARP Inspection Commands set vlan egress 10 ge.1.2 untagged set vlan egress 192 ge.1.1 untagged DHCP Snooping Configuration set dhcpsnooping enable set dhcpsnooping vlan 1 enable set dhcpsnooping vlan 10 enable set dhcpsnooping vlan 192 enable set dhcpsnooping verify mac-address disable set dhcpsnooping trust port ge.1.1 enable Dynamic ARP Inspection Configuration set arpinspection vlan 1 set arpinspection vlan 10 set arpinspection vlan 192 set arpinspection trust port ge.1.
set arpinspection trust Parameters vlan‐range Specifies the VLAN or range of VLANs on which to enable dynamic ARP inspection. logging (Optional) Enables logging of invalid ARP packets for that VLAN. Defaults Logging is disabled by default. Mode Switch command, read‐write. Usage This command enables dynamic ARP inspection (DAI) on one or more VLANs. When DAI is enabled on a VLAN, DAI is effectively enabled on the interfaces (physical ports or LAGs) that are members of that VLAN.
set arpinspection validate Usage Individual interfaces are configured as trusted or untrusted. The trust configuration for DAI is independent of the trust configuration for DHCP snooping. A trusted port is a port the network administrator does not consider to be a security threat. An untrusted port is one which could potentially be used to launch a network attack. DAI considers all physical ports and LAGs untrusted by default. Packets arriving on trusted interfaces bypass all DAI validation checks.
set arpinspection limit Example This example adds the optional verification that sender MAC addresses are the same as the source MAC addresses in the Ethernet headers of ARP packets.
set arpinspection filter set arpinspection filter Use this command to create an ARP ACL and then to assign an ACL to a VLAN, optionally as a static mapping. Syntax set arpinspection filter name {permit ip host sender-ipaddr mac host sender-macaddr | vlan vlan-range [static]} Parameters name Specifies the name of the ARP ACL. permit Specifies that a permit rule is being created. ip host sender‐ipaddr Specifies the IP address in the rule being created.
show arpinspection ports Parameters acl‐name (Optional) Specifies the ARP ACL to display. Defaults If a specific ACL is not specified, information about all configured ARP ACLs is displayed. Mode Switch command, read‐write. Example This example displays information about the ARP ACL named staticARP. C3(su)->show arpinspection access-list staticARP ARP access list staticARP permit ip host 192.168.1.10 mac host 00:01:22:33:44:55 permit ip host 192.168.1.
show arpinspection vlan show arpinspection vlan Use this command to display the ARP configuration of one or more VLANs. Syntax show arpinspection vlan vlan-range Parameters vlan‐range Specifies the VLANs for which to display configuration information. Defaults None. Mode Switch command, read‐write. Example This example displays ARP configuration information for VLAN 5.
clear arpinspection validate Examples This example shows what is displayed when no VLANs are specified. C3(su)->show arpinspection statistics VLAN ---5 Forwarded -----------0 Dropped --------0 This example shows what information is displayed when one or more VLANs are specified.
clear arpinspection vlan clear arpinspection vlan Use this command to disable dynamic ARP inspection on one or more VLANs or to disable logging of invalid ARP packets on one or more VLANs. Syntax clear arpinspection vlan vlan-range [logging] Parameters vlan‐range Specifies the VLAN or range of VLANs on which to disable dynamic ARP inspection. logging (Optional) Disable logging of invalid ARP packets for the specified VLANs.
clear arpinspection filter C3(su)->clear arpinspection vlan 5 logging C3(su)->show arpinspection vlan 5 Source MAC Validation Destination MAC Validation IP Address Validation Vlan ---5 Disabled Disabled Disabled Configuration Log Invalid ACL Name ------------- ----------- -------------------------------Disabled Disabled staticARP Static flag ----------Enabled clear arpinspection filter Use this command to remove an ARP ACL from a VLAN or from the switch, or to remove a permit rule from an existing ACL,
clear arpinspection limit Examples This example removes a permit rule from the ARP ACL named staticARP. C3(su)->clear arpinspection filter staticARP permit ip host 192.168.1.10 mac host 00:01:22:33:44:55 This example disables static mapping of the ARP ACL named staticARP that is associated with VLAN 5. C3(su)->clear arpinspection filter staticARP vlan 5 static This example removes the ARP ACL named staticARP from VLAN 5.
clear arpinspection statistics clear arpinspection statistics Use this command to clear all dynamic ARP inspection statistics. Syntax clear arpinspection statistics Parameters None. Defaults None. Mode Switch command, read‐write. Example This example clears all DAI statistics from the switch.
clear arpinspection statistics 17-32 DHCP Snooping and Dynamic ARP Inspection
18 Preparing for Router Mode This chapter describes how to prepare the switch for routing. For information about... Refer to page... Pre-Routing Configuration Tasks 18-1 Enabling Router Configuration Modes 18-2 Pre-Routing Configuration Tasks Startup and general configuration of the SecureStack C3 switch must occur from the switch CLI.
Enabling Router Configuration Modes Table 18-1 Enabling the Switch for Routing Step To do this task... Type this command... At this prompt... For details, see... 1 From admin (su) mode, enable router mode. router Switch: C3(su)-> 2 Enable router Privileged EXEC mode. enable Router: C3(su)->router> 3 Enable global router configuration mode. configure Router: C3(su)->router# 4 Enable interface configuration mode using the routing VLAN or loopback id.
Enabling Router Configuration Modes Table 18-2 Router CLI Configuration Modes (Continued) Use this mode... To... Access method... Resulting Prompt... Router Configuration Mode Set IP protocol parameters. Type router and the protocol name (and, for OSPF, the instance ID) from Global or Interface Configuration mode. C3(su)->router(Config-router)# Note: To jump to a lower configuration mode, type exit at the command prompt. To revert back to switch CLI, type exit from Privileged EXEC router mode.
Enabling Router Configuration Modes 18-4 Preparing for Router Mode
19 IP Configuration This chapter describes the Internet Protocol (IP) configuration set of commands and how to use them. Router: Unless otherwise noted, the commands covered in this chapter can be executed only when the device is in router mode. For details on how to enable router configuration modes, refer to “Enabling Router Configuration Modes” on page 18-2. For information about... Refer to page...
show interface For information about... Refer to page... show running-config 19-6 no shutdown 19-6 no ip routing 19-7 show interface Use this command to display information about one or more interfaces (VLANs or loopbacks) configured on the router. Syntax show interface [vlan vlan-id] [loopback loop-id] Parameters vlan vlan‐id (Optional) Displays interface information for a specific VLAN interface.
interface interface Use this command to configure interfaces for IP routing. Syntax interface vlan vlan-id | loopback loop-id Parameters vlan vlan‐id Specifies the number of the VLAN interface to be configured for routing. This interface must be configured for IP routing as described in “Pre‐ Routing Configuration Tasks” on page 18‐1. loopback loop‐id Specifies the number of the loopback interface to be configured for routing. The value of loop‐id can range from 0 to 7. Defaults None.
show ip interface Examples This example shows how to enter configuration mode for VLAN 1: C3(su)->router#configure C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))# This example shows how to enter configuration mode for loopback 1: C3(su)->router#configure C3(su)->router(Config)#interface loopback 1 C3(su)->router(Config-if(Lpbk 1))# show ip interface Use this command to display information, including administrative status, IP address, MTU (Maximum Transmission Unit) size and ban
ip address Table 19-1 show ip interface Output Details Output Field What It Displays... Vlan N Whether the interface is administratively and operationally up or down. Primary IP Address Inteface’s primary IP address and mask. Set using the ip address command as described in “ip address” on page 19-5. Frame Type Encapsulation type used by this interface. Set using the arp command as described in “arp” on page 19-13. MAC-Address MAC address mapped to this interface.
show running-config Example This example sets the IP address to 192.168.1.1 and the network mask to 255.255.255.0 for VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip address 192.168.1.1 255.255.255.0 show running-config Use this command to display the non‐default, user‐supplied commands entered while configuring the device. Syntax show running-config Parameters None. Defaults None. Mode Any router mode.
no ip routing Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage The shutdown form of this command disables an interface for IP routing. Example This example shows how to enable VLAN 1 for IP routing: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#no shutdown no ip routing Use this command to disable IP routing on the device.
Configuring Tunnel Interfaces Configuring Tunnel Interfaces Purpose The commands in this section describe how to create, delete, and manage tunnel interfaces. Several different types of tunnels provide functionality to facilitate the transition of IPv4 networks to IPv6 networks. These tunnels are divided into two classes: configured and automatic. The distinction is that configured tunnels are explicitly configured with a destination or endpoint of the tunnel.
tunnel source Usage This command enables tunnel interface configuration mode from global configuration mode, and, if the interface has not previously been created, this command creates a new tunnel routing interface. The no form of this command removes the tunnel interface and associated configuration parameters. Example This example creates a configured tunnel interface 1.
tunnel destination tunnel destination This command specifies the IPv4 destination transport address of the tunnel. Syntax tunnel destination ipv4-addr no tunnel destination Parameters ipv4‐addr The IPv4 destination address of the tunnel. Defaults None. Mode Router interface configuration: C3(su)‐>router(Config‐if(Tnnl 1))# Usage The no form of this command removes the destination IPv4 address for the tunnel interface being configured.
show interface tunnel Example This example sets the tunnel mode to IPv6 over IPv4. C3(su)->router(Config)# interface tunnel 1 C3(su)->router(Config-if(Tnnl 1))# C3(su)->router(Config-if(Tnnl 1))# tunnel mode ipv6ip show interface tunnel This command displays information about a configured tunnel interface. Syntax show interface tunnel tunnel-id Parameters tunnel‐id Specifies the tunnel for which to display information. Defaults None.
Reviewing and Configuring the ARP Table Reviewing and Configuring the ARP Table Purpose To review and configure the routing ARP table, to enable proxy ARP on an interface, and to set a MAC address on an interface. Commands For information about... Refer to page... show ip arp 19-12 arp 19-13 ip proxy-arp 19-14 arp timeout 19-15 clear arp-cache 19-15 show ip arp Use this command to display entries in the ARP (Address Resolution Protocol) table.
arp Example This example shows how to use the show ip arp command: C3(su)->router#show ip arp Protocol Address Age (min) Hardware Addr Type Interface -----------------------------------------------------------------------------Internet 134.141.235.251 0 0003.4712.7a99 ARPA Vlan1 Internet 134.141.235.165 - 0002.1664.a5b3 ARPA Vlan1 Internet 134.141.235.167 4 00d0.cf00.4b74 ARPA Vlan2 C3(su)->router#show ip arp 134.141.235.
ip proxy-arp Defaults None. Mode Global configuration: C3(su)‐>router(Config)# Usage The IP address specified for the static ARP entry must fall within one of the subnets or networks defined on the routed interfaces of the system ( or stack, if applicable). The system can then match the IP address of the static ARP entry with the appropriate routed interface and associate it with the correct VLAN. Example This example shows how to add a permanent ARP entry for the IP address 130.2.3.
arp timeout arp timeout Use this command to set the duration (in seconds) for dynamically learned entries to remain in the ARP table before expiring. The no form of this command restores the default value of 14,400 seconds. arp timeout seconds no arp timeout Parameters seconds Specifies the time in seconds that an entry remains in the ARP cache. Valid values are 0 ‐ 65535. A value of 0 specifies that ARP entries will never be aged out. Defaults 14,400 seconds.
Configuring Broadcast Settings Configuring Broadcast Settings Purpose To configure IP broadcast settings. By default, interfaces on the SecureStack C3 do not forward broadcast packets. Commands For information about... Refer to page... ip directed-broadcast 19-16 ip forward-protocol 19-17 ip helper-address 19-18 ip directed-broadcast Use this command to enable or disable IP directed broadcasts on an interface. By default, interfaces on the SecureStack C3 do not forward directed broadcasts.
ip forward-protocol broadcast only on the 30 network interface will allow anyone from any other networks (10, 20, 40, 50) to send directed broadcast to the 30 network. Example This example shows how to enable IP directed broadcasts on VLAN 1: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip directed-broadcast ip forward-protocol Use this command to enable UDP broadcast forwarding and specify which protocols will be forwarded.
ip helper-address Examples The following example globally disables IP forwarding for UDP port 69. C3(su)->router(Config)#no ip forward-protocol udp 69 The following example disables IP forwarding for UDP port 69 on a specific interface.
Reviewing IP Traffic and Configuring Routes For other protocols specified through the ip forward‐protocol command, the system forwards broadcast UDP traffic as a unicast packet to the specified IP addresses. Example This example show how to have all client DHCP requests for users in VLAN 1 to be forwarded to the remote DHCP server with IP address 192.168.1.28. C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip helper-address 192.168.1.
show ip route Defaults If no parameters are specified, all IP route information will be displayed. Mode Any router mode. Usage The routing table contains all active static routes, all the RIP routes, and up to three best OSPF routes learned for each network. Example This example shows how to use the show ip route command to display all IP route information.
ip route O E2 C O E2 22.22.28.0/24 [8/20] via 168.1.0.249, Vlan 1300 via 168.1.0.254, Vlan 1200 22.22.29.0/24 [150/20] via 168.0.0.249, Vlan 3205 26.0.0.0/8 [0/0] directly connected, Vlan 26 33.9.8.0/28 [8/20] via 168.1.0.254, Vlan 1200 33.33.0.0/16 [150/20] via 168.0.0.249, Vlan 3205 ip route Use this command to add or remove a static IP route. The no form of this command removes the static IP route.
traceroute Mode Privileged EXEC: C3(su)‐>router# Usage This command is also available in switch mode. Examples This example shows output from a successful ping to IP address 182.127.63.23: C3(su)->router#ping 182.127.63.23 182.127.63.23 is alive This example shows output from an unsuccessful ping to IP address 182.127.63.24: C3(su)->router#ping 182.127.63.24 no answer from 182.127.63.
Configuring ICMP Redirects Configuring ICMP Redirects Purpose Disable or enable sending ICMP redirect packets to the switch CPU for processing, at a global level and at an interface level. By default, sending ICMP redirects is enabled globally and on all interfaces. Disabling sending ICMP redirects can reduce CPU usage in certain deployments. Commands For information about... Refer to page...
show ip icmp redirect This example disables sending ICMP redirects globally. C3(su)->router#configure C3(su)->router(Config)#no ip icmp redirect enable show ip icmp redirect Use this command to display the status of sending ICMP redirects at a global or interface level. Syntax show ip icmp redirect {status | interface [vlan vlan-id]} Parameters status Display the global ICMP redirect status. interface Display ICMP redirect status for interfaces.
20 IPv4 Routing Protocol Configuration This chapter describes the IPv4 Routing Protocol Configuration set of commands and how to use them. Router: The commands covered in this chapter can be executed only when the device is in router mode. For details on how to enable router configuration modes, refer to “Enabling Router Configuration Modes” on page 18-2. For information about... Refer to page...
Configuring RIP Configuring RIP Purpose To enable and configure the Routing Information Protocol (RIP). RIP Configuration Task List and Commands Table 20‐1 lists the tasks and commands associated with RIP configuration. Commands are described in the associated section as shown. Table 20-1 RIP Configuration Task List and Commands To do this... Use these commands... Enable RIP configuration mode. “router rip” on page 20-2 Enable RIP on an interface.
ip rip enable Mode Global configuration: C3(su)‐>router(Config)# Usage You must execute the router rip command to enable the protocol before completing many RIP‐ specific configuration tasks. For details on enabling configuration modes, refer to Table 18‐2 in “Enabling Router Configuration Modes” on page 18‐2.
ip rip send version Parameters weight Specifies an administrative distance for RIP routes. Valid values are 1 ‐ 255. Defaults None. Mode Router configuration: C3(su)‐>router(Config‐router)# Usage If several routes (coming from different protocols) are presented to the SecureStack C3, the protocol with the lowest administrative distance will be chosen for route installation. By default, RIP administrative distance is set to 120.
ip rip receive version Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set the RIP send version to 2 for packets transmitted on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip rip send version 2 ip rip receive version Use this command to set the RIP version(s) for RIP update packets accepted on an interface.
ip rip message-digest-key Parameters name Specifies the password to enable or disable for RIP authentication. Defaults None.
no auto-summary no auto-summary Use this command to disable automatic route summarization. Syntax no auto-summary auto-summary Parameters None. Defaults None. Mode Router configuration: C3(su)‐>router(Config‐router)# Usage By default, RIP version 2 supports automatic route summarization, which summarizes subprefixes to the classful network boundary when crossing network boundaries.
passive-interface Mode Router configuration: C3(su)‐>router(Config‐router)# Usage Split horizon prevents a network from being advertised out the same interface it was received on. This function is disabled by default.
receive-interface receive-interface Use this command to allow RIP to receive update packets on an interface. The no form of this command denies the reception of RIP updates. By default, receiving is enabled on all routing interfaces. Syntax receive-interface vlan vlan-id no receive-interface vlan vlan-id Parameters vlan vlan‐id Specifies the number of the VLAN to make a receive interface. This VLAN must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1.
redistribute static Specifies that non‐RIP routing information discovered via static routes will be redistributed. Static routes are those created using the ip route command detailed in “ip route” on page 19‐21. metric metric value (Optional) Specifies a metric for the connected, OSPF or static redistribution route. This value should be consistent with the designation protocol. subnets (Optional) Specifies that connected, OSPF or static routes that are subnetted will be redistributed.
Configuring OSPF Configuring OSPF * Advanced License Required * OSPF is an advanced routing feature that must be enabled with a license key. If you have purchased an advanced license key, and have enabled routing on the device, you must activate your license as described in the chapter entitiled “Activating Licensed Features” in order to enable the OSPF command set. If you wish to purchase an advanced routing license, contact Enterasys Networks Sales.
router id Table 20-2 OSPF Configuration Task List and Commands (Continued) To do this... Use these commands... • Define an area as a stub area. “area stub” on page 20-22 • Set the cost value for the default route that is sent into a stub area. “area default cost” on page 20-23 • Define an area as an NSSA. “area nssa” on page 20-23 Create virtual links. “area virtual-link” on page 20-24 Enable redistribution from non-OSPF routes. “redistribute” on page 20-25 Monitor and maintain OSPF.
router ospf router ospf Use this command to enable or disable Open Shortest Path First (OSPF) configuration mode. The no form of this command disables OSPF configuration mode. Syntax router ospf process-id no router ospf process-id Parameters process‐id Specifies the process ID, an internally used identification number for an OSPF routing process run on a router. Only one OSPF process is allowed per stack or standalone. Valid values are 1 to 65535. Defaults None.
ip ospf enable Mode Router configuration: C3(su)‐>router(Config‐router)# Example This example shows how to enable RFC 1583 compatibility: C3(su)->router(Config)#router ospf 1 C3(su)->router(Config-router)#1583compatability ip ospf enable Use this command to enable OSPF on an interface. The no form of this command disables OSPF on an interface. Syntax ip ospf enable no ip ospf enable Parameters None. Defaults None.
ip ospf cost Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to configure the VLAN 1 interface as area 0.0.0.31: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip ospf areaid 0.0.0.31 ip ospf cost Use this command to set the cost of sending an OSPF packet on an interface. The no form of this command resets the OSPF cost to the default of 10.
timers spf Parameters number Specifies the router’s OSPF priority in a range from 0 to 255. Default value is 1. Defaults None. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage The priority value is communicated between routers by means of hello messages and influences the election of a designated router.
ip ospf retransmit-interval ip ospf retransmit-interval Use this command to set the amount of time between retransmissions of link state advertisements (LSAs) for adjacencies that belong to an interface. The no form of this command resets the retransmit interval value to the default, 5 seconds. Syntax ip ospf retransmit-interval seconds no ip ospf retransmit-interval Parameters seconds Specifies the retransmit time in seconds. Valid values are 1 to 65535. Defaults None.
ip ospf hello-interval Example This example shows how to set the time required to transmit a link state update packet on the VLAN 1 interface at 20 seconds: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip ospf transmit-delay 20 ip ospf hello-interval Use this command to set the number of seconds a router must wait before sending a hello packet to neighbor routers on an interface. The no form of this command sets the hello interval value to the default value of 10 seconds.
ip ospf authentication-key Parameters seconds Specifies the number of seconds that a router must wait to receive a hello packet before declaring the neighbor as “dead” and removing it from the OSPF neighbor list. Dead interval must be the same on neighboring routers (on a specific subnet), but can vary between subnets. This parameter is an unsigned integer ranging from 1 to 65535. Default value is 40 seconds. Defaults None.
ip ospf message digest key md5 Example This example shows how to enables an OSPF authentication key on the VLAN 1 interface with the password “yourpass”: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip ospf authentication-key yourpass ip ospf message digest key md5 Use this command to enable or disable OSPF MD5 authentication on an interface. This validates OSPF MD5 routing updates between neighboring routers.
area range Parameters external | inter‐ area | intra‐area Applies the distance value to external (type 5 and type 7), to inter‐area, or to intra‐area routes. Note: The value for intra-area distance must be less than the value for inter-area distance, which must be less than the value for external distance. weight Specifies an administrative distance for OSPF routes. Valid values are 1 ‐ 255. Defaults If route type is not specified, the distance value will be applied to all OSPF routes.
area stub Parameters area‐id Specifies the area from which routes are to be summarized. This is a decimal value from 0 to 429496295. ip‐address Specifies the IP address associated with the area ID. ip‐mask Specifies the mask for the IP address. advertise | no‐ advertise (Optional) Enters address range in advertise mode, or do not advertise mode. Defaults If not specified, advertise mode will be set.
area default cost Example The following example shows how to define OSPF area 10 as a stub area: C3(su)->router(Config)#router ospf 1 C3(su)->router(Config-router)#area 10 stub area default cost Use this command to set the cost value for the default route that is sent into a stub area and NSSA by an Area Border Router (ABR). The no form of this command removes the cost value from the summary route that is sent into the stub area.
area virtual-link Parameters area‐id Specifies the NSSA area. Valid values are decimal values or IP addresses. default‐ information‐ originate (Optional) Generates a default of Type 7 into the NSSA. This is used when the router is an NSSA ABR. Defaults If default‐information‐originate is not specified, no default type will be generated.
redistribute Parameters area‐id Specifies the transit area for the virtual link. Valid values are decimal values or IP addresses. A transit area is an area through which a virtual link is established. router‐id Specifies the router ID of the virtual link neighbor. authentication‐ key key Specifies a password to be used by the virtual link. Valid values are alphanumeric strings of up to 8 characters. Neighbor virtual link routers on a network must have the same password.
show ip ospf Parameters connected Specifies that non‐OSPF information discovered via directly connected interfaces will be redistributed. rip Specifies that RIP routing information will be redistributed in OSPF. static Specifies that non‐OSPF information discovered via static routes will be redistributed. Static routes are those created using the ip route command detailed in “ip route” on page 19‐21.
show ip ospf database Example This example shows how to display OSPF information: C3(su)->router#show ip ospf Routing process "ospf 1" with ID 155.155.155.155 Supports only Normal TOS route. It is not an area border router and is an autonomous system boundary router. Redistributing External Routes from static Number of areas in this router is 2 Area 0.0.0.0 SPF algorithm executed 0 times Area ranges are Link State Age Interval is 10 Area 0.0.0.
show ip ospf interface 191.4.0.0 155.155.155.155 1307 0x8000003c Displaying Router Link States(Area 0.0.0.8) LinkID ADV Router Age Seq# 3.3.3.3 3.3.3.3 986 0x8000008e 155.155.155.155 155.155.155.155 977 0x8000009c Displaying Net Link States(Area 0.0.0.8) LinkID ADV Router Age Seq# 192.168.30.2 155.155.155.155 310 0x8000003b 192.168.31.2 155.155.155.155 997 0x80000002 192.168.32.2 155.155.155.155 997 0x80000002 192.168.33.2 155.155.155.155 998 0x80000002 Displaying Ipnet Sum Link States(Area 0.0.0.
show ip ospf interface Defaults If vlan‐id is not specified, OSPF statistics will be displayed for all VLANs. Mode Any router mode. Example This example shows how to display all OSPF related information for the VLAN 6 interface: C3(su)->router#show ip ospf interface vlan 6 Vlan 6 Internet Address 192.168.6.2 Mask 255.255.255.0, Area 0.0.0.0 Router ID 3.3.3.3 , Cost: 10 (computed) Transmit Delay is 1 sec , State designated-router , Priority 1 Designated Router id 3.3.3.3 , Interface Addr 192.168.6.
show ip ospf neighbor show ip ospf neighbor Use this command to display the state of communication between an OSPF router and its neighbor routers. Syntax show ip ospf neighbor [detail] [ip-address] [vlan vlan-id] Parameters detail (Optional) Displays detailed information about the neighbors, including the area in which they are neighbors, who the designated router/backup designated router is on the subnet, if applicable, and the decimal equivalent of the E‐bit value from the hello packet options field.
show ip ospf virtual-links show ip ospf virtual-links Use this command to display information about the virtual links configured on a router. A virtual link represents a logical connection between the backbone and a non‐backbone OSPF area. Syntax show ip ospf virtual-links Parameters None. Defaults None. Mode Any router mode. Example This example shows how to display OSPF virtual links information: C3(su)->router#show ip ospf virtual-links Neighbor ID 155.155.155.155 Transit area 0.0.0.
clear ip ospf process Parameters process‐id Specifies the process ID, an internally used identification number for each instance of the OSPF routing process run on a router. Valid values are 1 to 65535. Defaults None.
Configuring DVMRP Configuring DVMRP * Advanced License Required * DVMRP is an advanced routing feature that must be enabled with a license key. If you have purchased an advanced license key, and have enabled routing on the device, you must activate your license as described in the chapter entitled “Activating Licensed Features” in order to enable the DVMRP command set. If you wish to purchase an advanced routing license, contact Enterasys Networks Sales.
ip dvmrp Table 20-1 Commands to Enable DVMRP on an Interface To do this... Use these commands... Globally enable IGMP. “ip igmp” on page 13-10 Globally enable DVMRP. “ip dvmrp” on page 20-34. Enable IGMP on each interface. “ip igmp enable” on page 13-11 Enable DVMRP on each interface . “ip dvmrp enable” on page 20-34 ip dvmrp Use this command to enable the DVMRP process. The no form of this command disables the DVMRP process: Syntax ip dvmrp no ip dvmrp Parameters None. Defaults None.
ip dvmrp metric Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to enable DVMRP on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip dvmrp enable ip dvmrp metric Use this command to configure the metric associated with a set of destinations for DVMRP reports. Syntax ip dvmrp metric metric Parameters metric Specifies a metric associated with a set of destinations for DVMRP reports.
show ip dvmrp Defaults If no optional parameters are specified, status information will be displayed. Mode Any router mode. Example This example shows how to display DVMRP status information: C3(su)->router#show ip dvmrp Vlan Id Metric Admin Status -----------------------10 Enabled 18 Enabled 20 Enabled 25 Enabled 32 Enabled 500 Enabled 20-36 IPv4 Routing Protocol Configuration Oper.
Configuring IRDP Configuring IRDP Purpose To enable and configure the ICMP Router Discovery Protocol (IRDP) on an interface. This protocol enables a host to determine the address of a router it can use as a default gateway. It is disabled by default. Commands For information about... Refer to page...
ip irdp maxadvertinterval ip irdp maxadvertinterval Use this command to set the maximum interval in seconds between IRDP advertisements. The no form of this command resets the maximum advertisement interval to the default value of 600 seconds. Syntax ip irdp maxadvertinterval interval no irdp maxadvertinterval Parameters interval Specifies a maximum advertisement interval in seconds. Valid values are 4 to 1800. Defaults None.
ip irdp holdtime Example This example shows how to set the minimum IRDP advertisement interval to 500 seconds on the VLAN 1 interface: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip irdp minadvertinterval 500 ip irdp holdtime Use this command to set the length of time in seconds IRDP advertisements are held valid. The no form of this command resets the hold time to the default value of three times the maxadvertinterval value, which is equal to 1800 seconds.
ip irdp broadcast Defaults None. Mode Interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Example This example shows how to set IRDP preference on the VLAN 1 interface so that the interface’s address may still be advertised, but cannot be used by neighboring hosts as a default router address: C3(su)->router(Config)#interface vlan 1 C3(su)->router(Config-if(Vlan 1))#ip irdp preference -2147483648 ip irdp broadcast Use this command to configure IRDP to use the limited broadcast address of 255.255.
show ip irdp Parameters vlan vlan‐id (Optional) Displays IRDP information for a specific VLAN. This VLAN must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1. Defaults If vlan vlan‐id is not specified, IRDP information for all interfaces will be displayed.
Configuring VRRP Configuring VRRP * Advanced License Required * VRRP is an advanced routing feature that must be enabled with a license key. If you have purchased an advanced license key, and have enabled routing on the device, you must activate your license as described in the chapter entitled “Activating Licensed Features” in order to enable the VRRP command set. If you wish to purchase an advanced routing license, contact Enterasys Networks Sales.
create Usage You must execute the router vrrp command to enable the protocol before completing other VRRP‐specific configuration tasks. For details on enabling configuration modes, refer to Table 18‐2 on page 18‐2. Example This example shows how enable VRRP configuration mode: C3(su)->router#configure C3(su)->router(Config)#router vrrp C3(su)->router(Config-router)# create Use this command to create a VRRP session. Each SecureStack C3 system supports up to 20 VRRP sessions.
address address Use this command to configure a virtual router IP address. The no form of this command clears the VRRP address configuration. Syntax address vlan vlan-id vrid ip-address owner no address vlan vlan-id vrid ip-address owner Parameters vlan vlan‐id Specifies the number of the VLAN on which to configure a virtual router address. This VLAN must be configured for IP routing as described in “Pre‐ Routing Configuration Tasks” on page 18‐1.
priority priority Use this command to set a priority value for a VRRP router. The no form of this command clears the VRRP priority configuration. Syntax priority vlan vlan-id vrid priority-value no priority vlan vlan-id vrid priority-value Parameters vlan vlan‐id Specifies the number of the VLAN on which to configure VRRP priority. This VLAN must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1.
preempt Parameters vlan vlan‐id Specifies the number of the VLAN on which to configure the VRRP advertisement interval. This VLAN must be configured for IP routing as described in “Pre‐Routing Configuration Tasks” on page 18‐1. vrid Specifies a unique Virtual Router ID (VRID) associated with the routing interface. Valid values are from 1 to 255. interval Specifies a VRRP advertisement interval to associate with the vrid. Valid values are from 1 to 255 seconds. Defaults None.
enable Mode Router configuration: C3(su)‐>router(Config‐router)# Usage Preempt is enabled on VRRP routers by default, which allows a higher priority backup router to preempt a lower priority master. The router that owns the virtual router IP address always preempts other routers, regardless of this setting.
ip vrrp authentication-key ip vrrp authentication-key Use this command to enable or disable a VRRP authentication key (password) for use on an interface. The no form of this command prevents VRRP from using authentication. Syntax ip vrrp authentication-key name no ip vrrp authentication-key Parameters name Specifies the password to enable or disable for VRRP authentication. Defaults None.
Configuring PIM-SM Configuring PIM-SM * Advanced License Required * PIM-SM is an advanced routing feature that must be enabled with a license key. If you have purchased an advanced license key, and have enabled routing on the device, you must activate your license as described in the chapter entitled “Activating Licensed Features” in order to enable the PIM-SM command set. If you wish to purchase an advanced routing license, contact Enterasys Networks Sales.
ip pimsm For information about... Refer to page... Display commands show ip pimsm 20-52 show ip pimsm componenttable 20-53 show ip pimsm interface 20-54 show ip pimsm neighbor 20-55 show ip pimsm rp 20-56 show ip pimsm rphash 20-57 show ip pimsm staticrp 20-58 show ip mroute 20-59 ip pimsm This command sets administrative mode of PIM‐SM multicast routing across the router to enabled. IGMP must be enabled before PIM‐SM can be enabled. By default, both IGMP and PIM are globally disabled.
ip pimsm enable Parameters ipaddress The IP address of the Rendezvous Point groupadress The group address supported by the Rendezvous Point groupmask The group mask for the group address Defaults None. Mode Global Router configuration: C3(su)‐>router(Config)# Example This example shows how to set an RP for a specific multicast group. C3(su)->router(Config)# ip pimsm staticrp 192.15.18.3 224.0.0.0 240.0.0.
ip pimsm query-interval ip pimsm query-interval This command configures the transmission frequency of hello messages in seconds between PIM‐enabled neighbors. The no form of this command resets the hello interval to the default, 30 seconds. Syntax ip pimsm query-interval seconds no ip pimsm query-interval Parameters seconds This field has a range of 10 to 3600 seconds. Default is 30. Defaults None.
show ip pimsm componenttable PIM-SM INTERFACE STATUS VlanId Interface Mode --------- -------------8 Disable 16 Enable 17 Enable 20 Enable 30 Enable 31 Disable 32 Disable 33 Disable Protocol State ---------------Non-Operational Operational Operational Operational Operational Non-Operational Non-Operational Non-Operational Table 20‐7 provides an explanation of the command output.
show ip pimsm interface COMPONENT TABLE Component Index Component BSR Address Component BSR Expiry Time (hh:mm:ss) --------------- --------------192.168.30.2 00:02:10 ---------1 Component CRP Hold Time (hh:mm:ss) ------------00:00:00 Table 20‐8 provides an explanation of the command output. Table 20-8 show ip pimsm componenettable Output Details Output Field What it displays Component Index This field displays a number which uniquely identifies the component.
show ip pimsm neighbor Hello Interval (secs) CBSR Preference CRP Preference CBSR Hash Mask Length 30 secs -1 -1 30 Table 20‐9 provides an explanation of the show ip pimsm interface vlan command output. Table 20-9 show ip pimsm interface vlan Output Details Output Field What it displays IP Address The IP address of the specified interface. Subnet Mask The Subnet Mask for the IP address of the PIM interface. Mode Indicates whether PIM-SM is enabled or disabled on the specified interface.
show ip pimsm rp Parameters vlan‐id (Optional) Display all neighbors discovered on a specific Interface. Mode Any router mode. Defaults If the VLAN id is omitted, all neighbors off all interfaces will be displayed. Example This example shows how to display PIM information: C3(su)->router> show ip pimsm neighbor Vlan ID --------30 6 NEIGHBOR TABLE IP Address Up Time (hh:mm:ss) ---------------- ---------192.168.30.2 01:36:41 192.168.6.
show ip pimsm rphash Defaults None. Mode Any router mode. Examples This example shows how to display the RP set for a specific group address. C3(su)->router> show ip pimsm rp 224.0.0.0 240.0.0.0 RP SET TABLE Group Address Group Mask Address Hold Time Expiry Time Component C-RP Priority (hh:mm:ss) (hh:mm:ss) --------- ---------- ----------- ---------- ----------- --------- ----------224.0.0.0 240.0.0.0 192.168.30.2 00:02:15 00:02:30 1 0 Table 20‐12 provides an explanation of the command output.
show ip pimsm staticrp Parameters group‐address The Group Address for the RP. Defaults None. Mode Any router mode. Example This example shows how to display RP that will be selected for group address 224.0.0.0: C3(su)->router> show ip pimsm rphash 224.0.0.0 192.168.129.223 show ip pimsm staticrp Display the PIM‐SM static Rendezvous Point information. Syntax show ip pimsm staticrp Parameters None. Mode Any router mode. Defaults None. Example This example shows how to display PIM information.
show ip mroute Table 20-13 show ip pimsm staticrp Output Details Output Field What it displays Address The IP address of the RP. Group Address The group address supported by the RP. Group Mask The group mask for the group address. show ip mroute Use this command to display the IP multicast routing table. Syntax show ip mroute Parameters None. Defaults None. Mode Any router mode.
show ip mroute Upstream Neighbor: 0.0.0.0 Upstream Vlan : 111 Downstream Vlans : 8 20-60 Source Network : Source Mask : MultiCast Group : Uptime : Upstream Neighbor: Upstream Vlan : Downstream Vlans : 192.168.111.10 0.0.0.0 239.1.8.169 6582 0.0.0.0 111 8 Source Network : Source Mask : MultiCast Group : Uptime : Upstream Neighbor: Upstream Vlan : Downstream Vlans : 192.168.111.10 0.0.0.0 239.1.4.173 6582 0.0.0.
21 IPv6 Management This chapter describes the switch mode set of commands used to manage IPv6. Purpose To enable or disable the IPv6 management function, to configure and display the IPv6 host address and IPv6 gateway for the switch, and to display IPv6 status information. Commands For information about... Refer to page...
set ipv6 Defaults None. Mode Switch mode, read‐only. Example This example shows how to display IPv6 management function status. C3(ro)->show ipv6 status IPv6 Administrative Mode: Disabled set ipv6 Use this command to globally enable or disable the IPv6 management function. Syntax set ipv6 {enable | disable} Parameters enable | disable Enable or disable the IPv6 management function. Defaults By default, IPv6 management is disabled. Mode Switch mode, read‐write.
set ipv6 address set ipv6 address Use this command to configure IPv6 global addressing information. Syntax set ipv6 address ipv6-addr/prefix-length [eui64] Parameters ipv6‐addr The IPv6 address or prefix to be configured. This parameter must be in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. prefix‐length The length of the IPv6 prefix for this address.
show ipv6 address show ipv6 address Use this command to display the system IPv6 address(es) and IPv6 gateway address (default router), if configured. Syntax show ipv6 address Parameters None. Defaults None. Mode Switch command, read‐only. Usage This command displays the IPv6 addresses configured automatically and with the set ipv6 address and set ipv6 gateway commands. Example This example displays three IPv6 management addresses configured for the switch.
set ipv6 gateway Mode Switch mode, read‐write. Usage This command clears addresses manually configured with the set ipv6 address command. Use the clear ipv6 gateway command to clear the IPv6 gateway address. Example This example illustrates that this command clears only those IPv6 addresses configured with the set ipv6 address command. The link‐local address for the host interface and the gateway address are not removed with this command.
clear ipv6 gateway Use the show ipv6 address command to display a configured IPv6 gateway address. Example This example shows how to configure an IPv6 gateway address using a link‐local address. C3(su)->set ipv6 gateway fe80::201:f4ff:fe5d:1234 C3(su)->show ipv6 address Name IPv6 Address --------------------------------------------------host FE80::201:F4FF:FE5C:2880/64 gateway FE80::201:F4FF:FE5D:1234 clear ipv6 gateway Use this command to clear an IPv6 gateway address.
show ipv6 netstat Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows example output of this command. C3(su)->show ipv6 neighbors Last IPv6 Address MAC Address isRtr State Updated --------------------------------------- ----------------- ----- ------- ------2001:db8:1234:6666::2310:3 00:04:76:73:42:31 True Reachable 00:01:16 show ipv6 netstat Use this command to display IPv6 netstat information. Syntax show ipv6 netstat Parameters None. Defaults None.
ping ipv6 TCP TCP TCP TCP TCP TCP ::.* ::.22 ::.* LISTEN 3333::211:88FF:FE59:4424.80 2020::D480:1384:F58C:B114.1053 3333::211:88FF:FE59:4424.80 2020::D480:1384:F58C:B114.1054 ::.443 ::.* 3333::211:88FF:FE59:4424.22 2020::D480:1384:F58C:B114.1048 3333::211:88FF:FE59:4424.443 2020::D480:1384:F58C:B114.1055 ESTABLISHED ESTABLISHED LISTEN ESTABLISHED TIME_WAIT ping ipv6 Use this command to test routing network connectivity by sending IP ping requests.
traceroute ipv6 traceroute ipv6 Use this command to discover the routes that packets actually take when traveling to their destination through the network on a hop‐by‐hop basis. Syntax traceroute ipv6 ipv6-addr Parameters ipv6‐addr Specifies a host to which the route of an IPv6 packet will be traced. Enter the address in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. Defaults None. Mode Switch mode, read‐write.
traceroute ipv6 21-10 IPv6 Management
22 IPv6 Configuration * IPv6 Routing License Required * IPv6 routing must be enabled with a license key. If you have purchased an IPv6 routing license key, and have enabled routing on the device, you must activate your license as described in the chapter entitled “Activating Licensed Features” in order to enable the IPv6 routing configuration command set. If you wish to purchase an IPv6 routing license, contact Enterasys Networks Sales.
Overview autoconfiguration is part of Router Advertisement and the SecureStack C3 can support both stateless and stateful autoconfiguration of end nodes. The SecureStack C3 supports both EUI‐64 interface identifiers and manually configured interface IDs.
General Configuration Commands General Configuration Commands For information about... Refer to page... ipv6 forwarding 22-3 ipv6 hop-limit 22-3 ipv6 route 22-4 ipv6 route distance 22-5 ipv6 unicast-routing 22-6 ping ipv6 22-6 ping ipv6 interface 22-7 traceroute ipv6 22-8 ipv6 forwarding This command enables or disables IPv6 forwarding on the router. Syntax ipv6 forwarding no ipv6 forwarding Parameters None. Defaults IPv6 forwarding is enabled.
ipv6 route Parameters hops Specifies the maximum number of IPv6 hops used in IPv6 packets and router advertisements generated by this device. Value can range from 1 to 255. The default value is 64. Defaults The default maximum number of IPv6 hops is 64. Mode Router global configuration: C3(su)‐>router(Config)# Usage This command sets the value of the hop limit field in IPv6 packets originated by this device.
ipv6 route distance next‐hop‐addr Link‐local address of the interface. pref (Optional) Specifies the preference value the router uses to compare this route with routes from other route sources that have the same destination. The value of pref can range from1 to 255. The default value is 1, which gives static routes precedence over any other type of route except connected routes. A route with a preference of 255 cannot be used to forward traffic.
ipv6 unicast-routing Usage The default distance is used when no distance is specified in the ipv6 route command. Changing the default distance does not update the distance of existing static routes, even if they were assigned the original default distance. The new default distance will only be applied to static routes created after invoking the ipv6 route distance command. Use the no form of this command to return the default distance to 1. Example This command sets the default distance value to 3.
ping ipv6 interface Parameters ipv6‐addr Specifies the global IPv6 address of the system to ping. Enter the address in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. size num (Optional) Specifies the size of the datagram packet. The value of num can range from 48 to 2048 bytes. Defaults None.
traceroute ipv6 ipv6‐addr Specifies the global IPv6 address of the system to ping. Enter the address in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. size num (Optional) Specifies the size of the datagram packet. The value of num can range from 48 to 2048 bytes. Defaults None.
traceroute ipv6 Example This example shows how to use traceroute to display a round trip path to host 2001:0db8:1234:5555::1. C3(su)->router#traceroute ipv6 2001:0db8:1234:5555::1 Traceroute to 2001:0db8:1234:5555::1, 30 hops max, 40 byte packets 1 2001:0db8:1234:5555::1 1.000000e+00 ms 1.000000e+00 ms 1.
Interface Configuration Commands Interface Configuration Commands For information about... Refer to page... ipv6 address 22-10 ipv6 enable 22-11 ipv6 mtu 22-12 ipv6 address This command configures a global IPv6 address on an interface, including VLAN, tunnel, and loopback interfaces, and enables IPv6 processing on the interface.
ipv6 enable This command also enables IPv6 processing on the interface and automatically generates a link‐ local address. You can assign multiple globally reachable addresses to an interface with this command. Use the no ipv6 address command without any parameters to remove all manually configured IPv6 addresses from the interface. Example This example configures an IPv6 address by using the eui64 parameter. Then, the show ipv6 interface is executed to display the configuration.
ipv6 mtu The no ipv6 enable command disables IPv6 routing on an interface that has been enabled with the ipv6 enable command, but it does not disable IPv6 processing on an interface that is configured with an explicit IPv6 address. Example This example enables IPv6 processing on VLAN 7. Note that a link‐local address has been automatically configured.
ipv6 mtu Note: All interfaces attached to the same physical medium must be configured with the same MTU to operate properly. Example This example sets the MTU value to 1500 bytes.
Neighbor Cache and Neighbor Discovery Commands Neighbor Cache and Neighbor Discovery Commands The IPv6 Neighbor Cache functions similarly to the IPv4 ARP table. Entries can be made to the Neighbor Cache by the Neighbor Discovery protocol. The Neighbor Discovery commands allow you to set protocol parameters on an interface basis. For information about... Refer to page...
ipv6 nd dad attempts ipv6 nd dad attempts This command configures the number of duplicate address detection (DAD) attempts made on the interface when configuring IPv6 unicast addresses. Syntax ipv6 nd dad attempts number no ipv6 nd dad attempts Parameters number Specifies the number of consecutive Neighbor Solicitation message transmitted on the interface, when Duplicate Address Detection (DAD) is performed on a unicast IPv6 address assigned to the interface. The value can range from 0 to 600.
ipv6 nd reachable-time Parameters msec Sets the interval in milliseconds between retransmissions of Neighbor Solicitation messages on the interface. The value can range from 1000 (one second) to 3,600,000 (one hour) milliseconds. 0 An advertised value of 0 means the interval is unspecified. Defaults By default, a value of 0 is advertised in RA messages.
ipv6 nd other-config-flag IPv6 operation, however, because shorter times consume more IPv6 network bandwidth and processing resources. This value is also included in all Router Advertisements messages sent out on the interface. By default, a value of 0, indicating that the configured time is unspecified by this router, is sent out in RA messages. Use the no form of this command to reset this value to the default. The show ipv6 interface command displays the current reachable time setting.
ipv6 nd ra-interval ipv6 nd ra-interval This command sets the transmission interval between router advertisements. Syntax ipv6 nd ra-interval sec no ipv6 nd ra-interval Parameters sec Specifies the value in seconds of the router advertisement transmission interval. The value can range from 4 to 1800 seconds. Defaults 600 seconds. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage The no form of this command resets the interval value to the default of 600 seconds.
ipv6 nd suppress-ra Usage The no form of this command resets the lifetime value to the default of 1800 seconds. Example This example sets the router advertisement lifetime value to 3600 seconds. C3(su)->router(Config-if(Vlan 1))# ipv6 nd ra-lifetime 3600 ipv6 nd suppress-ra This command suppresses router advertisement transmission on this interface. Syntax ipv6 nd suppress-ra no ipv6 nd suppress-ra Parameters None. Defaults Suppression disabled.
ipv6 nd prefix Parameters ipv6‐prefix/prefix‐length The IPv6 network prefix and the prefix length being configured. The prefix must be in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. The prefix length is a decimal number indicating the number of high‐ order contiguous bits of the address that comprise the network portion of the address.
ipv6 nd prefix Example This example configures a prefix that can be used for both on‐link determination and autoconfiguration, using the default values for valid lifetime and preferred lifetime.
Query Commands Query Commands For information about... Refer to page... show ipv6 22-22 show ipv6 interface 22-22 show ipv6 neighbors 22-24 show ipv6 route 22-25 show ipv6 route preferences 22-27 show ipv6 route summary 22-28 show ipv6 traffic 22-29 clear ipv6 statistics 22-34 show ipv6 This command displays the status of IPv6 forwarding mode and unicast routing mode. Syntax show ipv6 Parameters None. Defaults None.
show ipv6 interface Parameters vlan vlan‐id (Optional) Display information only about the specified interface. tunnel tunnel‐id loopback loop‐id Defaults If no interface is specified, information about all IPv6 interfaces is displayed. Mode Router privileged execution: C3(su)‐>router# Router global configuration: C3(su)‐>router(Config)# Usage Use this command to display the usability status of IPv6 interfaces.
show ipv6 neighbors Source Address for IPv6 Tunnel Destination Address for IPv6 Tunnel Routing Mode Interface Maximum Transmit Unit Router Duplicate Address Detection Transmits Router Advertisement NS Interval Router Lifetime Interval Router Advertisement Reachable Time Router Advertisement Interval Router Advertisement Managed Config Flag Router Advertisement Other Config Flag Router Advertisement Suppress Flag 192.168.1.2 192.168.8.
show ipv6 route Vlan 6 FE80::2D0:B7FF:FE2C:76B4 Vlan 6 00:d0:b7:2c:76:b4 False Delay 1903 Table 22‐1 provides an explanation of the command output. Table 22-1 show ipv6 neighbor Output Details Output Field What It Displays... IPv6 Address The IPv6 address of the neighbor on the interface. Interface The interface on which this neighbor was discovered. MAC Address The link layer address of the neighbor. isRtr Whether the neighbor is a router.
show ipv6 route Defaults If no parameters are entered, information about all active IPv6 routes is displayed. Mode Router privileged execution: C3(su)‐>router# Router user execution: C3(su)‐>router> Usage Use this command to display IPv6 routing table information for active routes. Example This example displays all active IPv6 routes.
show ipv6 route preferences show ipv6 route preferences This command shows the preference value associated with the type of route. Syntax show ipv6 route preference Parameters None. Defaults None. Mode Router privileged execution: C3(su)‐>router# Router user execution: C3(su)‐>router> Usage Lower numbers have a greater preference. A route with a preference of 255 cannot be used to forward traffic. The default preference value for static routes can be set with the ipv6 route distance command.
show ipv6 route summary Table 22-3 show ipv6 route preferences Output Details Output Field What It Displays... OSPF Est T2 Preference of OSPF Type-2 external routes. OSPF NSSA T1 Preference of OSPF NSSA Type 1 routes. OSPF NSS! T2 Preference of OSPF NSSA Type 2 routes. show ipv6 route summary This command displays the summary of the routing table. Syntax show ipv6 route summary [all] Parameters all (Optional) Display the count summary for all routes, including best and non‐best routes.
show ipv6 traffic Table 22-4 show ipv6 summary Output Details Output Field What It Displays... Connected Routes Total number of connected routes in the routing table. Static Routes Total number of static routes in the routing table. OSPF Routes Total number of routes installed by OSPFv3 protocol. Number of Prefixes Summarizes the number of routes with prefixes of different lengths Total Routes Total number of routes in the routing table.
show ipv6 traffic Received Datagrams Reassembly Required.................... Datagrams Successfully Reassembled........................ Datagrams Failed To Reassemble............................ Datagrams Forwarded....................................... Datagrams Locally Transmitted............................. Datagrams Transmit Failed................................. Datagrams Successfully Fragmented......................... Datagrams Failed To Fragment.............................. Fragments Created....
show ipv6 traffic Table 22-5 show ipv6 traffic Output Details (Continued) Output Field What It Displays... Received Datagrams Discarded Due To Header Errors Number of input datagrams discarded due to errors in their IPv6 headers, including version number mismatch, other format errors, hop count exceeded, errors discovered in processing their IPv6 options, etc.
show ipv6 traffic Table 22-5 22-32 show ipv6 traffic Output Details (Continued) Output Field What It Displays... Datagrams Locally Transmitted Total number of IPv6 datagrams which local IPv6 user protocols (including ICMP) supplied to IPv6 in requests for transmission. Note that this counter does not include any datagrams counted in ipv6IfStatsOutForwDatagrams.
show ipv6 traffic Table 22-5 show ipv6 traffic Output Details (Continued) Output Field What It Displays... ICMPv6 Neighbor Solicit Messages Received Number of ICMP Neighbor Solicit messages received by the interface. ICMPv6 Neighbor Advertisement Messages Received Number of ICMP Neighbor Advertisement messages received by the interface. ICMPv6 Redirect Messages Received Number of Redirect messages received by the interface.
clear ipv6 statistics Table 22-5 show ipv6 traffic Output Details (Continued) Output Field What It Displays... ICMPv6 Group Membership Query Messages Transmitted Number of ICMPv6 Group Membership Query messages sent. ICMPv6 Group Membership Response Messages Transmitted Number of ICMPv6 group Membership Response messages sent. ICMPv6 Group Membership Reduction Messages Transmitted Number of ICMPv6 Group Membership Reduction messages sent.
23 IPv6 Proxy Routing This chapter describes the commands used to enable IPv6 proxy routing and the suggested procedure to configure a mixed C2 and C3 stack to use IPv6 proxy routing. For information about... Refer to page... Overview 23-1 Preparing a Mixed Stack for IPv6 Proxy Routing 23-2 Commands 23-3 Overview IPv6 proxy routing allows a mixed C2/C3 stack to support some IPv6 routing functionality.
Preparing a Mixed Stack for IPv6 Proxy Routing Limitations • Proxy routing will use up to two masks in the fast forwarding processor associated with each port involved in routing of IPv6 packets. This will require restrictions on the use of policy when proxy routing is enabled. • All IPv6 packets ingressing or egressing a C2 port must be sent over the stack to the C3 stack master.
Commands Commands For information about... Refer to page... ipv6 proxy-routing 23-3 show ipv6 proxy-routing 23-3 ipv6 proxy-routing Use this command to enable or disable IPv6 proxy routing on a mixed C2/C3 stack. Syntax ipv6 proxy-routing no ipv6 proxy-routing Parameters None. Defaults IPv6 proxy routing is disabled by default. Mode Router global configuration: C2(su)‐>router(Config)# Usage IPv6 proxy routing is disabled by default.
show ipv6 proxy-routing Defaults None. Mode Any routing mode. Example This example shows the output of this command when IPv6 proxy routing is disabled. c2(su)->router(Config)#show ipv6 proxy-routing IPv6 Proxy Routing Mode...................................
24 DHCPv6 Configuration * IPv6 Routing License Required * IPv6 routing must be enabled with a license key in order to use this feature. If you have purchased an IPv6 routing license key, and have enabled routing on the device, you must activate your license as described in the chapter entitled “Activating Licensed Features” in order to enable the DHCPv6 configuration command set. If you wish to purchase an IPv6 routing license, contact Enterasys Networks Sales.
Global Configuration Commands RFC 3315 also describes DHCPv6 Relay Agent interactions, which are very much like DHCPv4 Relay Agent. RFC 3046 describes the DHCPv6 Relay Agent Information Option, which employs very similar capabilities as those described by DHCPv4 Relay Agent Option in RFC 2132. With the larger address space inherent to IPv6, addresses within a network can be allocated more effectively in a hierarchical fashion.
ipv6 dhcp relay-agent-info-opt Parameters None. Defaults By default, DHCPv6 is disabled. Mode Router global configuration: C3(su)‐>router(Config)# Usage Use this command to enable DHCPv6 on the router. Use the no form of this command to disable DHCPv6 after it has been enabled. Example This example enables DHCPv6. C3(su)->router(Config)# ipv6 dhcp enable ipv6 dhcp relay-agent-info-opt This command configures a number to represent the DHCPv6 Relay Agent Information Option.
ipv6 dhcp relay-agent-info-remote-id-subopt ipv6 dhcp relay-agent-info-remote-id-subopt This command configures a number to represent the DHCPv6 Relay Agent Remote‐ID sub‐option. Syntax ipv6 dhcp relay-agent-info-remote-id-subopt option Parameters option The value of option may range from 1 to 65535. The default value is 1. Defaults The default value of the DHCPv6 Relay Agent Remote‐ID sub‐option is 1.
ipv6 dhcp pool Usage DHCPv6 pools are used to specify information for the DHCPv6 server to distribute to DHCPv6 clients. These pools are shared between multiple interfaces over which DHCPv6 server capabilities are configured. After executing this command and entering pool configuration mode, you can return to global configuration mode by executing the exit command. Pool configuration commands are described in the section “Address Pool Configuration Commands” on page 24‐6.
Address Pool Configuration Commands Address Pool Configuration Commands Purpose These DHCP pool configuration mode commands are used to configure address pool parameters. This information is provided to DHCP clients by the DHCP server. Commands For information about... Refer to page... domain-name 24-6 dns-server 24-7 prefix-delegation 24-7 exit 24-8 domain-name This command sets the DNS domain name which is provided to DHCPv6 clients by the DHCPv6 server.
dns-server dns-server This command sets the IPv6 DNS server address which is provided to DHCPv6 clients by the DHCPv6 server. Syntax dns-server server-address no dns-server server-address Parameters server‐address The IPv6 address of the DNS server. This parameter must be in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. Defaults None.
exit Parameters prefix/prefix‐length This prefix must be in the form documented in RFC 4291, with the address specified in hexadecimal using 16‐bit values between colons. The value of prefix‐length is a decimal number indicating the number of high‐order contiguous bits of the address that comprise the prefix. DUID The DHCP Unique Identifier (DUID) of the prefix delegation client, as described in RFC 3315.
exit Defaults None. Mode Router DHCPv6 pool configuration mode: C3(su)‐>router(Config‐dhcp6s‐pool)# Example This example illustrates how to exit DHCPv6 pool configuration mode.
Interface Configuration Commands Interface Configuration Commands Purpose These commands are used to configure an interface as either a DHCPv6 server or a DHCPv6 relay agent. Commands For information about... Refer to page... ipv6 dhcp server 24-10 ipv6 dhcp relay 24-11 ipv6 dhcp server This command configures DHCPv6 server functionality on an interface.
ipv6 dhcp relay Example This example configures routing interface VLAN 7 to be a DHCPv6 server, using the address pool named PoolA. C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 dhcp server PoolA ipv6 dhcp relay This command configures an interface for DHCPv6 relay agent functionality.
ipv6 dhcp relay Examples This example configures interface VLAN 8 as a DHCPv6 relay agent that relays DHCPv6 messages to the DHCPv6 server at the global address 2001:0db8:1234:5555::122:10.
DHCPv6 Show Commands DHCPv6 Show Commands Purpose These commands are used to display DHCPv6 configuration information and statistics, to clear statistics globally or for a specific interface, and to display address pool and binding information. Commands For information about... Refer to page...
show ipv6 dhcp interface show ipv6 dhcp interface This command displays DHCPv6 configuration information or DHCPv6 statistics for the specified routing interface. Syntax show ipv6 dhcp vlan vlan-id [statistics] Parameters vlan vlan‐id Specifies the ID of the routing interface for which to display DHCPv6 information. statistics (Optional) Specifies that DHCPv6 statistics for the specified interface should be displayed.
show ipv6 dhcp interface Table 24-1 Output of show ipv6 dhcp interface Command Output... What it displays... IPv6 Interface Shows the interface name. Mode Shows whether the interface is an IPv6 DHCP relay agent or server. Pool Name Displays when interface is a server. Shows the pool name specifying information for DHCPv6 server distribution to DHCPv6 clients. Server Preference Displays when interface is a server. Shows the preference of the server.
show ipv6 dhcp statistics show ipv6 dhcp statistics This command displays IPv6 DHCP statistics for all interfaces. Syntax show ipv6 dhcp statistics Parameters None. Defaults None. Mode Router privileged execution: C3(su)‐>router# Example This example displays the output of this command.
clear ipv6 dhcp statistics Table 24-2 Output of show ipv6 dhcp statistics Command (Continued) Output... What it displays... DHCPv6 Decline Packets Received Number of decline received statistics. DHCPv6 Inform Packets Received Number of inform received statistics. DHCPv6 Relay-forward Packets Received Number of relay forward received statistics. DHCPv6 Relay-reply Packets Received Number of relay-reply received statistics.
show ipv6 dhcp pool show ipv6 dhcp pool This command displays information about a specific configured pool. Syntax show ipv6 dhcp pool pool-name Parameters pool‐name The name of the configured address pool for which to display information. Defaults None. Mode Router privileged execution: C3(su)‐>router# Usage The information displayed by this command differs, depending on the configuration parameters of the pool.
show ipv6 dhcp binding Parameters ipv6‐addr (Optional) Specifies the IPv6 address of the DHCP prefix delegation client for which to display binding information. Defaults If no IPv6 address is specified, all bindings are displayed. Mode Router privileged execution: C3(su)‐>router# Example This example displays all bindings for the client with the IPv6 address FE80::111:FCF1:DEA5:10.
show ipv6 dhcp binding 24-20 DHCPv6 Configuration
25 OSPFv3 Configuration * IPv6 Routing License Required * IPv6 routing must be enabled with a license key in order to use this feature. If you have purchased an IPv6 routing license key, and have enabled routing on the device, you must activate your license as described in the chapter entitled “Activating Licensed Features” in order to enable the OSPFv3 protocol configuration command set. If you wish to purchase an IPv6 routing license, contact Enterasys Networks Sales.
Overview semantics. LSA scope is generalized to link, area, and AS scope. OSPFv3 specifies the processing of unsupported LSAs. Unsupported LSAs are maintained in the database and flooded according to scope. In OSPFv3, routers with 100 or more interfaces generate more than one router LSA. A new link LSA has been created. Addresses in LSAs are specified as [prefix, prefix length]. Area ID and Router ID remain 32 bit identifiers.
Global OSPFv3 Configuration Commands Global OSPFv3 Configuration Commands Purpose These commands are used to configure a router ID for the OSPFv3 router, to enter router OSPFv3 configuration mode, and to configure global OSPFv3 parameters. Command For information about... Refer to page...
ipv6 router ospf ipv6 router ospf This command enters Router OSPFv3 configuration mode. Syntax ipv6 router ospf Parameters None. Defaults None. Mode Router global configuration: C3(su)‐>router(Config)# Usage Use this command to enter OSPFv3 configuration mode so you can configure global OSPFv3 parameters. Example This example illustrates entering router OSPFv3 configuration mode.
default-metric Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Use this command to generate a default external route into an OSPFv3 routing domain. Use the no form of this command to stop the generation of a default external route. Example This example specifies a metric of 100 for the default route redistributed into the OSPFv3 routing domain, and an external metric type of 1.
exit-overflow-interval Parameters intra Specifies the preference for intra‐area routes (all routes within an area) inter Specifies the preference for inter‐area routes (all routes between areas) type1 Specifies the preference for Type 1 external routes (routes learned by redistribution from other routing domains) type2 Specifies the preference for Type 2external routes (routes learned by redistribution from other routing domains) preference The preference range is from 1 to 255.
external-lsdb-limit Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage The exit overflow interval is the number of seconds after entering Overflow state that a router will wait before attempting to leave the Overflow State. This allows the router to again originate non‐default AS‐external‐LSAs. When set to 0, the router will not leave Overflow State until restarted. The no form of this command resets the interval to the default of 0.
maximum-paths maximum-paths This command sets the number of paths that OSPFv3 can report for a given destination. Syntax maximum-paths maxpaths no maximum-paths Parameters maxpaths Specifies the value for maxpaths, which can range from 1 to 4. Defaults The default value is 4. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Use the no form of this command to reset the maximum number of paths to the default value of 4.
redistribute Metric = unspecified Metric type = Type 2 Tag = 0 Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage The no form of this command configures the OSPFv3 protocol to prohibit redistribution of routes from the specified source protocol/routers.
Area Configuration Commands Area Configuration Commands Purpose These commands are used to configure area parameters. Commands For information about... Refer to page...
area nssa Mode Router OSPFv3 configuration: C3(su)->router(Config-router)# Usage Use this command to set the cost value for the default route that is sent into a stub area or NSSA by an Area Border Router (ABR). The no form of this command removes the cost value from the summary route that is sent into the stub area. Example This example sets the default route cost to 50 for area 20.
area nssa default-info-originate area nssa default-info-originate This command configures the metric value and type for the default route advertised into the NSSA. Syntax area areaid nssa default-info-originate [metric] [comparable | non-comparable] no area areaid nssa default-info-originate Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. metric (Optional) Specifies the metric of the default route, in the range of 1 to 16777214.
area nssa no-summary Defaults None. Mode Router OSPFv3 configuration: C3(su)->router(Config-router)# Usage Use this command to prevent redistribution of learned external routes to the NSSA by this area border router (ABR). Use the no form of this command to enable redistribution of learned external routes to the NSSA. Example This example configures the router to not redistribute learned external routes into NSSA 20.
area nssa translator role area nssa translator role This command configures the translator role of the router. Syntax area areaid nssa translator-role {always | candidate} no area areaid nssa translator-role Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. always Specifies that the router will always assume the role of the translator the instant is becomes a border router.
area range Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. interval Specifies the stability interval in seconds. The value of interval can range from 0 to 3600 seconds. Defaults The default interval is 40 seconds.
area stub Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Address ranges control the advertisement of routes across area boundaries. Routing information is summarized, or aggregated, at area boundaries. External to the area, at most a single route is advertised (via an inter‐area‐prefix‐LSA) for each address range. A route is advertised if and only if the address range’s status is set to advertise. The default condition is to advertise.
area stub no-summary Example This example creates a stub area with the ID of 30. C3(su)->router(Config-router)# area 30 stub area stub no-summary This command disables the import of summary LSAs into the specified stub area. Syntax area areaid stub no-summary no area areaid stub no-summary Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. Defaults None.
area virtual-link dead-interval Defaults None. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage The virtual link neighbor is identified by its router ID. Use the no form of this command to delete the configured OSPFv3 virtual interface identified by area and neighbor. Example This example creates a virtual interface for area 20 and the neighbor with router ID 2.2.2.2. C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.
area virtual-link hello-interval area virtual-link hello-interval This command configures the hello interval for the specified OSPFv3 virtual interface. Syntax area areaid virtual-link neighborid hello-interval seconds no area areaid virtual-link neighborid hello-interval Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. neighborid Specifies the virtual link neighbor by means of its router ID. The router ID must be entered in 32‐bit dotted‐quad notation.
area virtual-link transmit-delay Defaults The default retransmit interval is 5 seconds. Mode Router OSPFv3 configuration: C3(su)‐>router(Config‐router)# Usage Use the no form of this command to return a configured value to the default value of 5 seconds. Example This example sets the retransmit interval to 10 seconds for the specified OSPFv3 virtual interface. C3(su)->router(Config-router)# area 20 virtual-link 2.2.2.
Interface Configuration Commands Interface Configuration Commands Purpose These commands can be used to configure OSPF v3 routing interface parameters. Commands For information about... Refer to page...
ipv6 ospf areaid Example This example enters router interface configuration mode for VLAN 7 and then enables OSPFv3 on the interface. C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 ospf enable ipv6 ospf areaid This command sets the OSPFv3 area to which the router interface belongs. Syntax ipv6 ospf areaid areaid no ipv6 ospf areaid areaid Parameters areaid Specifies the area ID in either 32‐bit dotted‐quad format or as a decimal number between 0 and 4294967295.
ipv6 ospf dead-interval Parameters cost Specifies the cost of sending a packet on this interface. The value can range from 1 to 65535. Defaults The default cost is 10. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage Use this command to explicitly specify the cost of sending a packet on the interface being configured for OSPFv3. Use the no form of this command to return the cost to the default value of 10.
ipv6 ospf hello-interval Example This example sets the dead interval for router interface VLAN 7 to 60 seconds. C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 ospf dead-interval 60 ipv6 ospf hello-interval This command sets the OSPFv3 hello interval for the router interface. Syntax ipv6 ospf hello-interval seconds no ipv6 ospf hello-interval seconds Parameters seconds Specifies the OSPFv3 hello interval in seconds. The value can range from 1 to 65535 seconds.
ipv6 ospf network Defaults By default, MTU mismatch detection is enabled. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage OSPF Database Description packets specify the size of the largest IP packet that can be sent without fragmentation on the interface. When a router receives a Database Description packet, it examines the MTU advertised by the neighbor.
ipv6 ospf priority Use the no form of this command to set the network type to the default. Example This example sets the network type to point‐to‐point for router interface VLAN 7. C3(su)->router(Config)# interface vlan 7 C3(su)->router(Config-if(Vlan 7))# ipv6 ospf network point-to-point ipv6 ospf priority This command sets the OSPFv3 priority for the router interface. Router priority helps determine the designated router for an OSPFv3 link.
ipv6 ospf transmit-delay Parameters seconds Specifies the retransmit interval value, which can range from 0 to 3600 seconds. Defaults Default value is 4 seconds. Mode Router interface configuration: C3(su)‐>router(Config‐if(Vlan 1))# Usage The retransmit interval is the number of seconds between link‐state advertisement retransmissions for adjacencies belonging to this router interface. This value is also used when retransmitting database description and link‐state request packets.
ipv6 ospf transmit-delay Example This example sets the transmit delay value to 4 seconds for router interface VLAN 7.
OSPFv3 Show Commands OSPFv3 Show Commands Purpose These commands are used to display OSPFv3 information and statistics. Commands For information about... Refer to page...
show ipv6 ospf ABR Status Exit Overflow Interval External LSA Count External LSA Checksum New LSAs Originated LSAs Received External LSDB Limit Default Metric Maximum Paths Default Route Advertise Always Metric Metric Type Enable 0 0 0 89 177 No Limit Not Configured 4 Disabled FALSE External Type 2 Table 25‐1 provides an explanation of the command output. Note: Some of the information in Table 25-1 displays only if you enable OSPFv3 and configure certain features.
show ipv6 ospf area Table 25-1 show ipv6 ospf Output Details Output Field What It Displays... Always Whether default routes are always advertised. Metric The metric for the advertised default routes. If the metric is not configured, this field is blank. Metric Type Whether the routes are External Type 1 or External Type 2. show ipv6 ospf area This command displays information about the specified OSPFv3 area.
show ipv6 ospf abr Table 25-2 show ipv6 ospf area Output Details (Continued) Output Field What It Displays... Area LSA Checksum Number representing the Area LSA Checksum for the specified Area ID excluding the external (LS type 5) link-state advertisements. Stub Mode Whether the specified area is a stub area or not. The possible values are enabled and disabled. This is a configured value. Import Summary LSAs Whether to import summary LSAs (enabled or disabled).
show ipv6 ospf asbr Table 25-3 show ipv6 ospf abr Output Details (Continued) Output Field What It Displays... Next Hop Intf Address of the next hop toward the destination. Next Hop Intf The outgoing router interface to use when forwarding traffic to the next hop. show ipv6 ospf asbr This command displays OSPFv3 routes to reach AS border routers. Syntax show ipv6 ospf asbr Parameters None. Defaults None.
show ipv6 ospf database show ipv6 ospf database This command displays information about the link state database when OSPFv3 is enabled. Syntax show ipv6 ospf [areaid] database [{external | inter-area {prefix | router} | link | network | nssa-external | prefix | router | unknown {area | as | link}}] [lsid] [{adv-router [rtrid] | self-originate | database-summary}] Parameters areaid (Optional) Display database information about a specific area.
show ipv6 ospf database Adv Router Link Id Age Sequence Csum Options Rtr Opt --------------- --------------- ----- -------- ---- ------- ------2.2.2.2 1 153 80000026 A8F2 Intra Prefix States (Area 0.0.0.10) Adv Router Link Id Age Sequence Csum Options Rtr Opt --------------- --------------- ----- -------- ---- ------- ------2.2.2.2 0 506 80000027 DD00 AS External States Adv Router Link Id Age Sequence Csum Options Rtr Opt --------------- --------------- ----- -------- ---- ------- ------2.2.2.
show ipv6 ospf database Metric Type: 2 Metric:20 IPv6 Prefix: 2301::/64 (None) Table 25‐5 provides an explanation of the command output. Table 25-5 show ipv6 ospf database Output Details Output Field What It Displays... Link Id Number that uniquely identifies an LSA that a router originates from all other self originated LSAs of the same LS type. Advertising Router The Advertising Router. Is a 32 bit dotted decimal number representing the LSDB interface.
show ipv6 ospf database Intra-area Prefix Link Unknown Area Unknown AS Unknown AS Unknown Self Originated Type-7 Subtotal 2 0 0 0 0 0 8 Area 0.0.0.
show ipv6 ospf interface Table 25-6 show ipv6 ospf database database-summary Output Details (Continued) Output Field What It Displays... Link Unknown Total number of link-source unknown LSAs in the OSPFv3 link state database. Area Unknown Total number of area unknown LSAs in the OSPFv3 link state database. AS Unknown Total number of as unknown LSAs in the OSPFv3 link state database.
show ipv6 ospf interface Authentication Type Metric Cost OSPF Mtu-ignore OSPF Interface Type State Designated Router Backup Designated Router Number of Link Events None 10 (computed) Disable broadcast designated-router 2.2.2.2 0.0.0.0 2 This example displays information about tunnel interface 0. Table 25‐7 on page 25‐39 explains the content of the output fields. C3(su)->router#show ipv6 ospf interface tunnel 0 IPv6 Address FE80::5000:2 ifIndex 456 OSPF Admin Mode Enable OSPF Area ID 0.0.0.
show ipv6 ospf interface stats Table 25-7 show ipv6 ospf interface Command Output Details (Continued) Output Field What It Displays... Metric Cost The priority of the path. Low costs have a higher priority than high costs. OSPF MTU-ignore Whether to ignore MTU mismatches in database descriptor packets sent from neighboring routers. The following information only displays if OSPF is initialized on the interface: OSPF Interface Type Broadcast LANs, such as Ethernet and IEEE 802.
show ipv6 ospf interface stats Received Packets Discards Bad Version Virtual Link Not Found Area Mismatch Invalid Destination Address No Neighbor at Source Address Invalid OSPF Packet Type Packet Type -------------------Hello Database Description LS Request LS Update LS Acknowledgement 0 0 0 0 0 0 0 0 Sent ---------1053 0 0 0 0 Received ---------0 0 0 0 0 Table 25‐8 provides an explanation of the command output. Table 25-8 show ipv6 ospf interface stats Output Details Output Field What It Displays..
show ipv6 ospf neighbor Table 25-8 show ipv6 ospf interface stats Output Details Output Field What It Displays... Invalid OSPF Packet Type Number of packets received with invalid packet type. Packet Type / Sent / Received Columns listing packet types and number of packets sent and received per type. show ipv6 ospf neighbor This command displays information about OSPFv3 neighbors.
show ipv6 ospf neighbor Table 25-9 show ipv6 ospf neighbor Output Details Output Field What It Displays... Router ID The 4-digit dotted-decimal number of the neighbor router. Priority OSPFv3 priority for the specified interface. The priority of an interface is a priority integer from 0 to 255. A value of '0' indicates that the router is not eligible to become the designated router on this network. Intf ID Interface ID of the neighbor. Interface Interface of the local router.
show ipv6 ospf range Table 25-10 show ipv6 ospf neighbor routerid Output Details Output Field What It Displays... Interface Interface of the local router. Area ID OSPFv3 area ID associated with the interface. Options An integer value that indicates the optional OSPFv3 capabilities supported by the neighbor. These are listed in its Hello packets.
show ipv6 ospf stub table Table 25-11 show ipv6 ospf range Output Details Output Field What It Displays... Area ID The area ID of the requested OSPFv3 area. IPv6 Prefix/Prefix Length An IPv6 prefix and length which represents a configured area range. Lsdb Type The type of link advertisement associated with this area range. Advertisement The status of the advertisement: enabled or disabled.
show ipv6 ospf virtual-link show ipv6 ospf virtual-link This command displays the OSPFv3 virtual interface information for a specific area and neighbor. Syntax show ipv6 ospf virtual-link areaid neighborid Parameters areaid Specifies the area ID in IP address format (dotted‐quad) or as a decimal value. neighborid Specifies the neighbor by its router ID, specified in 32‐bit dotted quad format. Defaults None.
show ipv6 ospf virtual-link Table 25-13 show ipv6 ospf virtual-link Output Details (Continued) Output Field What It Displays... Metric The metric of this virtual link. Neighbor State The state of the neighbor. States are: down, loopback, waiting, point-to-point, designated router, and backup designated router.
show ipv6 ospf virtual-link 25-48 OSPFv3 Configuration
26 Authentication and Authorization Configuration This chapter describes the following authentication and authorization commands and how to use them. For information about using the TACACS+ authentication method for management, see Chapter 27, TACACS+ Configuration. For information about... Refer to page... Overview of Authentication and Authorization Methods 26-1 Setting the Authentication Login Method 26-4 Configuring RADIUS 26-6 Configuring 802.
Overview of Authentication and Authorization Methods TACACS+ application. When RADIUS or TACACS+ is enabled, this essentially overrides login user accounts. When HACA is active per a valid RADIUS or TACACS+ configuration, the user names and passwords used to access the switch via Telnet, SSH, WebView, and COM ports will be validated against the configured RADIUS server. Only in the case of a RADIUS timeout will those credentials be compared against credentials locally configured on the switch.
Overview of Authentication and Authorization Methods both tunnel and policy, also known as hybrid authentication mode. Refer to “Configuring Policy Maptable Response” on page 26‐52. • MAC Locking – locks a port to one or more MAC addresses, preventing the use of unauthorized devices and MAC spoofing on the port For details, refer to “Configuring MAC Locking” on page 26‐57.
Setting the Authentication Login Method The undecorated format is simply a string that specifies a policy profile name. The undecorated format cannot be used for management access authentication. Decorated Filter‐IDs are processed first by the switch. If no decorated Filter‐IDs are found, then undecorated Filter‐IDs are processed. If multiple Filter‐IDs are found that contain conflicting values, a Syslog message is generated.
clear authentication login Syntax set authentication login {any | local | radius | tacacs} Parameters any Specifies that the authentication protocol will be selected using the following precedence order: • TACACS+ • RADIUS • Local local Specifies that the local network password settings will be used for authentication login. radius Specifies that RADIUS will be used for authentication login. tacacs Specifies that TACACS+ will be used for authentication login. Defaults None.
Configuring RADIUS Configuring RADIUS Purpose To perform the following: • Review the RADIUS client/server configuration on the switch. • Enable or disable the RADIUS client. • Set local and remote login options. • Set primary and secondary server parameters, including IP address, timeout period, authentication realm, and number of user login attempts allowed. • Reset RADIUS server settings to default values. • Configure a RADIUS accounting server.
set radius server (Optional) Displays RADIUS server configuration information. index | all For use with the server parameter to show server configuration for all servers or a specific RADIUS server as defined by an index. Defaults If no parameters are specified, all RADIUS configuration information will be displayed. Mode Switch command, read‐only.
set radius Parameters enable | disable Enables or disables the RADIUS client. retries number‐of‐ retries Specifies the number of retry attempts before the RADIUS server times out. Valid values are from 0 to 10. Default is 3. timeout timeout Specifies the maximum amount of time (in seconds) to establish contact with the RADIUS server before retry attempts begin. Valid values are from 1 to 30. Default is 20 seconds.
clear radius This example shows how to set the RADIUS timeout to 5 seconds: C3(su)->set radius timeout 5 This example shows how to set RADIUS retries to 10: C3(su)->set radius retries 10 This example shows how to force any management‐access to the switch (Telnet, web, SSH) to authenticate through a RADIUS server. The all parameter at the end of the command means that any of the defined RADIUS servers can be used for this Authentication.
show radius accounting show radius accounting Use this command to display the RADIUS accounting configuration. This transmits accounting information between a network access server and a shared accounting server. Syntax show radius accounting [server] | [counter ip-address] | [retries] | [timeout] Parameters server (Optional) Displays one or all RADIUS accounting server configurations. counter ip‐address (Optional) Displays counters for a RADIUS accounting server.
clear radius accounting timeout timeout Sets the maximum amount of time (in seconds) to establish contact with a specified RADIUS accounting server before timing out. Valid timeout values are 1 ‐ 30. server ip_address port server‐secret Specifies the accounting server’s: • IP address • UDP authentication port (0 ‐ 65535) • server‐secret (Read‐Write password to access this accounting server. Device will prompt for this entry upon creating a server instance, as shown in the example below.
show radius interface Defaults None. Example This example shows how to reset the RADIUS accounting timeout to 5 seconds. C3(su)->clear radius accounting timeout show radius interface Use this command to display the interface used for the source IP address of the RADIUS application when generating RADIUS packets. Syntax show radius interface Parameters None. Defaults None. Mode Switch mode, read‐only. Example This example displays the output of this command.
clear radius interface Mode Switch command, read‐write. Usage This command allows you to configure the source IP address used for the source IP address of the RADIUS application when generating RADIUS packets. Any of the management interfaces, including VLAN routing interfaces, can be configured as the source IP address used in packets generated by the RADIUS application. An interface must have an IP address assigned to it before it can be set by this command.
clear radius interface Example This command returns the interface used for the source IP address of the RADIUS application back to the default of the Host interface. C3(rw)->show radius interface vlan 100 192.168.10.
Configuring 802.1X Authentication Configuring 802.1X Authentication Purpose To review and configure 802.1X authentication for one or more ports using EAPOL (Extensible Authentication Protocol). 802.1X controls network access by enforcing user authorization on selected ports, which results in allowing or denying network access according to RADIUS server configuration.
show dot1x If port‐string is not specified, information for all ports will be displayed. Mode Switch command, read‐only. Examples This example shows how to display 802.1X status: C3(su)->show dot1x DOT1X is disabled. This example shows how to display authentication diagnostics information for ge.1.1: C3(su)->show dot1x auth-diag ge.1.
show dot1x auth-config show dot1x auth-config Use this command to display 802.1X authentication configuration settings for one or more ports. Syntax show dot1x auth-config [authcontrolled-portcontrol] [maxreq] [quietperiod] [reauthenabled] [reauthperiod] [servertimeout] [supptimeout] [txperiod] [port-string] Parameters authcontrolled‐ portcontrol (Optional) Displays the current value of the controlled Port control parameter for the port.
set dot1x Port : 1 Auth-Config PAE state: Backend auth state: Admin controlled directions: Oper controlled directions: Auth controlled port status: Auth controlled port control: Quiet period: Transmission period: Supplicant timeout: Server timeout: Maximum requests: Reauthentication period: Reauthentication control: Initialize Initialize Both Both Authorized Auto 60 30 30 30 2 3600 Disabled set dot1x Use this command to enable or disable 802.
set dot1x auth-config set dot1x auth-config Use this command to configure 802.1X authentication. Syntax set dot1x auth-config {[authcontrolled-portcontrol {auto | forced-auth | forced-unauth}] [maxreq value] [quietperiod value] [reauthenabled {false | true}] [reauthperiod value] [servertimeout timeout] [supptimeout timeout] [txperiod value]} [port-string] Parameters authcontrolled‐ portcontrol auto | forced‐auth | forced‐unauth Specifies the 802.1X port control mode.
clear dot1x auth-config Examples This example shows how to enable reauthentication control on ports ge.1.1‐3: C3(su)->set dot1x auth-config reauthenabled true ge.1.1-3 This example shows how to set the 802.1X quiet period to 120 seconds on ports ge.1.1‐3: C3(su)->set dot1x auth-config quietperiod 120 ge.1.1-3 clear dot1x auth-config Use this command to reset 802.1X authentication parameters to default values on one or more ports.
show eapol This example shows how to reset the 802.1X quiet period to 60 seconds on ports ge.1.1‐3: C3(su)->clear dot1x auth-config quietperiod ge.1.1-3 show eapol Use this command to display EAPOL status or settings for one or more ports. Syntax show eapol [port-string] Parameters port‐string (Optional) Displays EAPOL status for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1.
show eapol Table 26-2 show eapol Output Details Output Field What It Displays... Port Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 7-1. Authentication State Current EAPOL authentication state for each port.
set eapol set eapol Use this command to enable or disable EAPOL port‐based user authentication with the RADIUS server and to set the authentication mode for one or more ports. Syntax set eapol [enable | disable] [auth-mode {auto | forced-auth | forced-unauth} port-string Parameters enable | disable Enables or disables EAPOL. auth‐mode Specifies the authentication mode as: auto | forced‐auth | forced‐unauth • auto ‐ Auto authorization mode.
clear eapol Parameters auth‐mode (Optional) Globally clears the EAPOL authentication mode. port‐string Specifies the port(s) on which to clear EAPOL parameters. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If auth‐mode is not specified, all EAPOL settings will be cleared. If port‐string is not specified, settings will be cleared for all ports. Mode Switch command, read‐write.
Configuring MAC Authentication Configuring MAC Authentication Purpose To review, disable, enable and configure MAC authentication. This authentication method allows the device to authenticate source MAC addresses in an exchange with an authentication server. The authenticator (switch) selects a source MAC seen on a MAC‐authentication enabled port and submits it to a backend client for authentication.
show macauthentication Parameters port‐string (Optional) Displays MAC authentication information for specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, MAC authentication information will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display MAC authentication information for ge.2.1 through 8: C3(su)->show macauthentication ge.2.
show macauthentication session Table 26-3 show macauthentication Output Details (Continued) Output Field What It Displays... Reauth Period Reauthentication period for this port. Default value of 30 can be changed using the set macauthentication reauthperiod command (page 26-33). Auth Allowed Number of concurrent authentications supported on this port. Auth Allocated Maximum number of MAC authentications permitted on this port.
set macauthentication Table 26-4 show macauthentication session Output Details (Continued) Output Field What It Displays... Reauth Period Reauthentication period for this port, set using the set macauthentication reauthperiod command described in “set macauthentication reauthperiod” on page 26-33. Reauthentications Whether or not reauthentication is enabled or disabled on this port.
clear macauthentication password Example This example shows how to set the MAC authentication password to “macauth”: C3(su)->set macauthentication password macauth clear macauthentication password Use this command to clear the MAC authentication password. Syntax clear macauthentication password Parameters None. Defaults None. Mode Switch command, read‐write.
set macauthentication portinitialize Usage Enabling port(s) for MAC authentication requires globally enabling MAC authentication on the switch as described in “set macauthentication” on page 26‐28, and then enabling it on a port‐by‐ port basis. By default, MAC authentication is globally disabled and disabled on all ports. Example This example shows how to enable MAC authentication on ge.2.1 though 5: C3(su)->set macauthentication port enable ge.2.
clear macauthentication portquietperiod Defaults None. Mode Switch command, read‐write. Example This example sets port 1 to wait 5 seconds after a failed authentication attempt before a new attempt can be made: C3(su)->set macauthentication portquietperiod 5 ge.1.1 clear macauthentication portquietperiod This sets the quiet period back to the default value of 30 seconds.
set macauthentication reauthentication Mode Switch command, read‐write. Defaults None. Example This example shows how to force the MAC authentication session for address 00‐60‐97‐b5‐4c‐07 to re‐initialize: C3(su)->set macauthentication macinitialize 00-60-97-b5-4c-07 set macauthentication reauthentication Use this command to enable or disable reauthentication of all currently authenticated MAC addresses on one or more ports.
set macauthentication macreauthenticate Parameters port‐string Specifies MAC authentication port(s) to be reauthenticated. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to force ge.2.1 though 5 to reauthenticate: C3(su)->set macauthentication portreauthentication ge.2.
clear macauthentication reauthperiod Parameters time Specifies the number of seconds between reauthentication attempts. Valid values are 1 ‐ 4294967295. port‐string Specifies the port(s) on which to set the MAC reauthentication period. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write.
set macauthentication significant-bits set macauthentication significant-bits Use this command to set the number of significant bits of the MAC address to use for authentication. Syntax set macauthentication significant-bits number Parameters number Specifies the number of significant bits to be used for authentication. Defaults None. Mode Switch command, read‐write. Usage This command allows you to specify a mask to apply to MAC addresses when authenticating users through a RADIUS server.
clear macauthentication significant-bits Mode Switch command, read‐write. Example This example resets the MAC authentication significant bits to 48.
Configuring Multiple Authentication Methods Configuring Multiple Authentication Methods About Multiple Authentication Types When enabled, multiple authentication types allows a user to authenticate using more than one method on the same port. In order for multiple authentication to function on the device, each possible method of authentication (MAC authentication, 802.
show multiauth For information about... Refer to page... clear multiauth port 26-42 show multiauth station 26-43 show multiauth session 26-43 show multiauth idle-timeout 26-44 set multiauth idle-timeout 26-45 clear multiauth idle-timeout 26-46 show multiauth session-timeout 26-46 set multiauth session-timeout 26-47 clear multiauth session-timeout 26-48 show multiauth Use this command to display multiple authentication system configuration. Syntax show multiauth Parameters None.
set multiauth mode set multiauth mode Use this command to set the system authentication mode to allow multiple authenticators simultaneously (802.1x, PWA, and MAC Authentication) on a single port, or to strictly adhere to 802.1x authentication. Syntax set multiauth mode {multi | strict} Parameters multi Allows the system to use multiple authenticators simultaneously (802.1x, PWA, and MAC Authentication) on a port. This is the default mode. strict User must authenticate using 802.
set multiauth precedence Example This example shows how to clear the system authentication mode: C3(rw)->clear multiauth mode set multiauth precedence Use this command to set the system’s multiple authentication administrative precedence. Syntax set multiauth precedence {[dot1x] [mac] [pwa]} Parameters dot1x Sets precedence for 802.1X authentication. mac Sets precedence for MAC authentication. pwa Sets precedence for port web authentication Defaults Default precedence order is dot1x, pwa, mac.
show multiauth port Mode Switch command, read‐write. Example This example shows how to clear the multiple authentication precedence: C3(rw)->clear multiauth precedence show multiauth port Use this command to display multiple authentication properties for one or more ports. Syntax show multiauth port [port-string] Parameters port‐string (Optional) Displays multiple authentication information for specific port(s).
clear multiauth port Parameters mode auth‐opt | auth‐reqd | force‐auth | force‐unauth Specifies the port(s)’ multiple authentication mode as: • auth‐opt — Authentication optional (“non‐strict” behavior). If a user does not attempt to authenticate using 802.1x, or if 802.1x authentication fails, the port will allow traffic to be forwarded according to the defined default VLAN. • auth‐reqd — Authentication is required. • force‐auth — Authentication considered.
show multiauth station Mode Switch command, read‐write. Examples This example shows how to clear the port multiple authentication mode on port ge.3.14: C3(rw)->clear multiauth port mode ge.3.14 This example shows how to clear the number of users on port ge.3.14: C3(rw)->clear multiauth port numusers ge.3.14 show multiauth station Use this command to display multiple authentication station (end user) entries.
show multiauth idle-timeout Parameters all (Optional) Displays information about all sessions, including those with terminated status. agent dot1x | mac | pwa (Optional) Displays 802.1X, or MAC, or port web authentication session information. mac address (Optional) Displays multiple authentication session entries for specific MAC address(es). port port‐string (Optional) Displays multiple authentication session entries for the specified port or ports.
set multiauth idle-timeout Example This example shows how to display timeout values for an idle session for all authentication types. C3(su)->show multiauth idle-timeout Authentication type Timeout (sec) ------------------- ------------dot1x 0 pwa 0 mac 0 set multiauth idle-timeout Use this command to set the maximum number of consecutive seconds an authenticated session may be idle before termination of the session.
clear multiauth idle-timeout clear multiauth idle-timeout Use this command to reset the maximum number of consecutive seconds an authenticated session may be idle before termination of the session to its default value of 0. Syntax clear multiauth idle-timeout [dot1x | mac | pwa] Parameters dot1x (Optional) Specifies the IEEE 802.1X port‐based network access control authentication method for which to reset the timeout value to its default.
set multiauth session-timeout Example This example displays the session timeout values for all authentication methods. C3(su)->show multiauth session-timeout Authentication type Timeout (sec) ------------------- ------------dot1x 0 pwa 0 mac 0 set multiauth session-timeout Use this command to set the maximum number of seconds an authenticated session may last before termination of the session.
clear multiauth session-timeout clear multiauth session-timeout Use this command to reset the maximum number of consecutive seconds an authenticated session may last before termination of the session to its default value of 0. Syntax clear multiauth session-timeout [dot1x | mac | pwa] Parameters dot1x (Optional) Specifies the IEEE 802.1X port‐based network access control authentication method for which to reset the timeout value to its default.
Configuring VLAN Authorization (RFC 3580) The second policy role, for the user, can either be statically configured with the default policy role on the port or dynamically assigned through authentication to the network (using a RADIUS Filter‐ID). When the default policy role is assigned on a port, the VLAN set as the portʹs PVID is mapped to the default policy role.
set vlanauthorization set vlanauthorization Enable or disable the use of the RADIUS VLAN tunnel attribute to put a port into a particular VLAN based on the result of authentication. Syntax set vlanauthorization {enable | disable} [port-string] Parameters enable | disable Enables or disables vlan authorization/tunnel attributes. port‐string (Optional) Specifies which ports to enable or disable the use of VLAN tunnel attributes/authorization.
clear vlanauthorization Defaults By default, administrative egress is set to untagged. Mode Switch command, read‐write. Example This example shows how to enable the insertion of the RADIUS assigned VLAN to an 802.1q tag for all outbound frames for ports 10 through 15 on unit/module number 3. C3(rw)->set vlanauthorization egress tagged ge.3.10-15 clear vlanauthorization Use this command to return port(s) to the default configuration of VLAN authorization disabled, egress untagged.
Configuring Policy Maptable Response Parameters port‐string (Optional) Displays VLAN authentication status for the specified ports. If no port string is entered, then the global status of the setting is displayed. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If no port string is entered, the status for all ports will be displayed. Mode Switch command, read‐only.
Configuring Policy Maptable Response When the maptable response is set to policy mode, the system will use the Filter‐ID attributes in the RADIUS reply to apply a policy to the authenticating user and will ignore any tunnel attributes in the RADIUS reply. On this platform, when policy mode is configured, no VLAN‐to‐ policy mapping will occur.
show policy maptable If VLAN authorization is not enabled, the tunnel attributes are ignored. When Policy Maptable Response is “Policy” When the switch is configured to use only Filter‐ID attributes, by setting the set policy maptable command response parameter to policy: • If the Filter‐ID attributes are present, the specified policy profile will be applied to the authenticating user.
set policy maptable Defaults If no VLAN list is specified, all entries in the VLAN‐to‐policy mapping table are displayed. Mode Switch command, read‐only. Usage This command displays both the policy maptable response setting, and the entries in the VLAN‐ to‐policy mapping table for one or multiple VLANs. Refer to “Operational Description” on page 26‐53 for information about how the VLAN‐to‐policy mapping table is used.
clear policy maptable Defaults No mapping table entries are configured. The default policy maptable response setting is policy mode. Mode Switch command, read‐write. Usage This command can be used to create entries in the VLAN‐to‐policy mapping table and also to set the switch’s maptable response. Refer to “Operational Description” on page 26‐53 for more information about the switch’s operations for all maptable response parameters.
Configuring MAC Locking Example This example removes the entry in the mapping table for VLAN 144.
show maclock Commands For information about... Refer to page...
show maclock stations ------ge.1.1 ------- -------- ------enabled disabled enabled ---------- --------------- --------------20 1 00:a0:c9:39:5c:b4 Table 26‐6 provides an explanation of the command output. Table 26-6 show maclock Output Details Output Field What It Displays... Port Number Port designation. For a detailed description of possible port-string values, refer to “Port String Syntax Used in the CLI” on page 7-1. Port Status Whether MAC locking is enabled or disabled on the port.
set maclock enable Example This example shows how to display MAC locking information for the end stations connected to all Gigabit Ethernet ports in unit/module 2: C3(su)->show maclock stations ge.2.* Port Number MAC Address Status ------------ -----------------------------ge.2.1 00:a0:c9:39:5c:b4 active ge.2.7 00:a0:c9:39:1f:11 active State -------------first arrival static Aging ----true false Table 26‐7 provides an explanation of the command output.
set maclock disable MAC locking is disabled by default at device startup. Configuring one or more ports for MAC locking requires globally enabling it on the device and then enabling it on the desired ports. Example This example shows how to enable MAC locking on ge.2.3: C3(su)->set maclock enable ge.2.3 set maclock disable Use this command to disable MAC locking globally or on one or more ports.
clear maclock create Establishes a MAC locking association between the specified MAC address and port. Create automatically enables MAC locking between the specified MAC address and port. enable | disable Enables or disables MAC locking between the specified MAC address and port. Defaults None. Mode Switch command, read‐write.
set maclock static Usage The MAC address that is cleared will no longer be able to communicate on the port unless the first arrival limit has been set to a value greater than 0 and this limit has not yet been met. For example, if user B’s MAC is removed from the static MAC address list and the first arrival limit has been set to 0, then user B will not be able to communicate on the port.
set maclock firstarrival Parameters port‐string Specifies the port on which to reset number of static MAC addresses allowed. For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the number of allowable static MACs on ge.2.3: C3(rw)->clear maclock static ge.2.
clear maclock firstarrival Example This example shows how to restrict MAC locking to 6 MAC addresses on ge.2.3: C3(su)->set maclock firstarrival ge.2.3 6 clear maclock firstarrival Use this command to reset the number of first arrival MAC addresses allowed per port to the default value of 600. Syntax clear maclock firstarrival port-string Parameters port‐string Specifies the port on which to reset the first arrival value.
clear maclock agefirstarrival Mode Switch mode, read‐write. Example This example enables first arrival aging on port ge.1.1. C3(su)-> set maclock agefirstarrival ge.1.1 enable clear maclock agefirstarrival Use this command to reset first arrival aging on one or more ports to its default state of disabled. Syntax clear maclock agefirstarrival port-string Parameters port‐string Specifies the port(s) on which to disable first arrival aging.
set maclock trap Mode Switch command, read‐write. Usage If there are more first arrival MACs than the allowed maximum static MACs, then only the latest first arrival MACs will be moved to static entries. For example, if you set the maximum number of static MACs to 2 with the set maclock static command, and then executed the set maclock move command, even though there were five MACs in the first arrival table, only the two most recent MAC entries would be moved to static entries.
Configuring Port Web Authentication (PWA) Configuring Port Web Authentication (PWA) About PWA PWA provides a way of authenticating users through a Web portal before allowing general access to the network. To log on using PWA, the user makes a request through a web browser for the PWA web page or is automatically redirected to this login page after requesting a URL in a browser. Depending upon the authenticated state of the user, a login page or a logout page will display.
show pwa show pwa Use this command to display port web authentication information for one or more ports. Syntax show pwa [port-string] Parameters port‐string (Optional) Displays PWA information for specific port(s). Defaults If port‐string is not specified, PWA information will be displayed for all ports. Mode Switch command, read‐only. Example This example shows how to display PWA information for ge.2.1: C3(su)->show pwa ge.2.
set pwa Table 26-8 show pwa Output Details (Continued) Output Field What It Displays... PWA Logo Whether the Enterasys logo will be displayed or hidden at user login. Default state of enabled (displayed) can be changed using the set pwa displaylogo command as described in “set pwa displaylogo” on page 26-72. PWA Guest Networking Status Whether PWA guest user status is disabled or enabled with RADIUS or no authentication.
show pwa banner show pwa banner Use this command to display the port web authentication login banner string. Syntax show pwa banner Parameters None. Defaults None. Mode Switch command, read‐only. Example This example shows how to display the PWA login banner: C3(su)->show pwa banner Welcome to Enterasys Networks set pwa banner Use this command to configure a string to be displayed as the PWA login banner. Syntax set pwa banner string Parameters string Specifies the PWA login banner.
clear pwa banner clear pwa banner Use this command to reset the PWA login banner to a blank string. Syntax clear pwa banner Parameters None. Defaults None. Mode Switch command, read‐write. Example This example shows how to reset the PWA login banner to a blank string C3(su)->clear pwa banner set pwa displaylogo Use this command to set the display options for the Enterasys Networks logo.
set pwa ipaddress set pwa ipaddress Use this command to set the PWA IP address. This is the IP address of the end station from which PWA will prevent network access until the user is authenticated. Syntax set pwa ipaddress ip-address Parameters ip‐address Specifies a globally unique IP address. This same value must be configured into every authenticating switch in the domain. Defaults None. Mode Switch command, read‐write. Example This example shows how to set a PWA IP address of 1.2.3.
set pwa guestname set pwa guestname Use this command to set a guest user name for PWA networking. PWA will use this name to grant network access to guests without established login names and passwords. Syntax set pwa guestname name Parameters name Specifies a guest user name. Defaults None. Mode Switch command, read‐write.
set pwa guestpassword set pwa guestpassword Use this command to set the guest user password for PWA networking. Syntax set pwa guestpassword Parameters None. Defaults None. Mode Switch command, read‐write. Usage PWA will use this password and the guest user name to grant network access to guests without established login names and passwords.
set pwa initialize Usage PWA will use a guest password and guest user name to grant network access with default policy privileges to users without established login names and passwords. Example This example shows how to enable PWA guest networking with RADIUS authentication: C3(su)->set pwa guestnetworking authradius set pwa initialize Use this command to initialize a PWA port to its default unauthenticated state.
set pwa maxrequest Defaults If port‐string is not specified, quiet period will be set for all ports. Mode Switch command, read‐write. Example This example shows how to set the PWA quiet period to 30 seconds for ports ge.1.5‐7: C3(su)->set pwa quietperiod 30 ge.1.5-7 set pwa maxrequest Use this command to set the maximum number of log on attempts allowed before transitioning the PWA port to a held state.
show pwa session Parameters enable | disable Enables or disables PWA on specified ports. port‐string (Optional) Sets the control mode on specific port(s). For a detailed description of possible port‐string values, refer to “Port String Syntax Used in the CLI” on page 7‐1. Defaults If port‐string is not specified, PWA will enabled on all ports. Mode Switch command, read‐write. Example This example shows how to enable PWA on ports 1‐22: C3(su)->set pwa portcontrol enable ge.1.
set pwa enhancedmode set pwa enhancedmode This command enables PWA URL redirection. The switch intercepts all HTTP packets on port 80 from the end user, and sends the end user a refresh page destined for the PWA IP Address configured. Syntax set pwa enhancedmode {enable | disable} Parameters enable | disable Enables or disables PWA enhancedmode. Defaults None. Mode Switch command, read‐write.
Configuring Secure Shell (SSH) Configuring Secure Shell (SSH) Purpose To review, enable, disable, and configure the Secure Shell (SSH) protocol, which provides secure Telnet. Commands For information about... Refer to page... show ssh status 26-80 set ssh 26-80 set ssh hostkey 26-81 show ssh status Use this command to display the current status of SSH on the switch. Syntax show ssh status Parameters None. Defaults None. Mode Switch command, read‐only.
set ssh hostkey Parameters enable | disable Enables or disables SSH, or reinitializes the SSH server. reinitialize Reinitializes the SSH server. Defaults None. Mode Switch command, read‐write. Example This example shows how to disable SSH: C3(su)->set ssh disable set ssh hostkey Use this command to reinitialize new SSH authentication keys. Syntax set ssh hostkey reinitialize Parameters reinitialize Reinitializes the server host authentication keys. Defaults None Mode Switch command, read‐write.
Configuring Access Lists Configuring Access Lists Router: These commands can be executed when the device is in router mode only. For details on how to enable router configuration modes, refer to “Enabling Router Configuration Modes” on page 18-2. Note: Refer to the Release Notes for your product for any limitations that may apply to access control lists.
access-list (standard) C3(su)->router#show access-lists 145 Extended IP access list 145 1: permit icmp host 88.255.255.254 any 2: permit icmp any host 11.11.16.16 3: deny icmp any any 4: permit tcp host 88.255.255.254 any eq 22 5: permit udp 88.255.128.0 0.0.127.255 eq 161 any 6: permit tcp any host 230.10.230.10 eq 1234 7: deny tcp any any eq 23 8: permit ip 88.255.128.0 0.0.127.255 any 9: deny ip any 224.0.0.0 31.0.0.
access-list (extended) insert | replace entryno (Optional) Inserts this new entry before a specified entry in an existing ACL, or replaces a specified entry with this new entry. move destination source1 source2 (Optional) Moves a sequence of access list entries before another entry. Destination is the number of the existing entry before which this new entry will be moved. Source1 is a single entry number or the first entry number in the range to be moved.
access-list (extended) To move entries within an ACL: access-list access-list-number move destination source1 [source2] Parameters access‐list‐number [entryno [entryno]] Specifies an extended access list number. Valid values are from 100 to 199. deny | permit Denies or permits access if specified conditions are met. protocol Specifies an IP protocol for which to deny or permit access.
ip access-group If eq port is not specified, TCP/UDP ports are not used for filtering. Only the protocol, source, and destination are used for applying the rule. Mode Global configuration: C3(su)‐>router(Config)# Usage Access lists are applied to interfaces by using the ip access‐group command as described in “ip access‐group” on page 26‐86. Valid access‐list‐numbers for extended ACLs are 100 to 199. For standard ACLs, valid values are 1 to 99.
ip access-group Usage ACLs must be applied per routing interface. An access list can be applied to inbound traffic only. Access lists can now be applied to routed VLANs which incorporate LAGs. Example This example shows how to apply access list 1 for all inbound frames on the VLAN 1 interface. Through the definition of access list 1, only frames with a source address on the 192.5.34.0/24 network will be routed.
ip access-group 26-88 Authentication and Authorization Configuration
27 TACACS+ Configuration This chapter provides information about the commands used to configure and monitor TACACS+ (Terminal Access Controller Access‐Control System Plus). TACACS+ is a security protcol that provides services for secure authentication, CLI command authorization, and CLI auditing for administrative access. It can be used as an alternative to the standard RADIUS security protocol (RFC 2865). TACACS+ runs over TCP and encrypts the body of each management packet.
TACACS+ Configuration show tacacs show tacacs Use this command to display the current TACACS+ configuration information and status. Syntax show tacacs [state] Parameters state (Optional) Displays only the TACACS+ client status. Defaults If state is not specified, all TACACS+ configuration information will be displayed. Mode Switch command, Read‐Only. Example This example shows how to display all TACACS configuration information.
set tacacs TACACS+ Configuration Table 27-1 show tacacs Output Details (Continued) Output... What it displays... TACACS+ singleconnect state Whether TACACS+ singleconnect is enabled or disabled. When enabled, the TACACS+ client sends multiple requests over a single TCP connection. TACACS+ service The name of the service that is requested by the TACACS+ client for session authorization. “exec” is the default service name.
TACACS+ Configuration set tacacs server Parameters index Display the configuration of the TACACS+ server identified by index. The value of index can range from 1 to 2,147,483,647. all Display the configuration for all configured TACACS+ servers. Defaults None. Mode Switch command, Read‐Only. Example This example displays configuration information for TACACS+ server 1. C3(ro)->show tacacs server 1 TACACS+ Server IP address Port Timeout -------------- ---------- ------ ------- 1 192.168.10.
clear tacacs server TACACS+ Configuration Mode Switch command, Read‐Write. Usage Up to 5 TACACS+ servers can be configured, with the index value of 1 having the highest priority. If you want to change the default timeout value for a specific server or all servers, you must enter the command using the timeout parameter. When at least one backup server has been configured and the switch loses contact with the primary server, the switch will contact the next server in priority.
TACACS+ Configuration show tacacs session Examples This example removes TACACS+ server 1. C3(rw)->clear tacacs server 1 This example resets the timeout value to its default value of 10 seconds for all configured TACACS+ servers. C3(rw)->clear tacacs server all timeout show tacacs session Use this command to display the current TACACS+ client session settings. Syntax show tacacs session {authorization | accounting} Parameters authorization Display client session authorization settings.
set tacacs session TACACS+ Configuration set tacacs session Use this command to enable or disable TACACS+ session accounting, or to configure TACACS+ session authorization parameters. For simplicity, separate syntax formats are shown for configuring session accounting and session authorization.
TACACS+ Configuration clear tacacs session The service name and attribute‐value pairs can be any character string, and are determined by your TACACS+ server configuration. Since a task ID is associated with each accounting session, if there is a failover to a backup server, the accounting information will still be associated with the correct session using the task ID. Examples This example configures the service requested by the TACACS+ client as the service name “basic.
show tacacs command TACACS+ Configuration show tacacs command Use this command to display the status (enabled or disabled) of TACACS+ accounting or authorization on a per‐command basis. Syntax show tacacs command {accounting | authorization} Parameters accounting Display the status of TACACS+ accounting on a per‐command basis. authorization Display the status of TACACS+ authorization on a per‐command basis. Defaults None. Mode Switch command, Read‐Write.
TACACS+ Configuration show tacacs singleconnect When per‐command accounting is enabled, the TACACS+ server will log accounting information, such as start and stop times, IP address of the client, and so forth, for each command executed during the session. When per‐command authorization is enabled, the TACACS+ server will check whether each command is permitted for that authorized session and return a success or fail. If the authorization fails, the command is not executed.
show tacacs interface TACACS+ Configuration Defaults None. Mode Switch command, Read‐Write. Examples This example shows how to disable sending multiple requests over a single connection. C3(rw)->set tacacs singleconnect disable show tacacs interface Use this command to display the interface used for the source IP address of the TACACS+ packets generated by the switch. Syntax show tacacs interface Parameters None. Defaults None. Mode Switch mode, read‐only.
TACACS+ Configuration clear tacacs interface vlan vlan‐ID Specifies the VLAN interface to be used. The value of vlan‐ID can range from 1 to 4093. Defaults None. Mode Switch command, read‐write. Usage This command allows you to configure the source IP address used by the TACACS+ application on the switch when generating packets for management purposes.
clear tacacs interface TACACS+ Configuration None. Defaults None. Mode Switch command, read‐write. Example This command returns the interface used for the source IP address of the TACACS+ client back to the default of the Host interface. C3(rw)->show tacacs interface vlan 100 192.168.10.
TACACS+ Configuration 27-14 clear tacacs interface
28 sFlow Configuration This chapter provides information about the commands used to configure and monitor the sFlow system. For information about... Refer to page... Overview 28-1 Commands 28-4 Overview sFlow is a method for monitoring high‐speed switched and routed networks. sFlow technology is built into network equipment and gives visibility into network activity, enabling effective management and control of network resources.
sFlow Configuration Overview Definitions The following table describes some of the main sFlow terms and concepts. Table 28-1 sFlow Definitions Term Definition Data Source A Data Source refers to a location within a Network Device that can make traffic measurements. Possible Data Sources include interfaces, physical entities within the device such as the backplane, and VLANs.
Overview sFlow Configuration Packet Flow Sampling The packet flow sampling mechanism carried out by each sFlow Instance ensures that any packet observed at a Data Source has an equal chance of being sampled, irrespective of the packet flow(s) to which it belongs. Packet flow sampling is accomplished as follows: 1. When a packet arrives on an interface, the Network Device makes a filtering decision to determine whether the packet should be dropped. 2.
sFlow Configuration Commands sFlow is disabled by default on SecureStack and G‐Series devices. Example Configuration The general procedure for configuring sFlow includes: 1. Configure your sFlow Collector information to be used by the sFlow Agent on the switch. Up to eight Collectors can be configured. The information is stored in the sFlowReceiverTable. 2. Enable and configure sFlow packet flow sampling instances on each port. 3.
show sflow receivers sFlow Configuration For information about... Refer to page... set sflow interface 28-14 show sflow interface 28-15 clear sflow interface 28-16 show sflow agent 28-17 show sflow receivers Use this command to display the contents of the sFlow Receivers Table, or to display information about a specific sFlow Collector listed in the table. Syntax show sflow receivers [index] Parameters index (Optional) Specifies a specific Collector to display information about.
sFlow Configuration show sflow receivers This example displays information about the Collector with index 1. C3(su)->show sflow receivers 1 Receiver Index 1 Owner String ets1 Time out 17758 IP Address: 10.1.2.117 Address Type IPv4 Port 6343 Datagram Version 5 Maximum Datagram Size 1400 The following table describes the output fields. Table 28-2 28-6 show sflow receivers Output Descriptions Output... What it displays...
set sflow receiver owner sFlow Configuration set sflow receiver owner Use this command to configure the owner identity string and timeout value for an sFlow Collector in the switch’s sFlow Receivers Table. Syntax set sflow receiver index owner owner-string timeout timeout Parameters index Index number in the sFlow Receivers Table for the receiver/Collector being configured. The index can range from 1 to 8. owner owner‐string The identity string of the receiver/Collector being configured.
sFlow Configuration set sflow receiver maxdatagram Parameters index Index number in the sFlow Receivers Table for the receiver/Collector being configured. The index can range from 1 to 8. ip ipaddr The IP address of the receiver/Collector being configured. An IP address of 0.0.0.0 means that no sample datagrams will be sent to the Collector. Defaults The default IP address is 0.0.0.0. Mode Switch command, read‐write.
set sflow receiver port sFlow Configuration Mode Switch command, read‐write. Example This example sets the maximum datagram size to 2800 bytes for index entry 1. C3(su)->set sflow receiver 1 maxdatagram 2800 set sflow receiver port Use this command to configure the UDP port on the sFlow Controller to which the switch will send sample datagrams. Syntax set sflow receiver index port port Parameters index Index number in the sFlow Receivers Table for the receiver/Collector being configured.
sFlow Configuration set sflow port poller owner (Optional) Clear the owner identity string. Entries in the sFlow Receiver Table without an identity string are considered unclaimed. timeout (Optional) Clear the timeout value of the specified entry. port port (Optional) Clear the UDP port on the receiver/Collector to which the sample datagrams should be sent. The value is reset to the default of 6343. Defaults If no optional parameters are specified, the entire entry is cleared.
show sflow pollers sFlow Configuration Usage A poller instance performs counter sampling on the data source to which it is configured. Refer to “Sampling Mechanisms” on page 28‐2 for more information. You must first associate a receiver/Collector in the sFlow Receivers Table with the poller instance, before configuring the polling interval.
sFlow Configuration clear sflow port poller clear sflow port poller Use this command to change the poller interval or to remove poller instances. Syntax clear sflow port port-string poller [interval] Parameters port‐string Specifies the port or ports on which the poller instance is being cleared. interval (Optional) Specifies that the polling interval should be cleared to 0. A value of 0 disables counter sampling. Defaults If interval is not specified, the poller instance is cleared.
show sflow samplers sFlow Configuration Defaults None. Mode Switch command, read‐write. Usage A sampler instance performs packet flow sampling on the data source to which it is configured. Refer to “Sampling Mechanisms” on page 28‐2 for more information. You must first associate a receiver/Collector in the sFlow Receivers Table with the sampler instance, before configuring the sampling rate or maximum number of bytes copied from sampled packets.
sFlow Configuration clear sflow port sampler ge.1.2 1 1024 128 ge.1.3 1 1024 128 ge.1.4 1 1024 128 ge.1.5 1 1024 128 ge.1.6 1 1024 128 ge.1.7 1 1024 128 ge.1.8 1 1024 128 clear sflow port sampler Use this command to change the sampler rate or maximum header size, or to remove sampler instances. Syntax clear sflow port port-string sampler [maxheadersize | rate] Parameters port‐string Specifies the port or ports on which the sampler instance is being cleared.
show sflow interface sFlow Configuration vlan vlan‐ID Specifies the VLAN interface to be used. The value of vlan‐ID can range from 1 to 4093. Defaults None. Mode Switch command, read‐write. Usage This command allows you to configure the management interface used by the sFlow Agent when sending sampling datagrams to the sFlow Collector. Any of the interfaces, including VLAN routing interfaces, can be configured as the management interface.
sFlow Configuration clear sflow interface None. Defaults None. Mode Switch mode, read‐only. Example This example displays the output of this command. In this case, the IP address assigned to loopback interface 1 will be used as the source IP address of the sFlow Agent. C3(rw)->show sflow interface loopback 1 192.168.10.1 clear sflow interface Use this command to clear the management interface used by the sFlow Agent back to the default of the Host VLAN. Syntax clear sflow interface Parameters None.
show sflow agent sFlow Configuration show sflow agent Use this command to display information about the sFlow Agent. Syntax show sflow agent Parameters None. Defaults None. Mode Switch command, read‐only. Example This example displays the output of this command. C3(rw)->show sflow agent sFlow Version IP Address 1.3;Broadcom Corp.;06.03.00.0001T 192.168.1.
sFlow Configuration 28-18 show sflow agent
A Policy and Authentication Capacities This appendix lists the policy and authentication capacities of the SecureStack C3 as of the date this document was published. Please refer to the Release Notes for your firmware version for the latest capacity information. Policy Capacities Refer to the “Configuring Policy” Feature Guide for an in‐depth discussion of Policy configuration. This Feature Guide is located on the Enterasys Networks web site: http://www.enterasys.
Policy and Authentication Capacities Table A-1 Authentication Capacities Policy Capacities (Continued) Feature Capacity udp dest port/udp source port icmp type1 cos/drop/fwd No 1. These rules cannot be masked. Authentication Capacities Refer to the “Configuring User Authentication” Feature Guide for an in‐depth discussion of authentication configuration. This Feature Guide is located on the Enterasys Networks web site: http://www.enterasys.
Index Numerics 802.1D 9-1 802.1p 11-17, 12-1 802.1Q 10-1 802.1s 9-2 802.1w 9-1 802.
about 22-1 configuring 22-14 displaying cache 21-6 OSPFv3, configuring 25-1 IPv6 proxy routing 23-1 IRDP 20-37 J Jumbo Frame Support 7-14 K Keyword Lookups 1-8 L License key advanced routing 20-1 licenses license key field descriptions 4-1 procedure for stack environment 4-1 Line Editing Commands 1-10 Link Layer Discovery Protocol (LLDP) configuring 6-13 Link State Advertisements displaying 20-27 retransmit interval 20-17 transmit delay 20-17 LLDP configuring 6-13 LLDP-MED configuring 6-14 Lockout set sy
enabling 18-2 Routing Interfaces configuring 19-3 Routing Protocol Configuration DVMRP 20-33 IRDP 20-37 OSPF 20-11 OSPFv3 25-1 RIP 20-2 VRRP 20-42 S Scrolling Screens 1-9 Secure Shell (SSH) 26-80 enabling 26-80 regenerating new keys 26-81 Security methods, overview of 26-1 Serial Port downloading upgrades via 3-32 sFlow configuration 28-1 show system utilization cpu 3-15 SNMP access rights 8-15 accessing in router mode 8-3 enabling on the switch 8-18 encryption protocols 8-10 MIB views 8-19 notification pa
Index - 4
