Accton Technology Switch ES3526XA User Manual

Table 4-31 Port Security Commands

4-78

4-81

Table 4-32 802.1X Port Authentication

Table 4-33 Network Access

Table 4-34 Access Control Lists

Table 4-36 Egress Queue Priority Mapping

Table 4-37 MAC ACLs

Table 4-38 Egress Queue Priority Mapping

Table 4-39 ACL Information

Table 4-40 SNMP Commands

Table 4-41 show snmp engine-id - display description

Table 4-42 show snmp view - display description

Table 4-43 show snmp group - display description

Table 4-44 show snmp user - display description

Table 4-45 Interface Commands

Table 4-46 Interfaces Switchport Statistics

Table 4-47 Mirror Port Commands

Table 4-48 Rate Limit Commands

Table 4-49 Link Aggregation Commands

Table 4-50 show lacp counters - display description

Table 4-51 show lacp internal - display description

Table 4-52 show lacp neighbors - display description

Table 4-54 Address Table Commands

Table 4-53 show lacp sysid - display description

Table 4-55 Spanning Tree Commands

Table 4-56 VLANs

Table 4-57 Editing VLAN Groups

Table 4-58 Configuring VLAN Interfaces

Table 4-59 Show VLAN Commands

Table 4-60 Private VLAN Commands

Table 4-61 GVRP and Bridge Extension Commands

Table 4-62 Priority Commands

Table 4-63 Priority Commands (Layer 2)

Table 4-64 Default CoS Priority Levels

Table 4-65 Priority Commands (Layer 3 and 4)

Table 4-66 Mapping IP Precedence Values

Table 4-67 IP DSCP to CoS Vales

Table 4-68 Multicast Filtering Commands

Table 4-69 IGMP Snooping Commands

Table 4-70 IGMP Query Commands (Layer 2)

Table 4-71 Static Multicast Routing Commands

xvi

Download from Www.Somanuals.com. All Manuals Search And Download.

Tables

4-221

Table 4-72 IGMP Filtering and Throttling Commands

Table 4-73 Multicast VLAN Registration Commands

Table 4-74 show mvr - display description

Table 4-76 show mvr members - display description

Table 4-75 show mvr interface - display description

Table 4-77 DNS Commands

Table 4-78 show dns cache - display description

Table 4-79 DHCP Commands

Table 4-80 IP Interface Commands

Table 4-81 Switch Cluster Commands

Table B-1

Troubleshooting Chart

xvii

Download from Www.Somanuals.com. All Manuals Search And Download.

Tables

xviii

Download from Www.Somanuals.com. All Manuals Search And Download.

Figures

Displaying Switch Information

Bridge Extension Configuration

Manual IP Configuration

IP Configuration using DHCP

DHCP Relay Option 82 Configuration

Operation Code Image File Transfer

Figure 3-10 Select Start-Up Operation File

Figure 3-11 Deleting Files

Figure 3-12 Copy Configuration Settings

Figure 3-13 Setting the Startup Configuration Settings

Figure 3-14 Console Port Settings

Figure 3-15 Enabling Telnet

Figure 3-16 System Logs

Figure 3-17 Remote Logs

Figure 3-18 Displaying Logs

Figure 3-19 Enabling and Configuring SMTP Alerts

Figure 3-20 Resetting the System

Figure 3-21 SNTP Configuration

Figure 3-22 NTP Client Configuration

Figure 3-23 Setting the System Clock

Figure 3-24 Enabling the SNMP Agent

Figure 3-25 Configuring SNMP Community Strings

Figure 3-26 Configuring SNMP Trap Managers

Figure 3-27 Setting the SNMPv3 Engine ID

Figure 3-28 Setting an Engine ID

Figure 3-29 Configuring SNMPv3 Users

Figure 3-30 Configuring Remote SNMPv3 Users

Figure 3-31 Configuring SNMPv3 Groups

Figure 3-32 Configuring SNMPv3 Views

Figure 3-33 Access Levels

Figure 3-34 Authentication Settings

Figure 3-35 HTTPS Settings

Figure 3-36 SSH Host-Key Settings

Figure 3-37 SSH Server Settings

Figure 3-38 Configuring Port Security

Figure 3-39 802.1X Global Information

Figure 3-40 802.1X Configuration

Figure 3-41 802.1X Port Configuration

Figure 3-42 Displaying 802.1X Port Statistics

xix

Download from Www.Somanuals.com. All Manuals Search And Download.

Figures

Figure 3-43 Network Access Configuration

Figure 3-44 Network Access Port Configuration

Figure 3-45 Network Access MAC Address Information

Figure 3-46 Network Access MAC Filter Configuration

Figure 3-47 Creating a Web IP Filter List

Figure 3-48 Selecting ACL Type

Figure 3-49 ACL Configuration - Standard IP

Figure 3-50 ACL Configuration - Extended IP

Figure 3-51 ACL Configuration - MAC

Figure 3-52 Binding a Port to an ACL

Figure 3-53 Displaying Port/Trunk Information

Figure 3-54 Port/Trunk Configuration

Figure 3-55 Configuring Port Trunks

Figure 3-56 LACP Configuration

Figure 3-57 LACP - Aggregation Port

Figure 3-58 LACP - Port Counters Information

Figure 3-59 LACP - Port Internal Information

Figure 3-60 LACP - Port Neighbors Information

Figure 3-61 Port Broadcast Control

Figure 3-62 Mirror Port Configuration

Figure 3-63 Rate Limit Granularity Configuration

Figure 3-64 Output Rate Limit Port Configuration

Figure 3-65 Port Statistics

Figure 3-66 Static Addresses

Figure 3-67 Dynamic Addresses

Figure 3-68 Address Aging

Figure 3-69 STA Information

Figure 3-70 STA Global Configuration

Figure 3-71 STA Port Information

Figure 3-72 STA Port Configuration

Figure 3-73 MSTP VLAN Configuration

Figure 3-74 MSTP Port Information

Figure 3-75 MSTP Port Configuration

Figure 3-76 GLobally Enabling GVRP

Figure 3-77 VLAN Basic Information

Figure 3-78 VLAN Current Table

Figure 3-79 VLAN Static List - Creating VLANs

Figure 3-80 VLAN Static Table - Adding Static Members

Figure 3-81 VLAN Static Membership by Port

Figure 3-82 VLAN Port Configuration

Figure 3-83 Private VLAN Information

Figure 3-84 Private VLAN Configuration

Figure 3-85 Private VLAN Association

Figure 3-86 Private VLAN Port Information

Figure 3-87 Private VLAN Port Configuration

Download from Www.Somanuals.com. All Manuals Search And Download.

Figures

3-159

Figure 3-88 Port Priority Configuration

Figure 3-89 Traffic Classes

Figure 3-90 Queue Mode

Figure 3-91 Configuring Queue Scheduling

Figure 3-92 IP Precedence/DSCP Priority Status

Figure 3-93 Mapping IP Precedence Priority Values

Figure 3-94 Mapping IP DSCP Priority Values

Figure 3-95 IP Port Priority Status

Figure 3-96 IP Port Priority

Figure 3-97 ACL CoS Priority

Figure 3-98 IGMP Configuration

Figure 3-99 IGMP Immediate Leave

Figure 3-100 Displaying Multicast Router Port Information

Figure 3-101 Static Multicast Router Port Configuration

Figure 3-102 IP Multicast Registration Table

Figure 3-103 IGMP Member Port Table

Figure 3-104 Enabling IGMP Filtering and Throttling

Figure 3-105 IGMP Profile Configuration

Figure 3-106 IGMP Filter and Throttling Port Configuration

Figure 3-107 MVR Global Configuration

Figure 3-108 MVR Port Information

Figure 3-109 MVR Group IP Information

Figure 3-110 MVR Port Configuration

Figure 3-111 MVR Group Member Configuration

Figure 3-112 DNS General Configuration

Figure 3-113 DNS Static Host Table

Figure 3-114 DNS Cache

Figure 3-115 Cluster Configuration

Figure 3-116 Cluster Member Configuration

Figure 3-117 Cluster Member Information

Figure 3-118 Cluster Candidate Information

xxi

Download from Www.Somanuals.com. All Manuals Search And Download.

Figures

xxii

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 1: Introduction

This switch provides a broad range of features for Layer 2 switching. It includes a

management agent that allows you to configure the features listed in this manual.

The default configuration can be used for most of the features provided by this

switch. However, there are many options that you should configure to maximize the

switch’s performance for your particular network environment.

Key Features

Table 1-1 Key Features

Feature

Description

Configuration Backup

and Restore

Backup to TFTP server

Authentication

Console, Telnet, web – User name / password, RADIUS, TACACS+

Web – HTTPS; Telnet – SSH

SNMP – Community strings

Port – IEEE 802.1X, MAC address filtering

Access Control Lists

DHCP Client

Supports up to 88 IP or MAC ACLs

Supported

Port Configuration

Rate Limiting

Speed, duplex mode and flow control

Input and output rate limiting per port

One port mirrored to a single analysis port

Supports up to 4 trunks using either static or dynamic trunking (LACP)

Supported

Port Mirroring

Port Trunking

Broadcast Storm

Control

Static Address

Up to 8K MAC addresses in the forwarding table

IEEE 802.1D Bridge

Supports dynamic data switching and addresses learning

Supported to ensure wire-speed switching while eliminating bad frames

Store-and-Forward

Switching

Spanning Tree Protocol Supports standard STP and Rapid Spanning Tree Protocol (RSTP)

Virtual LANs

Up to 255 using IEEE 802.1Q, port-based, or private VLANs

Traffic Prioritization

Default port priority, traffic class map, queue scheduling, IP Precedence or

Differentiated Services Code Point (DSCP), and TCP/UDP Port

Multicast Filtering

Supports IGMP snooping and query

1-1

Download from Www.Somanuals.com. All Manuals Search And Download.

Introduction

Description of Software Features

The switch provides a wide range of advanced performance enhancing features.

Flow control eliminates the loss of packets due to bottlenecks caused by port

saturation. Broadcast storm suppression prevents broadcast traffic storms from

engulfing the network. Port-based and protocol-based VLANs, plus support for

automatic GVRP VLAN registration provide traffic security and efficient use of

network bandwidth. CoS priority queueing ensures the minimum delay for moving

real-time multimedia data across the network. While multicast filtering provides

support for real-time network applications. Some of the management features are

briefly described below.

Configuration Backup and Restore – You can save the current configuration

settings to a file on a TFTP server, and later download this file to restore the switch

configuration settings.

Authentication – This switch authenticates management access via the console

port, Telnet or web browser. User names and passwords can be configured locally or

can be verified via a remote authentication server (i.e., RADIUS or TACACS+).

Port-based authentication is also supported via the IEEE 802.1X protocol. This

protocol uses the Extensible Authentication Protocol over LANs (EAPOL) to request

user credentials from the 802.1X client, and then verifies the client’s right to access

the network via an authentication server.

Other authentication options include HTTPS for secure management access via the

web, SSH for secure management access over a Telnet-equivalent connection, IP

address filtering for SNMP/web/Telnet management access, and MAC address

filtering for port access.

Access Control Lists – ACLs provide packet filtering for IP frames (based on

address, protocol, TCP/UDP port number or TCP control code) or any frames

(based on MAC address or Ethernet type). ACLs can be used to improve

performance by blocking unnecessary network traffic or to implement security

controls by restricting access to specific network resources or protocols.

Port Configuration – You can manually configure the speed, duplex mode, and

flow control used on specific ports, or use auto-negotiation to detect the connection

settings used by the attached device. Use the full-duplex mode on ports whenever

possible to double the throughput of switch connections. Flow control should also be

enabled to control network traffic during periods of congestion and prevent the loss

of packets when port buffer thresholds are exceeded. The switch supports flow

control based on the IEEE 802.3x standard.

Rate Limiting – This feature controls the maximum rate for traffic transmitted or

received on an interface. Rate limiting is configured on interfaces at the edge of a

network to limit traffic into or out of the network. Traffic that falls within the rate limit is

transmitted, while packets that exceed the acceptable amount of traffic are dropped.

1-2

Download from Www.Somanuals.com. All Manuals Search And Download.

Description of Software Features

Port Mirroring – The switch can unobtrusively mirror traffic from any port to a

monitor port. You can then attach a protocol analyzer or RMON probe to this port to

perform traffic analysis and verify connection integrity.

Port Trunking – Ports can be combined into an aggregate connection. Trunks can

be manually set up or dynamically configured using IEEE 802.3ad Link Aggregation

Control Protocol (LACP). The additional ports dramatically increase the throughput

across any connection, and provide redundancy by taking over the load if a port in

the trunk should fail. The switch supports up to four trunks.

Broadcast Storm Control – Broadcast suppression prevents broadcast traffic from

overwhelming the network. When enabled on a port, the level of broadcast traffic

passing through the port is restricted. If broadcast traffic rises above a pre-defined

threshold, it will be throttled until the level falls back beneath the threshold.

Static Addresses – A static address can be assigned to a specific interface on this

switch. Static addresses are bound to the assigned interface and will not be moved.

When a static address is seen on another interface, the address will be ignored and

will not be written to the address table. Static addresses can be used to provide

network security by restricting access for a known host to a specific port.

IEEE 802.1D Bridge – The switch supports IEEE 802.1D transparent bridging. The

address table facilitates data switching by learning addresses, and then filtering or

forwarding traffic based on this information. The address table supports up to 8K

addresses.

Store-and-Forward Switching – The switch copies each frame into its memory

before forwarding them to another port. This ensures that all frames are a standard

Ethernet size and have been verified for accuracy with the cyclic redundancy check

(CRC). This prevents bad frames from entering the network and wasting bandwidth.

To avoid dropping frames on congested ports, the switch provides 8 MB for frame

buffering. This buffer can queue packets awaiting transmission on congested

networks.

Spanning Tree Algorithm – The switch supports these spanning tree protocols:

Spanning Tree Protocol (STP, IEEE 802.1D) – This protocol provides loop detection

and recovery by allowing two or more redundant connections to be created between

a pair of LAN segments. When there are multiple physical paths between segments,

this protocol will choose a single path and disable all others to ensure that only one

route exists between any two stations on the network. This prevents the creation of

network loops. However, if the chosen path should fail for any reason, an alternate

path will be activated to maintain the connection.

Rapid Spanning Tree Protocol (RSTP, IEEE 802.1w) – This protocol reduces the

convergence time for network topology changes to 3 to 5 seconds, compared to 30

seconds or more for the older IEEE 802.1D STP standard. It is intended as a

complete replacement for STP, but can still interoperate with switches running the

older standard by automatically reconfiguring ports to STP-compliant mode if they

detect STP protocol messages from attached devices.

1-3

Download from Www.Somanuals.com. All Manuals Search And Download.

Introduction

Virtual LANs – The switch supports up to 255 VLANs. A Virtual LAN is a collection

of network nodes that share the same collision domain regardless of their physical

location or connection point in the network. The switch supports tagged VLANs

based on the IEEE 802.1Q standard. Members of VLAN groups can be dynamically

learned via GVRP, or ports can be manually assigned to a specific set of VLANs.

This allows the switch to restrict traffic to the VLAN groups to which a user has been

assigned. By segmenting your network into VLANs, you can:

• Eliminate broadcast storms which severely degrade performance in a flat network.

• Simplify network management for node changes/moves by remotely configuring

VLAN membership for any port, rather than having to manually change the network

connection.

• Provide data security by restricting all traffic to the originating VLAN.

• Use private VLANs to restrict traffic to pass only between data ports and the uplink

ports, thereby isolating adjacent ports within the same VLAN, and allowing you to

limit the total number of VLANs that need to be configured.

Traffic Prioritization – This switch prioritizes each packet based on the required

level of service, using four priority queues with strict or Weighted Round Robin

Queuing. It uses IEEE 802.1p and 802.1Q tags to prioritize incoming traffic based on

input from the end-station application. These functions can be used to provide

independent priorities for delay-sensitive data and best-effort data.

This switch also supports several common methods of prioritizing layer 3/4 traffic to

meet application requirements. Traffic can be prioritized based on the priority bits in

the IP frame’s Type of Service (ToS) octet or the number of the TCP/UDP port.

When these services are enabled, the priorities are mapped to a Class of Service

value by the switch, and the traffic then sent to the corresponding output queue.

Multicast Filtering – Specific multicast traffic can be assigned to its own VLAN to

ensure that it does not interfere with normal network traffic and to guarantee

real-time delivery by setting the required priority level for the designated VLAN. The

switch uses IGMP Snooping and Query to manage multicast group registration.

1-4

Download from Www.Somanuals.com. All Manuals Search And Download.

System Defaults

The switch’s system defaults are provided in the configuration file

“Factory_Default_Config.cfg.” To reset the switch defaults, this file should be set as

the startup configuration file (page 3-24).

The following table lists some of the basic system defaults.

Table 1-2 System Defaults

Function

Parameter

Default

Console Port

Connection

Baud Rate

9600

Data bits

Stop bits

Parity

none

Local Console Timeout

Privileged Exec Level

0 (disabled)

Authentication

Username “admin”

Password “admin”

Normal Exec Level

Username “guest”

Password “guest”

Enable Privileged Exec from Normal Password “super”

Exec Level

RADIUS Authentication

TACACS Authentication

802.1X Port Authentication

HTTPS

Disabled

Enabled

Disabled

Enabled

SSH

Port Security

IP Filtering

Web Management

HTTP Server

HTTP Port Number

HTTP Secure Server

HTTP Secure Port Number

Community Strings

Enabled

443

SNMP

“public” (read only)

“private” (read/write)

Traps

Authentication traps: enabled

Link-up-down events: enabled

1-5

Download from Www.Somanuals.com. All Manuals Search And Download.

Introduction

Table 1-2 System Defaults (Continued)

Function

Parameter

Default

Port Configuration

Admin Status

Auto-negotiation

Flow Control

Enabled

Disabled

Rate Limiting

Port Trunking

Input and output limits

Static Trunks

LACP (all ports)

Status

Disabled

None

Disabled

Broadcast Storm

Protection

Disabled (all ports)

32,000 octets per second

Broadcast Limit Rate

Status

Spanning Tree

Protocol

Enabled

(Defaults: All values based on IEEE 802.1w)

Fast Forwarding (Edge Port)

Aging Time

Disabled

Address Table

Virtual LANs

300 seconds

Default VLAN

PVID

Acceptable Frame Type

Ingress Filtering

All

Disabled

Switchport Mode (Egress Mode)

GVRP (global)

Hybrid: tagged/untagged frames

Disabled

GVRP (port interface)

Ingress Port Priority

Weighted Round Robin

Traffic Prioritization

Queue: 0 1 2 3

Weight: 1 2 4 6

IP Precedence Priority

IP DSCP Priority

IP Port Priority

IP Address

Disabled

0.0.0.0

IP Settings

Subnet Mask

Default Gateway

DHCP

255.0.0.0

0.0.0.0

Client: Enabled

Disabled

BOOTP

Multicast Filtering

IGMP Snooping

Snooping: Enabled

Querier: Enabled

1-6

Download from Www.Somanuals.com. All Manuals Search And Download.

System Defaults

Table 1-2 System Defaults (Continued)

Function

Parameter

Default

System Log

Status

Enabled

Messages Logged

Messages Logged to Flash

Event Handler

Levels 0-7 (all)

Levels 0-6

SMTP Email Alerts

SNTP

Enabled (but no server defined)

Disabled

Clock Synchronization

1-7

Download from Www.Somanuals.com. All Manuals Search And Download.

Introduction

1-8

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 2: Initial Configuration

Connecting to the Switch

Configuration Options

The switch includes a built-in network management agent. The agent offers a variety

of management options, including SNMP, RMON and a Web-based interface. A PC

may also be connected directly to the switch for configuration and monitoring via a

command line interface (CLI).

Note: The IP address for this switch is obtained via DHCP by default. To change this

address, see “Setting an IP Address” on page 2-4.

The switch’s HTTP Web agent allows you to configure switch parameters, monitor

port connections, and display statistics using a standard Web browser such as

Netscape Navigator version 6.2 and higher or Microsoft IE version 5.0 and higher.

The switch’s Web management interface can be accessed from any computer

attached to the network.

The CLI program can be accessed by a direct connection to the RS-232 serial

console port on the switch, or remotely by a Telnet connection over the network.

The switch’s management agent also supports SNMP (Simple Network

Management Protocol). This SNMP agent permits the switch to be managed from

any system in the network using network management software such as

HP OpenView.

The switch’s Web interface, CLI configuration program, and SNMP agent allow you

to perform the following management functions:

• Set user names and passwords for up to 16 users

• Set an IP interface for a management VLAN

• Configure SNMP parameters

• Enable/disable any port

• Set the speed/duplex mode for any port

• Configure the bandwidth of any port by limiting input or output rates

• Control port access through IEEE 802.1X security or static address filtering

• Filter packets using Access Control Lists (ACLs)

• Configure up to 255 IEEE 802.1Q VLANs

• Enable GVRP automatic VLAN registration

• Configure IGMP multicast filtering

• Upload and download system firmware via TFTP

• Upload and download switch configuration files via TFTP

• Configure Spanning Tree parameters

• Configure Class of Service (CoS) priority queuing

2-1

Download from Www.Somanuals.com. All Manuals Search And Download.

Initial Configuration

• Configure up to 4 static or LACP trunks

• Enable port mirroring

• Set broadcast storm control on any port

• Display system information and statistics

Required Connections

The switch provides an RS-232 serial port that enables a connection to a PC or

terminal for monitoring and configuring the switch. A null-modem console cable is

provided with the switch.

Attach a VT100-compatible terminal, or a PC running a terminal emulation program

to the switch. You can use the console cable provided with this package, or use a

null-modem cable that complies with the wiring assignments shown in the

Installation Guide.

To connect a terminal to the console port, complete the following steps:

1. Connect the console cable to the serial port on a terminal, or a PC running

terminal emulation software, and tighten the captive retaining screws on the

DB-9 connector.

2. Connect the other end of the cable to the RS-232 serial port on the switch.

3. Make sure the terminal emulation software is set as follows:

• Select the appropriate serial port (COM port 1 or COM port 2).

• Set the baud rate to 9600 bps.

• Set the data format to 8 data bits, 1 stop bit, and no parity.

• Set flow control to none.

• Set the emulation mode to VT100.

• When using HyperTerminal, select Terminal keys, not Windows keys.

Notes: 1. When using HyperTerminal with Microsoft Windows 2000, make sure that

you have Windows 2000 Service Pack 2 or later installed. Windows 2000

Service Pack 2 fixes the problem of arrow keys not functioning in

HyperTerminal’s VT100 emulation. See www.microsoft.com for information

on Windows 2000 service packs.

2. Refer to “Line Commands” on page 4-11 for a complete description of

console configuration options.

3. Once you have set up the terminal correctly, the console login screen will be

displayed.

For a description of how to use the CLI, see “Using the Command Line Interface” on

page 4-1. For a list of all the CLI commands and detailed information on using the

CLI, refer to “Command Groups” on page 4-9.

2-2

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Remote Connections

Prior to accessing the switch’s onboard agent via a network connection, you must

first configure it with a valid IP address, subnet mask, and default gateway using a

console connection, DHCP or BOOTP protocol.

The IP address for this switch is obtained via DHCP by default. To manually

configure this address or enable dynamic address assignment via DHCP or BOOTP,

see “Setting an IP Address” on page 2-4.

Note: This switch supports four concurrent Telnet/SSH sessions.

After configuring the switch’s IP parameters, you can access the onboard

configuration program from anywhere within the attached network. The onboard

configuration program can be accessed using Telnet from any computer attached to

the network. The switch can also be managed by any computer using a web

browser (Internet Explorer 5.0 or above, or Netscape Navigator 6.2 or above), or

from a network computer using SNMP network management software.

Note: The onboard program only provides access to basic configuration functions. To

access the full range of SNMP management functions, you must use

SNMP-based network management software.

Basic Configuration

Console Connection

The CLI program provides two different command levels — normal access level

(Normal Exec) and privileged access level (Privileged Exec). The commands

available at the Normal Exec level are a limited subset of those available at the

Privileged Exec level and allow you to only display information and use basic

utilities. To fully configure the switch parameters, you must access the CLI at the

Privileged Exec level.

Access to both CLI levels are controlled by user names and passwords. The switch

has a default user name and password for each level. To log into the CLI at the

Privileged Exec level using the default user name and password, perform these

steps:

1. To initiate your console connection, press <Enter>. The “User Access

Verification” procedure starts.

2. At the Username prompt, enter “admin.”

3. At the Password prompt, also enter “admin.” (The password characters are not

displayed on the console screen.)

4. The session is opened and the CLI displays the “Console#” prompt indicating

you have access at the Privileged Exec level.

2-3

Download from Www.Somanuals.com. All Manuals Search And Download.

Initial Configuration

Setting Passwords

Note: If this is your first time to log into the CLI program, you should define new

passwords for both default user names using the “username” command, record

them and put them in a safe place.

Passwords can consist of up to 8 alphanumeric characters and are case sensitive.

To prevent unauthorized access to the switch, set the passwords as follows:

1. Open the console interface with the default user name and password “admin” to

access the Privileged Exec level.

2. Type “configure” and press <Enter>.

3. Type “username guest password 0 password,” for the Normal Exec level, where

password is your new password. Press <Enter>.

4. Type “username admin password 0 password,” for the Privileged Exec level,

where password is your new password. Press <Enter>.

Note: ‘0’ specifies the password in plain text, ‘7’ specifies the password in encrypted

form.

Username: admin

Password:

CLI session with the Standalone Intelligent Switch is opened.

To end the CLI session, enter [Exit].

Console#configure

Console(config)#username guest password 0 [password]

Console(config)#username admin password 0 [password]

Console(config)#

Setting an IP Address

You must establish IP address information for the switch to obtain management

access through the network. This can be done in either of the following ways:

Manual — You have to input the information, including IP address and subnet mask.

If your management station is not in the same IP subnet as the switch, you will also

need to specify the default gateway router.

Dynamic — The switch sends IP configuration requests to BOOTP or DHCP

address allocation servers on the network.

Manual Configuration

You can manually assign an IP address to the switch. You may also need to specify

a default gateway that resides between this device and management stations that

exist on another network segment. Valid IP addresses consist of four decimal

numbers, 0 to 255, separated by periods. Anything outside this format will not be

accepted by the CLI program.

Note: The IP address for this switch is obtained via DHCP by default.

2-4

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Before you can assign an IP address to the switch, you must obtain the following

information from your network administrator:

• IP address for the switch

• Default gateway for the network

• Network mask for this network

To assign an IP address to the switch, complete the following steps:

1. From the Privileged Exec level global configuration mode prompt, type

“interface vlan 1” to access the interface-configuration mode. Press <Enter>.

2. Type “ip address ip-address netmask,” where “ip-address” is the switch IP

address and “netmask” is the network mask for the network. Press <Enter>.

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

4. To set the IP address of the default gateway for the network to which the switch

belongs, type “ip default-gateway gateway,” where “gateway” is the IP address

of the default gateway. Press <Enter>.

Console(config)#interface vlan 1

Console(config-if)#ip address 192.168.1.5 255.255.255.0

Console(config-if)#exit

Console(config)#ip default-gateway 192.168.1.254

Console(config)#

Dynamic Configuration

If you select the “bootp” or “dhcp” option, IP will be enabled but will not function until

a BOOTP or DHCP reply has been received. You therefore need to use the “ip dhcp

restart” command to start broadcasting service requests. Requests will be sent

periodically in an effort to obtain IP configuration information. (BOOTP and DHCP

values can include the IP address, subnet mask, and default gateway.)

If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the

switch will start broadcasting service requests as soon as it is powered on.

To automatically configure the switch by communicating with BOOTP or DHCP

address allocation servers on the network, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. At the interface-configuration mode prompt, use one of the following commands:

• To obtain IP settings via DHCP, type “ip address dhcp” and press <Enter>.

• To obtain IP settings via BOOTP, type “ip address bootp” and press <Enter>.

3. Type “end” to return to the Privileged Exec mode. Press <Enter>.

4. Type “ip dhcp restart” to begin broadcasting service requests. Press <Enter>.

2-5

Download from Www.Somanuals.com. All Manuals Search And Download.

Initial Configuration

5. Wait a few minutes, and then check the IP configuration settings by typing the

“show ip interface” command. Press <Enter>.

6. Then save your configuration changes by typing “copy running-config

startup-config.” Enter the startup file name and press <Enter>.

Console(config)#interface vlan 1

Console(config-if)#ip address dhcp

Console(config-if)#end

Console#ip dhcp restart

Console#show ip interface

IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1,

and address mode: User specified.

Console#copy running-config startup-config

Startup configuration file name []: startup

\Write to FLASH Programming.

\Write to FLASH finish.

Success.

Enabling SNMP Management Access

The switch can be configured to accept management commands from Simple

Network Management Protocol (SNMP) applications such as HP OpenView. You

can configure the switch to (1) respond to SNMP requests or (2) generate SNMP

traps.

When SNMP management stations send requests to the switch (either to return

information or to set a parameter), the switch provides the requested data or sets the

specified parameter. The switch can also be configured to send information to

SNMP managers (without being requested by the managers) through trap

messages, which inform the manager that certain events have occurred.

The switch includes an SNMP agent that supports SNMP version 1, 2c, and 3

clients. To provide management access for version 1 or 2c clients, you must specify

a community string. The switch provides a default MIB View (i.e., an SNMPv3

construct) for the default “public” community string that provides read access to the

entire MIB tree, and a default view for the “private” community string that provides

read/write access to the entire MIB tree. However, you may assign new views to

version 1 or 2c community strings that suit your specific security requirements (see

“Setting SNMPv3 Views” on page 3-53).

Community Strings (for SNMP version 1 and 2c clients)

Community strings are used to control management access to SNMP version 1 and

2c stations, as well as to authorize SNMP stations to receive trap messages from

the switch. You therefore need to assign community strings to specified users, and

set the access level.

2-6

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

The default strings are:

• public - with read-only access. Authorized management stations are only able to

retrieve MIB objects.

• private - with read-write access. Authorized management stations are able to both

retrieve and modify MIB objects.

To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it is

recommended that you change the default community strings.

To configure a community string, complete the following steps:

1. From the Privileged Exec level global configuration mode prompt, type

“snmp-server community string mode,” where “string” is the community access

string and “mode” is rw (read/write) or ro (read only). Press <Enter>. (Note that

the default mode is read only.)

2. To remove an existing string, simply type “no snmp-server community string,”

where “string” is the community access string to remove. Press <Enter>.

Console(config)#snmp-server community admin rw

Console(config)#snmp-server community private

Console(config)#

4-118

Note: If you do not intend to support access to SNMP version 1 and 2c clients, we

recommend that you delete both of the default community strings. If there are no

community strings, then SNMP management access from SNMP v1 and v2c

clients is disabled.

Trap Receivers

You can also specify SNMP stations that are to receive traps from the switch. To

configure a trap receiver, use the “snmp-server host” command. From the Privileged

Exec level global configuration mode prompt, type:

“snmp-server host host-address community-string

[version {1 | 2c | 3 {auth | noauth | priv}}]”

where “host-address” is the IP address for the trap receiver, “community-string”

specifies access rights for a version 1/2c host, or is the user name of a version 3

host, “version” indicates the SNMP client version, and “auth | noauth | priv” means

that authentication, no authentication, or authentication and privacy is used for v3

clients. Then press <Enter>. For a more detailed description of these parameters,

see “snmp-server host” on page 4-120. The following example creates a trap host

for each type of SNMP client.

Console(config)#snmp-server host 10.1.19.23 batman

Console(config)#snmp-server host 10.1.19.98 robin version 2c

Console(config)#snmp-server host 10.1.19.34 barbie version 3 auth

Console(config)#

4-120

2-7

Download from Www.Somanuals.com. All Manuals Search And Download.

Initial Configuration

Configuring Access for SNMP Version 3 Clients

To configure management access for SNMPv3 clients, you need to first create a

view that defines the portions of MIB that the client can read or write, assign the view

to a group, and then assign the user to a group. The following example creates one

view called “mib-2” that includes the entire MIB-2 tree branch, and then another view

that includes the IEEE 802.1d bridge MIB. It assigns these respective read and read/

write views to a group call “r&d” and specifies group authentication via MD5 or SHA.

In the last step, it assigns a v3 user to this group, indicating that MD5 will be used for

authentication, provides the password “greenpeace” for authentication, and the

password “einstien” for encryption.

Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included

Console(config)#snmp-server view 802.1d 1.3.6.1.2.1.17 included

Console(config)#snmp-server group r&d v3 auth mib-2 802.1d

Console(config)#snmp-server user steve group r&d v3 auth md5

greenpeace priv des56 einstien

4-125

4-126

4-128

Console(config)#

For a more detailed explanation on how to configure the switch for access from

SNMP v3 clients, refer to “Simple Network Management Protocol” on page 3-38, or

refer to the specific CLI commands for SNMP starting on page 4-116.

Saving Configuration Settings

Configuration commands only modify the running configuration file and are not

saved when the switch is rebooted. To save all your configuration changes in

nonvolatile storage, you must copy the running configuration file to the start-up

configuration file using the “copy” command.

To save the current configuration settings, enter the following command:

1. From the Privileged Exec mode prompt, type “copy running-config

startup-config” and press <Enter>.

2. Enter the name of the start-up file. Press <Enter>.

Console#copy running-config startup-config

Startup configuration file name []: startup

\Write to FLASH Programming.

\Write to FLASH finish.

Success.

Console#

2-8

Download from Www.Somanuals.com. All Manuals Search And Download.

Managing System Files

The switch’s flash memory supports three types of system files that can be managed

by the CLI program, Web interface, or SNMP. The switch’s file system allows files to

be uploaded and downloaded, copied, deleted, and set as a start-up file.

The three types of files are:

• Configuration — This file stores system configuration information and is created

when configuration settings are saved. Saved configuration files can be selected

as a system start-up file or can be uploaded via TFTP to a server for backup. A file

named “Factory_Default_Config.cfg” contains all the system default settings and

cannot be deleted from the system. See “Saving or Restoring Configuration

Settings” on page 3-22 for more information.

• Operation Code — System software that is executed after boot-up, also known as

run-time code. This code runs the switch operations and provides the CLI and Web

management interfaces. See “Managing Firmware” on page 3-19 for more

information.

• Diagnostic Code — Software that is run during system boot-up, also known as

POST (Power On Self-Test).

Due to the size limit of the flash memory, the switch supports only two operation

code files. However, you can have as many diagnostic code files and configuration

files as available flash memory space allows.

In the system flash memory, one file of each type must be set as the start-up file.

During a system boot, the diagnostic and operation code files set as the start-up file

are run, and then the start-up configuration file is loaded.

Note that configuration files should be downloaded using a file name that reflects the

contents or usage of the file settings. If you download directly to the running-config,

the system will reboot, and the settings will have to be copied from the

running-config to a permanent file.

2-9

Download from Www.Somanuals.com. All Manuals Search And Download.

Initial Configuration

2-10

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 3: Configuring the Switch

Using the Web Interface

This switch provides an embedded HTTP Web agent. Using a Web browser you can

configure the switch and view statistics to monitor network activity. The Web agent

can be accessed by any computer on the network using a standard Web browser

(Internet Explorer 5.0 or above, or Netscape Navigator 6.2 or above).

Note: You can also use the Command Line Interface (CLI) to manage the switch over a

serial connection to the console port or via Telnet. For more information on using

the CLI, refer to Chapter 4: “Command Line Interface.”

Prior to accessing the switch from a Web browser, be sure you have first performed

the following tasks:

1. Configure the switch with a valid IP address, subnet mask, and default gateway

using an out-of-band serial connection, BOOTP or DHCP protocol. (See

“Setting an IP Address” on page 2-4.)

2. Set user names and passwords using an out-of-band serial connection. Access

to the Web agent is controlled by the same user names and passwords as the

onboard configuration program. (See “Setting Passwords” on page 2-4.)

3. After you enter a user name and password, you will have access to the system

configuration program.

Notes: 1. You are allowed three attempts to enter the correct password; on the third

failed attempt the current connection is terminated.

2. If you log into the Web interface as guest (Normal Exec level), you can view

the configuration settings or change the guest password. If you log in as

“admin” (Privileged Exec level), you can change the settings on any page.

3. If the path between your management station and this switch does not pass

through any device that uses the Spanning Tree Algorithm, then you can set

the switch port attached to your management station to fast forwarding (i.e.,

enable Admin Edge Port) to improve the switch’s response time to

management commands issued through the web interface. See “Configuring

Interface Settings” on page 3-130.

3-1

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Navigating the Web Browser Interface

To access the web-browser interface you must first enter a user name and

password. The administrator has Read/Write access to all configuration parameters

and statistics. The default user name and password for the administrator is “admin.”

Home Page

When your web browser connects with the switch’s web agent, the home page is

displayed as shown below. The home page displays the Main Menu on the left side

of the screen and System Information on the right side. The Main Menu links are

used to navigate to other menus, and display configuration parameters and

statistics.

Figure 3-1 Home Page

Note: Most of the examples in this chapter are based on the ES3526XA. Other than the

number of fixed ports, there are no major differences between the ES3526XA and

ES3552XA.

3-2

Download from Www.Somanuals.com. All Manuals Search And Download.

Panel Display

Configuration Options

Configurable parameters have a dialog box or a drop-down list. Once a configuration

change has been made on a page, be sure to click on the Apply button to confirm

the new setting. The following table summarizes the web page configuration

buttons.

Table 3-1 Configuration Options

Button

Revert

Apply

Help

Action.

Cancels specified values and restores current values prior to pressing Apply.

Sets specified values to the system.

Links directly to webhelp.

Notes: 1. To ensure proper screen refresh, be sure that Internet Explorer 5.x is

configured as follows: Under the menu “Tools / Internet Options / General /

Temporary Internet Files / Settings,” the setting for item “Check for newer

versions of stored pages” should be “Every visit to the page.”

2. When using Internet Explorer 5.0, you may have to manually refresh the

screen after making configuration changes by pressing the browser’s refresh

button.

Panel Display

The web agent displays an image of the switch’s ports. The Mode can be set to

display different information for the ports, including Active (i.e., up or down), Duplex

(i.e., half or full duplex, or Flow Control (i.e., with or without flow control). Clicking on

the image of a port opens the Port Configuration page as described on page 3-91.

Figure 3-2 Panel Display

3-3

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Main Menu

Using the onboard web agent, you can define system parameters, manage and

control the switch, and all its ports, or monitor network conditions. The following

table briefly describes the selections available from this program.

Table 3-2 Main Menu

Description

Page

3-10

System

System Information

Provides basic system description, including contact information

3-10

3-11

Switch Information

Shows the number of ports, hardware/firmware version

numbers, and power status

Bridge Extension

IP Configuration

File

Shows the bridge extension parameters

Sets the IP address for management access

Copy

Allows the transfer and copying files

Allows deletion of files from the flash memory

Sets the startup file

Delete

Set Startup

Line

Console

Telnet

Sets console port connection parameters

Sets Telnet connection parameters.

Log

Logs

Stores and displays error messages

System Logs

Remote Logs

SMTP Logs

Reset

Sends error messages to a logging process

Configures the logging of messages to a remote logging process

Sends an SMTP client message to a participating server

Restarts the switch

SNTP

Configuration

Configures SNTP client settings, including broadcast mode or a

specified list of servers

Clock Time Zone

Sets the local time zone for the system clock

SNMP

Configuration

Security

Configures community strings and related trap functions

User Accounts

Assigns a new password for the current user

Configures authentication sequence, RADIUS and TACACS

Configures secure HTTP settings

Authentication Settings

HTTPS Settings

3-4

Download from Www.Somanuals.com. All Manuals Search And Download.

Main Menu

Table 3-2 Main Menu (Continued)

SSH

Host-Key Settings

Description

Page

3-61

Generates the host key pair (public and private)

Configures Secure Shell server settings

3-63

3-65

3-66

Settings

Port Security

Configures per port security, including status, response for

security breach, and maximum allowed MAC addresses

802.1X

Port authentication

Information

Displays global configuration settings

Configures the global configuration setting

Sets parameters for individual ports

Displays protocol statistics for the selected port

MAC address authentication

Configuration

Port Configuration

Statistics

Network Access

Configuration

Port Configuration

Sets the reauthentication time

Configures MAC authentication and dynamic VLAN assignment

on port interfaces

MAC Address Information Displays information in the secure MAC address table

MAC Filter Configuration

ACL

Configures MAC address filters

Configuration

Port Binding

Configures packet filtering based on IP or MAC addresses

Binds a port to the specified ACL

IP Filter

Sets IP addresses of clients allowed management access via

the Web, SNMP, and Telnet

Port

Port Information

Trunk Information

Port Configuration

Trunk Configuration

Trunk Membership

LACP

Displays port connection status

Displays trunk connection status

Configures port connection settings

Configures trunk connection settings

Specifies ports to group into static trunks

Configuration

Allows ports to dynamically join trunks

Aggregation Port

Port Counters

Configures parameters for link aggregation group members

Displays statistics for LACP protocol messages

Displays settings and operational state for the local side

Port Internal Information

Port Neighbors Information Displays settings and operational state for the remote side

Port Broadcast Control Sets the broadcast storm threshold for each port

3-5

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Table 3-2 Main Menu (Continued)

Description

Page

3-105

Trunk Broadcast Control

Mirror Port Configuration

Rate Limit

Sets the broadcast storm threshold for each trunk

Sets the source and target ports for mirroring

Granularity

Enables or disables the rate limit feature

Sets the input rate limit for each port

Input Port Configuration

Input Trunk Configuration Sets the input rate limit for each trunk

Output Port Configuration Sets the output rate limit for each port

Output Trunk Configuration Sets the output rate limit for each trunk

Port Statistics

Lists Ethernet and RMON port statistics

Address Table

Static Addresses

Dynamic Addresses

Address Aging

Spanning Tree

STA

Displays entries for interface, address or VLAN

Displays or edits static entries in the Address Table

Sets timeout for dynamically learned entries

Information

Displays STA values used for the bridge

Configures global bridge settings for STA and RSTP

Displays individual port settings for STA

Displays individual trunk settings for STA

Configures individual port settings for STA

Configures individual trunk settings for STA

Configuration

Port Information

Trunk Information

Port Configuration

Trunk Configuration

VLAN

802.1Q VLAN

GVRP Status

Basic Information

Current Table

Enables GVRP VLAN registration protocol

3-142

Displays information on the VLAN type supported by this switch 3-142

Shows the current port members of each VLAN and whether or

not the port is tagged or untagged

3-143

Static List

Used to create or remove VLAN groups

Modifies the settings for an existing VLAN

3-145

3-147

3-148

Static Table

Static Membership by Port Configures membership type for interfaces, including tagged,

untagged or forbidden

Port Configuration

Trunk Configuration

Specifies default PVID and VLAN attributes

Specifies default trunk VID and VLAN attributes

3-150

3-6

Download from Www.Somanuals.com. All Manuals Search And Download.

Main Menu

Table 3-2 Main Menu (Continued)

Private VLAN

Description

Page

3-152

Information

Displays Private VLAN feature information

3-153

3-154

Configuration

This page is used to create/remove primary or community

VLANs

Association

Each community VLAN must be associated with a primary VLAN 3-154

Port Information

Shows VLAN port type, and associated primary or secondary

VLANs

Port Configuration

Trunk Information

Trunk Configuration

Sets the private VLAN interface type, and associates the

interfaces with a private VLAN

Shows VLAN port type, and associated primary or secondary

VLANs

Sets the private VLAN interface type, and associates the

interfaces with a private VLAN

Priority

3-158

3-160

Default Port Priority

Default Trunk Priority

Traffic Classes

Sets the default priority for each port

Sets the default priority for each trunk

Maps IEEE 802.1p priority tags to output queues

Enables/disables traffic class priorities (not implemented)

Sets queue mode to strict priority or Weighted Round-Robin

Configures Weighted Round Robin queueing

Traffic Classes Status

Queue Mode

3-162

3-163

3-164

Queue Scheduling

IP Precedence/

DSCP Priority Status

Globally selects IP Precedence or DSCP Priority, or disables

both.

IP Precedence Priority

Sets IP Type of Service priority, mapping the precedence tag to

a class-of-service value

3-165

3-166

IP DSCP Priority

Sets IP Differentiated Services Code Point priority, mapping a

DSCP tag to a class-of-service value

IP Port Priority Status

IP Port Priority

Globally enables or disables IP Port Priority

3-165

3-168

Sets TCP/UDP port priority, defining the socket number and

associated class-of-service value

ACL CoS Priority

Sets the CoS value and corresponding output queue for packets 3-169

matching an ACL rule

3-7

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Table 3-2 Main Menu (Continued)

Description

Page

3-170

IGMP Snooping

IGMP Configuration

Enables multicast filtering; configures parameters for multicast

query

3-171

IGMP Filter Configuration

Enables IGMP filtering and throttling for the switch, creates filter

profile numbers

3-178

IGMP Immediate Leave

Enables the immediate leave function

3-173

3-174

Multicast Router

Port Information

Displays the ports that are attached to a neighboring multicast

router for each VLAN ID

Static Multicast Router Port

Configuration

Assigns ports that are attached to a neighboring multicast router 3-175

IP Multicast Registration

Table

Displays all multicast groups active on this switch, including

multicast IP addresses and VLAN ID

IGMP Member Port Table

Indicates multicast addresses associated with the selected

VLAN

IGMP Filter Profile

Configuration

Configures IGMP filter profile controlled groups and access

mode

IGMP Filter/Throttling Port

Configuration

Assigns IGMP filter profiles to port interfaces and sets throttling

settings

IGMP Filter/Throttling Trunk Assigns IGMP filter profiles to trunk interfaces and sets throttling 3-181

Configuration

settings

MVR

Configuration

Globally enables MVR, sets the MVR VLAN, adds multicast

stream addresses

3-184

3-185

Port Information

Trunk Information

Displays MVR interface type, MVR operational and activity

status, and immediate leave status

Displays MVR interface type, MVR operational and activity

status, and immediate leave status

Group IP Information

Port Configuration

Trunk Configuration

Displays the ports attached to an MVR multicast stream

Configures MVR interface type and immediate leave status

3-186

3-187

3-188

Group Member Configuration Statically assigns MVR multicast streams to an interface

DNS

General Configuration

Enables DNS; configures domain name and domain list; and

specifies IP address of name servers for dynamic lookup

3-189

3-192

Static Host Table

Cache

Configures static entries for domain name to address mapping

Displays cache entries discovered by designated name servers 3-193

Cluster

Configuration

Globally enables clustering for the switch

3-194

3-8

Download from Www.Somanuals.com. All Manuals Search And Download.

Main Menu

Table 3-2 Main Menu (Continued)

Description

Member Configuration

Page

3-195

Adds switch Members to the cluster

Displays cluster Member switch information

Displays network Candidate switch information

Member Information

3-196

3-197

Candidate Information

3-9

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Basic Configuration

Displaying System Information

You can easily identify the system by displaying the device name, location and

contact information.

Field Attributes

• System Name – Name assigned to the switch system.

• Object ID – MIB II object ID for switch’s network management subsystem.

• Location – Specifies the system location.

• Contact – Administrator responsible for the system.

• System Up Time – Length of time the management agent has been up.

These additional parameters are displayed for the CLI.

• MAC Address – The physical layer address for this switch.

• Web server – Shows if management access via HTTP is enabled.

• Web server port – Shows the TCP port number used by the web interface.

• Web secure server – Shows if management access via HTTPS is enabled.

• Web secure server port – Shows the TCP port used by the HTTPS interface.

• Telnet server – Shows if management access via Telnet is enabled.

• Telnet port – Shows the TCP port used by the Telnet interface.

• Jumbo Frame – Shows if jumbo frames are enabled.

• POST result – Shows results of the power-on self-test.

Web – Click System, System Information. Specify the system name, location, and

contact information for the system administrator, then click Apply. (This page also

includes a Telnet button that allows access to the Command Line Interface via Telnet.)

Figure 3-3 System Information

3-10

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

CLI – Specify the hostname, location and contact information.

Console(config)#hostname R&D 5

Console(config)#snmp-server location WC 9

Console(config)#snmp-server contact Ted

Console(config)#exit

4-26

4-119

Console#show system

4-67

System description: Layer2+ Fast Ethernet Standalone Switch ES3526XA

System OID string: 1.3.6.1.4.1.259.6.10.74

System information

System Up time:

System Name:

0 days, 2 hours, 4 minutes, and 7.13 seconds

R&D 5

System Location:

System Contact

MAC address

WC 9

Ted

00-30-F1-12-34-56

Web server:

Web server port:

Web secure server:

enabled

Web secure server port: 443

Telnet server:

Telnet port:

Jumbo Frame:

POST result

enabled

Disabled

DUMMY Test 1.................PASS

UART LOOP BACK Test..........PASS

DRAM Test....................PASS

Timer Test...................PASS

RTC Initialization...........PASS

Switch Int Loopback test.....PASS

Done All Pass.

Console#

Displaying Switch Hardware/Software Versions

Use the Switch Information page to display hardware/firmware version numbers for

the main board and management software, as well as the power status of the system.

Field Attributes

Main Board

• Serial Number – The serial number of the switch.

• Number of Ports – Number of built-in ports.

• Hardware Version – Hardware version of the main board.

• Internal Power Status – Displays the status of the internal power supply.

Management Software

• Loader Version – Version number of loader code.

• Boot-ROM Version – Version of Power-On Self-Test (POST) and boot code.

• Operation Code Version – Version number of runtime code.

• Role – Shows that this switch is operating as Master or Slave.

Expansion Slot

• Expansion Slot 1/2 – Combination RJ-45/SFP ports.

3-11

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

These additional parameters are displayed for the CLI.

• Unit - This is unit 1.

• Redundant Power Status – Displays the status of the redundant power supply.

Web – Click System, Switch Information.

Figure 3-4 Displaying Switch Information

CLI – Use the following command to display version information.

Console#show version

Unit 1

4-68

Serial number:

Service tag:

S542021059

Hardware version:

Module A type:

Module B type:

Number of ports:

Main power status:

Redundant power status

R01A

1000BaseT

:not present

Agent (master)

Unit ID:

Loader version:

Boot ROM version:

2.2.1.4

2.3.0.0

Operation code version: 2.3.1.16

Console#

3-12

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Displaying Bridge Extension Capabilities

The Bridge MIB includes extensions for managed devices that support Multicast

Filtering, Traffic Classes, and Virtual LANs. You can access these extensions to

display default settings for the key variables.

Field Attributes

• Extended Multicast Filtering Services – This switch does not support the filtering

of individual multicast addresses based on GMRP (GARP Multicast Registration

Protocol).

• Traffic Classes – This switch provides mapping of user priorities to multiple traffic

classes. (Refer to “Class of Service Configuration” on page 3-158.)

• Static Entry Individual Port – This switch allows static filtering for unicast and

multicast addresses. (Refer to “Setting Static Addresses” on page 3-114.)

• VLAN Learning – This switch uses Independent VLAN Learning (IVL), where each

port maintains its own filtering database.

• Configurable PVID Tagging – This switch allows you to override the default Port

VLAN ID (PVID used in frame tags) and egress status (VLAN-Tagged or

Untagged) on each port. (Refer to “VLAN Configuration” on page 3-139.)

• Local VLAN Capable – This switch does not support multiple local bridges outside

of the scope of 802.1Q defined VLANs.

• GMRP – GARP Multicast Registration Protocol (GMRP) allows network devices to

uses the Internet Group Management Protocol (IGMP) to provide automatic

multicast filtering.

Web – Click System, Bridge Extension Configuration.

Figure 3-5 Bridge Extension Configuration

3-13

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – Enter the following command.

Console#show bridge-ext

Max support VLAN numbers:

Max support VLAN ID:

4-195

255

4094

Extended multicast filtering services: No

Static entry individual port:

VLAN learning:

Yes

IVL

Configurable PVID tagging:

Local VLAN capable:

Traffic classes:

Global GVRP status:

GMRP:

Yes

Enabled

Disabled

Console#

Setting the Switch’s IP Address

This section describes how to configure an IP interface for management access

over the network. The IP address for this switch is obtained via DHCP by default. To

manually configure an address, you need to change the switch’s default settings

(IP address 0.0.0.0 and netmask 255.0.0.0) to values that are compatible with your

network. You may also need to a establish a default gateway between the switch

and management stations that exist on another network segment.

You can manually configure a specific IP address, or direct the device to obtain an

address from a BOOTP or DHCP server. Valid IP addresses consist of four decimal

numbers, 0 to 255, separated by periods. Anything outside this format will not be

accepted by the CLI program.

Command Attributes

• Management VLAN – ID of the configured VLAN (1-4094, no leading zeroes). By

default, all ports on the switch are members of VLAN 1. However, the management

station can be attached to a port belonging to any VLAN, as long as that VLAN has

been assigned an IP address.

• IP Address Mode – Specifies whether IP functionality is enabled via manual

configuration (Static), Dynamic Host Configuration Protocol (DHCP), or Boot

Protocol (BOOTP). If DHCP/BOOTP is enabled, IP will not function until a reply has

been received from the server. Requests will be broadcast periodically by the

switch for an IP address. (DHCP/BOOTP values can include the IP address,

subnet mask, and default gateway.)

• IP Address – Address of the VLAN interface that is allowed management access.

Valid IP addresses consist of four numbers, 0 to 255, separated by periods.

(Default: 0.0.0.0)

• Subnet Mask – This mask identifies the host address bits used for routing to

specific subnets. (Default: 255.0.0.0)

• Gateway IP address – IP address of the gateway router between this device and

management stations that exist on other network segments. (Default: 0.0.0.0)

• MAC Address – The physical layer address for this switch.

• Restart DHCP – Requests a new IP address from the DHCP server.

3-14

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Manual Configuration

Web – Click System, IP Configuration. Select the VLAN through which the

management station is attached, set the IP Address Mode to “Static,” enter the IP

address, subnet mask and gateway, then click Apply.

Figure 3-6 Manual IP Configuration

CLI – Specify the management interface, IP address and default gateway.

Console#config

Console(config)#interface vlan 1

Console(config-if)#ip address 10.1.0.254 255.255.255.0

Console(config-if)#exit

4-244

Console(config)#ip default-gateway 192.168.1.254

Console(config)#

4-245

3-15

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Using DHCP/BOOTP

If your network provides DHCP/BOOTP services, you can configure the switch to be

dynamically configured by these services.

Web – Click System, IP Configuration. Specify the VLAN to which the management

station is attached, set the IP Address Mode to DHCP or BOOTP. Click Apply to

save your changes. Then click Restart DHCP to immediately request a new

address. Note that the switch will also broadcast a request for IP configuration

settings on each power reset.

Figure 3-7 IP Configuration using DHCP

Note: If you lose your management connection, use a console connection and enter

“show ip interface” to determine the new switch address.

CLI – Specify the management interface, and set the IP address mode to DHCP or

BOOTP, and then enter the “ip dhcp restart” command.

Console#config

Console(config)#interface vlan 1

Console(config-if)#ip address dhcp

Console(config-if)#end

4-244

Console#ip dhcp restart

Console#show ip interface

4-246

IP address and netmask: 192.168.1.54 255.255.255.0 on VLAN 1,

and address mode: dhcp

Console#

Renewing DCHP – DHCP may lease addresses to clients indefinitely or for a

specific period of time. If the address expires or the switch is moved to another

network segment, you will lose management access to the switch. In this case, you

can reboot the switch or submit a client request to restart DHCP service via the CLI.

3-16

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Web – If the address assigned by DHCP is no longer functioning, you will not be

able to renew the IP settings via the web interface. You can only restart DHCP

service via the web interface if the current address is still available.

CLI – Enter the following command to restart DHCP service.

Console#ip dhcp restart

Console#

4-246

DHCP Relay and Option 82 Information

The switch supports DHCP relay service for attached host devices. If a subnet does

not include a DHCP server, you can relay DHCP client requests to a DHCP server

on another subnet.

When DHCP relay is enabled and the switch sees a DHCP request broadcast, it

inserts its own IP address into the request (so that the DHCP server knows the

subnet of the client), then forwards the packet to the DHCP server. When the server

receives the DHCP request, it allocates a free IP address for the DHCP client from

its defined scope for the DHCP client’s subnet, and sends a DHCP response back to

the switch. The switch then broadcasts the DHCP response to the client.

DHCP also provides a mechanism for sending information about the switch and its

DHCP clients to the DHCP server. Known as DHCP Option 82, it allows compatible

DHCP servers to use the information when assigning IP addresses, or to set other

services or policies for clients.

Using DHCP Relay Option 82, clients can be identified by the VLAN and switch port

to which they are connected rather than just their MAC address. DHCP client-server

exchange messages are then forwarded directly between the server and client

without having to flood them to the entire VLAN.

In some cases, the switch may receive DHCP packets from a client that already

includes DHCP Option 82 information. The switch can be configured to set the

action policy for these packets. Either the switch can discard the Option 82

information, keep the existing information, or replace it with the switch’s relay

information.

Command Usage

You must specify the IP address of at least one DHCP server. Otherwise, the

switch’s DHCP relay agent will not operate and all DHCP request and reply packets

will be flooded to the entire VLAN.

Command Attributes

• DHCP Relay Option 82 – Enables the DHCP relay agant with Option 82 support.

• DHCP Relay Option 82 Policy – Sets the DHCP relay policy for DHCP client

packets that include Option 82 information. (Default: Drop)

• Replace – Overwrites the DHCP client packet information with the switch’s relay

information.

• Keep – Retains the client’s DHCP information.

3-17

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• Drop – Discards the Option 82 information in a packet and then floods it to the

entire VLAN.

• DHCP Relay Server – IP addresses of DHCP servers to be used by the switch’s

DHCP relay agent in order of preference. Up to five servers can be specified.

Web – Click System, IP Configuration. Enable the DHCP Relay Option 82 function,

set the Option 82 policy, and specify at least one DHCP server IP address. Click

Apply.

Figure 3-8 DHCP Relay Option 82 Configuration

CLI – This example enables DHCP relay with Option 82, and sets the policy as

replace.

Console(config)#ip dhcp relay server 192.168.1.9 192.168.1.54

Console(config)#ip dhcp relay information option

Console(config)#ip dhcp relay information policy replace

Console(config)#exit

4-241

4-242

Console#show ip dhcp-relay

Status of DHCP relay option82:

Insertion of option82 is Enabled.

DHCP option policy :replace.

DHCP relay-server address 192.168.1.9 192.168.1.54 0.0.0.0 0.0.0.0

0.0.0.0

Console#

3-18

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Managing Firmware

You can upload/download firmware to or from a TFTP server. By saving runtime

code to a file on a TFTP server, that file can later be downloaded to the switch to

restore operation. You can also set the switch to use new firmware without

overwriting the previous version. You must specify the method of file transfer, along

with the file type and file names as required.

Command Attributes

• File Transfer Method – The firmware copy operation includes these options:

- file to file – Copies a file within the switch directory, assigning it a new name.

- file to tftp – Copies a file from the switch to a TFTP server.

- tftp to file – Copies a file from a TFTP server to the switch.

- file to unit – Copies a file from this switch to another unit in the stack.

- unit to file – Copies a file from another unit in the stack to this switch.

• TFTP Server IP Address – The IP address of a TFTP server.

• File Type – Specify opcode (operational code) to copy firmware.

• File Name – The file name should not contain slashes (\ or /), the leading letter of

the file name should not be a period (.), and the maximum length for file names on

the TFTP server is 127 characters or 31 characters for files on the switch.

(Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

Note: Up to two copies of the system software (i.e., the runtime firmware) can be stored

in the file directory on the switch. The currently designated startup version of this

file cannot be deleted.

1. These operations are not supported for this switch.

3-19

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Downloading System Software from a Server

When downloading runtime code, you can specify the destination file name to

replace the current image, or first download the file using a different name from the

current runtime code file, and then set the new file as the startup file.

Web –Click System, File Management, Copy Operation. Select “tftp to file” as the file

transfer method, enter the IP address of the TFTP server, set the file type to

“opcode,” enter the file name of the software to download, select a file on the switch

to overwrite or specify a new file name, then click Apply. If you replaced the current

firmware used for startup and want to start using the new operation code, reboot the

system via the System/Reset menu.

Figure 3-9 Operation Code Image File Transfer

If you download to a new destination file, go to the System/File/Set Start-Up menu,

mark the operation code file used at startup, and click Apply. To start the new

firmware, reboot the system via the System/Reset menu.

Figure 3-10 Select Start-Up Operation File

3-20

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

To delete a file select System, File, Delete. Select the file name from the given list by

checking the tick box and click Apply. Note that the file currently designated as the

startup code cannot be deleted.

Figure 3-11 Deleting Files

CLI – To download new firmware form a TFTP server, enter the IP address of the

TFTP server, select “opcode” as the file type, then enter the source and destination

file names. When the file has finished downloading, set the new file to start up the

system, and then restart the switch.

To start the new firmware, enter the “reload” command or reboot the system.

Console#copy tftp file

TFTP server ip address: 192.168.1.23

Choose file type:

1. config: 2. opcode: <1-2>: 2

Source file name: V2262.bix

Destination file name: ES3552XA_Opcpde_V2262.bix

\Write to FLASH Programming.

-Write to FLASH finish.

Success.

Console#config

Console(config)#boot system opcode:ES3552XA_Opcpde_V2262.bix

Console(config)#exit

Console#reload

4-75

4-23

3-21

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Saving or Restoring Configuration Settings

You can upload/download configuration settings to/from a TFTP server. The

configuration files can be later downloaded to restore the switch’s settings.

Command Attributes

• File Transfer Method – The configuration copy operation includes these options:

- file to file – Copies a file within the switch directory, assigning it a new name.

- file to running-config – Copies a file in the switch to the running configuration.

- file to startup-config – Copies a file in the switch to the startup configuration.

- file to tftp – Copies a file from the switch to a TFTP server.

- running-config to file – Copies the running configuration to a file.

- running-config to startup-config – Copies the running config to the startup config.

- running-config to tftp – Copies the running configuration to a TFTP server.

- startup-config to file – Copies the startup configuration to a file on the switch.

- startup-config to running-config – Copies the startup config to the running config.

- startup-config to tftp – Copies the startup configuration to a TFTP server.

- tftp to file – Copies a file from a TFTP server to the switch.

- tftp to running-config – Copies a file from a TFTP server to the running config.

- tftp to startup-config – Copies a file from a TFTP server to the startup config.

- file to unit – Copies a file from this switch to another unit in the stack.

- unit to file – Copies a file from another unit in the stack to this switch.

• TFTP Server IP Address – The IP address of a TFTP server.

• File Type – Specify config (configuration) to copy configuration settings.

•

File Name — The file name should not contain slashes (\ or /), the leading letter of

the file name should not be a period (.), and the maximum length for file names on

the TFTP server is 127 characters or 31 characters for files on the switch. (Valid

characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

Note: The maximum number of user-defined configuration files is limited only by

available flash memory space.

2. These operations are not supported for this switch.

3-22

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Downloading Configuration Settings from a Server

You can download the configuration file under a new file name and then set it as the

startup file, or you can specify the current startup configuration file as the destination

file to directly replace it. Note that the file “Factory_Default_Config.cfg” can be

copied to the TFTP server, but cannot be used as the destination on the switch.

Web – Click System, File, Copy. Select “tftp to startup-config” or “tftp to file” and

enter the IP address of the TFTP server. Specify the name of the file to download

and select a file on the switch to overwrite or specify a new file name, then click

Apply.

Figure 3-12 Copy Configuration Settings

If you download to a new file name using “tftp to startup-config” or “tftp to file,” the file

is automatically set as the start-up configuration file. To use the new settings, reboot

the system via the System/Reset menu.

Note that you can also select any configuration file as the start-up configuration by

using the System/File/Set Start-Up page.

Figure 3-13 Setting the Startup Configuration Settings

3-23

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – Enter the IP address of the TFTP server, specify the source file on the server,

set the startup file name on the switch, and then restart the switch.

Console#copy tftp startup-config

TFTP server ip address: 192.168.1.19

Source configuration file name: config-1

Startup configuration file name [] : startup

\Write to FLASH Programming.

-Write to FLASH finish.

Success.

Console#reload

To select another configuration file as the start-up configuration, use the boot

system command and then restart the switch.

Console#config

Console(config)#boot system config: startup-new

Console(config)#exit

Console#reload

4-75

4-23

Console Port Settings

You can access the onboard configuration program by attaching a VT100

compatible device to the switch’s serial console port. Management access through

the console port is controlled by various parameters, including a password, timeouts,

and basic communication settings. These parameters can be configured via the

Web or CLI interface.

Command Attributes

• Login Timeout – Sets the interval that the system waits for a user to log into the

CLI. If a login attempt is not detected within the timeout interval, the connection is

terminated for the session. (Range: 0-300 seconds; Default: 0)

• Exec Timeout – Sets the interval that the system waits until user input is detected.

If user input is not detected within the timeout interval, the current session is

terminated. (Range: 0-65535 seconds; Default: 0 seconds)

• Password Threshold – Sets the password intrusion threshold, which limits the

number of failed logon attempts. When the logon attempt threshold is reached, the

system interface becomes silent for a specified amount of time (set by the Silent

Time parameter) before allowing the next logon attempt.

(Range: 0-120; Default: 3 attempts)

• Silent Time – Sets the amount of time the management console is inaccessible

after the number of unsuccessful logon attempts has been exceeded.

(Range: 0-65535; Default: 0)

• Data Bits – Sets the number of data bits per character that are interpreted and

generated by the console port. If parity is being generated, specify 7 data bits per

character. If no parity is required, specify 8 data bits per character. (Default: 8 bits)

• Parity – Defines the generation of a parity bit. Communication protocols provided

by some terminals can require a specific parity bit setting. Specify Even, Odd, or

None. (Default: None)

3-24

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

• Speed – Sets the terminal line’s baud rate for transmit (to terminal) and receive

(from terminal). Set the speed to match the baud rate of the device connected to

the serial port. (Range: 9600, 19200, 38400, 57600, or 115200 baud, Auto;

Default: 9600 bps)

• Stop Bits – Sets the number of the stop bits transmitted per byte.

(Range: 1-2; Default: 1 stop bit)

• Password – Specifies a password for the line connection. When a connection is

started on a line with password protection, the system prompts for the password.

If you enter the correct password, the system shows a prompt.

(Default: No password)

• Login – Enables password checking at login. You can select authentication by a

single global password as configured for the Password parameter, or by

passwords set up for specific user-name accounts. (Default: Local)

Web – Click System, Line, Console. Specify the console port connection parameters

as required, then click Apply.

Figure 3-14 Console Port Settings

3. CLI only.

3-25

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – Enter Line Configuration mode for the console, then specify the connection

parameters as required. To display the current console port settings, use the show

line command from the Normal Exec level.

Console(config)#line console

Console(config-line)#login local

Console(config-line)#password 0 secret

Console(config-line)#timeout login response 0

Console(config-line)#exec-timeout 0

Console(config-line)#password-thresh 3

Console(config-line)#silent-time 60

Console(config-line)#databits 8

Console(config-line)#parity none

Console(config-line)#speed 115200

Console(config-line)#stopbits 1

Console(config-line)#end

Console#show line

Console configuration:

Password threshold: 3 times

Interactive timeout: Disabled

Silent time:

Baudrate:

Disabled

115200

Databits:

Parity:

Stopbits:

none

VTY configuration:

Password threshold: 3 times

Interactive timeout: 600 sec

Console#

300 sec

Telnet Settings

You can access the onboard configuration program over the network using Telnet

(i.e., a virtual terminal). Management access via Telnet can be enabled/disabled and

other various parameters set, including the TCP port number, timeouts, and a

password. These parameters can be configured via the Web or CLI interface.

Command Attributes

• Telnet Status – Enables or disables Telnet access to the switch.

(Default: Enabled)

• Telnet Port Number – Sets the TCP port number for Telnet on the switch.

(Default: 23)

• Login Timeout – Sets the interval that the system waits for a user to log into the

CLI. If a login attempt is not detected within the timeout interval, the connection is

terminated for the session. (Range: 0-300 seconds; Default: 300 seconds)

• Exec Timeout – Sets the interval that the system waits until user input is detected.

If user input is not detected within the timeout interval, the current session is

terminated. (Range: 0-65535 seconds; Default: 600 seconds)

3-26

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

• Password Threshold – Sets the password intrusion threshold, which limits the

number of failed logon attempts. When the logon attempt threshold is reached, the

system interface becomes silent for a specified amount of time (set by the Silent

Time parameter) before allowing the next logon attempt.

(Range: 0-120; Default: 3 attempts)

• Password – Specifies a password for the line connection. When a connection is

started on a line with password protection, the system prompts for the password.

If you enter the correct password, the system shows a prompt. (Default: No

password)

• Login – Enables password checking at login. You can select authentication by a

single global password as configured for the Password parameter, or by

passwords set up for specific user-name accounts. (Default: Local)

Web – Click System, Line, Telnet. Specify the connection parameters for Telnet

access, then click Apply.

Figure 3-15 Enabling Telnet

4. CLI only.

3-27

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – Enter Line Configuration mode for a virtual terminal, then specify the

connection parameters as required. To display the current virtual terminal settings,

use the show line command from the Normal Exec level.

Console(config)#line vty

Console(config-line)#login local

Console(config-line)#password 0 secret

Console(config-line)#timeout login response 300

Console(config-line)#exec-timeout 600

Console(config-line)#password-thresh 3

Console(config-line)#end

Console#show line

Console configuration:

Password threshold: 3 times

Interactive timeout: Disabled

Silent time:

Baudrate:

Disabled

9600

Databits:

Parity:

Stopbits:

none

VTY configuration:

Password threshold: 3 times

Interactive timeout: 600 sec

Console#

Configuring Event Logging

The switch allows you to control the logging of error messages, including the type of

events that are recorded in switch memory, logging to a remote System Log (syslog)

server, and displays a list of recent event messages.

System Log Configuration

The system allows you to enable or disable event logging, and specify which levels

are logged to RAM or flash memory.

Severe error messages that are logged to flash memory are permanently stored in

the switch to assist in troubleshooting network problems. Up to 4096 log entries can

be stored in the flash memory, with the oldest entries being overwritten first when the

available log memory (256 kilobytes) has been exceeded.

The System Logs page allows you to configure and limit system messages that are

logged to flash or RAM memory. The default is for event levels 0 to 3 to be logged to

flash and levels 0 to 6 to be logged to RAM.

Command Attributes

• System Log Status – Enables/disables the logging of debug or error messages to

the logging process. (Default: Enabled)

• Flash Level – Limits log messages saved to the switch’s permanent flash memory

for all levels up to the specified level. For example, if level 3 is specified, all

messages from level 0 to level 3 will be logged to flash. (Range: 0-7, Default: 3)

3-28

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Table 3-3 Logging Levels

Description

Level

Severity Name

Debug

Debugging messages

Informational messages only

Informational

Notice

Normal but significant condition, such as cold start

Warning conditions (e.g., return false, unexpected return)

Error conditions (e.g., invalid input, default used)

Warning

Error

Critical

Critical conditions (e.g., memory allocation, or free memory

error - resource exhausted)

Alert

Immediate action needed

System unusable

Emergency

* There are only Level 2, 5 and 6 error messages for the current firmware release.

• RAM Level – Limits log messages saved to the switch’s temporary RAM memory

for all levels up to the specified level. For example, if level 7 is specified, all

messages from level 0 to level 7 will be logged to RAM. (Range: 0-7, Default: 6)

Note: The Flash Level must be equal to or less than the RAM Level.

Web – Click System, Log, System Logs. Specify System Log Status, then change

the level of messages to be logged to RAM and flash memory, then click Apply.

Figure 3-16 System Logs

CLI – Enable system logging and then specify the level of messages to be logged to

RAM and flash memory. Use the show logging command to display the current

settings.

Console(config)#logging on

Console(config)#logging history ram 0

Console(config)#end

4-44

4-45

Console#show logging flash

Syslog logging: Enabled

4-48

History logging in FLASH: level emergencies

Console#

3-29

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Remote Log Configuration

The Remote Logs page allows you to configure the logging of messages that are

sent to syslog servers or other management stations. You can also limit the error

messages sent to only those messages below a specified level.

Command Attributes

• Remote Log Status – Enables/disables the logging of debug or error messages

to the remote logging process. (Default: Enabled)

• Logging Facility – Sets the facility type for remote logging of syslog messages.

There are eight facility types specified by values of 16 to 23. The facility type is

used by the syslog server to dispatch log messages to an appropriate service.

The attribute specifies the facility type tag sent in syslog messages. (See RFC

3164.) This type has no effect on the kind of messages reported by the switch.

However, it may be used by the syslog server to process messages, such as

sorting or storing messages in the corresponding database. (Range: 16-23,

Default: 23)

• Logging Trap – Limits log messages that are sent to the remote syslog server for

all levels up to the specified level. For example, if level 3 is specified, all messages

from level 0 to level 3 will be sent to the remote server. (Range: 0-7, Default: 6)

• Host IP List – Displays the list of remote server IP addresses that receive the

syslog messages. The maximum number of host IP addresses allowed is five.

• Host IP Address – Specifies a new server IP address to add to the Host IP List.

Web – Click System, Log, Remote Logs. To add an IP address to the Host IP List,

type the new IP address in the Host IP Address box, and then click Add. To delete

an IP address, click the entry in the Host IP List, and then click Remove.

Figure 3-17 Remote Logs

3-30

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

CLI – Enter the syslog server host IP address, choose the facility type and set the

logging trap.

Console(config)#logging host 192.168.1.15

Console(config)#logging facility 23

Console(config)#logging trap 4

Console(config)#end

4-46

Console#show logging trap

“Configuring Remote SNMPv3 Users” on page 3-47.)

Syslog logging:

Enabled

REMOTELOG status:

Enabled

REMOTELOG facility type:

REMOTELOG level type:

local use 7

Warning conditions

REMOTELOG server ip address: 192.168.1.15

REMOTELOG server ip address: 0.0.0.0

Console#

Displaying Log Messages

The Logs page allows you to scroll through the logged system and event messages.

The switch can store up to 2048 log entries in temporary random access memory

(RAM; i.e., memory flushed on power reset) and up to 4096 entries in permanent

flash memory.

Web – Click System, Log, Logs.

Figure 3-18 Displaying Logs

CLI – This example shows the event message stored in RAM.

Console#show log ram

4-48

[1] 00:01:37 2001-01-01

"DHCP request failed - will retry later."

level: 4, module: 9, function: 0, and event no.: 10

[0] 00:00:35 2001-01-01

"System coldStart notification."

level: 6, module: 6, function: 1, and event no.: 1

Console#

3-31

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Sending Simple Mail Transfer Protocol Alerts

To alert system administrators of problems, the switch can use SMTP (Simple Mail

Transfer Protocol) to send email messages when triggered by logging events of a

specified level. The messages are sent to specified SMTP servers on the network

and can be retrieved using POP or IMAP clients.

Command Attributes

• Admin Status – Enables/disables the SMTP function. (Default: Enabled)

• Email Source Address – Sets the email address used for the “From” field in alert

messages. You may use a symbolic email address that identifies the switch, or the

address of an administrator responsible for the switch.

• Severity – Sets the syslog severity threshold level (see table on page 3-29) used

to trigger alert messages. All events at this level or higher will be sent to the

configured email recipients. For example, using Level 7 will report all events from

level 7 to level 0. (Default: Level 7)

• SMTP Server List – Specifies a list of up to three recipient SMTP servers. The

switch attempts to connect to the other listed servers if the first fails. Use the New

SMTP Server text field and the Add/Remove buttons to configure the list.

• Email Destination Address List – Specifies the email recipients of alert

messages. You can specify up to five recipients. Use the New Email Destination

Address text field and the Add/Remove buttons to configure the list.

3-32

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Web – Click System, Log, SMTP. Enable SMTP, specify a source email address,

and select the minimum severity level. To add an IP address to the SMTP Server

List, type the new IP address in the SMTP Server field and click Add. To delete an IP

address, click the entry in the SMTP Server List and click Remove. Specify up to five

email addresses to receive the alert messages, and click Apply.

Figure 3-19 Enabling and Configuring SMTP Alerts

3-33

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – Enter the IP address of at least one SMTP server, set the syslog severity level

to trigger an email message, and specify the switch (source) and up to five recipient

(destination) email addresses. Enable SMTP with the logging sendmail command

to complete the configuration. Use the show logging sendmail command to display

the current SMTP configuration.

Console(config)#logging sendmail host 192.168.1.200

Console(config)#logging sendmail level 4

Console(config)#logging sendmail source-email john@acme.com

Console(config)##logging sendmail destination-email geoff@acme.com

Console(config)#logging sendmail

Console(config)#exit

Console#show logging sendmail

4-53

SMTP servers

-----------------------------------------------

1. 192.168.1.200

SMTP minimum severity level: 4

SMTP destination email addresses

-----------------------------------------------

1. geoff@acme.com

SMTP source email address:

john@acme.com

Enabled

SMTP status:

Console#

Resetting the System

Web – Click System, Reset to reboot the switch. When prompted, confirm that you

want reset the switch.

Figure 3-20 Resetting the System

CLI – Use the reload command to restart the switch. When prompted, confirm that

you want to reset the switch.

Console#reload

4-23

System will be restarted, continue <y/n>? y

Note: When restarting the system, it will always run the Power-On Self-Test.

3-34

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Setting the System Clock

Simple Network Time Protocol (SNTP) allows the switch to set its internal clock

based on periodic updates from a Network Time Protocol (NTP) server. Maintaining

an accurate time on the switch enables the system log to record meaningful dates

and times for event entries. You can also manually set the clock using the CLI. (See

“calendar set” on page 4-62.) If the clock is not set, the switch will only record the

time from the factory default set at the last bootup.

When the SNTP client is enabled, the switch periodically sends a request for a time

update to a configured time server. You can configure up to three time server IP

addresses. The switch will attempt to poll each server in the configured sequence.

For more robust, secure time updates from trusted servers, the NTP client can be

enabled instead of the SNTP client. Using the NTP client provides more reliable time

updates, since the updates are collected from many NTP servers, then filtered and

selected using an algorithm that determines the most accurate time. The NTP client

also uses authentication and encryption to ensure that updates are received from

authorized servers only.

Note: The SNTP and NTP client cannot be enabled at the same time.

Configuring SNTP

You can configure the switch to send time synchronization requests to time servers.

Command Attributes

• SNTP Client – Configures the switch to operate as an SNTP client. This requires

at least one time server to be specified in the SNTP Server field. (Default: Disabled)

• SNTP Poll Interval – Sets the interval between sending requests for a time update

from a time server. (Range: 16-16384 seconds; Default: 16 seconds)

• SNTP Server – Sets the IP address for up to three time servers. The switch

attempts to update the time from the first server, if this fails it attempts an update

from the next server in the sequence.

Web – Select NTP/SNTP, Configuration. Modify any of the required parameters, and

click Apply.

Figure 3-21 SNTP Configuration

3-35

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This example configures the switch to operate as an SNTP unicast client and

then displays the current time and settings.

Console(config)#sntp server 10.1.0.19 137.82.140.80 128.250.36.2

Console(config)#sntp poll 60

Console(config)#sntp client

Console(config)#exit

4-55

4-56

4-54

Console#show sntp

Current time: Jan 6 14:56:05 2004

Poll interval: 60

Current mode: unicast

SNTP status : Enabled

SNTP server 10.1.0.19 137.82.140.80 128.250.36.2

Current server: 128.250.36.2

Console#

Configuring NTP

The NTP client allows you to configure up to 50 NTP servers to poll for time updates.

You can also enable authentication to ensure that reliable updates are received from

only authorized NTP servers. The authentication keys and their associated key

number must be centrally managed and manually distributed to NTP servers and

clients. The key numbers and key values must match on both the server and client.

Command Attributes

• NTP Client – Configures the switch to operate as an NTP client. This requires at

least one time server to be specified in the NTP Server list. (Default: Disabled)

• NTP Polling Interval – Sets the interval between sending requests for a time

update from NTP servers. (Range: 16-16384 seconds; Default: 16 seconds)

• NTP Authenticate – Enables authentication for time requests and updates

between the switch and NTP servers. (Default: Disabled)

• NTP Server – Sets the IP address for an NTP server to be polled. The switch

requests an update from all configured servers, then determines the most accurate

time update from the responses received.

• Version – Specifies the NTP version supported by the server. (Range: 1-3;

Default: 3)

• Authenticate Key – Specifies the number of the key in the NTP Authentication Key

List to use for authentication with the configured server. The authentication key

must match the key configured on the NTP server.

• Key Number – A number that specifies a key value in the NTP Authentication Key

List. Up to 255 keys can be configured in the NTP Authentication Key List. Note

that key numbers and values must match on both the server and client. (Range:

1-65535)

• Key Context – Specifies an MD5 authentication key string. The key string can be

up to 32 case-sensitive printable ASCII characters (no spaces).

Web – Select NTP/SNTP, Configuration. Modify any of the required parameters, and

click Apply.

3-36

Download from Www.Somanuals.com. All Manuals Search And Download.

Basic Configuration

Figure 3-22 NTP Client Configuration

CLI – This example configures the switch to operate as an NTP client and then

displays the current settings.

Console(config)#ntp authentication-key 19 md5 thisiskey19

Console(config)#ntp authentication-key 30 md5 ntpkey30

Console(config)#ntp server 192.168.3.20

Console(config)#ntp server 192.168.3.21

Console(config)#ntp server 192.168.4.22 version 2

Console(config)#ntp server 192.168.5.23 version 3 key 19

Console(config)#ntp poll 60

Console(config)#ntp client

Console(config)#ntp authenticate

Console(config)#exit

Console#show ntp

Current time: Jan 1 02:58:58 2001

Poll interval: 60

Current mode: unicast

NTP status : Enabled

Last Update NTP Server: 0.0.0.0

NTP Authenticate status : Enabled

Port: 0

Last Update time: Dec 31 00:00:00 2000 UTC

NTP Server 192.168.3.20 version 3

NTP Server 192.168.3.21 version 3

NTP Server 192.168.4.22 version 2

NTP Server 192.168.5.23 version 3 key 19

NTP Authentication-Key 19 md5 Q33O16Q6338241J022S29Q731K7 7

NTP Authentication-Key 30 md5 D2V8777I51K1132K3552L26R6141O4 7

Console#

3-37

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Setting the Time Zone

SNTP uses Coordinated Universal Time (or UTC, formerly Greenwich Mean Time,

or GMT) based on the time at the Earth’s prime meridian, zero degrees longitude. To

display a time corresponding to your local time, you must indicate the number of

hours and minutes your time zone is east (before) or west (after) of UTC.

Command Attributes

• Current Time – Displays the current time.

• Name – Assigns a name to the time zone. (Range: 1-29 characters)

• Hours (0-12) – The number of hours before/after UTC.

• Minutes (0-59) – The number of minutes before/after UTC.

• Direction – Configures the time zone to be before (east) or after (west) UTC.

Web – Select SNTP, Clock Time Zone. Set the offset for your time zone relative to

the UTC, and click Apply.

Figure 3-23 Setting the System Clock

CLI - This example shows how to set the time zone for the system clock.

Console(config)#clock timezone Taiwan hours 6 minute 0 after-UTC

Console(config)#

4-61

Simple Network Management Protocol

SNMP is a communication protocol designed specifically for managing devices on a

network. Equipment commonly managed with SNMP includes switches, routers and

host computers. SNMP is typically used to configure these devices for proper

operation in a network environment, as well as to monitor them to evaluate

performance or detect potential problems.

Managed devices supporting SNMP contain software, which runs locally on the

device and is referred to as an agent. A defined set of variables, known as managed

objects, is maintained by the SNMP agent and used to manage the device. These

objects are defined in a Management Information Base (MIB) that provides a

standard presentation of the information controlled by the agent. SNMP defines both

3-38

Download from Www.Somanuals.com. All Manuals Search And Download.

Simple Network Management Protocol

the format of the MIB specifications and the protocol used to access this information

over the network.

The switch includes an onboard agent that supports SNMP versions 1, 2c, and 3.

This agent continuously monitors the status of the switch hardware, as well as the

traffic passing through its ports. A network management station can access this

information using software such as HP OpenView. Access to the onboard agent

from clients using SNMP v1 and v2c is controlled by community strings. To

communicate with the switch, the management station must first submit a valid

community string for authentication.

Access to the switch using from clients using SNMPv3 provides additional security

features that cover message integrity, authentication, and encryption; as well as

controlling user access to specific areas of the MIB tree.

The SNMPv3 security structure consists of security models, with each model having

it’s own security levels. There are three security models defined, SNMPv1,

SNMPv2c, and SNMPv3. Users are assigned to “groups” that are defined by a

security model and specified security levels. Each group also has a defined security

access to set of MIB objects for reading and writing, which are known as “views.”

The switch has a default view (all MIB objects) and default groups defined for

security models v1 and v2c. The following table shows the security models and

levels available and the system default settings.

Table 3-4 SNMPv3 Security Models and Levels

Model Level

Group

Read View Write View Notify View Security

noAuthNoPriv public

defaultview none

none

Community string only

(read only)

noAuthNoPriv private

defaultview defaultview none

Community string only

(read/write)

noAuthNoPriv user defined user defined user defined user defined Community string only

v2c

noAuthNoPriv public

(read only)

defaultview none

none

Community string only

v2c

noAuthNoPriv private

(read/write)

defaultview defaultview none

v2c

noAuthNoPriv user defined user defined user defined user defined Community string only

noAuthNoPriv user defined user defined user defined user defined A user name match only

AuthNoPriv

user defined user defined user defined user defined Provides user

authentication via MD5 or

SHA algorithms

AuthPriv

user defined user defined user defined user defined Provides user

authentication via MD5 or

SHA algorithms and data

privacy using DES 56-bit

encryption

Note: The predefined default groups and view can be deleted from the system. You can

then define customized groups and views for the SNMP clients that require access.

3-39

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Enabling the SNMP Agent

Enables SNMPv3 service for all management clients (i.e., versions 1, 2c, 3).

Command Attributes

SNMP Agent Status – Enables SNMP on the switch.

Web – Click SNMP, Agent Status. Enable the SNMP Agent by marking the Enabled

checkbox, and click Apply.

Figure 3-24 Enabling the SNMP Agent

CLI – The following example enables SNMP on the switch.

Console(config)#snmp-server

Console(config)#

4-117

Setting Community Access Strings

You may configure up to five community strings authorized for management access

by clients using SNMP v1 and v2c. All community strings used for IP Trap Managers

should be listed in this table. For security reasons, you should consider removing the

default strings.

Command Attributes

• SNMP Community Capability – The switch supports up to five community strings.

• Current – Displays a list of the community strings currently configured.

• Community String – A community string that acts like a password and permits

access to the SNMP protocol.

Default strings: “public” (read-only access), “private” (read/write access)

Range: 1-32 characters, case sensitive

• Access Mode – Specifies the access rights for the community string:

- Read-Only – Authorized management stations are only able to retrieve MIB

objects.

- Read/Write – Authorized management stations are able to both retrieve and

modify MIB objects.

3-40

Download from Www.Somanuals.com. All Manuals Search And Download.

Specifying Trap Managers and Trap Types

Web – Click SNMP, Configuration. Add new community strings as required, select

the access rights from the Access Mode drop-down list, then click Add.

Figure 3-25 Configuring SNMP Community Strings

CLI – The following example adds the string “spiderman” with read/write access.

Console(config)#snmp-server community spiderman rw

Console(config)#

4-118

Specifying Trap Managers and Trap Types

Traps indicating status changes are issued by the switch to specified trap managers.

You must specify trap managers so that key events are reported by this switch to

your management station (using network management platforms such as HP

OpenView). You can specify up to five management stations that will receive

authentication failure messages and other trap messages from the switch.

Command Usage

• If you specify an SNMP Version 3 host, then the “Trap Manager Community String”

is interpreted as an SNMP user name. If you use V3 authentication or encryption

options (authNoPriv or authPriv), the user name must first be defined in the

SNMPv3 Users page (page 3-45). Otherwise, the authentication password and/or

privacy password will not exist, and the switch will not authorize SNMP access for

the host. However, if you specify a V3 host with the no authentication (noAuth)

option, an SNMP user account will be automatically generated, and the switch will

authorize SNMP access for the host.

• Notifications are issued by the switch as trap messages by default. The recipient

of a trap message does not send a response to the switch. Traps are therefore not

as reliable as inform messages, which include a request for acknowledgement of

receipt. Informs can be used to ensure that critical information is received by the

host. However, note that informs consume more system resources because they

must be kept in memory until a response is received. Informs also add to network

traffic. You should consider these effects when deciding whether to issue

notifications as traps or informs.

3-41

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

To send an inform to a SNMPv2c host, complete these steps:

1.Enable the SNMP agent (page 3-54).

2.Enable trap informs as described in the following pages.

3.Create a view with the required notification messages (page 3-53).

4.Create a group that includes the required notify view (page 3-49).

To send an inform to a SNMPv3 host, complete these steps:

1.Enable the SNMP agent (page 3-54).

2.Enable trap informs as described in the following pages.

3.Create a view with the required notification messages (page 3-53).

4.Create a group that includes the required notify view (page 3-49).

5.Specify a remote engine ID where the user resides (page 3-44).

6.Then configure a remote user (page 3-47).

Command Attributes

• Trap Manager Capability – This switch supports up to five trap managers.

• Current – Displays a list of the trap managers currently configured.

• Trap Manager IP Address – IP address of a new management station to receive

notification messages.

• Trap Manager Community String – Specifies a valid community string for the

new trap manager entry. Though you can set this string in the Trap Managers table,

we recommend that you define this string in the SNMP Configuration page (for

Version 1 or 2c clients), or define a corresponding “User Name” in the SNMPv3

Users page (for Version 3 clients). (Range: 1-32 characters, case sensitive)

• Trap UDP Port – Specifies the UDP port number used by the trap manager.

• Trap Version – Indicates if the user is running SNMP v1, v2c, or v3. (Default: v1)

• Trap Security Level – When trap version 3 is selected, you must specify one of

the following security levels. (Default: noAuthNoPriv)

- noAuthNoPriv – There is no authentication or encryption used in SNMP

communications.

- AuthNoPriv – SNMP communications use authentication, but the data is not

encrypted (only available for the SNMPv3 security model).

- AuthPriv – SNMP communications use both authentication and encryption (only

available for the SNMPv3 security model).

• Trap Inform – Notifications are sent as inform messages. Note that this option is

only available for version 2c and 3 hosts. (Default: traps are used)

- Timeout – The number of seconds to wait for an acknowledgment before

resending an inform message. (Range: 0-2147483647 centiseconds;

Default: 1500 centiseconds)

- Retry times – The maximum number of times to resend an inform message if

the recipient does not acknowledge receipt. (Range: 0-255; Default: 3)

3-42

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SNMPv3 Management Access

• Enable Authentication Traps – Issues a notification message to specified IP

trap managers whenever authentication of an SNMP request fails.

(Default: Enabled)

• Enable Link-up and Link-down Traps – Issues a notification message whenever

a port link is established or broken. (Default: Enabled)

Web – Click SNMP, Configuration. Enter the IP address and community string for

each management station that will receive trap messages, specify the UDP port,

SNMP trap version, trap security level (for v3 clients), trap inform settings (for v2c/v3

clients), and then click Add. Select the trap types required using the check boxes for

Authentication and Link-up/down traps, and then click Apply.

Figure 3-26 Configuring SNMP Trap Managers

CLI – This example adds a trap manager and enables authentication traps.

Console(config)#snmp-server host 10.1.19.23 private version 2c

udp-port 162

4-120

4-122

Console(config)#snmp-server enable traps authentication

Configuring SNMPv3 Management Access

To configure SNMPv3 management access to the switch, follow these steps:

1. If you want to change the default engine ID, do so before configuring other

SNMP parameters.

2. Specify read and write access views for the switch MIB tree.

3. Configure SNMP user groups with the required security model (i.e., SNMP v1,

5. These are legacy notifications and therefore when used for SNMP Version 3 hosts, they must

be enabled in conjunction with the corresponding entries in the Notification View (page 3-49).

3-43

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

v2c or v3) and security level (i.e., authentication and privacy).

4. Assign SNMP users to groups, along with their specific authentication and

privacy passwords.

Setting a Local Engine ID

An SNMPv3 engine is an independent SNMP agent that resides on the switch. This

engine protects against message replay, delay, and redirection. The engine ID is

also used in combination with user passwords to generate the security keys for

authenticating and encrypting SNMPv3 packets.

A local engine ID is automatically generated that is unique to the switch. This is

referred to as the default engine ID. If the local engineID is deleted or changed, all

SNMP users will be cleared. You will need to reconfigure all existing users.

A new engine ID can be specified by entering 1 to 26 hexadecimal characters. If less

than 26 characters are specified, trailing zeroes are added to the value. For

example, the value “1234” is equivalent to “1234” followed by 22 zeroes.

Web – Click SNMP, SNMPv3, Engine ID. Enter an ID of up to 26 hexadecimal

characters and then click Save.

Figure 3-27 Setting the SNMPv3 Engine ID

CLI – This example sets an SNMPv3 engine ID.

Console(config)#snmp-server engine-id local 12345abcdef

Console(config)#exit

Console#show snmp engine-id

4-123

4-124

Local SNMP engineID: 8000002a8000000000e8666672

Local SNMP engineBoots: 1

Console#

Specifying a Remote Engine ID

To send inform messages to an SNMPv3 user on a remote device, you must first

specify the engine identifier for the SNMP agent on the remote device where the

user resides. The remote engine ID is used to compute the security digest for

authenticating and encrypting packets sent to a user on the remote host.

SNMP passwords are localized using the engine ID of the authoritative agent. For

informs, the authoritative SNMP agent is the remote agent. You therefore need to

3-44

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SNMPv3 Management Access

configure the remote agent’s SNMP engine ID before you can send proxy requests

or informs to it. (See “Specifying Trap Managers and Trap Types” on page 3-41 and

The engine ID can be specified by entering 1 to 26 hexadecimal characters. If less

than 26 characters are specified, trailing zeroes are added to the value. For

example, the value “1234” is equivalent to “1234” followed by 22 zeroes.

Web – Click SNMP, SNMPv3, Remote Engine ID. Enter an ID of up to 26

hexadecimal characters and then click Save.

Figure 3-28 Setting an Engine ID

CLI – This example specifies a remote SNMPv3 engine ID.

Console(config)#snmp-server engineID remote 54321 192.168.1.19

Console(config)#exit

Console#show snmp engine-id

4-123

4-124

Local SNMP engineID: 8000002a8000000000e8666672

Local SNMP engineBoots: 1

Remote SNMP engineID

80000000030004e2b316c54321

Console#

IP address

192.168.1.19

Configuring SNMPv3 Users

Each SNMPv3 user is defined by a unique name. Users must be configured with a

specific security level and assigned to a group. The SNMPv3 group restricts users to

a specific read, write, or notify view.

Command Attributes

• User Name – The name of user connecting to the SNMP agent. (Range: 1-32

characters)

• Group Name – The name of the SNMP group to which the user is assigned.

(Range: 1-32 characters)

• Security Model – The user security model; SNMP v1, v2c or v3.

• Security Level – The security level used for the user:

- noAuthNoPriv – There is no authentication or encryption used in SNMP

communications. (This is the default for SNMPv3.)

- AuthNoPriv – SNMP communications use authentication, but the data is not

encrypted (only available for the SNMPv3 security model).

- AuthPriv – SNMP communications use both authentication and encryption (only

3-45

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

available for the SNMPv3 security model).

• Authentication Protocol – The method used for user authentication. (Options:

MD5, SHA; Default: MD5)

• Authentication Password – A minimum of eight plain text characters is required.

• Privacy Protocol – The encryption algorithm use for data privacy; only 56-bit DES

is currently available.

• Privacy Password – A minimum of eight plain text characters is required.

• Actions – Enables the user to be assigned to another SNMPv3 group.

Web – Click SNMP, SNMPv3, Users. Click New to configure a user name. In the

New User page, define a name and assign it to a group, then click Add to save the

configuration and return to the User Name list. To delete a user, check the box next

to the user name, then click Delete. To change the assigned group of a user, click

Change Group in the Actions column of the users table and select the new group.

Figure 3-29 Configuring SNMPv3 Users

3-46

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SNMPv3 Management Access

CLI – Use the snmp-server user command to configure a new user name and

assign it to a group.

Console(config)#snmp-server user chris group r&d v3 auth md5

greenpeace priv des56 einstien

Console(config)#exit

Console#show snmp user

4-128

4-130

EngineId: 80000034030001f488f5200000

User Name: chris

Authentication Protocol: md5

Privacy Protocol: des56

Storage Type: nonvolatile

Row Status: active

Console#

Configuring Remote SNMPv3 Users

Each SNMPv3 user is defined by a unique name. Users must be configured with a

specific security level and assigned to a group. The SNMPv3 group restricts users to

a specific read and a write view.

To send inform messages to an SNMPv3 user on a remote device, you must first

specify the engine identifier for the SNMP agent on the remote device where the

user resides. The remote engine ID is used to compute the security digest for

authenticating and encrypting packets sent to a user on the remote host. (See

“Specifying Trap Managers and Trap Types” on page 3-41 an d “Specifying a

Remote Engine ID” on page 3-44.)

Command Attributes

• User Name – The name of user connecting to the SNMP agent. (Range: 1-32

characters)

• Group Name – The name of the SNMP group to which the user is assigned.

(Range: 1-32 characters)

• Engine ID – The engine identifier for the SNMP agent on the remote device where

the remote user resides. Note that the remote engine identifier must be specified

before you configure a remote user. (See “Specifying a Remote Engine ID” on

page 3-44.)

• Remote IP – The Internet address of the remote device where the user resides.

• Security Model – The user security model; SNMP v1, v2c or v3. (Default: v1)

• Security Level – The security level used for the user:

- noAuthNoPriv – There is no authentication or encryption used in SNMP

communications. (This is the default for SNMPv3.)

- AuthNoPriv – SNMP communications use authentication, but the data is not

encrypted (only available for the SNMPv3 security model).

- AuthPriv – SNMP communications use both authentication and encryption (only

available for the SNMPv3 security model).

• Authentication Protocol – The method used for user authentication. (Options:

MD5, SHA; Default: MD5)

• Authentication Password – A minimum of eight plain text characters is required.

3-47

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• Privacy Protocol – The encryption algorithm use for data privacy; only 56-bit DES

is currently available.

• Privacy Password – A minimum of eight plain text characters is required.

Web – Click SNMP, SNMPv3, Remote Users. Click New to configure a user name.

In the New User page, define a name and assign it to a group, then click Add to save

the configuration and return to the User Name list. To delete a user, check the box

next to the user name, then click Delete.

Figure 3-30 Configuring Remote SNMPv3 Users

3-48

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SNMPv3 Management Access

CLI – Use the snmp-server user command to configure a new user name and

assign it to a group.

Console(config)#snmp-server user mark group r&d remote 192.168.1.19 v3

auth md5 greenpeace priv des56 einstien

Console(config)#exit

4-128

Console#show snmp user

No user exist.

4-130

SNMP remote user

EngineId: 80000000030004e2b316c54321

User Name: mark

Authentication Protocol: none

Privacy Protocol: none

Storage Type: nonvolatile

Row Status: active

Console#

Configuring SNMPv3 Groups

An SNMPv3 group sets the access policy for its assigned users, restricting them to

specific read, write, and notify views. You can use the pre-defined default groups or

create new groups to map a set of SNMP users to SNMP views.

Command Attributes

• Group Name – The name of the SNMP group. (Range: 1-32 characters)

• Model – The group security model; SNMP v1, v2c or v3.

• Level – The security level used for the group:

- noAuthNoPriv – There is no authentication or encryption used in SNMP

communications.

- AuthNoPriv – SNMP communications use authentication, but the data is not

encrypted (only available for the SNMPv3 security model).

- AuthPriv – SNMP communications use both authentication and encryption (only

available for the SNMPv3 security model).

• Read View – The configured view for read access. (Range: 1-64 characters)

• Write View – The configured view for write access. (Range: 1-64 characters)

• Notify View – The configured view for notifications. (Range: 1-64 characters)

3-49

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Table 3-5 Supported Notification Messages

Object Label

Object ID

Description

RFC 1493 Traps

newRoot

1.3.6.1.2.1.17.0.1

The newRoot trap indicates that the sending

agent has become the new root of the Spanning

Tree; the trap is sent by a bridge soon after its

election as the new root, e.g., upon expiration of

the Topology Change Timer immediately

subsequent to its election.

topologyChange

1.3.6.1.2.1.17.0.2

A topologyChange trap is sent by a bridge when

any of its configured ports transitions from the

Learning state to the Forwarding state, or from

the Forwarding state to the Discarding state. The

trap is not sent if a newRoot trap is sent for the

same transition.

SNMPv2 Traps

coldStart

1.3.6.1.6.3.1.1.5.1

1.3.6.1.6.3.1.1.5.2

1.3.6.1.6.3.1.1.5.3

A coldStart trap signifies that the SNMPv2 entity,

acting in an agent role, is reinitializing itself and

that its configuration may have been altered.

warmStart

A warmStart trap signifies that the SNMPv2

entity, acting in an agent role, is reinitializing

itself such that its configuration is unaltered.

A linkDown trap signifies that the SNMP entity,

acting in an agent role, has detected that the

ifOperStatus object for one of its communication

links is about to enter the down state from some

other state (but not from the notPresent state).

This other state is indicated by the included

value of ifOperStatus.

linkDown

1.3.6.1.6.3.1.1.5.4

1.3.6.1.6.3.1.1.5.5

A linkUp trap signifies that the SNMP entity,

acting in an agent role, has detected that the

ifOperStatus object for one of its communication

links left the down state and transitioned into

some other state (but not into the notPresent

state). This other state is indicated by the

included value of ifOperStatus.

linkUp

An authenticationFailure trap signifies that the

SNMPv2 entity, acting in an agent role, has

received a protocol message that is not properly

authenticated. While all implementations of the

SNMPv2 must be capable of generating this

trap, the snmpEnableAuthenTraps object

indicates whether this trap will be generated.

authenticationFailure

RMON Events (V2)

risingAlarm

1.3.6.1.2.1.16.0.1

1.3.6.1.2.1.16.0.2

The SNMP trap that is generated when an alarm

entry crosses its rising threshold and generates

an event that is configured for sending SNMP

traps.

fallingAlarm

The SNMP trap that is generated when an alarm

entry crosses its falling threshold and generates

an event that is configured for sending SNMP

traps.

3-50

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SNMPv3 Management Access

Table 3-5 Supported Notification Messages (Continued)

Object ID Description

Object Label

Private Traps -

swPowerStatus

ChangeTrap

1.3.6.1.4.1.259.6.10.95.2.1.0.1 This trap is sent when the power state changes.

1.3.6.1.4.1.259.6.10.95.2.1.0.17 This trap is sent when the fan fails.

swFanFailureTrap

swFanRecoverTrap

1.3.6.1.4.1.259.6.10.95.2.1.0.18 This trap is sent when the fan failure has

recovered.

swPortSecurityTrap

swIpFilterRejectTrap

1.3.6.1.4.1.259.6.10.95.2.1.0.36 This trap is sent when a port is intruded.

1.3.6.1.4.1.259.6.10.95.2.1.0.40 This trap is sent when an incorrect IP address is

rejected by the IP Filter.

swSmtpConnFailure

Trap

1.3.6.1.4.1.259.6.10.95.2.1.0.41 This trap is triggered if the SMTP system cannot

open a connection to the mail server

successfully.

swMainBoardVer

MismatchNotificaiton

1.3.6.1.4.1.259.6.10.95.2.1.0.56 This trap is sent when the slave board version is

mismatched with the master board version. This

trap binds two objects, the first object indicates

the master version, whereas the second

represents the slave version.

swModuleVer

MismatchNotificaiton

1.3.6.1.4.1.259.6.10.95.2.1.0.57 This trap is sent when the slide-in module

version is mismatched with the main board

version.

swThermalRising

Notification

1.3.6.1.4.1.259.6.10.95.2.1.0.58 This trap is sent when the temperature exceeds

the switchThermalActionRisingThreshold.

swThermalFalling

Notification

1.3.6.1.4.1.259.6.10.95.2.1.0.59 This trap is sent when the temperature falls below

the switchThermalActionFallingThreshold.

swModuleInsertion

Notificaiton

1.3.6.1.4.1.259.6.10.95.2.1.0.60 This trap is sent when a module is inserted.

swModuleRemoval

Notificaiton

1.3.6.1.4.1.259.6.10.95.2.1.0.61 This trap is sent when a module is removed.

a. These are legacy notifications and therefore must be enabled in conjunction with the corresponding traps on the

SNMP Configuration menu (page 3-43).

3-51

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click SNMP, SNMPv3, Groups. Click New to configure a new group. In the

New Group page, define a name, assign a security model and level, and then select

read, write, and notify views. Click Add to save the new group and return to the

Groups list. To delete a group, check the box next to the group name, then click

Delete.

Figure 3-31 Configuring SNMPv3 Groups

CLI – Use the snmp-server group command to configure a new group, specifying

the security model and level, and restricting MIB access to defined read and write

views.

Console(config)#snmp-server group secure-users v3 priv read defaultview

write defaultview notify defaultview

Console(config)#exit

4-126

Console#show snmp group

4-127

Group Name: secure-users

Security Model: v3

Read View: defaultview

Write View: defaultview

Notify View: defaultview

Storage Type: nonvolatile

Row Status: active

Console#

3-52

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SNMPv3 Management Access

Setting SNMPv3 Views

SNMPv3 views are used to restrict user access to specified portions of the MIB tree.

The predefined view “defaultview” includes access to the entire MIB tree.

Command Attributes

• View Name – The name of the SNMP view. (Range: 1-64 characters)

• View OID Subtrees – Shows the currently configured object identifiers of branches

within the MIB tree that define the SNMP view.

• Edit OID Subtrees – Allows you to configure the object identifiers of branches

within the MIB tree. Wild cards can be used to mask a specific portion of the OID

string.

• Type – Indicates if the object identifier of a branch within the MIB tree is included

or excluded from the SNMP view.

Web – Click SNMP, SNMPv3, Views. Click New to configure a new view. In the New

View page, define a name and specify OID subtrees in the switch MIB to be included

or excluded in the view. Click Back to save the new view and return to the SNMPv3

Views list. For a specific view, click on View OID Subtrees to display the current

configuration, or click on Edit OID Subtrees to make changes to the view settings. To

delete a view, check the box next to the view name, then click Delete.

Figure 3-32 Configuring SNMPv3 Views

3-53

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – Use the snmp-server view command to configure a new view. This example

view includes the MIB-2 interfaces table, and the wildcard mask selects all index

entries.

Console(config)#snmp-server view ifEntry.a 1.3.6.1.2.1.2.2.1.1.*

included

4-125

4-126

Console(config)#exit

Console#show snmp view

View Name: ifEntry.a

Subtree OID: 1.3.6.1.2.1.2.2.1.1.*

View Type: included

Storage Type: nonvolatile

Row Status: active

View Name: readaccess

Subtree OID: 1.3.6.1.2

View Type: included

Storage Type: nonvolatile

Row Status: active

View Name: defaultview

Subtree OID: 1

View Type: included

Storage Type: nonvolatile

Row Status: active

Console#

User Authentication

You can restrict management access to this switch using the following options:

• User Accounts – Manually configure access rights on the switch for specified users.

• Authentication Settings – Use remote authentication to configure access rights.

• HTTPS Settings – Provide a secure web connection.

• SSH Settings – Provide a secure shell (for secure Telnet access).

• Port Security – Configure secure addresses for individual ports.

• 802.1X – Use IEEE 802.1X port authentication to control access to specific ports.

• IP Filter – Filters management access to the web, SNMP or Telnet interface.

Configuring User Accounts

The guest only has read access for most configuration parameters. However, the

administrator has write access for all parameters governing the onboard agent. You

should therefore assign a new administrator password as soon as possible, and

store it in a safe place.

The default guest name is “guest” with the password “guest.” The default

administrator name is “admin” with the password “admin.”

Command Attributes

• Account List – Displays the current list of user accounts and associated access

levels. (Defaults: admin, and guest)

3-54

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

• New Account – Displays configuration settings for a new account.

- User Name – The name of the user.

(Maximum length: 8 characters)

- Access Level – Specifies the user level.

(Options: Normal and Privileged)

- Password – Specifies the user password.

(Range: 0-8 characters plain text, case sensitive)

• Change Password – Sets a new password for the specified user name.

• Add/Remove – Adds or removes an account from the list.

Web – Click Security, User Accounts. To configure a new user account, specify a

user name, select the user’s access level, then enter a password and confirm it.

Click Add to save the new user account and add it to the Account List. To change the

password for a specific user, enter the user name and new password, confirm the

password by entering it again, then click Apply.

Figure 3-33 Access Levels

CLI – Assign a user name to access-level 15 (i.e., administrator), then specify the

password.

Console(config)#username bob access-level 15

Console(config)#username bob password 0 smith

Console(config)#

4-27

3-55

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Configuring Local/Remote Logon Authentication

Use the Authentication Settings menu to restrict management access based on

specified user names and passwords. You can manually configure access rights on

the switch, or you can use a remote access authentication server based on RADIUS

or TACACS+ protocols.

Remote Authentication Dial-in

User Service (RADIUS) and

Terminal Access Controller

Access Control System Plus

Web

Telnet

console

(TACACS+) are logon

authentication protocols that

use software running on a

central server to control

access to RADIUS-aware or

TACACS-aware devices on the

network. An authentication

server contains a database of

1. Client attempts management access.

2. Switch contacts authentication server.

3. Authentication server challenges client.

4. Client responds with proper password or key.

5. Authentication server approves access.

6. Switch grants management access.

RADIUS/

TACACS+

server

multiple user name/password pairs with associated privilege levels for each user

that requires management access to the switch.

RADIUS uses UDP while TACACS+ uses TCP. UDP only offers best effort delivery,

while TCP offers a connection-oriented transport. Also, note that RADIUS encrypts

only the password in the access-request packet from the client to the server, while

TACACS+ encrypts the entire body of the packet.

Command Usage

• By default, management access is always checked against the authentication

database stored on the local switch. If a remote authentication server is used, you

must specify the authentication sequence and the corresponding parameters for

the remote authentication protocol. Local and remote logon authentication control

management access via the console port, web browser, or Telnet.

• RADIUS and TACACS+ logon authentication assign a specific privilege level for

each user name/password pair. The user name, password, and privilege level

must be configured on the authentication server.

• You can specify up to three authentication methods for any user to indicate the

authentication sequence. For example, if you select (1) RADIUS, (2) TACACS and

(3) Local, the user name and password on the RADIUS server is verified first. If the

RADIUS server is not available, then authentication is attempted using the

TACACS+ server, and finally the local user name and password is checked.

3-56

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

Command Attributes

• Authentication – Select the authentication, or authentication sequence required:

- Local – User authentication is performed only locally by the switch.

- Radius – User authentication is performed using a RADIUS server only.

- TACACS – User authentication is performed using a TACACS+ server only.

- [authentication sequence] – User authentication is performed by up to three

authentication methods in the indicated sequence.

• RADIUS Settings

- Global – Provides globally applicable RADIUS settings.

- ServerIndex – Specifies one of five RADIUS servers that may be configured.

The switch attempts authentication using the listed sequence of servers. The

process ends when a server either approves or denies access to a user.

- Server IP Address – Address of authentication server. (Default: 10.1.0.1)

- Server Port Number – Network (UDP) port of authentication server used for

authentication messages. (Range: 1-65535; Default: 1812)

- Secret Text String – Encryption key used to authenticate logon access for

client. Do not use blank spaces in the string. (Maximum length: 20 characters)

- Number of Server Transmits – Number of times the switch tries to authenticate

logon access via the authentication server. (Range: 1-30; Default: 2)

- Timeout for a reply – The number of seconds the switch waits for a reply from

the RADIUS server before it resends the request. (Range: 1-65535; Default: 5)

• TACACS Settings

- Server IP Address – Address of the TACACS+ server. (Default: 10.11.12.13)

- Server Port Number – Network (TCP) port of TACACS+ server used for

authentication messages. (Range: 1-65535; Default: 49)

- Secret Text String – Encryption key used to authenticate logon access for

client. Do not use blank spaces in the string. (Maximum length: 20 characters)

Note: The local switch user database has to be set up by manually entering user names

and passwords using the CLI. (See “username” on page 4-27.)

3-57

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Security, Authentication Settings. To configure local or remote

authentication preferences, specify the authentication sequence (i.e., one to three

methods), fill in the parameters for RADIUS or TACACS+ authentication if selected,

and click Apply.

Figure 3-34 Authentication Settings

CLI – Specify all the required parameters to enable logon authentication.

Console(config)#authentication login radius

Console(config)#radius-server port 181

Console(config)#radius-server key green

Console(config)#radius-server retransmit 5

Console(config)#radius-server timeout 10

Console(config)#radius-server 1 host 192.168.1.25

Console(config)#end

Console#show radius-server

4-81

Remote RADIUS server configuration:

Global settings:

Communication key with RADIUS server: *****

Server port number:

Retransmit times:

Request timeout:

181

Server 1:

Server IP address: 192.168.1.25

Communication key with RADIUS server: *****

Server port number: 1812

Retransmit times: 2

Request timeout: 5

3-58

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

Console#configure

Console(config)#authentication login tacacs

Console(config)#tacacs-server host 10.20.30.40

Console(config)#tacacs-server port 200

Console(config)#tacacs-server key green

Console#show tacacs-server

Certificate” on page 3-60.

4-82

4-83

Server IP address: 10.20.30.40

Communication key with tacacs server: *****

Server port number: 200

Console(config)#

Configuring HTTPS

You can configure the switch to enable the Secure Hypertext Transfer Protocol

(HTTPS) over the Secure Socket Layer (SSL), providing secure access (i.e., an

encrypted connection) to the switch’s web interface.

Command Usage

• Both the HTTP and HTTPS service can be enabled independently on the switch.

However, you cannot configure both services to use the same UDP port.

• If you enable HTTPS, you must indicate this in the URL that you specify in your

browser: https://device[:port_number]

• When you start HTTPS, the connection is established in this way:

- The client authenticates the server using the server’s digital certificate.

- The client and server negotiate a set of security protocols to use for the

connection.

- The client and server generate session keys for encrypting and decrypting data.

• The client and server establish a secure encrypted connection.

A padlock icon should appear in the status bar for Internet Explorer 5.x or above

and Netscape Navigator 6.2 or above.

• The following web browsers and operating systems currently support HTTPS:

Table 3-6 HTTPS System Support

Web Browser

Operating System

Internet Explorer 5.0 or later

Windows 98,Windows NT (with service pack 6a),

Windows 2000, Windows XP

Netscape Navigator 6.2 or later

Windows 98,Windows NT (with service pack 6a),

Windows 2000, Windows XP, Solaris 2.6

• To specify a secure-site certificate, see “Replacing the Default Secure-site

Command Attributes

• HTTPS Status – Allows you to enable/disable the HTTPS server feature on the

switch.

(Default: Enabled)

•

Change HTTPS Port Number – Specifies the UDP port number used for HTTPS/

SSL connection to the switch’s web interface. (Default: Port 443)

3-59

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Security, HTTPS Settings. Enable HTTPS and specify the port number,

then click Apply.

Figure 3-35 HTTPS Settings

CLI – This example enables the HTTP secure server and modifies the port number.

Console(config)#ip http secure-server

Console(config)#ip http secure-port 443

Console(config)#

4-32

4-33

Replacing the Default Secure-site Certificate

When you log onto the web interface using HTTPS (for secure access), a Secure

Sockets Layer (SSL) certificate appears for the switch. By default, the certificate that

Netscape and Internet Explorer display will be associated with a warning that the

site is not recognized as a secure site. This is because the certificate has not been

signed by an approved certification authority. If you want this warning to be replaced

by a message confirming that the connection to the switch is secure, you must

obtain a unique certificate and a private key and password from a recognized

certification authority.

Caution: For maximum security, we recommend you obtain a unique Secure Sockets

Layer certificate at the earliest opportunity. This is because the default

certificate for the switch is not unique to the hardware you have purchased.

When you have obtained these, place them on your TFTP server, and use the

following command at the switch's command-line interface to replace the default

(unrecognized) certificate with an authorized one:

Console#copy tftp https-certificate

TFTP server ip address: <server ip-address>

Source certificate file name: <certificate file name>

Source private file name: <private key file name>

Private password: <password for private key>

Note: The switch must be reset for the new certificate to be activated. To reset the

switch, type: Console#reload

3-60

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

Configuring the Secure Shell

The Berkley-standard includes remote access tools originally designed for Unix

systems. Some of these tools have also been implemented for Microsoft Windows

and other environments. These tools, including commands such as rlogin (remote

The Secure Shell (SSH) includes server/client applications intended as a secure

replacement for the older Berkley remote access tools. SSH can also provide

remote management access to this switch as a secure replacement for Telnet.

When the client contacts the switch via the SSH protocol, the switch generates a

public-key that the client uses along with a local user name and password for access

authentication. SSH also encrypts all data transfers passing between the switch and

SSH-enabled management station clients, and ensures that data traveling over the

network arrives unaltered.

Note that you need to install an SSH client on the management station to access the

switch for management via the SSH protocol.

Note: The switch supports both SSH Version 1.5 and 2.0.

Command Usage

The SSH server on this switch supports both password and public key

authentication. If password authentication is specified by the SSH client, then the

password can be authenticated either locally or via a RADIUS or TACACS+ remote

authentication server, as specified on the Authentication Settings page

(page 3-56). If public key authentication is specified by the client, then you must

configure authentication keys on both the client and the switch as described in the

following section. Note that regardless of whether you use public key or password

authentication, you still have to generate authentication keys on the switch (SSH

Host Key Settings) and enable the SSH server (Authentication Settings).

To use the SSH server, complete these steps:

1. Generate a Host Key Pair – On the SSH Host Key Settings page, create a host

public/private key pair.

2. Provide Host Public Key to Clients – Many SSH client programs automatically

import the host public key during the initial connection setup with the switch.

Otherwise, you need to manually create a known hosts file on the management

station and place the host public key in it. An entry for a public key in the known

hosts file would appear similar to the following example:

10.1.0.54 1024 35 15684995401867669259333946775054617325313674890836547254

15020245593199868544358361651999923329781766065830956 10825913212890233

76546801726272571413428762941301196195566782 59566410486957427888146206

51941746772984865468615717739390164779355942303577413098022737087794545

24083971752646358058176716709574804776117

3-61

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

3. Import Client’s Public Key to the Switch – Use the copy tftp public-key

command (page 4-70) to copy a file containing the public key for all the SSH

client’s granted management access to the switch. (Note that these clients

must be configured locally on the switch via the User Accounts page as

described on page 3-54.) The clients are subsequently authenticated using

these keys. The current firmware only accepts public key files based on

standard UNIX format as shown in the following example for an RSA Version 1

key:

1024 35 1341081685609893921040944920155425347631641921872958921143173880

05553616163105177594083868631109291232226828519254374603100937187721199

69631781366277414168985132049117204830339254324101637997592371449011938

00609025394840848271781943722884025331159521348610229029789827213532671

31629432532818915045306393916643 steve@192.168.1.19

4. Set the Optional Parameters – On the SSH Settings page, configure the

optional parameters, including the authentication timeout, the number of retries,

and the server key size.

5. Enable SSH Service – On the SSH Settings page, enable the SSH server on

the switch.

6. Challenge-Response Authentication – When an SSH client attempts to contact

the switch, the SSH server uses the host key pair to negotiate a session key

and encryption method. Only clients that have a private key corresponding to

the public keys stored on the switch can access. The following exchanges take

place during this process:

a. The client sends its public key to the switch.

b. The switch compares the client's public key to those stored in memory.

c. If a match is found, the switch uses the public key to encrypt a random

sequence of bytes, and sends this string to the client.

d. The client uses its private key to decrypt the bytes, and sends the

decrypted bytes back to the switch.

e. The switch compares the decrypted bytes to the original bytes it sent. If the

two sets match, this means that the client's private key corresponds to an

authorized public key, and the client is authenticated.

Notes: 1. To use SSH with only password authentication, the host public key must still

be given to the client, either during initial connection or manually entered into

the known host file. However, you do not need to configure the client’s keys.

2. The SSH server supports up to four client sessions. The maximum number

of client sessions includes both current Telnet sessions and SSH sessions.

3-62

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

Generating the Host Key Pair

A host public/private key pair is used to provide secure communications between an

SSH client and the switch. After generating this key pair, you must provide the host

public key to SSH clients and import the client’s public key to the switch as

described in the proceeding section (Command Usage).

Field Attributes

• Public-Key of Host-Key – The public key for the host.

- RSA (Version 1): The first field indicates the size of the host key (e.g., 1024), the

second field is the encoded public exponent (e.g., 65537), and the last string is

the encoded modulus.

- DSA (Version 2): The first field indicates that the encryption method used by

SSH is based on the Digital Signature Standard (DSS). The last string is the

encoded modulus.

• Host-Key Type – The key type used to generate the host key pair (i.e., public and

private keys). (Range: RSA (Version 1), DSA (Version 2), Both: Default: RSA)

The SSH server uses RSA or DSA for key exchange when the client first

establishes a connection with the switch, and then negotiates with the client to

select either DES (56-bit) or 3DES (168-bit) for data encryption.

• Save Host-Key from Memory to Flash – Saves the host key from RAM (i.e.,

volatile memory to flash memory. Otherwise, the host key pair is stored to RAM by

default. Note that you must select this item prior to generating the host-key pair.

• Generate – This button is used to generate the host key pair. Note that you must

first generate the host key pair before you can enable the SSH server on the SSH

Server Settings page.

• Clear – This button clears the host key from both volatile memory (RAM) and

non-volatile memory (Flash).

3-63

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Security, SSH, Host-Key Settings. Select the host-key type from the

drop-down box, select the option to save the host key from memory to flash (if

required) prior to generating the key, and then click Generate.

Figure 3-36 SSH Host-Key Settings

CLI – This example generates a host-key pair using both the RSA and DSA

algorithms, stores the keys to flash memory, and then displays the host’s public keys.

Console#ip ssh crypto host-key generate

Console#ip ssh save host-key

Console#show public-key host

4-37

Host:

RSA:

1024 65537 127250922544926402131336514546131189679055192360076028653006761

82409690947448320102524878965977592168322225584652387791546479807396314033

86925793105105765212243052807865885485789272602937866089236841423275912127

60325919683697053439336438445223335188287173896894511729290510813919642025

190932104328579045764891

DSA:

ssh-dssAAAAB3NzaC1kc3MAAACBAN6zwIqCqDb3869jYVXlME1sHL0EcE/Re6hlasfEthIwmj

hLY4O0jqJZpcEQUgCfYlum0Y2uoLka+Py9ieGWQ8f2gobUZKIICuKg6vjO9XTs7XKc05xfzkBi

KviDa+2OrIz6UK+6vFOgvUDFedlnixYTVo+h5v8r0ea2rpnO6DkZAAAAFQCNZn/x17dwpW8RrV

DQnSWw4Qk+6QAAAIEAptkGeB6B5hwagH4gUOCY6i1TmrmSiJgfwO9OqRPUMbCAkCC+uzxatOo7

drnIZypMx+Sx5RUdMGgKS+9ywsa1cWqHeFY5ilc3lDCNBueeLykZzVS+RS+azTKIk/zrJh8GLG

Nq375R55yRxFvmcGIn/Q7IphPqyJ3o9MK8LFDfmJEAAACAL8A6tESiswP2OFqX7VGoEbzVDSOI

RTMFy3iUXtvGyQAOVSy67Mfc3lMtgqPRUOYXDiwIBp5NXgilCg5z7VqbmRm28mWc5a//f8TUAg

PNWKV6W0hqmshQdotVzDR1e+XKNTZj0uTwWfjO5Kytdn4MdoTHgrbl/DMdAfjnte8MZZs=

Console#

3-64

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

Configuring the SSH Server

The SSH server includes basic settings for authentication.

Field Attributes

• SSH Server Status – Allows you to enable/disable the SSH server on the switch.

(Default: Disabled)

• Version – The Secure Shell version number. Version 2.0 is displayed, but the

switch supports management access via either SSH Version 1.5 or 2.0 clients.

• SSH Authentication Timeout – Specifies the time interval in seconds that the

SSH server waits for a response from a client during an authentication attempt.

(Range: 1-120 seconds; Default: 120 seconds)

• SSH Authentication Retries – Specifies the number of authentication attempts

that a client is allowed before authentication fails and the client has to restart the

authentication process. (Range: 1-5 times; Default: 3)

• SSH Server-Key Size – Specifies the SSH server key size.

(Range: 512-896 bits; Default:768)

- The server key is a private key that is never shared outside the switch.

- The host key is shared with the SSH client, and is fixed at 1024 bits.

Web – Click Security, SSH, Settings. Enable SSH and adjust the authentication

parameters as required, then click Apply. Note that you must first generate the host

key pair on the SSH Host-Key Settings page before you can enable the SSH server.

Figure 3-37 SSH Server Settings

3-65

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This example enables SSH, sets the authentication parameters, and displays

the current configuration. It shows that the administrator has made a connection via

SHH, and then disables this connection.

Console(config)#ip ssh server

Console(config)#ip ssh timeout 100

Console(config)#ip ssh authentication-retries 5

Console(config)#ip ssh server-key size 512

Console(config)#end

Console#show ip ssh

SSH Enabled - version 2.0

Negotiation timeout: 120 secs; Authentication retries: 5

Server key size: 512 bits

Console#show ssh

4-42

Connection Version State

2.0 Session-Started

Username Encryption

admin

ctos aes128-cbc-hmac-md5

stoc aes128-cbc-hmac-md5

Console#disconnect 0

Console#

Configuring Port Security

Port security is a feature that allows you to configure a switch port with one or more

device MAC addresses that are authorized to access the network through that port.

When port security is enabled on a port, the switch stops learning new MAC

addresses on the specified port when it has reached a configured maximum

number. Only incoming traffic with source addresses already stored in the dynamic

or static address table will be accepted as authorized to access the network through

that port. If a device with an unauthorized MAC address attempts to use the switch

port, the intrusion will be detected and the switch can automatically take action by

disabling the port and sending a trap message.

To use port security, specify a maximum number of addresses to allow on the port

and then let the switch dynamically learn the <source MAC address, VLAN> pair for

frames received on the port. Note that you can also manually add secure addresses

to the port using the Static Address Table (page 3-114). When the port has reached

the maximum number of MAC addresses the selected port will stop learning. The

MAC addresses already in the address table will be retained and will not age out.

Any other device that attempts to use the port will be prevented from accessing the

switch.

Command Usage

• A secure port has the following restrictions:

- Cannot use port monitoring.

- Cannot be a multi-VLAN port.

- It cannot be used as a member of a static or dynamic trunk.

- It should not be connected to a network interconnection device.

• The default maximum number of MAC addresses allowed on a secure port is zero.

You must configure a maximum address count from 1 - 1024 for the port to allow

access.

3-66

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

• If a port is disabled (shut down) due to a security violation, it must be manually

re-enabled from the Port/Port Configuration page (page 3-91).

Command Attributes

• Port – Port number.

• Name – Descriptive text (page 4-132).

• Action – Indicates the action to be taken when a port security violation is detected:

- None: No action should be taken. (This is the default.)

- Trap: Send an SNMP trap message.

- Shutdown: Disable the port.

- Trap and Shutdown: Send an SNMP trap message and disable the port.

• Security Status – Enables or disables port security on the port. (Default: Disabled)

• Max MAC Count – The maximum number of MAC addresses that can be learned

on a port. (Range: 0 - 1024, where 0 means disabled)

• Trunk – Trunk number if port is a member (page 3-94 and 3-95).

Web – Click Security, Port Security. Mark the checkbox in the Status column to

enable security for a port, set the maximum number of MAC addresses allowed on a

port, and click Apply.

Figure 3-38 Configuring Port Security

CLI – This example selects the target port, sets the port security action to send a

trap and disable the port and sets the maximum MAC addresses allowed on the

port, and then enables port security for the port.

Console(config)#interface ethernet 1/5

Console(config-if)#port security action trap-and-shutdown

Console(config-if)#port security max-mac-count 20

Console(config-if)#port security

4-84

Console(config-if)#

3-67

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Configuring 802.1X Port Authentication

Network switches can provide open and easy access to network resources by

simply attaching a client PC. Although this automatic configuration and access is a

desirable feature, it also allows unauthorized personnel to easily intrude and

possibly gain access to sensitive network data.

The IEEE 802.1X (dot1X) standard defines a port-based access control procedure

that prevents unauthorized access to a network by requiring users to first submit

credentials for authentication. Access to all switch ports in a network can be

centrally controlled from a server, which means that authorized users can use the

same credentials for authentication from any point within the network.

This switch uses the

Extensible Authentication

Protocol over LANs (EAPOL)

to exchange authentication

802.1x

client

protocol messages with the

client, and a remote RADIUS

authentication server to verify

user identity and access

rights. When a client

(i.e., Supplicant) connects to

a switch port, the switch

1. Client attempts to access a switch port.

2. Switch sends client an identity request.

3. Client sends back identity information.

RADIUS

4. Switch forwards this to authentication server.

5. Authentication server challenges client.

server

6. Client responds with proper credentials.

7. Authentication server approves access.

8. Switch grants client access to this port.

(i.e., Authenticator) responds with an EAPOL identity request. The client provides its

identity (such as a user name) in an EAPOL response to the switch, which it

forwards to the RADIUS server. The RADIUS server verifies the client identity and

sends an access challenge back to the client. The EAP packet from the RADIUS

server contains not only the challenge, but the authentication method to be used.

The client can reject the authentication method and request another, depending on

the configuration of the client software and the RADIUS server. The encryption

method used to pass authentication messages can be MD5 (Message-Digest 5),

TLS (Transport Layer Security), TTLS (Tunneled Transport Layer Security), or

PEAP (Protected Extensible Authentication Protocol). The client responds to the

appropriate method with its credentials, such as a password or certificate. The

RADIUS server verifies the client credentials and responds with an accept or reject

packet. If authentication is successful, the switch allows the client to access the

network. Otherwise, network access is denied and the port remains blocked.

The operation of 802.1X on the switch requires the following:

• The switch must have an IP address assigned.

• RADIUS authentication must be enabled on the switch and the IP address of the

RADIUS server specified.

• 802.1X must be enabled globally for the switch.

• Each switch port that will be used must be set to dot1X “Auto” mode.

• Each client that needs to be authenticated must have dot1X client software

installed and properly configured.

3-68

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

• The RADIUS server and 802.1X client support EAP. (The switch only supports

EAPOL in order to pass the EAP packets from the server to the client.)

• The RADIUS server and client also have to support the same EAP encryption

method for passing authentication messages – MD5, TLS, TTLS, PEAP. Native

support for these encryption methods is provided in Windows XP, and in Windows

2000 with Service Pack 4. To support these encryption methods in Windows 95

and 98, you can use the AEGIS dot1x client or other comparable client software.

Displaying 802.1X Global Settings

The 802.1X protocol provides client authentication.

Command Attributes

• 802.1X System Authentication Control – The global setting for 802.1X.

Web – Click Security, 802.1X, Information.

Figure 3-39 802.1X Global Information

CLI – This example shows the default global setting for 802.1X.

Console#show dot1x

4-90

Global 802.1X Parameters

system-auth-control: enable

802.1X Port Summary

Port Name Status

Operation Mode

Single-Host

Mode

ForceAuthorized

Authorized

n/a

1/1

disabled

1/2

802.1X Port Details

802.1X is disabled on port 1/1

802.1X is disabled on port 1/52

Console#

3-69

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Configuring 802.1X Global Settings

The 802.1X protocol includes port authentication. The 802.1X protocol must be

enabled globally for the switch system before port settings are active.

Command Attributes

• 802.1X System Authentication Control – Sets the global setting for 802.1X.

(Default: Disabled)

Web – Select Security, 802.1X, Configuration. Enable 802.1X globally for the switch,

and click Apply.

Figure 3-40 802.1X Configuration

CLI – This example enables 802.1X globally for the switch.

Console(config)#dot1x system-auth-control

Console(config)#

4-86

Configuring Port Settings for 802.1X

When 802.1X is enabled, you need to configure the parameters for the

authentication process that runs between the client and the switch (i.e.,

authenticator), as well as the client identity lookup process that runs between the

switch and authentication server. These parameters are described in this section.

Command Attributes

• Port – Port number.

• Status – Indicates if authentication is enabled or disabled on the port.

(Default: Disabled)

• Operation Mode – Allows single or multiple hosts (clients) to connect to an

802.1X-authorized port. (Options: Single-Host, Multi-Host; Default: Single-Host)

• Max Count – The maximum number of hosts that can connect to a port when the

Multi-Host operation mode is selected. (Range: 1-1024; Default: 5)

• Mode – Sets the authentication mode to one of the following options:

- Auto – Requires a dot1x-aware client to be authorized by the authentication

server. Clients that are not dot1x-aware will be denied access.

- Force-Authorized – Forces the port to grant access to all clients, either

dot1x-aware or otherwise. (This is the default setting.)

- Force-Unauthorized – Forces the port to deny access to all clients, either

dot1x-aware or otherwise.

3-70

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

• Re-authen – Sets the client to be re-authenticated after the interval specified by

the Re-authentication Period. Re-authentication can be used to detect if a new

device is plugged into a switch port. (Default: Disabled)

• Max-Req – Sets the maximum number of times the switch port will retransmit an

EAP request packet to the client before it times out the authentication session.

(Range: 1-10; Default 2)

• Quiet Period – Sets the time that a switch port waits after the Max Request Count

has been exceeded before attempting to acquire a new client.

(Range: 1-65535 seconds; Default: 60 seconds)

• Re-authen Period – Sets the time period after which a connected client must be

re-authenticated. (Range: 1-65535 seconds; Default: 3600 seconds)

• TX Period – Sets the time period during an authentication session that the switch

waits before re-transmitting an EAP packet. (Range: 1-65535; Default: 30 seconds)

• Authorized –

- Yes – Connected client is authorized.

- No – Connected client is not authorized.

- Blank – Displays nothing when dot1x is disabled on a port.

• Supplicant – Indicates the MAC address of a connected client.

• Trunk – Indicates if the port is configured as a trunk port.

Web – Click Security, 802.1X, Port Configuration. Modify the parameters required,

and click Apply.

Figure 3-41 802.1X Port Configuration

3-71

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This example sets the 802.1X parameters on port 2. For a description of the

additional fields displayed in this example, see “show dot1x” on page 4-90.

Console(config)#interface ethernet 1/2

Console(config-if)#dot1x port-control auto

Console(config-if)#dot1x re-authentication

Console(config-if)#dot1x max-req 5

Console(config-if)#dot1x timeout quiet-period 30

Console(config-if)#dot1x timeout re-authperiod 1800

Console(config-if)#dot1x timeout tx-period 40

Console(config-if)#exit

Console(config)#exit

Console#show dot1x

4-90

Global 802.1X Parameters

system-auth-control: enable

802.1X Port Summary

Port Name Status

Operation Mode

Single-Host

Mode

ForceAuthorized

auto

Authorized

n/a

yes

1/1

disabled

1/2

enabled

1/52

disabled

Single-Host

ForceAuthorized

n/a

802.1X Port Details

802.1X is disabled on port 1/1

802.1X is enabled on port 1/2

reauth-enabled: Enable

reauth-period: 1800

quiet-period:

tx-period:

supplicant-timeout:

server-timeout: 10

reauth-max:

max-req:

Status

Authorized

Operation mode

Max count

Single-Host

Port-control

Supplicant

Auto

00-00-e8-49-5e-dc

Current Identifier 3

Authenticator State Machine

State

Authenticated

Reauth Count

Backend State Machine

State

Idle

Request Count

Identifier(Server) 2

Reauthentication State Machine

State

Initialize

802.1X is disabled on port 1/52

Console#

3-72

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

Displaying 802.1X Statistics

This switch can display statistics for dot1x protocol exchanges for any port.

Table 3-7 802.1X Statistics

Parameter

Description

Rx EAPOL Start

The number of EAPOL Start frames that have been received by this

Authenticator.

Rx EAPOL Logoff

Rx EAPOL Invalid

Rx EAPOL Total

Rx EAP Resp/Id

Rx EAP Resp/Oth

Rx EAP LenError

Rx Last EAPOLVer

Rx Last EAPOLSrc

Tx EAPOL Total

Tx EAP Req/Id

The number of EAPOL Logoff frames that have been received by this

Authenticator.

The number of EAPOL frames that have been received by this

Authenticator in which the frame type is not recognized.

The number of valid EAPOL frames of any type that have been received

by this Authenticator.

The number of EAP Resp/Id frames that have been received by this

Authenticator.

The number of valid EAP Response frames (other than Resp/Id frames)

that have been received by this Authenticator.

The number of EAPOL frames that have been received by this

Authenticator in which the Packet Body Length field is invalid.

The protocol version number carried in the most recently received EAPOL

frame.

The source MAC address carried in the most recently received EAPOL

frame.

The number of EAPOL frames of any type that have been transmitted by

this Authenticator.

The number of EAP Req/Id frames that have been transmitted by this

Authenticator.

Tx EAP Req/Oth

The number of EAP Request frames (other than Rq/Id frames) that have

been transmitted by this Authenticator.

3-73

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Select Security, 802.1X, Statistics. Select the required port and then click

Query. Click Refresh to update the statistics.

Figure 3-42 Displaying 802.1X Port Statistics

CLI – This example displays the 802.1X statistics for port 4.

Console#show dot1x statistics interface ethernet 1/4

4-90

Eth 1/4

Rx: EAPOL

EAPOL

Logoff

EAPOL

Invalid

EAPOL

Total

1007

EAP

Resp/Id Resp/Oth LenError

672

EAP

Start

Last

EAPOLVer

Last

EAPOLSrc

00-00-E8-98-73-21

Tx: EAPOL

Total

EAP

Req/Id

1005

EAP

Req/Oth

2017

Console#

MAC Address Authentication

Some devices connected to switch ports may not be able to support 802.1X

authentication due to hardware or software limitations. This is often true for devices

such as network printers, IP phones, and some wireless access points. The switch

enables network access from these devices to be controlled by authenticating

device MAC addresses with a central RADIUS server.

Note: MAC authentication, 802.1X, and port security cannot be configured together on

the same port. Only one security mechanism can be applied.

The Network Access feature controls host access to the network by authenticating

its MAC address on the connected switch port. Traffic received from a specific MAC

3-74

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

address is forwarded by the switch only if the source MAC address is successfully

authenticated by a central RADIUS server. While authentication for a MAC address

is in progress, all traffic is blocked until authentication is completed. On successful

authentication, the RADIUS server may optionally assign VLAN settings for the

switch port

When enabled on a port interface, the authentication process sends a Password

Authentication Protocol (PAP) request to a configured RADIUS server. The

username and password are both equal to the MAC address being authenticated.

On the RADIUS server, PAP username and passwords must be configured in the

MAC address format XX-XX-XX-XX-XX-XX (all in upper case).

Authenticated MAC addresses are stored as dynamic entries in the switch secure

MAC address table and are removed when the aging time expires. The maximum

number of secure MAC addresses supported for the switch system is 1024.

Note: MAC authentication cannot be configured on trunk ports.

The RADIUS server may optionally return a VLAN identifier list to be applied to the

switch port. The following attributes need to be configured on the RADIUS server.

• Tunnel-Type = VLAN

• Tunnel-Medium-Type = 802

• Tunnel-Private-Group-ID = 1u,2t [VLAN ID list]

The VLAN identifier list is carried in the RADIUS “Tunnel-Private-Group-ID” attribute.

The VLAN list can contain multiple VLAN identifiers in the format “1u,2t,3u” where

“u” indicates an untagged VLAN and “t” a tagged VLAN.

Configuring the MAC Authentication Reauthentication Time

MAC address authentication is configured on a per-port basis, however there are

two configurable parameters that apply globally to all ports on the switch.

Command Attributes

• Authenticated Age – The secure MAC address table aging time. This parameter

setting is the same as switch MAC address table aging time and is only

configurable from the Address Table, Aging Time web page (see page 3-117).

(Default: 300 seconds)

• MAC Authentication Reauthentication Time – Sets the time period after which

a connected MAC address must be re-authenticated. When the reauthentication

time expires for a secure MAC address, it is reauthenticated with the RADIUS

server. During the reauthentication process traffic through the port remains

unaffected. (Default: 1800 seconds; Range: 120-1000000 seconds)

3-75

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Security, Network Access, Configuration.

Figure 3-43 Network Access Configuration

CLI – This example sets and displays the reauthentication time.

Console(config)#mac-authentication reauth-time 3000

Console(config)#exit

Console#show network-access interface ethernet 1/1

Port:1/1

4-98

4-99

--------------------------------------------------

MAC Authentication

Maximum MAC Count

:Disabled

:1024

Dynamic VLAN Assignment :Disabled

Reauthentication Time

Authenticated Age

MAC Filter ID

:3000

:300

:None

Console#

Configuring MAC Authentication for Ports

Configures MAC authentication on switch ports, including setting the maximum MAC

count, applying a MAC address filter, and enabling dynamic VLAN assignment.

Command Attributes

• Mode – Enables MAC authentication on a port. (Default: None)

• Maximum MAC Count – Sets the maximum number of MAC addresses that can

be authenticated on a port. The maximum number of MAC addresses per port is

1024, and the maximum number of secure MAC addresses supported for the

switch system is 1024. When the limit is reached, all new MAC addresses are

treated as authentication failed. (Default: 1024; Range: 1 to 1024)

• MAC Filter ID – Applies a MAC address filter to a port interface. MAC address

filters must first be created from the MAC Filter Configuration page. Only one filter

can be applied to a port. (Default: No filters are applied)

• Dynamic VLAN – Enables dynamic VLAN assignment for an authenticated port.

When enabled, any VLAN identifiers returned by the RADIUS server are applied to

the port, providing the VLANs have already been created on the switch. (GVRP is

not used to create the VLANs.) The VLAN settings specified by the first

authenticated MAC address are implemented for a port. Other authenticated MAC

address on the port must have same VLAN configuration, or they are treated as

authentication failure. (Default: Disabled)

3-76

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

Note: MAC authentication cannot be configured on trunk ports. Ports configured as trunk

members are indicated on the Network Access Port Configuration page in the

“Trunk” column.

Web – Click Security, Network Access, Port Configuration.

Figure 3-44 Network Access Port Configuration

CLI – This example configures MAC authentication for port 1.

Console(config)#interface ethernet 1/1

Console(config-if)#network-access mode mac-authentication

Console(config-if)#network-access max-mac-count 10

Console(config-if)#network-access port-mac-filter 5

Console(config-if)#network-access dynamic-vlan

Console(config-if)#end

4-94

4-95

4-97

Console#show network-access interface ethernet 1/1

Port:1/1

4-99

--------------------------------------------------

MAC Authentication

Maximum MAC Count

:Enabled

:10

Dynamic VLAN Assignment :Enabled

Reauthentication Time

Authenticated Age

MAC Filter ID

:1800

:300

Console#

Displaying Secure MAC Address Information

Authenticated MAC addresses are stored in the secure MAC address table.

Information on the secure MAC entries can be displayed and selected entries can be

removed from the table.

Command Attributes

• Network Access MAC Address Count – The number of MAC addresses

currently in the secure MAC address table.

3-77

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• Query By – Specifies parameters to use in the MAC address query.

• Port – Specifies a port interface.

• MAC Address – Specifies a single MAC address information.

• Attribute – Displays static or dynamic addresses.

• Address Table Sort Key – Sorts the information displayed based on MAC

address or port interface.

• Unit/Port – The port interface associated with a secure MAC address.

• MAC Address – The authenticated MAC address.

• RADIUS Server – The IP address of the RADIUS server that authenticated the

MAC address.

• Time – The time when the MAC address was last authenticated.

• Attribute – Indicates a static or dynamic address.

• Remove – Click the Remove button to remove selected MAC addresses from the

secure MAC address table.

Web – Click Security, Network Access, MAC Address Information. Restrict the

displayed addresses by port, MAC Address, or attribute, then select the method of

sorting the displayed addresses. Click Query.

Figure 3-45 Network Access MAC Address Information

3-78

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

CLI – This example displays all entries currently in the secure MAC address table.

Console#show network-access mac-address-table

---- ----------------- --------------- --------- -------------------------

Port MAC-Address RADIUS-Server Attribute Time

---- ----------------- --------------- --------- -------------------------

4-100

1/1 00-00-01-02-03-04 172.155.120.17 Static

1/1 00-00-01-02-03-05 172.155.120.17 Dynamic

1/1 00-00-01-02-03-06 172.155.120.17 Static

1/3 00-00-01-02-03-07 172.155.120.17 Dynamic

00d06h32m50s

00d06h33m20s

00d06h35m10s

00d06h34m20s

Console#

Configuring MAC Address Filters

MAC address filters are used to specify MAC addresses to be excluded from

network access authentication. MAC addresses in a filter are not authenticated by a

RADIUS server when seen on a port, the addresses are immediately added to the

secure MAC address table.

MAC address filters must first be created and assigned a filter ID, then the filter can

be applied to a port interface. Multiple MAC addresses can be included in a filter, but

only one filter can be applied to a port.

Command Attributes

• Query – Display all current MAC address filters or a specific filter configuration.

• Add/Remove – Specify a filter ID and MAC address to create a filter. Specify the

same filter ID with other MAC addresses to add them to the filter. Select an entry

in the displayed list and click Remove to delete a MAC address from a filter.

• Filter ID – Specifies a filter to configure. (Range: 1 -64)

• MAC Address – Specifies a single MAC address to add to a filter.

Web – Click Security, Network Access, MAC Filter Configuration.

Figure 3-46 Network Access MAC Filter Configuration

3-79

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This example configures filter ID 1 with three MAC addresses, then applies

the filter to port 1.

Console(config)#network-access mac-filter 1 00-12-34-56-78-9A

Console(config)#network-access mac-filter 1 00-12-34-56-78-9B

Console(config)#network-access mac-filter 1 00-12-34-56-78-9C

Console(config)#interface ethernet 1/1

Console(config-if)#network-access port-mac-filter 1

Console(config-if)#end

4-96

4-97

Console#show network-access mac-filter 1

--------- -----------------

4-100

Filter-id MAC-Address

--------- -----------------

00-12-34-56-78-9A

00-12-34-56-78-9B

00-12-34-56-78-9C

Console#

Filtering Addresses for Management Access

You create a list of up to 16 IP addresses or IP address groups that are allowed

access to the switch through the web interface, SNMP, or Telnet.

Command Usage

• The management interfaces are open to all IP addresses by default. Once you add

an entry to a filter list, access to that interface is restricted to the specified

addresses.

• If anyone tries to access a management interface on the switch from an invalid

address, the switch will reject the connection, enter an event message in the

system log, and send a trap message to the trap manager.

• IP address can be configured for SNMP, web and Telnet access respectively. Each

of these groups can include up to five different sets of addresses, either individual

addresses or address ranges.

• When entering addresses for the same group (i.e., SNMP, web or Telnet), the

switch will not accept overlapping address ranges. When entering addresses for

different groups, the switch will accept overlapping address ranges.

• You cannot delete an individual address from a specified range. You must delete

the entire range, and reenter the addresses.

• You can delete an address range just by specifying the start address, or by

specifying both the start address and end address.

Command Attributes

• Web IP Filter – Configures IP address(es) for the web group.

• SNMP IP Filter – Configures IP address(es) for the SNMP group.

• Telnet IP Filter – Configures IP address(es) for the Telnet group.

• IP Filter List – IP address which are allowed management access to this interface.

• Start IP Address – A single IP address, or the starting address of a range.

• End IP Address – The end address of a range.

• Add/Remove Filtering Entry – Adds/removes an IP address from the list.

3-80

Download from Www.Somanuals.com. All Manuals Search And Download.

User Authentication

Web – Click Security, IP Filter. Enter the IP addresses or range of addresses that

are allowed management access to an interface, and click Add IP Filtering Entry to

update the filter list.

Figure 3-47 Creating a Web IP Filter List

CLI – This example allows SNMP access for a specific client.

Console(config)#management snmp-client 10.1.2.3

Console(config)#end

4-29

Console#show management all-client

Management IP Filter

HTTP-Client:

Start IP address End IP address

-----------------------------------------------

1. 10.1.2.1

10.1.2.254

SNMP-Client:

Start IP address End IP address

-----------------------------------------------

1. 10.1.2.3

10.1.2.3

TELNET-Client:

Start IP address End IP address

-----------------------------------------------

Console#

3-81

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Access Control Lists

Access Control Lists (ACL) provide packet filtering for IP frames (based on address,

protocol, Layer 4 protocol port number or TCP control code) or any frames (based

on MAC address or Ethernet type). To filter incoming packets, first create an access

list, add the required rules and then bind the list to a specific port.

Configuring Access Control Lists

An ACL is a sequential list of permit or deny conditions that apply to IP addresses,

MAC addresses, or other more specific criteria. This switch tests ingress or egress

packets against the conditions in an ACL one by one. A packet will be accepted as

soon as it matches a permit rule, or dropped as soon as it matches a deny rule. If no

rules match for a list of all permit rules, the packet is dropped; and if no rules match

for a list of all deny rules, the packet is accepted.

Command Usage

The following restrictions apply to ACLs:

• Each ACL can have up to 32 rules.

• The maximum number of ACLs is 88.

• However, due to resource restrictions, the average number of rules bound to the

ports should not exceed 20.

• This switch supports ACLs for ingress filtering only. However, you can only bind

one IP ACL to any port and one MAC ACL globally for ingress filtering. In other

words, only two ACLs can be bound to an interface - Ingress IP ACL and Ingress

MAC ACL.

3-82

Download from Www.Somanuals.com. All Manuals Search And Download.

Access Control Lists

The order in which active ACLs are checked is as follows:

1. User-defined rules in the Ingress MAC ACL for ingress ports.

2. User-defined rules in the Ingress IP ACL for ingress ports.

3. Explicit default rule (permit any any) in the ingress IP ACL for ingress ports.

4. Explicit default rule (permit any any) in the ingress MAC ACL for ingress ports.

5. If no explicit rule is matched, the implicit default is permit all.

Setting the ACL Name and Type

Use the ACL Configuration page to designate the name and type of an ACL.

Command Attributes

• Name – Name of the ACL. (Maximum length: 16 characters)

• Type – There are three filtering modes:

- Standard: IP ACL mode that filters packets based on the source IP address.

- Extended: IP ACL mode that filters packets based on source or destination IP

address, as well as protocol type and protocol port number. If the “TCP” protocol

is specified, then you can also filter packets based on the TCP control code.

- MAC: MAC ACL mode that filters packets based on the source or destination

MAC address and the Ethernet frame type (RFC 1060).

Web – Click Security, ACL, Configuration. Enter an ACL name in the Name field,

select the list type (IP Standard, IP Extended, or MAC), and click Add to open the

configuration page for the new list.

Figure 3-48 Selecting ACL Type

CLI – This example creates a standard IP ACL named david.

Console(config)#access-list ip standard david

Console(config-std-acl)#

4-103

3-83

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Configuring a Standard IP ACL

Command Attributes

• Action – An ACL can contain any combination of permit or deny rules.

• Address Type – Specifies the source IP address. Use “Any” to include all possible

addresses, “Host” to specify a specific host address in the Address field, or “IP” to

specify a range of addresses with the Address and SubMask fields.

(Options: Any, Host, IP; Default: Any)

• IP Address – Source IP address.

• Subnet Mask – A subnet mask containing four integers from 0 to 255, each

separated by a period. The mask uses 1 bits to indicate “match” and 0 bits to

indicate “ignore.” The mask is bitwise ANDed with the specified source IP address,

and compared with the address for each IP packet entering the port(s) to which this

ACL has been assigned.

Web – Specify the action (i.e., Permit or Deny). Select the address type (Any, Host,

or IP). If you select “Host,” enter a specific address. If you select “IP,” enter a subnet

address and the mask for an address range. Then click Add.

Figure 3-49 ACL Configuration - Standard IP

CLI – This example configures one permit rule for the specific address 10.1.1.21

and another rule for the address range 168.92.16.x – 168.92.31.x using a bitmask.

Console(config-std-acl)#permit host 10.1.1.21

Console(config-std-acl)#permit 168.92.16.0 255.255.240.0

Console(config-std-acl)#

4-104

3-84

Download from Www.Somanuals.com. All Manuals Search And Download.

Access Control Lists

Configuring an Extended IP ACL

Command Attributes

• Action – An ACL can contain any combination of permit or deny rules.

• Source/Destination Address Type – Specifies the source or destination IP

address. Use “Any” to include all possible addresses, “Host” to specify a specific

host address in the Address field, or “IP” to specify a range of addresses with the

Address and SubMask fields. (Options: Any, Host, IP; Default: Any)

• Source/Destination Address – Source or destination IP address.

• Source/Destination Subnet Mask – Subnet mask for source or destination

address. (See the description for Subnet Mask on page 3-84.)

• Service Type – Packet priority settings based on the following criteria:

- Precedence – IP precedence level. (Range: 0-7)

- TOS – Type of Service level. (Range: 0-15)

- DSCP – DSCP priority level. (Range: 0-63)

• Protocol – Specifies the protocol type to match as TCP, UDP or Others, where

others indicates a specific protocol number (0-255). (Options: TCP, UDP, Others;

Default: TCP)

• Source/Destination Port – Source/destination port number for the specified

protocol type. (Range: 0-65535)

• Control Code – Decimal number (representing a bit string) that specifies flag bits

in byte 14 of the TCP header. (Range: 0-63)

• Control Code Bitmask – Decimal number representing the code bits to match.

The control bitmask is a decimal number (for an equivalent binary bit mask) that is

applied to the control code. Enter a decimal number, where the equivalent binary

bit “1” means to match a bit and “0” means to ignore a bit. The following bits may

be specified:

- 1 (fin) – Finish

- 2 (syn) – Synchronize

- 4 (rst) – Reset

- 8 (psh) – Push

- 16 (ack) – Acknowledgement

- 32 (urg) – Urgent pointer

For example, use the code value and mask below to catch packets with the

following flags set:

- SYN flag valid, use control-code 2, control bitmask 2

- Both SYN and ACK valid, use control-code 18, control bitmask 18

- SYN valid and ACK invalid, use control-code 2, control bitmask 18

3-85

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Specify the action (i.e., Permit or Deny). Specify the source and/or

destination addresses. Select the address type (Any, Host, or IP). If you select

“Host,” enter a specific address. If you select “IP,” enter a subnet address and the

mask for an address range. Set any other required criteria, such as service type,

protocol type, or TCP control code. Then click Add.

Figure 3-50 ACL Configuration - Extended IP

CLI – This example adds two rules:

(1) Accept any incoming packets if the source address is in subnet 10.7.1.x. For

example, if the rule is matched; i.e., the rule (10.7.1.0 & 255.255.255.0) equals

the masked address (10.7.1.2 & 255.255.255.0), the packet passes through.

(2) Allow TCP packets from class C addresses 192.168.1.0 to any destination

address when set for destination TCP port 80 (i.e., HTTP).

(3) Permit all TCP packets from class C addresses 192.168.1.0 with the TCP control

code set to “SYN.”

Console(config-ext-acl)#permit 10.7.1.1 255.255.255.0 any

Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any

destination-port 80

4-105

Console(config-ext-acl)#permit tcp 192.168.1.0 255.255.255.0 any

control-flag 2 2

Console(config-std-acl)#

3-86

Download from Www.Somanuals.com. All Manuals Search And Download.

Access Control Lists

Configuring a MAC ACL

Command Attributes

• Action – An ACL can contain any combination of permit or deny rules.

• Source/Destination Address Type – Use “Any” to include all possible addresses,

“Host” to indicate a specific MAC address, or “MAC” to specify an address range

with the Address and Bitmask fields. (Options: Any, Host, MAC; Default: Any)

• Source/Destination MAC Address – Source or destination MAC address.

• Source/Destination Bitmask – Hexidecimal mask for source or destination MAC

address.

• VID – VLAN ID. (Range: 1-4094)

• Ethernet Type – This option can only be used to filter Ethernet II formatted

packets. (Range: 0-65535)

A detailed listing of Ethernet protocol types can be found in RFC 1060. A few of the

more common types include 0800 (IP), 0806 (ARP), 8137 (IPX).

Web – Specify the action (i.e., Permit or Deny). Specify the source and/or

destination addresses. Select the address type (Any, Host, or MAC). If you select

“Host,” enter a specific address (e.g., 11-22-33-44-55-66). If you select “MAC,” enter

a base address and a hexidecimal bitmask for an address range. Set any other

required criteria, such as VID or Ethernet type. Then click Add.

Figure 3-51 ACL Configuration - MAC

CLI – This rule permits packets from any source MAC address to the destination

address 00-e0-29-94-34-de where the Ethernet type is 0800.

Console(config-mac-acl)#permit any host 00-e0-29-94-34-de

ethertype 0800

4-111

Console(config-mac-acl)#

3-87

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Binding a Port to an Access Control List

After configuring Access Control Lists (ACL), you should bind them to the ports that

need to filter traffic. You can assign one IP access list to any port, but you can only

assign one MAC access list to all the ports on the switch.

Command Usage

• You must configure a mask for an ACL rule before you can bind it to a port.

• This switch only supports ACLs for ingress filtering. You can only bind one IP ACL

to any port, and one MAC ACL globally, for ingress filtering.

Command Attributes

• Port – Fixed port or SFP module. (Range: 1-26/52)

• IP – Specifies the IP Access List to enable for a port.

• MAC – Specifies the MAC Access List to enable globally.

• IN – ACL for ingress packets.

• ACL Name – Name of the ACL.

Web – Click Security, ACL, Port Binding. Mark the Enabled field for the port you

want to bind to an ACL, select the required ACL from the drop-down list, then click

Apply.

Figure 3-52 Binding a Port to an ACL

3-88

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

CLI – This example assigns an IP and MAC access list to port 1, and an IP access

list to port 3.

Console(config)#interface ethernet 1/1

Console(config-if)#ip access-group david in

Console(config-if)#mac access-group jerry in

Console(config-if)#exit

4-107

4-112

Console(config)#interface ethernet 1/3

Console(config-if)#ip access-group david in

Console(config-if)#

Port Configuration

Displaying Connection Status

You can use the Port Information or Trunk Information pages to display the current

connection status, including link state, speed/duplex mode, flow control, and

auto-negotiation.

Field Attributes (Web)

• Name – Interface label.

• Type – Indicates the port type. (100BASE-TX, 1000BASE-T, or SFP)

• Admin Status – Shows if the interface is enabled or disabled.

• Oper Status – Indicates if the link is Up or Down.

• Speed Duplex Status – Shows the current speed and duplex mode.

(Auto, or fixed choice)

• Flow Control Status – Indicates the type of flow control currently in use.

(IEEE 802.3x, Back-Pressure or None)

• Autonegotiation – Shows if auto-negotiation is enabled or disabled.

• Trunk Member – Shows if port is a trunk member.

• Creation – Shows if a trunk is manually configured or dynamically set via LACP.

6. Port Information only.

7. Trunk information only.

3-89

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Port, Port Information or Trunk Information.

Figure 3-53 Displaying Port/Trunk Information

Field Attributes (CLI)

Basic Information:

• Port type – Indicates the port type. (100BASE-TX, 1000BASE-T, or SFP)

• MAC address – The physical layer address for this port. (To access this item on

the web, see “Setting the Switch’s IP Address” on page 3-14.)

Configuration:

• Name – Interface label.

• Port admin – Shows if the interface is enabled or disabled (i.e., up or down).

•

Speed-duplex – Shows the current speed and duplex mode. (Auto, or fixed choice)

• Capabilities – Specifies the capabilities to be advertised for a port during

auto-negotiation. (To access this item on the web, see “Configuring Interface

Connections” on page 3-48.) The following capabilities are supported.

- 10half - Supports 10 Mbps half-duplex operation

- 10full - Supports 10 Mbps full-duplex operation

- 100half - Supports 100 Mbps half-duplex operation

- 100full - Supports 100 Mbps full-duplex operation

- 1000full - Supports 1000 Mbps full-duplex operation

- Sym - Transmits and receives pause frames for flow control

- FC - Supports flow control

• Broadcast storm – Shows if broadcast storm control is enabled or disabled.

• Broadcast storm limit – Shows the broadcast storm threshold.

(64-95232000 octets per second)

• Flow control – Shows if flow control is enabled or disabled.

• LACP – Shows if LACP is enabled or disabled.

• Port Security – Shows if port security is enabled or disabled.

3-90

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

• Max MAC count – Shows the maximum number of MAC address that can be

learned by a port. (0 - 1024 addresses)

• Port security action – Shows the response to take when a security violation is

detected. (shutdown, trap, trap-and-shutdown, or none)

Current Status:

• Link Status – Indicates if the link is up or down.

• Port Operation Status – Provides detailed information on port state.

(Displayed only when the link is up.)

• Operation speed-duplex – Shows the current speed and duplex mode.

• Flow control type – Indicates the type of flow control currently in use.

(IEEE 802.3x, Back-Pressure or none)

CLI – This example shows the connection status for Port 5.

Console#show interfaces status ethernet 1/5

Information of Eth 1/5

4-138

Basic information:

Port type:

Mac address:

Configuration:

Name:

100TX

00-30-f1-47-58-46

Port admin:

Speed-duplex:

Capabilities:

Broadcast storm:

Auto

10half, 10full, 100half, 100full

Enabled

Broadcast storm limit: 32000 octets/second

Flow control:

Lacp:

Disabled

Port security:

Max MAC count:

Port security action:

Current status:

Link status:

None

Down

Operation speed-duplex: 100full

Flow control type: None

Console#

Configuring Interface Connections

You can use the Port Configuration or Trunk Configuration page to enable/disable an

interface, set auto-negotiation and the interface capabilities to advertise, or manually

fix the speed, duplex mode, and flow control.

Command Attributes

• Name – Allows you to label an interface. (Range: 1-64 characters)

• Admin – Allows you to manually disable an interface. You can disable an interface

due to abnormal behavior (e.g., excessive collisions), and then reenable it after the

problem has been resolved. You may also disable an interface for security

reasons.

• Speed/Duplex – Allows you to manually set the port speed and duplex mode.

(i.e., with auto-negotiation disabled)

3-91

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• Flow Control – Allows automatic or manual selection of flow control.

• Autonegotiation (Port Capabilities) – Allows auto-negotiation to be enabled/

disabled. When auto-negotiation is enabled, you need to specify the capabilities to

be advertised. When auto-negotiation is disabled, you can force the settings for

speed, mode, and flow control.The following capabilities are supported.

- 10half - Supports 10 Mbps half-duplex operation

- 10full - Supports 10 Mbps full-duplex operation

- 100half - Supports 100 Mbps half-duplex operation

- 100full - Supports 100 Mbps full-duplex operation

- 1000full - Supports 1000 Mbps full-duplex operation

- Sym (Gigabit only) - Check this item to transmit and receive pause frames, or

clear it to auto-negotiate the sender and receiver for asymmetric pause frames.

(The current switch chip only supports symmetric pause frames.)

- FC - Supports flow control

Flow control can eliminate frame loss by “blocking” traffic from end stations or

segments connected directly to the switch when its buffers fill. When enabled,

back pressure is used for half-duplex operation and IEEE 802.3x for full-duplex

operation. (Avoid using flow control on a port connected to a hub unless it is

actually required to solve a problem. Otherwise back pressure jamming signals

may degrade overall performance for the segment attached to the hub.)

(Default: Autonegotiation enabled; Advertised capabilities for 100BASE-TX –

10half, 10full, 100half, 100full; 1000BASE-T – 10half, 10full, 100half, 100full,

1000full; 1000BASE-SX/LX/LH – 1000full)

• Trunk – Indicates if a port is a member of a trunk. To create trunks and select port

members, see “Creating Trunk Groups” on page 3-93.

Note: Auto-negotiation must be disabled before you can configure or force the interface

to use the Speed/Duplex Mode or Flow Control options.

Web – Click Port, Port Configuration or Trunk Configuration. Modify the required

interface settings, and click Apply.

Figure 3-54 Port/Trunk Configuration

3-92

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

CLI – Select the interface, and then enter the required settings.

Console(config)#interface ethernet 1/13

Console(config-if)#description RD SW#13

4-132

Console(config-if)#shutdown

4-136

Console(config-if)#no shutdown

Console(config-if)#no negotiation

4-133

Console(config-if)#speed-duplex 100half

4-132

Console(config-if)#flowcontrol

4-135

Console(config-if)#negotiation

Console(config-if)#capabilities 100half

4-134

Console(config-if)#capabilities 100full

Console(config-if)#capabilities flowcontrol

Creating Trunk Groups

You can create multiple links between devices that work as one virtual, aggregate

link. A port trunk offers a dramatic increase in bandwidth for network segments

where bottlenecks exist, as well as providing a fault-tolerant link between two

devices. You can create up to four trunks at a time.

The switch supports both static trunking and dynamic Link Aggregation Control

Protocol (LACP). Static trunks have to be manually configured at both ends of the

link, and the switches must comply with the Cisco EtherChannel standard. On the

other hand, LACP configured ports can automatically negotiate a trunked link with

LACP-configured ports on another device. You can configure any number of ports

on the switch as LACP, as long as they are not already configured as part of a static

trunk. If ports on another device are also configured as LACP, the switch and the

other device will negotiate a trunk link between them. If an LACP trunk consists of

more than eight ports, all other ports will be placed in a standby mode. Should one

link in the trunk fail, one of the standby ports will automatically be activated to

replace it.

Command Usage

Besides balancing the load across each port in the trunk, the other ports provide

redundancy by taking over the load if a port in the trunk fails. However, before

making any physical connections between devices, use the web interface or CLI to

specify the trunk on the devices at both ends. When using a port trunk, take note of

the following points:

• Finish configuring port trunks before you connect the corresponding network

cables between switches to avoid creating a loop.

• You can create up to four trunks on the switch, with up to eight ports per trunk.

• The ports at both ends of a connection must be configured as trunk ports.

3-93

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• When configuring static trunks on switches of different types, they must be

compatible with the Cisco EtherChannel standard.

• The ports at both ends of a trunk must be configured in an identical manner,

including communication mode (i.e., speed, duplex mode and flow control), VLAN

assignments, and CoS settings.

• All the ports in a trunk have to be treated as a whole when moved from/to, added

or deleted from a VLAN.

• STP, VLAN, and IGMP settings can only be made for the entire trunk.

Statically Configuring a Trunk

Command Usage

• When configuring static trunks, you may not be

able to link switches of different types,

depending on the manufacturer’s

statically

configured

implementation. However, note that the static

trunks on this switch are Cisco EtherChannel

compatible.

active

links

• To avoid creating a loop in the network, be sure

you add a static trunk via the configuration

interface before connecting the ports, and also

disconnect the ports before removing a static

trunk via the configuration interface.

Command Attributes

• Member List (Current) – Shows configured trunks (Trunk ID, Unit, Port).

• New – Includes entry fields for creating new trunks.

- Trunk – Trunk identifier. (Range: 1-4)

- Port – Port identifier. (Range: 1-26/52)

Web – Click Port, Trunk Membership. Enter a trunk ID of 1-4 in the Trunk field,

select any of the switch ports from the scroll-down port list, and click Add. After you

have completed adding ports to the member list, click Apply.

Figure 3-55 Configuring Port Trunks

3-94

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

CLI – This example creates trunk 2 with ports 1 and 2. Just connect these ports to

two static trunk ports on another switch to form a trunk.

Console(config)#interface port-channel 2

Console(config-if)#exit

Console(config)#interface ethernet 1/1

Console(config-if)#channel-group 2

Console(config-if)#exit

4-147

Console(config)#interface ethernet 1/2

Console(config-if)#channel-group 2

Console(config-if)#end

Console#show interfaces status port-channel 2

Information of Trunk 2

4-138

Basic information:

Port type:

100TX

Mac address:

Configuration:

Name:

00-00-E8-AA-AA-01

Port admin:

Speed-duplex:

Capabilities:

Flow control:

Port security:

Max MAC count:

Current status:

Created by:

Auto

10half, 10full, 100half, 100full

Disabled

User

Link status:

Port operation status: Up

Operation speed-duplex: 100full

Flow control type:

Member Ports: Eth1/1, Eth1/2,

Console#

None

Enabling LACP on Selected Ports

Command Usage

• To avoid creating a loop in the network, be sure

you enable LACP before connecting the ports,

and also disconnect the ports before disabling

LACP.

dynamically

enabled

active

links

backup

link

• If the target switch has also enabled LACP on the

connected ports, the trunk will be activated

automatically.

• A trunk formed with another switch using LACP

will automatically be assigned the next available

trunk ID.

configured

members

• If more than eight ports attached to the same

target switch have LACP enabled, the additional ports will be placed in standby

mode, and will only be enabled if one of the active links fails.

• All ports on both ends of an LACP trunk must be configured for full duplex, either

by forced mode or auto-negotiation.

• Trunks dynamically established through LACP will also be shown in the Member

List on the Trunk Membership menu (see page 3-94).

3-95

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Command Attributes

• Member List (Current) – Shows configured trunks (Unit, Port).

• New – Includes entry fields for creating new trunks.

- Port – Port identifier. (Range: 1-26/52)

Web – Click Port, LACP, Configuration. Select any of the switch ports from the

scroll-down port list and click Add. After you have completed adding ports to the

member list, click Apply.

Figure 3-56 LACP Configuration

CLI – The following example enables LACP for ports 3 to 6. Just connect these ports

to LACP-enabled trunk ports on another switch to form a trunk.

Console(config)#interface ethernet 1/3

Console(config-if)#lacp

4-148

Console(config-if)#exit

Console(config)#interface ethernet 1/6

Console(config-if)#lacp

Console(config-if)#end

Console#show interfaces status port-channel 1

Information of Trunk 1

4-138

Basic information:

Port type:

100TX

Mac address:

Configuration:

Name:

22-22-22-22-22-2d

Port admin:

Speed-duplex:

Capabilities:

Flow control status:

Port security:

Max MAC count:

Current status:

Created by:

Auto

10half, 10full, 100half, 100full

Disabled

Lacp

Link status:

Port operation status: Up

Operation speed-duplex: 100full

Flow control type:

Member Ports: Eth1/3, Eth1/4, Eth1/5, Eth1/6,

Console#

None

3-96

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

Configuring LACP Parameters

Dynamically Creating a Port Channel –

Ports assigned to a common port channel must meet the following criteria:

• Ports must have the same LACP System Priority.

• Ports must have the same LACP port Admin Key.

• However, if the “port channel” Admin Key is set (page 4-142), then the port Admin

Key must be set to the same value for a port to be allowed to join a channel group.

Note – If the port channel admin key (lacp admin key, page 4-151) is not set (through

the CLI) when a channel group is formed (i.e., it has a null value of 0), this key is set to

the same value as the port admin key used by the interfaces that joined the group (lacp

admin key, as described in this section and on page 4-150).

Command Attributes

Set Port Actor – This menu sets the local side of an aggregate link; i.e., the ports on

this switch.

• Port – Port number. (Range: 1-26/52)

• System Priority – LACP system priority is used to determine link aggregation

group (LAG) membership, and to identify this device to other switches during LAG

negotiations. (Range: 0-65535; Default: 32768)

- Ports must be configured with the same system priority to join the same LAG.

- System priority is combined with the switch’s MAC address to form the LAG

identifier. This identifier is used to indicate a specific LAG during LACP

negotiations with other systems.

• Admin Key – The LACP administration key must be set to the same value for ports

that belong to the same LAG. (Range: 0-65535; Default: 1)

• Port Priority – If a link goes down, LACP port priority is used to select a backup

link. (Range: 0-65535; Default: 32768)

Set Port Partner – This menu sets the remote side of an aggregate link; i.e., the

ports on the attached device. The command attributes have the same meaning as

those used for the port actor. However, configuring LACP settings for the partner

only applies to its administrative state, not its operational state, and will only take

effect the next time an aggregate link is established with the partner.

3-97

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Port, LACP, Aggregation Port. Set the System Priority, Admin Key, and

Port Priority for the Port Actor. You can optionally configure these settings for the

Port Partner. (Be aware that these settings only affect the administrative state of the

partner, and will not take effect until the next time an aggregate link is formed with

this device.) After you have completed setting the port LACP parameters, click Apply.

Figure 3-57 LACP - Aggregation Port

3-98

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

CLI – The following example configures LACP parameters for ports 1-4. Ports 1-4

are used as active members of the LAG.

Console(config)#interface ethernet 1/1

Console(config-if)#lacp actor system-priority 3

Console(config-if)#lacp actor admin-key 120

Console(config-if)#lacp actor port-priority 128

Console(config-if)#exit

Console(config)#interface ethernet 1/4

Console(config-if)#lacp actor system-priority 3

Console(config-if)#lacp actor admin-key 120

Console(config-if)#lacp actor port-priority 512

Console(config-if)#end

Console#show lacp sysid

Port Channel

System Priority

System MAC Address

-------------------------------------------------------------------------

32768

00-00-E9-31-31-31

Console#show lacp 1 internal

Port channel : 1

-------------------------------------------------------------------------

Oper Key : 120

Admin Key : 0

Eth 1/1

-------------------------------------------------------------------------

LACPDUs Internal:

30 sec

LACP System Priority: 3

LACP Port Priority:

Admin Key:

Oper Key:

128

120

Admin State : defaulted, aggregation, long timeout, LACP-activity

Oper State:

distributing, collecting, synchronization,

aggregation, long timeout, LACP-activity

Displaying LACP Port Counters

You can display statistics for LACP protocol messages.

Table 3-8 LACP Port Counters

Field

Description

LACPDUs Sent

LACPDUs Received

Marker Sent

Number of valid LACPDUs transmitted from this channel group.

Number of valid LACPDUs received on this channel group.

Number of valid Marker PDUs transmitted from this channel group.

Number of valid Marker PDUs received by this channel group.

Marker Received

3-99

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Table 3-8 LACP Port Counters (Continued)

Field

Description

LACPDUs Unknown Pkts

Number of frames received that either (1) Carry the Slow Protocols

Ethernet Type value, but contain an unknown PDU, or (2) are addressed

to the Slow Protocols group MAC Address, but do not carry the Slow

Protocols Ethernet Type.

LACPDUs Illegal Pkts

Number of frames that carry the Slow Protocols Ethernet Type value, but

contain a badly formed PDU or an illegal value of Protocol Subtype.

Web – Click Port, LACP, Port Counters Information. Select a member port to display

the corresponding information.

Figure 3-58 LACP - Port Counters Information

CLI – The following example displays LACP counters for port channel 1.

Console#show lacp counters

Port channel : 1

-------------------------------------------------------------------------

Eth 1/ 1

-------------------------------------------------------------------------

LACPDUs Sent:

LACPDUs Receive:

Marker Sent:

Marker Receive:

LACPDUs Unknown Pkts: 0

LACPDUs Illegal Pkts: 0

3-100

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

Displaying LACP Settings and Status for the Local Side

You can display configuration settings and the operational state for the local side of

an link aggregation.

Table 3-9 LACP Internal Configuration Information

Field

Description

Oper Key

Current operational value of the key for the aggregation port.

Current administrative value of the key for the aggregation port.

Number of seconds before invalidating received LACPDU information.

Admin Key

LACPDUs Internal

LACP System Priority LACP system priority assigned to this port channel.

LACP Port Priority

LACP port priority assigned to this interface within the channel group.

Admin State,

Oper State

Administrative or operational values of the actor’s state parameters:

• Expired – The actor’s receive machine is in the expired state;

• Defaulted – The actor’s receive machine is using defaulted operational partner

information, administratively configured for the partner.

• Distributing – If false, distribution of outgoing frames on this link is disabled; i.e.,

distribution is currently disabled and is not expected to be enabled in the absence

of administrative changes or changes in received protocol information.

• Collecting – Collection of incoming frames on this link is enabled; i.e., collection

is currently enabled and is not expected to be disabled in the absence of

administrative changes or changes in received protocol information.

• Synchronization – The System considers this link to be IN_SYNC; i.e., it has

been allocated to the correct Link Aggregation Group, the group has been

associated with a compatible Aggregator, and the identity of the Link Aggregation

Group is consistent with the System ID and operational Key information

transmitted.

• Aggregation – The system considers this link to be aggregatable; i.e., a potential

candidate for aggregation.

• Long timeout – Periodic transmission of LACPDUs uses a slow transmission rate.

• LACP-Activity – Activity control value with regard to this link.

(0: Passive; 1: Active)

3-101

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Port, LACP, Port Internal Information. Select a port channel to display

the corresponding information.

Figure 3-59 LACP - Port Internal Information

CLI – The following example displays the LACP configuration settings and

operational state for the local side of port channel 1.

Console#show lacp 1 internal

Port channel : 1

-------------------------------------------------------------------------

Oper Key : 120

Admin Key : 0

Eth 1/1

-------------------------------------------------------------------------

LACPDUs Internal:

30 sec

LACP System Priority: 3

LACP Port Priority:

Admin Key:

Oper Key:

128

120

Admin State : defaulted, aggregation, long timeout, LACP-activity

Oper State:

distributing, collecting, synchronization,

aggregation, long timeout, LACP-activity

3-102

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

Displaying LACP Settings and Status for the Remote Side

You can display configuration settings and the operational state for the remote side

of an link aggregation.

Table 3-10 LACP Neighbor Configuration Information

Field

Description

Partner Admin System ID

Partner Oper System ID

LAG partner’s system ID assigned by the user.

LAG partner’s system ID assigned by the LACP protocol.

Partner Admin Port Number Current administrative value of the port number for the protocol Partner.

Partner Oper Port Number

Operational port number assigned to this aggregation port by the port’s

protocol partner.

Port Admin Priority

Port Oper Priority

Admin Key

Current administrative value of the port priority for the protocol partner.

Priority value assigned to this aggregation port by the partner.

Current administrative value of the Key for the protocol partner.

Current operational value of the Key for the protocol partner.

Oper Key

Admin State

Oper State

Administrative values of the partner’s state parameters. (See preceding table.)

Operational values of the partner’s state parameters. (See preceding table.)

Web – Click Port, LACP, Port Neighbors Information. Select a port channel to

display the corresponding information.

Figure 3-60 LACP - Port Neighbors Information

3-103

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – The following example displays the LACP configuration settings and

operational state for the remote side of port channel 1.

Console#show lacp 1 neighbors

Port channel 1 neighbors

-------------------------------------------------------------------------

Eth 1/1

-------------------------------------------------------------------------

Partner Admin System ID:

Partner Oper System ID:

Partner Admin Port Number: 5

Partner Oper Port Number: 3

Port Admin Priority:

32768, 00-00-00-00-00-00

3, 00-30-F1-CE-2A-20

32768

128

Port Oper Priority:

Admin Key:

Oper Key:

120

Admin State:

defaulted, distributing, collecting,

synchronization, long timeout,

distributing, collecting, synchronization,

aggregation, long timeout, LACP-activity

Oper State:

3-104

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

Setting Broadcast Storm Thresholds

Broadcast storms may occur when a device on your network is malfunctioning, or if

application programs are not well designed or properly configured. If there is too

much broadcast traffic on your network, performance can be severely degraded or

everything can come to complete halt.

You can protect your network from broadcast storms by setting a threshold for

broadcast traffic. Any broadcast packets exceeding the specified threshold will then

be dropped.

Command Usage

• Broadcast Storm Control is enabled by default.

• Broadcast control does not effect IP multicast traffic.

• The specified threshold applies to all ports on the switch.

Command Attributes

• Threshold – Threshold as percentage of port bandwidth.

(Range: 64-95232000; Default: 32000 octets per second)

• Protect Status – Shows whether or not broadcast storm control has been enabled.

(Default: Enabled)

Web – Click Port, Port/Trunk Broadcast Control. Set the threshold, mark the

Enabled field for the desired interface and click Apply.

Figure 3-61 Port Broadcast Control

3-105

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – Specify any interface, and then enter the threshold. The following disables

broadcast storm control for port 1, and then sets broadcast suppression at 600

octets per second for port 2 (which applies to all ports).

Console(config)#interface ethernet 1/1

Console(config-if)#no switchport broadcast

Console(config-if)#exit

4-137

Console(config)#interface ethernet 1/2

Console(config-if)#switchport broadcast octet-rate 600

Console(config-if)#end

Console#show interfaces switchport ethernet 1/2

Information of Eth 1/2

4-137

4-140

Broadcast threshold:

Lacp status:

Enabled, 600 octets/second

Enabled

Ingress rate limit: disable, Level: 30

Egress rate limit: disable, Level: 30

VLAN membership mode:

Ingress rule:

Acceptable frame type:

Native VLAN:

Hybrid

Disabled

All frames

Priority for untagged traffic: 0

Gvrp status:

Disabled

Allowed Vlan:

1(u),

Forbidden Vlan:

Private-VLAN mode:

NONE

Private-VLAN host-association: NONE

Private-VLAN mapping:

Console#

NONE

Configuring Port Mirroring

You can mirror traffic from any source port to a

target port for real-time analysis. You can then

attach a logic analyzer or RMON probe to the

target port and study the traffic crossing the

source port in a completely unobtrusive manner.

Source

port(s)

Single

target

port

Command Usage

• Monitor port speed should match or exceed source port speed, otherwise traffic

may be dropped from the monitor port.

• All mirror sessions have to share the same destination port.

• When mirroring port traffic, the target port must be included in the same VLAN as

the source port.

Command Attributes

• Mirror Sessions – Displays a list of current mirror sessions.

• Source Port – The port whose traffic will be monitored.

• Type – Allows you to select which traffic to mirror to the target port, Rx (receive),

or Tx (transmit).

• Target Port – The port that will mirror the traffic on the source port.

3-106

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

Web – Click Port, Mirror Port Configuration. Specify the source port, the traffic type

to be mirrored, and the monitor port, then click Add.

Figure 3-62 Mirror Port Configuration

CLI – Use the interface command to select the monitor port, then use the port

monitor command to specify the source port and traffic type.

Console(config)#interface ethernet 1/10

Console(config-if)#port monitor ethernet 1/13 tx

Console(config-if)#

4-142

Configuring Rate Limits

This function allows the network manager to control the maximum rate for traffic

transmitted or received on a port. Rate limiting is configured on ports at the edge of

a network to limit traffic coming into or out of the network. Traffic that falls within the

rate limit is transmitted, while packets that exceed the acceptable amount of traffic

are dropped.

Rate limiting can be applied to individual ports or trunks. When an interface is

configured with this feature, the traffic rate will be monitored by the hardware to

verify conformity. Non-conforming traffic is dropped, conforming traffic is forwarded

without any changes.

Rate Limit Granularity

Rate limit granularity is an additional feature enabling the network manager greater

control over traffic on the network. The “rate limit granularity” is multiplied by the

“rate limit level” (page 3-108) to set the actual rate limit for an interface. Granularity

is a global setting that applies to Fast Ethernet or Gigabit Ethernet interfaces.

Command Usage

• For Fast Ethernet interfaces, the rate limit granularity can be set to 512 Kbps,

1 Mbps, or 3.3 Mbps

• For Gigabit Ethernet interfaces, the rate limit granularity is 33.3 Mbps.

3-107

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Port, Rate Limit, Granularity. Select the required rate limit granularity for

Fast Ethernet and Gigabit Ethernet, and click apply.

Figure 3-63 Rate Limit Granularity Configuration

CLI - This example sets and displays Fast Ethernet and Gigabit Ethernet granularity.

Console(config)#rate-limit fastethernet granularity 512

Console(config)#rate-limit gigabitethernet granularity 33300

console#show rate-limit

4-145

Fast ethernet granularity: 512

Gigabit ethernet granularity: 33300

Console#

Rate Limit Configuration

Use the rate limit configuration pages to apply rate limiting.

Command Usage

•

Input and output rate limit can be enabled or disabled for individual interfaces.

Command Attributes

• Port/Trunk – Displays the port number.

• Rate Limit Status – Enables or disables the rate limit. (Default: Disabled)

• Rate Limit Level – Sets the rate limit level.

Note: Actual rate limit = Rate Limit Level * Granularity

3-108

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

Web – Click Port, Rate Limit, Input/Output Port/Trunk Configuration. Enable the

Rate Limit Status for the required interfaces, set the Rate Limit Level, and click

Apply.

Figure 3-64 Output Rate Limit Port Configuration

CLI - This example sets the rate limit level for input and output traffic passing

through port 3.

Console(config)#interface ethernet 1/3

Console(config-if)#rate-limit input level 25

Console(config-if)#rate-limit output level 25

Console(config-if)#

4-144

Showing Port Statistics

You can display standard statistics on network traffic from the Interfaces Group and

Ethernet-like MIBs, as well as a detailed breakdown of traffic based on the RMON

MIB. Interfaces and Ethernet-like statistics display errors on the traffic passing

through each port. This information can be used to identify potential problems with

the switch (such as a faulty port or unusually heavy loading). RMON statistics

provide access to a broad range of statistics, including a total count of different

frame types and sizes passing through each port. All values displayed have been

accumulated since the last system reboot, and are shown as counts per second.

Statistics are refreshed every 60 seconds by default.

Note: RMON groups 2, 3 and 9 can only be accessed using SNMP management

software such as HP OpenView.

3-109

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Table 3-11 Port Statistics

Description

Parameter

Interface Statistics

Received Octets

The total number of octets received on the interface, including framing

characters.

Received Unicast Packets

Received Multicast Packets

Received Broadcast Packets

Received Discarded Packets

The number of subnetwork-unicast packets delivered to a higher-layer

protocol.

The number of packets, delivered by this sub-layer to a higher (sub-)layer,

which were addressed to a multicast address at this sub-layer.

The number of packets, delivered by this sub-layer to a higher (sub-)layer,

which were addressed to a broadcast address at this sub-layer.

The number of inbound packets which were chosen to be discarded even

though no errors had been detected to prevent their being deliverable to a

higher-layer protocol. One possible reason for discarding such a packet

could be to free up buffer space.

Received Unknown Packets

Received Errors

The number of packets received via the interface which were discarded

because of an unknown or unsupported protocol.

The number of inbound packets that contained errors preventing them

from being deliverable to a higher-layer protocol.

Transmit Octets

The total number of octets transmitted out of the interface, including

framing characters.

Transmit Unicast Packets

The total number of packets that higher-level protocols requested be

transmitted to a subnetwork-unicast address, including those that were

discarded or not sent.

Transmit Multicast Packets

Transmit Broadcast Packets

Transmit Discarded Packets

The total number of packets that higher-level protocols requested be

transmitted, and which were addressed to a multicast address at this

sub-layer, including those that were discarded or not sent.

The total number of packets that higher-level protocols requested be

transmitted, and which were addressed to a broadcast address at this

sub-layer, including those that were discarded or not sent.

The number of outbound packets which were chosen to be discarded even

though no errors had been detected to prevent their being transmitted.

One possible reason for discarding such a packet could be to free up

buffer space.

Transmit Errors

The number of outbound packets that could not be transmitted because of

errors.

Etherlike Statistics

Alignment Errors

Late Collisions

The number of alignment errors (missynchronized data packets).

The number of times that a collision is detected later than 512 bit-times

into the transmission of a packet.

FCS Errors

A count of frames received on a particular interface that are an integral

number of octets in length but do not pass the FCS check. This count does

not include frames received with frame-too-long or frame-too-short error.

3-110

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

Table 3-11 Port Statistics (Continued)

Parameter

Description

Excessive Collisions

A count of frames for which transmission on a particular interface fails due

to excessive collisions. This counter does not increment when the

interface is operating in full-duplex mode.

Single Collision Frames

Internal MAC Transmit Errors

Multiple Collision Frames

Carrier Sense Errors

The number of successfully transmitted frames for which transmission is

inhibited by exactly one collision.

A count of frames for which transmission on a particular interface fails due

to an internal MAC sublayer transmit error.

A count of successfully transmitted frames for which transmission is

inhibited by more than one collision.

The number of times that the carrier sense condition was lost or never

asserted when attempting to transmit a frame.

SQE Test Errors

A count of times that the SQE TEST ERROR message is generated by the

PLS sublayer for a particular interface.

Frames Too Long

A count of frames received on a particular interface that exceed the

maximum permitted frame size.

Deferred Transmissions

Internal MAC Receive Errors

A count of frames for which the first transmission attempt on a particular

interface is delayed because the medium was busy.

A count of frames for which reception on a particular interface fails due to

an internal MAC sublayer receive error.

RMON Statistics

Drop Events

The total number of events in which packets were dropped due to lack of

resources.

Jabbers

The total number of frames received that were longer than 1518 octets

(excluding framing bits, but including FCS octets), and had either an FCS

or alignment error.

Received Bytes

Collisions

Total number of bytes of data received on the network. This statistic can

be used as a reasonable indication of Ethernet utilization.

The best estimate of the total number of collisions on this Ethernet

segment.

Received Frames

Broadcast Frames

The total number of frames (bad, broadcast and multicast) received.

The total number of good frames received that were directed to the

broadcast address. Note that this does not include multicast packets.

Multicast Frames

The total number of good frames received that were directed to this

multicast address.

CRC/Alignment Errors

Undersize Frames

The number of CRC/alignment errors (FCS or alignment errors).

The total number of frames received that were less than 64 octets long

(excluding framing bits, but including FCS octets) and were otherwise well

formed.

Oversize Frames

The total number of frames received that were longer than 1518 octets

(excluding framing bits, but including FCS octets) and were otherwise well

formed.

3-111

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Table 3-11 Port Statistics (Continued)

Parameter

Description

Fragments

The total number of frames received that were less than 64 octets in length

(excluding framing bits, but including FCS octets) and had either an FCS

or alignment error.

64 Bytes Frames

The total number of frames (including bad packets) received and

transmitted that were 64 octets in length (excluding framing bits but

including FCS octets).

65-127 Byte Frames

The total number of frames (including bad packets) received and

transmitted where the number of octets fall within the specified range

(excluding framing bits but including FCS octets).

128-255 Byte Frames

256-511 Byte Frames

512-1023 Byte Frames

1024-1518 Byte Frames

1519-1536 Byte Frames

3-112

Download from Www.Somanuals.com. All Manuals Search And Download.

Port Configuration

Web – Click Port, Port Statistics. Select the required interface, and click Query. You

can also use the Refresh button at the bottom of the page to update the screen.

Figure 3-65 Port Statistics

3-113

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This example shows statistics for port 13.

Console#show interfaces counters ethernet 1/13

Ethernet 1/13

4-139

Iftable stats:

Octets input: 868453, Octets output: 3492122

Unicast input: 7315, Unitcast output: 6658

Discard input: 0, Discard output: 0

Error input: 0, Error output: 0

Unknown protos input: 0, QLen output: 0

Extended iftable stats:

Multi-cast input: 0, Multi-cast output: 17027

Broadcast input: 231, Broadcast output: 7

Ether-like stats:

Alignment errors: 0, FCS errors: 0

Single Collision frames: 0, Multiple collision frames: 0

SQE Test errors: 0, Deferred transmissions: 0

Late collisions: 0, Excessive collisions: 0

Internal mac transmit errors: 0, Internal mac receive errors: 0

Frame too longs: 0, Carrier sense errors: 0

Symbol errors: 0

RMON stats:

Drop events: 0, Octets: 4422579, Packets: 31552

Broadcast pkts: 238, Multi-cast pkts: 17033

Undersize pkts: 0, Oversize pkts: 0

Fragments: 0, Jabbers: 0

CRC align errors: 0, Collisions: 0

Packet size <= 64 octets: 25568, Packet size 65 to 127 octets: 1616

Packet size 128 to 255 octets: 1249, Packet size 256 to 511 octets: 1449

Packet size 512 to 1023 octets: 802, Packet size 1024 to 1518 octets: 871

Console#

Address Table Settings

Switches store the addresses for all known devices. This information is used to pass

traffic directly between the inbound and outbound ports. All the addresses learned

by monitoring traffic are stored in the dynamic address table. You can also manually

configure static addresses that are bound to a specific port.

Setting Static Addresses

A static address can be assigned to a specific interface on this switch. Static

addresses are bound to the assigned interface and will not be moved. When a static

address is seen on another interface, the address will be ignored and will not be

written to the address table.

Command Attributes

• Static Address Counts – The number of manually configured addresses.

• Current Static Address Table – Lists all the static addresses.

• Interface – Port or trunk associated with the device assigned a static address.

• MAC Address – Physical address of a device mapped to this interface.

• VLAN – ID of configured VLAN (1-4094).

8. Web Only.

3-114

Download from Www.Somanuals.com. All Manuals Search And Download.

Address Table Settings

Web – Click Address Table, Static Addresses. Specify the interface, the MAC

address and VLAN, then click Add Static Address.

Figure 3-66 Static Addresses

CLI – This example adds an address to the static address table, but sets it to be

deleted when the switch is reset.

Console(config)#mac-address-table static 00-e0-29-94-34-de interface

ethernet 1/1 vlan 1 delete-on-reset

4-157

Console(config)#

Displaying the Address Table

The Dynamic Address Table contains the MAC addresses learned by monitoring the

source address for traffic entering the switch. When the destination address for

inbound traffic is found in the database, the packets intended for that address are

forwarded directly to the associated port. Otherwise, the traffic is flooded to all ports.

Command Attributes

• Interface – Indicates a port or trunk.

• MAC Address – Physical address associated with this interface.

• VLAN – ID of configured VLAN (1-4094).

• Address Table Sort Key – You can sort the information displayed based on MAC

address, VLAN or interface (port or trunk).

• Dynamic Address Counts – The number of addresses dynamically learned.

• Current Dynamic Address Table – Lists all the dynamic addresses.

3-115

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Address Table, Dynamic Addresses. Specify the search type (i.e., mark

the Interface, MAC Address, or VLAN checkbox), select the method of sorting the

displayed addresses, and then click Query.

Figure 3-67 Dynamic Addresses

CLI – This example also displays the address table entries for port 1.

Console#show mac-address-table interface ethernet 1/1

Interface Mac Address Vlan Type

--------- ----------------- ---- -----------------

4-158

Eth 1/ 1 00-E0-29-94-34-DE

Eth 1/ 1 00-20-9C-23-CD-60

1 Delete-on-reset

2 Learned

Console#

3-116

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

Changing the Aging Time

You can set the aging time for entries in the dynamic address table.

Command Attributes

• Aging Status – Enables/disables the function.

• Aging Time – The time after which a learned entry is discarded.

(Range: 10-30000 seconds; Default: 300 seconds)

Web – Click Address Table, Address Aging. Specify the new aging time, click Apply.

Figure 3-68 Address Aging

CLI – This example sets the aging time to 300 seconds.

Console(config)#mac-address-table aging-time 300

Console(config)#

4-159

Spanning Tree Algorithm Configuration

The Spanning Tree Algorithm (STA) can be used to detect and disable network

loops, and to provide backup links between switches, bridges or routers. This allows

the switch to interact with other bridging devices (that is, an STA-compliant switch,

bridge or router) in your network to ensure that only one route exists between any

two stations on the network, and provide backup links which automatically take over

when a primary link goes down.

The spanning tree algorithms supported by this switch include these versions:

• STP – Spanning Tree Protocol (IEEE 802.1D)

• RSTP – Rapid Spanning Tree Protocol (IEEE 802.1w)

• MSTP – Multiple Spanning Tree Protocol (IEEE 802.1s)

STP – STP uses a distributed algorithm to select a bridging device (STP-compliant

switch, bridge or router) that serves as the root of the spanning tree network. It

selects a root port on each bridging device (except for the root device) which incurs

the lowest path cost when forwarding a packet from that device to the root device.

Then it selects a designated bridging device from each LAN which incurs the lowest

path cost when forwarding a packet from that LAN to the root device. All ports

connected to designated bridging devices are assigned as designated ports. After

determining the lowest cost spanning tree, it enables all root ports and designated

3-117

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

ports, and disables all other ports. Network packets are therefore only forwarded

between root ports and designated ports, eliminating any possible network loops.

Designated

Root

Port

Designated

Port

Designated

Bridge

Once a stable network topology has been established, all bridges listen for Hello

BPDUs (Bridge Protocol Data Units) transmitted from the Root Bridge. If a bridge

does not get a Hello BPDU after a predefined interval (Maximum Age), the bridge

assumes that the link to the Root Bridge is down. This bridge will then initiate

negotiations with other bridges to reconfigure the network to reestablish a valid

network topology.

RSTP – RSTP is designed as a general replacement for the slower, legacy STP.

RSTP is also incorporated into MSTP. RSTP achieves must faster reconfiguration

(i.e., around 1 to 3 seconds, compared to 30 seconds or more for STP) by reducing

the number of state changes before active ports start learning, predefining an

alternate route that can be used when a node or port fails, and retaining the

forwarding database for ports insensitive to changes in the tree structure when

reconfiguration occurs.

MSTP – When using STP or RSTP, it may be difficult to maintain a stable path

between all VLAN members. Frequent changes in the tree structure can easily

isolate some of the group members. MSTP (which is based on RSTP for fast

convergence) is designed to support independent spanning trees based on VLAN

groups. Using multiple spanning trees can provide multiple forwarding paths and

enable load balancing. One or more VLANs can be grouped into a Multiple Spanning

Tree Instance (MSTI). MSTP builds a separate Multiple Spanning Tree (MST) for

each instance to maintain connectivity among each of the assigned VLAN groups.

3-118

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

MSTP then builds a Internal Spanning Tree (IST) for the Region containing all

commonly configured MSTP bridges.

IST

(for this Region)

MST 1

Region R

MST 2

An MST Region consists of a group of interconnected bridges that have the same

MST Configuration Identifiers (including the Region Name, Revision Level and

Configuration Digest – see “Configuring Multiple Spanning Trees” on page 3-132).

An MST Region may contain multiple MSTP Instances. An Internal Spanning Tree

(IST) is used to connect all the MSTP switches within an MST region. A Common

Spanning Tree (CST) interconnects all adjacent MST Regions, and acts as a virtual

bridge node for communications with STP or RSTP nodes in the global network.

Region 1

CIST

CST

Region 4

IST

Region 2

Region 3

Region 2

Region 3

MSTP connects all bridges and LAN segments with a single Common and Internal

Spanning Tree (CIST). The CIST is formed as a result of the running spanning tree

algorithm between switches that support the STP, RSTP, MSTP protocols.

Displaying Global Settings

You can display a summary of the current bridge STA information that applies to the

entire switch using the STA Information screen.

Field Attributes

• Spanning Tree State – Shows if the switch is enabled to participate in an

STA-compliant network.

3-119

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• Bridge ID – A unique identifier for this bridge, consisting of the bridge priority, the

MST Instance ID 0 for the Common Spanning Tree when spanning tree mode is

set to MSTP (page 3-123), and MAC address (where the address is taken from the

switch system).

• Max Age – The maximum time (in seconds) a device can wait without receiving a

configuration message before attempting to reconfigure. All device ports (except

for designated ports) should receive configuration messages at regular intervals.

Any port that ages out STA information (provided in the last configuration

message) becomes the designated port for the attached LAN. If it is a root port, a

new root port is selected from among the device ports attached to the network.

(References to “ports” in this section mean “interfaces,” which includes both ports

and trunks.)

• Hello Time – Interval (in seconds) at which the root device transmits a

configuration message.

• Forward Delay – The maximum time (in seconds) the root device will wait before

changing states (i.e., discarding to learning to forwarding). This delay is required

because every device must receive information about topology changes before it

starts to forward frames. In addition, each port needs time to listen for conflicting

information that would make it return to a discarding state; otherwise, temporary

data loops might result.

• Designated Root – The priority and MAC address of the device in the Spanning

Tree that this switch has accepted as the root device.

- Root Port – The number of the port on this switch that is closest to the root. This

switch communicates with the root device through this port. If there is no root

port, then this switch has been accepted as the root device of the Spanning Tree

network.

- Root Path Cost – The path cost from the root port on this switch to the root

device.

• Configuration Changes – The number of times the Spanning Tree has been

reconfigured.

• Last Topology Change – Time since the Spanning Tree was last reconfigured.

These additional parameters are only displayed for the CLI:

• Spanning tree mode – Specifies the type of spanning tree used on this switch:

- STP: Spanning Tree Protocol (IEEE 802.1D)

- RSTP: Rapid Spanning Tree (IEEE 802.1w)

- MSTP: Multiple Spanning Tree (IEEE 802.1s)

• Instance – Instance identifier of this spanning tree. (This is always 0 for the CIST.)

• VLANs configuration – VLANs assigned to the CIST.

• Priority – Bridge priority is used in selecting the root device, root port, and

designated port. The device with the highest priority (i.e., lower numeric value)

becomes the STA root device. However, if all devices have the same priority, the

device with the lowest MAC address will then become the root device.

• Root Hello Time – Interval (in seconds) at which this device transmits a

configuration message.

3-120

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

• Root Maximum Age – The maximum time (in seconds) this device can wait

without receiving a configuration message before attempting to reconfigure. All

device ports (except for designated ports) should receive configuration messages

at regular intervals. If the root port ages out STA information (provided in the last

configuration message), a new root port is selected from among the device ports

attached to the network. (References to “ports” in this section means “interfaces,”

which includes both ports and trunks.)

• Root Forward Delay – The maximum time (in seconds) this device will wait before

changing states (i.e., discarding to learning to forwarding). This delay is required

because every device must receive information about topology changes before it

starts to forward frames. In addition, each port needs time to listen for conflicting

information that would make it return to a discarding state; otherwise, temporary

data loops might result.

• Max hops – The max number of hop counts for the MST region.

• Remaining hops – The remaining number of hop counts for the MST instance.

• Transmission limit – The minimum interval between the transmission of

consecutive RSTP/MSTP BPDUs.

• Path Cost Method – The path cost is used to determine the best path between

devices. The path cost method is used to determine the range of values that can

be assigned to each interface.

Web – Click Spanning Tree, STA, Information.

Figure 3-69 STA Information

3-121

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This command displays global STA settings, followed by settings for each port

Console#show spanning-tree

4-176

Spanning-tree information

---------------------------------------------------------------

Spanning tree mode:

Spanning tree enable/disable:

Instance:

MSTP

enable

Vlans configuration:

Priority:

1-4093

32768

Bridge Hello Time (sec.):

Bridge Max Age (sec.):

Bridge Forward Delay (sec.):

Root Hello Time (sec.):

Root Max Age (sec.):

Root Forward Delay (sec.):

Max hops:

Remaining hops:

Designated Root

32768.0.0000ABCD0000

Current root port:

Current root cost

Number of topology changes:

200000

Last topology changes time (sec.): 13380

Transmission limit:

Path Cost Method:

long

---------------------------------------------------------------

Eth 1/ 1 information

---------------------------------------------------------------

Admin status:

Role:

enabled

disable

State:

discarding

External admin path cost: 10000

Internal admin cost: 10000

External oper path cost: 10000

Internal oper path cost: 10000

Priority:

128

Designated cost:

Designated port:

Designated root:

Designated bridge:

Fast forwarding:

Forward transitions:

Admin edge port:

Oper edge port:

Admin Link type:

Oper Link type:

Spanning Tree Status:

300000

128.1

32768.0000E8AAAA00

32768.0030F1D473A0

disabled

auto

point-to-point

enabled

Note: The current root port and current root cost display as zero when this device is not

connected to the network.

3-122

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

Configuring Global Settings

Global settings apply to the entire switch.

Command Usage

• Spanning Tree Protocol

Uses RSTP for the internal state machine, but sends only 802.1D BPDUs. This

creates one spanning tree instance for the entire network. If multiple VLANs are

implemented on a network, the path between specific VLAN members may be

inadvertently disabled to prevent network loops, thus isolating group members.

When operating multiple VLANs, we recommend selecting the MSTP option.

• Rapid Spanning Tree Protocol

RSTP supports connections to either STP or RSTP nodes by monitoring the

incoming protocol messages and dynamically adjusting the type of protocol

messages the RSTP node transmits, as described below:

- STP Mode – If the switch receives an 802.1D BPDU (i.e., STP BPDU) after a

port’s migration delay timer expires, the switch assumes it is connected to an

802.1D bridge and starts using only 802.1D BPDUs.

- RSTP Mode – If RSTP is using 802.1D BPDUs on a port and receives an RSTP

BPDU after the migration delay expires, RSTP restarts the migration delay timer

and begins using RSTP BPDUs on that port.

• Multiple Spanning Tree Protocol

- To allow multiple spanning trees to operate over the network, you must configure

a related set of bridges with the same MSTP configuration, allowing them to

participate in a specific set of spanning tree instances.

- A spanning tree instance can exist only on bridges that have compatible VLAN

instance assignments.

- Be careful when switching between spanning tree modes. Changing modes

stops all spanning-tree instances for the previous mode and restarts the system

in the new mode, temporarily disrupting user traffic.

Command Attributes

Basic Configuration of Global Settings

• Spanning Tree State – Enables/disables STA on this switch. (Default: Enabled)

• Spanning Tree Type – Specifies the type of spanning tree used on this switch:

- STP: Spanning Tree Protocol (IEEE 802.1D); i.e., when this option is selected,

the switch will use RSTP set to STP forced compatibility mode).

- RSTP: Rapid Spanning Tree (IEEE 802.1w); RSTP is the default.

- MSTP: Multiple Spanning Tree (IEEE 802.1s)

• Priority – Bridge priority is used in selecting the root device, root port, and

designated port. The device with the highest priority becomes the STA root device.

However, if all devices have the same priority, the device with the lowest MAC

9. STP and RSTP BPDUs are transmitted as untagged frames, and will cross any VLAN

boundaries.

3-123

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

address will then become the root device. (Note that lower numeric values indicate

higher priority.)

• Default: 32768

• Range: 0-61440, in steps of 4096

• Options: 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864,

40960, 45056, 49152, 53248, 57344, 61440

Root Device Configuration

• Hello Time – Interval (in seconds) at which the root device transmits a

configuration message.

• Default: 2

• Minimum: 1

• Maximum: The lower of 10 or [(Max. Message Age / 2) -1]

• Maximum Age – The maximum time (in seconds) a device can wait without

receiving a configuration message before attempting to reconfigure. All device

ports (except for designated ports) should receive configuration messages at

regular intervals. Any port that ages out STA information (provided in the last

configuration message) becomes the designated port for the attached LAN. If it is

a root port, a new root port is selected from among the device ports attached to the

network. (References to “ports” in this section mean “interfaces,” which includes

both ports and trunks.)

• Default: 20

• Minimum: The higher of 6 or [2 x (Hello Time + 1)].

• Maximum: The lower of 40 or [2 x (Forward Delay - 1)]

• Forward Delay – The maximum time (in seconds) this device will wait before

changing states (i.e., discarding to learning to forwarding). This delay is required

because every device must receive information about topology changes before it

starts to forward frames. In addition, each port needs time to listen for conflicting

information that would make it return to a discarding state; otherwise, temporary

data loops might result.

• Default: 15

• Minimum: The higher of 4 or [(Max. Message Age / 2) + 1]

• Maximum: 30

Configuration Settings for RSTP

The following attributes apply to both RSTP and MSTP:

• Path Cost Method – The path cost is used to determine the best path between

devices. The path cost method is used to determine the range of values that can

be assigned to each interface.

- Long: Specifies 32-bit based values that range from 1-200,000,000.

(This is the default.)

- Short: Specifies 16-bit based values that range from 1-65535.

• Transmission Limit – The maximum transmission rate for BPDUs is specified by

setting the minimum interval between the transmission of consecutive protocol

messages. (Range: 1-10; Default: 3)

3-124

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

Configuration Settings for MSTP

• Max Instance Numbers – The maximum number of MSTP instances to which this

switch can be assigned.

• Configuration Digest – An MD5 signature key that contains the VLAN ID to MST

ID mapping table. In other words, this key is a mapping of all VLANs to the CIST.

• Region Revision – The revision for this MSTI. (Range: 0-65535; Default: 0)

• Region Name – The name for this MSTI. (Maximum length: 32 characters)

• Max Hop Count – The maximum number of hops allowed in the MST region before

a BPDU is discarded. (Range: 1-40; Default: 20)

10. The MST name and revision number are both required to uniquely identify an MST region.

3-125

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Spanning Tree, STA, Configuration. Modify the required attributes, and

click Apply.

Figure 3-70 STA Global Configuration

3-126

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

CLI – This example enables Spanning Tree Protocol, sets the mode to MST, and

then configures the STA and MSTP parameters.

Console(config)#spanning-tree

4-161

Console(config)#spanning-tree mode mstp

Console(config)#spanning-tree priority 40000

Console(config)#spanning-tree hello-time 5

Console(config)#spanning-tree max-age 38

Console(config)#spanning-tree forward-time 20

Console(config)#spanning-tree pathcost method long

Console(config)#spanning-tree transmission-limit 4

Console(config)#spanning-tree mst-configuration

Console(config-mstp)#revision 1

Console(config-mstp)#name R&D

Console(config-mstp)#max-hops 30

Console(config-mstp)#

Displaying Interface Settings

The STA Port Information and STA Trunk Information pages display the current

status of ports and trunks in the Spanning Tree.

Field Attributes

• Spanning Tree – Shows if STA has been enabled on this interface.

• STA Status – Displays current state of this port within the Spanning Tree:

- Discarding - Port receives STA configuration messages, but does not forward

packets.

- Learning - Port has transmitted configuration messages for an interval set by

the Forward Delay parameter without receiving contradictory information. Port

address table is cleared, and the port begins learning addresses.

- Forwarding - Port forwards packets, and continues learning addresses.

The rules defining port status are:

- A port on a network segment with no other STA compliant bridging device is

always forwarding.

- If two ports of a switch are connected to the same segment and there is no other

STA device attached to this segment, the port with the smaller ID forwards

packets and the other is discarding.

- All ports are discarding when the switch is booted, then some of them change

state to learning, and then to forwarding.

• Forward Transitions – The number of times this port has transitioned from the

Learning state to the Forwarding state.

• Designated Cost – The cost for a packet to travel from this port to the root in the

current Spanning Tree configuration. The slower the media, the higher the cost.

• Designated Bridge – The bridge priority and MAC address of the device through

which this port must communicate to reach the root of the Spanning Tree.

• Designated Port – The port priority and number of the port on the designated

bridging device through which this switch must communicate with the root of the

Spanning Tree.

3-127

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• Oper Path Cost – The contribution of this port to the path cost of paths towards

the spanning tree root which include this port.

• Oper Link Type – The operational point-to-point status of the LAN segment

attached to this interface. This parameter is determined by manual configuration or

by auto-detection, as described for Admin Link Type in STA Port Configuration on

page 3-130.

• Oper Edge Port – This parameter is initialized to the setting for Admin Edge Port

in STA Port Configuration on page 3-130 (i.e., true or false), but will be set to false

if a BPDU is received, indicating that another bridge is attached to this port.

• Port Role – Roles are assigned according to whether the port is part of the active

topology connecting the bridge to the root bridge (i.e., root port), connecting a LAN

through the bridge to the root bridge (i.e., designated port), or is the MSTI regional

root (i.e., master port); or is an alternate or backup port that may provide

connectivity if other bridges, bridge ports, or LANs fail or are removed. The role is

set to disabled (i.e., disabled port) if a port has no role within the spanning tree.

R: Root Port

Alternate port receives more

useful BPDUs from another

bridge and is therefore not

selected as the designated

port.

A: Alternate Port

D: Designated Port

B: Backup Port

Backup port receives more

useful BPDUs from the same

bridge and is therefore not

selected as the designated

port.

• Trunk Member – Indicates if a port is a member of a trunk.

(STA Port Information only)

These additional parameters are only displayed for the CLI:

• Admin status – Shows if this interface is enabled.

• External path cost – The path cost for the IST. This parameter is used by the

STA to determine the best path between devices. Therefore, lower values should

be assigned to ports attached to faster media, and higher values assigned to ports

with slower media. (Path cost takes precedence over port priority.)

3-128

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

• Internal path cost – The path cost for the MST. See the preceding item.

• Priority – Defines the priority used for this port in the Spanning Tree Algorithm. If

the path cost for all ports on a switch is the same, the port with the highest priority

(i.e., lowest value) will be configured as an active link in the Spanning Tree. This

makes a port with higher priority less likely to be blocked if the Spanning Tree

Algorithm is detecting network loops. Where more than one port is assigned the

highest priority, the port with the lowest numeric identifier will be enabled.

• Designated root – The priority and MAC address of the device in the Spanning

Tree that this switch has accepted as the root device.

• Fast forwarding – This field provides the same information as Admin Edge port,

and is only included for backward compatibility with earlier products.

• Admin Edge Port – You can enable this option if an interface is attached to a LAN

segment that is at the end of a bridged LAN or to an end node. Since end nodes

cannot cause forwarding loops, they can pass directly through to the spanning tree

forwarding state. Specifying Edge Ports provides quicker convergence for devices

such as workstations or servers, retains the current forwarding database to reduce

the amount of frame flooding required to rebuild address tables during

reconfiguration events, does not cause the spanning tree to reconfigure when the

interface changes state, and also overcomes other STA-related timeout problems.

However, remember that Edge Port should only be enabled for ports connected to

an end-node device.

• Admin Link Type – The link type attached to this interface.

- Point-to-Point – A connection to exactly one other bridge.

- Shared – A connection to two or more bridges.

- Auto – The switch automatically determines if the interface is attached to a

point-to-point link or to shared media.

Web – Click Spanning Tree, STA, Port Information or STA Trunk Information.

Figure 3-71 STA Port Information

3-129

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This example shows the STA attributes for port 5.

Console#show spanning-tree ethernet 1/5

Eth 1/ 5 information

4-176

--------------------------------------------------------------

Admin status:

Role:

enabled

disable

State:

discarding

External admin path cost: 10000

Internal admin cost: 10000

External oper path cost: 10000

Internal oper path cost: 10000

Priority:

128

Designated cost:

Designated port:

Designated root:

Designated bridge:

Fast forwarding:

Forward transitions:

Admin edge port:

Oper edge port:

Admin Link type:

Oper Link type:

Spanning Tree Status:

10000

128.1

32768.0.0000E8AAAA00

32768.0.0030F1D473A0

disabled

auto

point-to-point

enabled

Console#

Configuring Interface Settings

You can configure RSTP and MSTP attributes for specific interfaces, including port

priority, path cost, link type, and edge port. You may use a different priority or path

cost for ports of the same media type to indicate the preferred path, link type to

indicate a point-to-point connection or shared-media connection, and edge port to

indicate if the attached device can support fast forwarding. (References to “ports” in

this section means “interfaces,” which includes both ports and trunks.)

Command Attributes

The following attributes are read-only and cannot be changed:

• STA State – Displays current state of this port within the Spanning Tree.

(See Displaying Interface Settings on page 3-127 for additional information.)

• Discarding - Port receives STA configuration messages, but does not forward

packets.

• Learning - Port has transmitted configuration messages for an interval set by

the Forward Delay parameter without receiving contradictory information. Port

address table is cleared, and the port begins learning addresses.

• Forwarding - Port forwards packets, and continues learning addresses.

• Trunk – Indicates if a port is a member of a trunk.

11. STA Port Configuration only

3-130

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

The following interface attributes can be configured:

• Spanning Tree – Enables/disables STA on this interface. (Default: Enabled)

• Priority – Defines the priority used for this port in the Spanning Tree Protocol. If

the path cost for all ports on a switch are the same, the port with the highest priority

(i.e., lowest value) will be configured as an active link in the Spanning Tree. This

makes a port with higher priority less likely to be blocked if the Spanning Tree

Protocol is detecting network loops. Where more than one port is assigned the

highest priority, the port with lowest numeric identifier will be enabled.

• Default: 128

• Range: 0-240, in steps of 16

• Admin Path Cost – This parameter is used by the STA to determine the best path

between devices. Therefore, lower values should be assigned to ports attached to

faster media, and higher values assigned to ports with slower media. (Path cost

takes precedence over port priority.) (Range: 0 for auto-configuration, 1-65535 for

the short path cost method (see page 3-123), 1-200,000,000 for the long path cost

method)

By default, the system automatically detects the speed and duplex mode used on

each port, and configures the path cost according to the values shown below. Path

cost “0” is used to indicate auto-configuration mode.

When the short path cost method is selected and the default path cost

recommended by the IEEE 8021w standard exceeds 65,535, the default is set to

65,535.

• Range –

-Ethernet: 200,000-20,000,000

-Fast Ethernet: 20,000-2,000,000

-Gigabit Ethernet: 2,000-200,000

• Default –

-Ethernet – Half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000

-Fast Ethernet – Half duplex: 200,000; full duplex: 100,000; trunk: 50,000

-Gigabit Ethernet – Full duplex: 10,000; trunk: 5,000

• Admin Link Type – The link type attached to this interface.

• Point-to-Point – A connection to exactly one other bridge.

• Shared – A connection to two or more bridges.

• Auto – The switch automatically determines if the interface is attached to a

point-to-point link or to shared media. (This is the default setting.)

• Admin Edge Port (Fast Forwarding) – You can enable this option if an interface is

attached to a LAN segment that is at the end of a bridged LAN or to an end node.

Since end nodes cannot cause forwarding loops, they can pass directly through to

the spanning tree forwarding state. Specifying Edge Ports provides quicker

convergence for devices such as workstations or servers, retains the current

forwarding database to reduce the amount of frame flooding required to rebuild

address tables during reconfiguration events, does not cause the spanning tree to

initiate reconfiguration when the interface changes state, and also overcomes

3-131

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

other STA-related timeout problems. However, remember that Edge Port should

only be enabled for ports connected to an end-node device. (Default: Disabled)

• Migration – If at any time the switch detects STP BPDUs, including Configuration

or Topology Change Notification BPDUs, it will automatically set the selected

interface to forced STP-compatible mode. However, you can also use the Protocol

Migration button to manually re-check the appropriate BPDU format (RSTP or

STP-compatible) to send on the selected interfaces. (Default: Disabled)

Web – Click Spanning Tree, STA, Port Configuration or Trunk Configuration. Modify

the required attributes, then click Apply.

Figure 3-72 STA Port Configuration

CLI – This example sets STA attributes for port 7.

Console(config)#interface ethernet 1/7

Console(config-if)#no spanning-tree spanning-disabled

Console(config-if)#spanning-tree port-priority 0

Console(config-if)#spanning-tree cost 50

Console(config-if)#spanning-tree link-type auto

Console(config-if)#no spanning-tree edge-port

Console(config-if)#spanning-tree protocol-migration

Configuring Multiple Spanning Trees

MSTP generates a unique spanning tree for each instance. This provides multiple

pathways across the network, thereby balancing the traffic load, preventing

wide-scale disruption when a bridge node in a single instance fails, and allowing for

faster convergence of a new topology for the failed instance.

By default all VLANs are assigned to the Internal Spanning Tree (MST Instance 0)

that connects all bridges and LANs within the MST region. This switch supports up

to 33 instances. You should try to group VLANs which cover the same general area

of your network. However, remember that you must configure all bridges within the

same MSTI Region (page 3-125) with the same set of instances, and the same

instance (on each bridge) with the same set of VLANs. Also, note that RSTP treats

each MSTI region as a single node, connecting all regions to the Common Spanning

Tree.

3-132

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

To use multiple spanning trees:

1. Set the spanning tree type to MSTP (STA Configuration, page 3-123).

2. Enter the spanning tree priority for the selected MST instance (MSTP VLAN

Configuration).

3. Add the VLANs that will share this MSTI (MSTP VLAN Configuration).

Note: All VLANs are automatically added to the IST (Instance 0).

To ensure that the MSTI maintains connectivity across the network, you must

configure a related set of bridges with the same MSTI settings.

Command Attributes

• MST Instance – Instance identifier of this spanning tree. (Default: 0)

• Priority – The priority of a spanning tree instance. (Range: 0-61440 in steps of

4096; Options: 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864,

40960, 45056, 49152, 53248, 57344, 61440; Default: 32768)

• VLANs in MST Instance – VLANs assigned this instance.

• MST ID – Instance identifier to configure. (Range: 0-4094; Default: 0)

• VLAN ID – VLAN to assign to this selected MST instance. (Range: 1-4093)

The other global attributes are described under “Displaying Global Settings,” page 3-119. The

attributes displayed by the CLI for individual interfaces are described under “Displaying Interface

Settings,” page 3-127

3-133

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Spanning Tree, MSTP, VLAN Configuration. Select an instance

identifier from the list, set the instance priority, and click Apply. To add the VLAN

members to an MSTI instance, enter the instance identifier, the VLAN identifier, and

click Add.

Figure 3-73 MSTP VLAN Configuration

CLI – This displays STA settings for instance 1, followed by settings for each port.

Console#show spanning-tree mst 1

4-178

Spanning-tree information

---------------------------------------------------------------

Spanning tree mode:

Spanning tree enabled/disabled:

Instance:

MSTP

enabled

VLANs configuration:

Priority:

32768

Bridge Hello Time (sec.):

Bridge Max Age (sec.):

Bridge Forward Delay (sec.):

Root Hello Time (sec.):

Root Max Age (sec.):

Root Forward Delay (sec.):

Max hops:

Remaining hops:

Designated Root:

32768.1.0030F1D473A0

Current root port:

Current root cost:

Number of topology changes:

10000

Last topology changes time (sec.):85

Transmission limit:

Path Cost Method:

long

3-134

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

---------------------------------------------------------------

Eth 1/ 7 information

---------------------------------------------------------------

Admin status:

Role:

enabled

master

State:

forwarding

External admin path cost: 10000

Internal admin path cost: 10000

External oper path cost: 10000

Internal oper path cost: 10000

Priority:

128

Designated cost:

Designated port:

Designated root:

Designated bridge:

Fast forwarding:

Forward transitions:

Admin edge port:

Oper edge port:

Admin Link type:

Oper Link type:

Spanning Tree Status:

128.1

32768.1.0030F1D473A0

disabled

auto

point-to-point

enabled

CLI – This example sets the priority for MSTI 1, and adds VLANs 1-5 to this MSTI.

Console(config)#spanning-tree mst-configuration

Console(config-mst)#mst 1 priority 4096

Console(config-mstp)#mst 1 vlan 1-5

Console(config-mst)#

4-166

4-168

4-167

3-135

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Displaying Interface Settings for MSTP

The MSTP Port Information and MSTP Trunk Information pages display the current

status of ports and trunks in the selected MST instance.

Field Attributes

MST Instance ID – Instance identifier to configure. (Range: 0-4094; Default: 0)

The other attributes are described under “Displaying Interface Settings,” page 3-127.

Web – Click Spanning Tree, MSTP, Port Information or Trunk Information. Select the

required MST instance to display the current spanning tree values.

Figure 3-74 MSTP Port Information

CLI – This displays STA settings for instance 0, followed by settings for each port.

The settings for instance 0 are global settings that apply to the IST (page 3-119), the

settings for other instances only apply to the local spanning tree.

Console#show spanning-tree mst 0

4-178

Spanning-tree information

---------------------------------------------------------------

Spanning tree mode:

Spanning tree enabled/disabled:

Instance:

MSTP

enabled

VLANs configuration:

Priority:

2-4093

32768

Bridge Hello Time (sec.):

Bridge Max Age (sec.):

Bridge Forward Delay (sec.):

Root Hello Time (sec.):

Root Max Age (sec.):

Root Forward Delay (sec.):

Max hops:

Remaining hops:

Designated Root:

32768.0.0000E8AAAA00

Current root port:

Current root cost:

Number of topology changes:

10000

Last topology changes time (sec.):303

Transmission limit:

Path Cost Method:

long

3-136

Download from Www.Somanuals.com. All Manuals Search And Download.

Spanning Tree Algorithm Configuration

---------------------------------------------------------------

Eth 1/ 1 information

---------------------------------------------------------------

Admin status:

Role:

enabled

root

State:

forwarding

External admin path cost: 10000

Internal admin path cost: 10000

External oper path cost: 10000

Internal oper path cost: 10000

Priority:

128

Designated cost:

Designated port:

Designated root:

Designated bridge:

Fast forwarding:

Forward transitions:

Admin edge port:

Oper edge port:

Admin Link type:

Oper Link type:

Spanning Tree Status:

128.4

32768.0.0000E8AAAA00

disabled

auto

point-to-point

enabled

Configuring Interface Settings for MSTP

You can configure the STA interface settings for an MST Instance using the MSTP

Port Configuration and MSTP Trunk Configuration pages.

Field Attributes

The following attributes are read-only and cannot be changed:

• STA State – Displays current state of this port within the Spanning Tree.

(See Displaying Interface Settings on page 3-127 for additional information.)

• Discarding - Port receives STA configuration messages, but does not forward

packets.

• Learning - Port has transmitted configuration messages for an interval set by

the Forward Delay parameter without receiving contradictory information. Port

address table is cleared, and the port begins learning addresses.

• Forwarding - Port forwards packets, and continues learning addresses.

• Trunk – Indicates if a port is a member of a trunk.

(STA Port Configuration only)

The following interface attributes can be configured:

• MST Instance ID – Instance identifier to configure. (Range: 0-4094; Default: 0)

• Priority – Defines the priority used for this port in the Spanning Tree Protocol. If

the path cost for all ports on a switch are the same, the port with the highest priority

(i.e., lowest value) will be configured as an active link in the Spanning Tree. This

makes a port with higher priority less likely to be blocked if the Spanning Tree

Protocol is detecting network loops. Where more than one port is assigned the

highest priority, the port with lowest numeric identifier will be enabled.

• Default: 128

• Range: 0-240, in steps of 16

3-137

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• Admin MST Path Cost – This parameter is used by the MSTP to determine the

best path between devices. Therefore, lower values should be assigned to ports

attached to faster media, and higher values assigned to ports with slower media.

(Path cost takes precedence over port priority.) Note that when the Path Cost

Method is set to short (page 3-63), the maximum path cost is 65,535.

By default, the system automatically detects the speed and duplex mode used on

each port, and configures the path cost according to the values shown below. Path

cost “0” is used to indicate auto-configuration mode. When the short path cost

method is selected and the default path cost recommended by the IEEE 8021w

standard exceeds 65,535, the default is set to 65,535.

• Range –

-Ethernet: 200,000-20,000,000

-Fast Ethernet: 20,000-2,000,000

-Gigabit Ethernet: 2,000-200,000

• Default –

-Ethernet – Half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000

-Fast Ethernet – Half duplex: 200,000; full duplex: 100,000; trunk: 50,000

-Gigabit Ethernet – Full duplex: 10,000; trunk: 5,000

Web – Click Spanning Tree, MSTP, Port Configuration or Trunk Configuration. Enter

the priority and path cost for an interface, and click Apply.

Figure 3-75 MSTP Port Configuration

CLI – This example sets the MSTP attributes for port 4.

Console(config)#interface ethernet 1/4

Console(config-if)#spanning-tree mst port-priority 0

Console(config-if)#spanning-tree mst cost 50

Console(config-if)

4-175

4-174

3-138

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

IEEE 802.1Q VLANs

In large networks, routers are used to isolate broadcast traffic for each subnet into

separate domains. This switch provides a similar service at Layer 2 by using VLANs

to organize any group of network nodes into separate broadcast domains. VLANs

confine broadcast traffic to the originating group, and can eliminate broadcast

storms in large networks. This also provides a more secure and cleaner network

environment.

An IEEE 802.1Q VLAN is a group of ports that can be located anywhere in the

network, but communicate as though they belong to the same physical segment.

VLANs help to simplify network management by allowing you to move devices to a

new VLAN without having to change any physical connections. VLANs can be easily

organized to reflect departmental groups (such as Marketing or R&D), usage groups

(such as e-mail), or multicast groups (used for multimedia applications such as

videoconferencing).

VLANs provide greater network efficiency by reducing broadcast traffic, and allow

you to make network changes without having to update IP addresses or IP subnets.

VLANs inherently provide a high level of network security since traffic must pass

through a configured Layer 3 link to reach a different VLAN.

This switch supports the following VLAN features:

• Up to 255 VLANs based on the IEEE 802.1Q standard

• Distributed VLAN learning across multiple switches using explicit or implicit tagging

and GVRP protocol

• Port overlapping, allowing a port to participate in multiple VLANs

• End stations can belong to multiple VLANs

• Passing traffic between VLAN-aware and VLAN-unaware devices

• Priority tagging

Assigning Ports to VLANs

Before enabling VLANs for the switch, you must first assign each port to the VLAN

group(s) in which it will participate. By default all ports are assigned to VLAN 1 as

untagged ports. Add a port as a tagged port if you want it to carry traffic for one or

more VLANs, and any intermediate network devices or the host at the other end of

the connection supports VLANs. Then assign ports on the other VLAN-aware

network devices along the path that will carry this traffic to the same VLAN(s), either

manually or dynamically using GVRP. However, if you want a port on this switch to

participate in one or more VLANs, but none of the intermediate network devices nor

the host at the other end of the connection supports VLANs, then you should add

this port to the VLAN as an untagged port.

3-139

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Note: VLAN-tagged frames can pass through VLAN-aware or VLAN-unaware network

interconnection devices, but the VLAN tags should be stripped off before passing it

on to any end-node host that does not support VLAN tagging.

tagged frames

VA: VLAN Aware

VU: VLAN Unaware

tagged

frames

untagged

frames

VLAN Classification – When the switch receives a frame, it classifies the frame in

one of two ways. If the frame is untagged, the switch assigns the frame to an

associated VLAN (based on the default VLAN ID of the receiving port). But if the

frame is tagged, the switch uses the tagged VLAN ID to identify the port broadcast

domain of the frame.

Port Overlapping – Port overlapping can be used to allow access to commonly

shared network resources among different VLAN groups, such as file servers or

printers. Note that if you implement VLANs which do not overlap, but still need to

communicate, you can connect them by enabled routing on this switch.

Untagged VLANs – Untagged (or static) VLANs are typically used to reduce

broadcast traffic and to increase security. A group of network users assigned to a

VLAN form a broadcast domain that is separate from other VLANs configured on the

switch. Packets are forwarded only between ports that are designated for the same

VLAN. Untagged VLANs can be used to manually isolate user groups or subnets.

However, you should use IEEE 802.3 tagged VLANs with GVRP whenever possible

to fully automate VLAN registration.

Automatic VLAN Registration – GVRP (GARP VLAN Registration Protocol)

defines a system whereby the switch can automatically learn the VLANs to which

each end station should be assigned. If an end station (or its network adapter)

supports the IEEE 802.1Q VLAN protocol, it can be configured to broadcast a

message to your network indicating the VLAN groups it wants to join. When this

switch receives these messages, it will automatically place the receiving port in the

specified VLANs, and then forward the message to all other ports. When the

message arrives at another switch that supports GVRP, it will also place the

receiving port in the specified VLANs, and pass the message on to all other ports.

VLAN requirements are propagated in this way throughout the network. This allows

GVRP-compliant devices to be automatically configured for VLAN groups based

solely on endstation requests.

To implement GVRP in a network, first add the host devices to the required VLANs

(using the operating system or other application software), so that these VLANs can

be propagated onto the network. For both the edge switches attached directly to

3-140

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

these hosts, and core switches in the network, enable GVRP on the links between

these devices. You should also determine security boundaries in the network and

disable GVRP on the boundary ports to prevent advertisements from being

propagated, or forbid those ports from joining restricted VLANs.

Note: If you have host devices that do not support GVRP, you should configure static or

untagged VLANs for the switch ports connected to these devices (as described in

“Adding Static Members to VLANs (VLAN Index)” on page 3-147). But you can still

enable GVRP on these edge switches, as well as on the core switches in the

network.

Port-based VLAN

10 11

15 16

Forwarding Tagged/Untagged Frames

If you want to create a small port-based VLAN for devices attached directly to a

single switch, you can assign ports to the same untagged VLAN. However, to

participate in a VLAN group that crosses several switches, you should create a

VLAN for that group and enable tagging on all ports.

Ports can be assigned to multiple tagged or untagged VLANs. Each port on the

switch is therefore capable of passing tagged or untagged frames. When forwarding

a frame from this switch along a path that contains any VLAN-aware devices, the

switch should include VLAN tags. When forwarding a frame from this switch along a

path that does not contain any VLAN-aware devices (including the destination host),

the switch must first strip off the VLAN tag before forwarding the frame. When the

switch receives a tagged frame, it will pass this frame onto the VLAN(s) indicated by

the frame tag. However, when this switch receives an untagged frame from a

VLAN-unaware device, it first decides where to forward the frame, and then inserts a

VLAN tag reflecting the ingress port’s default VID.

3-141

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Enabling or Disabling GVRP (Global Setting)

GARP VLAN Registration Protocol (GVRP) defines a way for switches to exchange

VLAN information in order to register VLAN members on ports across the network.

VLANs are dynamically configured based on join messages issued by host devices

and propagated throughout the network. GVRP must be enabled to permit automatic

VLAN registration, and to support VLANs which extend beyond the local switch.

(Default: Disabled)

Web – Click VLAN, 802.1Q VLAN, GVRP Status. Enable or disable GVRP, and click

Apply.

Figure 3-76 GLobally Enabling GVRP

CLI – This example enables GVRP for the switch.

Console(config)#bridge-ext gvrp

Console(config)#

4-194

Displaying Basic VLAN Information

The VLAN Basic Information page displays basic information on the VLAN type

supported by the switch.

Field Attributes

• VLAN Version Number – The VLAN version used by this switch as specified in

the IEEE 802.1Q standard.

• Maximum VLAN ID – Maximum VLAN ID recognized by this switch.

• Maximum Number of Supported VLANs – Maximum number of VLANs that can

be configured on this switch.

Web – Click VLAN, 802.1Q VLAN, Basic Information.

Figure 3-77 VLAN Basic Information

12. Web Only.

3-142

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

CLI – Enter the following command.

Console#show bridge-ext

Max support vlan numbers:

Max support vlan ID:

4-195

255

4094

Extended multicast filtering services: No

Static entry individual port:

VLAN learning:

Yes

IVL

Configurable PVID tagging:

Local VLAN capable:

Traffic classes:

Global GVRP status:

GMRP:

Yes

Enabled

Disabled

Console#

Displaying Current VLANs

The VLAN Current Table shows the current port members of each VLAN and

whether or not the port supports VLAN tagging. Ports assigned to a large VLAN

group that crosses several switches should use VLAN tagging. However, if you just

want to create a small port-based VLAN for one or two switches, you can disable

tagging.

Command Attributes (Web)

• VLAN ID – ID of configured VLAN (1-4094).

• Up Time at Creation – Time this VLAN was created (i.e., System Up Time).

• Status – Shows how this VLAN was added to the switch.

- Dynamic GVRP: Automatically learned via GVRP.

- Permanent: Added as a static entry.

• Egress Ports – Shows all the VLAN port members.

• Untagged Ports – Shows the untagged VLAN port members.

3-143

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click VLAN, 802.1Q VLAN, Current Table. Select any ID from the scroll-down

list.

Figure 3-78 VLAN Current Table

Command Attributes (CLI)

• VLAN – ID of configured VLAN (1-4094, no leading zeroes).

• Type – Shows how this VLAN was added to the switch.

- Dynamic: Automatically learned via GVRP.

- Static: Added as a static entry.

• Name – Name of the VLAN (1 to 32 characters).

• Status – Shows if this VLAN is enabled or disabled.

- Active: VLAN is operational.

- Suspend: VLAN is suspended; i.e., does not pass packets.

• Ports / Channel groups – Shows the VLAN interface members.

3-144

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

CLI – Current VLAN information can be displayed with the following command.

Console#show vlan id 1

4-187

Vlan ID:

Type:

Name:

Static

DefaultVlan

Active

Status:

Ports/Port channel: Eth1/ 1(S) Eth1/ 2(S) Eth1/ 3(S) Eth1/ 4(S) Eth1/ 5(S)

Eth1/ 6(S) Eth1/ 7(S) Eth1/ 8(S) Eth1/ 9(S) Eth1/10(S)

Eth1/11(S) Eth1/12(S) Eth1/13(S) Eth1/14(S) Eth1/15(S)

Eth1/16(S) Eth1/17(S) Eth1/18(S) Eth1/19(S) Eth1/20(S)

Eth1/21(S) Eth1/22(S) Eth1/23(S) Eth1/24(S) Eth1/25(S)

Eth1/26(S) Eth1/27(S) Eth1/28(S) Eth1/29(S) Eth1/30(S)

Eth1/31(S) Eth1/32(S) Eth1/33(S) Eth1/34(S) Eth1/35(S)

Eth1/36(S) Eth1/37(S) Eth1/38(S) Eth1/39(S) Eth1/40(S)

Eth1/41(S) Eth1/42(S) Eth1/43(S) Eth1/44(S) Eth1/45(S)

Eth1/46(S) Eth1/47(S) Eth1/48(S) Eth1/49(S) Eth1/50(S)

Eth1/51(S) Eth1/52(S)

Console#

Creating VLANs

Use the VLAN Static List to create or remove VLAN groups. To propagate

information about VLAN groups used on this switch to external network devices, you

must specify a VLAN ID for each of these groups.

Command Attributes

• Current – Lists all the current VLAN groups created for this system. Up to 255

VLAN groups can be defined. VLAN 1 is the default untagged VLAN.

• New – Allows you to specify the name and numeric identifier for a new VLAN

group. (The VLAN name is only used for management on this system; it is not

added to the VLAN tag.)

• VLAN ID – ID of configured VLAN (1-4094, no leading zeroes).

• VLAN Name – Name of the VLAN (1 to 32 characters).

• Status (Web) – Enables or disables the specified VLAN.

- Enabled: VLAN is operational.

- Disabled: VLAN is suspended; i.e., does not pass packets.

• State (CLI) – Enables or disables the specified VLAN.

- Active: VLAN is operational.

- Suspend: VLAN is suspended; i.e., does not pass packets.

• Add – Adds a new VLAN group to the current list.

• Remove – Removes a VLAN group from the current list. If any port is assigned to

this group as untagged, it will be reassigned to VLAN group 1 as untagged.

3-145

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click VLAN, 802.1Q VLAN, Static List. To create a new VLAN, enter the

VLAN ID and VLAN name, mark the Enable checkbox to activate the VLAN, and

then click Add.

Figure 3-79 VLAN Static List - Creating VLANs

CLI – This example creates a new VLAN.

Console(config)#vlan database

Console(config-vlan)#vlan 2 name R&D media ethernet state active

Console(config-vlan)#end

4-180

Console#show vlan

4-187

Vlan ID:

Type:

Name:

Static

DefaultVlan

Active

Status:

Ports/Port channel: Eth1/ 1(S) Eth1/ 2(S) Eth1/ 3(S) Eth1/ 4(S) Eth1/ 5(S)

Eth1/ 6(S) Eth1/ 7(S) Eth1/ 8(S) Eth1/ 9(S) Eth1/10(S)

Eth1/11(S) Eth1/12(S) Eth1/13(S) Eth1/14(S) Eth1/15(S)

Eth1/16(S) Eth1/17(S) Eth1/18(S) Eth1/19(S) Eth1/20(S)

Eth1/21(S) Eth1/22(S) Eth1/23(S) Eth1/24(S) Eth1/25(S)

Eth1/26(S) Eth1/27(S) Eth1/28(S) Eth1/29(S) Eth1/30(S)

Eth1/31(S) Eth1/32(S) Eth1/33(S) Eth1/34(S) Eth1/35(S)

Eth1/36(S) Eth1/37(S) Eth1/38(S) Eth1/39(S) Eth1/40(S)

Eth1/41(S) Eth1/42(S) Eth1/43(S) Eth1/44(S) Eth1/45(S)

Eth1/46(S) Eth1/47(S) Eth1/48(S) Eth1/49(S) Eth1/50(S)

Eth1/51(S) Eth1/52(S)

Vlan ID:

Type:

Name:

Static

R&D

Status:

Active

Ports/Port Channel:

Console#

3-146

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

Adding Static Members to VLANs (VLAN Index)

Use the VLAN Static Table to configure port members for the selected VLAN index.

Assign ports as tagged if they are connected to 802.1Q VLAN compliant devices, or

untagged they are not connected to any VLAN-aware devices. Or configure a port

as forbidden to prevent the switch from automatically adding it to a VLAN via the

GVRP protocol.

Notes: 1. You can also use the VLAN Static Membership by Port page to configure

VLAN groups based on the port index (page 3-148). However, note that this

configuration page can only add ports to a VLAN as tagged members.

2. VLAN 1 is the default untagged VLAN containing all ports on the switch, and

can only be modified by first reassigning the default port VLAN ID as

described under “Configuring VLAN Behavior for Interfaces” on page 3-150.

Command Attributes

• VLAN – ID of configured VLAN (1-4094).

• Name – Name of the VLAN (1 to 32 characters).

• Status – Enables or disables the specified VLAN.

- Enable: VLAN is operational.

- Disable: VLAN is suspended; i.e., does not pass packets.

• Port – Port identifier.

• Membership Type – Select VLAN membership for each interface by marking the

appropriate radio button for a port or trunk:

- Tagged: Interface is a member of the VLAN. All packets transmitted by the port

will be tagged, that is, carry a tag and therefore carry VLAN or CoS information.

- Untagged: Interface is a member of the VLAN. All packets transmitted by the

port will be untagged, that is, not carry a tag and therefore not carry VLAN or

CoS information. Note that an interface must be assigned to at least one group

as an untagged port.

- Forbidden: Interface is forbidden from automatically joining the VLAN via

GVRP. For more information, see “Automatic VLAN Registration” on page

3-140.

- None: Interface is not a member of the VLAN. Packets associated with this

VLAN will not be transmitted by the interface.

• Trunk Member – Indicates if a port is a member of a trunk. To add a trunk to the

selected VLAN, use the last table on the VLAN Static Table page.

3-147

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click VLAN, 802.1Q VLAN, Static Table. Select a VLAN ID from the

scroll-down list. Modify the VLAN name and status if required. Select the

membership type by marking the appropriate radio button in the list of ports or

trunks. Click Apply.

Figure 3-80 VLAN Static Table - Adding Static Members

CLI – The following example adds tagged and untagged ports to VLAN 2.

Console(config)#interface ethernet 1/1

Console(config-if)#switchport allowed vlan add 2 tagged

Console(config-if)#exit

4-185

Console(config)#interface ethernet 1/2

Console(config-if)#switchport allowed vlan add 2 untagged

Console(config-if)#exit

Console(config)#interface ethernet 1/13

Console(config-if)#switchport allowed vlan add 2 tagged

Console(config-if)#

Adding Static Members to VLANs (Port Index)

Use the VLAN Static Membership by Port menu to assign VLAN groups to the

selected interface as a tagged member.

Command Attributes

• Interface – Port or trunk identifier.

• Member – VLANs for which the selected interface is a tagged member.

• Non-Member – VLANs for which the selected interface is not a tagged member.

3-148

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

Web – Open VLAN, 802.1Q VLAN, Static Membership by Port. Select an interface

from the scroll-down box (Port or Trunk). Click Query to display membership

information for the interface. Select a VLAN ID, and then click Add to add the

interface as a tagged member, or click Remove to remove the interface. After

configuring VLAN membership for each interface, click Apply.

Figure 3-81 VLAN Static Membership by Port

CLI – This example adds Port 3 to VLAN 1 as a tagged port, and removes Port 3

from VLAN 2.

Console(config)#interface ethernet 1/3

Console(config-if)#switchport allowed vlan add 1 tagged

Console(config-if)#switchport allowed vlan remove 2

Console(config-if)#

4-185

3-149

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Configuring VLAN Behavior for Interfaces

You can configure VLAN behavior for specific interfaces, including the default VLAN

identifier (PVID), accepted frame types, ingress filtering, GVRP status, and GARP

timers.

Command Usage

• GVRP – GARP VLAN Registration Protocol defines a way for switches to

exchange VLAN information in order to automatically register VLAN members on

interfaces across the network.

• GARP – Group Address Registration Protocol is used by GVRP to register or

deregister client attributes for client services within a bridged LAN. The default

values for the GARP timers are independent of the media access method or data

rate. These values should not be changed unless you are experiencing difficulties

with GVRP registration/deregistration.

Command Attributes

• PVID – VLAN ID assigned to untagged frames received on the interface. (Default: 1)

- If an interface is not a member of VLAN 1 and you assign its PVID to this VLAN,

the interface will automatically be added to VLAN 1 as an untagged member. For

all other VLANs, an interface must first be configured as an untagged member

before you can assign its PVID to that group.

• Acceptable Frame Type – Sets the interface to accept all frame types, including

tagged or untagged frames, or only tagged frames. When set to receive all frame

types, any received frames that are untagged are assigned to the default VLAN.

(Options: All, Tagged; Default: All)

• Ingress Filtering – Determines how to process frames tagged for VLANs for which

the ingress port is not a member. (Default: Disabled)

- Ingress filtering only affects tagged frames.

- If ingress filtering is disabled and a port receives frames tagged for VLANs for

which it is not a member, these frames will be flooded to all other ports (except

for those VLANs explicitly forbidden on this port).

- If ingress filtering is enabled and a port receives frames tagged for VLANs for

which it is not a member, these frames will be discarded.

Ingress filtering does not affect VLAN independent BPDU frames, such as GVRP

or STP. However, they do affect VLAN dependent BPDU frames, such as GMRP.

• GVRP Status – Enables/disables GVRP for the interface. GVRP must be globally

enabled for the switch before this setting can take effect. (See “Displaying Bridge

Extension Capabilities” on page 3-13.) When disabled, any GVRP packets

received on this port will be discarded and no GVRP registrations will be

propagated from other ports. (Default: Disabled)

• GARP Join Timer – The interval between transmitting requests/queries to

participate in a VLAN group. (Range: 20-1000 centiseconds; Default: 20)

13. Timer settings should follow this rule: 2 x (join timer) < leave timer < leaveAll timer

3-150

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

• GARP Leave Timer – The interval a port waits before leaving a VLAN group.

This time should be set to more than twice the join time. This ensures that after a

Leave or LeaveAll message has been issued, the applicants can rejoin before the

port actually leaves the group. (Range: 60-3000 centiseconds; Default: 60)

• GARP LeaveAll Timer – The interval between sending out a LeaveAll query

message for VLAN group participants and the port leaving the group. This interval

should be considerably larger than the Leave Time to minimize the amount of traffic

generated by nodes rejoining the group.

(Range: 500-18000 centiseconds; Default: 1000)

• Mode – Indicates VLAN membership mode for an interface. (Default: Hybrid)

- 1Q Trunk – Specifies a port as an end-point for a VLAN trunk. A trunk is a direct

link between two switches, so the port transmits tagged frames that identify the

source VLAN. Note that frames belonging to the port’s default VLAN (i.e.,

associated with the PVID) are also transmitted as tagged frames.

- Hybrid – Specifies a hybrid VLAN interface. The port may transmit tagged or

untagged frames.

• Trunk Member – Indicates if a port is a member of a trunk. To add a trunk to the

selected VLAN, use the last table on the VLAN Static Table page.

Web – Click VLAN, 802.1Q VLAN, Port Configuration or VLAN Trunk Configuration.

Fill in the required settings for each interface, click Apply.

Figure 3-82 VLAN Port Configuration

3-151

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This example sets port 3 to accept only tagged frames, assigns PVID 3 as the

native VLAN ID, enables GVRP, sets the GARP timers, and then sets the switchport

mode to hybrid.

Console(config)#interface ethernet 1/3

Console(config-if)#switchport acceptable-frame-types tagged

Console(config-if)#switchport ingress-filtering

Console(config-if)#switchport native vlan 3

Console(config-if)#switchport gvrp

Console(config-if)#garp timer join 20

Console(config-if)#garp timer leave 90

Console(config-if)#garp timer leaveall 2000

Console(config-if)#switchport mode hybrid

Console(config-if)#

Private VLANs

Private VLANs provide port-based security and isolation between ports within

the assigned VLAN. This switch supports two types of private VLANs: primary/

secondary associated groups, and stand-alone isolated VLANs. A primary VLAN

contains promiscuous ports that can communicate with all other ports in the private

VLAN group, while a secondary (or community) VLAN contains community ports

that can only communicate with other hosts within the secondary VLAN and with any

of the promiscuous ports in the associated primary VLAN. Isolated VLANs, on the

other hand, consist a single stand-alone VLAN that contains one promiscuous port

and one or more isolated (or host) ports. In all cases, the promiscuous ports are

designed to provide open access to an external network such as the Internet, while

the community or isolated ports provide restricted access to local users.

Multiple primary VLANs can be configured on this switch, and multiple community

VLANs can be associated with each primary VLAN. One or more isolated VLANs

can also be configured. (Note that private VLANs and normal VLANs can exist

simultaneously within the same switch.)

To configure primary/secondary associated groups, follow these steps:

1. Use the Private VLAN Configuration menu (page 3-154) to designate one or

more community VLANs, and the primary VLAN that will channel traffic outside

of the VLAN groups.

2. Use the Private VLAN Association menu (page 3-154) to map the secondary

(i.e., community) VLAN(s) to the primary VLAN.

3. Use the Private VLAN Port Configuration menu (page 3-156) to set the port

type to promiscuous (i.e., having access to all ports in the primary VLAN), or

host (i.e., having access restricted to community VLAN members, and

channeling all other traffic through promiscuous ports). Then assign any

promiscuous ports to a primary VLAN and any host ports a community VLAN.

To configure an isolated VLAN, follow these steps:

1. Use the Private VLAN Configuration menu (page 3-154) to designate an

isolated VLAN that will channel all traffic through a single promiscuous port.

3-152

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

2. Use the Private VLAN Port Configuration menu (page 3-156) to set the port

type to promiscuous (i.e., the single channel to the external network), or

isolated (i.e., having access only to the promiscuous port in its own VLAN).

Then assign the promiscuous port and all host ports to an isolated VLAN.

Displaying Current Private VLANs

The Private VLAN Information page displays information on the private VLANs

configured on the switch, including primary, community, and isolated VLANs, and

their assigned interfaces.

Command Attributes

• VLAN ID – ID of configured VLAN (1-4094), and VLAN type.

• Primary VLAN – The VLAN with which the selected VLAN ID is associated. A

primary VLAN displays its own ID, a community VLAN displays the associated

primary VLAN, and an isolated VLAN displays the stand-alone VLAN.

• Ports List – The list of ports (and assigned port type) in the selected private VLAN.

Web – Click VLAN, Private VLAN, Information. Select the desired port from the

VLAN ID drop-down menu.

Figure 3-83 Private VLAN Information

CLI – This example shows the switch configured with primary VLAN 5 and

secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped

to VLAN 5, while ports 4 and 5 have been configured as a host ports and are

associated with VLAN 6. This means that traffic for port 4 and 5 can only pass

through port 3.

Console#show vlan private-vlan

Primary Secondary Type

-------- ----------- ---------- --------------------------------------

4-153

Interfaces

primary

community

Eth1/ 3

Eth1/ 4 Eth1/ 5

Console#

3-153

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Configuring Private VLANs

The Private VLAN Configuration page is used to create/remove primary, community,

or isolated VLANs.

Command Attributes

• VLAN ID – ID of configured VLAN (1-4094).

• Type – There are three types of VLANs within a private VLAN:

- Primary VLANs – Conveys traffic between promiscuous ports, and to

community ports within secondary (or community) VLANs.

- Community VLANs - Conveys traffic between community ports, and to their

promiscuous ports in the associated primary VLAN.

- Isolated VLANs – Conveys traffic only between the VLAN’s isolated ports and

the promiscuous port. Traffic between isolated ports within the VLAN is blocked.

• Current – Displays a list of the currently configured VLANs.

Web – Click VLAN, Private VLAN, Configuration. Enter the VLAN ID number, select

Primary, Isolated or Community type, then click Add. To remove a private VLAN from

the switch, highlight an entry in the Current list box and then click Remove. Note that

all member ports must be removed from the VLAN before it can be deleted.

Figure 3-84 Private VLAN Configuration

CLI – This example configures VLAN 5 as a primary VLAN, and VLAN 6 as a

community VLAN and VLAN 7 as an isolated VLAN.

Console(config)#vlan database

4-189

Console(config-vlan)#private-vlan 5 primary

Console(config-vlan)#private-vlan 6 community

Console(config-vlan)#private-vlan 7 isolated

Console(config-vlan)#

Associating VLANs

Each community or isolated VLAN must be associated with a primary VLAN.

Command Attributes

• Primary VLAN ID – ID of primary VLAN (1-4094).

• Association – Community VLANs associated with the selected primary VLAN.

• Non-Association – Community VLANs not associated with the selected VLAN.

3-154

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

Web – Click VLAN, Private VLAN, Association. Select the required primary VLAN

from the scroll-down box, highlight one or more community VLANs in the

Non-Association list box, and click Add to associate these entries with the selected

primary VLAN. (A community VLAN can only be associated with one primary VLAN.)

Figure 3-85 Private VLAN Association

CLI – This example associates community VLANs 6 and 7 with primary VLAN 5.

Console(config)#vlan database

4-190

Console(config-vlan)#private-vlan 5 association 6

Console(config-vlan)#private-vlan 5 association 7

Console(config-vlan)#

Displaying Private VLAN Interface Information

Use the Private VLAN Port Information and Private VLAN Trunk Information menus

to display the interfaces associated with private VLANs.

Command Attributes

• Port/Trunk – The switch interface.

• PVLAN Port Type – Displays private VLAN port types.

- Normal – The port is not configured in a private VLAN.

- Host – The port is a community port and can only communicate with other ports

in its own community VLAN, and with the designated promiscuous port(s). Or the

port is an isolated port that can only communicate with the lone promiscuous

port within its own isolated VLAN.

- Promiscuous – A promiscuous port can communicate with all the interfaces

within a private VLAN.

• Primary VLAN – Conveys traffic between promiscuous ports, and between

promiscuous ports and community ports within the associated secondary VLANs.

• Community VLAN – A community VLAN conveys traffic between community

ports, and from community ports to their designated promiscuous ports.

• Isolated VLAN – Conveys traffic only between the VLAN’s isolated ports and

promiscuous ports. Traffic between isolated ports within the VLAN is blocked.

• Trunk – The trunk identifier. (Port Information only)

3-155

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click VLAN, Private VLAN, Port Information or Trunk Information.

Figure 3-86 Private VLAN Port Information

CLI – This example shows the switch configured with primary VLAN 5 and

community VLAN 6. Port 3 has been configured as a promiscuous port and mapped

to VLAN 5, while ports 4 and 5 have been configured as host ports and associated

with VLAN 6. This means that traffic for port 4 and 5 can only pass through port 3.

Console#show vlan private-vlan

Primary Secondary Type

-------- ----------- ---------- ------------------------------

4-193

Interfaces

primary

community

Eth1/ 3

Eth1/ 4 Eth1/ 5

Console#

Configuring Private VLAN Interfaces

Use the Private VLAN Port Configuration and Private VLAN Trunk Configuration

menus to set the private VLAN interface type, and associate the interfaces with a

private VLAN.

Command Attributes

• Port/Trunk – The switch interface.

• PVLAN Port Type – Sets the private VLAN port types.

- Normal – The port is not assigned to a private VLAN.

- Host – The port is a community port or an isolated port. A community port can

communicate with other ports in its own community VLAN and with designated

promiscuous port(s). An isolated port can only communicate with the single

designated promiscuous port in the isolated VLAN; it cannot communicate with

any other host ports.

- Promiscuous – A promiscuous port can communicate with all interfaces within

a private VLAN.

• Primary VLAN – Conveys traffic between promiscuous ports, and between

promiscuous ports and community ports within the associated secondary VLANs.

If PVLAN type is “Promiscuous,” then specify the associated primary VLAN.

3-156

Download from Www.Somanuals.com. All Manuals Search And Download.

VLAN Configuration

• Community VLAN – A community VLAN conveys traffic between community

ports, and from community ports to their designated promiscuous ports. Set

PVLAN Port Type to “Host,” and then specify the associated Community VLAN.

• Isolated VLAN – Conveys traffic only between the VLAN’s isolated ports and the

promiscuous port. Traffic between isolated ports within the VLAN is blocked. Set

the PVLAN Port Type to “Host,” then specify an isolated VLAN by marking the

check box for an “Isolated VLAN,” and selecting the required VLAN from the

drop-down box.

Web – Click VLAN, Private VLAN, Port Configuration or Trunk Configuration. Set the

PVLAN Port Type for each port that will join a private VLAN. Assign promiscuous

ports to a primary or isolated VLAN. Assign host ports to a community or isolated

VLAN. After all the ports have been configured, click Apply.

Figure 3-87 Private VLAN Port Configuration

CLI – This example shows the switch configured with primary VLAN 5 and

secondary VLAN 6. Port 3 has been configured as a promiscuous port and mapped

to VLAN 5, while ports 4 and 5 have been configured as a host ports and associated

with VLAN 6. This means that traffic for port 4 and 5 can only pass through port 3.

Console(config)#interface ethernet 1/3Console(config-if)#switchportmode

private-vlan promiscuous

Console(config-if)#switchport private-vlan mapping 5

Console(config-if)#exit

4-191

4-193

Console(config)#interface ethernet 1/4

Console(config-if)#switchport mode private-vlan host

Console(config-if)#switchport private-vlan host-association 6

Console(config-if)#exit

4-191

Console(config)#interface ethernet 1/5

Console(config-if)#switchport mode private-vlan host

Console(config-if)#switchport private-vlan host-association 6

Console(config-if)#

3-157

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Class of Service Configuration

Class of Service (CoS) allows you to specify which data packets have greater

precedence when traffic is buffered in the switch due to congestion. This switch

supports CoS with four priority queues for each port. Data packets in a port’s

high-priority queue will be transmitted before those in the lower-priority queues. You

can set the default priority for each interface, and configure the mapping of frame

priority tags to the switch’s priority queues.

Layer 2 Queue Settings

Setting the Default Priority for Interfaces

You can specify the default port priority for each interface on the switch. All untagged

packets entering the switch are tagged with the specified default port priority, and

then sorted into the appropriate priority queue at the output port.

Command Usage

• This switch provides four priority queues for each port. It uses Weighted Round

Robin to prevent head-of-queue blockage.

• The default priority applies for an untagged frame received on a port set to accept

all frame types (i.e, receives both untagged and tagged frames). This priority does

not apply to IEEE 802.1Q VLAN tagged frames. If the incoming frame is an IEEE

802.1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used.

• If the output port is an untagged member of the associated VLAN, these frames are

stripped of all VLAN tags prior to transmission.

Command Attributes

• Default Priority – The priority that is assigned to untagged frames received on

the specified interface. (Range: 0-7, Default: 0)

• Number of Egress Traffic Classes – The number of queue buffers provided for

each port.

14. CLI displays this information as “Priority for untagged traffic.”

3-158

Download from Www.Somanuals.com. All Manuals Search And Download.

Class of Service Configuration

Web – Click Priority, Default Port Priority or Default Trunk Priority. Modify the default

priority for any interface, then click Apply.

Figure 3-88 Port Priority Configuration

CLI – This example assigns a default priority of 5 to port 3.

Console(config)#interface ethernet 1/3

Console(config-if)#switchport priority default 5

4-199

Console(config-if)#end

Console#show interfaces switchport ethernet 1/3

4-140

Information of Eth 1/3

Broadcast threshold:

LACP status:

Disabled

Ingress rate limit: disable, Level: 30

Egress rate limit: disable, Level: 30

VLAN membership mode:

Ingress rule:

Hybrid

Enabled

Acceptable frame type:

Native VLAN:

Tagged frames only

Priority for untagged traffic: 5

GVRP status:

Disabled

Allowed VLAN:

Forbidden VLAN:

Private-VLAN mode:

1(u),

NONE

Private-VLAN host-association: NONE

Private-VLAN mapping:

Console#

NONE

3-159

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Mapping CoS Values to Egress Queues

This switch processes Class of Service (CoS) priority tagged traffic by using four

priority queues for each port, with service schedules based on strict or Weighted

Round Robin (WRR). Up to eight separate traffic priorities are defined in IEEE

802.1p. The default priority levels are assigned according to recommendations in

the IEEE 802.1p standard as shown in the following table.

Table 3-12 Egress Queue Priority Mapping

Queue

Priority

1,2

0,3

4,5

6,7

1,2

0,3

4,5

6,7

Q₀

Q₁

Q₂

Q₃

Serviced

by weighted

round robin

The priority levels recommended in the IEEE 802.1p standard for various network

applications are shown in the following table. However, you can map the priority

levels to the switch’s output queues in any way that benefits application traffic for

your own network.

Table 3-13 CoS Priority Levels

Priority Level

Traffic Type

Background

(Spare)

0 (default)

Best Effort

Excellent Effort

Controlled Load

Video, less than 100 milliseconds latency and jitter

Voice, less than 10 milliseconds latency and jitter

Network Control

Command Attributes

• Priority – CoS value. (Range: 0-7, where 7 is the highest priority)

• Traffic Class – Output queue buffer. (Range: 0-3, where 3 is the highest CoS

priority queue)

15. CLI shows Queue ID.

3-160

Download from Www.Somanuals.com. All Manuals Search And Download.

Class of Service Configuration

Web – Click Priority, Traffic Classes. Assign priorities to the traffic classes (i.e.,

output queues), then click Apply.

Figure 3-89 Traffic Classes

CLI – The following example shows how to change the CoS assignments.

Console(config)#interface ethernet 1/1

Console(config-if)#queue cos-map 0 0

4-201

Console(config-if)#queue cos-map 1 1

Console(config-if)#queue cos-map 2 2

Console(config-if)#end

Console#show queue cos-map ethernet 1/1

4-203

Information of Eth 1/1

CoS Value

: 0 1 2 3 4 5 6 7

Priority Queue: 0 1 2 1 2 2 3 3

Console#

Mapping specific values for CoS priorities is implemented as an interface configuration

command, but any changes will apply to the all interfaces on the switch.

3-161

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Selecting the Queue Mode

You can set the switch to service the queues based on a strict rule that requires all

traffic in a higher priority queue to be processed before lower priority queues are

serviced, or use Weighted Round-Robin (WRR) queuing that specifies a relative

weight of each queue. WRR uses a predefined relative weight for each queue that

determines the percentage of service time the switch services each queue before

moving on to the next queue. This prevents the head-of-line blocking that can occur

with strict priority queuing.

Command Attributes

• WRR - Weighted Round-Robin shares bandwidth at the egress ports by using

scheduling weights 1, 2, 4, 6 for queues 0 through 3 respectively. (This is the

default selection.)

• Strict - Services the egress queues in sequential order, transmitting all traffic in the

higher priority queues before servicing lower priority queues.

Web – Click Priority, Queue Mode. Select Strict or WRR, then click Apply.

Figure 3-90 Queue Mode

CLI – The following sets the queue mode to strict priority service mode.

Console(config)#queue mode wrr

4-199

Console(config)#exit

Console#show queue mode

4-202

Queue mode: wrr

Console#

3-162

Download from Www.Somanuals.com. All Manuals Search And Download.

Class of Service Configuration

Setting the Service Weight for Traffic Classes

This switch uses the Weighted Round Robin (WRR) algorithm to determine the

frequency at which it services each priority queue. As described in “Mapping CoS

Values to Egress Queues” on page 3-160, the traffic classes are mapped to one of

the four egress queues provided for each port. You can assign a weight to each of

these queues (and thereby to the corresponding traffic priorities). This weight sets

the frequency at which each queue will be polled for service, and subsequently

affects the response time for software applications assigned a specific priority value.

Command Attributes

• WRR Setting Table – Displays a list of weights for each traffic class (i.e., queue).

• Weight Value – Set a new weight for the selected traffic class. However, note that

Queue 0 is fixed at a weight of 1, and cannot be configured. (Range: 1-31)

Web – Click Priority, Queue Scheduling. Highlight a traffic class (i.e., output queue),

enter a weight, then click Apply.

Figure 3-91 Configuring Queue Scheduling

CLI – The following example shows how to assign WRR weights to each of the

priority queues.

Console(config)#queue bandwidth 6 9 12

Console(config)#exit

Console#show queue bandwidth

Queue ID Weight

4-200

4-202

-------- ------

Console

16. CLI shows Queue ID.

3-163

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Layer 3/4 Priority Settings

Mapping Layer 3/4 Priorities to CoS Values

This switch supports several common methods of prioritizing layer 3/4 traffic to meet

application requirements. Traffic priorities can be specified in the IP header of a

frame, using the priority bits in the Type of Service (ToS) octet or the number of the

TCP port. If priority bits are used, the ToS octet may contain three bits for IP

Precedence or six bits for Differentiated Services Code Point (DSCP) service. When

these services are enabled, the priorities are mapped to a Class of Service value by

the switch, and the traffic then sent to the corresponding output queue.

Because different priority information may be contained in the traffic, this switch

maps priority values to the output queues in the following manner:

• The precedence for priority mapping is IP Port Priority, IP Precedence or DSCP

Priority, and then Default Port Priority.

• IP Precedence and DSCP Priority cannot both be enabled. Enabling one of these

priority types will automatically disable the other.

Selecting IP Precedence/DSCP Priority

The switch allows you to choose between using IP Precedence or DSCP priority.

Select one of the methods or disable this feature.

Command Attributes

• Disabled – Disables both priority services. (This is the default setting.)

• IP Precedence – Maps layer 3/4 priorities using IP Precedence.

• IP DSCP – Maps layer 3/4 priorities using Differentiated Services Code Point

Mapping.

Web – Click Priority, IP Precedence/DSCP Priority Status. Select Disabled,

IP Precedence or IP DSCP from the scroll-down menu, then click Apply.

Figure 3-92 IP Precedence/DSCP Priority Status

CLI – The following example enables IP Precedence service on the switch.

Console(config)#map ip precedence

Console(config)#

4-204

3-164

Download from Www.Somanuals.com. All Manuals Search And Download.

Class of Service Configuration

Mapping IP Precedence

The Type of Service (ToS) octet in the IPv4 header includes three precedence bits

defining eight different priority levels ranging from highest priority for network control

packets to lowest priority for routine traffic. The default IP Precedence values are

mapped one-to-one to Class of Service values (i.e., Precedence value 0 maps to

CoS value 0, and so forth). Bits 6 and 7 are used for network control, and the other

bits for various application types. ToS bits are defined in the following table.

Table 3-14 Mapping IP Precedence

Priority Level

Traffic Type

Priority Level

Traffic Type

Flash

Network Control

Internetwork Control

Critical

Immediate

Priority

Flash Override

Routine

Command Attributes

• IP Precedence Priority Table – Shows the IP Precedence to CoS map.

• Class of Service Value – Maps a CoS value to the selected IP Precedence value.

Note that “0” represents low priority and “7” represent high priority.

Web – Click Priority, IP Precedence Priority. Select an entry from the IP Precedence

Priority Table, enter a value in the Class of Service Value field, and then click Apply.

Figure 3-93 Mapping IP Precedence Priority Values

3-165

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – The following example globally enables IP Precedence service on the switch,

maps IP Precedence value 1 to CoS value 0 (on port 1), and then displays the IP

Precedence settings.

Console(config)#map ip precedence

Console(config)#interface ethernet 1/1

Console(config-if)#map ip precedence 1 cos 0

Console(config-if)#end

4-204

4-206

Console#show map ip precedence ethernet 1/1

Precedence mapping status: enabled

4-209

Port

Precedence COS

--------- ---------- ---

Eth 1/ 1

Console#

Note: Mapping specific values for IP Precedence is implemented as an interface

configuration command, but any changes will apply to the all interfaces on the

switch.

Mapping DSCP Priority

The DSCP is six bits wide, allowing coding for up to 64 different forwarding

behaviors. The DSCP replaces the ToS bits, but it retains backward compatibility

with the three precedence bits so that non-DSCP compliant, ToS-enabled devices,

will not conflict with the DSCP mapping. Based on network policies, different kinds of

traffic can be marked for different kinds of forwarding. The DSCP default values are

defined in the following table. Note that all the DSCP values that are not specified

are mapped to CoS value 0.

Table 3-15 Mapping DSCP Priority Values

IP DSCP Value

CoS Value

10, 12, 14, 16

18, 20, 22, 24

26, 28, 30, 32, 34, 36

38, 40, 42

46, 56

3-166

Download from Www.Somanuals.com. All Manuals Search And Download.

Class of Service Configuration

Command Attributes

• DSCP Priority Table – Shows the DSCP Priority to CoS map.

• Class of Service Value – Maps a CoS value to the selected DSCP Priority value.

Note that “0” represents low priority and “7” represent high priority.

Note: IP DSCP settings apply to all interfaces.

Web – Click Priority, IP DSCP Priority. Select an entry from the DSCP table, enter a

value in the Class of Service Value field, then click Apply.

Figure 3-94 Mapping IP DSCP Priority Values

CLI – The following example globally enables DSCP Priority service on the switch,

maps DSCP value 0 to CoS value 1 (on port 1), and then displays the DSCP Priority

settings.

Console(config)#map ip dscp

4-207

4-207

Console(config)#interface ethernet 1/1

Console(config-if)#map ip dscp 1 cos 0

Console(config-if)#end

Console#show map ip dscp ethernet 1/1

DSCP mapping status: disabled

4-210

Port

DSCP COS

--------- ---- ---

Eth 1/ 1

Console#

Note: Mapping specific values for IP DSCP is implemented as an interface configuration

command, but any changes will apply to the all interfaces on the switch.

3-167

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Mapping IP Port Priority

You can also map network applications to Class of Service values based on the IP

port number (i.e., TCP/UDP port number) in the frame header. Some of the more

common TCP service ports include: HTTP: 80, FTP: 21, Telnet: 23 and POP3: 110.

Command Attributes

• IP Port Priority Status – Enables or disables the IP port priority.

• IP Port Priority Table – Shows the IP port to CoS map.

• IP Port Number (TCP/UDP) – Set a new IP port number.

• Class of Service Value – Sets a CoS value for a new IP port. Note that “0”

represents low priority and “7” represent high priority.

Web – Click Priority, IP Port Priority Status. Set IP Port Priority Status to Enabled.

Figure 3-95 IP Port Priority Status

Click Priority, IP Port Priority. Enter the port number for a network application in the

IP Port Number box and the new CoS value in the Class of Service box, and then

click Apply.

Figure 3-96 IP Port Priority

3-168

Download from Www.Somanuals.com. All Manuals Search And Download.

Class of Service Configuration

CLI* – The following example globally enables IP Port Priority service on the switch,

maps HTTP traffic on port 5 to CoS value 0, and then displays all the IP Port Priority

settings for that port.

Console(config)#map ip port

4-204

4-205

Console(config)#interface ethernet 1/5

Console(config-if)#map ip port 80 cos 0

Console(config-if)#end

Console#show map ip port ethernet 1/5

TCP port mapping status: disabled

Port

--------- -------- ---

Eth 1/ 5 80

Console#

Port no. COS

Note: Mapping specific values for IP Port Priority is implemented as an interface

configuration command, but any changes will apply to the all interfaces on the

switch.

Mapping CoS Values to ACLs

Use the ACL CoS Mapping page to set the output queue for packets matching an

ACL rule as shown in the following table. Note that the specified CoS value is only

used to map the matching packet to an output queue; it is not written to the packet

itself. For information on mapping the CoS values to output queues, see page 3-160.

Table 3-16 Egress Queue Priority Mapping

Queue

Priority

1,2

0,3

4,5

6,7

Command Attributes

• Port – Port identifier.

• Name – Name of ACL.

• Type – Type of ACL (IP or MAC).

• CoS Priority – CoS value used for packets matching an IP ACL rule. (Range: 0-7)

• ACL CoS Priority Mapping – Displays the configured information.

17. For information on configuring ACLs, see page 3-82.

3-169

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Priority, ACL CoS Priority. Enable mapping for any port, select an ACL

from the scroll-down list, then click Add.

Figure 3-97 ACL CoS Priority

CLI – This example assigns a CoS value of zero to packets matching rules within

the specified ACL on port 24.

Console(config)#interface ethernet 1/24

Console(config-if)#map access-list ip bill cos 0

Console(config-if)#

4-108

Multicast Filtering

Multicasting is used to support real-time

Unicast

Flow

applications such as videoconferencing or

streaming audio. A multicast server does not have

to establish a separate connection with each

client. It merely broadcasts its service to the

network, and any hosts that want to receive the

multicast register with their local multicast switch/

router. Although this approach reduces the

network overhead required by a multicast server,

the broadcast traffic must be carefully pruned at

every multicast switch/router it passes through to

ensure that traffic is only passed on to the hosts

which subscribed to this service.

Multicast

Flow

This switch uses IGMP (Internet Group

Management Protocol) to query for any attached

hosts that want to receive a specific multicast

service. It identifies the ports containing hosts

3-170

Download from Www.Somanuals.com. All Manuals Search And Download.

Multicast Filtering

requesting to join the service and sends data out to those ports only. It then

propagates the service request up to any neighboring multicast switch/router to

ensure that it will continue to receive the multicast service. This procedure is called

multicast filtering.

The purpose of IP multicast filtering is to optimize a switched network’s

performance, so multicast packets will only be forwarded to those ports containing

multicast group hosts or multicast routers/switches, instead of flooding traffic to all

ports in the subnet (VLAN).

Layer 2 IGMP (Snooping and Query)

IGMP Snooping and Query – If multicast routing is not supported on other switches

in your network, you can use IGMP Snooping and Query (page 3-171) to monitor

IGMP service requests passing between multicast clients and servers, and

dynamically configure the switch ports which need to forward multicast traffic.

Static IGMP Router Interface – If IGMP snooping cannot locate the IGMP querier,

you can manually designate a known IGMP querier (i.e., a multicast router/switch)

connected over the network to an interface on your switch (page 3-175). This

interface will then join all the current multicast groups supported by the attached

router/switch to ensure that multicast traffic is passed to all appropriate interfaces

within the switch.

Static IGMP Host Interface – For multicast applications that you need to control

more carefully, you can manually assign a multicast service to specific interfaces on

the switch (page 3-177).

Configuring IGMP Snooping and Query Parameters

You can configure the switch to forward multicast traffic intelligently. Based on the

IGMP query and report messages, the switch forwards traffic only to the ports that

request multicast traffic. This prevents the switch from broadcasting the traffic to all

ports and possibly disrupting network performance.

Command Usage

• IGMP Snooping – This switch can passively snoop on IGMP Query and Report

packets transferred between IP multicast routers/switches and IP multicast host

groups to identify the IP multicast group members. It simply monitors the IGMP

packets passing through it, picks out the group registration information, and

configures the multicast filters accordingly.

• IGMP Querier – A router, or multicast-enabled switch, can periodically ask their

hosts if they want to receive multicast traffic. If there is more than one router/switch

on the LAN performing IP multicasting, one of these devices is elected “querier”

and assumes the role of querying the LAN for group members. It then propagates

the service requests on to any upstream multicast switch/router to ensure that it will

continue to receive the multicast service.

Note: Multicast routers use this information, along with a multicast routing protocol such

as DVMRP or PIM, to support IP multicasting across the Internet.

3-171

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Command Attributes

• IGMP Status — When enabled, the switch will monitor network traffic to determine

which hosts want to receive multicast traffic. This is also referred to as IGMP

Snooping. (Default: Enabled)

• Act as IGMP Querier — When enabled, the switch can serve as the Querier,

which is responsible for asking hosts if they want to receive multicast traffic.

(Default: Enabled)

• IGMP Query Count — Sets the maximum number of queries issued for which

there has been no response before the switch takes action to drop a client from the

multicast group. (Range: 2-10; Default: 2)

• IGMP Query Interval — Sets the frequency at which the switch sends IGMP

host-query messages. (Range: 60-125 seconds; Default: 125)

• IGMP Report Delay — Sets the time between receiving an IGMP Report for an IP

multicast address on a port before the switch sends an IGMP Query out of that port

and removes the entry from its list. (Range: 5-25 seconds; Default: 10)

•

IGMP Query Timeout — The time the switch waits after the previous querier stops

before it considers the router port (i.e., the interface which had been receiving

query packets) to have expired. (Range: 300-500 seconds; Default: 300)

• IGMP Version — Sets the protocol version for compatibility with other devices on

the network. (Range: 1-2; Default: 2)

Notes: 1. All systems on the subnet must support the same version.

2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay

and IGMP Query Timeout.

Web – Click IGMP Snooping, IGMP Configuration. Adjust the IGMP settings as

required, and then click Apply. (The default settings are shown below.)

Figure 3-98 IGMP Configuration

3-172

Download from Www.Somanuals.com. All Manuals Search And Download.

Multicast Filtering

CLI – This example modifies the settings for multicast filtering, and then displays the

current status.

Console(config)#ip igmp snooping

Console(config)#ip igmp snooping querier

Console(config)#ip igmp snooping query-count 10

Console(config)#ip igmp snooping query-interval 100

Console(config)#ip igmp snooping query-max-response-time 20

Console(config)#ip igmp snooping router-port-expire-time 300

Console(config)#ip igmp snooping version 2

Console(config)#exit

Console#show ip igmp snooping

4-214

Service status

Querier status

Query count

: Enabled

: 10

Query interval

: 100 sec

Query max response time : 20 sec

Router port expire time : 300 sec

IGMP snooping version

Console#

: Version 2

Enabling IGMP Immediate Leave

The IGMP snooping immediate-leave feature enables a Layer 2 LAN interface to be

removed from the multicast forwarding table without first sending an IGMP

group-specific query to the interface. Upon receiving a group-specific IGMPv2 leave

message, the switch immediately removes the interface from the Layer 2 forwarding

table entry for that multicast group, unless a multicast router was learned on the

port.

IGMP immediate leave improves bandwidth management for all hosts in a switched

network.

Command Attributes

• VLAN ID – ID of configured VLAN (1-4093).

• Immediate Leave – Enable or disable IGMP immediate leave for the selected

VLAN.

Web – Click IGMP Snooping, IGMP Immediate Leave.

Figure 3-99 IGMP Immediate Leave

3-173

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This example enables IGMP immediate leave for VLAN 1 and then displays

the current IGMP snooping status.

Console(config)#interface vlan 1

Console(config-if)#ip igmp snooping immediate-leave

Console(config-if)#end

Console#show ip igmp snooping

4-213

4-214

Service status:

Querier status:

Query count:

Enabled

Query interval:

125 sec

Query max response time: 10 sec

Router port expire time: 300 sec

Immediate Leave Processing: Enabled on VLAN

IGMP snooping version:

Console#

Version 2

Displaying Interfaces Attached to a Multicast Router

Multicast routers that are attached to ports on the switch use information obtained

from IGMP, along with a multicast routing protocol such as DVMRP or PIM, to

support IP multicasting across the Internet. These routers may be dynamically

discovered by the switch or statically assigned to an interface on the switch.

You can use the Multicast Router Port Information page to display the ports on this

switch attached to a neighboring multicast router/switch for each VLAN ID.

Command Attributes

• VLAN ID – ID of configured VLAN (1-4094).

• Multicast Router List – Multicast routers dynamically discovered by this switch or

those that are statically assigned to an interface on this switch.

Web – Click IGMP Snooping, Multicast Router Port Information. Select the required

VLAN ID from the scroll-down list to display the associated multicast routers.

Figure 3-100 Displaying Multicast Router Port Information

3-174

Download from Www.Somanuals.com. All Manuals Search And Download.

Multicast Filtering

CLI – This example shows that Port 11 has been statically configured as a port

attached to a multicast router.

Console#show ip igmp snooping mrouter vlan 1

VLAN M'cast Router Port Type

4-220

---- ------------------ -------

Eth 1/11 Static

Console#

Specifying Static Interfaces for a Multicast Router

Depending on your network connections, IGMP snooping may not always be able to

locate the IGMP querier. Therefore, if the IGMP querier is a known multicast router/

switch connected over the network to an interface (port or trunk) on your switch, you

can manually configure the interface (and a specified VLAN) to join all the current

multicast groups supported by the attached router. This can ensure that multicast

traffic is passed to all the appropriate interfaces within the switch.

Command Attributes

• Interface – Activates the Port or Trunk scroll down list.

• VLAN ID – Selects the VLAN to propagate all multicast traffic coming from the

attached multicast router.

• Port or Trunk – Specifies the interface attached to a multicast router.

Web – Click IGMP Snooping, Static Multicast Router Port Configuration. Specify the

interfaces attached to a multicast router, indicate the VLAN which will forward all the

corresponding multicast traffic, and then click Add. After you have finished adding

interfaces to the list, click Apply.

Figure 3-101 Static Multicast Router Port Configuration

CLI – This example configures port 11 as a multicast router port within VLAN 1.

Console(config)#ip igmp snooping vlan 1 mrouter ethernet 1/11

Console(config)#exit

Console#show ip igmp snooping mrouter vlan 1

VLAN M'cast Router Port Type

4-219

4-220

---- ------------------ -------

Eth 1/11 Static

Console#

3-175

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Displaying Port Members of Multicast Services

You can display the port members associated with a specified VLAN and multicast

service.

Command Attributes

• VLAN ID – Selects the VLAN for which to display port members.

• Multicast IP Address – The IP address for a specific multicast service.

• Multicast Group Port List – Shows the interfaces that have already been

assigned to the selected VLAN to propagate a specific multicast service.

Web – Click IGMP Snooping, IP Multicast Registration Table. Select a VLAN ID and

the IP address for a multicast service from the scroll-down lists. The switch will

display all the interfaces that are propagating this multicast service.

Figure 3-102 IP Multicast Registration Table

CLI – This example displays all the known multicast services supported on VLAN 1,

along with the ports propagating the corresponding services. The Type field shows if

this entry was learned dynamically or was statically configured.

Console#show bridge 1 multicast vlan 1

VLAN M'cast IP addr. Member ports Type

---- --------------- ------------ -------

4-215

224.1.1.12

224.1.2.3

Eth1/12

USER

IGMP

Console#

3-176

Download from Www.Somanuals.com. All Manuals Search And Download.

Multicast Filtering

Assigning Ports to Multicast Services

Multicast filtering can be dynamically configured using IGMP Snooping and IGMP

Query messages as described in “Configuring IGMP snooping and Query

Parameters” on page 3-133. For certain applications that require tighter control, you

may need to statically configure a multicast service on the switch. First add all the

ports attached to participating hosts to a common VLAN, and then assign the

multicast service to that VLAN group.

Command Usage

• Static multicast addresses are never aged out.

• When a multicast address is assigned to an interface in a specific VLAN, the

corresponding traffic can only be forwarded to ports within that VLAN.

Command Attributes

• Interface – Activates the Port or Trunk scroll down list.

• VLAN ID – Selects the VLAN to propagate all multicast traffic coming from the

attached multicast router/switch.

• Multicast IP – The IP address for a specific multicast service

• Port or Trunk – Specifies the interface attached to a multicast router/switch.

Web – Click IGMP Snooping, IGMP Member Port Table. Specify the interface

attached to a multicast service (via an IGMP-enabled switch or multicast router),

indicate the VLAN that will propagate the multicast service, specify the multicast IP

address, and click Add. After you have completed adding ports to the member list,

click Apply.

Figure 3-103 IGMP Member Port Table

3-177

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI – This example assigns a multicast address to VLAN 1, and then displays all the

known multicast services supported on VLAN 1.

Console(config)#ip igmp snooping vlan 1 static 224.1.1.12

ethernet 1/12

4-212

Console(config)#exit

Console#show mac-address-table multicast vlan 1

4-215

VLAN M'cast IP addr. Member ports Type

---- --------------- ------------ -------

224.1.1.12

224.1.2.3

Eth1/12

USER

IGMP

Console#

IGMP Filtering and Throttling

In certain switch applications, the administrator may want to control the multicast

services that are available to end users. For example, an IP/TV service based on a

specific subscription plan. The IGMP filtering feature fulfills this requirement by

restricting access to specified multicast services on a switch port and IGMP

throttling limits the number of simultaneous multicast groups a port can join.

IGMP filtering enables you to assign a profile to a switch port that specifies multcast

groups that are permitted or denied on the port. An IGMP filter profile can contain

one or more, or a range of multicast addresses, but only one profile can be assigned

to a port. When enabled, IGMP join reports received on the port are checked against

the filter profile. If a requested multicast group is permitted, the IGMP join report is

forwarded as normal. If a requested multicast group is denied, the IGMP join report

is dropped.

IGMP throttling sets a maximum number of multicast groups that a port can join at

the same time. When the maximum number of groups is reached on a port, the

switch can take one of two actions; either “deny” or “replace.” If the action is set to

deny, any new IGMP join reports will be dropped. If the action is set to replace, the

switch randomly removes an existing group and replaces it with the new multicast

group.

Note: IGMP filtering and throttling only applies to dynamically learned multicast groups, it

does not apply to statically configured groups.

Enabling IGMP Filtering and Throttling

To implement IGMP filtering and throttling on the switch, you must first enable the

feature globally and create IGMP profile numbers.

Command Attributes

• IGMP Filter – Enables IGMP filtering and throttling globally for the switch.

(Default: Disabled)

• IGMP Profile – Creates IGMP profile numbers. (Range: 1-4294967295)

3-178

Download from Www.Somanuals.com. All Manuals Search And Download.

Multicast Filtering

Web – Click IGMP Snooping, IGMP Filter Configuration. Create a profile number by

entering the number in text box and clicking Add. Enable the IGMP filter status, then

click Apply.

Figure 3-104 Enabling IGMP Filtering and Throttling

CLI – This example enables IGMP filtering and creates a profile number, then

displays the current status and the existing profile numbers.

Console(config)#ip igmp filter

4-221

Console(config)#ip igmp profile 19

4-222

Console(config-igmp-profile)#end

Console#show ip igmp filter

IGMP filter enable

Console#show ip igmp profile

IGMP Profile 19

IGMP Profile 50

Console#

Configuring IGMP Filter Profiles

When you have created an IGMP profile number, you can then configure the

multicast groups to filter and set the access mode.

Command Usage

• Each profile has only one access mode; either permit or deny.

• When the access mode is set to permit, IGMP join reports are processed when a

multicast group falls within the controlled range. When the access mode is set to

deny, IGMP join reports are only processed when a multicast group is not in the

controlled range.

3-179

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Command Attributes

• Profile ID – Selects an existing profile number to configure. After selecting an ID

number, click the Query button to display the current configuration.

• Access Mode – Sets the access mode of the profile; either permit or deny.

(Default: Deny)

• New Multicast Address Range List – Specifies multicast groups to include in the

profile. Specify a multicast group range by entering a start and end IP address.

Specify a single multicast group by entering the same IP address for the start and

end of the range. Click the Add button to add a range to the current list.

• Current Multicast Address Range List – Lists multicast groups currently

included in the profile. Select an entry and click the Remove button to delete it from

the list.

Web – Click IGMP Snooping, IGMP Filter Profile Configuration. Select the profile

number you want to configure, then click Query to display the current settings.

Specify the access mode for the profile and then add multicast groups to the profile

list. Click Apply.

Figure 3-105 IGMP Profile Configuration

3-180

Download from Www.Somanuals.com. All Manuals Search And Download.

Multicast Filtering

CLI – This example configures profile number 19 by setting the access mode to

“permit” and then specifying a range of multicast groups that a user can join. The

current profile configuration is then displayed.

Console(config)#ip igmp profile 19

4-222

Console(config-igmp-profile)#permit

4-223

Console(config-igmp-profile)#range 239.1.1.1

4-223

Console(config-igmp-profile)#range 239.2.3.1 239.2.3.100

Console(config-igmp-profile)#end

Console#show ip igmp profile 19

IGMP Profile 19

permit

range 239.1.1.1 239.1.1.1

range 239.2.3.1 239.2.3.100

Console#

Configuring IGMP Filtering and Throttling for Interfaces

Once you have configured IGMP profiles, you can then assign them to interfaces on

the switch. Also, you can set the IGMP throttling number to limit the number of

multicast groups an interface can join at the same time.

Command Usage

• Only one profile can be assigned to an interface.

• An IGMP profile or throttling setting can be applied to a trunk interface. When ports

are configured as trunk members, the trunk uses the settings applied to the first

port member in the trunk.

• IGMP throttling sets a maximum number of multicast groups that a port can join at

the same time. When the maximum number of groups is reached on a port, the

switch can take one of two actions; either “deny” or “replace.” If the action is set to

deny, any new IGMP join reports will be dropped. If the action is set to replace, the

switch randomly removes an existing group and replaces it with the new multicast

group.

Command Attributes

• Profile – Selects an existing profile number to assign to an interface.

• Max Multicast Groups – Sets the maximum number of multicast groups an

interface can join at the same time. (Range: 0-64; Default: 64)

• Current Multicast Groups – Displays the current number of multicast groups the

interface has joined.

• Throttling Action Mode – Sets the action to take when the maximum number of

multicast groups for the interface has been exceeded. (Default: Deny)

• deny - The new multicast group join report is dropped.

• replace - The new multicast group replaces an existing group.

• Throttling Status – Indicates if the throttling action has been implemented on the

interface. (Options: True or False)

3-181

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• Trunk – Indicates if a port is a trunk member.

Web – Click IGMP Snooping, IGMP Filter/Throttling Port Configuration or IGMP

Filter/Throttling Trunk Configuration. Select a profile to assign to an interface, then

set the throttling number and action. Click Apply.

Figure 3-106 IGMP Filter and Throttling Port Configuration

CLI – This example assigns IGMP profile number 19 to port 1, and then sets the

throttling number and action. The current IGMP filtering and throttling settings for the

interface are then displayed.

Console(config)#interface ethernet 1/1

Console(config-if)#ip igmp filter 19

4-224

Console(config-if)#ip igmp max-groups 10

4-224

Console(config-if)#ip igmp max-groups action replace

4-225

Console(config-if)#end

Console#show ip igmp filter interface ethernet 1/1

Global MVR Settings” on page 3-184).

Information of Eth 1/1

IGMP Profile 19

deny

range 239.1.1.1 239.1.1.1

range 239.2.3.1 239.2.3.100

Console#show ip igmp throttle interface ethernet 1/1

4-227

Information of Eth 1/1

status : FALSE

action : replace

max multicast groups : 10

current multicast groups : 1

Console#

3-182

Download from Www.Somanuals.com. All Manuals Search And Download.

Multicast VLAN Registration

Multicast VLAN Registration (MVR) is a protocol that controls access to a single

network-wide VLAN most commonly used for transmitting multicast traffic (such as

television channels or video-on-demand) across a service provider’s network. Any

multicast traffic entering an MVR VLAN is sent to all attached subscribers. This

protocol can significantly reduce to processing overhead required to dynamically

monitor and establish the distribution tree for a normal multicast VLAN. This makes

it possible to support common multicast services over a wide part of the network

without having to use any multicast routing protocol.

MVR maintains the user isolation and data security provided by VLAN segregation

by passing only multicast traffic into other VLANs to which the subscribers belong.

Even though common multicast streams are passed onto different VLAN groups

from the MVR VLAN, users in different IEEE 802.1Q or private VLANs cannot

exchange any information (except through upper-level routing services).

Multicast Router

Satellite Services

Service

Network

Multicast Server

Source

Layer 2 Switch

Port

Receiver

Ports

Set-top Box

General Configuration Guidelines for MVR

1. Enable MVR globally on the switch, select the MVR VLAN, and add the

multicast groups that will stream traffic to attached hosts (see “Configuring

2. Set the interfaces that will join the MVR as source ports or receiver ports (see

“Configuring MVR Interface Status” on page 3-187).

3. Enable IGMP Snooping to a allow a subscriber to dynamically join or leave an

MVR group (see “Configuring IGMP Snooping and Query Parameters” on

page 3-171). Note that only IGMP version 2 or 3 hosts can issue multicast join

or leave messages.

3-183

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

4. For multicast streams that will run for a long term and be associated with a

stable set of hosts, you can statically bind the multicast group to the

participating interfaces (see “Assigning Static Multicast Groups to Interfaces” on

page 3-188).

Configuring Global MVR Settings

The global settings for Multicast VLAN Registration (MVR) include enabling or

disabling MVR for the switch, selecting the VLAN that will serve as the sole channel

for common multicast streams supported by the service provider, and assigning the

multicast group address for each of these services to the MVR VLAN.

Command Attributes

• MVR Status – When MVR is enabled on both the switch, any multicast data

associated an MVR group is sent from all designated source ports, and to all

receiver ports that have registered to receive data from that multicast group.

(Default: Disabled)

• MVR Running Status – Indicates whether or not all necessary conditions in the

MVR environment are satisfied.

• MVR VLAN – Identifier of the VLAN that serves as the channel for streaming

multicast services using MVR. (Range: 1-4094; Default: 1)

• MVR Group IP – IP address for an MVR multicast group. The IP address range of

224.0.0.0 to 239.255.255.255 is used for multicast streams. MVR group addresses

cannot fall within the reserved IP multicast address range of 224.0.0.x. (Range:

224.0.1.0 - 239.255.255.255; Default: no groups are assigned to the MVR VLAN)

• Count – The number of contiguous MVR group addresses. (Range: 1-255;

Default: 0)

Web – Click MVR, Configuration. Enable MVR globally on the switch, select the

MVR VLAN, add the multicast groups that will stream traffic to attached hosts, and

then click Apply.

Figure 3-107 MVR Global Configuration

3-184

Download from Www.Somanuals.com. All Manuals Search And Download.

Multicast VLAN Registration

CLI – This example first enables IGMP snooping, enables MVR globally, and then

configures a range of MVR group addresses.

Console(config)#ip igmp snooping

Console(config)#mvr

Console(config)#mvr group 228.1.23.1 10

Console(config)#

Displaying MVR Interface Status

You can display information about the interfaces attached to the MVR VLAN.

Field Attributes

• Type – Shows the MVR port type.

• Oper Status – Shows the link status.

• MVR Status – Shows the MVR status. MVR status for source ports is “ACTIVE” if

MVR is globally enabled on the switch. MVR status for receiver ports is “ACTIVE”

only if there are subscribers receiving multicast traffic from one of the MVR groups,

or a multicast group has been statically assigned to an interface.

• Immediate Leave – Shows if immediate leave is enabled or disabled.

• Trunk Member – Shows if port is a trunk member.

Web – Click MVR, Port or Trunk Information.

Figure 3-108 MVR Port Information

CLI – This example shows information about interfaces attached to the MVR VLAN.

Console#show mvr interface

Port

Type

Status

Immediate Leave

------- -------- ------------- ---------------

eth1/1 SOURCE

eth1/2 RECEIVER ACTIVE/UP

Console#

ACTIVE/UP

Disable

18. Port Information only.

3-185

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Displaying Port Members of Multicast Groups

You can display the multicast groups assigned to the MVR VLAN either through

IGMP snooping or static configuration.

Field Attributes

• Group IP – Multicast groups assigned to the MVR VLAN.

• Group Port List – Shows the interfaces with subscribers for multicast services

provided through the MVR VLAN.

Web – Click MVR, Group IP Information.

Figure 3-109 MVR Group IP Information

CLI – This example following shows information about the interfaces associated with

multicast groups assigned to the MVR VLAN.

Console#show mvr interface

MVR Group IP

Status

Members

---------------- -------- -------

225.0.0.1

225.0.0.2

225.0.0.3

225.0.0.4

225.0.0.5

225.0.0.6

225.0.0.7

225.0.0.8

225.0.0.9

225.0.0.10

Console#

ACTIVE

eth1/1(d), eth1/2(s)

INACTIVE None

3-186

Download from Www.Somanuals.com. All Manuals Search And Download.

Multicast VLAN Registration

Configuring MVR Interface Status

Each interface that participates in the MVR VLAN must be configured as an MVR

source port or receiver port. If only one subscriber attached to an interface is

receiving multicast services, you can enable the immediate leave function.

Command Usage

• One or more interfaces may be configured as MVR source ports.

• MVR receiver ports cannot be members of a trunk. Receiver ports can belong to

different VLANs, but should not be configured as a member of the MVR VLAN.

• IGMP snooping can be used to allow a source port or receiver port to dynamically

join or leave multicast groups within the MVR VLAN using the standard rules for

multicast filtering. Multicast groups can also be statically assigned to a source port

or receiver port (see “Assigning Static Multicast Groups to Interfaces” on page

15-15).

• Immediate leave applies only to receiver ports. When enabled, the receiver port is

immediately removed from the multicast group identified in the leave message.

When immediate leave is disabled, the switch follows the standard rules by

sending a group-specific query to the receiver port and waiting for a response to

determine if there are any remaining subscribers for that multicast group before

removing the port from the group list. Using immediate leave can speed up leave\

latency, but should only be enabled on a port attached to one multicast subscriber

to avoid disrupting services to other group members attached to the same

interface. Note that immediate leave does not apply to multicast groups which have

been statically assigned to a port.

Command Attributes

• MVR Type – The following interface types are supported:

- Source – An uplink port that can send and receive multicast data for the groups

assigned to the MVR VLAN.

- Receiver – A subscriber port that can receive multicast data sent through the

MVR VLAN.

- Non-MVR – An interface that does not participate in the MVR VLAN. (This is the

default type.)

• Immediate Leave – Configures the switch to immediately remove an interface

from a multicast stream as soon as it receives a leave message for that group.

• Trunk – Shows if port is a trunk member.

19. Port Information only.

3-187

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click MVR, Port or Trunk Configuration.

Figure 3-110 MVR Port Configuration

CLI – This example configures an MVR source port and receiver port, and then

enables immediate leave on the receiver port.

Console(config)#interface ethernet 1/1

Console(config-if)#mvr type source

Console(config-if)#exit

Console(config)#interface ethernet 1/2

Console(config-if)#mvr type receiver

Console(config-if)#mvr immediate

Console(config-if)#

Assigning Static Multicast Groups to Interfaces

For multicast streams that will run for a long term and be associated with a stable set

of hosts, you can statically bind the multicast group to the participating interfaces.

Command Usage

• Any multicast groups that use the MVR VLAN must be statically assigned to it

under the MVR Configuration menu (see “Configuring Global MVR Settings” on

page 15-10).

• The IP address range from 224.0.0.0 to 239.255.255.255 is used for multicast

streams. MVR group addresses cannot fall within the reserved IP multicast

address range of 224.0.0.x.

Command Attributes

• Interface – Indicates a port or trunk.

• Member – Shows the IP addresses for MVR multicast groups which have been

statically assigned to the selected interface.

• Non-Member – Shows the IP addresses for all MVR multicast groups which have

not been statically assigned to the selected interface.

3-188

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring Domain Name Service

Web – Click MVR, Group Member Configuration. Select a port or trunk from the

“Interface” field, and click Query to display the assigned multicast groups. Select a

multicast address from the displayed lists, and click the Add or Remove button to

modify the Member list.

Figure 3-111 MVR Group Member Configuration

CLI – This example statically assigns a multicast group to a receiver port.

Console(config)#interface ethernet 1/2

Console(config-if)#mvr group 228.1.23.1

Console(config-if)#

Configuring Domain Name Service

The Domain Naming System (DNS) service on this switch allows host names to be

mapped to IP addresses using static table entries or by redirection to other name

servers on the network. When a client device designates this switch as a DNS

server, the client will attempt to resolve host names into IP addresses by forwarding

DNS queries to the switch, and waiting for a response.

You can manually configure entries in the DNS table used for mapping domain

names to IP addresses, configure default domain names, or specify one or more

name servers to use for domain name to address translation.

Configuring General DNS Service Parameters

Command Usage

• To enable DNS service on this switch, first configure one or more name servers,

and then enable domain lookup status.

• To append domain names to incomplete host names received from a DNS client

(i.e., not formatted with dotted notation), you can specify a default domain name or

a list of domain names to be tried in sequential order.

3-189

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

• If there is no domain list, the default domain name is used. If there is a domain list,

the default domain name is not used.

• When an incomplete host name is received by the DNS service on this switch and

a domain name list has been specified, the switch will work through the domain list,

appending each domain name in the list to the host name, and checking with the

specified name servers for a match.

• When more than one name server is specified, the servers are queried in the

specified sequence until a response is received, or the end of the list is reached

with no response.

• Note that if all name servers are deleted, DNS will automatically be disabled.

Command Attributes

• Domain Lookup Status – Enables DNS host name-to-address translation.

• Default Domain Name – Defines the default domain name appended to

incomplete host names. (Range: 1-64 alphanumeric characters)

• Domain Name List – Defines a list of domain names that can be appended to

incomplete host names. (Range: 1-64 alphanumeric characters. 1-5 names)

• Name Server List – Specifies the address of one or more domain name servers

to use for name-to-address resolution. (Range: 1-6 IP addresses)

20. Do not include the initial dot that separates the host name from the domain name.

3-190

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring Domain Name Service

Web – Select DNS, General Configuration. Set the default domain name or list of

domain names, specify one or more name servers to use to use for address

resolution, enable domain lookup status, and click Apply.

Figure 3-112 DNS General Configuration

CLI - This example sets a default domain name and a domain list. However,

remember that if a domain list is specified, the default domain name is not used.

Console(config)#ip domain-name sample.com

Console(config)#ip domain-list sample.com.uk

Console(config)#ip domain-list sample.com.jp

Console(config)#ip name-server 192.168.1.55 10.1.0.55

Console(config)#ip domain-lookup

Console#show dns

Domain Lookup Status:

DNS enabled

Default Domain Name:

.sample.com

Domain Name List:

.sample.com.uk

.sample.com.jp

Name Server List:

192.168.1.55

10.1.0.55

Console#

3-191

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Configuring Static DNS Host to Address Entries

You can manually configure static entries in the DNS table that are used to map

domain names to IP addresses.

Command Usage

• Static entries may be used for local devices connected directly to the attached

network, or for commonly used resources located elsewhere on the network.

• Servers or other network devices may support one or more connections via

multiple IP addresses. If more than one IP address is associated with a host name

in the static table or via information returned from a name server, a DNS client can

try each address in succession, until it establishes a connection with the target

device.

Field Attributes

• Host Name – Name of a host device that is mapped to one or more IP addresses.

(Range: 1-64 characters)

• IP Address – Internet address(es) associated with a host name.

(Range: 1-8 addresses)

• Alias – Displays the host names that are mapped to the same address(es) as a

previously configured entry.

Web – Select DNS, Static Host Table. Enter a host name and one or more

corresponding addresses, then click Apply.

Figure 3-113 DNS Static Host Table

3-192

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring Domain Name Service

CLI - This example maps two address to a host name, and then configures an alias

host name for the same addresses.

Console(config)#ip host rd5 192.168.1.55 10.1.0.55

Console(config)#ip host rd6 10.1.0.55

Console#show hosts

4-233

4-238

Hostname

rd5

Inet address

10.1.0.55 192.168.1.55

Alias

1.rd6

Console#

Displaying the DNS Cache

You can display entries in the DNS cache that have been learned via the designated

name servers.

Field Attributes

• No – The entry number for each resource record.

• Flag – The flag is always “4” indicating a cache entry and therefore unreliable.

• Type – This field includes CNAME which specifies the canonical or primary name

for the owner, and ALIAS which specifies multiple domain names which are

mapped to the same IP address as an existing entry.

• IP – The IP address associated with this record.

• TTL – The time to live reported by the name server.

• Domain – The domain name associated with this record.

Web – Select DNS, Cache.

Figure 3-114 DNS Cache

3-193

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

CLI - This example displays all the resource records learned from the designated

name servers.

Console#show dns cache

4-239

FLAG

TYPE

TTL

DOMAIN

CNAME

ALIAS

CNAME

ALIAS

CNAME

ALIAS

CNAME

207.46.134.222 51

207.46.134.190 51

207.46.134.155 51

207.46.249.222 51

www.microsoft.akadns.net

www.microsoft.com

msn.com.tw

www.msn.com.tw

passportimages.com

www.passportimages.com

global.msads.net

207.46.249.27

POINTER TO:4

207.46.68.27

POINTER TO:6

65.54.131.192

POINTER TO:8

71964

605

165.193.72.190 87

Console#

Switch Clustering

Switch Clustering is a method of grouping switches together to enable centralized

management through a single unit. Switches that support clustering can be grouped

together regardless of physical location or switch type, as long as they are

connected to the same local network.

A switch cluster has a “Commander” unit that is used to manage all other “Member”

switches in the cluster. The management station uses Telnet to communicate

directly with the Commander throught its IP address, and the Commander manages

Member switches using cluster “internal” IP addresses. There can be up to 36

Member switches in one cluster. Cluster switches are limited to within a single IP

subnet.

Once a switch has been configured to be a cluster Commander, it automatically

discovers other cluster-enabled switches in the network. These “Candidate”

switches only become cluster Members when manually selected by the

administrator through the management station.

Note: Cluster Member switches can be managed through only using a Telnet connection

to the Commander. From the Commander CLI prompt, use the “rcommand”

command (see page 4-252) to connect to the Member switch.

Cluster Configuration

To create a switch cluster, first be sure that clustering is enabled on the switch (the

default is enabled), then set the switch as a Cluster Commander. Set a Cluster IP

Pool that does not conflict with the network IP subnet. Cluster IP addresses are

assigned to switches when they become Members and are used for communication

between Member switches and the Commander.

Command Attributes

• Cluster Status – Enables or disables clustering on the switch.

• Cluster Commander – Enables or disables the switch as a cluster Commander.

3-194

Download from Www.Somanuals.com. All Manuals Search And Download.

Switch Clustering

• Role – Indicates the current role of the switch in the cluster; either Commander,

Member, or Candidate.

• Cluster IP Pool – An “internal” IP address pool that is used to assign IP addresses

to Member switches in the cluster. Internal cluster IP addresses are in the form

10.x.x.member-ID. Only the base IP address of the pool needs to be set since

Member IDs can only be between 1 and 36. Note that you cannot change the cluster

IP pool when the switch is currently in Commander mode. Commander mode must first

be disabled.

• Number of Members – The current number of Member switches in the cluster.

• Number of Candidates – The current number of Candidate switches discovered

in the network that are available to become Members.

Web – Click Cluster, Configuration.

Figure 3-115 Cluster Configuration

CLI – This example first enables clustering on the switch, sets the switch as the

cluster Commander, and then configures the cluster IP pool.

Console(config)#cluster

4-249

4-250

Console(config)#cluster commander

Console(config)#cluster ip-pool 10.2.3.4

Console(config)#

Cluster Member Configuration

Adds Candidate switches to the cluster as Members.

Command Attributes

• Member ID – Specify a Member ID number for the selected Candidate switch.

(Range: 1-36)

• MAC Address – Select a discoverd switch MAC address from the Candidate

Table, or enter a specific MAC address of a known switch.

3-195

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

Web – Click Cluster, Member Configuration.

Figure 3-116 Cluster Member Configuration

CLI – This example creates a new cluster Member by specifying the Candidate

switch MAC address and setting a Member ID.

Console(config)#cluster member mac-address 00-12-34-56-78-9a id 5

Console(config)#

4-251

Cluster Member Information

Displays current cluster Member switch information.

Command Attributes

• Member ID – The ID number of the Member switch. (Range: 1-36)

• Role – Indicates the current status of the switch in the cluster.

• IP Address – The internal cluster IP address assigned to the Member switch.

• MAC Address – The MAC address of the Member switch.

• Description – The system description string of the Member switch.

Web – Click Cluster, Member Information.

Figure 3-117 Cluster Member Information

3-196

Download from Www.Somanuals.com. All Manuals Search And Download.

Switch Clustering

CLI – This example shows information about cluster Member switches.

Vty-0#show cluster members

Cluster Members:

4-253

ID:

Role:

Active member

IP Address: 10.254.254.2

MAC Address: 00-12-cf-23-49-c0

Description: 24/48 L2/L4 IPV4/IPV6 GE Switch

Vty-0#

Cluster Candidate Information

Displays information about discovered switches in the network that are already

cluster Members or are available to become cluster Members.

Command Attributes

• Role – Indicates the current status of Candidate switches in the network.

• MAC Address – The MAC address of the Candidate switch.

• Description – The system description string of the Candidate switch.

Web – Click Cluster, Candidate Information.

Figure 3-118 Cluster Candidate Information

CLI – This example shows information about cluster Candidate switches.

Vty-0#show cluster candidates

Cluster Candidates:

4-253

Role

Mac

Description

--------------- ----------------- -----------------------------------------

ACTIVE MEMBER

CANDIDATE

Vty-0#

00-12-cf-23-49-c0 24/48 L2/L4 IPV4/IPV6 GE Switch

00-12-cf-0b-47-a0 24/48 L2/L4 IPV4/IPV6 GE Switch

3-197

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the Switch

3-198

Download from Www.Somanuals.com. All Manuals Search And Download.

Chapter 4: Command Line Interface

This chapter describes how to use the Command Line Interface (CLI).

Using the Command Line Interface

Accessing the CLI

When accessing the management interface for the switch over a direct connection

to the server’s console port, or via a Telnet connection, the switch can be managed

by entering command keywords and parameters at the prompt. Using the switch's

command-line interface (CLI) is very similar to entering commands on a UNIX

system.

Console Connection

To access the switch through the console port, perform these steps:

1. At the console prompt, enter the user name and password. (The default user

names are “admin” and “guest” with corresponding passwords of “admin” and

“guest.”) When the administrator user name and password is entered, the CLI

displays the “Console#” prompt and enters privileged access mode

(i.e., Privileged Exec). But when the guest user name and password is entered,

the CLI displays the “Console>” prompt and enters normal access mode

(i.e., Normal Exec).

2. Enter the necessary commands to complete your desired tasks.

3. When finished, exit the session with the “quit” or “exit” command.

After connecting to the system through the console port, the login screen displays:

User Access Verification

Username: admin

Password:

CLI session with the Standalone Intelligent Switch is opened.

To end the CLI session, enter [Exit].

Console#

Telnet Connection

Telnet operates over the IP transport protocol. In this environment, your

management station and any network device you want to manage over the network

must have a valid IP address. Valid IP addresses consist of four numbers, 0 to 255,

separated by periods. Each address consists of a network portion and host portion.

For example, the IP address assigned to this switch, 10.1.0.1, with subnet mask

255.255.255.0, consists of a network portion (10.1.0) and a host portion (1).

Note: The IP address for this switch is obtained via DHCP by default.

4-1

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

To access the switch through a Telnet session, you must first set the IP address for

the switch, and set the default gateway if you are managing the switch from a

different IP subnet. For example,

Console(config)#interface vlan 1

Console(config-if)#ip address 10.1.0.254 255.255.255.0

Console(config-if)#exit

Console(config)#ip default-gateway 10.1.0.254

If your corporate network is connected to another network outside your office or to

the Internet, you need to apply for a registered IP address. However, if you are

attached to an isolated network, then you can use any IP address that matches the

network segment to which you are attached.

After you configure the switch with an IP address, you can open a Telnet session by

performing these steps:

1. From the remote host, enter the Telnet command and the IP address of the

device you want to access.

2. At the prompt, enter the user name and system password. The CLI will display

the “Vty-n#” prompt for the administrator to show that you are using privileged

access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you

are using normal access mode (i.e., Normal Exec), where n indicates the

number of the current Telnet session.

3. Enter the necessary commands to complete your desired tasks.

4. When finished, exit the session with the “quit” or “exit” command.

After entering the Telnet command, the login screen displays:

Username: admin

Password:

CLI session with the Standalone Intelligent Switch is opened.

To end the CLI session, enter [Exit].

Vty-0#

Note: You can open up to four sessions to the device via Telnet.

4-2

Download from Www.Somanuals.com. All Manuals Search And Download.

Entering Commands

This section describes how to enter CLI commands.

Keywords and Arguments

A CLI command is a series of keywords and arguments. Keywords identify a

command, and arguments specify configuration parameters. For example, in the

command “show interfaces status ethernet 1/5,” show interfaces and status are

keywords, ethernet is an argument that specifies the interface type, and 1/5

specifies the unit/port.

You can enter commands as follows:

• To enter a simple command, enter the command keyword.

• To enter multiple commands, enter each command in the required order. For

example, to enable Privileged Exec command mode, and display the startup

configuration, enter:

Console>enable

Console#show startup-config

• To enter commands that require parameters, enter the required parameters after

the command keyword. For example, to set a password for the administrator,

enter:

Console(config)#username admin password 0 smith

Minimum Abbreviation

The CLI will accept a minimum number of characters that uniquely identify a

command. For example, the command “configure” can be entered as con. If an

entry is ambiguous, the system will prompt for further input.

Command Completion

If you terminate input with a Tab key, the CLI will print the remaining characters of a

partial keyword up to the point of ambiguity. In the “logging history” example, typing

log followed by a tab will result in printing the command up to “logging.”

Getting Help on Commands

You can display a brief description of the help system by entering the help

command. You can also display command syntax by using the “?” character to list

keywords or parameters.

4-3

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Showing Commands

If you enter a “?” at the command prompt, the system will display the first level of

keywords for the current command class (Normal Exec or Privileged Exec) or

configuration class (Global, ACL, Interface, Line or VLAN Database). You can also

display a list of valid keywords for a specific command. For example, the command

“show ?” displays a list of possible show commands:

Console#show ?

access-group

access-list

bridge-ext

calendar

cluster

dns

Access groups

Access lists

Bridge extend information

Date and time information

Display cluster information

DNS information

dot1x

802.1X content

garp

GARP properties

gvrp

history

hosts

GVRP interface information

History information

Host information

interfaces

Interface information

IP information

lacp

LACP statistics

line

log

TTY line information

logging

mac

MAC access lists

mac-address-table Configuration of the address table

management

map

Management IP filter

Maps priority

mvr

CLI_MSG_PRIVILEGE_EXEC_CMD_W2_SHOW_MVR

Network Access

Network Time Protocol configuration

Port Characteristics

network-access

ntp

port

public-key

queue

radius-server

rate-limit

running-config

snmp

sntp

spanning-tree

ssh

Public Key information

Priority queue information

RADIUS server information

Configures rate-limits

Information on the running configuration

Simple Network Management Protocol statistics

Simple Network Time Protocol configuration

Spanning-tree configuration

Secure shell server connections

Startup system configuration

System Information

startup-config

system

tacacs-server

users

version

TACACS server settings

Information about terminal lines

System hardware and software versions

Virtual LAN settings

vlan

Console#show

The command “show interfaces ?” will display the following information:

Console#show interfaces ?

counters

status

switchport

Interface counters information

Interface status information

Interface switchport information

Console#

4-4

Download from Www.Somanuals.com. All Manuals Search And Download.

Entering Commands

Partial Keyword Lookup

If you terminate a partial keyword with a question mark, alternatives that match the

initial letters are provided. (Remember not to leave a space between the command

and question mark.) For example “s?” shows all the keywords starting with “s.”

Console#show s?

snmp

sntp

spanning-tree

ssh

startup-config

system

Console#show s

Negating the Effect of Commands

For many configuration commands you can enter the prefix keyword “no” to cancel

the effect of a command or reset the configuration to the default value. For example,

the logging command will log system messages to a host server. To disable

logging, specify the no logging command. This guide describes the negation effect

for all applicable commands.

Using Command History

The CLI maintains a history of commands that have been entered. You can scroll

back through the history of commands by pressing the up arrow key. Any command

displayed in the history list can be executed again, or first modified and then

executed.

Using the show history command displays a longer list of recently executed

commands.

Understanding Command Modes

The command set is divided into Exec and Configuration classes. Exec commands

generally display information on system status or clear statistical counters.

Configuration commands, on the other hand, modify interface parameters or enable

certain switching functions. These classes are further divided into different modes.

Available commands depend on the selected mode. You can always enter a

question mark “?” at the prompt to display a list of the commands available for the

4-5

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

current mode. The command classes and associated modes are displayed in the

following table:

Table 4-1 Command Modes

Class

Exec

Mode

Normal

Privileged

Configuration

Global

Access Control List

IGMP Profile

Interface

Line

Multiple Spanning Tree

VLAN Database

You must be in Privileged Exec mode to access the Global configuration mode.

You must be in Global Configuration mode to access any of the other configuration modes.

Exec Commands

When you open a new console session on the switch with the user name and

password “guest,” the system enters the Normal Exec command mode (or guest

mode), displaying the “Console>” command prompt. Only a limited number of the

commands are available in this mode. You can access all commands only from the

Privileged Exec command mode (or administrator mode). To access Privilege Exec

mode, open a new console session with the user name and password “admin.” The

system will now display the “Console#” command prompt. You can also enter

Privileged Exec mode from within Normal Exec mode, by entering the enable

command, followed by the privileged level password “super” (page 4-28).

To enter Privileged Exec mode, enter the following user names and passwords:

Username: admin

Password: [admin login password]

CLI session with the Standalone Intelligent Switch is opened.

To end the CLI session, enter [Exit].

Console#

Username: guest

Password: [guest login password]

CLI session with the Standalone Intelligent Switch is opened.

To end the CLI session, enter [Exit].

Console#enable

Password: [privileged level password]

Console#

4-6

Download from Www.Somanuals.com. All Manuals Search And Download.

Entering Commands

Configuration Commands

Configuration commands are privileged level commands used to modify switch

settings. These commands modify the running configuration only and are not saved

when the switch is rebooted. To store the running configuration in non-volatile

storage, use the copy running-config startup-config command.

The configuration commands are organized into different modes:

• Global Configuration - These commands modify the system level configuration,

and include commands such as hostname and snmp-server community.

• Access Control List Configuration - These commands are used for packet filtering.

• Interface Configuration - These commands modify the port configuration such as

speed-duplex and negotiation.

• Line Configuration - These commands modify the console port and Telnet

configuration, and include command such as parity and databits.

• VLAN Configuration - Includes the command to create VLAN groups.

To enter the Global Configuration mode, enter the command configure in Privileged

Exec mode. The system prompt will change to “Console(config)#” which gives you

access privilege to all Global Configuration commands.

Console#configure

Console(config)#

To enter the other modes, at the configuration prompt type one of the following

commands. Use the exit or end command to return to the Privileged Exec mode.

Table 4-2 Configuration Modes

Mode

Command

Prompt

Page

4-11

Line

line {console | vty}

Console(config-line)#

Access

Control List

access-list ip standard

access-list ip extended

access-list mac

Console(config-std-acl)#

Console(config-ext-acl)#

Console(config-mac-acl)#

4-102

Interface

MSTP

interface {ethernet port | port-channel id| vlan id} Console(config-if)#

spanning-tree mst-configuration

vlan database

Console(config-mstp)#

Console(config-vlan)#

VLAN

IGMP Profile ip igmp profile

Console(config-igmp-profile)#

For example, you can use the following commands to enter interface configuration

mode, and then return to Privileged Exec mode

Console(config)#interface ethernet 1/5

Console(config-if)#exit

Console(config)#

4-7

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Command Line Processing

Commands are not case sensitive. You can abbreviate commands and parameters

as long as they contain enough letters to differentiate them from any other currently

available commands or parameters. You can use the Tab key to complete partial

commands, or enter a partial command followed by the “?” character to display a list

of possible matches. You can also use the following editing keystrokes for

command-line processing:

Table 4-3 Command Line Processing

Keystroke

Function

Ctrl-A

Shifts cursor to start of command line.

Shifts cursor to the left one character.

Terminates the current task and displays the command prompt.

Shifts cursor to end of command line.

Shifts cursor to the right one character.

Deletes all characters from the cursor to the end of the line.

Repeats current command line on a new line.

Enters the next command line in the history buffer.

Enters the last command.

Ctrl-B

Ctrl-C

Ctrl-E

Ctrl-F

Ctrl-K

Ctrl-L

Ctrl-N

Ctrl-P

Ctrl-R

Repeats current command line on a new line.

Deletes from the cursor to the beginning of the line.

Deletes the last word typed.

Ctrl-U

Ctrl-W

Esc-B

Moves the cursor back one word.

Esc-D

Deletes from the cursor to the end of the word.

Moves the cursor forward one word.

Esc-F

Delete key or backspace key

Erases a mistake when entering a command.

4-8

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Groups

The system commands can be broken down into the functional groups shown below.

Table 4-4 Command Groups

Command Group

Description

Page

Line

Sets communication parameters for the serial port and Telnet,

including baud rate and console time-out

4-11

General

Basic commands for entering privileged access mode, restarting the

system, or quitting the CLI

4-20

4-25

System Management

Controls system logs, system passwords, user name, browser

management options, and a variety of other system information

Flash/File

Manages code image or switch configuration files

Authentication

Configures logon access using local or remote authentication;

also configures port security, IEEE 802.1X port access control, and

MAC address authentication

Access Control List

Provides filtering for IP frames (based on address, protocol, TCP/UDP

port number or TCP control code) or non-IP frames (based on MAC

address or Ethernet type)

4-102

SNMP

Activates authentication failure traps; configures community access

strings, and trap managers; also configures IP address filtering

4-116

4-142

Interface

Mirror Port

Configures the connection parameters for all Ethernet ports,

aggregated links, and VLANs

Mirrors data to another port for analysis without affecting the data

passing through or the performance of the monitored port

Rate Limiting

Controls the maximum rate for traffic transmitted or received on a port 4-144

Link Aggregation

Statically groups multiple ports into a single logical trunk; configures

Link Aggregation Control Protocol for port trunks

4-145

Address Table

Configures the address table for filtering specified addresses, displays 4-156

current entries, clears the table, or sets the aging time

Spanning Tree

VLANs

Configures Spanning Tree settings for the switch

4-160

Configures VLAN settings, and defines port membership for VLAN

groups; also enables or configures private VLANs

GVRP and

Bridge Extension

Configures GVRP settings that permit automatic VLAN learning;

shows the configuration for the bridge extension MIB

4-194

Priority

Sets port priority for untagged frames, selects strict priority or weighted 4-198

round robin, relative weight for each priority queue, also sets priority for

TCP/UDP traffic types, IP precedence, and DSCP

Multicast Filtering

Configures IGMP multicast filtering, query parameters, specifies ports

attached to a multicast router, and enables multicast VLAN registration

4-211

Domain Name Service

DHCP Relay

Configures DNS services.

Configures DHCP relay and Option 82 functions

Configures IP address for the switch

Configures switch clustering

IP Interface

Switch Cluster

4-9

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

The access mode shown in the following tables is indicated by these abbreviations:

NE (Normal Exec)

PE (Privileged Exec)

IC (Interface Configuration)

LC (Line Configuration)

GC (Global Configuration)

ACL (Access Control List Configuration)

IPC (IGMP Profile Configuration)

VC (VLAN Database Configuration)

MST (Multiple Spanning Tree)

4-10

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Commands

You can access the onboard configuration program by attaching a VT100

compatible device to the server’s serial port. These commands are used to set

communication parameters for the serial port or Telnet (i.e., a virtual terminal).

Table 4-5 Line Commands

Command

Function

Mode

Page

line

Identifies a specific line for configuration and starts the line

configuration mode

4-11

Enables password checking at login

Specifies a password on a line

4-12

4-13

4-14

password

timeout login

response

Sets the interval that the system waits for a user to log into the LC

CLI

exec-timeout

password-thresh

silent-time*

Sets the interval that the command interpreter waits until user LC

input is detected

4-14

4-15

4-16

Sets the password intrusion threshold, which limits the number LC

of failed logon attempts

Sets the amount of time the management console is

inaccessible after the number of unsuccessful logon attempts

exceeds the threshold set by the password-thresh command

databits*

Sets the number of data bits per character that are interpreted LC

and generated by hardware

4-16

parity*

Defines the generation of a parity bit

Sets the terminal baud rate

4-17

4-18

“Understanding Command Modes” on page 4-5.

speed*

stopbits*

disconnect

show line

Sets the number of the stop bits transmitted per byte

Terminates a line connection

Displays a terminal line's parameters

NE, PE

* These commands only apply to the serial port.

line

This command identifies a specific line for configuration, and to process subsequent

line configuration commands.

Syntax

line {console | vty}

• console - Console terminal line.

• vty - Virtual terminal for remote console access (i.e., Telnet).

Default Setting

There is no default line.

Command Mode

Global Configuration

4-11

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Command Usage

Telnet is considered a virtual terminal connection and will be shown as “Vty” in

screen displays such as show users. However, the serial communication

parameters (e.g., databits) do not affect Telnet connections.

Example

To enter console line mode, enter the following command:

Console(config)#line console

Console(config-line)#

Related Commands

show line (4-19)

show users (4-67)

This command enables password checking at login. Use the no form to disable

password checking and allow connections without a password.

Syntax

no login

local - Selects local password checking. Authentication is based on the

user name specified with the username command.

Default Setting

Command Mode

Line Configuration

Command Usage

• There are three authentication modes provided by the switch itself at login:

- login selects authentication by a single global password as specified by the

password line configuration command. When using this method, the

management interface starts in Normal Exec (NE) mode.

- login local selects authentication via the user name and password

specified by the username command (i.e., default setting). When using this

method, the management interface starts in Normal Exec (NE) or Privileged

Exec (PE) mode, depending on the user’s privilege level (0 or 15

respectively).

- no login selects no authentication. When using this method, the

management interface starts in Normal Exec (NE) mode.

• This command controls login authentication via the switch itself. To configure

user names and passwords for remote authentication servers, you must use

the RADIUS or TACACS software installed on those servers.

4-12

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Commands

Example

Console(config-line)#login local

Console(config-line)#

Related Commands

username (4-27)

password (4-13)

password

This command specifies the password for a line. Use the no form to remove the

password.

Syntax

password {0 | 7} password

no password

• {0 | 7} - 0 means plain password, 7 means encrypted password

• password - Character string that specifies the line password.

(Maximum length: 8 characters plain text, 32 encrypted, case sensitive)

Default Setting

No password is specified.

Command Mode

Line Configuration

Command Usage

• When a connection is started on a line with password protection, the system

prompts for the password. If you enter the correct password, the system

shows a prompt. You can use the password-thresh command to set the

number of times a user can enter an incorrect password before the system

terminates the line connection and returns the terminal to the idle state.

• The encrypted password is required for compatibility with legacy password

settings (i.e., plain text or encrypted) when reading the configuration file

during system bootup or when downloading the configuration file from a TFTP

server. There is no need for you to manually configure encrypted passwords.

Example

Console(config-line)#password 0 secret

Console(config-line)#

Related Commands

password-thresh (4-15)

4-13

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

timeout login response

This command sets the interval that the system waits for a user to log into the CLI.

Use the no form to restore the default.

Syntax

timeout login response [seconds]

no timeout login response

seconds - Integer that specifies the timeout interval.

(Range: 0 - 300 seconds; 0: disabled)

Default Setting

• CLI: Disabled (0 seconds)

• Telnet: 600 seconds

Command Mode

Line Configuration

Command Usage

• If a login attempt is not detected within the timeout interval, the connection is

terminated for the session.

• This command applies to both the local console and Telnet connections.

• The timeout for Telnet cannot be disabled.

• Using the command without specifying a timeout restores the default setting.

Example

To set the timeout to two minutes, enter this command:

Console(config-line)#timeout login response 120

Console(config-line)#

Related Commands

silent-time (4-16)

exec-timeout (4-14)

exec-timeout

This command sets the interval that the system waits until user input is detected.

Use the no form to restore the default.

Syntax

exec-timeout [seconds]

no exec-timeout

seconds - Integer that specifies the number of seconds.

(Range: 0-65535 seconds; 0: no timeout)

Default Setting

CLI: No timeout

Telnet: 10 minutes

4-14

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Commands

Command Mode

Line Configuration

Command Usage

• If user input is detected within the timeout interval, the session is kept open;

otherwise the session is terminated.

• This command applies to both the local console and Telnet connections.

• The timeout for Telnet cannot be disabled.

• Using the command without specifying a timeout restores the default setting.

Example

To set the timeout to two minutes, enter this command:

Console(config-line)#exec-timeout 120

Console(config-line)#

Related Commands

silent-time (4-16)

timeout login response (4-13)

password-thresh

This command sets the password intrusion threshold which limits the number of

failed logon attempts. Use the no form to remove the threshold value.

Syntax

password-thresh [threshold]

no password-thresh

threshold - The number of allowed password attempts.

(Range: 1-120; 0: no threshold)

Default Setting

The default value is three attempts.

Command Mode

Line Configuration

Command Usage

• When the logon attempt threshold is reached, the system interface becomes

silent for a specified amount of time before allowing the next logon attempt.

(Use the silent-time command to set this interval.) When this threshold is

reached for Telnet, the Telnet logon interface shuts down.

• This command applies to both the local console and Telnet connections.

Example

To set the password threshold to five attempts, enter this command:

Console(config-line)#password-thresh 5

Console(config-line)#

4-15

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Related Commands

silent-time (4-16)

timeout login response (4-13)

silent-time

This command sets the amount of time the management console is inaccessible

after the number of unsuccessful logon attempts exceeds the threshold set by the

password-thresh command. Use the no form to remove the silent time value.

Syntax

silent-time [seconds]

no silent-time

seconds - The number of seconds to disable console response.

(Range: 0-65535; 0: no silent-time)

Default Setting

The default value is no silent-time.

Command Mode

Line Configuration

Example

To set the silent time to 60 seconds, enter this command:

Console(config-line)#silent-time 60

Console(config-line)#

Related Commands

password-thresh (4-15)

databits

This command sets the number of data bits per character that are interpreted and

generated by the console port. Use the no form to restore the default value.

Syntax

databits {7 | 8}

no databits

• 7 - Seven data bits per character.

• 8 - Eight data bits per character.

Default Setting

8 data bits per character

Command Mode

Line Configuration

4-16

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Commands

Command Usage

The databits command can be used to mask the high bit on input from

devices that generate 7 data bits with parity. If parity is being generated,

specify 7 data bits per character. If no parity is required, specify 8 data bits per

character.

Example

To specify 7 data bits, enter this command:

Console(config-line)#databits 7

Console(config-line)#

Related Commands

parity (4-17)

parity

This command defines the generation of a parity bit. Use the no form to restore the

default setting.

Syntax

parity {none | even | odd}

no parity

• none - No parity

• even - Even parity

• odd - Odd parity

Default Setting

No parity

Command Mode

Line Configuration

Command Usage

Communication protocols provided by devices such as terminals and modems

often require a specific parity bit setting.

Example

To specify no parity, enter this command:

Console(config-line)#parity none

Console(config-line)#

4-17

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

speed

This command sets the terminal line’s baud rate. This command sets both the

transmit (to terminal) and receive (from terminal) speeds. Use the no form to restore

the default setting.

Syntax

speed bps

no speed

bps - Baud rate in bits per second.

(Options: 9600, 19200, 38400, 57600, 115200 bps)

Default Setting

9600

Command Mode

Line Configuration

Command Usage

Set the speed to match the baud rate of the device connected to the serial

port. Some baud rates available on devices connected to the port might not be

supported. The system indicates if the speed you selected is not supported.

Example

To specify 57600 bps, enter this command:

Console(config-line)#speed 57600

Console(config-line)#

stopbits

This command sets the number of the stop bits transmitted per byte. Use the no

form to restore the default setting.

Syntax

stopbits {1 | 2}

• 1 - One stop bit

• 2 - Two stop bits

Default Setting

1 stop bit

Command Mode

Line Configuration

Example

To specify 2 stop bits, enter this command:

Console(config-line)#stopbits 2

Console(config-line)#

4-18

Download from Www.Somanuals.com. All Manuals Search And Download.

Line Commands

disconnect

This command terminates an SSH, Telnet, or console connection.

Syntax

disconnect session-id

session-id – The session identifier for an SSH, Telnet or console

connection. (Range: 0-4)

Command Mode

Privileged Exec

Command Usage

Specifying session identifier “0” will disconnect the console connection.

Specifying any other identifiers for an active session will disconnect an SSH or

Telnet connection.

Example

Console#disconnect 1

Console#

Related Commands

show ssh (4-42)

show users (4-67)

show line

This command displays the terminal line’s parameters.

Syntax

show line [console | vty]

• console - Console terminal line.

• vty - Virtual terminal for remote console access (i.e., Telnet).

Default Setting

Shows all lines

Command Mode

Normal Exec, Privileged Exec

4-19

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Example

To show all lines, enter this command:

Console#show line

Console configuration:

Password threshold: 3 times

Interactive timeout: Disabled

Silent time:

Baudrate:

Databits:

Parity:

Disabled

9600

none

Stopbits:

VTY configuration:

Password threshold: 3 times

Interactive timeout: 600 sec

console#

General Commands

Table 4-6 General Commands

Command

enable

Function

Mode

Page

Activates privileged mode

disable

Returns to normal mode from privileged mode

Activates global configuration mode

Shows the command history buffer

Restarts the system

configure

show history

reload

NE, PE

end

Returns to Privileged Exec mode

any

config.

mode

exit

quit

help

Returns to the previous configuration mode, or exits the CLI

Exits a CLI session

any

4-24

NE, PE

any

Shows how to use help

Shows options for command completion (context sensitive)

any

enable

This command activates Privileged Exec mode. In privileged mode, additional

commands are available, and certain commands display additional information. See

Syntax

enable [level]

level - Privilege level to log into the device.

The device has two predefined privilege levels: 0: Normal Exec,

15: Privileged Exec. Enter level 15 to access Privileged Exec mode.

4-20

Download from Www.Somanuals.com. All Manuals Search And Download.

General Commands

Default Setting

Level 15

Command Mode

Normal Exec

Command Usage

• “super” is the default password required to change the command mode from

Normal Exec to Privileged Exec. (To set this password, see the enable

password command on page 4-28.)

• The “#” character is appended to the end of the prompt to indicate that the

system is in privileged access mode.

Example

Console>enable

Password: [privileged level password]

Console#

Related Commands

disable (4-21)

enable password (4-28)

disable

This command returns to Normal Exec mode from privileged mode. In normal

access mode, you can only display basic information on the switch's configuration or

Ethernet statistics. To gain access to all commands, you must use the privileged

mode. See “Understanding Command Modes” on page 4-5.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

The “>” character is appended to the end of the prompt to indicate that the

system is in normal access mode.

Example

Console#disable

Console>

Related Commands

enable (4-20)

4-21

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

configure

This command activates Global Configuration mode. You must enter this mode to

modify any settings on the switch. You must also enter Global Configuration mode

prior to enabling some of the other configuration modes, including Interface

Configuration, Line Configuration, and VLAN Database Configuration. See

“Understanding Command Modes” on page 4-5.

Default Setting

None

Command Mode

Privileged Exec

Example

Console#configure

Console(config)#

Related Commands

end (4-23)

show history

This command shows the contents of the command history buffer.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

Command Usage

The history buffer size is fixed at 10 Execution commands and

10 Configuration commands.

Example

In this example, the show history command lists the contents of the command

history buffer:

Console#show history

Execution command history:

2 config

1 show history

Configuration command history:

4 interface vlan 1

3 exit

2 interface vlan 1

1 end

Console#

4-22

Download from Www.Somanuals.com. All Manuals Search And Download.

General Commands

The ! command repeats commands from the Execution command history buffer

when you are in Normal Exec or Privileged Exec Mode, and commands from the

Configuration command history buffer when you are in any of the configuration

modes. In this example, the !2 command repeats the second command in the

Execution history buffer (config).

Console#!2

Console#config

Console(config)#

reload

This command restarts the system.

Note: When the system is restarted, it will always run the Power-On Self-Test. It will also

retain all configuration information stored in non-volatile memory by the copy

running-config startup-config command.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

This command resets the entire system.

Example

This example shows how to reset the switch:

Console#reload

System will be restarted, continue <y/n>? y

end

This command returns to Privileged Exec mode.

Default Setting

None

Command Mode

Global Configuration, Interface Configuration, Line Configuration, and VLAN

Database Configuration.

Example

This example shows how to return to the Privileged Exec mode from the Interface

Configuration mode:

Console(config-if)#end

Console#

4-23

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

exit

This command returns to the previous configuration mode or exit the configuration

program.

Default Setting

None

Command Mode

Any

Example

This example shows how to return to the Privileged Exec mode from the Global

Configuration mode, and then quit the CLI session:

Console(config)#exit

Console#exit

Press ENTER to start session

User Access Verification

Username:

quit

This command exits the configuration program.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

Command Usage

The quit and exit commands can both exit the configuration program.

Example

This example shows how to quit a CLI session:

Console#quit

Press ENTER to start session

User Access Verification

Username:

4-24

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

These commands are used to control system logs, passwords, user names, browser

configuration options, and display or configure a variety of other system information.

Table 4-7 System Management Commands

Command Group

Device Designation

User Access

IP Filter

Function

Page

4-25

Configures information that uniquely identifies this switch

Configures the basic user names and passwords for management access

Configures IP addresses that are allowed management access

Enables management access via a web browser

Enables management access via Telnet

Web Server

Telnet Server

Secure Shell

Event Logging

Provides secure replacement for Telnet

Controls logging of error messages

Time (System Clock) Sets the system clock automatically via NTP/SNTP or manually

System Status

Frame Size

Displays system configuration, active managers, and version information

Enables support for jumbo frames

Device Designation Commands

Table 4-8 Device Designation Commands

Function

Command

prompt

Mode

Page

4-25

Customizes the prompt used in PE and NE mode

Specifies the host name for the switch

Sets the system contact string

hostname

4-26

snmp-server contact

4-119

snmp-server location Sets the system location string

prompt

This command customizes the CLI prompt. Use the no form to restore the default

prompt.

Syntax

prompt string

no prompt

string - Any alphanumeric string to use for the CLI prompt. (Maximum

length: 255 characters)

Default Setting

Console

Command Mode

Global Configuration

4-25

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Example

Console(config)#prompt RD2

RD2(config)#

hostname

This command specifies or modifies the host name for this device. Use the no form

to restore the default host name.

Syntax

hostname name

no hostname

name - The name of this host. (Maximum length: 255 characters)

Default Setting

None

Command Mode

Global Configuration

Example

Console(config)#hostname RD#1

Console(config)#

User Access Commands

The basic commands required for management access are listed in this section.

This switch also includes other options for password checking via the console or a

Telnet connection (page 4-11), user authentication via a remote authentication

server (page 4-76), and host access authentication for specific ports (page 4-85).

Table 4-9 User Access Commands

Command

Function

Mode

Page

4-27

4-28

username

Establishes a user name-based authentication system at login GC

Sets a password to control access to the Privileged Exec level GC

enable password

4-26

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

username

This command adds named users, requires authentication at login, specifies or

changes a user's password (or specify that no password is required), or specifies or

changes a user's access level. Use the no form to remove a user name.

Syntax

username name {access-level level | nopassword |

password {0 | 7} password}

no username name

• name - The name of the user.

(Maximum length: 8 characters, case sensitive. Maximum users: 16)

• access-level level - Specifies the user level.

The device has two predefined privilege levels:

0: Normal Exec, 15: Privileged Exec.

• nopassword - No password is required for this user to log in.

• {0 | 7} - 0 means plain password, 7 means encrypted password.

• password password - The authentication password for the user.

(Maximum length: 8 characters plain text, 32 encrypted, case sensitive)

Default Setting

• The default access level is Normal Exec.

• The factory defaults for the user names and passwords are:

Table 4-10 Default Login Settings

username

access-level

password

guest

admin

Command Mode

Global Configuration

Command Usage

The encrypted password is required for compatibility with legacy password

settings (i.e., plain text or encrypted) when reading the configuration file during

system bootup or when downloading the configuration file from a TFTP server.

There is no need for you to manually configure encrypted passwords.

Example

This example shows how to set the access level and password for a user.

Console(config)#username bob access-level 15

Console(config)#username bob password 0 smith

Console(config)#

4-27

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

enable password

After initially logging onto the system, you should set the Privileged Exec password.

Remember to record it in a safe place. This command controls access to the

Privileged Exec level from the Normal Exec level. Use the no form to reset the

default password.

Syntax

enable password [level level] {0 | 7} password

no enable password [level level]

• level level - Level 15 for Privileged Exec. (Levels 0-14 are not used.)

• {0 | 7} - 0 means plain password, 7 means encrypted password.

• password - password for this privilege level.

(Maximum length: 8 characters plain text, 32 encrypted, case sensitive)

Default Setting

• The default is level 15.

• The default password is “super”

Command Mode

Global Configuration

Command Usage

• You cannot set a null password. You will have to enter a password to change

the command mode from Normal Exec to Privileged Exec with the enable

command (page 4-20).

• The encrypted password is required for compatibility with legacy password

settings (i.e., plain text or encrypted) when reading the configuration file

during system bootup or when downloading the configuration file from a TFTP

server. There is no need for you to manually configure encrypted passwords.

Example

Console(config)#enable password level 15 0 admin

Console(config)#

Related Commands

enable (4-20)

authentication enable (4-77)

4-28

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

IP Filter Commands

Table 4-11 IP Filter Commands

Command

Function

Mode

Page

management

show management

Configures IP addresses that are allowed management access GC

4-29

4-30

Displays the switch to be monitored or configured from a

browser

management

This command specifies the client IP addresses that are allowed management

access to the switch through various protocols. Use the no form to restore the

default setting.

Syntax

[no] management {all-client | http-client | snmp-client | telnet-client}

start-address [end-address]

• all-client - Adds IP address(es) to the SNMP, web and Telnet groups.

• http-client - Adds IP address(es) to the web group.

• snmp-client - Adds IP address(es) to the SNMP group.

• telnet-client - Adds IP address(es) to the Telnet group.

• start-address - A single IP address, or the starting address of a range.

• end-address - The end address of a range.

Default Setting

All addresses

Command Mode

Global Configuration

Command Usage

• If anyone tries to access a management interface on the switch from an invalid

address, the switch will reject the connection, enter an event message in the

system log, and send a trap message to the trap manager.

• IP address can be configured for SNMP, web and Telnet access respectively.

Each of these groups can include up to five different sets of addresses, either

individual addresses or address ranges.

• When entering addresses for the same group (i.e., SNMP, web or Telnet), the

switch will not accept overlapping address ranges. When entering addresses

for different groups, the switch will accept overlapping address ranges.

• You cannot delete an individual address from a specified range. You must

delete the entire range, and reenter the addresses.

• You can delete an address range just by specifying the start address, or by

specifying both the start address and end address.

4-29

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Example

This example restricts management access to the indicated addresses.

Console(config)#management all-client 192.168.1.19

Console(config)#management all-client 192.168.1.25 192.168.1.30

Console(config)#

show management

This command displays the client IP addresses that are allowed management

access to the switch through various protocols.

Syntax

show management {all-client | http-client | snmp-client | telnet-client}

• all-client - Adds IP address(es) to the SNMP, web and Telnet groups.

• http-client - Adds IP address(es) to the web group.

• snmp-client - Adds IP address(es) to the SNMP group.

• telnet-client - Adds IP address(es) to the Telnet group.

Command Mode

Privileged Exec

Example

Console#show management all-client

Management IP Filter

HTTP-Client:

Start IP address

End IP address

-----------------------------------------------

1. 192.168.1.19

2. 192.168.1.25

192.168.1.19

192.168.1.30

SNMP-Client:

Start IP address

End IP address

-----------------------------------------------

1. 192.168.1.19

2. 192.168.1.25

192.168.1.19

192.168.1.30

TELNET-Client:

Start IP address

End IP address

-----------------------------------------------

1. 192.168.1.19

2. 192.168.1.25

192.168.1.19

192.168.1.30

Console#

4-30

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Web Server Commands

Table 4-12 Web Server Commands

Command

Function

Mode

Page

ip http port

Specifies the port to be used by the web browser interface

4-31

4-32

4-33

ip http server

Allows the switch to be monitored or configured from a browser GC

ip http secure-server

ip http secure-port

Enables HTTPS/SSL for encrypted communications

Specifies the UDP port number for HTTPS/SSL

ip http port

This command specifies the TCP port number used by the web browser interface.

Use the no form to use the default port.

Syntax

ip http port port-number

no ip http port

port-number - The TCP port to be used by the browser interface.

(Range: 1-65535)

Default Setting

Command Mode

Global Configuration

Example

Console(config)#ip http port 769

Console(config)#

Related Commands

ip http server (4-31)

ip http server

This command allows this device to be monitored or configured from a browser. Use

the no form to disable this function.

Syntax

[no] ip http server

Default Setting

Enabled

Command Mode

Global Configuration

4-31

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Example

Console(config)#ip http server

Console(config)#

Related Commands

ip http port (4-31)

ip http secure-server

This command enables the secure hypertext transfer protocol (HTTPS) over the

Secure Socket Layer (SSL), providing secure access (i.e., an encrypted connection)

to the switch’s web interface. Use the no form to disable this function.

Syntax

[no] ip http secure-server

Default Setting

Enabled

Command Mode

Global Configuration

Command Usage

• Both HTTP and HTTPS service can be enabled independently on the switch.

However, you cannot configure the HTTP and HTTPS servers to use the

same UDP port.

• If you enable HTTPS, you must indicate this in the URL that you specify in

your browser: https://device[:port_number]

• When you start HTTPS, the connection is established in this way:

- The client authenticates the server using the server’s digital certificate.

- The client and server negotiate a set of security protocols to use for the

connection.

- The client and server generate session keys for encrypting and decrypting

data.

• The client and server establish a secure encrypted connection.

A padlock icon should appear in the status bar for Internet Explorer 5.x and

Netscape Navigator 6.2 or later versions.

• The following web browsers and operating systems currently support HTTPS:

Table 4-13 HTTPS System Support

Web Browser

Operating System

Internet Explorer 5.0 or later

Windows 98,Windows NT (with service pack 6a),

Windows 2000, Windows XP

Netscape Navigator 6.2 or later

Windows 98,Windows NT (with service pack 6a),

Windows 2000, Windows XP, Solaris 2.6

• To specify a secure-site certificate, see “Replacing the Default Secure-site

Certificate” on page 3-60. Also refer to the copy command on page 4-70.

4-32

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Example

Console(config)#ip http secure-server

Console(config)#

Related Commands

ip http secure-port (4-33)

copy tftp https-certificate (4-70)

ip http secure-port

This command specifies the UDP port number used for HTTPS/SSL connection to

the switch’s web interface. Use the no form to restore the default port.

Syntax

ip http secure-port port_number

no ip http secure-port

port_number – The UDP port used for HTTPS/SSL.

(Range: 1-65535)

Default Setting

443

Command Mode

Global Configuration

Command Usage

• You cannot configure the HTTP and HTTPS servers to use the same port.

• If you change the HTTPS port number, clients attempting to connect to the

HTTPS server must specify the port number in the URL, in this format:

https://device:port_number

Example

Console(config)#ip http secure-port 1000

Console(config)#

Related Commands

ip http secure-server (4-32)

4-33

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Telnet Server Commands

Table 4-14 Telnet Server Commands

Function

Command

Mode

Page

4-31

ip telnet port

ip telnet server

Specifies the port to be used by the Telnet interface

Allows the switch to be monitored or configured from Telnet

ip telnet port

This command specifies the TCP port number used by the Telnet interface. Use the

no form to use the default port.

Syntax

ip telnet port port-number

no ip telnet port

port-number - The TCP port to be used by the browser interface.

(Range: 1-65535)

Default Setting

Command Mode

Global Configuration

Example

Console(config)#ip telnet port 123

Console(config)#

Related Commands

ip telnet server (4-34)

ip telnet server

This command allows this device to be monitored or configured from Telnet. Use the

no form to disable this function.

Syntax

[no] ip telnet server

Default Setting

Enabled

Command Mode

Global Configuration

Example

Console(config)#ip telnet server

Console(config)#

4-34

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Related Commands

ip telnet port (4-34)

Secure Shell Commands

The Berkley-standard includes remote access tools originally designed for Unix

systems. Some of these tools have also been implemented for Microsoft Windows

and other environments. These tools, including commands such as rlogin (remote

The Secure Shell (SSH) includes server/client applications intended as a secure

replacement for the older Berkley remote access tools. SSH can also provide

remote management access to this switch as a secure replacement for Telnet.

When a client contacts the switch via the SSH protocol, the switch uses a public-key

that the client must match along with a local user name and password for access

authentication. SSH also encrypts all data transfers passing between the switch and

SSH-enabled management station clients, and ensures that data traveling over the

network arrives unaltered.

This section describes the commands used to configure the SSH server. However,

note that you also need to install a SSH client on the management station when

using this protocol to configure the switch.

Note: The switch supports both SSH Version 1.5 and 2.0.

Table 4-15 SSH Commands

Command

Function

Mode

Page

4-37

4-38

ip ssh server

ip ssh timeout

Enables the SSH server on the switch

Specifies the authentication timeout for the SSH server

Specifies the number of retries allowed by a client

ip ssh

authentication-retries

ip ssh server-key size Sets the SSH server key size

copy tftp public-key

delete public-key

Copies the user’s public key from a TFTP server to the switch PE

Deletes the public key for the specified user

ip ssh crypto host-key Generates the host key

generate

ip ssh crypto zeroize

ip ssh save host-key

disconnect

Clear the host key from RAM

Saves the host key from RAM to flash memory

Terminates a line connection

show ip ssh

Displays the status of the SSH server and the configured values PE

for authentication timeout and retries

show ssh

Displays the status of current SSH sessions

4-42

4-43

4-67

show public-key

show users

Shows the public key for the specified user or for the host

Shows SSH users, including privilege level and public key type PE

4-35

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

The SSH server on this switch supports both password and public key

authentication. If password authentication is specified by the SSH client, then the

password can be authenticated either locally or via a RADIUS or TACACS+ remote

authentication server, as specified by the authentication login command on

page 4-76. If public key authentication is specified by the client, then you must

configure authentication keys on both the client and the switch as described in the

following section. Note that regardless of whether you use public key or password

authentication, you still have to generate authentication keys on the switch and

enable the SSH server.

To use the SSH server, complete these steps:

1. Generate a Host Key Pair – Use the ip ssh crypto host-key generate

command to create a host public/private key pair.

2. Provide Host Public Key to Clients – Many SSH client programs automatically

import the host public key during the initial connection setup with the switch.

Otherwise, you need to manually create a known hosts file on the management

station and place the host public key in it. An entry for a public key in the known

hosts file would appear similar to the following example:

10.1.0.54 1024 35 15684995401867669259333946775054617325313674890836547254

15020245593199868544358361651999923329781766065830956 10825913212890233

76546801726272571413428762941301196195566782 59566410486957427888146206

51941746772984865468615717739390164779355942303577413098022737087794545

24083971752646358058176716709574804776117

3. Import Client’s Public Key to the Switch – Use the copy tftp public-key

command to copy a file containing the public key for all the SSH client’s granted

management access to the switch. (Note that these clients must be configured

locally on the switch via the User Accounts page as described on page 3-54.)

The clients are subsequently authenticated using these keys. The current

firmware only accepts public key files based on standard UNIX format as shown

in the following example for an RSA Version 1 key:

1024 35 1341081685609893921040944920155425347631641921872958921143173880

05553616163105177594083868631109291232226828519254374603100937187721199

69631781366277414168985132049117204830339254324101637997592371449011938

00609025394840848271781943722884025331159521348610229029789827213532671

31629432532818915045306393916643 steve@192.168.1.19

4. Set the Optional Parameters – Set other optional parameters, including the

authentication timeout, the number of retries, and the server key size.

5. Enable SSH Service – Use the ip ssh server command to enable the SSH

server on the switch.

6. Configure Challenge-Response Authentication – When an SSH client attempts

to contact the switch, the SSH server uses the host key pair to negotiate a

session key and encryption method. Only clients that have a private key

4-36

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

corresponding to the public keys stored on the switch can gain access. The

following exchanges take place during this process:

a. The client sends its public key to the switch.

b. The switch compares the client's public key to those stored in memory.

c. If a match is found, the switch uses the public key to encrypt a random

sequence of bytes, and sends this string to the client.

d. The client uses its private key to decrypt the bytes, and sends the

decrypted bytes back to the switch.

e. The switch compares the decrypted bytes to the original bytes it sent. If the

two sets match, this means that the client's private key corresponds to an

authorized public key, and the client is authenticated.

Note: To use SSH with only password authentication, the host public key must still be

given to the client, either during initial connection or manually entered into the

known host file. However, you do not need to configure the client’s keys.

ip ssh server

This command enables the Secure Shell (SSH) server on this switch. Use the no

form to disable this service.

Syntax

[no] ip ssh server

Default Setting

Disabled

Command Mode

Global Configuration

Command Usage

• The SSH server supports up to four client sessions. The maximum number of

client sessions includes both current Telnet sessions and SSH sessions.

• The SSH server uses DSA or RSA for key exchange when the client first

establishes a connection with the switch, and then negotiates with the client

to select either DES (56-bit) or 3DES (168-bit) for data encryption.

• You must generate the host key before enabling the SSH server.

Example

Console#ip ssh crypto host-key generate dsa

Console#configure

Console(config)#ip ssh server

Console(config)#

Related Commands

ip ssh crypto host-key generate (4-40)

show ssh (4-42)

4-37

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

ip ssh timeout

This command configures the timeout for the SSH server. Use the no form to restore

the default setting.

Syntax

ip ssh timeout seconds

no ip ssh timeout

seconds – The timeout for client response during SSH negotiation.

(Range: 1-120)

Default Setting

10 seconds

Command Mode

Global Configuration

Command Usage

The timeout specifies the interval the switch will wait for a response from the

client during the SSH negotiation phase. Once an SSH session has been

established, the timeout for user input is controlled by the exec-timeout

command for vty sessions.

Example

Console(config)#ip ssh timeout 60

Console(config)#

Related Commands

exec-timeout (4-14)

show ip ssh (4-41)

ip ssh authentication-retries

This command configures the number of times the SSH server attempts to

reauthenticate a user. Use the no form to restore the default setting.

Syntax

ip ssh authentication-retries count

no ip ssh authentication-retries

count – The number of authentication attempts permitted after which the

interface is reset. (Range: 1-5)

Default Setting

Command Mode

Global Configuration

4-38

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Example

Console(config)#ip ssh authentication-retires 2

Console(config)#

Related Commands

show ip ssh (4-41)

ip ssh server-key size

This command sets the SSH server key size. Use the no form to restore the default

setting.

Syntax

ip ssh server-key size key-size

no ip ssh server-key size

key-size – The size of server key. (Range: 512-896 bits)

Default Setting

768 bits

Command Mode

Global Configuration

Command Usage

• The server key is a private key that is never shared outside the switch.

• The host key is shared with the SSH client, and is fixed at 1024 bits.

Example

Console(config)#ip ssh server-key size 512

Console(config)#

delete public-key

This command deletes the specified user’s public key.

Syntax

delete public-key username [dsa | rsa]

• username – Name of an SSH user. (Range: 1-8 characters)

• dsa – DSA public key type.

• rsa – RSA public key type.

Default Setting

Deletes both the DSA and RSA key.

Command Mode

Privileged Exec

4-39

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Example

Console#delete public-key admin dsa

Console#

ip ssh crypto host-key generate

This command generates the host key pair (i.e., public and private).

Syntax

ip ssh crypto host-key generate [dsa | rsa]

• dsa – DSA (Version 2) key type.

• rsa – RSA (Version 1) key type.

Default Setting

Generates both the DSA and RSA key pairs.

Command Mode

Privileged Exec

Command Usage

• This command stores the host key pair in memory (i.e., RAM). Use the ip ssh

save host-key command to save the host key pair to flash memory.

• Some SSH client programs automatically add the public key to the known

hosts file as part of the configuration process. Otherwise, you must manually

create a known hosts file and place the host public key in it.

• The SSH server uses this host key to negotiate a session key and encryption

method with the client trying to connect to it.

Example

Console#ip ssh crypto host-key generate dsa

Console#

Related Commands

ip ssh crypto zeroize (4-40)

ip ssh save host-key (4-41)

ip ssh crypto zeroize

This command clears the host key from memory (i.e. RAM).

Syntax

ip ssh crypto zeroize [dsa | rsa]

• dsa – DSA key type.

• rsa – RSA key type.

Default Setting

Clears both the DSA and RSA key.

4-40

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Command Mode

Privileged Exec

Command Usage

• This command clears the host key from volatile memory (RAM). Use the no

ip ssh save host-key command to clear the host key from flash memory.

• The SSH server must be disabled before you can execute this command.

Example

Console#ip ssh crypto zeroize dsa

Console#

Related Commands

ip ssh crypto host-key generate (4-40)

ip ssh save host-key (4-41)

no ip ssh server (4-37)

ip ssh save host-key

This command saves host key from RAM to flash memory.

Syntax

ip ssh save host-key [dsa | rsa]

• dsa – DSA key type.

• rsa – RSA key type.

Default Setting

Saves both the DSA and RSA key.

Command Mode

Privileged Exec

Example

Console#ip ssh save host-key dsa

Console#

Related Commands

ip ssh crypto host-key generate (4-40)

show ip ssh

This command displays the connection settings used when authenticating client

access to the SSH server.

Command Mode

Privileged Exec

4-41

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Example

Console#show ip ssh

SSH Enabled - version 1.99

Negotiation timeout: 120 secs; Authentication retries: 3

Server key size: 768 bits

Console#

show ssh

This command displays the current SSH server connections.

Command Mode

Privileged Exec

Example

Console#show ssh

Connection Version State

Username Encryption

admin ctos aes128-cbc-hmac-md5

stoc aes128-cbc-hmac-md5

2.0

Session-Started

Console#

Table 4-16 show ssh - display description

Description

Field

Session

Version

State

The session number. (Range: 0-3)

The Secure Shell version number.

The authentication negotiation state.

(Values: Negotiation-Started, Authentication-Started, Session-Started)

Username

Encryption

The user name of the client.

The encryption method is automatically negotiated between the client and server.

Options for SSHv1.5 include: DES, 3DES

Options for SSHv2.0 can include different algorithms for the client-to-server (ctos)

and server-to-client (stoc):

aes128-cbc-hmac-sha1

aes192-cbc-hmac-sha1

aes256-cbc-hmac-sha1

3des-cbc-hmac-sha1

blowfish-cbc-hmac-sha1

aes128-cbc-hmac-md5

aes192-cbc-hmac-md5

aes256-cbc-hmac-md5

3des-cbc-hmac-md5

blowfish-cbc-hmac-md5

Terminology:

DES – Data Encryption Standard (56-bit key)

3DES – Triple-DES (Uses three iterations of DES, 112-bit key)

aes – Advanced Encryption Standard (160 or 224-bit key)

blowfish – Blowfish (32-448 bit key)

cbc – cypher-block chaining

sha1 – Secure Hash Algorithm 1 (160-bit hashes)

md5 – Message Digest algorithm number 5 (128-bit hashes)

4-42

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

show public-key

This command shows the public key for the specified user or for the host.

Syntax

show public-key [user [username]| host]

username – Name of an SSH user. (Range: 1-8 characters)

Default Setting

Shows all public keys.

Command Mode

Privileged Exec

Command Usage

• If no parameters are entered, all keys are displayed. If the user keyword is

entered, but no user name is specified, then the public keys for all users are

displayed.

• When an RSA key is displayed, the first field indicates the size of the host key

(e.g., 1024), the second field is the encoded public exponent (e.g., 35), and

the last string is the encoded modulus. When a DSA key is displayed, the first

field indicates that the encryption method used by SSH is based on the Digital

Signature Standard (DSS), and the last string is the encoded modulus.

Example

Console#show public-key host

Host:

RSA:

1024 35

1568499540186766925933394677505461732531367489083654725415020245593199868

5443583616519999233297817660658309586108259132128902337654680172627257141

3428762941301196195566782595664104869574278881462065194174677298486546861

5717739390164779355942303577413098022737087794545240839717526463580581767

16709574804776117

DSA:

ssh-dss AAAB3NzaC1kc3MAAACBAPWKZTPbsRIB8ydEXcxM3dyV/yrDbKStIlnzD/Dg0h2Hxc

YV44sXZ2JXhamLK6P8bvuiyacWbUW/a4PAtp1KMSdqsKeh3hKoA3vRRSy1N2XFfAKxl5fwFfv

JlPdOkFgzLGMinvSNYQwiQXbKTBH0Z4mUZpE85PWxDZMaCNBPjBrRAAAAFQChb4vsdfQGNIjw

bvwrNLaQ77isiwAAAIEAsy5YWDC99ebYHNRj5kh47wY4i8cZvH+/p9cnrfwFTMU01VFDly3IR

2G395NLy5Qd7ZDxfA9mCOfT/yyEfbobMJZi8oGCstSNOxrZZVnMqWrTYfdrKX7YKBw/Kjw6Bm

iFq7O+jAhf1Dg45loAc27s6TLdtny1wRq/ow2eTCD5nekAAACBAJ8rMccXTxHLFAczWS7EjOy

DbsloBfPuSAb4oAsyjKXKVYNLQkTLZfcFRu41bS2KV5LAwecsigF/+DjKGWtPNIQqabKgYCw2

o/dVzX4Gg+yqdTlYmGA7fHGm8ARGeiG4ssFKy4Z6DmYPXFum1Yg0fhLwuHpOSKdxT3kk475S7

w0W

Console#

4-43

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Event Logging Commands

Table 4-17 Event Logging Commands

Function

Command

logging on

Mode

Page

4-44

4-45

Controls logging of error messages

logging history

Limits syslog messages saved to switch memory based on

severity

logging host

Adds a syslog server host IP address that will receive logging GC

messages

4-46

logging facility

logging trap

Sets the facility type for remote logging of syslog messages

4-46

Limits syslog messages saved to a remote server based on

severity

clear logging

show logging

show log

Clears messages from the logging buffer

Displays the state of logging

Displays log messages

show logging sendmail (4-53)

4-48

4-49

logging on

This command controls logging of error messages, sending debug or error

messages to switch memory. The no form disables the logging process.

Syntax

[no] logging on

Default Setting

None

Command Mode

Global Configuration

Command Usage

The logging process controls error messages saved to switch memory. You

can use the logging history command to control the type of error messages

that are stored.

Example

Console(config)#logging on

Console(config)#

Related Commands

logging history (4-45)

clear logging (4-47)

4-44

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

logging history

This command limits syslog messages saved to switch memory based on severity.

The no form returns the logging of syslog messages to the default level.

Syntax

logging history {flash | ram} level

no logging history {flash | ram}

• flash - Event history stored in flash memory (i.e., permanent memory).

• ram - Event history stored in temporary RAM (i.e., memory flushed on

power reset).

• level - One of the levels listed below. Messages sent include the selected

level down to level 0. (Range: 0-7)

Table 4-18 Logging Levels

Level Severity Name

Description

debugging

informational

notifications

warnings

errors

Debugging messages

Informational messages only

Normal but significant condition, such as cold start

Warning conditions (e.g., return false, unexpected return)

Error conditions (e.g., invalid input, default used)

critical

Critical conditions (e.g., memory allocation, or free

memory error - resource exhausted)

alerts

Immediate action needed

System unusable

emergencies

* There are only Level 2, 5 and 6 error messages for the current firmware release.

Default Setting

Flash: errors (level 3 - 0)

RAM: warnings (level 6 - 0)

Command Mode

Global Configuration

Command Usage

The message level specified for flash memory must be a higher priority (i.e.,

numerically lower) than that specified for RAM.

Example

Console(config)#logging history ram 0

Console(config)#

4-45

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

logging host

This command adds a syslog server host IP address that will receive logging

messages. Use the no form to remove a syslog server host.

Syntax

[no] logging host host_ip_address

host_ip_address - The IP address of a syslog server.

Default Setting

None

Command Mode

Global Configuration

Command Usage

• By using this command more than once you can build up a list of host IP

addresses.

• The maximum number of host IP addresses allowed is five.

Example

Console(config)#logging host 10.1.0.3

Console(config)#

logging facility

This command sets the facility type for remote logging of syslog messages. Use the

no form to return the type to the default.

Syntax

[no] logging facility type

type - A number that indicates the facility used by the syslog server to

dispatch log messages to an appropriate service. (Range: 16-23)

Default Setting

Command Mode

Global Configuration

Command Usage

The command specifies the facility type tag sent in syslog messages. (See

RFC 3164.) This type has no effect on the kind of messages reported by the

switch. However, it may be used by the syslog server to sort messages or to

store messages in the corresponding database.

Example

Console(config)#logging facility 19

Console(config)#

4-46

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

logging trap

This command enables the logging of system messages to a remote server, or

limits the syslog messages saved to a remote server based on severity. Use this

command without a specified level to enable remote logging. Use the no form to

disable remote logging.

Syntax

logging trap [level]

no logging trap

level - One of the level arguments listed below. Messages sent include the

selected level up through level 0. (Refer to the table on page 4-45.)

Default Setting

• Enabled

• Level 6 - 0

Command Mode

Global Configuration

Command Usage

• Using this command with a specified level enables remote logging and sets

the minimum severity level to be saved.

• Using this command without a specified level also enables remote logging, but

restores the minimum severity level to the default.

Example

Console(config)#logging trap 4

Console(config)#

clear logging

This command clears messages from the log buffer.

Syntax

clear logging [flash | ram]

• flash - Event history stored in flash memory (i.e., permanent memory).

• ram - Event history stored in temporary RAM (i.e., memory flushed on

power reset).

Default Setting

Flash and RAM

Command Mode

Privileged Exec

Example

Console#clear logging

Console#

4-47

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Related Commands

show logging (4-48)

show logging

This command displays the configuration settings for logging messages to local

switch memory, to an SMTP event handler, or to a remote syslog server.

Syntax

show logging {flash | ram | sendmail | trap}

• flash - Displays settings for storing event messages in flash memory

(i.e., permanent memory).

• ram - Displays settings for storing event messages in temporary RAM

(i.e., memory flushed on power reset).

• sendmail - Displays settings for the SMTP event handler (page 4-53).

• trap - Displays settings for the trap function.

Default Setting

None

Command Mode

Privileged Exec

Example

The following example shows that system logging is enabled, the message level for

flash memory is “errors” (i.e., default level 3 - 0), the message level for RAM is

“debugging” (i.e., default level 7 - 0).

Console#show logging flash

Syslog logging:

Enabled

History logging in FLASH: level errors

Console#show logging ram

Syslog logging:

Enabled

History logging in RAM: level debugging

Console#

Table 4-19 show logging flash/ram - display description

Description

Shows if system logging has been enabled via the logging on command.

Field

Syslog logging

History logging in FLASH The message level(s) reported based on the logging history command.

History logging in RAM The message level(s) reported based on the logging history command.

4-48

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

The following example displays settings for the trap function.

Console#show logging trap

Syslog logging: Enable

REMOTELOG status: disable

REMOTELOG facility type: local use 7

REMOTELOG level type: Debugging messages

REMOTELOG server IP address: 1.2.3.4

REMOTELOG server IP address: 0.0.0.0

Console#

Table 4-20 show logging trap - display description

Description

Field

Syslog logging

REMOTELOG status

Shows if system logging has been enabled via the logging on command.

Shows if remote logging has been enabled via the logging trap command.

REMOTELOG

facility type

The facility type for remote logging of syslog messages as specified in the logging

facility command.

REMOTELOG level type The severity threshold for syslog messages sent to a remote server as specified in

the logging trap command.

REMOTELOG

server IP address

The address of syslog servers as specified in the logging host command.

Related Commands

show log

This command displays the system and event messages stored in memory.

Syntax

show log {flash | ram} [login] [tail]

• flash - Event history stored in flash memory (i.e., permanent memory).

• ram - Event history stored in temporary RAM (i.e., memory flushed on

power reset).

• tail - Shows event history starting from the most recent entry.

• login - Shows the login record only.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

This command shows the system and event messages stored in memory,

including the time stamp, message level (page 4-45), program module,

function, and event number.

4-49

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Example

The following example shows sample messages stored in RAM.

Console#show log ram

[5] 00:01:06 2001-01-01

"STA root change notification."

level: 6, module: 6, function: 1, and event no.: 1

[4] 00:01:00 2001-01-01

"STA root change notification."

level: 6, module: 6, function: 1, and event no.: 1

[3] 00:00:54 2001-01-01

"STA root change notification."

level: 6, module: 6, function: 1, and event no.: 1

[2] 00:00:50 2001-01-01

"STA topology change notification."

level: 6, module: 6, function: 1, and event no.: 1

[1] 00:00:48 2001-01-01

"VLAN 1 link-up notification."

level: 6, module: 6, function: 1, and event no.: 1

Console#

SMTP Alert Commands

These commands configure SMTP event handling, and forwarding of alert

messages to the specified SMTP servers and email recipients.

Table 4-21 SMTP Alert Commands

Command

Function

Mode Page

logging sendmail host

logging sendmail level

SMTP servers to receive alert messages

Severity threshold used to trigger alert messages

Email address used for “From” field of alert messages

4-50

4-51

4-52

logging sendmail

source-email

logging sendmail

destination-email

Email recipients of alert messages

4-52

logging sendmail

Enables SMTP event handling

4-53

show logging sendmail

Displays SMTP event handler settings

NE, PE

logging sendmail host

This command specifies SMTP servers that will be sent alert messages. Use the no

form to remove an SMTP server.

Syntax

[no] logging sendmail host ip_address

ip_address - IP address of an SMTP server that will be sent alert

messages for event handling.

Default Setting

None

4-50

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Command Mode

Global Configuration

Command Usage

• You can specify up to three SMTP servers for event handing. However, you

must enter a separate command to specify each server.

• To send email alerts, the switch first opens a connection, sends all the email

alerts waiting in the queue one by one, and finally closes the connection.

• To open a connection, the switch first selects the server that successfully sent

mail during the last connection, or the first server configured by this command.

If it fails to send mail, the switch selects the next server in the list and tries to

send mail again. If it still fails, the system will repeat the process at a periodic

interval. (A trap will be triggered if the switch cannot successfully open a

connection.)

Example

Console(config)#logging sendmail host 192.168.1.200

Console(config)#

logging sendmail level

This command sets the severity threshold used to trigger alert messages.

Syntax

logging sendmail level level

level - One of the system message levels (page 4-45). Messages sent

include the selected level down to level 0. (Range: 0-7; Default: 7)

Default Setting

Level 7

Command Mode

Global Configuration

Command Usage

The specified level indicates an event threshold. All events at this level or

higher will be sent to the configured email recipients. (For example, using

Level 7 will report all events from level 7 to level 0.)

Example

This example will send email alerts for system errors from level 4 through 0.

Console(config)#logging sendmail level 4

Console(config)#

4-51

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

logging sendmail source-email

This command sets the email address used for the “From” field in alert messages.

Use the no form to delete the source email address.

Syntax

[no] logging sendmail source-email email-address

email-address - The source email address used in alert messages.

(Range: 0-41 characters)

Default Setting

None

Command Mode

Global Configuration

Command Usage

You may use an symbolic email address that identifies the switch, or the

address of an administrator responsible for the switch.

Example

This example will set the source email john@acme.com.

Console(config)#logging sendmail source-email john@acme.com

Console(config)#

logging sendmail destination-email

This command specifies the email recipients of alert messages. Use the no form to

remove a recipient.

Syntax

[no] logging sendmail destination-email email-address

email-address - The source email address used in alert messages.

(Range: 1-41 characters)

Default Setting

None

Command Mode

Global Configuration

Command Usage

You can specify up to five recipients for alert messages. However, you must

enter a separate command to specify each recipient.

Example

Console(config)#logging sendmail destination-email ted@this-company.com

Console(config)#

4-52

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

logging sendmail

This command enables SMTP event handling. Use the no form to disable this

function.

Syntax

[no] logging sendmail

Default Setting

Enabled

Command Mode

Global Configuration

Example

Console(config)#logging sendmail

Console(config)#

show logging sendmail

This command displays the settings for the SMTP event handler.

Command Mode

Normal Exec, Privileged Exec

Example

Console#show logging sendmail

SMTP servers

-----------------------------------------------

1. 192.168.1.200

SMTP minimum severity level: 4

SMTP destination email addresses

-----------------------------------------------

1. geoff@acme.com

SMTP source email address:

john@acme.com

Enabled

SMTP status:

Console#

4-53

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Time Commands

The system clock can be dynamically set by polling a set of specified NTP time

servers. Maintaining an accurate time on the switch enables the system log to

record meaningful dates and times for event entries. If the clock is not set, the switch

will only record the time from the factory default set at the last bootup.

Table 4-22 Time Commands

Command

sntp client

sntp server

sntp poll

Function

Mode

Page

Enables the SNTP client for time updates from specified servers GC

Specifies one or more time servers

Sets the interval at which the SNTP client polls for time

Shows current SNTP configuration settings

show sntp

ntp client

NE, PE

Enables the NTP client for time updates from specified servers GC

ntp server

ntp poll

Specifies NTP servers to poll for time updates

Sets the interval at which the NTP client polls for time

Enables authentication for NTP traffic

ntp authenticate

ntp authentication-key Configures authentication keys

show ntp

Shows current NTP configuration settings

NE, PE

clock timezone

calendar set

show calendar

Sets the time zone for the switch’s internal clock

Sets the system date and time

Displays the current date and time setting

NE, PE

sntp client

This command enables SNTP client requests for time synchronization from NTP or

SNTP time servers specified with the sntp servers command. Use the no form to

disable SNTP client requests.

Syntax

[no] sntp client

Default Setting

Disabled

Command Mode

Global Configuration

Command Usage

• The time acquired from time servers is used to record accurate dates and

times for log events. Without SNTP, the switch only records the time starting

from the factory default set at the last bootup (i.e., 00:00:00, Jan. 1, 2001).

• This command enables client time requests to time servers specified via the

sntp servers command. It issues time synchronization requests based on the

interval set via the sntp poll command.

4-54

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Example

Console(config)#sntp server 10.1.0.19

Console(config)#sntp poll 60

Console(config)#sntp client

Console(config)#end

Console#show sntp

Current time: Dec 23 02:52:44 2002

Poll interval: 60

Current mode: unicast

SNTP status: Enabled

SNTP server: 10.1.0.19 0.0.0.0 0.0.0.0

Current server: 10.1.0.19

Console#

Related Commands

sntp server (4-55)

sntp poll (4-56)

show sntp (4-56)

sntp server

This command sets the IP address of the servers to which SNTP time requests are

issued. Use this command with no arguments to clear all time servers from the

current list.

Syntax

sntp server [ip1 [ip2 [ip3]]]

ip - IP address of an NTP time server.

(Range: 1-3 addresses)

Default Setting

None

Command Mode

Global Configuration

Command Usage

This command specifies time servers from which the switch will poll for time

updates when set to SNTP client mode. The client will poll the time servers in

the order specified until a response is received. It issues time synchronization

requests based on the interval set via the sntp poll command.

Example

Console(config)#sntp server 10.1.0.19

Related Commands

sntp client (4-54)

sntp poll (4-56)

show sntp (4-56)

4-55

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

sntp poll

This command sets the interval between sending time requests when the switch is

set to SNTP client mode. Use the no form to restore to the default.

Syntax

sntp poll seconds

no sntp poll

seconds - Interval between time requests. (Range: 16-16384 seconds)

Default Setting

16 seconds

Command Mode

Global Configuration

Example

Console(config)#sntp poll 60

Console(config)#

Related Commands

sntp client (4-54)

show sntp

This command displays the current time and configuration settings for the SNTP

client, and indicates whether or not the local time has been properly updated.

Command Mode

Normal Exec, Privileged Exec

Command Usage

This command displays the current time, the poll interval used for sending

time synchronization requests, and the current SNTP mode (i.e., unicast).

Example

Console#show sntp

Current time: Dec 23 05:13:28 2002

Poll interval: 16

Current mode: unicast

SNTP status : Enabled

SNTP server 137.92.140.80 0.0.0.0 0.0.0.0

Current server: 137.92.140.80

Console#

4-56

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

ntp client

This command enables NTP client requests for time synchronization from NTP time

servers specified with the ntp servers command. Use the no form to disable NTP

client requests.

Syntax

[no] ntp client

Default Setting

Disabled

Command Mode

Global Configuration

Command Usage

• The SNTP and NTP clients cannot be enabled at the same time. First disable

the SNTP client before using this command.

• The time acquired from time servers is used to record accurate dates and

times for log events. Without NTP, the switch only records the time starting

from the factory default set at the last bootup (i.e., 00:00:00, Jan. 1, 2001).

• This command enables client time requests to time servers specified via the

ntp servers command. It issues time synchronization requests based on the

interval set via the ntp poll command.

Example

Console(config)#ntp client

Console(config)#

Related Commands

sntp client (4-54)

ntp poll (4-58)

ntp server (4-57)

ntp server

This command sets the IP addresses of the servers to which NTP time requests are

issued. Use the no form of the command to clear a specific time server or all servers

from the current list.

Syntax

ntp server ip-address [version number] [key key-number]

no ntp server [ip-address]

• ip-address - IP address of an NTP time server.

• number - The NTP version number supported by the server. (Range: 1-3)

• key-number - The number of an authentication key to use in

communications with the server. (Range: 1-65535)

4-57

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Default Setting

Version number: 3

Command Mode

Global Configuration

Command Usage

• This command specifies time servers that the switch will poll for time updates

when set to NTP client mode. It issues time synchronization requests based

on the interval set with the ntp poll command. The client will poll all the time

servers configured, the responses received are filtered and compared to

determine the most reliable and accurate time update for the switch.

• You can configure up to 50 NTP servers on the switch. Re-enter this

command for each server you want to configure.

• NTP authentication is optional. If enabled with the ntp authenticate

command, you must also configure at least one key number using the ntp

authentication-key command.

• Use the no form of this command without an argument to clear all configured

servers in the list.

Example

Console(config)#ntp server 192.168.3.20

Console(config)#ntp server 192.168.3.21

Console(config)#ntp server 192.168.4.22 version 2

Console(config)#ntp server 192.168.5.23 version 3 key 19

Console(config)#

Related Commands

ntp client (4-57)

ntp poll (4-58)

show ntp (4-60)

ntp poll

This command sets the interval between sending time requests when the switch is

set to NTP client mode. Use the no form to restore to the default.

Syntax

ntp poll seconds

no ntp poll

seconds - Interval between time requests. (Range: 16-16384 seconds)

Default Setting

16 seconds

Command Mode

Global Configuration

4-58

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Example

Console(config)#ntp poll 60

Console(config)#

Related Commands

ntp client (4-57)

ntp authenticate

This command enables authentication for NTP client-server communications. Use

the no form to disable authentication.

Syntax

[no] ntp authenticate

Default Setting

Disabled

Command Mode

Global Configuration

Command Usage

You can enable NTP authentication to ensure that reliable updates are

received from only authorized NTP servers. The authentication keys and their

associated key number must be centrally managed and manually distributed to

NTP servers and clients. The key numbers and key values must match on

both the server and client.

Example

Console(config)#ntp authenticate

Console(config)#

Related Commands

ntp authentication-key (4-59)

ntp authentication-key

This command configures authentication keys and key numbers to use when NTP

authentication is enabled. Use the no form of the command to clear a specific

authentication key or all keys from the current list.

Syntax

ntp authentication-key number md5 key

no ntp authentication-key [number]

• number - The NTP authentication key ID number. (Range: 1-65535)

• md5 - Specifies that authentication is provided by using the message digest

algorithm 5.

4-59

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

• key - An MD5 authentication key string. The key string can be up to 32

case-sensitive printable ASCII characters (no spaces).

Default Setting

None

Command Mode

Global Configuration

Command Usage

• The key number specifies a key value in the NTP authentication key list. Up

to 255 keys can be configured on the switch. Re-enter this command for each

server you want to configure.

• Note that NTP authentication key numbers and values must match on both the

server and client.

• NTP authentication is optional. When enabled with the ntp authenticate

command, you must also configure at least one key number using this

command.

• Use the no form of this command without an argument to clear all

authentication keys in the list.

Example

Console(config)#ntp authentication-key 45 md5 thisiskey45

Console(config)#

Related Commands

ntp authenticate (4-59)

show ntp

This command displays the current time and configuration settings for the NTP

client, and indicates whether or not the local time has been properly updated.

Command Mode

Normal Exec, Privileged Exec

Command Usage

This command displays the current time, the poll interval used for sending

time synchronization requests, and the current NTP mode (i.e., unicast).

4-60

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Example

Console#show ntp

Current time: Jan 1 02:58:58 2001

Poll interval: 16

Current mode: unicast

NTP status : Enabled

NTP Authenticate status : Enabled

Last Update NTP Server: 0.0.0.0

Port: 0

Last Update time: Dec 31 00:00:00 2000 UTC

NTP Server 192.168.3.20 version 3

NTP Server 192.168.3.21 version 3

NTP Server 192.168.3.22 version 2

NTP Server 192.168.4.50 version 3 key 30

NTP Server 192.168.5.35 version 3 key 19

NTP Authentication-Key 12 md5 156S46Q24142414222711K66N80 7

NTP Authentication-Key 19 md5 Q33O16Q6338241J022S29Q731K7 7

NTP Authentication-Key 30 md5 D2V8777I51K1132K3552L26R6141O4 7

NTP Authentication-Key 45 md5 3U865531O13K38F0R8 7

NTP Authentication-Key 125 md5 A48S2810327947M76 7

Console#

clock timezone

This command sets the time zone for the switch’s internal clock.

Syntax

clock timezone name hour hours minute minutes {before-utc | after-utc}

• name - Name of timezone, usually an acronym. (Range: 1-29 characters)

• hours - Number of hours before/after UTC. (Range: 0-12 hours)

• minutes - Number of minutes before/after UTC. (Range: 0-59 minutes)

• before-utc - Sets the local time zone before (east) of UTC.

• after-utc - Sets the local time zone after (west) of UTC.

Default Setting

None

Command Mode

Global Configuration

Command Usage

This command sets the local time zone relative to the Coordinated Universal

Time (UTC, formerly Greenwich Mean Time or GMT), based on the earth’s

prime meridian, zero degrees longitude. To display a time corresponding to

your local time, you must indicate the number of hours and minutes your time

zone is east (before) or west (after) of UTC.

Example

Console(config)#clock timezone Japan hours 8 minute 0 after-UTC

Console(config)#

4-61

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Related Commands

show sntp (4-56)

calendar set

This command sets the system clock. It may be used if there is no time server on

your network, or if you have not configured the switch to receive signals from a time

server.

Syntax

calendar set hour min sec {day month year | month day year}

• hour - Hour in 24-hour format. (Range: 0-23)

• min - Minute. (Range: 0-59)

• sec - Second. (Range: 0-59)

• day - Day of month. (Range: 1-31)

september | october | november | december

• year - Year (4-digit). (Range: 2001-2100)

Default Setting

None

Command Mode

Privileged Exec

Example

This example shows how to set the system clock to 15:12:34, April 1st, 2004.

Console#calendar set 15 12 34 1 April 2004

Console#

show calendar

This command displays the system clock.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

Example

Console#show calendar

15:12:34 April 1 2004

Console#

4-62

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

System Status Commands

Table 4-23 System Status Commands

Command

Function

Mode

Page

show startup-config

Displays the contents of the configuration file (stored in flash

memory) that is used to start up the system

4-63

show running-config

show system

Displays the configuration data currently in use

Displays system information

4-65

4-67

NE, PE

show users

Shows all active console and Telnet sessions, including user

name, idle time, and IP address of Telnet clients

show version

Displays version information for the system

NE, PE

4-68

show startup-config

This command displays the configuration file stored in non-volatile memory that is

used to start up the system.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

• Use this command in conjunction with the show running-config command to

compare the information in running memory to the information stored in

non-volatile memory.

• This command displays settings for key command modes. Each mode group

is separated by “!” symbols, and includes the configuration mode command,

and corresponding commands. This command displays the following

information:

- SNMP community strings

- Users (names and access levels)

- VLAN database (VLAN ID, name and state)

- VLAN configuration settings for each interface

- IP address configured for the switch

- Spanning tree settings

- Any configured settings for the console port and Telnet

4-63

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Example

Console#show startup-config

building startup-config, please wait.....

username admin access-level 15

username admin password 0 admin

username guest access-level 0

username guest password 0 guest

enable password level 15 0 super

snmp-server community public ro

snmp-server community private rw

logging history ram 6

logging history flash 3

vlan database

vlan 1 name DefaultVlan media ethernet state active

interface ethernet 1/1

switchport allowed vlan add 1 untagged

switchport native vlan 1

interface vlan 1

ip address dhcp

line console

line vty

end

Console#

Related Commands

show running-config (4-65)

4-64

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

show running-config

This command displays the configuration information currently in use.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

• Use this command in conjunction with the show startup-config command to

compare the information in running memory to the information stored in

non-volatile memory.

• This command displays settings for key command modes. Each mode group

is separated by “!” symbols, and includes the configuration mode command,

and corresponding commands. This command displays the following

information:

- SNTP server settings

- SNMP community strings

- Users (names, access levels, and encrypted passwords)

- Event log settings

- VLAN database (VLAN ID, name and state)

- VLAN configuration settings for each interface

- IP address configured for the switch

- Layer 4 precedence settings

- Any configured settings for the console port and Telnet

4-65

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Example

Console#show running-config

building running-config, please wait.....

SNTP server 0.0.0.0 0.0.0.0 0.0.0.0

clock timezone hours 0 minute 0 after-UTC

SNMP-server community private rw

SNMP-server community public ro

username admin access-level 15

username admin password 7 21232f297a57a5a743894a0e4a801fc3

username guest access-level 0

username guest password 7 084e0343a0486ff05530df6c705c8bb4

enable password level 15 7 1b3231655cebb7a1f783eddf27d254ca

logging history ram 6

logging history flash 3

vlan database

vlan 1 name DefaultVlan media ethernet state active

interface ethernet 1/1

switchport allowed vlan add 1 untagged

switchport native vlan 1

interface vlan 1

ip address DHCP

no map IP precedence

no map IP DSCP

line console

line vty

end

Console#

Related Commands

show startup-config (4-63)

4-66

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

show system

This command displays system information.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

Command Usage

• For a description of the items shown by this command, refer to “Displaying

System Information” on page 3-10.

• The POST results should all display “PASS.” If any POST test indicates

“FAIL,” contact your distributor for assistance.

Example

Console#show system

System description: Layer2+ Fast Ethernet Standalone Switch ES3526XA

System OID string: 1.3.6.1.4.1.259.6.10.74

System information

System Up time:

System Name:

0 days, 0 hours, 0 minutes, and 7.18 seconds

[NONE]

System Location:

System Contact:

MAC address:

Web server:

Web server port:

Web secure server:

[NONE]

00-30-F1-D3-26-00

enabled

Web secure server port: 443

Telnet server

Telnet port

Jumbo Frame :

POST result

: enable

: 23

Disabled

Dummy Test 1.................PASS

UART LOOP BACK Test..........PASS

DRAM Test....................PASS

Timer Test...................PASS

Switch Int Loopback test.....PASS

Done All Pass.

Console#

show users

Shows all active console and Telnet sessions, including user name, idle time, and IP

address of Telnet client.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

4-67

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Command Usage

The session used to execute this command is indicated by a “*” symbol next to

the Line (i.e., session) index number.

Example

Console#show users

Username accounts:

Username Privilege Public-Key

-------- --------- ----------

admin

guest

steve

None

RSA

Online users:

Line

Username Idle time (h:m:s) Remote IP addr.

----------- -------- ----------------- ---------------

* 1

console

VTY 0

SSH 1

admin

steve

0:14:14

0:00:00

0:00:06

192.168.1.19

Web online users:

Line Remote IP addr Username Idle time (h:m:s).

----------- -------------- -------- ------------------

HTTP 192.168.1.19 admin 0:00:00

Console#

show version

This command displays hardware and software version information for the system.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

Command Usage

See “Displaying Switch Hardware/Software Versions” on page 3-11 for detailed

information on the items displayed by this command.

4-68

Download from Www.Somanuals.com. All Manuals Search And Download.

System Management Commands

Example

Console#show version

Unit1

Serial number

Service tag:

:A419048860

Hardware version

Module A type

Module B type

Number of ports

Main power status

:R0B

:1000BaseT

:26

:up

Redundant power status :not present

Agent(master)

Loader version:

Boot ROM version:

2.2.1.4

2.2.1.9

Operation code version: 0.2.6.3

Console#

Frame Size Commands

Table 4-24 Frame Size Commands

Command

Function

Mode

Page

4-69

jumbo frame

Enables support for jumbo frames

jumbo frame

This command enables support for jumbo frames. Use the no form to disable it.

Syntax

[no] jumbo frame

Default Setting

Disabled

Command Mode

Global Configuration

Command Usage

• This switch provides more efficient throughput for large sequential data

transfers by supporting jumbo frames up to 9216 bytes. Compared to

standard Ethernet frames that run only up to 1.5 KB, using jumbo frames

significantly reduces the per-packet overhead required to process protocol

encapsulation fields.

• To use jumbo frames, both the source and destination end nodes (such as a

computer or server) must support this feature. Also, when the connection is

operating at full duplex, all switches in the network between the two end nodes

must be able to accept the extended frame size. And for half-duplex

connections, all devices in the collision domain would need to support jumbo

frames.

4-69

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

• Enabling jumbo frames will limit the maximum threshold for broadcast storm

control. (See the switchport broadcast command on page 4-137.)

• The current setting for jumbo frames can be displayed with the show system

command (page 4-67).

Example

Console(config)#jumbo frame

Console(config)#

Flash/File Commands

These commands are used to manage the system code or configuration files.

Table4-25 Flash/File Commands

Command

copy

Function

Mode

Page

Copies a code image or a switch configuration to or from flash PE

memory or a TFTP server

delete

Deletes a file or code image

4-73

4-74

4-75

dir

Displays a list of files in flash memory

Displays the files booted

whichboot

boot system

Specifies the file or image used to start up the system

copy

This command moves (upload/download) a code image or configuration file

between the switch’s flash memory and a TFTP server. When you save the system

code or configuration settings to a file on a TFTP server, that file can later be

downloaded to the switch to restore system operation. The success of the file

transfer depends on the accessibility of the TFTP server and the quality of the

network connection.

Syntax

copy file {file | running-config | startup-config | tftp }

copy running-config { file | startup-config | tftp }

copy startup-config { file | running-config | tftp }

copy tftp {file | running-config | startup-config | https-certificate |

public-key }

• file - Keyword that allows you to copy to/from a file.

• running-config - Keyword that allows you to copy to/from the current

running configuration.

• startup-config - The configuration used for system initialization.

• tftp - Keyword that allows you to copy to/from a TFTP server.

• https-certificate - Copies an HTTPS certificate from an TFTP server to the

switch.

4-70

Download from Www.Somanuals.com. All Manuals Search And Download.

Flash/File Commands

• public-key - Keyword that allows you to copy a SSH key from a TFTP

server. (“Secure Shell Commands” on page 4-35)

Default Setting

None

Command Mode

Privileged Exec

Command Usage

• The system prompts for data required to complete the copy command.

• The destination file name should not contain slashes (\ or /), the leading letter

of the file name should not be a period (.), and the maximum length for file

names on the TFTP server is 127 characters or 31 characters for files on the

switch. (Valid characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

• Due to the size limit of the flash memory, the switch supports only two

operation code files.

• The maximum number of user-defined configuration files depends on

available memory.

• You can use “Factory_Default_Config.cfg” as the source to copy from the

factory default configuration file, but you cannot use it as the destination.

• To replace the startup configuration, you must use startup-config as the

destination.

• The Boot ROM and Loader cannot be uploaded or downloaded from the TFTP

server. You must follow the instructions in the release notes for new firmware,

or contact your distributor for help.

• For information on specifying an https-certificate, see “Replacing the Default

Secure-site Certificate” on page 3-60. For information on configuring the

switch to use HTTPS/SSL for a secure connection, see “ip http secure-server”

on page 4-32.

Example

The following example shows how to upload the configuration settings to a file on

the TFTP server:

Console#copy file tftp

Choose file type:

1. config: 2. opcode: <1-2>: 1

Source file name: startup

TFTP server ip address: 10.1.0.99

Destination file name: startup.01

TFTP completed.

Success.

Console#

4-71

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

The following example shows how to copy the running configuration to a startup file.

Console#copy running-config file

destination file name: startup

Write to FLASH Programming.

\Write to FLASH finish.

Success.

Console#

The following example shows how to download a configuration file:

Console#copy tftp startup-config

TFTP server ip address: 10.1.0.99

Source configuration file name: startup.01

Startup configuration file name [startup]:

Write to FLASH Programming.

\Write to FLASH finish.

Success.

Console#

This example shows how to copy a secure-site certificate from an TFTP server. It

then reboots the switch to activate the certificate:

Console#copy tftp https-certificate

TFTP server ip address: 10.1.0.19

Source certificate file name: SS-certificate

Source private file name: SS-private

Private password: ********

Success.

Console#reload

System will be restarted, continue <y/n>? y

This example shows how to copy a public-key used by SSH from an TFTP server.

Note that public key authentication via SSH is only supported for users configured

locally on the switch:

Console#copy tftp public-key

TFTP server IP address: 192.168.1.19

Choose public key type:

1. RSA: 2. DSA: <1-2>: 1

Source file name: steve.pub

Username: steve

TFTP Download

Success.

Write to FLASH Programming.

Success.

Console#

4-72

Download from Www.Somanuals.com. All Manuals Search And Download.

Flash/File Commands

delete

This command deletes a file or image.

Syntax

delete filename

filename - Name of the configuration file or image name.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

• If the file type is used for system startup, then this file cannot be deleted.

• “Factory_Default_Config.cfg” cannot be deleted.

Example

This example shows how to delete the test2.cfg configuration file from flash memory.

Console#delete test2.cfg

Console#

Related Commands

dir (4-73)

delete public-key (4-39)

dir

This command displays a list of files in flash memory.

Syntax

dir {{boot-rom: | config: | opcode:} [:filename]}

The type of file or image to display includes:

• boot-rom - Boot ROM (or diagnostic) image file.

• config - Switch configuration file.

• opcode - Run-time operation code image file.

• filename - Name of the configuration file or code image.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

If you enter the command dir without any parameters, the system displays all

files.

4-73

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

• File information is shown below:

Table 4-26 File Directory Information

Description

Column Heading

file name

file type

The name of the file.

File types: Boot-Rom, Operation Code, and Config file.

Shows if this file is used when the system is started.

The length of the file in bytes.

startup

size

Example

The following example shows how to display all file information:

Console#dir 1:

file name

file type

startup size (byte)

-----------------------------------

ES3552XA_diag_v2.2.1.8.bix

ES3552XA_Opcode_V2.2.6.2.bix

ES3552XA_V2260.bix

-------------- ------- -----------

Boot-Rom image Y

Operation Code Y

Operation Code N

214124

1749228

1745500

5197

Factory_Default_Config.cfg

Config File

-------------------------------------------------------------------------

Total free space: 3345728

Console#

whichboot

This command displays which files were booted when the system powered up.

Syntax

whichboot

Default Setting

None

Command Mode

Privileged Exec

Example

This example shows the information displayed by the whichboot command. See

the table under the dir command for a description of the file information displayed by

this command.

Console#whichboot

file name

------------------

file type startup

------------- -------

Boot-Rom image Y

size (byte)

-----------

ES3552XA_diag_v2.2.1.8.bix

214124

ES3552XA_Opcode_V2.2.6.2.bix

Factory_Default_Config.cfg

Operation Code Y

1749228

5197

Config File

Console#

4-74

Download from Www.Somanuals.com. All Manuals Search And Download.

Flash/File Commands

boot system

This command specifies the image used to start up the system.

Syntax

boot system {boot-rom| config | opcode}: filename

The type of file or image to set as a default includes:

• boot-rom* - Boot ROM.

• config* - Configuration file.

• opcode* - Run-time operation code.

• filename - Name of the configuration file or code image.

* The colon (:) is required.

Default Setting

None

Command Mode

Global Configuration

Command Usage

• A colon (:) is required after the specified file type.

• If the file contains an error, it cannot be set as the default file.

Example

Console(config)#boot system config: startup

Console(config)#

Related Commands

dir (4-73)

whichboot (4-74)

4-75

Download from Www.Somanuals.com. All Manuals Search And Download.

Command Line Interface

Authentication Commands

You can configure this switch to authenticate users logging into the system for

management access using local or RADIUS authentication methods. You can also

enable port-based authentication for network client access using IEEE 802.1X.

Table 4-27 Authentication Commands

Command Group

Authentication Sequence

RADIUS Client

Function

Page

Defines logon authentication method and precedence

Configures settings for authentication via a RADIUS server

Configures settings for authentication via a TACACS+ server

Configures secure addresses for a port

TACACS+ Client

Port Security

Port Authentication

Network Access

Configures host authentication on specific ports using 802.1X

Configures MAC authentication and dynamic VLAN assignment

Authentication Sequence

Table 4-28 Authentication Sequence

Function

Command

Mode

Page