Stackable Managed Switch Management Guide TigerSwitch

ManualsBrandsSMC Networks ManualsSwitchTigerSwitch

TigerSwitch 10/100

24-Port 10/100Mbps

Stackable Managed Switch

Management Guide

◆ 24 auto-MDI/MDI-X 10BASE-T/100BASE-TX ports

◆ 2 Gigabit RJ-45 ports shared with 2 SFP transceiver slots

◆ 2 Gigabit stacking ports that act as Ethernet ports in

standalone mode

◆ Stacks up to 8 units

◆ 12.8 Gbps of aggregate bandwidth

◆ Non-blocking switching architecture

◆ Spanning Tree Protocol and Rapid STP

◆ Up to four LACP or static 4-port trunks

◆ RADIUS and TACACS+ authentication

◆ Rate limiting for bandwidth management

◆ CoS support for four-level priority

◆ Full support for VLANs with GVRP

◆ IP Multicasting with IGMP Snooping

Management Guide

SMC6224M

Summary of content (518 pages)

PAGE 1
TigerSwitch 10/100 24-Port 10/100Mbps Stackable Managed Switch Management Guide ◆ 24 auto-MDI/MDI-X 10BASE-T/100BASE-TX ports ◆ 2 Gigabit RJ-45 ports shared with 2 SFP transceiver slots ◆ 2 Gigabit stacking ports that act as Ethernet ports in standalone mode ◆ Stacks up to 8 units ◆ 12.
PAGE 2
PAGE 3
TigerSwitch 10/100 Management Guide From SMC’s Tiger line of feature-rich workgroup LAN solutions 38 Tesla Irvine, CA 92618 Phone: (949) 679-8000 November 2004 Pub.
PAGE 4
Information furnished by SMC Networks, Inc. (SMC) is believed to be accurate and reliable. However, no responsibility is assumed by SMC for its use, nor for any infringements of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent or patent rights of SMC. SMC reserves the right to change specifications at any time without notice. Copyright © 2004 by SMC Networks, Inc. 38 Tesla Irvine, CA 92618 All rights reserved.
PAGE 5
LIMITED WARRANTY Limited Warranty Statement: SMC Networks, Inc. (“SMC”) warrants its products to be free from defects in workmanship and materials, under normal use and service, for the applicable warranty term. All SMC products carry a standard 90-day limited warranty from the date of purchase from SMC or its Authorized Reseller. SMC may, at its own discretion, repair or replace any product not operating as warranted with a similar or functionally equivalent product, during the applicable warranty term.
PAGE 6
LIMITED WARRANTY WARRANTIES EXCLUSIVE: IF AN SMC PRODUCT DOES NOT OPERATE AS WARRANTED ABOVE, CUSTOMER’S SOLE REMEDY SHALL BE REPAIR OR REPLACEMENT OF THE PRODUCT IN QUESTION, AT SMC’S OPTION. THE FOREGOING WARRANTIES AND REMEDIES ARE EXCLUSIVE AND ARE IN LIEU OF ALL OTHER WARRANTIES OR CONDITIONS, EXPRESS OR IMPLIED, EITHER IN FACT OR BY OPERATION OF LAW, STATUTORY OR OTHERWISE, INCLUDING WARRANTIES OR CONDITIONS OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
PAGE 7
CONTENTS 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-1 Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Description of Software Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-2 System Defaults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7 2 Initial Configuration . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 8
CONTENTS Displaying Switch Hardware/Software Versions . . . . . . . . . . . Displaying Bridge Extension Capabilities . . . . . . . . . . . . . . . . . Setting the Switch’s IP Address . . . . . . . . . . . . . . . . . . . . . . . . Manual Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Using DHCP/BOOTP . . . . . . . . . . . . . . . . . . . . . . . . . . . Managing Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Downloading System Software from a Server . .
PAGE 9
CONTENTS Filtering Addresses for Management Access . . . . . . . . . . . . . . . 3-75 Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-77 Configuring Access Control Lists . . . . . . . . . . . . . . . . . . . . . . . 3-77 Setting the ACL Name and Type . . . . . . . . . . . . . . . . . . . . 3-78 Configuring a Standard IP ACL . . . . . . . . . . . . . . . . . . . . . 3-80 Configuring an Extended IP ACL . . . . . . . . . . . . . . . . . . .
PAGE 10
CONTENTS Displaying Basic VLAN Information . . . . . . . . . . . . . . . Displaying Current VLANs . . . . . . . . . . . . . . . . . . . . . . . Creating VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Adding Static Members to VLANs (VLAN Index) . . . . Adding Static Members to VLANs (Port Index) . . . . . . Configuring VLAN Behavior for Interfaces . . . . . . . . . . Private VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 11
CONTENTS Telnet Connection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Entering Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4 Keywords and Arguments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4 Minimum Abbreviation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4 Command Completion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-5 Getting Help on Commands . . . . . . . . .
PAGE 12
CONTENTS quit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . System Management Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Device Designation Commands . . . . . . . . . . . . . . . . . . . . . . . . prompt . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . hostname . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . User Access Commands . . . . . . . . . . . . . . . . . . . . . .
PAGE 13
CONTENTS clear logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-64 show logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-64 show log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-66 SMTP Alert Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-68 logging sendmail host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-68 logging sendmail level . . . . . . . . . . . . . . . .
PAGE 14
CONTENTS RADIUS Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-99 radius-server host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-99 radius-server port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-100 radius-server key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-101 radius-server retransmit . . . . . . . . . . . . . . . . . . . . . . . . . . 4-101 radius-server timeout . . . . . . . . . . . . . . . . . . . .
PAGE 15
CONTENTS MAC ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-130 access-list mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-130 permit, deny (MAC ACL) . . . . . . . . . . . . . . . . . . . . . . . . . 4-131 show mac access-list . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-133 mac access-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-133 show mac access-group . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 16
CONTENTS show rate-limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Link Aggregation Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . channel-group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . lacp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . lacp system-priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . lacp admin-key (Ethernet Interface) . . . . . . . .
PAGE 17
CONTENTS switchport mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-202 switchport acceptable-frame-types . . . . . . . . . . . . . . . . . 4-203 switchport ingress-filtering . . . . . . . . . . . . . . . . . . . . . . . 4-204 switchport native vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-205 switchport allowed vlan . . . . . . . . . . . . . . . . . . . . . . . . . . 4-206 switchport forbidden vlan . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 18
CONTENTS map ip dscp (Interface Configuration) . . . . . . . . . . . . . . . show map ip port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . show map ip precedence . . . . . . . . . . . . . . . . . . . . . . . . . show map ip dscp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Multicast Filtering Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . IGMP Snooping Commands . . . . . . . . . . . . . . . . . . . . . . . . . ip igmp snooping . . . . . . . . . . . . .
PAGE 19
CONTENTS Glossary Index xv
PAGE 20
CONTENTS xvi
PAGE 21
TABLES Table 1-1 Table 1-2 Table 3-1 Table 3-2 Table 3-3 Table 3-4 Table 3-5 Table 3-6 Table 3-7 Table 3-8 Table 3-9 Table 3-10 Table 3-11 Table 3-12 Table 3-13 Table 3-14 Table 4-1 Table 4-2 Table 4-3 Table 4-4 Table 4-5 Table 4-6 Table 4-7 Table 4-8 Table 4-9 Table 4-10 Table 4-11 Table 4-12 Table 4-13 Table 4-14 Table 4-15 Table 4-16 Table 4-17 Table 4-18 Table 4-19 Table 4-20 Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 System Defaults . . . . . . . . . . . .
PAGE 22
TABLES Table 4-21 Table 4-22 Table 4-23 Table 4-24 Table 4-25 Table 4-26 Table 4-27 Table 4-28 Table 4-29 Table 4-30 Table 4-31 Table 4-32 Table 4-33 Table 4-34 Table 4-35 Table 4-36 Table 4-37 Table 4-38 Table 4-39 Table 4-40 Table 4-41 Table 4-42 Table 4-43 Table 4-44 Table 4-45 Table 4-46 Table 4-47 Table 4-49 Table 4-48 Table 4-50 Table 4-51 Table 4-52 Table 4-53 Table 4-54 Table 4-55 Table 4-56 Table 4-57 xviii SMTP Alert Commands . . . . . . . . . . . . . . . . . . . . . . . . . 4-68 Time Commands .
PAGE 23
TABLES Table 4-58 Table 4-59 Table 4-60 Table 4-61 Table 4-62 Table 4-63 Table 4-64 Table 4-65 Table 4-66 Table 4-67 Table B-1 Priority Commands (Layer 2) . . . . . . . . . . . . . . . . . . . . 4-222 Default CoS Priority Levels . . . . . . . . . . . . . . . . . . . . . . 4-226 Priority Commands (Layer 3 and 4) . . . . . . . . . . . . . . . 4-229 Mapping IP Precedence Values . . . . . . . . . . . . . . . . . . . 4-232 IP DSCP to CoS Values . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 24
FIGURES Figure 3-1 Figure 3-2 Figure 3-3 Figure 3-4 Figure 3-5 Figure 3-6 Figure 3-7 Figure 3-8 Figure 3-9 Figure 3-10 Figure 3-11 Figure 3-12 Figure 3-13 Figure 3-14 Figure 3-15 Figure 3-16 Figure 3-17 Figure 3-18 Figure 3-19 Figure 3-20 Figure 3-21 Figure 3-22 Figure 3-23 Figure 3-24 Figure 3-25 Figure 3-26 Figure 3-27 Figure 3-28 Figure 3-29 Figure 3-30 Figure 3-31 Figure 3-32 Figure 3-33 Figure 3-34 Figure 3-35 Figure 3-36 xx FIGURES Home Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 25
FIGURES Figure 3-37 Figure 3-38 Figure 3-39 Figure 3-40 Figure 3-41 Figure 3-42 Figure 3-43 Figure 3-44 Figure 3-45 Figure 3-46 Figure 3-47 Figure 3-48 Figure 3-49 Figure 3-50 Figure 3-51 Figure 3-52 Figure 3-53 Figure 3-54 Figure 3-55 Figure 3-56 Figure 3-57 Figure 3-58 Figure 3-59 Figure 3-60 Figure 3-61 Figure 3-62 Figure 3-63 Figure 3-64 Figure 3-65 Figure 3-66 Figure 3-67 Figure 3-68 Figure 3-69 Figure 3-70 Figure 3-71 Figure 3-72 Figure 3-73 ACL Configuration - Extended IP . . . . . . . . . . . . . .
PAGE 26
FIGURES Figure 3-74 Figure 3-75 Figure 3-76 Figure 3-77 Figure 3-78 Figure 3-79 Figure 3-80 Figure 3-81 Figure 3-82 Figure 3-83 Figure 3-84 Figure 3-85 Figure 3-86 xxii Queue Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Configuring Queue Scheduling . . . . . . . . . . . . . . . . . . IP Precedence/DSCP Priority Status . . . . . . . . . . . . . . Mapping IP Precedence Priority Values . . . . . . . . . . . Mapping IP DSCP Priority Values . . . . . . . . . . . . . . . .
PAGE 27
CHAPTER 1 INTRODUCTION This switch provides a broad range of features for Layer 2 switching. It includes a management agent that allows you to configure the features listed in this manual. The default configuration can be used for most of the features provided by this switch. However, there are many options that you should configure to maximize the switch’s performance for your particular network environment.
PAGE 28
INTRODUCTION Table 1-1 Key Features Feature Description Port Trunking Supports up to 4 trunks using either static or dynamic trunking (LACP) Broadcast Storm Control Supported Static Address Up to 8K MAC addresses in the forwarding table IEEE 802.
PAGE 29
DESCRIPTION OF SOFTWARE FEATURES Configuration Backup and Restore – You can save the current configuration settings to a file on a TFTP server, and later download this file to restore the switch configuration settings. Authentication – This switch authenticates management access via the console port, Telnet or web browser. User names and passwords can be configured locally or can be verified via a remote authentication server (i.e., RADIUS or TACACS+).
PAGE 30
INTRODUCTION Rate Limiting – This feature controls the maximum rate for traffic transmitted or received on an interface. Rate limiting is configured on interfaces at the edge of a network to limit traffic into or out of the network. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped. Port Mirroring – The switch can unobtrusively mirror traffic from any port to a monitor port.
PAGE 31
DESCRIPTION OF SOFTWARE FEATURES Store-and-Forward Switching – The switch copies each frame into its memory before forwarding them to another port. This ensures that all frames are a standard Ethernet size and have been verified for accuracy with the cyclic redundancy check (CRC). This prevents bad frames from entering the network and wasting bandwidth. To avoid dropping frames on congested ports, the switch provides 8 MB for frame buffering.
PAGE 32
INTRODUCTION switch to restrict traffic to the VLAN groups to which a user has been assigned. By segmenting your network into VLANs, you can: • • • • Eliminate broadcast storms which severely degrade performance in a flat network. Simplify network management for node changes/moves by remotely configuring VLAN membership for any port, rather than having to manually change the network connection. Provide data security by restricting all traffic to the originating VLAN.
PAGE 33
SYSTEM DEFAULTS System Defaults The switch’s system defaults are provided in the configuration file “Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as the startup configuration file (page 3-23). The following table lists some of the basic system defaults.
PAGE 34
INTRODUCTION Table 1-2 System Defaults Function Parameter Default Web Management HTTP Server Enabled HTTP Port Number 80 HTTP Secure Server Enabled HTTP Secure Port Number 443 Community Strings “public” (read only) “private” (read/write) Traps Authentication traps: enabled Link-up-down events: enabled Admin Status Enabled Auto-negotiation Enabled Flow Control Disabled Rate Limiting Input and output limits Disabled Port Trunking Static Trunks None LACP (all ports) Disabled SNMP
PAGE 35
SYSTEM DEFAULTS Table 1-2 System Defaults Function Parameter Default Virtual LANs Default VLAN 1 PVID 1 Acceptable Frame Type All Ingress Filtering Disabled Switchport Mode (Egress Mode) Hybrid: tagged/untagged frames GVRP (global) Disabled GVRP (port interface) Disabled Ingress Port Priority 0 Weighted Round Robin Queue: 0 1 2 3 Weight: 1 2 4 6 IP Precedence Priority Disabled IP DSCP Priority Disabled IP Port Priority Disabled IP Address 0.0.0.0 Subnet Mask 255.0.0.
PAGE 36
INTRODUCTION 1-10
PAGE 37
CHAPTER 2 INITIAL CONFIGURATION Connecting to the Switch Configuration Options The switch includes a built-in network management agent. The agent offers a variety of management options, including SNMP, RMON (Groups 1, 2, 3, 9) and a Web-based interface. A PC may also be connected directly to the switch for configuration and monitoring via a command line interface (CLI). Note: The IP address for this switch is obtained via DHCP by default. To change this address, see “Setting an IP Address” on page 2-8.
PAGE 38
INITIAL CONFIGURATION The switch’s Web interface, CLI configuration program, and SNMP agent allow you to perform the following management functions: • • • • • • Set user names and passwords for up to 16 users Set an IP interface for a management VLAN Configure SNMP parameters Enable/disable any port Set the speed/duplex mode for any port Configure the bandwidth of any port by limiting input or output rates • Control port access through IEEE 802.
PAGE 39
CONNECTING TO THE SWITCH Attach a VT100-compatible terminal, or a PC running a terminal emulation program to the switch. You can use the console cable provided with this package, or use a null-modem cable that complies with the wiring assignments shown in the Installation Guide. To connect a terminal to the console port, complete the following steps: 1.
PAGE 40
INITIAL CONFIGURATION For a description of how to use the CLI, see “Using the Command Line Interface” on page 4-1. For a list of all the CLI commands and detailed information on using the CLI, refer to “Command Groups” on page 4-12. Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you must first configure it with a valid IP address, subnet mask, and default gateway using a console connection, DHCP or BOOTP protocol.
PAGE 41
STACK OPERATIONS Stack Operations Up to eight switches can be stacked together as described in the Installation Guide. One unit in the stack acts as the Master for configuration tasks and firmware upgrade. All of the other units function in Slave mode. To configure any unit in the stack, first verify the unit number by counting down from the Master unit, and then select the appropriate unit number from the web or console management interface.
PAGE 42
INITIAL CONFIGURATION Resilient IP Interface for Management Access The stack functions as one integral system for management and configuration purposes. You can therefore manage the stack through any IP interface configured on the stack. The Master unit does not even have to include an active port member in the VLAN interface used for management access.
PAGE 43
BASIC CONFIGURATION 3. At the Password prompt, also enter “admin.” (The password characters are not displayed on the console screen.) 4. The session is opened and the CLI displays the “Console#” prompt indicating you have access at the Privileged Exec level. Setting Passwords Note: If this is your first time to log into the CLI program, you should define new passwords for both default user names using the “username” command, record them and put them in a safe place.
PAGE 44
INITIAL CONFIGURATION Setting an IP Address You must establish IP address information for the switch to obtain management access through the network. This can be done in either of the following ways: Manual — You have to input the information, including IP address and subnet mask. If your management station is not in the same IP subnet as the switch, you will also need to specify the default gateway router.
PAGE 45
BASIC CONFIGURATION 3. Type “exit” to return to the global configuration mode prompt. Press . 4. To set the IP address of the default gateway for the network to which the switch belongs, type “ip default-gateway gateway,” where “gateway” is the IP address of the default gateway. Press . Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.5 255.255.255.0 Console(config-if)#exit Console(config)#ip default-gateway 192.168.1.
PAGE 46
INITIAL CONFIGURATION • To obtain IP settings via BOOTP, type “ip address bootp” and press . 3. Type “end” to return to the Privileged Exec mode. Press . 4. Type “ip dhcp restart” to begin broadcasting service requests. Press . 5. Wait a few minutes, and then check the IP configuration settings by typing the “show ip interface” command. Press . 6. Then save your configuration changes by typing “copy running-config startup-config.” Enter the startup file name and press .
PAGE 47
BASIC CONFIGURATION Community Strings Community strings are used to control management access to SNMP stations, as well as to authorize SNMP stations to receive trap messages from the switch. You therefore need to assign community strings to specified users or user groups, and set the access level. The default strings are: • public - with read-only access. Authorized management stations are only able to retrieve MIB objects. • private - with read-write access.
PAGE 48
INITIAL CONFIGURATION Trap Receivers You can also specify SNMP stations that are to receive traps from the switch. To configure a trap receiver, complete the following steps: 1. From the Privileged Exec level global configuration mode prompt, type “snmp-server host host-address community-string,” where “host-address” is the IP address for the trap receiver and “community-string” is the string associated with that host. Press . 2.
PAGE 49
MANAGING SYSTEM FILES 2. Enter the name of the start-up file. Press . Console#copy running-config startup-config Startup configuration file name []: startup \Write to FLASH Programming. \Write to FLASH finish. Success. Console# Managing System Files The switch’s flash memory supports three types of system files that can be managed by the CLI program, Web interface, or SNMP. The switch’s file system allows files to be uploaded and downloaded, copied, deleted, and set as a start-up file.
PAGE 50
INITIAL CONFIGURATION Due to the size limit of the flash memory, the switch supports only two operation code files. However, you can have as many diagnostic code files and configuration files as available flash memory space allows. In the system flash memory, one file of each type must be set as the start-up file. During a system boot, the diagnostic and operation code files set as the start-up file are run, and then the start-up configuration file is loaded.
PAGE 51
CHAPTER 3 CONFIGURING THE SWITCH Using the Web Interface This switch provides an embedded HTTP Web agent. Using a Web browser you can configure the switch and view statistics to monitor network activity. The Web agent can be accessed by any computer on the network using a standard Web browser (Internet Explorer 5.0 or above, or Netscape Navigator 6.2 or above). Note: You can also use the Command Line Interface (CLI) to manage the switch over a serial connection to the console port or via Telnet.
PAGE 52
CONFIGURING THE SWITCH Notes: 1. You are allowed three attempts to enter the correct password; on the third failed attempt the current connection is terminated. 2. If you log into the Web interface as guest (Normal Exec level), you can view the configuration settings or change the guest password. If you log in as “admin” (Privileged Exec level), you can change the settings on any page. 3.
PAGE 53
NAVIGATING THE WEB BROWSER INTERFACE Navigating the Web Browser Interface To access the web-browser interface you must first enter a user name and password. The administrator has Read/Write access to all configuration parameters and statistics. The default user name and password for the administrator is “admin.” Home Page When your web browser connects with the switch’s web agent, the home page is displayed as shown below.
PAGE 54
CONFIGURING THE SWITCH Configuration Options Configurable parameters have a dialog box or a drop-down list. Once a configuration change has been made on a page, be sure to click on the Apply button to confirm the new setting. The following table summarizes the web page configuration buttons. Table 3-1 Configuration Options Button Action Revert Cancels specified values and restores current values prior to pressing Apply. Apply Sets specified values to the system. Help Links directly to webhelp.
PAGE 55
MAIN MENU Main Menu Using the onboard web agent, you can define system parameters, manage and control the switch, and all its ports, or monitor network conditions. The following table briefly describes the selections available from this program.
PAGE 56
CONFIGURING THE SWITCH Table 3-2 Main Menu (Continued) Menu Description SNTP 3-42 Configuration Configures SNTP client settings, including broadcast mode or a specified list of servers 3-42 Clock Time Zone Sets the local time zone for the system clock 3-44 SNMP Configuration 3-45 Configures community strings and related trap functions Security 3-45 3-48 User Accounts Assigns a new password for the current user 3-48 Authentication Settings Configures authentication sequence, RADIUS and TACA
PAGE 57
MAIN MENU Table 3-2 Main Menu (Continued) Menu IP Filter Description Sets IP addresses of clients allowed management access via the Web, SNMP, and Telnet Port Page 3-75 3-88 Port Information Displays port connection status 3-88 Trunk Information Displays trunk connection status 3-88 Port Configuration Configures port connection settings 3-91 Trunk Configuration Configures trunk connection settings 3-91 Trunk Membership Specifies ports to group into static trunks 3-95 LACP 3-93 Configur
PAGE 58
CONFIGURING THE SWITCH Table 3-2 Main Menu (Continued) Menu Description Page Output Port Configuration Sets the output rate limit for each port 3-114 Output Trunk Configuration Sets the output rate limit for each trunk 3-114 Lists Ethernet and RMON port statistics 3-115 Port Statistics Address Table 3-122 Static Addresses Displays entries for interface, address or VLAN 3-122 Dynamic Addresses Displays or edits static entries in the Address Table 3-123 Address Aging Sets timeout for dynam
PAGE 59
MAIN MENU Table 3-2 Main Menu (Continued) Menu Description Page Static Membership by Configures membership type for interfaces, Port including tagged, untagged or forbidden 3-154 Port Configuration Specifies default PVID and VLAN attributes 3-156 Trunk Configuration Specifies default trunk VID and VLAN attributes 3-156 Private VLAN 3-159 Information Displays Private VLAN feature information 3-160 Configuration This page is used to create/remove primary or community VLANs 3-161 Association
PAGE 60
CONFIGURING THE SWITCH Table 3-2 Main Menu (Continued) Menu Description Queue Scheduling Configures Weighted Round Robin queueing 3-173 IP Precedence/ DSCP Priority Status Globally selects IP Precedence or DSCP Priority, or disables both.
PAGE 61
BASIC CONFIGURATION Basic Configuration Displaying System Information You can easily identify the system by displaying the device name, location and contact information. Field Attributes • System Name – Name assigned to the switch system. • Object ID – MIB II object ID for switch’s network management subsystem. • Location – Specifies the system location. • Contact – Administrator responsible for the system. • System Up Time – Length of time the management agent has been up.
PAGE 62
CONFIGURING THE SWITCH Web – Click System, System Information. Specify the system name, location, and contact information for the system administrator, then click Apply. (This page also includes a Telnet button that allows access to the Command Line Interface via Telnet.
PAGE 63
BASIC CONFIGURATION CLI – Specify the hostname, location and contact information. Console(config)#hostname R&D 5 4-34 Console(config)#snmp-server location WC 9 4-140 Console(config)#snmp-server contact Ted 4-139 Console(config)#exit Console#show system 4-84 System description: 24-Port 10/100Mbps Stackable Managed Switch with 2 optional uplink modules System OID string: 1.3.6.1.4.1.202.20.43 System information System Up time: 0 days, 2 hours, 4 minutes, and 7.
PAGE 64
CONFIGURING THE SWITCH • Internal Power Status – Displays the status of the internal power supply. Management Software • Loader Version – Version number of loader code. • Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code. • Operation Code Version – Version number of runtime code. • Role – Shows that this switch is operating as Master or Slave. Expansion Slot • Expansion Slot 1/2 – Combination RJ-45/SFP ports. These additional parameters are displayed for the CLI.
PAGE 65
BASIC CONFIGURATION CLI – Use the following command to display version information. Console#show version Unit 1 Serial number: Service tag: Hardware version: Module A type: Module B type: Number of ports: Main power status: Redundant power status Agent (master) Unit ID: Loader version: Boot ROM version: Operation code version: 4-86 S416000963 R01 1000BaseT 1000BaseT 26 up :not present 1 2.2.1.1 2.2.1.2 2.2.5.
PAGE 66
CONFIGURING THE SWITCH • Configurable PVID Tagging – This switch allows you to override the default Port VLAN ID (PVID used in frame tags) and egress status (VLAN-Tagged or Untagged) on each port. (Refer to “VLAN Configuration” on page 3-142.) • Local VLAN Capable – This switch does not support multiple local bridges outside of the scope of 802.1Q defined VLANs. • GMRP – GARP Multicast Registration Protocol (GMRP) allows network devices to register endstations with multicast groups.
PAGE 67
BASIC CONFIGURATION CLI – Enter the following command. Console#show bridge-ext Max support VLAN numbers: Max support VLAN ID: Extended multicast filtering services: Static entry individual port: VLAN learning: Configurable PVID tagging: Local VLAN capable: Traffic classes: Global GVRP status: GMRP: Console# 4-217 255 4094 No Yes IVL Yes No Enabled Disabled Disabled Setting the Switch’s IP Address This section describes how to configure an IP interface for management access over the network.
PAGE 68
CONFIGURING THE SWITCH Requests will be broadcast periodically by the switch for an IP address. (DHCP/BOOTP values can include the IP address, subnet mask, and default gateway.) • IP Address – Address of the VLAN interface that is allowed management access. Valid IP addresses consist of four numbers, 0 to 255, separated by periods. (Default: 0.0.0.0) • Subnet Mask – This mask identifies the host address bits used for routing to specific subnets. (Default: 255.0.0.
PAGE 69
BASIC CONFIGURATION CLI – Specify the management interface, IP address and default gateway. Console#config Console(config)#interface vlan 1 Console(config-if)#ip address 10.1.0.254 255.255.255.0 Console(config-if)#exit Console(config)#ip default-gateway 192.168.1.254 Console(config)# 4-146 4-249 4-252 Using DHCP/BOOTP If your network provides DHCP/BOOTP services, you can configure the switch to be dynamically configured by these services. Web – Click System, IP Configuration.
PAGE 70
CONFIGURING THE SWITCH CLI – Specify the management interface, and set the IP address mode to DHCP or BOOTP, and then enter the “ip dhcp restart” command. Console#config Console(config)#interface vlan 1 4-146 Console(config-if)#ip address dhcp 4-249 Console(config-if)#end Console#ip dhcp restart 4-251 Console#show ip interface 4-252 IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: dhcp.
PAGE 71
BASIC CONFIGURATION Managing Firmware You can upload/download firmware to or from a TFTP server, or copy files to and from switch units in a stack. By saving runtime code to a file on a TFTP server, that file can later be downloaded to the switch to restore operation. You can also set the switch to use new firmware without overwriting the previous version. You must specify the method of file transfer, along with the file type and file names as required.
PAGE 72
CONFIGURING THE SWITCH Downloading System Software from a Server When downloading runtime code, you can specify the destination file name to replace the current image, or first download the file using a different name from the current runtime code file, and then set the new file as the startup file. Web –Click System, File Management, Copy Operation.
PAGE 73
BASIC CONFIGURATION If you download to a new destination file, go to the System/File/Set Start-Up menu, mark the operation code file used at startup, and click Apply. To start the new firmware, reboot the system via the System/Reset menu. Figure 3-9 Select Start-Up Operation File To delete a file select System, File, Delete. Select the file name from the given list by checking the tick box and click Apply.
PAGE 74
CONFIGURING THE SWITCH CLI – To download new firmware form a TFTP server, enter the IP address of the TFTP server, select “opcode” as the file type, then enter the source and destination file names. When the file has finished downloading, set the new file to start up the system, and then restart the switch. To start the new firmware, enter the “reload” command or reboot the system. Console#copy tftp file TFTP server ip address: 10.1.0.19 Choose file type: 1. config: 2.
PAGE 75
BASIC CONFIGURATION • - running-config to startup-config – Copies the running config to the startup config. - running-config to tftp – Copies the running configuration to a TFTP server. - startup-config to file – Copies the startup configuration to a file on the switch. - startup-config to running-config – Copies the startup config to the running config. - startup-config to tftp – Copies the startup configuration to a TFTP server. - tftp to file – Copies a file from a TFTP server to the switch.
PAGE 76
CONFIGURING THE SWITCH Downloading Configuration Settings from a Server You can download the configuration file under a new file name and then set it as the startup file, or you can specify the current startup configuration file as the destination file to directly replace it. Note that the file “Factory_Default_Config.cfg” can be copied to the TFTP server, but cannot be used as the destination on the switch. Web – Click System, File, Copy.
PAGE 77
BASIC CONFIGURATION If you download to a new file name using “tftp to startup-config” or “tftp to file,” the file is automatically set as the start-up configuration file. To use the new settings, reboot the system via the System/Reset menu. Note that you can also select any configuration file as the start-up configuration by using the System/File/Set Start-Up page.
PAGE 78
CONFIGURING THE SWITCH Console Port Settings You can access the onboard configuration program by attaching a VT100 compatible device to the switch’s serial console port. Management access through the console port is controlled by various parameters, including a password, timeouts, and basic communication settings. These parameters can be configured via the Web or CLI interface. Command Attributes 3-28 • Login Timeout – Sets the interval that the system waits for a user to log into the CLI.
PAGE 79
BASIC CONFIGURATION • Speed – Sets the terminal line’s baud rate for transmit (to terminal) and receive (from terminal). Set the speed to match the baud rate of the device connected to the serial port. (Range: 9600, 19200, 38400, 57600, or 115200 baud, Auto; Default: 9600 bps) • Stop Bits – Sets the number of the stop bits transmitted per byte. (Range: 1-2; Default: 1 stop bit) • Password1 – Specifies a password for the line connection.
PAGE 80
CONFIGURING THE SWITCH CLI – Enter Line Configuration mode for the console, then specify the connection parameters as required. To display the current console port settings, use the show line command from the Normal Exec level.
PAGE 81
BASIC CONFIGURATION • Telnet Port Number – Sets the TCP port number for Telnet on the switch. (Default: 23) • Login Timeout – Sets the interval that the system waits for a user to log into the CLI. If a login attempt is not detected within the timeout interval, the connection is terminated for the session. (Range: 0-300 seconds; Default: 300 seconds) • Exec Timeout – Sets the interval that the system waits until user input is detected.
PAGE 82
CONFIGURING THE SWITCH Web – Click System, Line, Telnet. Specify the connection parameters for Telnet access, then click Apply. Figure 3-14 Enabling Telnet CLI – Enter Line Configuration mode for a virtual terminal, then specify the connection parameters as required. To display the current virtual terminal settings, use the show line command from the Normal Exec level.
PAGE 83
BASIC CONFIGURATION Configuring Event Logging The switch allows you to control the logging of error messages, including the type of events that are recorded in switch memory, logging to a remote System Log (syslog) server, and displays a list of recent event messages. System Log Configuration The system allows you to enable or disable event logging, and specify which levels are logged to RAM or flash memory.
PAGE 84
CONFIGURING THE SWITCH Table 3-3 Logging Levels Level Severity Name Description 7 Debug Debugging messages 6 Informational Informational messages only 5 Notice Normal but significant condition, such as cold start 4 Warning Warning conditions (e.g., return false, unexpected return) 3 Error Error conditions (e.g., invalid input, default used) 2 Critical Critical conditions (e.g.
PAGE 85
BASIC CONFIGURATION Web – Click System, Log, System Logs. Specify System Log Status, set the level of event messages to be logged to RAM and flash memory, then click Apply. Figure 3-15 System Logs CLI – Enable system logging and then specify the level of messages to be logged to RAM and flash memory. Use the show logging command to display the current settings.
PAGE 86
CONFIGURING THE SWITCH The facility type is used by the syslog server to dispatch log messages to an appropriate service. The attribute specifies the facility type tag sent in syslog messages. (See RFC 3164.) This type has no effect on the kind of messages reported by the switch. However, it may be used by the syslog server to process messages, such as sorting or storing messages in the corresponding database.
PAGE 87
BASIC CONFIGURATION Web – Click System, Log, Remote Logs. To add an IP address to the Host IP List, type the new IP address in the Host IP Address box, and then click Add. To delete an IP address, click the entry in the Host IP List, and then click Remove. Figure 3-16 Remote Logs CLI – Enter the syslog server host IP address, choose the facility type and set the logging trap. Console(config)#logging host 192.168.1.
PAGE 88
CONFIGURING THE SWITCH Displaying Log Messages The Logs page allows you to scroll through the logged system and event messages. The switch can store up to 2048 log entries in temporary random access memory (RAM; i.e., memory flushed on power reset) and up to 4096 entries in permanent flash memory. Web – Click System, Log, Logs. Figure 3-17 Displaying Logs CLI – This example shows the event message stored in RAM. Console#show log ram [1] 00:01:37 2001-01-01 "DHCP request failed - will retry later.
PAGE 89
BASIC CONFIGURATION Sending Simple Mail Transfer Protocol Alerts To alert system administrators of problems, the switch can use SMTP (Simple Mail Transfer Protocol) to send email messages when triggered by logging events of a specified level. The messages are sent to specified SMTP servers on the network and can be retrieved using POP or IMAP clients. Command Attributes • Admin Status – Enables/disables the SMTP function.
PAGE 90
CONFIGURING THE SWITCH Web – Click System, Log, SMTP. Enable SMTP, specify a source email address, and select the minimum severity level. To add an IP address to the SMTP Server List, type the new IP address in the SMTP Server field and click Add. To delete an IP address, click the entry in the SMTP Server List and click Remove. Specify up to five email addresses to receive the alert messages, and click Apply.
PAGE 91
BASIC CONFIGURATION CLI – Enter the IP address of at least one SMTP server, set the syslog severity level to trigger an email message, and specify the switch (source) and up to five recipient (destination) email addresses. Enable SMTP with the logging sendmail command to complete the configuration. Use the show logging sendmail command to display the current SMTP configuration. Console(config)#logging sendmail host 192.168.1.
PAGE 92
CONFIGURING THE SWITCH CLI – Use the reload command to restart the switch. When prompted, confirm that you want to reset the switch. Console#reload System will be restarted, continue ? y 4-30 Note: When restarting the system, it will always run the Power-On Self-Test. Setting the System Clock Simple Network Time Protocol (SNTP) allows the switch to set its internal clock based on periodic updates from a time server (SNTP or NTP).
PAGE 93
BASIC CONFIGURATION • SNTP Server – Sets the IP address for up to three time servers. The switch attempts to update the time from the first server, if this fails it attempts an update from the next server in the sequence. Web – Select SNTP, Configuration. Modify any of the required parameters, and click Apply. Figure 3-20 SNTP Configuration CLI – This example configures the switch to operate as an SNTP unicast client and then displays the current time and settings. Console(config)#sntp server 10.1.0.
PAGE 94
CONFIGURING THE SWITCH Setting the Time Zone SNTP uses Coordinated Universal Time (or UTC, formerly Greenwich Mean Time, or GMT) based on the time at the Earth’s prime meridian, zero degrees longitude. To display a time corresponding to your local time, you must indicate the number of hours and minutes your time zone is east (before) or west (after) of UTC. Command Attributes • Current Time – Displays the current time. • Name – Assigns a name to the time zone.
PAGE 95
SIMPLE NETWORK MANAGEMENT PROTOCOL Simple Network Management Protocol Simple Network Management Protocol (SNMP) is a communication protocol designed specifically for managing devices on a network. Equipment commonly managed with SNMP includes switches, routers and host computers. SNMP is typically used to configure these devices for proper operation in a network environment, as well as to monitor them to evaluate performance or detect potential problems.
PAGE 96
CONFIGURING THE SWITCH • Access Mode - Read-Only – Specifies read-only access. Authorized management stations are only able to retrieve MIB objects. - Read/Write – Specifies read-write access. Authorized management stations are able to both retrieve and modify MIB objects. Web – Click SNMP, Configuration. Add new community strings as required, select the access rights from the Access Mode drop-down list, then click Add.
PAGE 97
SIMPLE NETWORK MANAGEMENT PROTOCOL Command Attributes • Trap Manager Capability – This switch supports up to five trap managers. • Current – Displays a list of the trap managers currently configured. • Trap Manager IP Address – IP address of the host (the targeted recipient). • Trap Manager Community String – Community string sent with the notification operation. (Range: 1-32 characters, case sensitive) Trap Version – Specifies whether to send notifications as SNMP v1 or v2c traps.
PAGE 98
CONFIGURING THE SWITCH CLI – This example adds a trap manager and enables both authentication and link-up, link-down traps. Console(config)#snmp-server host 192.168.1.19 private version 2c Console(config)#snmp-server enable traps authentication 4-141 4-142 User Authentication You can restrict management access to this switch using the following options: • • • • • • • User Accounts – Manually configure access rights on the switch for specified users.
PAGE 99
USER AUTHENTICATION Command Attributes • • Account List – Displays the current list of user accounts and associated access levels. (Defaults: admin, and guest) New Account – Displays configuration settings for a new account. - User Name – The name of the user. (Maximum length: 8 characters; maximum number of users: 5) Access Level – Specifies the user level. (Options: Normal and Privileged) Password – Specifies the user password.
PAGE 100
CONFIGURING THE SWITCH CLI – Assign a user name to access-level 15 (i.e., administrator), then specify the password. Console(config)#username bob access-level 15 Console(config)#username bob password 0 smith Console(config)# 4-36 Configuring Local/Remote Logon Authentication Use the Authentication Settings menu to restrict management access based on specified user names and passwords.
PAGE 101
USER AUTHENTICATION Command Usage • By default, management access is always checked against the authentication database stored on the local switch. If a remote authentication server is used, you must specify the authentication sequence and the corresponding parameters for the remote authentication protocol. Local and remote logon authentication control management access via the console port, web browser, or Telnet.
PAGE 102
CONFIGURING THE SWITCH • RADIUS Settings • - Global – Provides globally applicable RADIUS settings. - ServerIndex – Specifies one of five RADIUS servers that may be configured. The switch attempts authentication using the listed sequence of servers. The process ends when a server either approves or denies access to a user. - Server IP Address – Address of authentication server. (Default: 10.1.0.1) - Server Port Number – Network (UDP) port of authentication server used for authentication messages.
PAGE 103
USER AUTHENTICATION Web – Click Security, Authentication Settings. To configure local or remote authentication preferences, specify the authentication sequence (i.e., one to three methods), fill in the parameters for RADIUS or TACACS+ authentication if selected, and click Apply.
PAGE 104
CONFIGURING THE SWITCH CLI – Specify all the required parameters to enable logon authentication. Console(config)#authentication login radius Console(config)#radius-server port 181 Console(config)#radius-server key green Console(config)#radius-server retransmit 5 Console(config)#radius-server timeout 10 Console(config)#radius-server 1 host 192.168.1.
PAGE 105
USER AUTHENTICATION • If you enable HTTPS, you must indicate this in the URL that you specify in your browser: https://device[:port_number] • When you start HTTPS, the connection is established in this way: • • - The client authenticates the server using the server’s digital certificate. - The client and server negotiate a set of security protocols to use for the connection. - The client and server generate session keys for encrypting and decrypting data.
PAGE 106
CONFIGURING THE SWITCH Web – Click Security, HTTPS Settings. Enable HTTPS and specify the port number, then click Apply. Figure 3-26 HTTPS Settings CLI – This example enables the HTTP secure server and modifies the port number.
PAGE 107
USER AUTHENTICATION When you have obtained these, place them on your TFTP server, and use the following command at the switch's command-line interface to replace the default (unrecognized) certificate with an authorized one: Console#copy tftp https-certificate TFTP server ip address: Source certificate file name: Source private file name: Private password: 4-89 Note: The switch must be reset for the new certific
PAGE 108
CONFIGURING THE SWITCH Command Usage The SSH server on this switch supports both password and public key authentication. If password authentication is specified by the SSH client, then the password can be authenticated either locally or via a RADIUS or TACACS+ remote authentication server, as specified on the Authentication Settings page (page 3-50).
PAGE 109
USER AUTHENTICATION 3. Import Client’s Public Key to the Switch – Use the copy tftp public-key command (page 4-89) to copy a file containing the public key for all the SSH client’s granted management access to the switch. (Note that these clients must be configured locally on the switch via the User Accounts page as described on page 3-48.) The clients are subsequently authenticated using these keys.
PAGE 110
CONFIGURING THE SWITCH e. The switch compares the decrypted bytes to the original bytes it sent. If the two sets match, this means that the client's private key corresponds to an authorized public key, and the client is authenticated. Notes: 1. To use SSH with only password authentication, the host public key must still be given to the client, either during initial connection or manually entered into the known host file. However, you do not need to configure the client’s keys. 2.
PAGE 111
USER AUTHENTICATION the client to select either DES (56-bit) or 3DES (168-bit) for data encryption. • Save Host-Key from Memory to Flash – Saves the host key from RAM (i.e., volatile memory to flash memory. Otherwise, the host key pair is stored to RAM by default. Note that you must select this item prior to generating the host-key pair. • Generate – This button is used to generate the host key pair.
PAGE 112
CONFIGURING THE SWITCH CLI – This example generates a host-key pair using both the RSA and DSA algorithms, stores the keys to flash memory, and then displays the host’s public keys.
PAGE 113
USER AUTHENTICATION • SSH Authentication Retries – Specifies the number of authentication attempts that a client is allowed before authentication fails and the client has to restart the authentication process. (Range: 1-5 times; Default: 3) • SSH Server-Key Size – Specifies the SSH server key size. (Range: 512-896 bits; Default:768) - The server key is a private key that is never shared outside the switch. - The host key is shared with the SSH client, and is fixed at 1024 bits.
PAGE 114
CONFIGURING THE SWITCH CLI – This example enables SSH, sets the authentication parameters, and displays the current configuration. It shows that the administrator has made a connection via SHH, and then disables this connection. Console(config)#ip ssh server 4-50 Console(config)#ip ssh timeout 100 4-51 Console(config)#ip ssh authentication-retries 5 4-52 Console(config)#ip ssh server-key size 512 4-52 Console(config)#end Console#show ip ssh 4-56 SSH Enabled - version 2.
PAGE 115
USER AUTHENTICATION already in the address table will be retained and will not age out. Any other device that attempts to use the port will be prevented from accessing the switch. Command Usage • • • A secure port has the following restrictions: - It cannot use port monitoring. - It cannot be a multi-VLAN port. - It cannot be used as a member of a static or dynamic trunk. - It should not be connected to a network interconnection device.
PAGE 116
CONFIGURING THE SWITCH Web – Click Security, Port Security. Set the action to take when an invalid address is detected on a port, mark the checkbox in the Status column to enable security for a port, set the maximum number of MAC addresses allowed on a port, and click Apply.
PAGE 117
USER AUTHENTICATION This switch uses the Extensible 802.1x Authentication client Protocol over LANs (EAPOL) to 1. Client attempts to access a switch port. 2. Switch sends client an identity request. exchange 3. Client sends back identity information. RADIUS 4. Switch forwards this to authentication server. server authentication 5. Authentication server challenges client. 6. Client responds with proper credentials. protocol messages 7. Authentication server approves access. 8.
PAGE 118
CONFIGURING THE SWITCH • The RADIUS server and 802.1X client support EAP. (The switch only supports EAPOL in order to pass the EAP packets from the server to the client.) • The RADIUS server and client also have to support the same EAP authentication type – MD5. (Some clients have native support in Windows, otherwise the dot1x client must support it.) Displaying 802.1X Global Settings The 802.1X protocol provides port authentication. The 802.
PAGE 119
USER AUTHENTICATION CLI – This example shows the default global setting for 802.1X. Console#show dot1x Global 802.1X Parameters system-auth-control: enable 4-115 802.1X Port Summary Port Name Status 1/1 disabled 1/2 disabled . . . 802.1X Port Details Operation Mode Mode Single-Host ForceAuthorized Single-Host ForceAuthorized Authorized n/a n/a 802.1X is disabled on port 1/1 802.1X is disabled on port 26 . . . Console# Configuring 802.1X Global Settings The 802.1X protocol includes port authentication.
PAGE 120
CONFIGURING THE SWITCH CLI – This example enables 802.1X globally for the switch. Console(config)#dot1x system-auth-control Console(config)# 4-109 Configuring Port Settings for 802.1X When 802.1X is enabled, you need to configure the parameters for the authentication process that runs between the client and the switch (i.e., authenticator), as well as the client identity lookup process that runs between the switch and authentication server. These parameters are described in this section.
PAGE 121
USER AUTHENTICATION • Max-Req – Sets the maximum number of times the switch port will retransmit an EAP request packet to the client before it times out the authentication session. (Range: 1-10; Default 2) • Quiet Period – Sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. (Range: 1-65535 seconds; Default: 60) • Re-authen Period – Sets the time period after which a connected client must be re-authenticated.
PAGE 122
CONFIGURING THE SWITCH CLI – This example sets the 802.1X parameters on port 2. For a description of the additional fields displayed in this example, see “show dot1x” on page 4-115.
PAGE 123
USER AUTHENTICATION Displaying 802.1X Statistics This switch can display statistics for dot1x protocol exchanges for any port. Table 3-5 802.1X Statistics Parameter Description Rx EAPOL Start The number of EAPOL Start frames that have been received by this Authenticator. Rx EAPOL Logoff The number of EAPOL Logoff frames that have been received by this Authenticator. Rx EAPOL Invalid The number of EAPOL frames that have been received by this Authenticator in which the frame type is not recognized.
PAGE 124
CONFIGURING THE SWITCH Web – Select Security, 802.1X, Statistics. Select the required port and then click Query. Click Refresh to update the statistics. Figure 3-33 Displaying 802.1X Port Statistics CLI – This example displays the 802.1X statistics for port 4.
PAGE 125
USER AUTHENTICATION Filtering Addresses for Management Access You create a list of up to 16 IP addresses or IP address groups that are allowed management access to the switch through the web interface, SNMP, or Telnet. Command Usage • The management interfaces are open to all IP addresses by default. Once you add an entry to a filter list, access to that interface is restricted to the specified addresses.
PAGE 126
CONFIGURING THE SWITCH • Start IP Address – A single IP address, or the starting address of a range. • End IP Address – The end address of a range. • Add/Remove Filtering Entry – Adds/removes an IP address from the list. Web – Click Security, IP Filter. Enter the IP addresses or range of addresses that are allowed management access to an interface, and click Add IP Filtering Entry to update the filter list.
PAGE 127
ACCESS CONTROL LISTS CLI – This example allows SNMP access for a specific client. Console(config)#management snmp-client 10.1.2.3 Console(config)#end Console#show management all-client Management IP Filter HTTP-Client: Start IP address End IP address ----------------------------------------------1. 10.1.2.1 10.1.2.254 4-39 SNMP-Client: Start IP address End IP address ----------------------------------------------1. 10.1.2.3 10.1.2.
PAGE 128
CONFIGURING THE SWITCH Command Usage The following restrictions apply to ACLs: • • • • Each ACL can have up to 32 rules. The maximum number of ACLs is 88. However, due to resource restrictions, the average number of rules bound to the ports should not exceed 20. This switch supports ACLs for ingress filtering only. However, you can only bind one IP ACL to any port and one MAC ACL globally for ingress filtering. In other words, only two ACLs can be bound to an interface - Ingress IP ACL and Ingress MAC ACL.
PAGE 129
ACCESS CONTROL LISTS - MAC: MAC ACL mode that filters packets based on the source or destination MAC address and the Ethernet frame type (RFC 1060). Web – Click Security, ACL, Configuration. Enter an ACL name in the Name field, select the list type (IP Standard, IP Extended, or MAC), and click Add to open the configuration page for the new list. Figure 3-35 Selecting ACL Type CLI – This example creates a standard IP ACL named david.
PAGE 130
CONFIGURING THE SWITCH Configuring a Standard IP ACL Command Attributes 3-80 • Action – An ACL can contain any combination of permit or deny rules. • Address Type – Specifies the source IP address. Use “Any” to include all possible addresses, “Host” to specify a specific host address in the Address field, or “IP” to specify a range of addresses with the Address and SubMask fields. (Options: Any, Host, IP; Default: Any) • IP Address – Source IP address.
PAGE 131
ACCESS CONTROL LISTS Web – Specify the action (i.e., Permit or Deny). Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet address and the mask for an address range. Then click Add. Figure 3-36 ACL Configuration - Standard IP CLI – This example configures one permit rule for the specific address 10.1.1.21 and another rule for the address range 168.92.16.x – 168.92.31.x using a bitmask. Console(config-std-acl)#permit host 10.1.1.
PAGE 132
CONFIGURING THE SWITCH to specify a range of addresses with the Address and SubMask fields. (Options: Any, Host, IP; Default: Any) • Source/Destination Address – Source or destination IP address. • Source/Destination Subnet Mask – Subnet mask for source or destination address. (See the description for Subnet Mask on page 3-80.) • Service Type – Packet priority settings based on the following criteria: - Precedence – IP precedence level. (Range: 0-8) - TOS – Type of Service level.
PAGE 133
ACCESS CONTROL LISTS For example, use the code value and mask below to catch packets with the following flags set: - SYN flag valid, use control-code 2, control bitmask 2 Both SYN and ACK valid, use control-code 18, control bitmask 18 SYN valid and ACK invalid, use control-code 2, control bitmask 18 Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or IP). If you select “Host,” enter a specific address.
PAGE 134
CONFIGURING THE SWITCH 3. Permit all TCP packets from class C addresses 192.168.1.0 with the TCP control code set to “SYN.” Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any 4-123 Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any destination-port 80 Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any control-flag 2 2 Console(config-std-acl)# Configuring a MAC ACL Command Attributes 3-84 • Action – An ACL can contain any combination of permit or deny rules.
PAGE 135
ACCESS CONTROL LISTS Web – Specify the action (i.e., Permit or Deny). Specify the source and/or destination addresses. Select the address type (Any, Host, or MAC). If you select “Host,” enter a specific address (e.g., 11-22-33-44-55-66). If you select “MAC,” enter a base address and a hexidecimal bitmask for an address range. Set any other required criteria, such as VID or Ethernet type. Then click Add.
PAGE 136
CONFIGURING THE SWITCH Binding a Port to an Access Control List After configuring Access Control Lists (ACL), you should bind them to the ports that need to filter traffic. You can assign one IP access list to any port, but you can only assign one MAC access list to all the ports on the switch. Command Usage • You must configure a mask for an ACL rule before you can bind it to a port. • This switch only supports ACLs for ingress filtering.
PAGE 137
ACCESS CONTROL LISTS Web – Click Security, ACL, Port Binding. Mark the Enabled field for the port you want to bind to an ACL, select the required ACL from the drop-down list, then click Apply. Figure 3-39 Binding a Port to an ACL CLI – This example assigns an IP and MAC access list to port 1, and an IP access list to port 3.
PAGE 138
CONFIGURING THE SWITCH Port Configuration Displaying Connection Status You can use the Port Information or Trunk Information pages to display the current connection status, including link state, speed/duplex mode, flow control, and auto-negotiation. Field Attributes (Web) • Name – Interface label. • Type – Indicates the port type. (100BASE-TX, 1000BASE-T, or SFP) • Admin Status – Shows if the interface is enabled or disabled. • Oper Status – Indicates if the link is Up or Down.
PAGE 139
PORT CONFIGURATION Web – Click Port, Port Information or Trunk Information. Figure 3-40 Displaying Port/Trunk Information Field Attributes (CLI) Basic Information: • Port type – Indicates the port type. (100BASE-TX, 1000BASE-T, or SFP) • MAC address – The physical layer address for this port. (To access this item on the web, see “Setting the Switch’s IP Address” on page 3-17.) Configuration: • Name – Interface label. • Port admin – Shows if the interface is enabled or disabled (i.e., up or down).
PAGE 140
CONFIGURING THE SWITCH - 10full - Supports 10 Mbps full-duplex operation 100half - Supports 100 Mbps half-duplex operation 100full - Supports 100 Mbps full-duplex operation 1000full - Supports 1000 Mbps full-duplex operation Sym - Transmits and receives pause frames for flow control FC - Supports flow control • Broadcast storm – Shows if broadcast storm control is enabled or disabled. • Broadcast storm limit – Shows the broadcast storm threshold.
PAGE 141
PORT CONFIGURATION CLI – This example shows the connection status for Port 5.
PAGE 142
CONFIGURING THE SWITCH • Autonegotiation (Port Capabilities) – Allows auto-negotiation to be enabled/disabled. When auto-negotiation is enabled, you need to specify the capabilities to be advertised. When auto-negotiation is disabled, you can force the settings for speed, mode, and flow control.The following capabilities are supported.
PAGE 143
PORT CONFIGURATION Web – Click Port, Port Configuration or Trunk Configuration. Modify the required interface settings, and click Apply. Figure 3-41 Port/Trunk Configuration CLI – Select the interface, and then enter the required settings. Console(config)#interface ethernet 1/13 Console(config-if)#description RD SW#13 Console(config-if)#shutdown . Console(config-if)#no shutdown Console(config-if)#no negotiation Console(config-if)#speed-duplex 100half Console(config-if)#flowcontrol .
PAGE 144
CONFIGURING THE SWITCH automatically negotiate a trunked link with LACP-configured ports on another device. You can configure any number of ports on the switch as LACP, as long as they are not already configured as part of a static trunk. If ports on another device are also configured as LACP, the switch and the other device will negotiate a trunk link between them. If an LACP trunk consists of more than eight ports, all other ports will be placed in a standby mode.
PAGE 145
PORT CONFIGURATION Statically Configuring a Trunk Command Usage • When configuring static trunks, you may not be able to link switches of different types, depending on the manufacturer’s implementation. However, note that the static trunks on this switch are Cisco EtherChannel compatible.
PAGE 146
CONFIGURING THE SWITCH Web – Click Port, Trunk Membership. Enter a trunk ID of 1-4 in the Trunk field, select any of the switch ports from the scroll-down port list, and click Add. After you have completed adding ports to the member list, click Apply.
PAGE 147
PORT CONFIGURATION CLI – This example creates trunk 2 with ports 1 and 2. Just connect these ports to two static trunk ports on another switch to form a trunk.
PAGE 148
CONFIGURING THE SWITCH • A trunk formed with another switch using LACP will automatically be assigned the next available trunk ID. • If more than eight ports attached to the same target switch have LACP enabled, the additional ports will be placed in standby mode, and will only be enabled if one of the active links fails. • All ports on both ends of an LACP trunk must be configured for full duplex, either by forced mode or auto-negotiation.
PAGE 149
PORT CONFIGURATION CLI – The following example enables LACP for ports 1 to 6. Just connect these ports to LACP-enabled trunk ports on another switch to form a trunk. Console(config)#interface ethernet 1/1 4-146 Console(config-if)#lacp 4-167 Console(config-if)#exit . . .
PAGE 150
CONFIGURING THE SWITCH Note: If the port channel admin key (lacp admin key, page 4-171) is not set (through the CLI) when a channel group is formed (i.e., it has a null value of 0), this key is set to the same value as the port admin key used by the interfaces that joined the group (lacp admin key, as described in this section and on page 4-170). Command Attributes Set Port Actor – This menu sets the local side of an aggregate link; i.e., the ports on this switch. • Port – Port number.
PAGE 151
PORT CONFIGURATION Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and Port Priority for the Port Actor. You can optionally configure these settings for the Port Partner. (Be aware that these settings only affect the administrative state of the partner, and will not take effect until the next time an aggregate link is formed with this device.) After you have completed setting the port LACP parameters, click Apply.
PAGE 152
CONFIGURING THE SWITCH CLI – The following example configures LACP parameters for ports 1-4. Ports 1-4 are used as active members of the LAG. Console(config)#interface ethernet 1/1 4-146 Console(config-if)#lacp actor system-priority 3 4-168 Console(config-if)#lacp actor admin-key 120 4-170 Console(config-if)#lacp actor port-priority 128 4-172 Console(config-if)#exit . . .
PAGE 153
PORT CONFIGURATION Displaying LACP Port Counters You can display statistics for LACP protocol messages. Table 3-6 LACP Port Counters Field Description LACPDUs Sent Number of valid LACPDUs transmitted from this channel group. LACPDUs Received Number of valid LACPDUs received on this channel group. Marker Sent Number of valid Marker PDUs transmitted from this channel group. Marker Received Number of valid Marker PDUs received by this channel group.
PAGE 154
CONFIGURING THE SWITCH CLI – The following example displays LACP counters. Console#show lacp counters 4-173 Port channel : 1 ------------------------------------------------------------------Eth 1/ 1 ------------------------------------------------------------------LACPDUs Sent: 91 LACPDUs Receive: 43 Marker Sent: 0 Marker Receive: 0 LACPDUs Unknown Pkts: 0 LACPDUs Illegal Pkts: 0 . . .
PAGE 155
PORT CONFIGURATION Table 3-7 LACP Internal Configuration Information (Continued) Field Description LACP Port Priority LACP port priority assigned to this interface within the channel group. Admin State, Administrative or operational values of the actor’s state parameters: Oper State • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner.
PAGE 156
CONFIGURING THE SWITCH Web – Click Port, LACP, Port Internal Information. Select a port channel to display the corresponding information. Figure 3-46 LACP - Port Internal Information CLI – The following example displays the LACP configuration settings and operational state for the local side of port channel 1.
PAGE 157
PORT CONFIGURATION Displaying LACP Settings and Status for the Remote Side You can display configuration settings and the operational state for the remote side of an link aggregation. Table 3-8 LACP Neighbor Configuration Information Field Description Partner Admin System ID LAG partner’s system ID assigned by the user. Partner Oper System LAG partner’s system ID assigned by the LACP protocol. ID Partner Admin Port Number Current administrative value of the port number for the protocol Partner.
PAGE 158
CONFIGURING THE SWITCH Web – Click Port, LACP, Port Neighbors Information. Select a port channel to display the corresponding information. Figure 3-47 LACP - Port Neighbors Information CLI – The following example displays the LACP configuration settings and operational state for the remote side of port channel 1.
PAGE 159
PORT CONFIGURATION Setting Broadcast Storm Thresholds Broadcast storms may occur when a device on your network is malfunctioning, or if application programs are not well designed or properly configured. If there is too much broadcast traffic on your network, performance can be severely degraded or everything can come to complete halt. You can protect your network from broadcast storms by setting a threshold for broadcast traffic. Any broadcast packets exceeding the specified threshold will then be dropped.
PAGE 160
CONFIGURING THE SWITCH Web – Click Port, Port/Trunk Broadcast Control. Set the threshold, mark the Enabled field for the desired interface and click Apply.
PAGE 161
PORT CONFIGURATION CLI – Specify any interface, and then enter the threshold. The following disables broadcast storm control for port 1, and then sets broadcast suppression at 600 octets per second for port 2 (which applies to all ports).
PAGE 162
CONFIGURING THE SWITCH Command Attributes • Mirror Sessions – Displays a list of current mirror sessions. • Source Unit – The unit whose port traffic will be monitored. • Source Port – The port whose traffic will be monitored. • Type – Allows you to select which traffic to mirror to the target port, Rx (receive), or Tx (transmit). • Target Unit – The unit whose port will “duplicate” or “mirror” the traffic on the source port.
PAGE 163
PORT CONFIGURATION Configuring Rate Limits This function allows the network manager to control the maximum rate for traffic transmitted or received on a port. Rate limiting is configured on ports at the edge of a network to limit traffic coming into or out of the network. Traffic that falls within the rate limit is transmitted, while packets that exceed the acceptable amount of traffic are dropped. Rate limiting can be applied to individual ports or trunks.
PAGE 164
CONFIGURING THE SWITCH CLI - This example sets and displays Fast Ethernet and Gigabit Ethernet granularity. Console(config)#rate-limit fastethernet granularity 512 4-162 Console(config)#rate-limit gigabitethernet granularity 33300 4-162 console#show rate-limit 4-163 Fast ethernet granularity: 512 Gigabit ethernet granularity: Console# 33300 Rate Limit Configuration Use the rate limit configuration pages to apply rate limiting.
PAGE 165
PORT CONFIGURATION Web – Click Port, Rate Limit, Input/Output Port/Trunk Configuration. Enable the Rate Limit Status for the required interfaces, set the Rate Limit Level, and click Apply. Figure 3-51 Output Rate Limit Port Configuration CLI - This example sets the rate limit level for input and output traffic passing through port 3.
PAGE 166
CONFIGURING THE SWITCH Note: RMON groups 2, 3 and 9 can only be accessed using SNMP management software such as MC EliteView. Table 3-9 Port Statistics Parameter Description Interface Statistics 3-116 Received Octets The total number of octets received on the interface, including framing characters. Received Unicast Packets The number of subnetwork-unicast packets delivered to a higher-layer protocol.
PAGE 167
PORT CONFIGURATION Table 3-9 Port Statistics (Continued) Parameter Description Transmit Multicast Packets The total number of packets that higher-level protocols requested be transmitted, and which were addressed to a multicast address at this sub-layer, including those that were discarded or not sent.
PAGE 168
CONFIGURING THE SWITCH Table 3-9 Port Statistics (Continued) Parameter Description Multiple Collision Frames A count of successfully transmitted frames for which transmission is inhibited by more than one collision. Carrier Sense Errors The number of times that the carrier sense condition was lost or never asserted when attempting to transmit a frame. SQE Test Errors A count of times that the SQE TEST ERROR message is generated by the PLS sublayer for a particular interface.
PAGE 169
PORT CONFIGURATION Table 3-9 Port Statistics (Continued) Parameter Description Multicast Frames The total number of good frames received that were directed to this multicast address. CRC/Alignment Errors The number of CRC/alignment errors (FCS or alignment errors). Undersize Frames The total number of frames received that were less than 64 octets long (excluding framing bits, but including FCS octets) and were otherwise well formed.
PAGE 170
CONFIGURING THE SWITCH Web – Click Port, Port Statistics. Select the required interface, and click Query. You can also use the Refresh button at the bottom of the page to update the screen.
PAGE 171
PORT CONFIGURATION CLI – This example shows statistics for port 13.
PAGE 172
CONFIGURING THE SWITCH Address Table Settings Switches store the addresses for all known devices. This information is used to pass traffic directly between the inbound and outbound ports. All the addresses learned by monitoring traffic are stored in the dynamic address table. You can also manually configure static addresses that are bound to a specific port. Setting Static Addresses A static address can be assigned to a specific interface on this switch.
PAGE 173
ADDRESS TABLE SETTINGS Web – Click Address Table, Static Addresses. Specify the interface, the MAC address and VLAN, then click Add Static Address. Figure 3-53 Configuring a Static Address Table CLI – This example adds an address to the static address table, but sets it to be deleted when the switch is reset.
PAGE 174
CONFIGURING THE SWITCH • MAC Address – Physical address associated with this interface. • VLAN – ID of configured VLAN (1-4094). • Address Table Sort Key – You can sort the information displayed based on MAC address, VLAN or interface (port or trunk). • Dynamic Address Counts – The number of addresses dynamically learned. • Current Dynamic Address Table – Lists all the dynamic addresses. Web – Click Address Table, Dynamic Addresses. Specify the search type (i.e.
PAGE 175
SPANNING TREE ALGORITHM CONFIGURATION Changing the Aging Time You can set the aging time for entries in the dynamic address table. Command Attributes • Aging Status – Enables/disables the function. • Aging Time – The time after which a learned entry is discarded. (Range: 10-1000000 seconds; Default: 300 seconds) Web – Click Address Table, Address Aging. Specify the new aging time, click Apply. Figure 3-55 Setting the Address Aging Time CLI – This example sets the aging time to 400 seconds.
PAGE 176
CONFIGURING THE SWITCH The spanning tree algorithms supported by this switch include these versions: • STP – Spanning Tree Protocol (IEEE 802.1D) • RSTP – Rapid Spanning Tree Protocol (IEEE 802.1w) STA uses a distributed algorithm to select a bridging device (STA-compliant switch, bridge or router) that serves as the root of the spanning tree network.
PAGE 177
SPANNING TREE ALGORITHM CONFIGURATION that can be used when a node or port fails, and retaining the forwarding database for ports insensitive to changes in the tree structure when reconfiguration occurs. Displaying Global Settings You can display a summary of the current bridge STA information that applies to the entire switch using the STA Information screen. Field Attributes • Spanning Tree State – Shows if the switch is enabled to participate in an STA-compliant network.
PAGE 178
CONFIGURING THE SWITCH • • • Designated Root – The priority and MAC address of the device in the Spanning Tree that this switch has accepted as the root device. - Root Port – The number of the port on this switch that is closest to the root. This switch communicates with the root device through this port. If there is no root port, then this switch has been accepted as the root device of the Spanning Tree network. - Root Path Cost – The path cost from the root port on this switch to the root device.
PAGE 179
SPANNING TREE ALGORITHM CONFIGURATION • Root Forward Delay – The maximum time (in seconds) this device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a discarding state; otherwise, temporary data loops might result.
PAGE 180
CONFIGURING THE SWITCH CLI – This command displays global STA settings, followed by settings for each port. Console#show spanning-tree 4-196 Spanning-tree information --------------------------------------------------------------Spanning tree mode :RSTP Spanning tree enable/disable :enabled Priority :32768 Bridge Hello Time (sec.) :2 Bridge Max Age (sec.) :20 Bridge Forward Delay (sec.) :15 Root Hello Time (sec.) :2 Root Max Age (sec.) :20 Root Forward Delay (sec.) :15 Designated Root :32768.0.
PAGE 181
SPANNING TREE ALGORITHM CONFIGURATION Configuring Global Settings Global settings apply to the entire switch. Command Usage • Spanning Tree Algorithm6 Uses RSTP for the internal state machine, but sends only 802.1D BPDUs. • Rapid Spanning Tree Protocol* RSTP supports connections to either STP or RSTP nodes by monitoring the incoming protocol messages and dynamically adjusting the type of protocol messages the RSTP node transmits, as described below: - STP Mode – If the switch receives an 802.1D BPDU (i.
PAGE 182
CONFIGURING THE SWITCH • Priority – Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device. (Note that lower numeric values indicate higher priority.
PAGE 183
SPANNING TREE ALGORITHM CONFIGURATION • Forward Delay – The maximum time (in seconds) this device will wait before changing states (i.e., discarding to learning to forwarding). This delay is required because every device must receive information about topology changes before it starts to forward frames. In addition, each port needs time to listen for conflicting information that would make it return to a discarding state; otherwise, temporary data loops might result.
PAGE 184
CONFIGURING THE SWITCH Web – Click Spanning Tree, STA, Configuration. Modify the required attributes, and click Apply. Figure 3-57 STA Configuration CLI – This example enables Spanning Tree Protocol, sets the mode to RSTP, and then configures the STA and RSTP parameters.
PAGE 185
SPANNING TREE ALGORITHM CONFIGURATION Displaying Interface Settings The STA Port Information and STA Trunk Information pages display the current status of ports and trunks in the Spanning Tree. Field Attributes • Spanning Tree – Shows if STA has been enabled on this interface. • STA Status – Displays current state of this port within the Spanning Tree: - Discarding - Port receives STA configuration messages, but does not forward packets.
PAGE 186
CONFIGURING THE SWITCH • Designated Port – The port priority and number of the port on the designated bridging device through which this switch must communicate with the root of the Spanning Tree. • Oper Link Type – The operational point-to-point status of the LAN segment attached to this interface. This parameter is determined by manual configuration or by auto-detection, as described for Admin Link Type in STA Port Configuration on page 3-139.
PAGE 187
SPANNING TREE ALGORITHM CONFIGURATION R A x • Backup port receives more useful BPDUs from the same bridge and is therefore not selected as the designated port. R D B Trunk Member – Indicates if a port is a member of a trunk. (STA Port Information only) These additional parameters are only displayed for the CLI: • Admin status – Shows if this interface is enabled. • Path cost – This parameter is used by the STA to determine the best path between devices.
PAGE 188
CONFIGURING THE SWITCH • Admin Edge Port – You can enable this option if an interface is attached to a LAN segment that is at the end of a bridged LAN or to an end node. Since end nodes cannot cause forwarding loops, they can pass directly through to the spanning tree forwarding state.
PAGE 189
SPANNING TREE ALGORITHM CONFIGURATION CLI – This example shows the STA attributes for port 5. Console#show spanning-tree ethernet 1/5 4-196 Eth 1/ 5 information -------------------------------------------------------------Admin status : enabled Role : designate State : discarding Path cost : 10000 Priority : 128 Designated cost : 0 Designated port : 128.5 Designated root : 61440.0.0000E9313131 Designated bridge : 61440.0.
PAGE 190
CONFIGURING THE SWITCH • contradictory information. Port address table is cleared, and the port begins learning addresses. - Forwarding - Port forwards packets, and continues learning addresses. Trunk – Indicates if a port is a member of a trunk. (STA Port Configuration only) The following interface attributes can be configured: • Spanning Tree – Enables/disables STA on this interface. (Default: Enabled). • Priority – Defines the priority used for this port in the Spanning Tree Protocol.
PAGE 191
SPANNING TREE ALGORITHM CONFIGURATION - Default – - Ethernet – Half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 - Fast Ethernet – Half duplex: 200,000; full duplex: 100,000; trunk: 50,000 - Gigabit Ethernet – Full duplex: 10,000; trunk: 5,000 • Admin Link Type – The link type attached to this interface. - Point-to-Point – A connection to exactly one other bridge. - Shared – A connection to two or more bridges.
PAGE 192
CONFIGURING THE SWITCH Web – Click Spanning Tree, STA, Port Configuration or Trunk Configuration. Modify the required attributes, then click Apply. Figure 3-59 STA Port Configuration CLI – This example sets STA attributes for port 7.
PAGE 193
VLAN CONFIGURATION VLANs help to simplify network management by allowing you to move devices to a new VLAN without having to change any physical connections. VLANs can be easily organized to reflect departmental groups (such as Marketing or R&D), usage groups (such as e-mail), or multicast groups (used for multimedia applications such as videoconferencing).
PAGE 194
CONFIGURING THE SWITCH Note: VLAN-tagged frames can pass through VLAN-aware or VLAN-unaware network interconnection devices, but the VLAN tags should be stripped off before passing it on to any end-node host that does not support VLAN tagging. tagged frames VA VA VA: VLAN Aware VU: VLAN Unaware tagged frames VA untagged frames VA VU VLAN Classification – When the switch receives a frame, it classifies the frame in one of two ways.
PAGE 195
VLAN CONFIGURATION Automatic VLAN Registration – GVRP (GARP VLAN Registration Protocol) defines a system whereby the switch can automatically learn the VLANs to which each end station should be assigned. If an end station (or its network adapter) supports the IEEE 802.1Q VLAN protocol, it can be configured to broadcast a message to your network indicating the VLAN groups it wants to join.
PAGE 196
CONFIGURING THE SWITCH Port-based VLAN 2 1 9 10 11 3 4 5 13 12 6 15 16 14 7 8 18 19 Forwarding Tagged/Untagged Frames If you want to create a small port-based VLAN for devices attached directly to a single switch, you can assign ports to the same untagged VLAN. However, to participate in a VLAN group that crosses several switches, you should create a VLAN for that group and enable tagging on all ports. Ports can be assigned to multiple tagged or untagged VLANs.
PAGE 197
VLAN CONFIGURATION Enabling or Disabling GVRP (Global Setting) GARP VLAN Registration Protocol (GVRP) defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. VLANs are dynamically configured based on join messages issued by host devices and propagated throughout the network. GVRP must be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch. (Default: Disabled) Web – Click VLAN, 802.
PAGE 198
CONFIGURING THE SWITCH • Maximum Number of Supported VLANs – Maximum number of VLANs that can be configured on this switch. Web – Click VLAN, 802.1Q VLAN, Basic Information. Figure 3-61 VLAN Basic Information CLI – Enter the following command.
PAGE 199
VLAN CONFIGURATION • Status – Shows how this VLAN was added to the switch. - Dynamic GVRP: Automatically learned via GVRP. - Permanent: Added as a static entry. • Egress Ports – Shows all the VLAN port members. • Untagged Ports – Shows the untagged VLAN port members. Web – Click VLAN, 802.1Q VLAN, Current Table. Select any ID from the scroll-down list. Figure 3-62 Displaying Current VLANs Command Attributes (CLI) • VLAN – ID of configured VLAN (1-4094, no leading zeroes).
PAGE 200
CONFIGURING THE SWITCH • Status – Shows if this VLAN is enabled or disabled. - Active: VLAN is operational. - Suspend: VLAN is suspended; i.e., does not pass packets. • Ports / Channel groups – Shows the VLAN interface members. CLI – Current VLAN information can be displayed with the following command.
PAGE 201
VLAN CONFIGURATION • State (CLI) – Enables or disables the specified VLAN. - Active: VLAN is operational. - Suspend: VLAN is suspended; i.e., does not pass packets. • Add – Adds a new VLAN group to the current list. • Remove – Removes a VLAN group from the current list. If any port is assigned to this group as untagged, it will be reassigned to VLAN group 1 as untagged. Web – Click VLAN, 802.1Q VLAN, Static List.
PAGE 202
CONFIGURING THE SWITCH Adding Static Members to VLANs (VLAN Index) Use the VLAN Static Table to configure port members for the selected VLAN index. Assign ports as tagged if they are connected to 802.1Q VLAN compliant devices, or untagged they are not connected to any VLAN-aware devices. Or configure a port as forbidden to prevent the switch from automatically adding it to a VLAN via the GVRP protocol. Notes: 1.
PAGE 203
VLAN CONFIGURATION • • Membership Type – Select VLAN membership for each interface by marking the appropriate radio button for a port or trunk: - Tagged: Interface is a member of the VLAN. All packets transmitted by the port will be tagged, that is, carry a tag and therefore carry VLAN or CoS information. - Untagged: Interface is a member of the VLAN. All packets transmitted by the port will be untagged, that is, not carry a tag and therefore not carry VLAN or CoS information.
PAGE 204
CONFIGURING THE SWITCH Web – Click VLAN, 802.1Q VLAN, Static Table. Select a VLAN ID from the scroll-down list. Modify the VLAN name and status if required. Select the membership type by marking the appropriate radio button in the list of ports or trunks. Click Apply. Figure 3-64 Configuring a VLAN Static Table CLI – The following example adds tagged and untagged ports to VLAN 2.
PAGE 205
VLAN CONFIGURATION • Member – VLANs for which the selected interface is a tagged member. • Non-Member – VLANs for which the selected interface is not a tagged member. Web – Open VLAN, 802.1Q VLAN, Static Membership by Port. Select an interface from the scroll-down box (Port or Trunk). Click Query to display membership information for the interface. Select a VLAN ID, and then click Add to add the interface as a tagged member, or click Remove to remove the interface.
PAGE 206
CONFIGURING THE SWITCH Configuring VLAN Behavior for Interfaces You can configure VLAN behavior for specific interfaces, including the default VLAN identifier (PVID), accepted frame types, ingress filtering, GVRP status, and GARP timers. Command Usage • GVRP – GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network.
PAGE 207
VLAN CONFIGURATION - If ingress filtering is disabled and a port receives frames tagged for VLANs for which it is not a member, these frames will be flooded to all other ports (except for those VLANs explicitly forbidden on this port). - If ingress filtering is enabled and a port receives frames tagged for VLANs for which it is not a member, these frames will be discarded. - Ingress filtering does not affect VLAN independent BPDU frames, such as GVRP or STP.
PAGE 208
CONFIGURING THE SWITCH • • Mode – Indicates VLAN membership mode for an interface. (Default: Hybrid) - 1Q Trunk – Specifies a port as an end-point for a VLAN trunk. A trunk is a direct link between two switches, so the port transmits tagged frames that identify the source VLAN. However, note that frames belonging to the port’s default VLAN (i.e., associated with the PVID) are also transmitted as tagged frames. - Hybrid – Specifies a hybrid VLAN interface. The port may transmit tagged or untagged frames.
PAGE 209
VLAN CONFIGURATION CLI – This example sets port 3 to accept only tagged frames, assigns PVID 3 as the native VLAN ID, enables GVRP, sets the GARP timers, and then sets the switchport mode to hybrid.
PAGE 210
CONFIGURING THE SWITCH To configure private VLANs, follow these steps: 1. Use the Private VLAN Configuration menu (page 3-161) to designate one or more isolated and community VLANs, and the primary VLAN that will channel traffic outside of the VLAN groups. 2. Use the Private VLAN Association menu (page 3-163) to map the secondary (i.e., isolate and community) VLAN(s) to the primary VLAN. 3. Use the Private VLAN Port Configuration menu (page 3-165) to set the port type to promiscuous (i.e.
PAGE 211
VLAN CONFIGURATION Web – Click VLAN, Private VLAN, Information. Select the desired port from the VLAN ID drop-down menu. Figure 3-67 Private VLAN Information CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as a host ports and are associated with VLAN 6. This means that traffic for port 4 and 5 can only pass through port 3.
PAGE 212
CONFIGURING THE SWITCH • Type – There are three types of VLANs within a private VLAN: • - Primary VLANs – Conveys traffic between promiscuous ports, and to community ports within secondary VLANs. - Community VLANs - Conveys traffic between community ports, and to their associated promiscuous ports. - Isolated VLANs – Conveys traffic only between the VLAN’s isolated ports and promiscuous ports. Traffic between isolated ports within the VLAN is blocked.
PAGE 213
VLAN CONFIGURATION Associating VLANs Each community or isolated VLAN must be associated with a primary VLAN. Command Attributes • Primary VLAN ID – ID of primary VLAN (1-4094). • Association – Community or isolated VLANs associated with the selected primary VLAN. • Non-Association – Community or isolated VLANs not associated with the selected primary VLAN. Web – Click VLAN, Private VLAN, Association.
PAGE 214
CONFIGURING THE SWITCH Displaying Private VLAN Interface Information Use the Private VLAN Port Information and Private VLAN Trunk Information menus to display the interfaces associated with private VLANs. Command Attributes • Port/Trunk – The switch interface. • PVLAN Port Type – Displays private VLAN port types. • 3-164 - Normal – The port is not configured in a private VLAN.
PAGE 215
VLAN CONFIGURATION Web – Click VLAN, Private VLAN, Port Information or Trunk Information. Figure 3-70 Private VLAN Port Information CLI – This example shows the switch configured with primary VLAN 5 and community VLAN 6. Port 3 has been configured as a promiscuous port and mapped to VLAN 5, while ports 4 and 5 have been configured as host ports and associated with VLAN 6. This means that traffic for port 4 and 5 can only pass through port 3.
PAGE 216
CONFIGURING THE SWITCH - Host – The port is a community port and can only communicate with other ports in its own community VLAN, and with the designated promiscuous port(s). - Promiscuous – A promiscuous port can communicate with all interfaces within a private VLAN. 3-166 • Primary VLAN – Conveys traffic between promiscuous ports, and between promiscuous ports and community ports within the associated secondary VLANs. If PVLAN type is “Promiscuous,” then specify the associated primary VLAN.
PAGE 217
VLAN CONFIGURATION Web – Click VLAN, Private VLAN, Port Configuration or Trunk Configuration. Set the PVLAN Port Type for each port that will join a private VLAN. For promiscuous ports, set the associated primary VLAN. For host ports, set the associated secondary VLAN. For isolated ports, set the associated isolated VLAN. After all the ports have been configured, click Apply. Figure 3-71 Private VLAN Port Configuration CLI – This example shows the switch configured with primary VLAN 5 and secondary VLAN 6.
PAGE 218
CONFIGURING THE SWITCH Class of Service Configuration Class of Service (CoS) allows you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with four priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues. You can set the default priority for each interface, and configure the mapping of frame priority tags to the switch’s priority queues.
PAGE 219
CLASS OF SERVICE CONFIGURATION Command Attributes • Default Priority9 – The priority that is assigned to untagged frames received on the specified interface. (Range: 0-7, Default: 0) • Number of Egress Traffic Classes – The number of queue buffers provided for each port. Web – Click Priority, Default Port Priority or Default Trunk Priority. Modify the default priority for any interface, then click Apply.
PAGE 220
CONFIGURING THE SWITCH Mapping CoS Values to Egress Queues This switch processes Class of Service (CoS) priority tagged traffic by using four priority queues for each port, with service schedules based on strict or Weighted Round Robin (WRR). Up to eight separate traffic priorities are defined in IEEE 802.1p. The default priority levels are assigned according to recommendations in the IEEE 802.1p standard as shown in the following table.
PAGE 221
CLASS OF SERVICE CONFIGURATION Command Attributes • Priority – CoS value. (Range: 0-7, where 7 is the highest priority) • Traffic Class10 – Output queue buffer. (Range: 0-3, where 3 is the highest CoS priority queue) Web – Click Priority, Traffic Classes. Assign priorities to the traffic classes (i.e., output queues), then click Apply. Figure 3-73 Traffic Classes CLI – The following example shows how to change the CoS assignments to a one-to-one mapping.
PAGE 222
CONFIGURING THE SWITCH Selecting the Queue Mode You can set the switch to service the queues based on a strict rule that requires all traffic in a higher priority queue to be processed before lower priority queues are serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative weight of each queue. WRR uses a predefined relative weight for each queue that determines the percentage of service time the switch services each queue before moving on to the next queue.
PAGE 223
CLASS OF SERVICE CONFIGURATION Setting the Service Weight for Traffic Classes This switch uses the Weighted Round Robin (WRR) algorithm to determine the frequency at which it services each priority queue. As described in “Mapping CoS Values to Egress Queues” on page 3-170, the traffic classes are mapped to one of the four egress queues provided for each port. You can assign a weight to each of these queues (and thereby to the corresponding traffic priorities).
PAGE 224
CONFIGURING THE SWITCH CLI – The following example shows how to assign WRR weights to each of the priority queues. Console(config)#queue bandwidth 6 9 12 Console(config)#exit Console#show queue bandwidth Queue ID Weight -------- -----0 1 1 6 2 9 3 12 Console 4-225 4-227 Layer 3/4 Priority Settings Mapping Layer 3/4 Priorities to CoS Values This switch supports several common methods of prioritizing layer 3/4 traffic to meet application requirements.
PAGE 225
CLASS OF SERVICE CONFIGURATION Selecting IP Precedence/DSCP Priority The switch allows you to choose between using IP Precedence or DSCP priority. Select one of the methods or disable this feature. Command Attributes • Disabled – Disables both priority services. (This is the default setting.) • IP Precedence – Maps layer 3/4 priorities using IP Precedence. • IP DSCP – Maps layer 3/4 priorities using Differentiated Services Code Point Mapping. Web – Click Priority, IP Precedence/DSCP Priority Status.
PAGE 226
CONFIGURING THE SWITCH Table 3-12 Mapping IP Precedence Priority Level Traffic Type Priority Level Traffic Type 7 Network Control 3 6 Internetwork Control 2 Immediate 5 Critical 1 Priority 4 Flash Override 0 Routine Flash Command Attributes • IP Precedence Priority Table – Shows the IP Precedence to CoS map. • Class of Service Value – Maps a CoS value to the selected IP Precedence value. Note that “0” represents low priority and “7” represent high priority.
PAGE 227
CLASS OF SERVICE CONFIGURATION CLI – The following example globally enables IP Precedence service on the switch, maps IP Precedence value 1 to CoS value 0 (on port 1), and then displays the IP Precedence settings.
PAGE 228
CONFIGURING THE SWITCH Table 3-13 Mapping DSCP Priority Values IP DSCP Value CoS Value 18, 20, 22, 24 3 26, 28, 30, 32, 34, 36 4 38, 40, 42 5 48 6 46, 56 7 Command Attributes • DSCP Priority Table – Shows the DSCP Priority to CoS map. • Class of Service Value – Maps a CoS value to the selected DSCP Priority value. Note that “0” represents low priority and “7” represent high priority. Note: IP DSCP settings apply to all interfaces. Web – Click Priority, IP DSCP Priority.
PAGE 229
CLASS OF SERVICE CONFIGURATION CLI – The following example globally enables DSCP Priority service on the switch, maps DSCP value 0 to CoS value 1 (on port 1), and then displays the DSCP Priority settings. Console(config)#map ip dscp Console(config)#interface ethernet 1/1 Console(config-if)#map ip dscp 1 cos 0 Console(config-if)#end Console#show map ip dscp ethernet 1/1 DSCP mapping status: enabled 4-233 4-146 4-233 4-237 Port DSCP COS --------- ---- --Eth 1/ 1 0 0 Eth 1/ 1 1 0 Eth 1/ 1 2 0 Eth 1/ 1 3 0 .
PAGE 230
CONFIGURING THE SWITCH Web – Click Priority, IP Port Priority Status. Set IP Port Priority Status to Enabled. Figure 3-79 IP Port Priority Status Click Priority, IP Port Priority. Enter the port number for a network application in the IP Port Number box and the new CoS value in the Class of Service box, and then click Apply.
PAGE 231
CLASS OF SERVICE CONFIGURATION CLI – The following example globally enables IP Port Priority service on the switch, maps HTTP traffic on port 5 to CoS value 0, and then displays all the IP Port Priority settings for that port. Console(config)#map ip port Console(config)#interface ethernet 1/5 Console(config-if)#map ip port 80 cos 0 Console(config-if)#end Console#show map ip port ethernet 1/5 TCP port mapping status: enabled 4-229 4-230 4-230 Port Port no.
PAGE 232
CONFIGURING THE SWITCH • ACL CoS Priority Mapping – Displays the configured information. * For information on configuring ACLs, see page 3-77. Web – Click Priority, ACL CoS Priority. Enable mapping for any port, select an ACL from the scroll-down list, then click Add. Figure 3-81 ACL CoS Priority CLI – This example assigns a CoS value of zero to packets matching rules within the specified ACL on port 24.
PAGE 233
MULTICAST FILTERING Multicast Filtering Multicasting is used to support real-time Unicast Flow applications such as videoconferencing or streaming audio. A multicast server does not have to establish a separate connection with each client. It merely broadcasts its service to the network, and any hosts that want to receive the multicast register with their local Multicast multicast switch/router.
PAGE 234
CONFIGURING THE SWITCH Layer 2 IGMP (Snooping and Query) IGMP Snooping and Query – If multicast routing is not supported on other switches in your network, you can use IGMP Snooping and Query (page 3-184) to monitor IGMP service requests passing between multicast clients and servers, and dynamically configure the switch ports which need to forward multicast traffic. Static IGMP Router Interface – If IGMP snooping cannot locate the IGMP querier, you can manually designate a known IGMP querier (i.e.
PAGE 235
MULTICAST FILTERING multicasting, one of these devices is elected “querier” and assumes the role of querying the LAN for group members. It then propagates the service requests on to any upstream multicast switch/router to ensure that it will continue to receive the multicast service. Note: Multicast routers use this information, along with a multicast routing protocol such as DVMRP or PIM, to support IP multicasting across the Internet.
PAGE 236
CONFIGURING THE SWITCH Notes: 1. All systems on the subnet must support the same version. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Timeout. Web – Click IGMP Snooping, IGMP Configuration. Adjust the IGMP settings as required, and then click Apply. (The default settings are shown below.) Figure 3-82 IGMP Configuration CLI – This example modifies the settings for multicast filtering, and then displays the current status.
PAGE 237
MULTICAST FILTERING Displaying Interfaces Attached to a Multicast Router Multicast routers that are attached to ports on the switch use information obtained from IGMP, along with a multicast routing protocol such as DVMRP or PIM, to support IP multicasting across the Internet. These routers may be dynamically discovered by the switch or statically assigned to an interface on the switch.
PAGE 238
CONFIGURING THE SWITCH CLI – This example shows that Port 11 has been statically configured as a port attached to a multicast router. Console#show ip igmp snooping mrouter vlan 1 VLAN M'cast Router Port Type ---- ------------------ ------1 Eth 1/11 Static Console# 4-248 Specifying Static Interfaces for a Multicast Router Depending on your network connections, IGMP snooping may not always be able to locate the IGMP querier.
PAGE 239
MULTICAST FILTERING Web – Click IGMP Snooping, Static Multicast Router Port Configuration. Specify the interfaces attached to a multicast router, indicate the VLAN which will forward all the corresponding multicast traffic, and then click Add. After you have finished adding interfaces to the list, click Apply. Figure 3-84 Static Multicast Router Port Configuration CLI – This example configures port 11 as a multicast router port within VLAN 1.
PAGE 240
CONFIGURING THE SWITCH Web – Click IGMP Snooping, IP Multicast Registration Table. Select a VLAN ID and the IP address for a multicast service from the scroll-down lists. The switch will display all the interfaces that are propagating this multicast service. Figure 3-85 IP Multicast Registration Table CLI – This example displays all the known multicast services supported on VLAN 1, along with the ports propagating the corresponding services.
PAGE 241
MULTICAST FILTERING Assigning Ports to Multicast Services Multicast filtering can be dynamically configured using IGMP Snooping and IGMP Query messages as described in “Configuring IGMP snooping and Query Parameters” on page 3-133. For certain applications that require tighter control, you may need to statically configure a multicast service on the switch. First add all the ports attached to participating hosts to a common VLAN, and then assign the multicast service to that VLAN group.
PAGE 242
CONFIGURING THE SWITCH Web – Click IGMP Snooping, IGMP Member Port Table. Specify the interface attached to a multicast service (via an IGMP-enabled switch or multicast router), indicate the VLAN that will propagate the multicast service, specify the multicast IP address, and click Add. After you have completed adding ports to the member list, click Apply.
PAGE 243
CHAPTER 4 COMMAND LINE INTERFACE This chapter describes how to use the Command Line Interface (CLI). Using the Command Line Interface Accessing the CLI When accessing the management interface for the switch over a direct connection to the server’s console port, or via a Telnet connection, the switch can be managed by entering command keywords and parameters at the prompt. Using the switch's command-line interface (CLI) is very similar to entering commands on a UNIX system.
PAGE 244
COMMAND LINE INTERFACE After connecting to the system through the console port, the login screen displays: User Access Verification Username: admin Password: CLI session with the SMC6224M is opened. To end the CLI session, enter [Exit]. Console# Telnet Connection Telnet operates over the IP transport protocol. In this environment, your management station and any network device you want to manage over the network must have a valid IP address.
PAGE 245
USING THE COMMAND LINE INTERFACE 2. At the prompt, enter the user name and system password. The CLI will display the “Vty-n#” prompt for the administrator to show that you are using privileged access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you are using normal access mode (i.e., Normal Exec), where n indicates the number of the current Telnet session. 3. Enter the necessary commands to complete your desired tasks. 4.
PAGE 246
COMMAND LINE INTERFACE Entering Commands This section describes how to enter CLI commands. Keywords and Arguments A CLI command is a series of keywords and arguments. Keywords identify a command, and arguments specify configuration parameters. For example, in the command “show interfaces status ethernet 1/5,” show interfaces and status are keywords, ethernet is an argument that specifies the interface type, and 1/5 specifies the unit/port.
PAGE 247
ENTERING COMMANDS Command Completion If you terminate input with a Tab key, the CLI will print the remaining characters of a partial keyword up to the point of ambiguity. In the “logging history” example, typing log followed by a tab will result in printing the command up to “logging.” Getting Help on Commands You can display a brief description of the help system by entering the help command. You can also display command syntax by using the “?” character to list keywords or parameters.
PAGE 248
COMMAND LINE INTERFACE Showing Commands If you enter a “?” at the command prompt, the system will display the first level of keywords for the current command class (Normal Exec or Privileged Exec) or configuration class (Global, ACL, Interface, Line or VLAN Database). You can also display a list of valid keywords for a specific command.
PAGE 249
ENTERING COMMANDS The command “show interfaces ?” will display the following information: Console#show interfaces ? counters Interface counters information status Interface status information switchport Interface switchport information Console# Partial Keyword Lookup If you terminate a partial keyword with a question mark, alternatives that match the initial letters are provided. (Remember not to leave a space between the command and question mark.) For example “s?” shows all the keywords starting with “s.
PAGE 250
COMMAND LINE INTERFACE Understanding Command Modes The command set is divided into Exec and Configuration classes. Exec commands generally display information on system status or clear statistical counters. Configuration commands, on the other hand, modify interface parameters or enable certain switching functions. These classes are further divided into different modes. Available commands depend on the selected mode.
PAGE 251
ENTERING COMMANDS Privileged Exec mode from within Normal Exec mode, by entering the enable command, followed by the privileged level password “super” (page 4-37). To enter Privileged Exec mode, enter the following user names and passwords: Username: admin Password: [admin login password] CLI session with the SMC6624M is opened. To end the CLI session, enter [Exit]. Console# Username: guest Password: [guest login password] CLI session with the SMC6624M is opened. To end the CLI session, enter [Exit].
PAGE 252
COMMAND LINE INTERFACE • Line Configuration - These commands modify the console port and Telnet configuration, and include command such as parity and databits. • VLAN Configuration - Includes the command to create VLAN groups. To enter the Global Configuration mode, enter the command configure in Privileged Exec mode. The system prompt will change to “Console(config)#” which gives you access privilege to all Global Configuration commands.
PAGE 253
ENTERING COMMANDS Command Line Processing Commands are not case sensitive. You can abbreviate commands and parameters as long as they contain enough letters to differentiate them from any other currently available commands or parameters. You can use the Tab key to complete partial commands, or enter a partial command followed by the “?” character to display a list of possible matches.
PAGE 254
COMMAND LINE INTERFACE Command Groups The system commands can be broken down into the functional groups shown below.
PAGE 255
COMMAND GROUPS Table 4-4 Command Groups (Continued) Command Group Description Page Address Table Configures the address table for filtering specified addresses, displays current entries, clears the table, or sets the aging time 4-178 Spanning Tree Configures Spanning Tree settings for the switch 4-183 VLANs Configures VLAN settings, and defines port membership for VLAN groups; also enables or configures private VLANs 4-198 GVRP and Bridge Extension Configures GVRP settings that permit automatic
PAGE 256
COMMAND LINE INTERFACE Line Commands You can access the onboard configuration program by attaching a VT100 compatible device to the server’s serial port. These commands are used to set communication parameters for the serial port or Telnet (i.e., a virtual terminal).
PAGE 257
LINE COMMANDS line This command identifies a specific line for configuration, and to process subsequent line configuration commands. Syntax line {console | vty} - console - Console terminal line. - vty - Virtual terminal for remote console access (i.e., Telnet). Default Setting There is no default line. Command Mode Global Configuration Command Usage Telnet is considered a virtual terminal connection and will be shown as “Vty” in screen displays such as show users.
PAGE 258
COMMAND LINE INTERFACE login This command enables password checking at login. Use the no form to disable password checking and allow connections without a password. Syntax login [local] no login local - Selects local password checking. Authentication is based on the user name specified with the username command.
PAGE 259
LINE COMMANDS Example Console(config-line)#login local Console(config-line)# Related Commands username (4-36) password (4-17) password This command specifies the password for a line. Use the no form to remove the password. Syntax password {0 | 7} password no password - {0 | 7} - 0 means plain password, 7 means encrypted password - password - Character string that specifies the line password. (Maximum length: 8 characters plain text, 32 encrypted, case sensitive) Default Setting No password is specified.
PAGE 260
COMMAND LINE INTERFACE configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords. Example Console(config-line)#password 0 secret Console(config-line)# Related Commands login (4-16) password-thresh (4-20) timeout login response This command sets the interval that the system waits for a user to log into the CLI. Use the no form to restore the default. Syntax timeout login response [seconds] no silent-time seconds - Integer that specifies the timeout interval.
PAGE 261
LINE COMMANDS Example To set the timeout to two minutes, enter this command: Console(config-line)#timeout login response 120 Console(config-line)# Related Commands silent-time (4-21) exec-timeout (4-14) exec-timeout This command sets the interval that the system waits until user input is detected. Use the no form to restore the default. Syntax exec-timeout [seconds] no exec-timeout seconds - Integer that specifies the number of seconds.
PAGE 262
COMMAND LINE INTERFACE Example To set the timeout to two minutes, enter this command: Console(config-line)#exec-timeout 120 Console(config-line)# Related Commands silent-time (4-21) timeout login response (4-13) password-thresh This command sets the password intrusion threshold which limits the number of failed logon attempts. Use the no form to remove the threshold value. Syntax password-thresh [threshold] no password-thresh threshold - The number of allowed password attempts.
PAGE 263
LINE COMMANDS Example To set the password threshold to five attempts, enter this command: Console(config-line)#password-thresh 5 Console(config-line)# Related Commands silent-time (4-21) timeout login response (4-13) silent-time This command sets the amount of time the management console is inaccessible after the number of unsuccessful logon attempts exceeds the threshold set by the password-thresh command. Use the no form to remove the silent time value.
PAGE 264
COMMAND LINE INTERFACE databits This command sets the number of data bits per character that are interpreted and generated by the console port. Use the no form to restore the default value. Syntax databits {7 | 8} no databits - 7 - Seven data bits per character. - 8 - Eight data bits per character. Default Setting 8 data bits per character Command Mode Line Configuration Command Usage The databits command can be used to mask the high bit on input from devices that generate 7 data bits with parity.
PAGE 265
LINE COMMANDS parity This command defines the generation of a parity bit. Use the no form to restore the default setting. Syntax parity {none | even | odd} no parity - none - No parity - even - Even parity - odd - Odd parity Default Setting No parity Command Mode Line Configuration Command Usage Communication protocols provided by devices such as terminals and modems often require a specific parity bit setting.
PAGE 266
COMMAND LINE INTERFACE Default Setting 9600 Command Mode Line Configuration Command Usage Set the speed to match the baud rate of the device connected to the serial port. Some baud rates available on devices connected to the port might not be supported. The system indicates if the speed you selected is not supported. Example To specify 57600 bps, enter this command: Console(config-line)#speed 57600 Console(config-line)# stopbits This command sets the number of the stop bits transmitted per byte.
PAGE 267
LINE COMMANDS disconnect This command terminates an SSH, Telnet, or console connection. Syntax disconnect session-id session-id – The session identifier for an SSH, Telnet or console connection. (Range: 0-4) Command Mode Privileged Exec Command Usage Specifying session identifier “0” will disconnect the console connection. Specifying any other identifiers for an active session will disconnect an SSH or Telnet connection.
PAGE 268
COMMAND LINE INTERFACE Example To show all lines, enter this command: Console#show line Console configuration: Password threshold: 3 times Interactive timeout: Disabled Login timeout: Disabled Silent time: Disabled Baudrate: 9600 Databits: 8 Parity: none Stopbits: 1 VTY configuration: Password threshold: 3 times Interactive timeout: 600 sec Login timeout: 300 sec console# 4-26
PAGE 269
GENERAL COMMANDS General Commands Table 4-6 General Commands Command Function Mode enable Activates privileged mode NE Page 4-27 disable Returns to normal mode from privileged mode PE 4-28 configure Activates global configuration mode PE 4-29 show history Shows the command history buffer NE, PE 4-29 reload Restarts the system PE 4-30 end Returns to Privileged Exec mode any config.
PAGE 270
COMMAND LINE INTERFACE Command Mode Normal Exec Command Usage • “super” is the default password required to change the command mode from Normal Exec to Privileged Exec. (To set this password, see the enable password command on page 4-37.) • The “#” character is appended to the end of the prompt to indicate that the system is in privileged access mode.
PAGE 271
GENERAL COMMANDS Example Console#disable Console> Related Commands enable (4-27) configure This command activates Global Configuration mode. You must enter this mode to modify any settings on the switch. You must also enter Global Configuration mode prior to enabling some of the other configuration modes, including Interface Configuration, Line Configuration, and VLAN Database Configuration. See “Understanding Command Modes” on page 4-8.
PAGE 272
COMMAND LINE INTERFACE Command Usage The history buffer size is fixed at 10 Execution commands and 10 Configuration commands.
PAGE 273
GENERAL COMMANDS Command Mode Privileged Exec Command Usage This command resets the entire system. Example This example shows how to reset the switch: Console#reload System will be restarted, continue ? y end This command returns to Privileged Exec mode. Default Setting None Command Mode Global Configuration, Interface Configuration, Line Configuration, and VLAN Database Configuration.
PAGE 274
COMMAND LINE INTERFACE Example This example shows how to return to the Privileged Exec mode from the Global Configuration mode, and then quit the CLI session: Console(config)#exit Console#exit Press ENTER to start session User Access Verification Username: quit This command exits the configuration program. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The quit and exit commands can both exit the configuration program.
PAGE 275
SYSTEM MANAGEMENT COMMANDS System Management Commands These commands are used to control system logs, passwords, user names, browser configuration options, and display or configure a variety of other system information.
PAGE 276
COMMAND LINE INTERFACE prompt This command customizes the CLI prompt. Use the no form to restore the default prompt. Syntax prompt string no prompt string - Any alphanumeric string to use for the CLI prompt. (Maximum length: 255 characters) Default Setting Console Command Mode Global Configuration Example Console(config)#prompt RD2 RD2(config)# hostname This command specifies or modifies the host name for this device. Use the no form to restore the default host name.
PAGE 277
SYSTEM MANAGEMENT COMMANDS Example Console(config)#hostname RD#1 Console(config)# User Access Commands The basic commands required for management access are listed in this section. This switch also includes other options for password checking via the console or a Telnet connection (page 4-14), user authentication via a remote authentication server (page 4-95), and host access authentication for specific ports (page 4-108).
PAGE 278
COMMAND LINE INTERFACE username This command adds named users, requires authentication at login, specifies or changes a user's password (or specify that no password is required), or specifies or changes a user's access level. Use the no form to remove a user name. Syntax username name {access-level level | nopassword | password {0 | 7} password} no username name - name - The name of the user. (Maximum length: 8 characters, case sensitive. Maximum users: 16) - access-level level - Specifies the user level.
PAGE 279
SYSTEM MANAGEMENT COMMANDS Command Usage The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords. Example This example shows how to set the access level and password for a user.
PAGE 280
COMMAND LINE INTERFACE Command Usage • You cannot set a null password. You will have to enter a password to change the command mode from Normal Exec to Privileged Exec with the enable command (page 4-27). • The encrypted password is required for compatibility with legacy password settings (i.e., plain text or encrypted) when reading the configuration file during system bootup or when downloading the configuration file from a TFTP server. There is no need for you to manually configure encrypted passwords.
PAGE 281
SYSTEM MANAGEMENT COMMANDS management This command specifies the client IP addresses that are allowed management access to the switch through various protocols. Use the no form to restore the default setting. Syntax [no] management {all-client | http-client | snmp-client | telnet-client} start-address [end-address] - all-client - Adds IP address(es) to the SNMP, web and Telnet groups. - http-client - Adds IP address(es) to the web group. - snmp-client - Adds IP address(es) to the SNMP group.
PAGE 282
COMMAND LINE INTERFACE • You can delete an address range just by specifying the start address, or by specifying both the start address and end address. Example This example restricts management access to the indicated addresses. Console(config)#management all-client 192.168.1.19 Console(config)#management all-client 192.168.1.25 192.168.1.30 Console(config)# show management This command displays the client IP addresses that are allowed management access to the switch through various protocols.
PAGE 283
SYSTEM MANAGEMENT COMMANDS Example Console#show management all-client Management IP Filter HTTP-Client: Start IP address End IP address ----------------------------------------------1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 SNMP-Client: Start IP address End IP address ----------------------------------------------1. 192.168.1.19 192.168.1.19 2. 192.168.1.25 192.168.1.30 TELNET-Client: Start IP address End IP address ----------------------------------------------1. 192.168.1.19 192.168.1.
PAGE 284
COMMAND LINE INTERFACE ip http port This command specifies the TCP port number used by the web browser interface. Use the no form to use the default port. Syntax ip http port port-number no ip http port port-number - The TCP port to be used by the browser interface.
PAGE 285
SYSTEM MANAGEMENT COMMANDS Example Console(config)#ip http server Console(config)# Related Commands ip http port (4-42) ip http secure-server This command enables the secure hypertext transfer protocol (HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection) to the switch’s web interface. Use the no form to disable this function.
PAGE 286
COMMAND LINE INTERFACE 5.x and Netscape Navigator 6.2 or later versions. • The following web browsers and operating systems currently support HTTPS: Table 4-13 HTTPS System Support Web Browser Operating System Internet Explorer 5.0 or later Windows 98,Windows NT (with service pack 6a), Windows 2000, Windows XP Netscape Navigator 6.2 or later Windows 98,Windows NT (with service pack 6a), Windows 2000, Windows XP, Solaris 2.
PAGE 287
SYSTEM MANAGEMENT COMMANDS Command Mode Global Configuration Command Usage • You cannot configure the HTTP and HTTPS servers to use the same port.
PAGE 288
COMMAND LINE INTERFACE Default Setting 23 Command Mode Global Configuration Example Console(config)#ip telnet port 123 Console(config)# Related Commands ip telnet server (4-46) ip telnet server This command allows this device to be monitored or configured from Telnet. Use the no form to disable this function.
PAGE 289
SYSTEM MANAGEMENT COMMANDS Secure Shell Commands The Berkley-standard includes remote access tools originally designed for Unix systems. Some of these tools have also been implemented for Microsoft Windows and other environments. These tools, including commands such as rlogin (remote login), rsh (remote shell), and rcp (remote copy), are not secure from hostile attacks. The Secure Shell (SSH) includes server/client applications intended as a secure replacement for the older Berkley remote access tools.
PAGE 290
COMMAND LINE INTERFACE Table 4-15 SSH Commands (Continued) Command Function Mode Page delete public-key Deletes the public key for the specified user PE 4-53 ip ssh crypto Generates the host key host-key generate PE 4-53 ip ssh crypto zeroize Clear the host key from RAM PE 4-54 ip ssh save host-key Saves the host key from RAM to flash memory PE 4-55 disconnect Terminates a line connection PE 4-25 show ip ssh Displays the status of the SSH server and the PE configured values for authent
PAGE 291
SYSTEM MANAGEMENT COMMANDS 2. Provide Host Public Key to Clients – Many SSH client programs automatically import the host public key during the initial connection setup with the switch. Otherwise, you need to manually create a known hosts file on the management station and place the host public key in it. An entry for a public key in the known hosts file would appear similar to the following example: 10.1.0.
PAGE 292
COMMAND LINE INTERFACE a. The client sends its public key to the switch. b. The switch compares the client's public key to those stored in memory. c. If a match is found, the switch uses the public key to encrypt a random sequence of bytes, and sends this string to the client. d. The client uses its private key to decrypt the bytes, and sends the decrypted bytes back to the switch. e. The switch compares the decrypted bytes to the original bytes it sent.
PAGE 293
SYSTEM MANAGEMENT COMMANDS Example Console#ip ssh crypto host-key generate dsa Console#configure Console(config)#ip ssh server Console(config)# Related Commands ip ssh crypto host-key generate (4-53) show ssh (4-56) ip ssh timeout This command configures the timeout for the SSH server. Use the no form to restore the default setting. Syntax ip ssh timeout seconds no ip ssh timeout seconds – The timeout for client response during SSH negotiation.
PAGE 294
COMMAND LINE INTERFACE ip ssh authentication-retries This command configures the number of times the SSH server attempts to reauthenticate a user. Use the no form to restore the default setting. Syntax ip ssh authentication-retries count no ip ssh authentication-retries count – The number of authentication attempts permitted after which the interface is reset.
PAGE 295
SYSTEM MANAGEMENT COMMANDS Command Usage • The server key is a private key that is never shared outside the switch. • The host key is shared with the SSH client, and is fixed at 1024 bits. Example Console(config)#ip ssh server-key size 512 Console(config)# delete public-key This command deletes the specified user’s public key. Syntax delete public-key username [dsa | rsa] - username – Name of an SSH user. (Range: 1-8 characters) - dsa – DSA public key type. - rsa – RSA public key type.
PAGE 296
COMMAND LINE INTERFACE Command Mode Privileged Exec Command Usage • This command stores the host key pair in memory (i.e., RAM). Use the ip ssh save host-key command to save the host key pair to flash memory. • Some SSH client programs automatically add the public key to the known hosts file as part of the configuration process. Otherwise, you must manually create a known hosts file and place the host public key in it.
PAGE 297
SYSTEM MANAGEMENT COMMANDS Command Usage • This command clears the host key from volatile memory (RAM). Use the no ip ssh save host-key command to clear the host key from flash memory. • The SSH server must be disabled before you can execute this command. Example Console#ip ssh crypto zeroize dsa Console# Related Commands ip ssh crypto host-key generate (4-53) ip ssh save host-key (4-55) no ip ssh server (4-50) ip ssh save host-key This command saves host key from RAM to flash memory.
PAGE 298
COMMAND LINE INTERFACE show ip ssh This command displays the connection settings used when authenticating client access to the SSH server. Command Mode Privileged Exec Example Console#show ip ssh SSH Enabled - version 1.99 Negotiation timeout: 120 secs; Authentication retries: 3 Server key size: 768 bits Console# show ssh This command displays the current SSH server connections. Command Mode Privileged Exec Example Console#show ssh Connection Version State 0 2.
PAGE 299
SYSTEM MANAGEMENT COMMANDS Table 4-16 show ssh - display description (Continued) Field Description Encryption The encryption method is automatically negotiated between the client and server. Options for SSHv1.5 include: DES, 3DES Options for SSHv2.
PAGE 300
COMMAND LINE INTERFACE Command Mode Privileged Exec Command Usage • If no parameters are entered, all keys are displayed. If the user keyword is entered, but no user name is specified, then the public keys for all users are displayed. • When an RSA key is displayed, the first field indicates the size of the host key (e.g., 1024), the second field is the encoded public exponent (e.g., 35), and the last string is the encoded modulus.
PAGE 301
SYSTEM MANAGEMENT COMMANDS Event Logging Commands Table 4-17 Event Logging Commands Command Function Mode Page logging on Controls logging of error messages GC 4-59 logging history Limits syslog messages saved to switch memory GC based on severity 4-60 logging host Adds a syslog server host IP address that will receive logging messages GC 4-61 logging facility Sets the facility type for remote logging of syslog GC messages 4-62 logging trap Limits syslog messages saved to a remote server G
PAGE 302
COMMAND LINE INTERFACE Example Console(config)#logging on Console(config)# Related Commands logging history (4-60) clear logging (4-64) logging history This command limits syslog messages saved to switch memory based on severity. The no form returns the logging of syslog messages to the default level. Syntax logging history {flash | ram} level no logging history {flash | ram} - flash - Event history stored in flash memory (i.e., permanent memory). - ram - Event history stored in temporary RAM (i.e.
PAGE 303
SYSTEM MANAGEMENT COMMANDS Table 4-18 Logging Levels Level Severity Name Description 1 alerts Immediate action needed 0 emergencies System unusable * There are only Level 2, 5 and 6 error messages for the current firmware release. Default Setting Flash: errors (level 3 - 0) RAM: warnings (level 7 - 0) Command Mode Global Configuration Command Usage The message level specified for flash memory must be a higher priority (i.e., numerically lower) than that specified for RAM.
PAGE 304
COMMAND LINE INTERFACE Command Usage • By using this command more than once you can build up a list of host IP addresses. • The maximum number of host IP addresses allowed is five. Example Console(config)#logging host 10.1.0.3 Console(config)# logging facility This command sets the facility type for remote logging of syslog messages. Use the no form to return the type to the default.
PAGE 305
SYSTEM MANAGEMENT COMMANDS logging trap This command enables the logging of system messages to a remote server, or limits the syslog messages saved to a remote server based on severity. Use this command without a specified level to enable remote logging. Use the no form to disable remote logging. Syntax logging trap [level] no logging trap level - One of the level arguments listed below. Messages sent include the selected level up through level 0. (Refer to the table on page 4-60.
PAGE 306
COMMAND LINE INTERFACE clear logging This command clears messages from the log buffer. Syntax clear logging [flash | ram] - flash - Event history stored in flash memory (i.e., permanent memory). - ram - Event history stored in temporary RAM (i.e., memory flushed on power reset).
PAGE 307
SYSTEM MANAGEMENT COMMANDS - sendmail - Displays settings for the SMTP event handler (page 4-71). - trap - Displays settings for the trap function. Default Setting None Command Mode Privileged Exec Example The following example shows that system logging is enabled, the message level for flash memory is “errors” (i.e., default level 3 - 0), the message level for RAM is “debugging” (i.e., default level 7 - 0).
PAGE 308
COMMAND LINE INTERFACE The following example displays settings for the trap function. Console#show logging trap Syslog logging: Enable REMOTELOG status: disable REMOTELOG facility type: local use 7 REMOTELOG level type: Debugging messages REMOTELOG server IP address: 1.2.3.4 REMOTELOG server IP address: 0.0.0.0 REMOTELOG server IP address: 0.0.0.0 REMOTELOG server IP address: 0.0.0.0 REMOTELOG server IP address: 0.0.0.
PAGE 309
SYSTEM MANAGEMENT COMMANDS - tail - Shows event history starting from the most recent entry. - login - Shows the login record only. Default Setting None Command Mode Privileged Exec Command Usage This command shows the system and event messages stored in memory, including the time stamp, message level (page 4-60), program module, function, and event number. Example The following example shows sample messages stored in RAM. Console#show log ram [5] 00:01:06 2001-01-01 "STA root change notification.
PAGE 310
COMMAND LINE INTERFACE SMTP Alert Commands These commands configure SMTP event handling, and forwarding of alert messages to the specified SMTP servers and email recipients.
PAGE 311
SYSTEM MANAGEMENT COMMANDS • To send email alerts, the switch first opens a connection, sends all the email alerts waiting in the queue one by one, and finally closes the connection. • To open a connection, the switch first selects the server that successfully sent mail during the last connection, or the first server configured by this command. If it fails to send mail, the switch selects the next server in the list and tries to send mail again.
PAGE 312
COMMAND LINE INTERFACE logging sendmail source-email This command sets the email address used for the “From” field in alert messages. Use the no form to delete the source email address. Syntax [no] logging sendmail source-email email-address email-address - The source email address used in alert messages.
PAGE 313
SYSTEM MANAGEMENT COMMANDS Command Mode Global Configuration Command Usage You can specify up to five recipients for alert messages. However, you must enter a separate command to specify each recipient. Example Console(config)#logging sendmail destination-email ted@this-company.com Console(config)# logging sendmail This command enables SMTP event handling. Use the no form to disable this function.
PAGE 314
COMMAND LINE INTERFACE Example Console#show logging sendmail SMTP servers ----------------------------------------------1. 192.168.1.200 SMTP minimum severity level: 4 SMTP destination email addresses ----------------------------------------------1. geoff@acme.com SMTP source email address: SMTP status: Console# john@acme.com Enabled Time Commands The system clock can be dynamically set by polling a set of specified time servers (NTP or SNTP).
PAGE 315
SYSTEM MANAGEMENT COMMANDS sntp client This command enables SNTP client requests for time synchronization from NTP or SNTP time servers specified with the sntp servers command. Use the no form to disable SNTP client requests. Syntax [no] sntp client Default Setting Disabled Command Mode Global Configuration Command Usage • The time acquired from time servers is used to record accurate dates and times for log events.
PAGE 316
COMMAND LINE INTERFACE sntp server This command sets the IP address of the servers to which SNTP time requests are issued. Use the this command with no arguments to clear all time servers from the current list. Syntax sntp server [ip1 [ip2 [ip3]]] ip - IP address of an time server (NTP or SNTP). (Range: 1-3 addresses) Default Setting None Command Mode Global Configuration Command Usage This command specifies time servers from which the switch will poll for time updates when set to SNTP client mode.
PAGE 317
SYSTEM MANAGEMENT COMMANDS sntp poll This command sets the interval between sending time requests when the switch is set to SNTP client mode. Use the no form to restore to the default. Syntax sntp poll seconds no sntp poll seconds - Interval between time requests.
PAGE 318
COMMAND LINE INTERFACE Example Console#show sntp Current time: Dec 23 05:13:28 2002 Poll interval: 16 Current mode: unicast SNTP status : Enabled SNTP server 137.92.140.80 0.0.0.0 0.0.0.0 Current server: 137.92.140.80 Console# clock timezone This command sets the time zone for the switch’s internal clock. Syntax clock timezone name hour hours minute minutes {before-utc | after-utc} • name - Name of timezone, usually an acronym. (Range: 1-29 characters) • hours - Number of hours before/after UTC.
PAGE 319
SYSTEM MANAGEMENT COMMANDS Example Console(config)#clock timezone Japan hours 8 minute 0 after-UTC Console(config)# Related Commands show sntp (4-75) calendar set This command sets the system clock. It may be used if there is no time server on your network, or if you have not configured the switch to receive signals from a time server. Syntax calendar set hour min sec {day month year | month day year} • • • • • hour - Hour in 24-hour format. (Range: 0-23) min - Minute. (Range: 0-59) sec - Second.
PAGE 320
COMMAND LINE INTERFACE show calendar This command displays the system clock.
PAGE 321
SYSTEM MANAGEMENT COMMANDS light unit This command displays the unit ID of a switch using its front-panel LED indicators. Syntax light unit [unit] - unit - specifies a unit in a switch stack to light the panel LEDs Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage The unit ID is displayed using the port status LED indicators for ports 1 to 8. When the light unit command is entered, the LED corresponding to the switch’s ID will flash for about 15 seconds.
PAGE 322
COMMAND LINE INTERFACE • This command displays settings for key command modes. Each mode group is separated by “!” symbols, and includes the configuration mode command, and corresponding commands.
PAGE 323
SYSTEM MANAGEMENT COMMANDS Example Console#show startup-config building startup-config, please wait.....
PAGE 324
COMMAND LINE INTERFACE show running-config This command displays the configuration information currently in use. Default Setting None Command Mode Privileged Exec Command Usage • Use this command in conjunction with the show startup-config command to compare the information in running memory to the information stored in non-volatile memory. • This command displays settings for key command modes.
PAGE 325
SYSTEM MANAGEMENT COMMANDS Example Console#show running-config building running-config, please wait..... ! phymap 5a-a5-aa-55-44-32 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 ! SNTP server 0.0.0.0 0.0.0.0 0.0.0.
PAGE 326
COMMAND LINE INTERFACE Related Commands show startup-config (4-79) show system This command displays system information. Default Setting None Command Mode Normal Exec, Privileged Exec Command Usage • For a description of the items shown by this command, refer to “Displaying System Information” on page -11. • The POST results should all display “PASS.” If any POST test indicates “FAIL,” contact your distributor for assistance.
PAGE 327
SYSTEM MANAGEMENT COMMANDS Example Console#show system System description: 24-Port 10/100Mbps Stackable Managed Switch with 2 optional uplink modules System OID string: 1.3.6.1.4.1.202.20.43 System information System Up time: 0 days, 0 hours, 0 minutes, and 7.
PAGE 328
COMMAND LINE INTERFACE Example Console#show users Username accounts: Username Privilege Public-Key -------- --------- ---------admin 15 None guest 0 None steve 15 RSA Online users: Line Username Idle time (h:m:s) Remote IP addr. ----------- -------- ----------------- --------------0 console admin 0:14:14 * 1 VTY 0 admin 0:00:00 192.168.1.19 2 SSH 1 steve 0:00:06 192.168.1.19 Web online users: Line Remote IP addr Username Idle time (h:m:s). ----------- -------------- -------- -----------------1 HTTP 192.168.
PAGE 329
SYSTEM MANAGEMENT COMMANDS Example Console#show version Unit 1 Serial number: Service tag: Hardware version: Module A type: Module B type: Number of ports: Main power status: Redundant power status: Agent(master) Unit ID: Loader version: Boot ROM version: Operation code version: Console# S416000963 R0A 1000BaseT 1000BaseT 26 up not present 1 2.2.1.1 2.2.1.2 2.2.5.
PAGE 330
COMMAND LINE INTERFACE using jumbo frames significantly reduces the per-packet overhead required to process protocol encapsulation fields. • To use jumbo frames, both the source and destination end nodes (such as a computer or server) must support this feature. Also, when the connection is operating at full duplex, all switches in the network between the two end nodes must be able to accept the extended frame size.
PAGE 331
FLASH/FILE COMMANDS copy This command moves (upload/download) a code image or configuration file between the switch’s flash memory and a TFTP server. When you save the system code or configuration settings to a file on a TFTP server, that file can later be downloaded to the switch to restore system operation. The success of the file transfer depends on the accessibility of the TFTP server and the quality of the network connection.
PAGE 332
COMMAND LINE INTERFACE • The destination file name should not contain slashes (\ or /), the leading letter of the file name should not be a period (.), and the maximum length for file names on the TFTP server is 127 characters or 31 characters for files on the switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”) • Due to the size limit of the flash memory, the switch supports only two operation code files. • The maximum number of user-defined configuration files depends on available memory.
PAGE 333
FLASH/FILE COMMANDS The following example shows how to copy the running configuration to a startup file. Console#copy running-config file destination file name: startup Write to FLASH Programming. \Write to FLASH finish. Success. Console# The following example shows how to download a configuration file: Console#copy tftp startup-config TFTP server ip address: 10.1.0.99 Source configuration file name: startup.01 Startup configuration file name [startup]: Write to FLASH Programming. \Write to FLASH finish.
PAGE 334
COMMAND LINE INTERFACE delete This command deletes a file or image. Syntax delete [unit:] filename filename - Name of the configuration file or image name. unit - Stack unit. (Range: 1-8) Default Setting None Command Mode Privileged Exec Command Usage • If the file type is used for system startup, then this file cannot be deleted. • “Factory_Default_Config.cfg” cannot be deleted. • A colon (:) is required after the specified unit number. Example This example shows how to delete the test2.
PAGE 335
FLASH/FILE COMMANDS - boot-rom - Boot ROM (or diagnostic) image file. config - Switch configuration file. opcode - Run-time operation code image file. filename - Name of the configuration file or image name. unit - Stack unit. (Range: 1-8) Default Setting None Command Mode Privileged Exec Command Usage • If you enter the command dir without any parameters, the system displays all files. • A colon (:) is required after the specified unit number.
PAGE 336
COMMAND LINE INTERFACE whichboot This command displays which files were booted when the system powered up. Syntax whichboot [unit] unit - Specifies the unit number. Default Setting None Command Mode Privileged Exec Example This example shows the information displayed by the whichboot command. See the table under the dir command for a description of the file information displayed by this command.
PAGE 337
AUTHENTICATION COMMANDS - unit* - Specifies the unit number. * The colon (:) is required. Default Setting None Command Mode Global Configuration Command Usage • A colon (:) is required after the specified file type. • If the file contains an error, it cannot be set as the default file. • A colon (:) is required after the specified unit number.
PAGE 338
COMMAND LINE INTERFACE Table 4-27 Authentication Commands Command Group Function Port Security Configures secure addresses for a port Page 4-106 Port Authentication Configures host authentication on specific ports using 802.
PAGE 339
AUTHENTICATION COMMANDS access-request packet from the client to the server, while TACACS+ encrypts the entire body of the packet. • RADIUS and TACACS+ logon authentication assigns a specific privilege level for each user name and password pair. The user name, password, and privilege level must be configured on the authentication server. • You can specify three authentication methods in a single command to indicate the authentication sequence.
PAGE 340
COMMAND LINE INTERFACE Command Mode Global Configuration Command Usage • RADIUS uses UDP while TACACS+ uses TCP. UDP only offers best effort delivery, while TCP offers a connection-oriented transport. Also, note that RADIUS encrypts only the password in the access-request packet from the client to the server, while TACACS+ encrypts the entire body of the packet. • RADIUS and TACACS+ logon authentication assigns a specific privilege level for each user name and password pair.
PAGE 341
AUTHENTICATION COMMANDS RADIUS Client Remote Authentication Dial-in User Service (RADIUS) is a logon authentication protocol that uses software running on a central server to control access to RADIUS-aware devices on the network. An authentication server contains a database of multiple user name/password pairs with associated privilege levels for each user or group that require management access to a switch.
PAGE 342
COMMAND LINE INTERFACE • port_number - RADIUS server UDP port used for authentication messages. (Range: 1-65535) • timeout - Number of seconds the switch waits for a reply before resending a request. (Range: 1-65535) • retransmit - Number of times the switch will try to authenticate logon access via the RADIUS server. (Range: 1-30) • key - Encryption key used to authenticate logon access for client. Do not use blank spaces in the string.
PAGE 343
AUTHENTICATION COMMANDS Example Console(config)#radius-server port 181 Console(config)# radius-server key This command sets the RADIUS encryption key. Use the no form to restore the default. Syntax radius-server key key_string no radius-server key key_string - Encryption key used to authenticate logon access for client. Do not use blank spaces in the string.
PAGE 344
COMMAND LINE INTERFACE Command Mode Global Configuration Example Console(config)#radius-server retransmit 5 Console(config)# radius-server timeout This command sets the interval between transmitting authentication requests to the RADIUS server. Use the no form to restore the default. Syntax radius-server timeout number_of_seconds no radius-server timeout number_of_seconds - Number of seconds the switch waits for a reply before resending a request.
PAGE 345
AUTHENTICATION COMMANDS Example Console#show radius-server Remote RADIUS server configuration: Global settings Communication key with RADIUS server: Server port number: 1812 Retransmit times: 2 Request timeout: 5 Sever 1: Server IP address: 192.168.1.
PAGE 346
COMMAND LINE INTERFACE tacacs-server host This command specifies the TACACS+ server. Use the no form to restore the default. Syntax tacacs-server host host_ip_address no tacacs-server host host_ip_address - IP address of a TACACS+ server. Default Setting 10.11.12.13 Command Mode Global Configuration Example Console(config)#tacacs-server host 192.168.1.25 Console(config)# tacacs-server port This command specifies the TACACS+ server network port. Use the no form to restore the default.
PAGE 347
AUTHENTICATION COMMANDS Example Console(config)#tacacs-server port 181 Console(config)# tacacs-server key This command sets the TACACS+ encryption key. Use the no form to restore the default. Syntax tacacs-server key key_string no tacacs-server key key_string - Encryption key used to authenticate logon access for the client. Do not use blank spaces in the string.
PAGE 348
COMMAND LINE INTERFACE Example Console#show tacacs-server Remote TACACS server configuration: Server IP address: 10.11.12.13 Communication key with TACACS server: ***** Server port number: 49 Console# Port Security Commands These commands can be used to enable port security on a port. When using port security, the switch stops learning new MAC addresses on the specified port when it has reached a configured maximum number.
PAGE 349
AUTHENTICATION COMMANDS port security This command enables or configures port security. Use the no form without any keywords to disable port security. Use the no form with the appropriate keyword to restore the default settings for a response to security violation or for the maximum number of allowed addresses. Syntax port security [action {shutdown | trap | trap-and-shutdown} | max-mac-count address-count] no port security [action | max-mac-count] • action - Response to take when port security is violated.
PAGE 350
COMMAND LINE INTERFACE • You can also manually add secure addresses with the mac-address-table static command. • A secure port has the following restrictions: - Cannot use port monitoring. - Cannot be a multi-VLAN port. - Cannot be connected to a network interconnection device. - Cannot be a trunk port. • If a port is disabled due to a security violation, it must be manually re-enabled using the no shutdown command.
PAGE 351
AUTHENTICATION COMMANDS Table 4-32 802.
PAGE 352
COMMAND LINE INTERFACE Command Mode Global Configuration Example Console(config)#dot1x system-auth-control Console(config)# dot1x default This command sets all configurable dot1x global and port settings to their default values.
PAGE 353
AUTHENTICATION COMMANDS Example Console(config)#interface eth 1/2 Console(config-if)#dot1x max-req 2 Console(config-if)# dot1x port-control This command sets the dot1x mode on a port interface. Use the no form to restore the default. Syntax dot1x port-control {auto | force-authorized | force-unauthorized} no dot1x port-control • auto – Requires a dot1x-aware connected client to be authorized by the RADIUS server. Clients that are not dot1x-aware will be denied access.
PAGE 354
COMMAND LINE INTERFACE dot1x operation-mode This command allows single or multiple hosts (clients) to connect to an 802.1X-authorized port. Use the no form with no keywords to restore the default to single host. Use the no form with the multi-host max-count keywords to restore the default maximum count. Syntax dot1x operation-mode {single-host | multi-host [max-count count]} no dot1x operation-mode [multi-host max-count] • single-host – Allows only a single host to connect to this port.
PAGE 355
AUTHENTICATION COMMANDS dot1x re-authenticate This command forces re-authentication on all ports or a specific interface. Syntax dot1x re-authenticate [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) Command Mode Privileged Exec Example Console#dot1x re-authenticate Console# dot1x re-authentication This command enables periodic re-authentication globally for all ports. Use the no form to disable re-authentication.
PAGE 356
COMMAND LINE INTERFACE dot1x timeout quiet-period This command sets the time that a switch port waits after the Max Request Count has been exceeded before attempting to acquire a new client. Use the no form to reset the default. Syntax dot1x timeout quiet-period seconds no dot1x timeout quiet-period seconds - The number of seconds.
PAGE 357
AUTHENTICATION COMMANDS Example Console(config)#interface eth 1/2 Console(config-if)#dot1x timeout re-authperiod 300 Console(config-if)# dot1x timeout tx-period This command sets the time that an interface on the switch waits during an authentication session before re-transmitting an EAP packet. Use the no form to reset to the default value. Syntax dot1x timeout tx-period seconds no dot1x timeout tx-period seconds - The number of seconds.
PAGE 358
COMMAND LINE INTERFACE Command Mode Privileged Exec Command Usage This command displays the following information: • Global 802.1X Parameters – Shows whether or not 802.1X port authentication is globally enabled on the switch. • 802.1X Port Summary – Displays the port access control parameters for each interface, including the following items: - Status – Administrative state for port access control. - Operation Mode– Dot1x port control operation mode (page 4-112).
PAGE 359
AUTHENTICATION COMMANDS - Max Count – The maximum number of hosts allowed to access this port (page 4-112). - Port-control – Shows the dot1x mode on a port as auto, force-authorized, or force-unauthorized (page 4-111). - Supplicant – MAC address of authorized client. - Current Identifier– The integer (0-255) used by the Authenticator to identify the current authentication session.
PAGE 360
COMMAND LINE INTERFACE Example Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status 1/1 disabled 1/2 enabled . . . 1/26 disabled Operation Mode Single-Host Single-Host Single-Host 802.1X Port Details 802.1X is disabled on port 1/1 802.
PAGE 361
ACCESS CONTROL LIST COMMANDS Access Control List Commands Access Control Lists (ACL) provide packet filtering for IP frames (based on address, protocol, Layer 4 protocol port number or TCP control code) or any frames (based on MAC address or Ethernet type). To filter packets, first create an access list, add the required rules and then bind the list to a specific port.
PAGE 362
COMMAND LINE INTERFACE • This switch supports ACLs for ingress filtering only. However, you can only bind one IP ACL to any port and one MAC ACL globally for ingress filtering. In other words, only two ACLs can be bound to an interface - Ingress IP ACL and Ingress MAC ACL. The order in which active ACLs are checked is as follows: 1. User-defined rules in the Ingress MAC ACL for ingress ports. 2. User-defined rules in the Ingress IP ACL for ingress ports. 3.
PAGE 363
ACCESS CONTROL LIST COMMANDS Table 4-34 IP ACLs Command Function Mode Page show ip access-list Displays the rules for configured IP ACLs PE 4-126 ip access-group Adds a port to an IP ACL IC 4-126 show ip access-group Shows port assignments for IP ACLs PE 4-126 map access-list Sets the CoS value and corresponding output IC ip queue for packets matching an ACL rule 4-128 show map access-list ip 4-129 Shows CoS value mapped to an access list for PE an interface access-list ip This command
PAGE 364
COMMAND LINE INTERFACE Command Usage • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To create an ACL, you must add at least one rule to the list. • To remove a rule, use the no permit or no deny command followed by the exact text of a previously configured rule. • An ACL can contain up to 32 rules.
PAGE 365
ACCESS CONTROL LIST COMMANDS Command Usage • New rules are appended to the end of the list. • Address bitmasks are similar to a subnet mask, containing four integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “match” and 0 bits to indicate “ignore.” The bitmask is bitwise ANDed with the specified source IP address, and then compared with the address for each IP packet entering the port(s) to which this ACL has been assigned.
PAGE 366
COMMAND LINE INTERFACE [precedence precedence] [tos tos] [dscp dscp] [source-port sport [end]] [destination-port dport [end]] [control-flag control-flags flag-bitmask] • • • • • • • • • • • • • protocol-number – A specific protocol number. (Range: 0-255) source – Source IP address. destination – Destination IP address. address-bitmask – Decimal number representing the address bits to match. host – Keyword followed by a specific IP address. precedence – IP precedence level.
PAGE 367
ACCESS CONTROL LIST COMMANDS • The control-code bitmask is a decimal number (representing an equivalent bit mask) that is applied to the control code. Enter a decimal number, where the equivalent binary bit “1” means to match a bit and “0” means to ignore a bit.
PAGE 368
COMMAND LINE INTERFACE Related Commands access-list ip (4-121) show ip access-list This command displays the rules for configured IP ACLs. Syntax show ip access-list {standard | extended} [acl_name] • standard – Specifies a standard IP ACL. • extended – Specifies an extended IP ACL. • acl_name – Name of the ACL. (Maximum length: 16 characters) Command Mode Privileged Exec Example Console#show ip access-list standard IP standard access-list david: permit host 10.1.1.21 permit 168.92.0.0 255.255.255.
PAGE 369
ACCESS CONTROL LIST COMMANDS Command Mode Interface Configuration (Ethernet) Command Usage • A port can only be bound to one ACL. • If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. • You must configure a mask for an ACL rule before you can bind it to a port.
PAGE 370
COMMAND LINE INTERFACE map access-list ip This command sets the output queue for packets matching an ACL rule. The specified CoS value is only used to map the matching packet to an output queue; it is not written to the packet itself. Use the no form to remove the CoS mapping. Syntax [no] map access-list ip acl_name cos cos-value • acl_name – Name of the ACL. (Maximum length: 16 characters) • cos-value – CoS value.
PAGE 371
ACCESS CONTROL LIST COMMANDS show map access-list ip This command shows the CoS value mapped to an IP ACL for the current interface. (The CoS value determines the output queue for packets matching an ACL rule.) Syntax show map access-list ip [interface] interface • ethernet unit/port - unit - This is device 1. - port - Port number.
PAGE 372
COMMAND LINE INTERFACE MAC ACLs Table 4-36 MAC ACLs Command Function Mode Page access-list mac Creates a MAC ACL and enters configuration mode GC 4-130 permit, deny Filters packets matching a specified source and destination address, packet format, and Ethernet type MAC-ACL 4-131 show mac access-list Displays the rules for configured MAC ACLs PE 4-133 IC 4-133 show mac access-group Shows port assignments for MAC ACLs PE 4-134 map access-list mac Sets the CoS value and corresponding out
PAGE 373
ACCESS CONTROL LIST COMMANDS Command Usage • When you create a new ACL or enter configuration mode for an existing ACL, use the permit or deny command to add new rules to the bottom of the list. To create an ACL, you must add at least one rule to the list. • To remove a rule, use the no permit or no deny command followed by the exact text of a previously configured rule. • An ACL can contain up to 32 rules.
PAGE 374
COMMAND LINE INTERFACE • address-bitmask2 – Bitmask for MAC address (in hexidecimal format). • vid – VLAN ID. (Range: 1-4094) • vid-end – Upper bound of VID range. (Range: 1-4094) • protocol – A specific Ethernet protocol number. (Range: 0-65535) • protocol-end – Upper bound of protocol range. (Range: 0-65535) Default Setting None Command Mode MAC ACL Command Usage • New rules are added to the end of the list. • The ethertype option can only be used to filter Ethernet II formatted packets.
PAGE 375
ACCESS CONTROL LIST COMMANDS show mac access-list This command displays the rules for configured MAC ACLs. Syntax show mac access-list [acl_name] acl_name – Name of the ACL. (Maximum length: 16 characters) Command Mode Privileged Exec Example Console#show mac access-list MAC access-list jerry: permit any host 00-e0-29-94-34-de ethertype 0800 Console# Related Commands permit, deny 4-131 mac access-group (4-133) mac access-group This command binds a port to a MAC ACL. Use the no form to remove the port.
PAGE 376
COMMAND LINE INTERFACE Command Usage • A port can only be bound to one ACL. • If a port is already bound to an ACL and you bind it to a different ACL, the switch will replace the old binding with the new one. Example Console(config)#interface ethernet 1/25 Console(config-if)#mac access-group alexander in Console(config-if)# Related Commands show mac access-list (4-133) show mac access-group This command shows the ports assigned to MAC ACLs.
PAGE 377
ACCESS CONTROL LIST COMMANDS Default Setting None Command Mode Interface Configuration (Ethernet) Command Usage • You must configure an ACL mask before you can map CoS values to the rule. • A packet matching a rule within the specified ACL is mapped to one of the output queues as shown below.
PAGE 378
COMMAND LINE INTERFACE Command Mode Privileged Exec Example Console#show map access-list mac Access-list to COS of Eth 1/5 Access-list M5 cos 0 Console# Related Commands map access-list mac (4-134) ACL Information Table 4-38 ACL Information Command Function show access-list Show all ACLs and associated rules show access-group Shows the ACLs assigned to each port Mode Page PE 4-136 PE 4-137 show access-list This command shows all ACLs and associated rules, as well as all the user-defined masks.
PAGE 379
ACCESS CONTROL LIST COMMANDS Example Console#show access-list IP standard access-list david: permit host 10.1.1.21 permit 168.92.0.0 255.255.15.0 IP extended access-list bob: permit 10.7.1.1 0.0.0.255 any permit 192.168.1.0 255.255.255.0 any destination-port 80 80 permit 192.168.1.0 255.255.255.
PAGE 380
COMMAND LINE INTERFACE SNMP Commands Controls access to this switch from management stations using the Simple Network Management Protocol (SNMP), as well as the error types sent to trap managers.
PAGE 381
SNMP COMMANDS • rw - Specifies read/write access. Authorized management stations are able to both retrieve and modify MIB objects. Default Setting • public - Read-only access. Authorized management stations are only able to retrieve MIB objects. • private - Read/write access. Authorized management stations are able to both retrieve and modify MIB objects. Command Mode Global Configuration Command Usage The first snmp-server community command you enter enables SNMP (SNMPv1).
PAGE 382
COMMAND LINE INTERFACE Example Console(config)#snmp-server contact Paul Console(config)# Related Commands snmp-server location (4-140) snmp-server location This command sets the system location string. Use the no form to remove the location string. Syntax snmp-server location text no snmp-server location text - String that describes the system location.
PAGE 383
SNMP COMMANDS snmp-server host This command specifies the recipient of a Simple Network Management Protocol notification operation. Use the no form to remove the specified host. Syntax snmp-server host host-addr community-string [version {1 | 2c}] no snmp-server host host-addr • host-addr - Internet address of the host (the targeted recipient). (Maximum host addresses: 5 trap destination IP address entries) • community-string - Password-like community string sent with the notification operation.
PAGE 384
COMMAND LINE INTERFACE enable traps command and the snmp-server host command for that host must be enabled. • Some notification types cannot be controlled with the snmp-server enable traps command. For example, some notification types are always enabled. • The switch can send SNMP version 1 or version 2c notifications to a host IP address, depending on the SNMP version that the management station supports.
PAGE 385
SNMP COMMANDS Command Usage • If you do not enter an snmp-server enable traps command, no notifications controlled by this command are sent. In order to configure this device to send SNMP notifications, you must enter at least one snmp-server enable traps command. If you enter the command with no keywords, both authentication and link-up-down notifications are enabled. If you enter the command with a keyword, only the notification type related to that keyword is enabled.
PAGE 386
COMMAND LINE INTERFACE Example Console#show snmp System Contact: Joe System Location: Room 23 SNMP traps: Authentication: enabled Link-up-down: enabled SNMP communities: 1. private, and the privilege is read-write 2.
PAGE 387
INTERFACE COMMANDS Interface Commands These commands are used to display or set communication parameters for an Ethernet port, aggregated link, or VLAN.
PAGE 388
COMMAND LINE INTERFACE interface This command configures an interface type and enter interface configuration mode. Use the no form to remove a trunk. Syntax interface interface no interface port-channel channel-id interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
PAGE 389
Command Mode Interface Configuration (Ethernet, Port Channel) Example The following example adds a description to port 24. Console(config)#interface ethernet 1/24 Console(config-if)#description RD-SW#3 Console(config-if)# speed-duplex This command configures the speed and duplex mode of a given interface when autonegotiation is disabled. Use the no form to restore the default.
PAGE 390
COMMAND LINE INTERFACE • When using the negotiation command to enable auto-negotiation, the optimal settings will be determined by the capabilities command. To set the speed/duplex mode under auto-negotiation, the required mode must be specified in the capabilities list for an interface. Example The following example configures port 5 to 100 Mbps, half-duplex operation.
PAGE 391
Example The following example configures port 11 to use autonegotiation. Console(config)#interface ethernet 1/11 Console(config-if)#negotiation Console(config-if)# Related Commands capabilities (4 -149) speed-duplex (4 -147) capabilities This command advertises the port capabilities of a given interface during autonegotiation. Use the no form with parameters to remove an advertised capability, or the no form without parameters to restore the default values.
PAGE 392
COMMAND LINE INTERFACE Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage When auto-negotiation is enabled with the negotiation command, the switch will negotiate the best settings for a link based on the capabilites command. When auto-negotiation is disabled, you must manually specify the link attributes with the speed-duplex and flowcontrol commands. Example The following example configures Ethernet port 5 capabilities to 100half, 100full and flow control.
PAGE 393
Command Usage • Flow control can eliminate frame loss by “blocking” traffic from end stations or segments connected directly to the switch when its buffers fill. When enabled, back pressure is used for half-duplex operation and IEEE 802.3x for full-duplex operation. • To force flow control on or off (with the flowcontrol or no flowcontrol command), use the no negotiation command to disable auto-negotiation on the selected interface.
PAGE 394
COMMAND LINE INTERFACE Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage This command allows you to disable a port due to abnormal behavior (e.g., excessive collisions), and then reenable it after the problem has been resolved. You may also want to disable a port for security reasons. Example The following example disables port 5.
PAGE 395
Example The following shows how to configure broadcast storm control at 600 packets per second: Console(config)#interface ethernet 1/5 Console(config-if)#switchport broadcast octet-rate 600 Console(config-if)# clear counters This command clears statistics on an interface. Syntax clear counters interface interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
PAGE 396
COMMAND LINE INTERFACE show interfaces status This command displays the status for an interface. Syntax show interfaces status [interface] interface - ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) - port-channel channel-id (Range: 1-4) - vlan vlan-id (Range: 1-4094) Default Setting Shows the status for all interfaces. Command Mode Normal Exec, Privileged Exec Command Usage If no interface is specified, information on all interfaces is displayed.
PAGE 397
Example Console#show interfaces status ethernet 1/5 Information of Eth 1/5 Basic information: Port type: 100TX Mac address: 00-00-AB-CD-00-01 Configuration: Name: Port admin: Up Speed-duplex: Auto Capabilities: 10half, 10full, 100half, 100full, Broadcast storm: Enabled Broadcast storm limit: 32000 octets/second Flow control: Disabled Lacp: Disabled Port security: Disabled Max MAC count: 0 Port security action: None Current status: Link status: Up Port operation status: Up Operation speed-duplex: 100full Flo
PAGE 398
COMMAND LINE INTERFACE Command Usage If no interface is specified, information on all interfaces is displayed. For a description of the items displayed by this command, see “Showing Port Statistics” on page 3-115.
PAGE 399
show interfaces switchport This command displays the administrative and operational status of the specified interfaces. Syntax show interfaces switchport [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) • port-channel channel-id (Range: 1-4) Default Setting Shows all interfaces. Command Mode Normal Exec, Privileged Exec Command Usage If no interface is specified, information on all interfaces is displayed.
PAGE 400
COMMAND LINE INTERFACE Table 4-41 Interfaces Switchport Statistics Field Description Broadcast threshold Shows if broadcast storm suppression is enabled or disabled; if enabled it also shows the threshold level (page 4-152). Lacp status Shows if Link Aggregation Control Protocol has been enabled or disabled (page 4-167). Ingress/Egress rate Shows if rate limiting is enabled, and the current rate limit. limit (page 4-162). VLAN membership Indicates membership mode as Trunk or Hybrid (page mode 4-202).
PAGE 401
MIRROR PORT COMMANDS Mirror Port Commands This section describes how to mirror traffic from a source port to a target port. Table 4-42 Mirror Port Commands Command Function Mode Page port monitor Configures a mirror session IC 4-159 show port monitor Shows the configuration for a mirror port PE 4-160 port monitor This command configures a mirror session. Use the no form to clear a mirror session.
PAGE 402
COMMAND LINE INTERFACE • The mirror port and monitor port speeds should match, otherwise traffic may be dropped from the monitor port. • You can only create a single mirror session. Example The following example configures the switch to mirror received packets from port 6 to 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 rx Console(config-if)# show port monitor This command displays mirror information.
PAGE 403
RATE LIMIT COMMANDS Example The following shows mirroring configured from port 6 to port 11: Console(config)#interface ethernet 1/11 Console(config-if)#port monitor ethernet 1/6 rx Console(config-if)#end Console#show port monitor Port Mirroring ------------------------------------Destination port(listen port):Eth1/11 Source port(monitored port) :Eth1/6 Mode :RX Console# Rate Limit Commands This function allows the network manager to control the maximum rate for traffic transmitted or received on an interfa
PAGE 404
COMMAND LINE INTERFACE rate-limit Use this command to define the rate limit level for a specific interface. Use this command without specifying a rate to restore the default rate limit level. Use the no form to restore the default status of disabled. Syntax rate-limit {input | output} level [rate] no rate-limit {input | output} • • • input – Input rate output – Output rate rate – Maximum value.
PAGE 405
RATE LIMIT COMMANDS • • • fastethernet – Fast Ethernet granularity gigabitethernet – Gigabit Ethernet granularity granularity – Sets rate limit granularity for the system. For Fast Ethernet, choose 512 Kbps, 1 Mbps, or 3.3 Mbps. For Gigabit Ethernet, only one granularity option is supported, 33.3 Mbps Default Setting Fast Ethernet interface – 3.3 Mbps Gigabit Ethernet interface – 33.
PAGE 406
COMMAND LINE INTERFACE Example Console#show rate-limit Fast ethernet granularity: 1000 Gigabit ethernet granularity: Console# 33300 Link Aggregation Commands Ports can be statically grouped into an aggregate link (i.e., trunk) to increase the bandwidth of a network connection or to ensure fault recovery. Or you can use the Link Aggregation Control Protocol (LACP) to automatically negotiate a trunk link between this switch and another network device.
PAGE 407
LINK AGGREGATION COMMANDS Table 4-44 Link Aggregation Commands Command Function Mode Page lacp port-priority Configures a port's LACP port priority IC (Ethernet) 4-172 show interfaces Shows trunk information status port-channel NE, PE 4-154 show lacp PE 4-173 Trunk Status Display Command Shows LACP information Guidelines for Creating Trunks General Guidelines – • Finish configuring port trunks before you connect the corresponding network cables between switches to avoid creating a loop.
PAGE 408
COMMAND LINE INTERFACE • However, if the port channel admin key is set, then the port admin key must be set to the same value for a port to be allowed to join a channel group. • If a link goes down, LACP port priority is used to select the backup link. channel-group This command adds a port to a trunk. Use the no form to remove a port from a trunk. Syntax channel-group channel-id no channel-group channel-id - Trunk index (Range: 1-4) Default Setting The current port will be added to this trunk.
PAGE 409
LINK AGGREGATION COMMANDS lacp This command enables 802.3ad Link Aggregation Control Protocol (LACP) for the current interface. Use the no form to disable it. Syntax [no] lacp Default Setting Disabled Command Mode Interface Configuration (Ethernet) Command Usage • The ports on both ends of an LACP trunk must be configured for full duplex, either by forced mode or auto-negotiation. • A trunk formed with another switch using LACP will automatically be assigned the next available port-channel ID.
PAGE 410
COMMAND LINE INTERFACE Example The following shows LACP enabled on ports 11-13. Because LACP has also been enabled on the ports at the other end of the links, the show interfaces status port-channel 1 command shows that Trunk 1 has been established.
PAGE 411
LINK AGGREGATION COMMANDS • priority - This priority is used to determine link aggregation group (LAG) membership, and to identify this device to other switches during LAG negotiations. (Range: 0-65535) Default Setting 32768 Command Mode Interface Configuration (Ethernet) Command Usage • Port must be configured with the same system priority to join the same LAG. • System priority is combined with the switch’s MAC address to form the LAG identifier.
PAGE 412
COMMAND LINE INTERFACE lacp admin-key (Ethernet Interface) This command configures a port's LACP administration key. Use the no form to restore the default setting. Syntax lacp {actor | partner} admin-key key [no] lacp {actor | partner} admin-key • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. • key - The port admin key must be set to the same value for ports that belong to the same link aggregation group (LAG).
PAGE 413
LINK AGGREGATION COMMANDS lacp admin-key (Port Channel) This command configures a port channel's LACP administration key string. Use the no form to restore the default setting. Syntax lacp {actor | partner} admin-key key [no] lacp {actor | partner} admin-key key - The port channel admin key is used to identify a specific link aggregation group (LAG) during local LACP setup on this switch.
PAGE 414
COMMAND LINE INTERFACE lacp port-priority This command configures LACP port priority. Use the no form to restore the default setting. Syntax lacp {actor | partner} port-priority priority no lacp {actor | partner} port-priority • actor - The local side an aggregate link. • partner - The remote side of an aggregate link. • priority - LACP port priority is used to select a backup link.
PAGE 415
LINK AGGREGATION COMMANDS show lacp This command displays LACP information. Syntax show lacp [port-channel] {counters | internal | neighbors | sysid} • port-channel - Local identifier for a link aggregation group. (Range: 1-4) • counters - Statistics for LACP protocol messages. • internal - Configuration settings and operational state for local side. • neighbors - Configuration settings and operational state for remote side. • sysid - Summary of system priority and MAC address for all channel groups.
PAGE 416
COMMAND LINE INTERFACE Table 4-45 show lacp counters - display description 4-174 Field Description LACPDUs Sent Number of valid LACPDUs transmitted from this channel group. LACPDUs Received Number of valid LACPDUs received on this channel group. Marker Sent Number of valid Marker PDUs transmitted from this channel group. Marker Received Number of valid Marker PDUs received by this channel group.
PAGE 417
LINK AGGREGATION COMMANDS Console#show lacp 1 internal Channel group : 1 ------------------------------------------------------------------Oper Key : 4 Admin Key : 0 Eth 1/1 ------------------------------------------------------------------LACPDUs Internal : 30 sec LACP System Priority : 32768 LACP Port Priority : 32768 Admin Key : 4 Oper Key : 4 Admin State : defaulted, aggregation, long timeout, LACP-activity Oper State : distributing, collecting, synchronization, aggregation, long timeout, LACP-activity
PAGE 418
COMMAND LINE INTERFACE Table 4-46 show lacp internal - display description (Continued) Field Description Admin State, Administrative or operational values of the actor’s state parameters: Oper State • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive machine is using defaulted operational partner information, administratively configured for the partner. • Distributing – If false, distribution of outgoing frames on this link is disabled; i.e.
PAGE 419
LINK AGGREGATION COMMANDS Console#show lacp 1 neighbors Channel group 1 neighbors ------------------------------------------------------------------Eth 1/1 ------------------------------------------------------------------Partner Admin System ID : 32768, 00-00-00-00-00-00 Partner Oper System ID : 32768, 00-00-00-00-00-01 Partner Admin Port Number : 1 Partner Oper Port Number : 1 Port Admin Priority : 32768 Port Oper Priority : 32768 Admin Key : 0 Oper Key : 4 Admin State : defaulted, distributing, collectin
PAGE 420
COMMAND LINE INTERFACE Console#show lacp sysid Port Channel System Priority System MAC Address ------------------------------------------------------------------1 32768 00-30-F1-8F-2C-A7 2 32768 00-30-F1-8F-2C-A7 3 32768 00-30-F1-8F-2C-A7 4 32768 00-30-F1-8F-2C-A7 Console# Table 4-48 show lacp sysid - display description Field Description Channel group A link aggregation group configured on this switch. System Priority* LACP system priority for this channel group.
PAGE 421
ADDRESS TABLE COMMANDS mac-address-table static This command maps a static address to a destination port in a VLAN. Use the no form to remove an address. Syntax mac-address-table static mac-address interface interface vlan vlan-id [action] no mac-address-table static mac-address vlan vlan-id • mac-address - MAC address. • interface - ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
PAGE 422
COMMAND LINE INTERFACE • A static address cannot be learned on another port until the address is removed with the no form of this command. Example Console(config)#mac-address-table static 00-e0-29-94-34-de interface ethernet 1/1 vlan 1 delete-on-reset Console(config)# clear mac-address-table dynamic This command removes any learned entries from the forwarding database and clears the transmit and receive counts for any static or system configured entries.
PAGE 423
ADDRESS TABLE COMMANDS show mac-address-table This command shows classes of entries in the bridge-forwarding database. Syntax show mac-address-table [address mac-address [mask]] [interface interface] [vlan vlan-id] [sort {address | vlan | interface}] • mac-address - MAC address. • mask - Bits to match in the address. • interface - ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
PAGE 424
COMMAND LINE INTERFACE Example Console#show mac-address-table Interface Mac Address Vlan --------- ----------------- ---Eth 1/1 00-e0-29-94-34-de 1 Trunk 2 00-E0-29-8F-AA-1B 1 Console# Type ----------------Delete-on-reset Learned mac-address-table aging-time This command sets the aging time for entries in the address table. Use the no form to restore the default aging time. Syntax mac-address-table aging-time seconds no mac-address-table aging-time seconds - Aging time.
PAGE 425
SPANNING TREE COMMANDS Command Mode Privileged Exec Example Console#show mac-address-table aging-time Aging time: 100 sec. Console# Spanning Tree Commands This section includes commands that configure the Spanning Tree Algorithm (STA) globally for the switch, and commands that configure STA for the selected interface.
PAGE 426
COMMAND LINE INTERFACE Table 4-50 Spanning Tree Commands Command Function Mode Page spanning-tree portfast Sets an interface to fast forwarding IC 4-193 spanning-tree link-type Configures the link type for RSTP IC 4-194 spanning-tree protocol-migration Re-checks the appropriate BPDU format PE 4-196 show spanning-tree Shows spanning tree configuration for the common spanning tree (i.e.
PAGE 427
SPANNING TREE COMMANDS Example This example shows how to enable the Spanning Tree Algorithm for the switch: Console(config)#spanning-tree Console(config)# spanning-tree mode This command selects the spanning tree mode for this switch. Use the no form to restore the default. Syntax spanning-tree mode {stp | rstp} no spanning-tree mode • stp - Spanning Tree Protocol (IEEE 802.1D) • rstp - Rapid Spanning Tree Protocol (IEEE 802.
PAGE 428
COMMAND LINE INTERFACE RSTP Mode – If RSTP is using 802.1D BPDUs on a port and receives an RSTP BPDU after the migration delay expires, RSTP restarts the migration delay timer and begins using RSTP BPDUs on that port. Example The following example configures the switch to use Rapid Spanning Tree: Console(config)#spanning-tree mode rstp Console(config)# spanning-tree forward-time This command configures the spanning tree bridge forward time globally for this switch. Use the no form to restore the default.
PAGE 429
SPANNING TREE COMMANDS spanning-tree hello-time This command configures the spanning tree bridge hello time globally for this switch. Use the no form to restore the default. Syntax spanning-tree hello-time time no spanning-tree hello-time time - Time in seconds. (Range: 1-10 seconds). The maximum value is the lower of 10 or [(max-age / 2) -1].
PAGE 430
COMMAND LINE INTERFACE Command Mode Global Configuration Command Usage This command sets the maximum time (in seconds) a device can wait without receiving a configuration message before attempting to reconfigure. All device ports (except for designated ports) should receive configuration messages at regular intervals. Any port that ages out STA information (provided in the last configuration message) becomes the designated port for the attached LAN.
PAGE 431
SPANNING TREE COMMANDS Command Usage Bridge priority is used in selecting the root device, root port, and designated port. The device with the highest priority becomes the STA root device. However, if all devices have the same priority, the device with the lowest MAC address will then become the root device. Example Console(config)#spanning-tree priority 40960 Console(config)# spanning-tree pathcost method This command configures the path cost method used for Rapid Spanning Tree.
PAGE 432
COMMAND LINE INTERFACE spanning-tree transmission-limit This command configures the minimum interval between the transmission of consecutive RSTP BPDUs. Use the no form to restore the default. Syntax spanning-tree transmission-limit count no spanning-tree transmission-limit count - The transmission limit in seconds. (Range: 1-10) Default Setting 3 Command Mode Global Configuration Command Usage This command limits the maximum transmission rate for BPDUs.
PAGE 433
SPANNING TREE COMMANDS Default Setting • Ethernet – half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 • Fast Ethernet – half duplex: 200,000; full duplex: 100,000; trunk: 50,000 • Gigabit Ethernet – full duplex: 10,000; trunk: 5,000 Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command is used by the Spanning Tree Algorithm to determine the best path between devices.
PAGE 434
COMMAND LINE INTERFACE Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • This command defines the priority for the use of a port in the Spanning Tree Algorithm. If the path cost for all ports on a switch are the same, the port with the highest priority (that is, lowest value) will be configured as an active link in the spanning tree. • Where more than one port is assigned the highest priority, the port with the lowest numeric identifier will be enabled.
PAGE 435
SPANNING TREE COMMANDS of frame flooding required to rebuild address tables during reconfiguration events, does not cause the spanning tree to initiate reconfiguration when the interface changes state, and also overcomes other STA-related timeout problems. However, remember that Edge Port should only be enabled for ports connected to an end-node device. • This command has the same effect as the spanning-tree portfast.
PAGE 436
COMMAND LINE INTERFACE forwarding should only be enabled for ports connected to a LAN segment that is at the end of a bridged LAN or for an end-node device.) • This command is the same as spanning-tree edge-port, and is only included for backward compatibility with earlier products. Note that this command may be removed for future software versions.
PAGE 437
SPANNING TREE COMMANDS Command Usage • Specify a point-to-point link if the interface can only be connected to exactly one other bridge, or a shared link if it can be connected to two or more bridges. • When automatic detection is selected, the switch derives the link type from the duplex mode. A full-duplex interface is considered a point-to-point link, while a half-duplex interface is assumed to be on a shared link. • RSTP only works on point-to-point links between two bridges.
PAGE 438
COMMAND LINE INTERFACE Example Console#spanning-tree protocol-migration ethernet 1/5 Console# show spanning-tree This command shows the configuration for the spanning tree. Syntax show spanning-tree [interface] • interface - ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
PAGE 439
SPANNING TREE COMMANDS Example Console#show spanning-tree Spanning-tree information --------------------------------------------------------------Spanning tree mode: RSTP Spanning tree enabled/disabled: enabled Priority: 40960 Bridge Hello Time (sec.): 2 Bridge Max Age (sec.): 20 Bridge Forward Delay (sec.): 15 Root Hello Time (sec.): 2 Root Max Age (sec.): 20 Root Forward Delay (sec.): 15 Designated Root: 32768.0.
PAGE 440
COMMAND LINE INTERFACE VLAN Commands A VLAN is a group of ports that can be located anywhere in the network, but communicate as though they belong to the same physical segment. This section describes commands used to create VLAN groups, add port members, specify how VLAN tagging is used, and enable automatic VLAN registration for the selected interface.
PAGE 441
VLAN COMMANDS Command Mode Global Configuration Command Usage • Use the VLAN database command mode to add, change, and delete VLANs. After finishing configuration changes, you can display the VLAN settings by entering the show vlan command. • Use the interface vlan command mode to define the port membership mode and add or remove ports from a VLAN. The results of these commands are written to the running-configuration file, and you can display this file by entering the show running-config command.
PAGE 442
COMMAND LINE INTERFACE • state - Keyword to be followed by the VLAN state. - active - VLAN is operational. - suspend - VLAN is suspended. Suspended VLANs do not pass packets. Default Setting By default only VLAN 1 exists and is active. Command Mode VLAN Database Configuration Command Usage • no vlan vlan-id deletes the VLAN. • no vlan vlan-id name removes the VLAN name. • no vlan vlan-id state returns the VLAN to the default state (i.e., active). • You can configure up to 255 VLANs on the switch.
PAGE 443
VLAN COMMANDS Configuring VLAN Interfaces Table 4-53 Configuring VLAN Interfaces Command Function Mode Page interface vlan Enters interface configuration mode for a specified VLAN IC 4-201 switchport mode Configures VLAN membership mode IC for an interface 4-202 switchport Configures frame types to be accepted IC acceptable-frame-types by an interface 4-203 switchport ingress-filtering Enables ingress filtering on an interface IC 4-204 switchport native vlan Configures the PVID (native VLAN
PAGE 444
COMMAND LINE INTERFACE Example The following example shows how to set the interface configuration mode to VLAN 1, and then assign an IP address to the VLAN: Console(config)#interface vlan 1 Console(config-if)#ip address 192.168.1.254 255.255.255.0 Console(config-if)# Related Commands shutdown (4 -151) switchport mode This command configures the VLAN membership mode for a port. Use the no form to restore the default.
PAGE 445
VLAN COMMANDS Example The following shows how to set the configuration mode to port 1, and then set the switchport mode to hybrid: Console(config)#interface ethernet 1/1 Console(config-if)#switchport mode hybrid Console(config-if)# Related Commands switchport acceptable-frame-types (4 -203) switchport acceptable-frame-types This command configures the acceptable frame types for a port. Use the no form to restore the default.
PAGE 446
COMMAND LINE INTERFACE Related Commands switchport mode (4 -202) switchport ingress-filtering This command enables ingress filtering for an interface. Use the no form to restore the default. Syntax [no] switchport ingress-filtering Default Setting Disabled Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Ingress filtering only affects tagged frames.
PAGE 447
VLAN COMMANDS switchport native vlan This command configures the PVID (i.e., default VLAN ID) for a port. Use the no form to restore the default. Syntax switchport native vlan vlan-id no switchport native vlan vlan-id - Default VLAN ID for a port.
PAGE 448
COMMAND LINE INTERFACE switchport allowed vlan This command configures VLAN groups on the selected interface. Use the no form to restore the default. Syntax switchport allowed vlan {add vlan-list [tagged | untagged] | remove vlan-list} no switchport allowed vlan • add vlan-list - List of VLAN identifiers to add. • remove vlan-list - List of VLAN identifiers to remove. • vlan-list - Separate nonconsecutive VLAN identifiers with a comma and no spaces; use a hyphen to designate a range of IDs.
PAGE 449
VLAN COMMANDS • If a VLAN on the forbidden list for an interface is manually added to that interface, the VLAN is automatically removed from the forbidden list for that interface. Example The following example shows how to add VLANs 1, 2, 5 and 6 to the allowed list as tagged VLANs for port 1: Console(config)#interface ethernet 1/1 Console(config-if)#switchport allowed vlan add 1,2,5,6 tagged Console(config-if)# switchport forbidden vlan This command configures forbidden VLANs.
PAGE 450
COMMAND LINE INTERFACE Example The following example shows how to prevent port 1 from being added to VLAN 3: Console(config)#interface ethernet 1/1 Console(config-if)#switchport forbidden vlan add 3 Console(config-if)# Displaying VLAN Information Table 4-54 Show VLAN Commands Command Function Mode Page show vlan Shows VLAN information NE, PE 4-208 show interfaces status vlan Displays status for the specified VLAN interface NE, PE 4-154 show interfaces switchport Displays the administrative and
PAGE 451
VLAN COMMANDS Example The following example shows how to display information for VLAN 1: Console#show vlan id 1 Vlan ID: Type: Name: Status: Ports/Port channel: 1 Static DefaultVlan Active Eth1/ 1(S) Eth1/ 2(S) Eth1/ 6(S) Eth1/ 7(S) Eth1/11(S) Eth1/12(S) Eth1/16(S) Eth1/17(S) Eth1/21(S) Eth1/22(S) Eth1/26(S) Eth1/ 3(S) Eth1/ 8(S) Eth1/13(S) Eth1/18(S) Eth1/23(S) Eth1/ 4(S) Eth1/ 9(S) Eth1/14(S) Eth1/19(S) Eth1/24(S) Eth1/ 5(S) Eth1/10(S) Eth1/15(S) Eth1/20(S) Eth1/25(S) Console# Configuring Private VL
PAGE 452
COMMAND LINE INTERFACE Table 4-55 Private VLAN Commands Command Function Mode Page Display Private VLAN Information show vlan private-vlan Shows private VLAN information NE, PE 4-217 To configure private VLANs, follow these steps: 1. 2. 3. 4. 5. 6. Use the private-vlan command to designate one or more community VLANs and the primary VLAN that will channel traffic outside the community groups. Use the private-vlan association command to map the secondary (i.e.
PAGE 453
VLAN COMMANDS VLANs, and serves to channel traffic between community VLANs and other locations. • isolated – Specifies an isolated VLAN. Ports assigned to an isolated VLAN can only communicate with promiscuous ports within their own VLAN.
PAGE 454
COMMAND LINE INTERFACE • primary-vlan-id - ID of primary VLAN. (Range: 1-4094, no leading zeroes). • secondary-vlan-id - ID of secondary (i.e, community) VLAN. (Range: 1-4094, no leading zeroes). Default Setting None Command Mode VLAN Configuration Command Usage Secondary VLANs provide security for group members. The associated primary VLAN provides a common interface for access to other network resources within the primary VLAN (e.g.
PAGE 455
VLAN COMMANDS switchport mode private-vlan Use this command to set the private VLAN mode for an interface. Use the no form to restore the default setting. Syntax switchport mode private-vlan {host | promiscuous} no switchport mode private-vlan • host – This port type can communicate with all other host ports assigned to the same secondary VLAN. All communications outside of this VLAN must pass through a promiscuous port in the associated primary VLAN.
PAGE 456
COMMAND LINE INTERFACE switchport private-vlan host-association Use this command to associate an interface with a secondary VLAN. Use the no form to remove this association. Syntax switchport private-vlan host-association secondary-vlan-id no switchport private-vlan host-association secondary-vlan-id - ID of secondary (i.e, community) VLAN. (Range: 2-4094, no leading zeroes).
PAGE 457
VLAN COMMANDS Default Setting None Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage Promiscuous ports assigned to a primary VLAN can communicate with any other promiscuous ports in the same VLAN, and with the group members within any associated secondary VLANs.
PAGE 458
COMMAND LINE INTERFACE Example Console#show vlan private-vlan Primary Secondary Type -------- ----------- ---------5 primary 5 6 community 0 8 isolated Console# Interfaces -----------------------------Eth1/ 3 Eth1/ 4 Eth1/ 5 GVRP and Bridge Extension Commands GARP VLAN Registration Protocol defines a way for switches to exchange VLAN information in order to automatically register VLAN members on interfaces across the network.
PAGE 459
GVRP AND BRIDGE EXTENSION COMMANDS bridge-ext gvrp This command enables GVRP globally for the switch. Use the no form to disable it. Syntax [no] bridge-ext gvrp Default Setting Disabled Command Mode Global Configuration Command Usage GVRP defines a way for switches to exchange VLAN information in order to register VLAN members on ports across the network. This function should be enabled to permit automatic VLAN registration, and to support VLANs which extend beyond the local switch.
PAGE 460
COMMAND LINE INTERFACE Example Console#show bridge-ext Max support vlan numbers: Max support vlan ID: Extended multicast filtering services: Static entry individual port: VLAN learning: Configurable PVID tagging: Local VLAN capable: Traffic classes: Global GVRP status: GMRP: Console# 255 4094 No Yes IVL Yes No Enabled Enabled Disabled switchport gvrp This command enables GVRP for a port. Use the no form to disable it.
PAGE 461
GVRP AND BRIDGE EXTENSION COMMANDS show gvrp configuration This command shows if GVRP is enabled. Syntax show gvrp configuration [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) • port-channel channel-id (Range: 1-4) Default Setting Shows both global and interface-specific configuration.
PAGE 462
COMMAND LINE INTERFACE Default Setting • join: 20 centiseconds • leave: 60 centiseconds • leaveall: 1000 centiseconds Command Mode Interface Configuration (Ethernet, Port Channel) Command Usage • Group Address Registration Protocol is used by GVRP and GMRP to register or deregister client attributes for client services within a bridged LAN. The default values for the GARP timers are independent of the media access method or data rate.
PAGE 463
GVRP AND BRIDGE EXTENSION COMMANDS show garp timer This command shows the GARP timers for the selected interface. Syntax show garp timer [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) • port-channel channel-id (Range: 1-4) Default Setting Shows all GARP timers.
PAGE 464
COMMAND LINE INTERFACE Priority Commands The commands described in this section allow you to specify which data packets have greater precedence when traffic is buffered in the switch due to congestion. This switch supports CoS with four priority queues for each port. Data packets in a port’s high-priority queue will be transmitted before those in the lower-priority queues.
PAGE 465
PRIORITY COMMANDS Table 4-58 Priority Commands (Layer 2) Command Function Mode Page show queue cos-map Shows the class-of-service map PE 4-228 show interfaces switchport Displays the administrative and operational PE status of an interface 4-157 queue mode This command sets the queue mode to strict priority or Weighted Round-Robin (WRR) for the class of service (CoS) priority queues. Use the no form to restore the default value.
PAGE 466
COMMAND LINE INTERFACE Example The following example sets the queue mode to strict priority service mode: Console(config)#queue mode strict Console(config)# switchport priority default This command sets a priority for incoming untagged frames. Use the no form to restore the default value. Syntax switchport priority default default-priority-id no switchport priority default default-priority-id - The priority number for untagged ingress traffic. The priority is a number from 0 to 7.
PAGE 467
PRIORITY COMMANDS Therefore, any inbound frames that do not have priority tags will be placed in queue 0 of the output port. (Note that if the output port is an untagged member of the associated VLAN, these frames are stripped of all VLAN tags prior to transmission.
PAGE 468
COMMAND LINE INTERFACE Related Commands show queue bandwidth (4 -227) queue cos-map This command assigns class of service (CoS) values to the priority queues (i.e., hardware output queues 0 - 3). Use the no form set the CoS map to the default values. Syntax queue cos-map queue_id [cos1 ... cosn] no queue cos-map • queue_id - The ID of the priority queue. Ranges are 0 to 3, where 3 is the highest priority queue. • cos1 .. cosn - The CoS values that are mapped to the queue ID.
PAGE 469
PRIORITY COMMANDS Example The following example shows how to map CoS values 0, 1 and 2 to egress queue 0, value 3 to egress queue 1, values 4 and 5 to egress queue 2, and values 6 and 7 to egress queue 3: Console(config)#interface ethernet 1/1 Console(config-if)#queue cos-map 0 0 1 2 Console(config-if)#queue cos-map 1 3 Console(config-if)#queue cos-map 2 4 5 Console(config-if)#queue cos-map 3 6 7 Console(config-if)#end Console#show queue cos-map ethernet 1/1 Information of Eth 1/1 CoS Value : 0 1 2 3 4 5 6
PAGE 470
COMMAND LINE INTERFACE Command Mode Privileged Exec Example Console#show queue bandwidth Queue ID Weight -------- -----0 1 1 2 2 4 3 6 Console# show queue cos-map This command shows the class of service priority map. Syntax show queue cos-map [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
PAGE 471
PRIORITY COMMANDS Priority Commands (Layer 3 and 4) Table 4-60 Priority Commands (Layer 3 and 4) Command Function Mode Page map ip port Enables TCP class of service mapping GC 4-229 map ip port Maps TCP socket to a class of service IC 4-230 map ip precedence Enables IP precedence class of service mapping GC 4-229 map ip precedence Maps IP precedence value to a class of service IC 4-232 map ip dscp Enables IP DSCP class of service mapping GC 4-233 map ip dscp Maps IP DSCP value to a
PAGE 472
COMMAND LINE INTERFACE Default Setting Disabled Command Mode Global Configuration Command Usage The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. Example The following example shows how to enable TCP/UDP port mapping globally: Console(config)#map ip port Console(config)# map ip port (Interface Configuration) This command set IP port priority (i.e., TCP/UDP port priority). Use the no form to remove a specific setting.
PAGE 473
PRIORITY COMMANDS Example The following example shows how to map HTTP traffic to CoS value 0: Console(config)#interface ethernet 1/5 Console(config-if)#map ip port 80 cos 0 Console(config-if)# map ip precedence (Global Configuration) This command enables IP precedence mapping (i.e., IP Type of Service). Use the no form to disable IP precedence mapping.
PAGE 474
COMMAND LINE INTERFACE map ip precedence (Interface Configuration) This command sets IP precedence priority (i.e., IP Type of Service priority). Use the no form to restore the default table. Syntax map ip precedence ip-precedence-value cos cos-value no map ip precedence • precedence-value - 3-bit precedence value. (Range: 0-7) • cos-value - Class-of-Service value (Range: 0-7) Default Setting The list below shows the default priority mapping.
PAGE 475
PRIORITY COMMANDS map ip dscp (Global Configuration) This command enables IP DSCP mapping (i.e., Differentiated Services Code Point mapping). Use the no form to disable IP DSCP mapping. Syntax [no] map ip dscp Default Setting Disabled Command Mode Global Configuration Command Usage • The precedence for priority mapping is IP Port, IP Precedence or IP DSCP, and default switchport priority. • IP Precedence and IP DSCP cannot both be enabled.
PAGE 476
COMMAND LINE INTERFACE Default Setting The DSCP default values are defined in the following table. Note that all the DSCP values that are not specified are mapped to CoS value 0.
PAGE 477
PRIORITY COMMANDS show map ip port Use this command to show the IP port priority map. Syntax show map ip port [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) • port-channel channel-id (Range: 1-4) Default Setting None Command Mode Privileged Exec Example The following shows that HTTP traffic has been mapped to CoS value 0: Console#show map ip port TCP port mapping status: enabled Port Port no.
PAGE 478
COMMAND LINE INTERFACE show map ip precedence This command shows the IP precedence priority map. Syntax show map ip precedence [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number.
PAGE 479
PRIORITY COMMANDS show map ip dscp This command shows the IP DSCP priority map. Syntax show map ip dscp [interface] interface • ethernet unit/port - unit - Stack unit. (Range: 1-8) - port - Port number. (Range: 1-26) • port-channel channel-id (Range: 1-4) Default Setting None Command Mode Privileged Exec Example Console#show map ip dscp ethernet 1/1 DSCP mapping status: enabled Port DSCP COS --------- ---- --Eth 1/ 1 0 0 Eth 1/ 1 1 0 Eth 1/ 1 2 0 Eth 1/ 1 3 0 . . .
PAGE 480
COMMAND LINE INTERFACE Multicast Filtering Commands This switch uses IGMP (Internet Group Management Protocol) to query for any attached hosts that want to receive a specific multicast service. It identifies the ports containing hosts requesting a service and sends data out to those ports only. It then propagates the service request up to any neighboring multicast switch/router to ensure that it will continue to receive the multicast service.
PAGE 481
MULTICAST FILTERING COMMANDS ip igmp snooping This command enables IGMP snooping on this switch. Use the no form to disable it. Syntax [no] ip igmp snooping Default Setting Enabled Command Mode Global Configuration Example The following example enables IGMP snooping. Console(config)#ip igmp snooping Console(config)# ip igmp snooping vlan static This command adds a port to a multicast group. Use the no form to remove the port.
PAGE 482
COMMAND LINE INTERFACE Command Mode Global Configuration Example The following shows how to statically configure a multicast group on a port: Console(config)#ip igmp snooping vlan 1 static 224.0.0.12 ethernet 1/5 Console(config)# ip igmp snooping version This command configures the IGMP snooping version. Use the no form to restore the default.
PAGE 483
MULTICAST FILTERING COMMANDS show ip igmp snooping This command shows the IGMP snooping configuration. Default Setting None Command Mode Privileged Exec Command Usage See “Configuring IGMP Snooping and Query Parameters” on page 4 -184 for a description of the displayed items.
PAGE 484
COMMAND LINE INTERFACE Command Mode Privileged Exec Command Usage Member types displayed include IGMP or USER, depending on selected options. Example The following shows the multicast entries learned through IGMP snooping for VLAN 1: Console#show mac-address-table multicast vlan 1 igmp-snooping VLAN M'cast IP addr. Member ports Type ---- --------------- ------------ ------1 224.1.2.
PAGE 485
MULTICAST FILTERING COMMANDS ip igmp snooping querier This command enables the switch as an IGMP querier. Use the no form to disable it. Syntax [no] ip igmp snooping querier Default Setting Enabled Command Mode Global Configuration Command Usage If enabled, the switch will serve as querier if elected. The querier is responsible for asking hosts if they want to receive multicast traffic.
PAGE 486
COMMAND LINE INTERFACE Command Usage The query count defines how long the querier waits for a response from a multicast client before taking action. If a querier has sent a number of queries defined by this command, but a client has not responded, a countdown timer is started using the time defined by ip igmp snooping query-max- response-time. If the countdown finishes, and the client still has not responded, then that client is considered to have left the multicast group.
PAGE 487
MULTICAST FILTERING COMMANDS ip igmp snooping query-max-response-time This command configures the query report delay. Use the no form to restore the default. Syntax ip igmp snooping query-max-response-time seconds no ip igmp snooping query-max-response-time seconds - The report delay advertised in IGMP queries. (Range: 5-25) Default Setting 10 seconds Command Mode Global Configuration Command Usage • The switch must be using IGMPv2 for this command to take effect.
PAGE 488
COMMAND LINE INTERFACE ip igmp snooping router-port-expire-time This command configures the query timeout. Use the no form to restore the default. Syntax ip igmp snooping router-port-expire-time seconds no ip igmp snooping router-port-expire-time seconds - The time the switch waits after the previous querier stops before it considers the router port (i.e., the interface which had been receiving query packets) to have expired.
PAGE 489
MULTICAST FILTERING COMMANDS Static Multicast Routing Commands Table 4-66 Static Multicast Routing Commands Command Function Mode Page ip igmp snooping vlan mrouter Adds a multicast router port GC 4-247 show ip igmp snooping Shows multicast router ports mrouter PE 4-248 ip igmp snooping vlan mrouter This command statically configures a multicast router port. Use the no form to remove the configuration.
PAGE 490
COMMAND LINE INTERFACE Example The following shows how to configure port 11 as a multicast router port within VLAN 1: Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11 Console(config)# show ip igmp snooping mrouter This command displays information on statically configured and dynamically learned multicast router ports. Syntax show ip igmp snooping mrouter [vlan vlan-id] vlan-id - VLAN ID (Range: 1-4094) Default Setting Displays multicast router ports for all configured VLANs.
PAGE 491
IP INTERFACE COMMANDS IP Interface Commands An IP addresses may be used for management access to the switch over your network. The IP address for this switch is obtained via DHCP by default. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server when it is powered on. You may also need to a establish a default gateway between this device and management stations or other devices that exist on another network segment.
PAGE 492
COMMAND LINE INTERFACE Default Setting DHCP Command Mode Interface Configuration (VLAN) Command Usage • You must assign an IP address to this device to gain management access over the network. You can manually configure a specific IP address, or direct the device to obtain an address from a BOOTP or DHCP server. Valid IP addresses consist of four numbers, 0 to 255, separated by periods. Anything outside this format will not be accepted by the configuration program.
PAGE 493
IP INTERFACE COMMANDS ip dhcp restart This command submits a BOOTP or DHCP client request. Default Setting None Command Mode Privileged Exec Command Usage • This command issues a BOOTP or DHCP client request for any IP interface that has been set to BOOTP or DHCP mode via the ip address command. • DHCP requires the server to reassign the client’s last address if available.
PAGE 494
COMMAND LINE INTERFACE ip default-gateway This command establishes a static route between this switch and devices that exist on another network segment. Use the no form to remove the static route. Syntax ip default-gateway gateway no ip default-gateway gateway - IP address of the default gateway Default Setting No static route is established. Command Mode Global Configuration Command Usage A gateway must be defined if the management station is located in a different IP segment.
PAGE 495
IP INTERFACE COMMANDS Example Console#show ip interface IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1, and address mode: User specified. Console# Related Commands show ip redirects (4 -253) show ip redirects This command shows the default gateway configured for this device. Default Setting None Command Mode Privileged Exec Example Console#show ip redirects IP default gateway 10.1.0.
PAGE 496
COMMAND LINE INTERFACE Default Setting This command has no default for the host. Command Mode Normal Exec, Privileged Exec Command Usage • Use the ping command to see if another site on the network can be reached. • Following are some results of the ping command: - Normal response - The normal response occurs in one to ten seconds, depending on network traffic. - Destination does not respond - If the host does not respond, a “timeout” appears in ten seconds.
PAGE 497
APPENDIX A SOFTWARE SPECIFICATIONS Software Features Authentication Local, RADIUS, TACACS, Port (802.1X), HTTPS, SSH, Port Security Access Control Lists IP, MAC (up to 88 lists) DHCP Client Port Configuration 100BASE-TX: 10/100 Mbps, half/full duplex 1000BASE-T: 1000 Mbps, full duplex Flow Control Full Duplex: IEEE 802.
PAGE 498
SOFTWARE SPECIFICATIONS Spanning Tree Protocol Spanning Tree Protocol (STP, IEEE 802.1D) Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) VLAN Support Up to 255 groups; port-based or tagged (802.
PAGE 499
SOFTWARE SPECIFICATIONS RMON Groups 1, 2, 3, 9 (Statistics, History, Alarm, Event) Standards IEEE 802.1D Spanning Tree Protocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1w Rapid Spanning Tree Protocol IEEE 802.1X Port Authentication IEEE 802.3-2002 Ethernet, Fast Ethernet, Gigabit Ethernet IEEE 802.3-2002 Full-duplex flow control IEEE 802.3-2002 Link Aggregation Control Protocol IEEE 802.
PAGE 500
SOFTWARE SPECIFICATIONS Management Information Bases Bridge MIB (RFC 1493) Entity MIB (RFC 2737) Ether-like MIB (RFC 2665) Extended Bridge MIB (RFC 2674) Extensible SNMP Agents MIB (RFC 2742) Forwarding Table MIB (RFC 2096) IGMP MIB (RFC 2933) Interface Group MIB (RFC 2233) Interfaces Evolution MIB (RFC 2863) IP MIB (RFC 2011) IP Multicasting related MIBs MAU MIB (RFC 2668) MIB II (RFC 1212, 1213) Port Access Entity MIB (IEEE 802.
PAGE 501
APPENDIX B TROUBLESHOOTING Problems Accessing the Management Interface Table B-1 Troubleshooting Chart Symptom Action Cannot connect using Telnet, web browser, or SNMP software • Be sure the switch is powered up. • Check network cabling between the management station and the switch. • Check that you have a valid network connection to the switch and that the port you are using has not been disabled.
PAGE 502
TROUBLESHOOTING Table B-1 Troubleshooting Chart (Continued) Symptom Action Cannot connect using Secure Shell • If you cannot connect using SSH, you may have exceeded the maximum number of concurrent Telnet/SSH sessions permitted. Try connecting again at a later time. • Be sure the control parameters for the SSH server are properly configured on the switch, and that the SSH client software is properly configured on the management station.
PAGE 503
USING SYSTEM LOGS Using System Logs If a fault does occur, refer to the Installation Guide to ensure that the problem you encountered is actually caused by the switch. If the problem appears to be caused by the switch, follow these steps: 1. Enable logging. 2. Set the error messages reported to include all categories. 3. Designate the SNMP host that is to receive the error messages. 4. Repeat the sequence of commands or other actions that lead up to the error. 5.
PAGE 504
TROUBLESHOOTING B-4
PAGE 505
GLOSSARY Access Control List (ACL) ACLs can limit network traffic and restrict access to certain users or devices by checking each packet for certain IP or MAC (i.e., Layer 2) information. Boot Protocol (BOOTP) BOOTP is used to provide bootup information for network devices, including IP address information, the address of the TFTP server that contains the devices system files, and the name of the boot file.
PAGE 506
GLOSSARY Dynamic Host Control Protocol (DHCP) Provides a framework for passing configuration information to hosts on a TCP/IP network. DHCP is based on the Bootstrap Protocol (BOOTP), adding the capability of automatic allocation of reusable network addresses and additional configuration options. Extensible Authentication Protocol over LAN (EAPOL) EAPOL is a client authentication protocol used by this switch to verify the network access rights for any device that is plugged into the switch.
PAGE 507
GLOSSARY IEEE 802.1D Specifies a general method for the operation of MAC bridges, including the Spanning Tree Protocol. IEEE 802.1Q VLAN Tagging—Defines Ethernet frame tags which carry VLAN information. It allows switches to assign endstations to different virtual LANs, and defines a standard way for VLANs to communicate across switched networks. IEEE 802.1p An IEEE standard for providing quality of service (QoS) in Ethernet networks.
PAGE 508
GLOSSARY IGMP Query On each subnetwork, one IGMP-capable device will act as the querier — that is, the device that asks all hosts to report on the IP multicast groups they wish to join or to which they already belong. The elected querier will be the device with the lowest IP address in the subnetwork. Internet Group Management Protocol (IGMP) A protocol through which hosts can register with their local router for multicast services.
PAGE 509
GLOSSARY Link Aggregation See Port Trunk. Link Aggregation Control Protocol (LACP) Allows ports to automatically negotiate a trunked link with LACP-configured ports on another device. Management Information Base (MIB) An acronym for Management Information Base. It is a set of database objects that contains information about a specific device. MD5 Message-Digest Algorithm An algorithm that is used to create digital signatures.
PAGE 510
GLOSSARY Port Mirroring A method whereby data on a target port is mirrored to a monitor port for troubleshooting with a logic analyzer or RMON probe. This allows data on the target port to be studied unobstructively. Port Trunk Defines a network link aggregation and trunking method which specifies how to create a single high-speed logical link that combines several lower-speed physical links. Private VLANs Private VLANs provide port-based security and isolation between ports within the assigned VLAN.
PAGE 511
GLOSSARY Simple Network Management Protocol (SNMP) The application protocol in the Internet suite of protocols which offers network management services. Simple Network Time Protocol (SNTP) SNTP allows a device to set its internal clock based on periodic updates from a Network Time Protocol (NTP) server. Updates can be requested from a specific NTP server, or can be received via broadcasts sent by NTP servers. Spanning Tree Algorithm (STA) A technology that checks your network for any loops.
PAGE 512
GLOSSARY User Datagram Protocol (UDP) UDP provides a datagram mode for packet-switched communications. It uses IP as the underlying transport mechanism to provide access to IP-like services. UDP packets are delivered just like IP packets – connection-less datagrams that may be discarded before reaching their targets. UDP is useful when TCP would be too complex, too slow, or just unnecessary.
PAGE 513
INDEX Numerics 802.
PAGE 514
INDEX G L GARP VLAN Registration Protocol See GVRP gateway, default 3-18, 4-252 GVRP global setting 4-217 interface configuration 3-157, 4-218 GVRP, global setting 3-147 LACP local parameters 4-173 partner parameters 4-173 protocol message statistics 4-173 link type, STA 3-138, 3-141, 4-194 logging syslog traps 4-63 to syslog servers 4-61 log-in, Web interface 3-3 logon authentication 3-48, 4-95 RADIUS client 4-99 RADIUS server 4-99 TACACS+ client 3-50, 4-103 TACACS+ server 3-50, 4-103 logon authenticat
PAGE 515
INDEX path cost 3-128, 3-137 method 3-133, 4-189 STA 3-128, 3-137, 4-189 port authentication 3-66 port priority configuring 3-168, 4-222 default ingress 3-168, 4-224 STA 3-137, 4-191 port security, configuring 3-64, 4-106 port, statistics 3-115, 4-155 ports autonegotiation 3-92, 4-148 broadcast storm threshold 3-109, 4-152 capabilities 3-92, 4-149 duplex mode 3-91, 4-147 flow control 3-91, 4-150 speed 3-91, 4-147 ports, configuring 3-88, 4-145 ports, mirroring 3-111, 4-159 primary VLAN 3-160 priority, defau
PAGE 516
INDEX STA 3-125, 4-183 edge port 3-138, 3-141, 4-192 global settings, configuring 3-131, 4-184–4-190 global settings, displaying 3-127, 4-196 interface settings 3-135, 4-190–4-195, 4-196 link type 3-138, 3-141, 4-194 path cost 3-128, 3-137, 4-190 path cost method 3-133, 4-189 port priority 3-137, 4-191 protocol migration 3-141, 4-195 transmission limit 3-133, 4-190 standards, IEEE A-3 startup files creating 3-26, 4-89 displaying 3-22, 4-79 setting 3-22, 4-94 static addresses, setting 3-122, 4-179 statistics
PAGE 517
PAGE 518
FOR TECHNICAL SUPPORT, CALL: From U.S.A. and Canada (24 hours a day, 7 days a week) (800) SMC-4-YOU; Phn: (949) 679-8000; Fax: (949) 679-1481 From Europe: Contact details can be found on www.smc-europe.com or www.smc.com INTERNET E-mail addresses: techsupport@smc.com european.techsupport@smc-europe.com Driver updates: http://www.smc.com/index.cfm?action=tech_support_drivers_downloads World Wide Web: http://www.smc.com http://www.smc-europe.com FOR LITERATURE OR ADVERTISING RESPONSE, CALL: U.S.A.