Manuel d'utilisation / d'entretien du produit SMC6224M du fabricant SMC Networks
Aller à la page of 522
T igerStack 10/100 24/48-P ort 10/100Mbps Stackable Managed Switch Management Guide ◆ 24/48 au to-MDI/M DI-X 10BASE-T/100B AS E-TX ports ◆ 2 Gigabit RJ-45 port s shared with 2 SFP transcei ver slo.
.
38 T esla Irvine, CA 9261 8 Phone: (9 49) 679-8000 T igerStack 10/100 Management Guide From SMC’ s T iger line of feature-r i ch w orkgroup LAN solutions Janu ary 2 005 Pub.
Infor mation fur nished by SMC Networks , In c . (SMC) is believed to be accu- rate and reliable. How ever, no responsibility is assumed by SMC for its use, nor fo r any inf ringeme nts of pa tents or oth er rights of third pa rtie s which may result from its use.
i L IMITED W ARRANTY Limited W ar ranty Statement: SMC Networks, Inc. (“SM C”) war rants it s products to be free from defects in w orkmanship and materials, under nor mal use and ser vice, for t he applicable warranty term .
L IMIT ED W AR RAN TY ii WARRA NTIES EXCLUSIVE : IF AN SMC PR ODUCT DOES NOT OPERA TE AS W ARRANTED ABO VE, CUSTOM ER’S SOLE REMED Y SHALL BE R EP AIR OR REPLA CEMENT OF THE PR ODUCT IN QUESTION , A T SMC’S OPTION .
iii C ONTENTS 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Key Featu res . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Descripti on of Software Features . . .
C ONTENTS iv Displaying Sw itch Hardware/S oftware Version s . . . . . . . . . . . 3-13 Displaying Bridge Extension Capabilitie s . . . . . . . . . . . . . . . . . 3-15 Setting th e Switch’s IP Ad dress . . . . . . . . . . . . . . . . . . . . . . . .
C ONTENTS v Filtering A ddresses fo r Management A ccess . . . . . . . . . . . . . . . 3-75 Access Con trol Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-77 Configuri ng Access Cont rol Lists . . . . . . . . .
C ONTENTS vi Displaying Ba sic VLAN Infor mation . . . . . . . . . . . . . . . 3-148 Displaying C urrent VLAN s . . . . . . . . . . . . . . . . . . . . . . . 3-149 Creating VL ANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-151 Adding Stat ic Members to V LANs (VLAN I ndex) .
C ONTENTS vii Telnet Co nnection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-2 Entering Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-4 Keywor ds and Argu ments . . . . . . . .
C ONTENTS viii quit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-31 System Man agement Com mands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-32 Device Desi gnation Command s . . . . .
C ONTENTS ix clear log ging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-63 show logg ing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-63 show log . . . . . . . . . . . . . . . . . . . . . . .
C ONTENTS x RADIUS Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-96 radius-ser ver host . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-97 radius-ser ver port . . . . . . . . . . . . . . . . . .
C ONTENTS xi MAC ACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-127 access-list mac . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-127 permit , deny (MAC ACL ) . . . . . . . . . . . . . . . . .
C ONTENTS xii show rate-lim it . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-161 Link Ag gregation C ommands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-161 channel -group . . . . . . . . . . . . . . .
C ONTENTS xiii Configuri ng VLAN Interfa ces . . . . . . . . . . . . . . . . . . . . . . . . . 4-198 interfac e vlan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-198 switchpor t mode . . . . . . . . . . . . . . . . . . . . .
C ONTENTS xiv map ip prece dence (I nterface Con figuration) . . . . . . . . . 4-230 map ip dscp (Global Configu ration) . . . . . . . . . . . . . . . . 4-231 map ip dscp (Interface Con figuration) . . . . . . . . . . . . . . . 4-231 show map ip p ort .
C ONTENTS xv A PPEN DICES : A Software Specifications . . . . . . . . . . . . . . . . . . . . . . . . . A-1 Software Fe atures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A-1 Managem ent Features . . . . . . .
C ONTENTS xvi.
xvii T ABLES Table 1-1 Key Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-1 Table 1-2 System Defa ults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1-7 Table 3-1 Configur ation Option s . . . . .
T ABLES xviii Table 4-21 SMTP Alert Commands . . . . . . . . . . . . . . . . . . . . . . . . . 4-66 Table 4-22 Time Comma nds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4-71 Table 4-23 System Stat us Commands . . . . . . . . . . . .
T ABL ES xix Table 4-58 Priority C ommands (Lay er 2) . . . . . . . . . . . . . . . . . . . . 4-220 Table 4-59 Default CoS Pr iority Levels . . . . . . . . . . . . . . . . . . . . . . 4-224 Table 4-60 Priority C ommands (Layer 3 and 4) . . . . . . . .
T ABLES xx.
xxi F IGURES Figure 3-1 Ho me Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-3 Figure 3-2 P anel Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-4 Figure 3-3 S ystem Inform ation . . . . .
F IGU R ES xxii Figure 3-37 ACL Config uration - Exten ded IP . . . . . . . . . . . . . . . . . 3-83 Figure 3-38 ACL Config uration - MAC . . . . . . . . . . . . . . . . . . . . . . . 3-85 Figure 3-39 Binding a Port to an ACL . . . . . . . . . . . . .
F IGU R ES xxiii Figure 3-74 Queue Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-173 Figure 3-75 Configuri ng Queue Schedu ling . . . . . . . . . . . . . . . . . . . 3-174 Figure 3-76 IP Prece dence/DSCP Prio rity Status . .
F IGU R ES xxiv.
1-1 C HAPTER 1 I NTRODUCTION This sw itch provides a broad range of features for La yer 2 switc hing. It include s a management agent t hat allows you to conf igure the featu res listed in this man u al. The default conf iguration can be used for mos t of the featu res provid ed by t his switc h.
I NTR O DUC TI ON 1-2 Descri ption of Softwa re Featu res Th e switch provide s a wide rang e of a dvanced perfor mance enh ancing featu res. Flow contro l eliminates the loss of packet s due to bott lenecks caused by port sa turation . Broadcas t stor m supp ression pr events broad cast traffic storms from engulfing the n et w ork.
D ESCRIPTION OF S OFTWARE F EAT UR ES 1-3 Configuration Backup and Restore – Y ou can sa ve the cur rent configuration s ettings to a file on a TFTP ser ver , and later download this file to restore the switch configuration s ettings .
I NTR O DUC TI ON 1-4 Rate Limiting – T his feature c ont rols the m aximum r at e for traffic transmi tted or recei ved on an interface . Rate limi ting is conf igured on inte rfaces a t the edge of a netw ork to limit tr affic in to or o ut of the network.
D ESCRIPTION OF S OFTWARE F EAT UR ES 1-5 Store-and-F orward S witching – The switch copies eac h frame into i ts memor y b efore for warding them to an other por t. T his en sures tha t all frames are a standard E ther net si ze and hav e been v erified for ac curacy with t he cyclic redund ancy chec k (CRC).
I NTR O DUC TI ON 1-6 switch to res trict tr affic to the VLAN g roups to which a user has be en assigne d. By segme nting your ne twork into VLA Ns , you ca n: • Eliminat e broadcast storms whic h severely degrade pe rformance in a flat ne twork.
S YSTEM D EFAULTS 1-7 System Defaults The swit c h ’ s system defaults are provided in the config uration file “Factor y_Default_ Config.cfg. ” To reset th e switch de faults, this file should be s et as the startup conf iguration file (page 3-23).
I NTR O DUC TI ON 1-8 Web Managem ent HTT P Se rve r Ena bled HTTP Port Number 80 HTTP Secure Server Enabled HTT P Se cure P ort Num ber 443 SNMP Co mmunity String s “pu blic” ( read on ly) “pri.
S YSTEM D EFAULTS 1-9 Virtual LANs Default VLAN 1 PVID 1 Acceptab le Frame Type All Ingress F iltering Disabled Switchport Mod e (Egress Mode) Hybrid: t agged/unta gged frames GVRP (global) Disabled G.
I NTR O DUC TI ON 1-10.
2-1 C HAPTER 2 I NITI AL C ONFIGURATI ON Connect ing to the Switch Configuration Opt ions The switc h includes a built-in ne twor k m anagem ent agent. The agent offer s a variety of man ageme nt options, includ ing SNMP , RM ON (Groups 1, 2, 3, 9) and a w eb- based interface .
I NI TIA L C ONFIGURATION 2-2 The swi tch’ s web interface , CLI config uration prog ram, and SNMP agent allow you to perf or m the following manageme nt functio ns: • Set us er n ames an d passw .
C ONNECTING TO THE S WITCH 2-3 Attach a VT100-compatible ter minal, or a PC r unning a ter minal emu lation pro g ram to the switc h. Y ou can use the consol e cable pro vided with this pac kage, or us e a null-m odem cable th at compli es with the w iring assignmen ts shown in th e Installation Guide.
I NI TIA L C ONFIGURATION 2-4 F or a descr iption of how to use the CLI, see “Using th e Command Li ne Interface” on page 4-1. F or a list of all the CLI commands and detailed information on usi ng the CLI, refer to “Co mmand Groups” on pa g e 4-12.
S TACK O PERATIONS 2-5 Stack Operations Y ou can stack up to eight SMC6224M units , four SMC6248M units, or four uni ts when bo t h s witch ty pes are stac ked togeth er. R efer to the Installation Guide for details on stacking the se units . One unit in the stack acts as the Mast er for configuration tasks and fir mware upgrade.
I NI TIA L C ONFIGURATION 2-6 Recovering from Stack Failure or Topology Change Note the follo wing points about r ecovering from a stack c hang e: • When using a “line” to pology, if any link or unit in th e stack fails, the stack will be split int o two separate segmen ts.
B ASIC C ONFIGURATION 2-7 Basic Configuratio n Console Connectio n The CLI program provid es tw o differ ent comma nd lev els — normal access level (Nor mal Exec) and privileged access level (Privileged Exec).
I NI TIA L C ONFIGURATION 2-8 Setting Passwords Note: If th is is your first time to log into the CLI p rogram, you should define new passw o rds for both de fault user nam es using the “usernam e” command, reco rd them and pu t them in a s afe place.
B ASIC C ONFIGURATION 2-9 Setting an IP Address Y ou must est ablish IP address infor matio n for the stack to obtain manag ement a ccess t hrough t he network. T his can be done in either of the following ways: Manual — Y ou have to input the infor m ation, including IP address and subnet ma sk.
I NI TIA L C ONFIGURATION 2-10 2. T ype “ip address ip-address netmask , ” where “i p-address” is the swit ch IP addre ss and “net mask” is the n etwork mask for the ne twork. Press <Ente r>. 3. T ype “ex it” to return to the global c onfiguration mode prompt.
B ASIC C ONFIGURATION 2-11 2. At the interf ace-configu ration mode pr ompt, use on e of the fol lowing commands: • To obtain IP settings vi a DHCP, type “ip addres s dhcp” and press <Ente r>. • To obtai n IP settings via BOOTP, t ype “ip ad dress bootp ” and press <Enter >.
I NI TIA L C ONFIGURATION 2-12 When SNM P management stations send request s to the sw itch (ei ther to return in for mation or to set a parameter) , the switch provides the request ed data or set s th e specified para meter .
B ASIC C ONFIGURATION 2-13 2. T o remove an existing string, simp ly type “no snmp -ser ver comm un ity string , ” where “stri ng” is the c ommunity access strin g to remo ve. Press <Ente r>. Trap Receiver s Y ou can also specify SNMP stations th at are to recei ve trap s from the switc h.
I NI TIA L C ONFIGURATION 2-14 2. Enter t he name of the start-up file. Press <Enter>. Managing System Files Th e switch’ s flash me mor y suppor ts three ty pes of system f iles that can be managed b y the CLI pr og ram, w eb interf ace, or SNMP .
M ANAGING S YSTEM F ILES 2-15 Due to the size limit of the f lash me mor y , the s witch suppor ts only two operation code files . Howev e r , you can have as many diagnostic code files and configuration file s as av ailable f lash memor y space allows .
I NI TIA L C ONFIGURATION 2-16.
3-1 C HAPTER 3 C ONFIGURING THE S WITCH Using the We b Interface Th is switch provides a n embedde d HTTP web ag ent. Usin g a web browser you c an config ure the switc h and view st atistics to monitor netw ork acti vity . The web agent can be accesse d by any c omputer on th e netw ork using a st andard web br owser (Inte rne t Explorer 5.
C ONFIGURING THE S WI TCH 3-2 Notes: 1. Yo u are allow ed three at tempts to en ter the cor rect passw ord; on th e third failed at tempt the curr ent connec tion is terminate d. 2. If you log into th e web interface as guest (Normal Exec level), you ca n view the co nfiguratio n settings or change the guest password.
N AVIGATIN G THE W EB B RO WS ER I NTE RFA CE 3-3 Navigati ng the Web Brow ser Int erface T o access the w eb-browser inte rface you mus t first enter a user name and passw ord. The administrator h as Read/W rite access to all conf ig urat i on parameter s and stati stics .
C ONFIGURING THE S WI TCH 3-4 Configuration Opt ions Configur able param eters hav e a dialog bo x or a dro p-down li st. Once a config uration cha nge has been made on a p age, be su re to click on the Apply bu tton to con fir m the new setting . T he fol lowing table su mmarizes the w eb page confi guration b uttons .
M AIN M ENU 3-5 Main Menu Using t he onboard w eb agent, y ou can define s ystem param eters, manage and control the switch, and all its por ts , o r monitor network condit ions . The following table briefly des cribes the selection s av ailable from this prog ram .
C ONFIGURING THE S WI TCH 3-6 SNTP 3-42 Configuratio n Configures SNTP client se ttings, including broadcast m ode or a specified list of servers 3-4 2 Clock T ime Zone Sets the local time zone for th.
M AIN M ENU 3-7 IP Filter Sets IP address es of clients allowed manageme nt access via the web, SN MP, and Telnet 3-7 5 Port 3- 88 Port Inform ation D isplays port connection status 3-88 Trunk I nform.
C ONFIGURING THE S WI TCH 3-8 Output Port Conf iguration Sets the output rate limit for each port 3-114 Output Trunk Con fi gura tion Sets the output rate limit for each trunk 3-114 Port Statistics Li.
M AIN M ENU 3-9 Static Membership by Port Configures m embership type for interfaces , including tagg ed, untagged or forbidd en 3-156 Port Conf iguration Spec ifies default PVID and VLAN attribu tes .
C ONFIGURING THE S WI TCH 3-10 Queue Sched uling Config ures Weighted Ro und Robin queu eing 3-174 IP Preceden ce/ DSCP Priority Status Globally se lects IP Precedence or DSCP Priority, or dis ables both.
B ASIC C ONFIGURATION 3-11 Basic Configuratio n Displaying System Inform ation Y ou can easi ly identify the system b y displa ying the devic e name, loc ation and conta ct infor mation. Field Attribut es • System N ame – Name as signed to th e switch syst em.
C ONFIGURING THE S WI TCH 3-12 We b – Click Syste m, Syst em Inf or matio n. Speci fy the system name, location , and contact information for th e system admini strator , then cl ick Apply . (Thi s pag e also inclu des a T el net butt on that allows access to the Command Line Interface via T elnet.
B ASIC C ONFIGURATION 3-13 CLI – Specify the h ostname, location and contact infor mation . Displaying Switch Hardware/Software Versions Use the Switch Infor matio n page to disp lay hardware/firmware version numbe rs for the main board and manag ement software, as well as the pow er status of t he system.
C ONFIGURING THE S WI TCH 3-14 • Internal Power Status – Displays the st atus of the internal powe r supply. Manageme nt Software • Loader Versio n – Version nu mber of lo ader co de. • Boot-RO M Versio n – Version of Power-On Self-Test (POST) and boot code .
B ASIC C ONFIGURATION 3-15 CLI – Use the followin g command to display version infor mation. Displaying Bridge Extension Capabilities Th e Bridg e MIB includ es extens ions for mana ged d evices that su ppor t Multicast Filtering , T raffic Classes , and V ir tual LAN s.
C ONFIGURING THE S WI TCH 3-16 • Configurable PVID Tagging – This switch a ll ows yo u to override the defau lt Port VLAN ID (PVID used in frame tags) a nd egress statu s (VLAN- Tagged or Unta gged) on each port. (R efer to “VLAN Configuration” on page 3-143.
B ASIC C ONFIGURATION 3-17 CLI – Enter the following command. Setting the Switch’s IP Address Th is section d escribe s how to config ure an IP in terfac e for mana gement access over th e netwo rk. T he IP ad dress for the st ack is obtain ed via DHCP b y default.
C ONFIGURING THE S WI TCH 3-18 Requests will be broadcast period ically by the switch for an IP address. (DHCP/B OOT P val ues can include the I P address, subn et mask, and default ga teway.) • IP Address – Address of the VLAN interface that is allo wed manag ement access.
B ASIC C ONFIGURATION 3-19 CLI – Specify t he management interf ace, IP addres s and default gatew ay . Usin g DHCP/ BOOT P If you r network p rovides D HCP /BOOTP ser vi ces, you can conf igure the switc h to be dyna mically config ured by th ese ser vices .
C ONFIGURING THE S WI TCH 3-20 CLI – Spec ify the man agement in terface, a nd set the I P address mod e to DHCP or BOOTP , and th en ente r the “ip dhcp re star t” com mand. Renewing DCHP – DHCP may lease addres ses to cli ents in defin itely or for a sp ecific period of time .
B ASIC C ONFIGURATION 3-21 Managing Firmware Y ou can uploa d/downloa d fir mware to or from a TF TP ser ver, or copy files to and from sw itch units in a stack. By saving ru ntime code to a file on a TFTP se r v e r , tha t file can later b e downloaded to the switch to rest ore operat ion.
C ONFIGURING THE S WI TCH 3-22 Downloading System Software from a Server When do wnloadin g r untime cod e, yo u can speci fy the desti nation fi l e name to re place t he current image, or firs t download the file using a differe nt name from th e cur rent r untime code file, and t hen set the new file as the star tup file.
B ASIC C ONFIGURATION 3-23 If you download to a new destinatio n file, go to the System/File/Set Start-Up me n u , mark the operation code file used at star tup , and click Apply . T o st ar t the new fir mware , reboot the system via the System/R eset menu.
C ONFIGURING THE S WI TCH 3-24 CLI – T o download new fir mware for m a TF TP ser ver, enter the IP addres s of the TF TP ser ver, select “opcode ” as the fil e type, then e nter the source and d estination file names . W hen the file h as finished downloading, set the new file to star t up the system , and then re star t the switch.
B ASIC C ONFIGURATION 3-25 - runni ng-config to startup- config – Copie s the runni ng config to the start up config . - runni ng-config to tf tp – Copies the running configuration to a TFTP serve r. - startup-c onfig to file – Copies the startup c onfiguration to a file on the s witch.
C ONFIGURING THE S WI TCH 3-26 Download ing Configuratio n Settings fro m a Ser ver Y ou can do wnload th e configur ation file un der a new f ile name and then set it as the startup fil e, or y ou can specify the current startup configuration file as the desti nation file to directly re place it.
B ASIC C ONFIGURATION 3-27 If you downloa d to a new f ile name us ing “tftp to s tar tup-conf ig” or “tft p to file, ” the file is automatically set as the star t-up configuration file . T o use the ne w settings , reboot the system via t he System/R eset men u.
C ONFIGURING THE S WI TCH 3-28 Consol e Port Se ttings Y ou can access the onboard configuration program by attaching a VT100 compa tible device t o th e switch ’ s ser ial console por t. M anagement access throu gh the co nsole po rt is contro lled by various pa rameters, incl uding a password, time outs, and basic com munication se ttings.
B ASIC C ONFIGURATION 3-29 • Speed – Sets th e ter minal lin e’ s ba ud rate for tra nsmit (to t er minal) and receive (from ter mina l). Set the s peed to match th e baud rate of the device connected to the serial port.
C ONFIGURING THE S WI TCH 3-30 CLI – Enter Li ne Configura t ion m ode for the c onsole, then specify t h e connec tion parame ters as requir ed. T o displa y the current conso le port settings, use th e show line command from t he Nor mal Ex ec level .
B ASIC C ONFIGURATION 3-31 • Telnet Port Number – Sets the TCP p or t num ber for T elnet on the switch. (Default: 23) • Login Timeout – Se ts the inte r val that the system w aits fo r a user t o log into the CLI. If a login atte mpt is not dete cted with in the timeou t inte rval, the conne ction is ter m inat ed for the ses sion.
C ONFIGURING THE S WI TCH 3-32 We b – Clic k System, Line , T elnet . Specify the co nnection param eters for T e lnet access, t h en c li c k Apply . Figure 3-14 Enabling Telnet CLI – Enter Line Conf iguration mode fo r a virtual ter minal, then sp ecify the co nnection paramet ers as required.
B ASIC C ONFIGURATION 3-33 Configuring Event Log ging The switch allows you to control the log ging of er ror messages, including the ty pe of ev ents that are reco rded in swi tch memory , logging to a remot e System Log (syslog) ser ve r, and di splays a list of re cent eve nt messages .
C ONFIGURING THE S WI TCH 3-34 • RAM Level – Limits log messages save d to the switc h’s temporary RAM memory for all levels up to the spe cified level. For example, if level 7 is sp ecified, all messages from le vel 0 to level 7 will be logged to RAM.
B ASIC C ONFIGURATION 3-35 We b – Click System, Log, System Logs . Specify System Log St atus, set the lev el of ev ent messages to be lo g g ed to RAM and f lash me mor y , then cl ick Apply . Figure 3-15 System Logs CLI – Enable system log gi ng and then specify th e level of messages to be logg ed to RAM and flash memory .
C ONFIGURING THE S WI TCH 3-36 The fac i lit y type is used by the sysl og server to d i sp atch log messag es to an appropri ate service. The attribute specifies the facility type tag se nt in syslog messages. (See RFC 3164.) This type has no effect on the kin d of messages reported by the s witch.
B ASIC C ONFIGURATION 3-37 We b – C lick Sy stem , Log, Remote Logs. T o add an IP ad dres s to th e Hos t I P L i st , t y p e t h e n e w I P a d d r e s s i n th e H o s t I P A d d r es s b ox , a n d t h e n c l ic k Add. T o delete an IP add ress, click the en tr y in th e Host IP List, and then click R emove.
C ONFIGURING THE S WI TCH 3-38 Displaying Log Messages The Log s page allows you to scroll through the lo gg ed syste m and event messages. The switc h can store up to 2048 log entries in temporary random access memor y (RA M; i.e., memory f lushed on power reset) and up to 4096 entries in per manent flash memor y .
B ASIC C ONFIGURATION 3-39 Sending Simple Mail Transfer Proto col Alerts T o alert system administra tors of proble ms , the switc h can use SMTP (Simple Mail T ra nsfer Prot ocol) t o send email messages whe n trigg ered by log ging events o f a specified level.
C ONFIGURING THE S WI TCH 3-40 We b – Click System, Log, SMTP . Enable SMTP , sp ecify a sour ce email address , and select the minimum sev erity level. T o add an IP address to the SMTP Ser v er List, type the new IP address in the SM T P Server field an d click Add.
B ASIC C ONFIGURATION 3-41 CLI – Enter the IP address o f at least one SM TP ser v er, set the syslog severity lev e l to trig ger an email messag e, and specify the switch (source) and up to five recipie nt (destina tion) em ail address es . Ena ble SMTP with the logging sendmai l command to co mplete the co nfiguration .
C ONFIGURING THE S WI TCH 3-42 CLI – Use th e reload command to restart the s witch. W hen prompted, confir m tha t you want to reset the switch. Note: When restarting th e system, it will always run the Power-On Self-Test.
B ASIC C ONFIGURATION 3-43 • SNTP Ser ver – Sets the I P address for up to three ti me servers. Th e switch att empts to upda te the time from the first serve r, if this fails it attempts a n update fr om the next ser ver in the seq uence. We b – Select SNTP , Conf iguration.
C ONFIGURING THE S WI TCH 3-44 Setti ng the Time Zone SNTP uses Co ordinated Uni versal T ime (or UTC , for merly Gre enwich Mean T ime, or GMT) based on the tim e at the Ea r th’ s pri me meridian , zero deg rees longitud e.
S IMP LE N ETWORK M ANAGEME NT P RO TO C OL 3-45 Simple Netw ork Management Protocol Simple Ne twork Manage ment Protoc ol (SNMP) is a communication protoc ol desig ned spec ifically for managing d evices on a network. Equipmen t commonly ma naged with SNMP in cludes switch es, ro uters and h ost compu ters.
C ONFIGURING THE S WI TCH 3-46 • Acce ss Mode - Read-Only – Specifies read-o nly access. Au thorized m anag ement stations are only able to re trieve MIB objects. - Read/Write – Sp ecifies read -write access . Au thorized management stations are able to bo th retrieve and modify MIB ob jects.
S IMP LE N ETWORK M ANAGEME NT P RO TO C OL 3-47 Command Att ributes • Trap Manager Capability – This switch supports up to five trap managers. • Current – Displays a list of th e trap manage rs currentl y configured . • Trap Manager IP Address – IP addre ss of th e host (th e targ eted recip ient).
C ONFIGURING THE S WI TCH 3-48 CLI – This example adds a t rap manager and enables bo th authentication and link-up , link-down traps. User Aut henticat ion Y ou can rest rict management access to this switch using the following options: • User Accounts – Manu ally con figur e acces s right s on the sw itch for specified us ers.
U SER A UTHENTICATION 3-49 Command Att ributes • Account List – Displays th e current li st of user acco unts and associated acc ess levels. (Defaults: admin, an d guest) • New Account – Displays configuratio n settings for a new ac count. - User Na me – T h e nam e of the user.
C ONFIGURING THE S WI TCH 3-50 CLI – Assign a user name to access-lev el 15 (i.e. , administra tor), th en speci fy the passw ord. Configuring L ocal/Remote Logon Aut hentication Use th e Authen tication Settings m enu to res trict mana g ement access based on specif ied user names and pas s w ords .
U SER A UTHENTICATION 3-51 Command Usage • By default, man agement access i s always checke d against the authen ticatio n da tabase st ored on the l ocal switch . If a remote authen tication s erver is used, you must spec ify the authen tication sequenc e and the corresp onding parameter s for the remote authent ication protocol.
C ONFIGURING THE S WI TCH 3-52 • RADIUS Settings - Global – Provides globally applicable RADIUS settings. - ServerIndex – Spe cifies one of five RA DIUS servers that m ay be configur ed. The swi tch attempts authenticati on using th e listed sequence of servers.
U SER A UTHENTICATION 3-53 We b – Click Secu rity , Authen tication Se ttings . T o config ure local or remot e authentica tion pref erences , specify the authen tication sequence (i.e., one to thr ee methods), fill in the parame ters for RADIUS or T ACA CS+ authenticat ion if selected , and clic k Apply .
C ONFIGURING THE S WI TCH 3-54 CLI – Spec ify all the requi red paramete rs to enable log on a uthentica tion. Configuring H TTPS Y ou can conf igure the switc h to enable the Secure Hypertext T ransfer Proto col (HTTP S) over the Sec ure Socket Laye r (SSL), pr oviding secu re access (i.
U SER A UTHENTICATION 3-55 • When you star t HTTPS, the conn ection is estab lished in th i s w ay: - The cl i ent authentica tes the server using the ser ver’s digital certifi cate. - The clie nt and server nego tiate a set of secur ity protoc ols to use for the co nnection.
C ONFIGURING THE S WI TCH 3-56 We b – Click Security , H TTPS Settings . Enable HTTPS and specify the por t number, then click Ap ply . Figure 3-26 HTTPS Settings CLI – This example e nables the HTTP secur e ser ver an d modifies the por t numbe r .
U SER A UTHENTICATION 3-57 When y ou hav e obtained th ese, place t hem on your T FTP ser ver , and use the foll owing comm and at the swit ch's comman d-line interface t o re pl ace the de fault (unr ecogniz ed) cer tificat e with an authorize d one: Note: The switc h must be r eset for the new cer tificate to be act ivated.
C ONFIGURING THE S WI TCH 3-58 Command Usage The SSH se r ver on this switc h supports b o th passwo rd and public k ey authen tication. I f passw ord authenti cation is speci fied by t he SSH client,.
U SER A UTHENTICATION 3-59 3. Import Client’ s Public K e y to the Switch – Use the copy tftp public-k ey command (p age 4-86) to copy a fi le containing t h e publ ic key for all the SSH c lient’ s g ranted ma nag ement ac cess to th e switch.
C ONFIGURING THE S WI TCH 3-60 e. Th e swit ch compar es the de cr ypte d bytes to the origi nal byte s it sent. If the two sets match, t his means th at the client's priv a te key cor responds to an authorized public key , and th e client is authe nticated.
U SER A UTHENTICATION 3-61 the client to select either DES (56-bit) or 3DES (168-bit) for da t a encrypt ion. • Save Host-Key from Memory to Flash – S aves the host key from RAM (i.e., vola tile memory to flas h memo ry. Otherwis e, the host key pair is stored to RAM by default.
C ONFIGURING THE S WI TCH 3-62 CLI – This example gen erates a host -key pair u s in g both the RSA and DSA al go rithms, stores the ke ys to f lash me mor y , and then display s the host’ s publ ic keys . Configur ing the SSH Server The SSH server inc ludes basic settings for aut henticatio n.
U SER A UTHENTICATION 3-63 fails an d the clien t has to resta rt the auth enticatio n process. (Range: 1-5 times; D efault: 3) • SSH Server-Key Size – Sp ecifies the SSH se rver key size. (Range: 512-896 bits; Default:768) - The server key is a private key t hat is never share d outside th e switch.
C ONFIGURING THE S WI TCH 3-64 CLI – T his examp le enable s SSH, sets th e authen tication p arameters, and disp lays the current configur ation. It shows th at the administra tor has made a c onnection v ia SHH, and then disables this connectio n.
U SER A UTHENTICATION 3-65 already in the address table wil l be retained and will not ag e out. Any other device that atte mpts to use the por t will be prevented from access ing the switch. Command Usage • A secure port h as the follow ing restricti o ns : - It ca nnot use po rt monitor ing.
C ONFIGURING THE S WI TCH 3-66 We b – Click Secu rity , Port Se curity . Se t the action to take when an invalid addr ess is de tected on a por t, mar k the checkbox in the Sta tus colu mn to enable s ecurity for a por t, set the maximu m number of MA C addresses allowed on a port, and click Apply .
U SER A UTHENTICATION 3-67 This sw itch uses the Ex tensible Au thentica tion Protoc ol ov er LANs (EAPOL) to ex change auth enticati on protoc ol m essag es with the client, an d a rem ote RADIUS a uthenti cation ser ver to ver ify user identity and acces s righ ts.
C ONFIGURING THE S WI TCH 3-68 • The RADIUS server and 802.1X clien t support EAP. (The switch only suppor ts EAPO L in orde r to pas s the EA P packe ts from the serv er to the client .) • The RADIUS server and clie nt also have to supp ort the same EAP authent ication type – MD 5.
U SER A UTHENTICATION 3-69 CLI – This example shows the default global setting for 802.1X. Configur ing 802.1X Global Set tings The 802.1X protocol includes port authentic at ion. The 802.1X protocol mus t be enabled globally fo r the switc h system be fore port setting s are activ e.
C ONFIGURING THE S WI TCH 3-70 CLI – This example enables 802.1X globally for the switch. Configur ing Port Settin gs for 802.1X When 802.1X is enabled, you ne ed to configure the parameters for the authen ticatio n pr ocess that r uns betw een the cl ient and t he switc h (i.
U SER A UTHENTICATION 3-71 • Max-Req – Sets th e maximum number of times th e switch port will retransmit an EAP request packet to the client before it times out the auth enticati on sess ion.
C ONFIGURING THE S WI TCH 3-72 CLI – This example sets the 802.1X parameters on port 2. For a descr iption of th e addit ional fi elds disp layed in th is exampl e, see “ show dot1x” on pag e 4-112.
U SER A UTHENTICATION 3-73 Displaying 802.1X St atistics This sw itch can display statistics for dot1x proto col ex chang es for any por t. Table 3-5 802.1X Statistics Parameter Description Rx EAPOL Start The number of EAPOL Start frames t hat have been received by this A uthenticator.
C ONFIGURING THE S WI TCH 3-74 We b – Select Security , 802.1X , Statistics . Select the require d por t and then click Query . Click R efresh to update the st atistics . Figure 3-33 Displaying 802.1X Port Statistics CLI – This example displays the 802.
U SER A UTHENTICATION 3-75 Filte r ing Addre sses for Managemen t Access Y ou create a list o f up to 16 IP addresses or IP address groups that ar e allowed management access to t he switch through the web interface, SNMP , or T elnet. Command Usage • The manage m ent interfaces ar e open to all IP addresses by d efault.
C ONFIGURING THE S WI TCH 3-76 • Start IP Address – A single IP addres s , or t he starting add ress of a range. • End IP Address – The en d address o f a range. • Add/Remove Filtering Entry – Ad ds/re moves an I P addr ess fr om the list.
A CCES S C ONTROL L ISTS 3-77 CLI – This example a llows SNM P access for a specific cli ent. Access Control List s Access Control Lis t s (A CL) provide pac ket fi ltering for I P frames (bas ed on add ress , protoc ol, Layer 4 prot ocol por t number or TCP cont rol code) or any fr ames (based on MAC a ddress or E ther net typ e).
C ONFIGURING THE S WI TCH 3-78 Command Usage The foll owing restrictio ns apply t o A CLs: • Each A CL can hav e up to 32 rules. • The m aximum number of AC Ls is 8 8. • However, due to resource res trictions, t h e avera ge number of r ules bound to the port s should not e xceed 20.
A CCES S C ONTROL L ISTS 3-79 - MAC : MAC ACL m ode that fi lters packet s based on the source or destin at ion MAC address and the Ethernet frame typ e (RFC 1060).
C ONFIGURING THE S WI TCH 3-80 Configur ing a Standard IP ACL Command Att ributes • Action – An ACL can contain an y combination of permit or deny rules.
A CCES S C ONTROL L ISTS 3-81 We b – Specify the act ion (i.e ., P er mit or D eny). Select the address t ype (Any , Host, or I P). If you select “Host, ” enter a speci fic address . If y ou select “IP ,” enter a subn et addr ess and th e mask f or an add ress ran ge.
C ONFIGURING THE S WI TCH 3-82 to sp ecify a range of addresses wit h the Address an d SubMask fields . (Options: Any, Host, IP; Defa ult: Any) • Source/Destination Address – Source or des t inat ion IP addres s. • Source/Destination Subnet Mask – Sub net mask for source o r desti nation addr ess.
A CCES S C ONTROL L ISTS 3-83 For examp le, use the co de value and mas k belo w to catch pa ckets with the following flags set: - SYN flag valid, use control-code 2, control bitmask 2 - Both SYN a nd.
C ONFIGURING THE S WI TCH 3-84 3. P er mit all TCP packets from class C addresses 192.168.1.0 with the TCP contro l code set to “SYN . ” Configur ing a MAC ACL Command Att ributes • Action – An ACL can contain an y combination of permit or deny rules.
A CCES S C ONTROL L ISTS 3-85 We b – Specify the acti on (i.e ., Permit or Deny) . Spec ify the source an d/or desti nation add resses . Select t he address type (Any , Ho st, or MA C). I f you select “Host,” enter a specific ad dress (e .g., 11-22-33-44-55-66).
C ONFIGURING THE S WI TCH 3-86 Binding a Port t o an Access Control List Afte r configur ing Access Control Lists (A CL), y ou shoul d bind th em to the por ts tha t need to filter traffic. Y o u can assig n one IP a ccess list to any port, but you can o nly assign one MA C access l ist to all the ports on the switch.
A CCES S C ONTROL L ISTS 3-87 We b – Click Security , A CL, P or t Binding . Mark the Enabled field for the port you wa nt to bind to an ACL, s elect the required A CL fr om the drop-down list, then c lic k A pply .
C ONFIGURING THE S WI TCH 3-88 Port Conf iguration Displaying Connection Status Y ou can use the P o rt Inf or matio n or T r un k Infor ma tion pag es to di splay the current c onnection status , includin g link sta te, speed/ duplex mode , flow co ntrol, and aut o-neg oti ation.
P ORT C ONFIGURATION 3-89 We b – Click P or t, P or t Infor matio n or T r unk Infor mation. Figure 3-40 Displaying Port/Trunk Information Field Attribut es (CLI) Basic In formatio n: • Port type – Indicates th e port type. (100BASE-TX, 1000BA SE-T, or SFP) • MAC address – The p hysical layer address for this port .
C ONFIGURING THE S WI TCH 3-90 - 10full - Sup ports 10 Mb ps full-duplex op eration - 100half - Supports 100 M bps half-duplex o p eration - 100full - Suppor t s 100 Mbps full-duplex opera tion - 1000.
P ORT C ONFIGURATION 3-91 CLI – This example s hows the co nnection sta t us fo r P or t 5. Configuring I nterface Connections Y ou can use the P ort Configuration or T r unk Configuration pag e to .
C ONFIGURING THE S WI TCH 3-92 • Autonegotiation (P ort Capabilities) – Allows auto-negotiat ion to be enabled/disable d. When auto-negotiat ion is enabled, you need to specify t he capabilities to be advertis ed. When auto-neg otiation is disa bled, yo u can fo rce the s etting s for spe ed, mode , and flow control.
P ORT C ONFIGURATION 3-93 We b – Click P ort, Port Configuration o r T r unk Configuration. Mo dify the required interface settings, and c lick Apply . Figure 3-41 Port/Trunk Configuration CLI – Sele ct the inte rface, and the n enter the r equired settings .
C ONFIGURING THE S WI TCH 3-94 automatically n eg otiate a trunked link with LA CP-configured ports on anoth er device. Y ou can co nfigure any n umber of po r ts on t he switch a s LA CP , as long as they are not alre ady configured as part of a static trunk.
P ORT C ONFIGURATION 3-95 Static ally Configuring a Trunk Command Usage • When configuring static trunks, you may not be able to link switches o f diff erent types, depending on the manufact urer’s implemen tation. However, note tha t the stat ic trunks on this sw itch are Cisco Ether Channe l compat ible.
C ONFIGURING THE S WI TCH 3-96 We b – Click P or t, T r unk Membership. E n ter a trunk ID of 1-4 in the T runk field, sel ect any of the switch po r ts fro m th e scroll-do wn port list, and cl ick Add. Aft er you ha ve compl eted addin g ports to the member lis t, click Apply .
P ORT C ONFIGURATION 3-97 CLI – This example cre ates tr unk 2 wi th ports 1 and 2. J ust connect th ese por ts to two static tr unk po rts on anothe r switch to for m a tr unk.
C ONFIGURING THE S WI TCH 3-98 • A trunk formed with anothe r switch using LACP will automatically be assign ed the next available trunk ID . • If more than eigh t ports a ttached to the same tar get swit ch have LACP enabled, the addition al ports will be placed in standby mode, and will only be enabled if one of the active links fails.
P ORT C ONFIGURATION 3-99 CLI – T he follow ing ex ample enabl es LACP for por ts 1 to 6. Just conn ect these por ts t o LACP-e nabled trunk ports on an other switc h to form a tr unk.
C ONFIGURING THE S WI TCH 3-100 Note: If the port channel adm i n k ey (lacp adm in key, page 4-168) is not set (thr ough the C LI) when a channel gr oup is formed (i.
P ORT C ONFIGURATION 3-101 We b – Click P or t, LA CP , Ag g reg ation P or t. Set the System Priority , Admin Key , and P or t Priority for the P or t Actor.
C ONFIGURING THE S WI TCH 3-102 CLI – The followi ng example config ures LA CP parameters fo r por ts 1-4. P orts 1-4 are used as a ctive m embers o f the LA G .
P ORT C ONFIGURATION 3-103 Displaying LACP Port Co unters Y ou can dis play statis tics for L A CP pr otocol messag es . We b – Click P or t, LA CP , P o rt Counters Infor matio n.
C ONFIGURING THE S WI TCH 3-104 CLI – The follow ing example dis plays LA CP counters . Displaying LACP Settings and Sta tus for the Lo cal Side Y ou can dis play configuration settings and th e operational state for the local side of an link ag greg ation.
P ORT C ONFIGURATION 3-105 Admi n Sta te, Oper State Administrati ve or operational values of t he actor’s state parameters: • Expired – The actor’s receive machine is in the expired state; • Defaulted – The actor’s receive ma chine is using defaul ted operational partner information, administratively configured for the partner.
C ONFIGURING THE S WI TCH 3-106 We b – Click P or t, LA CP , P o rt Inter nal Infor mation. Select a port channel to disp lay the correspondi ng infor mat i on. Figure 3-46 LACP - Port Internal Information CLI – The follow ing example dis plays th e LA CP configuration settings and op erational sta t e f or the local s ide of port ch annel 1.
P ORT C ONFIGURATION 3-107 Displaying LACP Settings and Sta tus for the Remote Side Y ou can dis play configuration settings and th e operational state for the remote side of an link agg reg ation. Table 3 -8 LACP Neighbo r Configurati on Information Field Description Partner Admin Syst em ID LAG partn er’s system ID ass igned by the user.
C ONFIGURING THE S WI TCH 3-108 We b – Click P or t, LA CP , P o rt Neighbor s Infor mation. Select a por t channel to display the cor responding info r mation.
P ORT C ONFIGURATION 3-109 Setting Broadcast Storm Thre sholds Broadc ast stor ms ma y occur when a d evice on yo ur network i s malfunctioning, o r if application prog rams are not well design ed or proper ly configure d.
C ONFIGURING THE S WI TCH 3-110 We b – Click P ort, P ort/T r unk Broadcas t Control. Se t the threshol d, mark the Enabl ed field for t h e des ired interface and click App ly .
P ORT C ONFIGURATION 3-111 CLI – Sp ecify a ny inter face, and th en ente r the th reshol d. The following disab les broadcas t storm control fo r port 1, and t h en s ets broadc ast suppr ession a t 600 o ctets per sec ond fo r por t 2 (which app lies to all por ts).
C ONFIGURING THE S WI TCH 3-112 Command Att ributes • Mirror S essions – Displays a list of curre nt mirror sessions. • Source Unit – The unit whose port traffic will be monitored. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) • Source Port – The port whose tr affic will be monitored.
P ORT C ONFIGURATION 3-113 CLI – U se th e inter face comma nd to select the mo nitor p ort , then use th e port monito r command to s pecify the so urce port and traffic type. Configuring Rate Lim its This f unction allows t he network manag er to cont rol the maximum r ate for traffic transmitted or received on a por t.
C ONFIGURING THE S WI TCH 3-114 We b – Click P or t, Rate Limit, Granularity . Sele ct the require d rate limit granularity for Fast Ethernet and Gigabit Ethe r net, and click apply . Figure 3-50 Rate Limit Granular i ty Configuration CLI - T his ex ample se ts and d isplays F a st Ethe rn et and Gig abit E ther net granularity .
P ORT C ONFIGURATION 3-115 We b – Click Port, Rate Limit, Input/Out put P ort/ T runk Co nfiguration. Enable th e Rate Limit Sta tus for the required int erfaces, set the Rate Lim it Level, and click Apply .
C ONFIGURING THE S WI TCH 3-116 Note: RMON groups 2, 3 and 9 can only be accessed using SNMP management software such as SMC EliteView. Table 3-9 Port Statistics Parameter Description Interface Statist ics Received Octets The total number of octets received on the interface, including framing characters.
P ORT C ONFIGURATION 3-117 Transmit Multicast Packets The total number of packets that higher- level protocols requested be transmitted, an d w hich we re addres sed to a multicast address at this sub-layer, incl uding those that were discarded or not sent.
C ONFIGURING THE S WI TCH 3-118 Multiple Collision Frames A count of succes sfully transmitted frames for which transmission is inh ibited by more than one collision. Carrier Sense Errors The number of times that the carrier se nse condition was lost or never a ss erted when a ttempting to transmit a frame .
P ORT C ONFIGURATION 3-119 Multicast Frames The total number of good frames rec eived that were directed to this multicast ad dress. CRC/A lignme nt E rror s The num ber of CRC/alignment errors (FCS or alignment errors).
C ONFIGURING THE S WI TCH 3-120 We b – Click P or t, P or t Statistics . Select the required interface, and click Quer y . Y ou ca n also u se the Refres h button at the bott om of the pa ge to update th e scre en.
P ORT C ONFIGURATION 3-121 CLI – This example show s statist ics for port 13. Console #show i nterfac es cou nters e thernet 1/13 4- 152 Etherne t 1/13 Iftabl e stats : Octets input : 868453, Octets.
C ONFIGURING THE S WI TCH 3-122 Addre ss Tabl e Settin gs Switches sto re the addresses f or all known devices. This infor matio n is used to pass traff ic directly between t he inbound and outbou nd ports . All the add resses learned b y monitorin g traffic are s t ored in the dynami c address t able.
A DDR ESS T ABLE S ETTINGS 3-123 We b – Click Address T ab le , Static Addresses . Specify the interface, the MA C address and VLAN , then click Ad d Static Address . Figure 3-53 Configuring a Static Address Tabl e CLI – This example adds an address to the static ad dress table, but sets it to be deleted w hen the switch is reset.
C ONFIGURING THE S WI TCH 3-124 Displaying the Address Table The Dynamic Address T able c ontains th e MA C addresses le ar ned b y monit oring the so urce address f or traffic e ntering the s witch.
A DDR ESS T ABLE S ETTINGS 3-125 We b – Clic k Address T able , Dynamic Addresses . Spec ify the searc h type (i.e., mar k the Inte rface, MAC Addres s , or VLAN checkbox), se lect the method of sorting the displ ayed addre sses, and then cli ck Quer y .
C ONFIGURING THE S WI TCH 3-126 Changing the Agin g Time Y ou can set the a ging time for e ntries in th e dynamic a ddress tab le. Command Att ributes • Aging Status – Enables/d isables the function. • Aging Time – The tim e after which a learned ent ry is discarded .
S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-127 Th e spanni ng tree a lgo rithm s suppor ted by this switch incl ude the se ve rs io n s : • S TP – Sp an ning Tree Protocol (IEEE 802.
C ONFIGURING THE S WI TCH 3-128 that can be us ed when a node or po rt f ails , a nd ret aining the f orwarding data base for ports ins ensitiv e to c hanges in the t ree str ucture when reconfi guration occur s .
S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-129 • Designated Root – The priority and MAC address of the device in the Spannin g Tree that th is switch has a ccepted as th e root device. - Root Port – The numbe r of the port on th is switch that i s closest to the roo t.
C ONFIGURING THE S WI TCH 3-130 • Root Forward Delay – The maximum time (i n seconds) th i s d evice will wait befor e changing states ( i .e., d i scar ding to learning to forwardin g). This delay i s required becaus e every device m ust receive information about topology changes before it starts to forward frame s .
S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-131 CLI – T his command displays global STA settings, followe d by settings for ea ch por t. Note: The current root port an d current root co st display as zero when this de vice is not co nnected to the network.
C ONFIGURING THE S WI TCH 3-132 Configuring Global Setti ngs Global sett ings apply to the entire switch. Command Usage • Spanning Tree Pro tocol 8 Uses RSTP fo r the internal state machine, but sends only 802.
S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-133 • Priority – Bridge priority is used in se le cting the root dev ice, root port, and des ignated por t.
C ONFIGURING THE S WI TCH 3-134 • Forward Delay – The maximum t ime (in second s) this device will w ait b e f or e c h a n g i n g s t at es ( i .
S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-135 We b – Click Spanning T ree, ST A, Config uration. Modify the required attributes , an d click A pply . Figure 3-57 STA Configura t ion CLI – T his exa mple enable s Spanni ng T ree Protoc ol, set s the mod e to RSTP , and then config ures the ST A and RSTP paramet ers.
C ONFIGURING THE S WI TCH 3-136 Displaying Interface Setti ngs The ST A P or t Information and ST A T r unk Infor mation pages display the cur rent sta tus of por ts an d tr unks in the S panning Tree. Field Attribut es • Spanning Tree – Shows if STA has be en enabled on this inter face.
S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-137 • Designated Port – The por t priorit y and numb er of the port on the designated brid ging device through wh ich this switch must communi cate with the root of the Spanni ng Tree. • Oper Link Type – The operati onal po int-to-po int stat us of the LA N segment a ttached to th is interface.
C ONFIGURING THE S WI TCH 3-138 • Trunk Member – Indicates if a port is a member of a trunk. (STA Port Information o nly) These additio nal parame ters are only display ed for the CLI: • Admin status – Shows if this inte rface is enabled.
S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-139 • Admi n Edge Port – You can e nable this option if an interface is attache d to a LAN se gment th at is at the end of a bridge d LAN or to an end no de. Since end node s cannot cause forwardi ng loops, they c an pass d irectly thro ugh to the sp anning tree fo rwarding stat e.
C ONFIGURING THE S WI TCH 3-140 CLI – This example s hows the ST A attr i but es for port 5. Configuring I nterface Settings Y ou can conf igure RSTP attrib utes for speci fic interfaces , incl uding port prior ity , path cos t, link type , and edge port.
S PANNING T RE E A LGOR ITHM C ONFIGURATION 3-141 contra dictory informat ion. Port addres s table is clea red, and the port begins le arning a ddresses. - Forwarding - Port forwards packets , and continues learni ng addr esses. • Trunk – Indica t es if a port is a member of a trun k.
C ONFIGURING THE S WI TCH 3-142 - D e f a u l t – - Ethernet – Half duplex: 2,000,000; full duplex: 1,000,000; trunk: 500,000 - Fast Ethernet – Half duplex: 200,000; full du p lex: 100,000; trunk: 50,000 - Gigabit Ethernet – Full duplex: 10,000; trunk: 5,000 • Admin Link Type – The link type a ttached to this in terface.
VLAN C ONFIGURATION 3-143 We b – Click Spa nning T ree, S T A, P or t Configu ration or Trun k Configuration. Modify the requir ed attri b utes , then c lick Appl y . Figure 3-59 STA Port Configuration CLI – T his example sets STA attributes for por t 7.
C ONFIGURING THE S WI TCH 3-144 VLANs he lp to simplify network manag ement by allowing you t o mov e device s to a new VLAN without h aving to chang e any physic al conne ctions.
VLAN C ONFIGURATION 3-145 Note: VL AN-tagged frames can pa ss throu gh VLAN-a ware or VLAN-u naware network interconnect ion devices , but th e VLAN tags sho uld be st ripped of f befo re passin g it on to any e nd-nod e host that does no t support VLAN tagg ing.
C ONFIGURING THE S WI TCH 3-146 Automatic VLAN Registration – GVRP (GARP VLA N R eg istration Protoc ol) defines a system where by the s w it ch can auto maticall y lear n th e VLANs to which each end station should be assigne d. If an end station (or its network a d apter) supports the IEEE 802.
VLAN C ONFIGURATION 3-147 Forw ar ding T a gged/U nta gged Frames If you wan t to creat e a small por t-bas ed VLAN for devi ces at tached direc tly to a sin gle swi tch, you can a ssign por ts to the sam e untag g ed VLAN .
C ONFIGURING THE S WI TCH 3-148 Enabl ing or Disa bling GVRP ( G lobal Settin g) GARP VLA N R egist ration Protoc ol (GVRP) defi nes a wa y for switch es to exc hang e VLAN info rm ation in order to reg ister VLAN membe rs on ports acro ss the netw ork.
VLAN C ONFIGURATION 3-149 • Maximum Number of Supported VLANs – Maximum number of VLANs t hat can be configured on this switch. We b – Click VLAN , 802.1Q VLAN , Basic In formatio n. Figure 3-61 VLAN Basic Information CLI – Enter the following command.
C ONFIGURING THE S WI TCH 3-150 • Status – Shows h ow this VL AN was adde d to the swi tch. - Dynamic GVRP : Automatically learned via GVRP. - Permanent : Adde d as a static entry. • Egress Ports – Show s all the VLA N port mem bers. • Untagged Ports – Show s the untagg ed VLAN port me mbers.
VLAN C ONFIGURATION 3-151 • Status – Show s if this VLAN is enabled or disabled. - Active : V LAN is operation al. - Suspe nd : VLAN is suspend ed; i.e., does not pa ss packet s. • Ports / Channel groups – Shows the VL AN inter face member s. CLI – Cur rent VLAN infor mat ion can be displayed wit h the following command.
C ONFIGURING THE S WI TCH 3-152 • State (CLI) – Enable s or disab les the speci fied VLAN. - Active : V LAN is operation al. - Suspe nd : VLAN is suspend ed; i.e., does not pa ss packet s. • Add – Adds a new VLAN grou p to the curr ent list. • Remove – R emoves a VLAN gr oup from the curr ent list.
VLAN C ONFIGURATION 3-153 Adding Stati c Members to VLANs (VLAN Index) Use the V LAN Static T able to configure port member s for the select ed VLAN index. Assign por ts as tag ged if they are connected to 802.1Q VLAN com pliant devi ces, o r untag ged they a re not connecte d to any VLAN-a ware devi ces.
C ONFIGURING THE S WI TCH 3-154 • Membership Type – Select VLAN membership for each interface by markin g the approp riate radio button fo r a port or tr unk: - Tagged : Interface is a member of th e VLAN. All packet s transmitted by the port will be tagged, th at is, carry a tag and therefo re carry VLAN o r CoS informati on.
VLAN C ONFIGURATION 3-155 We b – Click VLAN , 802.1Q VLAN , Static T able. Select a VLAN ID from the scrol l-down list. Mod ify the VLAN name a nd status if required . Selec t the membe rship type by markin g the approp riate radio button in the list of por ts or tr unk s .
C ONFIGURING THE S WI TCH 3-156 Adding Stati c Members to VLANs (Port Index) Use the VLAN S tatic Membership by P ort menu to assi gn VLAN g roups to the select ed int erfa ce as a ta g ge d mem ber . Command Att ributes • Interface – Po rt or tr unk identi fier.
VLAN C ONFIGURATION 3-157 Configur ing VLAN Behavior for Interfaces Y ou can config ure VLAN behavior for specific interfaces, including the default V LAN identifier ( PVID), accepted fram e types, ing ress fil t eri ng, GVRP status , and GARP timers .
C ONFIGURING THE S WI TCH 3-158 - Ingress filte ring only affects tagged frames. - If ingres s filtering i s di sabled and a port receives fram es tagged for VLANs for wh ich it is not a member, these fram es will be flooded to all other ports (exc ept for those VLANs explic itly forbidden on this por t).
VLAN C ONFIGURATION 3-159 • Mode – Indicates VLAN membership mod e for an interface. (Default: H ybrid) - 1Q Trunk – Specifies a port as an end-point for a VLAN t runk. A trunk is a direct link between two switches, so the port transmits tagged frames that ide ntify the sour ce VLAN.
C ONFIGURING THE S WI TCH 3-160 CLI – This example s ets port 3 to accept only ta g g ed fra m es , assig ns PVID 3 as the na tiv e VLAN ID , enable s GVRP , sets the GA RP timers, and then sets the swit chport mode to hybrid. Privat e VL ANs Pri vate VLAN s provide por t-ba sed security and isolation between por ts within the a ssigned VLAN.
VLAN C ONFIGURATION 3-161 2. Use the Private VLAN As sociation menu (pag e 3-164) to map the seco ndar y (i.e., communit y) VLAN(s ) to the primar y VL AN . 3. Use the Priv ate VLAN P ort Configur ation menu (pag e 3 -166 ) to set the por t typ e to promisc uous (i.
C ONFIGURING THE S WI TCH 3-162 We b – Click VL AN , Private VLAN, Infor mation . Select the d esired por t from the VLAN ID drop-d own men u. Figure 3-67 Private VLAN Information CLI – T hi s ex ample show s the switc h configured with primary VLAN 5 and seco ndar y VLAN 6.
VLAN C ONFIGURATION 3-163 Configur ing Private VLANs Th e Private VLAN Configura tion pa ge is use d to crea te/remove primar y , community , or isolated VLANs.
C ONFIGURING THE S WI TCH 3-164 CLI – This exam ple confi gures VLAN 5 as a pr imary VLAN , and VLAN 6 as a comm unity VLAN and VLAN 7 as an isol ated VLAN . Associating VLANs Eac h communit y VLAN mu st be associat ed with a pr imar y VLAN . Command Att ributes • Primary VLAN ID – ID of primary VLAN (1-4094).
VLAN C ONFIGURATION 3-165 CLI – T his examp le as sociat es co mmunity VLANs 6 and 7 wi th prim ar y VLAN 5. Displaying Priva te VLAN I nterface In formation Use the Pri vat e VLAN P or t Info r mation and Pri vate V LAN T r unk Infor mation menus to display the interfaces associat ed with priv ate VLANs.
C ONFIGURING THE S WI TCH 3-166 We b – Cli ck VLAN, P rivate VLAN, Po rt Infor matio n or Tru nk Informa tion. Figure 3-70 Private VLAN Port Information CLI – T hi s ex ample show s the switc h configured with primary VLAN 5 and comm unity VLAN 6.
VLAN C ONFIGURATION 3-167 - Host – The port is a community po rt or an isolat ed port. A commun ity port can commu nicate wi th other po rts in its ow n communi ty VLAN and wi th designat ed promiscu ous port(s).
C ONFIGURING THE S WI TCH 3-168 We b – Click VLAN, Private V LAN, Port Configuration or Trunk Configuration. Set the PVLAN Port Ty pe for each port that will join a priv ate VLAN. As sign prom iscuous po rts to a p rimary or i solated VL AN. Assign ho st ports to a community or isolated VLAN.
C LASS OF S ER VICE C ONFIGURATION 3-169 Class o f Service Configura tion Class of Ser vice (CoS) allows you to sp ecify which data pack e ts hav e greater pr ecedence when traf fic is buff ered in the swit ch due to cong estion . This sw itch suppor ts C oS with four priority qu eues fo r each port.
C ONFIGURING THE S WI TCH 3-170 Command Att ributes • Default Priority 11 – The priority that is assigne d to untagge d frames received on the specifie d interface . (Range: 0-7, Default: 0) • Number of Egress Traffic Classes – The number of queue buff ers provided for each port.
C LASS OF S ER VICE C ONFIGURATION 3-171 Mapping CoS Val ues to Egress Queues This sw itch processes Class of Ser vice (Co S) priority tag ged traffic b y using four priority queues fo r each port, with service sche dules based on strict or W eighted Round Robin (WRR).
C ONFIGURING THE S WI TCH 3-172 Command Att ributes • Priority – CoS value. (Range: 0-7, where 7 is the high est priority) • Traffic Class 12 – Output queue buffer . (Range: 0-3, where 3 is the highest CoS priorit y queue) We b – Click Priority , T raffic Classes.
C LASS OF S ER VICE C ONFIGURATION 3-173 Selecting t he Queue Mode Y ou can set th e switch to ser v ice the qu eues base d on a stric t ru le that require s all traff ic in a higher priority qu eue t.
C ONFIGURING THE S WI TCH 3-174 Setting the Service Weight for Traffic Classes Th is switch u ses the W ei ghted Roun d R o bin (WRR ) alg ori thm to deter mine the frequency at which it ser vices each priority queue.
C LASS OF S ER VICE C ONFIGURATION 3-175 CLI – The follow ing example s hows ho w to assign WRR weight s to each of the priority queues . Layer 3/4 Priority Settings Mapping L ayer 3/ 4 Priorities to CoS Values This sw itch suppor ts several common method s of prioritizing layer 3/4 traffic to meet application re quirements .
C ONFIGURING THE S WI TCH 3-176 Selecting IP Preced ence/DSCP Priority The switc h allow s you to choose be tween us ing IP Precedenc e or DSCP prior ity . Select one of the methods or disable this feature . Command Att ributes • Disabled – Disables both prio rity services.
C LASS OF S ER VICE C ONFIGURATION 3-177 Command Att ributes • IP Precedence Priority Table – Show s the IP Pre cedence to CoS map. • Class of Service Value – Map s a Co S value to the selected IP Preceden ce value. Note t hat “0” repres ents low pri ority and “7 ” repr esent high pr iority.
C ONFIGURING THE S WI TCH 3-178 CLI – The follow ing example g lobally enabl es IP Precedence s er vice on the sw itch, maps IP Precedence v alue 1 to Co S value 0 (o n port 1), and then d isplays t he IP Preceden ce settings .
C LASS OF S ER VICE C ONFIGURATION 3-179 Command Att ributes • DSCP Priori t y Table – S hows th e DSCP Pri ority to CoS ma p. • Class of Service Value – Ma ps a CoS value to the selected DSCP Priority va lue. Note that “0” represe nts low pr iority and “7” repre sent high prio rity.
C ONFIGURING THE S WI TCH 3-180 CLI – T he following example globally enable s DSCP Priority ser vice on the switch , maps DSCP value 0 to CoS value 1 (on por t 1), and th en displays the DSCP Priority setting s .
C LASS OF S ER VICE C ONFIGURATION 3-181 We b – Click Priority , IP P or t Priority St atus . Set IP P o rt Priority Status to Enabl ed. Figure 3-79 IP Port Prio rity Status Click Priority , IP P or t Priority .
C ONFIGURING THE S WI TCH 3-182 CLI – T he following example globally enables IP P ort Priority servic e on the s witch, ma ps HTTP traff ic on po rt 5 to CoS valu e 0, a nd then display s all the IP Port P riority sett ings for that p ort.
C LASS OF S ER VICE C ONFIGURATION 3-183 • ACL CoS Priority Mapping – Displa ys the configured info rmation. We b – Click Priority , A CL CoS Priori ty .
C ONFIGURING THE S WI TCH 3-184 Mult icast Filt ering Multicasting is used to suppor t real-time applications such as videocon ferencing or streaming audio .
M ULTICAST F ILTE RIN G 3-185 Layer 2 IGMP (Snooping and Query) IGMP Snoopin g and Quer y – If multicast routing is not sup ported on other switches in you r network, you ca n use IG MP Snoo ping an.
C ONFIGURING THE S WI TCH 3-186 multi casting, on e of these devices is elec ted “queri er” and assumes the role of qu erying the L A N fo r group members. It then propa g ates the service requ ests on to any upst ream multicast switc h/router to ensu re that it will contin ue to re ceive the mult icast servi ce.
M ULTICAST F ILTE RIN G 3-187 Notes: 1. All syst ems on the subnet must supp ort th e same ver sion. 2. Some attributes are only enabled for IGMPv2, including IGMP Report Delay and IGMP Query Ti meout. We b – Clic k IGMP Snoopin g, IGMP Co nfiguration.
C ONFIGURING THE S WI TCH 3-188 Displaying Inte rfaces Attached to a M u lticast Ro uter Multi cast routers t hat are atta ched to p or ts on the switc h use information obtained from IGM P , along with a multicast routing protoco l such as D V MRP or PIM , to supp ort IP multicasting a cross the Inter net.
M ULTICAST F ILTE RIN G 3-189 CLI – T his example shows that P or t 11 has been static ally configured as a port attached to a multicast router . Specifyin g Static Interfaces f o r a Mult icast Router Depe nding on your network co nnect ions , IGMP sn ooping m ay not always be able t o locate th e IGMP querier .
C ONFIGURING THE S WI TCH 3-190 We b – Click IGMP Snoo ping, Static Mult icast R o uter P or t Configuration. Specify the interfaces at tached to a multicas t router , indicate the VLAN which will forward all the corre sponding multicast traffic, and then click Add.
M ULTICAST F ILTE RIN G 3-191 We b – Click IGMP Snooping, IP Multicast R egi stration T able. Select a VLAN ID and the IP ad dress for a multicast ser vice from the scroll-down lists . T he switch will display all the interfaces that are propag ating this multicast ser vice.
C ONFIGURING THE S WI TCH 3-192 Assigning Ports to Multicast Services Multicast filte ring can be dynamic ally configured using IGMP Snooping and IGMP Quer y messages as de scribed in “ Configuring IGMP snoopi ng and Query Parameter s” on pag e 3-133.
M ULTICAST F ILTE RIN G 3-193 We b – Clic k IGMP Snoopin g, IGMP Me m ber Port T abl e. Speci fy the interface atta ched to a multicast s er v ice (via an IGMP-enabled switch or multicast rout er), ind icate the VL AN that wil l propaga te the multic ast ser vice, specify the multicast IP address, and click Add.
C ONFIGURING THE S WI TCH 3-194.
4-1 C HAPTER 4 C OMMAND L INE I NTERF ACE This ch apter descr ibes how t o use the Com m and Line Interfac e (CLI). Note: Yo u can only access the console interfa ce throug h the Mast er unit in the stack.
C OMMAND L IN E I NTE RFA CE 4-2 3. Whe n finished, ex it the sessio n with the “q uit” or “exit ” command. After c onnecting to the sy stem through the conso le port, the logi n screen displ ays: Telnet Connection T elnet operates o ver t he IP transport proto col.
U SIN G THE C OMMAND L INE I NTE RFA CE 4-3 After y ou configure t he switch with an IP addre ss, y ou can open a T elnet session by perfor ming these st eps: 1. Fr om the remote host, e nter the T elnet co m man d and the IP address o f the de vice you want to acces s .
C OMMAND L IN E I NTE RFA CE 4-4 Enteri ng Commands Th is section d escribe s how to enter CLI comma nds . Keywords and Arguments A CLI comm and is a series of ke yword s and arguments . Keyw ords ident ify a command, an d arguments specify con figuration parameter s.
E NTERING C OMMANDS 4-5 Command Com pletion If you ter minate input with a Ta b ke y , the CLI will print the remaining characters of a par tial keyword up to the point of ambi guity . In th e “logging his tor y” examp le, typi ng log follo wed by a tab will result in printing the comm and up to “ log ging .
C OMMAND L IN E I NTE RFA CE 4-6 Showing Commands If you enter a “?” at the command prompt , the system will display the first lev el of key words for the current comm and class (No r mal Ex ec or Pri vileged Exec) or configurati on class (Gl obal, A CL, Interfac e, Line or VLAN Database ).
E NTERING C OMMANDS 4-7 The co mmand “ show interfaces ? ” will display the following infor mat ion: Partial Keyword Lookup If yo u ter minate a partial keyw ord with a question mark, alter nati ves that match the initial letters are provided. ( R ememb er not to leav e a space betw een the command and que stion mark.
C OMMAND L IN E I NTE RFA CE 4-8 Understanding Command Modes The command s et is divide d into Ex ec and Confi guration class es. Exec commands ge nerally display infor mation on system stat us or clear statisti cal count ers . Configur ation com mands, on the othe r hand, mo dify inte rface parameters o r enable certain sw i tc hing functio ns.
E NTERING C OMMANDS 4-9 Pri vileged Exec mode from wi thin Nor mal Ex ec m ode , by enter ing the enab le comman d, followe d by the privileg ed lev el p assw ord “super ” (page 4-36).
C OMMAND L IN E I NTE RFA CE 4-10 • Line Conf igurati on - These co mmands modify the console po rt and Telnet configuration, an d include com m and such as parity and databits . • VLAN Configurat ion - Includes the command t o create VL AN group s.
E NTERING C OMMANDS 4-11 Command Line Pr ocessing Commands are not case sensitiv e. Y o u can abbreviate com mands and para meters as lon g as they conta in enou gh lett ers to d iffere ntiat e them from an y other currently a vailab le commands o r paramete rs.
C OMMAND L IN E I NTE RFA CE 4-12 Comman d Groups The syst em commands c an be brok en down i nto the funct ional groups shown below . Table 4-4 Command Groups Command Group Description Page Lin e Set.
C OMMAND G RO UP S 4-13 The access m ode shown i n the follo wing tables i s i ndicated by these abbr eviations: NE (Nor mal Exec) PE (Privilege d Exec) GC (Global Con figuration) ACL (Access Co ntrol.
C OMMAND L IN E I NTE RFA CE 4-14 Line Co mmand s Y ou can access the onboard configuration program by attaching a VT100 compa t ibl e device to the s er ver’ s seri al port. These commands are used to set com munication p arameters for the serial po r t or T elnet (i.
L INE C OMMANDS 4-15 line This comma n d id entifies a sp ecific line for configuration , and to proces s subse quent line co nfiguratio n comma nds . Syntax line { console | vty } - console - Console terminal lin e. - vty - Virtual terminal fo r remote console acces s (i.
C OMMAND L IN E I NTE RFA CE 4-16 login This command enables pass word c hecking at login. Use the no for m to disable password checking and allow con nection s withou t a password. Syntax login [ local ] no login local - Selec ts local password checking .
L INE C OMMANDS 4-17 Example Related Commands username ( 4-35) password (4-17) password This comma n d sp ecifies the pa ssword for a line . Use the no for m to remove the password .
C OMMAND L IN E I NTE RFA CE 4-18 configuration file from a TFTP server. Th ere is no need for you to manual ly config ure encrypte d password s. Example Related Commands login (4-16) password-thre sh (4-20) timeout login re sponse This c ommand sets t he inter val that the syst em waits for a user to log in to the CL I.
L INE C OMMANDS 4-19 Example T o set the tim eout to t wo m inutes , e nter th is comma nd: Related Commands silent-time ( 4-21) ex ec-timeout (4-14) exec-timeout This c ommand sets the inter val that the syste m waits until user input is detected. Use the no form to restore the default.
C OMMAND L IN E I NTE RFA CE 4-20 Example T o set the tim eout to t wo m inutes , e nter th is comma nd: Related Commands silent-time ( 4-21) tim eout login response ( 4-13) password-thr esh This c ommand sets the passw o rd intr usion threshold w hich limits the number of failed lo go n attempts .
L INE C OMMANDS 4-21 Example T o set the password thres hold to five attempts, enter this command: Related Commands silent-time ( 4-21) tim eout login response ( 4-13) silen t-time This c ommand sets .
C OMMAND L IN E I NTE RFA CE 4-22 databits This c ommand se ts the number of dat a bits per chara cter that are inter preted a nd g enerate d by the c onsole port . Use the no for m to re store the de fault value. Syntax databi ts { 7 | 8 } no databits - 7 - Seven data bits per ch aracter.
L INE C OMMANDS 4-23 parity Th is command defines t he gene ration of a parity bit . Use the no for m to restore the default s etting . Syntax parity { none | even | odd } no parity - none - No parity.
C OMMAND L IN E I NTE RFA CE 4-24 Default Setting 9600 Command Mode Line Configuration Command Usage Set the speed to m atch the b aud rate of t he device conn ected to the seria l port. So me baud rates available on devices co nnected to the por t might not be supp or ted.
L INE C OMMANDS 4-25 disconnect This command te r minates an SSH, T elnet , or console connecti on. Syntax disconnect s ession-id session- id – The session identifier fo r an SSH, T elnet or console connect ion.
C OMMAND L IN E I NTE RFA CE 4-26 Example T o show all lines, enter this command: General Comman ds Console#show line Console configuration: Password threshold: 3 times Interactive timeout: Disabled L.
G ENERAL C OMMANDS 4-27 enable This c ommand activates Pri v ileged Exec mode. In privileged mode, addition al commands are av ailable, an d cer tain comman ds display addition al infor mation. See “ Under s tandin g Command Modes” on page 4-8. Syntax enab le [ leve l ] leve l - Privil e ge level to log into the device.
C OMMAND L IN E I NTE RFA CE 4-28 disable This comm and returns to Nor mal Ex e c mode from privileged mode. In nor mal access mode , you ca n only displ ay basic in for mation o n the switch's configuration or Ethe rnet statistic s . T o g ain access to all comma nds, you must use t he privi lege d mode.
G ENERAL C OMMANDS 4-29 Example Related Commands end (4-30) show h isto ry This comma nd shows the content s of the comman d history buffer . Default Setting None Command Mode Nor mal Exec , Privileg ed Exec Command Usage The history buffer si ze is fix ed at 10 Execu tion command s and 10 Configur ation comma nds .
C OMMAND L IN E I NTE RFA CE 4-30 The ! comm and repeats comm ands from the Ex ecution co mmand history buffer wh en you are in Nor mal Ex ec or Pri vileged Ex ec Mode, and command s from the Configu ration command his tor y buffer when y ou are in any of the config uration modes .
G ENERAL C OMMANDS 4-31 Command Mode Global Co nfiguratio n, Inte rface Co nf iguration, Line Co nfiguration, and VLAN Da tabase Conf iguration. Example This examp le shows ho w to return to the Privi.
C OMMAND L IN E I NTE RFA CE 4-32 Command Mode Nor mal Exec , Privileg ed Exec Command Usage The quit and exit commands c an both exi t the config uration pr og ram.
S YSTE M M ANAGEME NT C OMMANDS 4-33 Device Designation Co mmands prom pt This comma nd customizes t he CLI prompt. Use the no for m to re sto re the def ault prom pt. Syntax prompt string no prompt string - Any a lphanu meric strin g to use fo r the CLI pr ompt.
C OMMAND L IN E I NTE RFA CE 4-34 hostnam e This command s pecifies or modi fies the host nam e for this device . Use the no for m to res tore the d efault hos t name.
S YSTE M M ANAGEME NT C OMMANDS 4-35 usernam e This comma n d adds named users , req uires authentica tion at log in, specifie s or chang es a user's password (or sp ecify that no password is requ ired), or spec ifies or chang es a us er's ac cess le vel.
C OMMAND L IN E I NTE RFA CE 4-36 Command Usage The en crypte d passw ord is required for compatibility with legacy pas sword setting s (i.e ., plain text or encr ypte d) when rea ding the conf iguration file duri ng system bo otup or wh en downlo ading the config uration f ile from a TFT P ser ver .
S YSTE M M ANAGEME NT C OMMANDS 4-37 Command Usage • You cannot set a nu ll password. You will have to enter a p assword to change the command mod e from Normal Exec to Privileged Exec with the enable comman d (page 4-27). • The encrypted password is required for compatibility with legacy passw ord settings (i.
C OMMAND L IN E I NTE RFA CE 4-38 management This comma n d sp ecifies the cli ent IP address es that are all owed manageme nt access to the switc h through various protocols .
S YSTE M M ANAGEME NT C OMMANDS 4-39 • Y ou can delete an address range j ust by specif ying the start add ress, or by specifyin g both the start ad dress and end add ress. Example This exampl e restricts managem ent access to t h e i ndicated addr esses .
C OMMAND L IN E I NTE RFA CE 4-40 Example Web Server Commands Console#show management all-client Management IP Filter HTTP-Client: Start IP address End IP address ----------------------------------------- ------ 1. 192.168.1.19 192.168.1.19 2. 192.168.
S YSTE M M ANAGEME NT C OMMANDS 4-41 ip http port This command specifies the T CP port n umber used b y the web b rowser interface. Use the no form to us e th e defa ult port. Syntax ip http por t port-number no ip http por t por t-nu mber - T h e T C P p o r t t o b e u s e d b y t h e b r o w se r i n t e r f a c e .
C OMMAND L IN E I NTE RFA CE 4-42 Example Related Commands ip http po rt (4-41) ip http secur e-server This comma nd enables t he secure h ypertext transfe r protocol (HTTPS) over the Sec ure Socket Layer (S SL), providing secur e acces s (i.e., an encrypted con nection) to the switch ’ s w eb interf ace.
S YSTE M M ANAGEME NT C OMMANDS 4-43 • Th e client an d server establ ish a secure encrypted c o nnec tion. A padloc k icon sh ould app ear in the status bar for Intern et Explor er 5.
C OMMAND L IN E I NTE RFA CE 4-44 Command Mode Global Configuratio n Command Usage • Y ou cannot con figure the HT TP and HTTPS server s to use t he same port .
S YSTE M M ANAGEME NT C OMMANDS 4-45 Default Setting 23 Command Mode Global Configuratio n Example Related Commands ip telnet ser v er (4-4 5) ip telnet s erver This comm and allows this device to be monitored or configured from T elnet. Use the no for m t o disabl e this functi on.
C OMMAND L IN E I NTE RFA CE 4-46 Secure Shell Commands The Berkley-stan dard includes remote access tools originally design ed for Unix sys tems . Some of th ese tool s have also bee n implem ented fo r Micros oft Windows a nd other environmen ts .
S YSTE M M ANAGEME NT C OMMANDS 4-47 The SSH se r ver on this switc h supports b o th passwo rd and public k ey authen tication. I f passw ord authenti cation is speci fied by t he SSH client, then th.
C OMMAND L IN E I NTE RFA CE 4-48 2. Provide Host Public Key to Clients – Many SSH clie nt prog rams automatically impor t the host public key during the initi al connection setup with the switch. Otherwise, you need t o manually create a known hosts f ile on the ma nage ment stat ion and place the host public key in it.
S YSTE M M ANAGEME NT C OMMANDS 4-49 a. The c lient send s its publi c key to the switch. b. The switc h compares t he client's p ublic key to those stor ed in memo r y . c. If a mat ch is fou nd, the switc h uses the p ublic key t o encrypt a random sequenc e of by tes , and sends t his string to the clie nt.
C OMMAND L IN E I NTE RFA CE 4-50 Example Related Commands ip ssh cr yp to host-key ge nerate (4-52) show ssh (4-55) ip ssh timeout This comma n d con figures the ti meout for the SSH ser ver .
S YSTE M M ANAGEME NT C OMMANDS 4-51 ip ssh auth entication-retri es This command c onfigures t he number of times the SSH s er ver att empts to reauth enticate a user.
C OMMAND L IN E I NTE RFA CE 4-52 Command Usage • Th e server key is a priv ate key that is never sha red outside the swit ch. • The host key is shared with the SSH client, a n d is fixed at 1024 bits. Example delete public- key This command deletes the sp ecified user’ s publi c key .
S YSTE M M ANAGEME NT C OMMANDS 4-53 Command Mode Pri vileged Exec Command Usage • This comm and stor es the ho st key pair in me mory (i.e. , RAM). Use the ip ssh save ho st-key command to s ave the host key p air to flash memory.
C OMMAND L IN E I NTE RFA CE 4-54 Command Usage • Th is command cl ears the host key fr om volatile memo ry (RAM). Use the no ip ss h save ho st-ke y command to clear the host key fr om fla s h memory. • Th e SSH server must be d isabled before you can execute this command.
S YSTE M M ANAGEME NT C OMMANDS 4-55 show ip ssh This comma nd displa ys the connect ion settin gs used when authenticating client access to th e SSH ser ver . Command Mode Pri vileged Exec Example show ssh This comma nd displa ys the current S SH ser ver connection s.
C OMMAND L IN E I NTE RFA CE 4-56 show publ ic-key This comma nd shows the public key for th e specified user or for the host. Syntax show public-k ey [ user [ user na me ]| host ] user name – Name of an SSH user . (Range: 1-8 c haracters) Default Setting Shows all public keys.
S YSTE M M ANAGEME NT C OMMANDS 4-57 Command Mode Pri vileged Exec Command Usage • I f no parameters are ent ered, all keys are displayed. If th e user keyword is ent ered, but no use r name is speci fied, then t he public keys for a ll user s are disp layed.
C OMMAND L IN E I NTE RFA CE 4-58 Event Logging Commands loggi ng on This c ommand controls lo g ging of er ror messag es , se nding debug or er ror messag es to switch memor y .
S YSTE M M ANAGEME NT C OMMANDS 4-59 Example Related Commands log ging h istor y (4-59) clear log ging (4 -63) loggi ng history This c ommand limits syslog messag es saved to swit c h memor y based on severity . T he no for m retur ns the log ging of syslog me ssag es to the defau lt level.
C OMMAND L IN E I NTE RFA CE 4-60 Default Setting Flash: errors (lev el 3 - 0) RAM: warnings ( level 6 - 0) Command Mode Global Configuratio n Command Usage The message le v el sp ecified for f lash memor y must be a higher priority (i.e. , numerically low er) than that spec i fied fo r RAM.
S YSTE M M ANAGEME NT C OMMANDS 4-61 Command Usage • By using this comma nd more than on ce yo u can bu ild up a l ist of host IP add resses. • The maximum number of host IP addresses allowed is five. Example logging facility This c ommand sets the facility type for remote logg ing of syslog mess ages .
C OMMAND L IN E I NTE RFA CE 4-62 loggi ng trap This command en ables the logging of syste m messages to a remote s er ver , or li mits the syslog messages save d to a re mote server based on se veri ty . Use this comm and without a specified level to enable re mote log ging.
S YSTE M M ANAGEME NT C OMMANDS 4-63 clear l ogging This command clears messages from the log buffer . Syntax clear lo gging [ fl as h | ram ] - fla sh - Even t history s tored in flas h memory (i. e., permanent memo ry). - ram - Eve nt history stor ed in temporary RA M (i.
C OMMAND L IN E I NTE RFA CE 4-64 Default Setting None Command Mode Pri vileged Exec Example The following example shows that system log ging is enabled, the messag e level for flash memor y is “er rors” (i.e., default level 3 - 0), the message level for RAM is “infor mational” (i.
S YSTE M M ANAGEME NT C OMMANDS 4-65 Related Commands show log ging se ndmail (4-70) show log This comma nd displa ys the syst em and ev ent messages st ored in memo r y . Syntax show log { fl a s h | ram } [ logi n ] [ tail ] - fla sh - Event h istory st ored in flas h memory (i.
C OMMAND L IN E I NTE RFA CE 4-66 Command Usage This comman d shows the system and ev ent messages stored in memor y , including the time stamp , message level (page 4-59), p rogram module, func tion, and even t n u mber . Example The follo wing exampl e shows s ample messages st ored in RAM.
S YSTE M M ANAGEME NT C OMMANDS 4-67 loggi ng sendmail host This c ommand specifies SMTP ser vers that will be sent alert messages. Use the no form to remo ve an SM TP server . Syntax [ no ] lo gging sendmail host ip_address ip_address - IP ad d ress of an SMTP ser ver that will b e sent alert mess ages for ev ent ha ndlin g.
C OMMAND L IN E I NTE RFA CE 4-68 Example loggi ng sendmail level This c ommand se ts the severity thre shold used to trig ge r alert messag es . Syntax loggin g se ndma il le vel le vel leve l - One of the system messag e levels (page 4-59). Me ssages sent include the selected level do wn to le v el 0.
S YSTE M M ANAGEME NT C OMMANDS 4-69 logging sendmail source-email This command sets the emai l address use d for the “Fro m ” fiel d in alert messages . Use the no form to delete the source email address . Syntax [no] log ging sendmail source-email email-add r ess email-address - The sour ce email addr ess used in al ert messages .
C OMMAND L IN E I NTE RFA CE 4-70 Command Mode Global Configuratio n Command Usage Y ou can spec ify up to fiv e recipi ents for alert mess ages. H owev er , you mus t enter a separa te command to sp ecify each recipient. Example loggi ng sendmail This comma nd enables SMT P event h andling .
S YSTE M M ANAGEME NT C OMMANDS 4-71 Example Time Commands The sys tem clock can be dynamically se t b y polling a set of specified time ser vers (NTP or SNTP). M aintaining an accurate tim e on the switch enables the system l og to record m eani ngful dates an d times for ev ent entries .
C OMMAND L IN E I NTE RFA CE 4-72 sntp client This comm and enables SNTP client requests for tim e synchronization from N TP or SNTP t i me ser ver s specified with the sntp servers comma nd.
S YSTE M M ANAGEME NT C OMMANDS 4-73 sntp server This comma nd sets the IP address of the ser v ers to whi ch SNTP tim e request s are issued. Use the this command with n o arguments to clear all time ser vers from the cur rent lis t. Syntax sntp server [ ip1 [ ip2 [ ip3 ]]] ip - I P a d d r e s s o f a t i m e s e rv e r ( N T P o r S N T P ) .
C OMMAND L IN E I NTE RFA CE 4-74 sntp poll This comma nd sets the i nte r val be tween send ing time req uests when the switch is set to SNT P client mode. Use the no for m to re store to th e defau lt. Syntax sntp p o ll se conds no sntp poll seconds - Inter val betw een time requests .
S YSTE M M ANAGEME NT C OMMANDS 4-75 Example clock timezon e This command sets the time z one for the s w itc h’ s internal clock. Syntax clock timezone name hour ho urs minute minutes { before-utc | after-utc } • name - Name of timezone, usually an acronym.
C OMMAND L IN E I NTE RFA CE 4-76 Example Related Commands show sntp (4-74) calendar set This comma nd sets the sys tem clock. It may be used if there is no time ser ver on your network, or if you h av e not conf igured the switch to rece ive signals f rom a time s er ver .
S YSTE M M ANAGEME NT C OMMANDS 4-77 show cal endar This comma nd displa ys the system clock. Default Setting None Command Mode Nor mal Exec , Privileg ed Exec Example System Status Commands Console#s.
C OMMAND L IN E I NTE RFA CE 4-78 light un it This comm and displays the unit ID of a switch using its front- panel LED indicators. Syntax light unit [ unit ] unit - speci fies a u nit in a swit ch s .
S YSTE M M ANAGEME NT C OMMANDS 4-79 • This command d isplays settin gs for key comman d modes. E ach mode group is separated b y “!” symbols , and incl udes the co nfiguratio n mode command, and corresponding command s.
C OMMAND L IN E I NTE RFA CE 4-80 Related Commands show r unning -config (4-80) show runnin g-config This comma nd displays the configur a t ion infor mation cur rently in use.
S YSTE M M ANAGEME NT C OMMANDS 4-81 Example Console#show running-config building startup-config, please wait..... ! phymap 00-30-f1-ce-2a-20 00-00-00-00-00-0 0 00-00-00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 00-00 -00-00-00-00 00-00-00-00-00-00 00-00-00-00-00-00 ! SNTP server 0.
C OMMAND L IN E I NTE RFA CE 4-82 Related Commands show star tup-config ( 4-78) show system This c ommand displays system infor mat ion. Default Setting None Command Mode Nor mal Exec , Privileg ed Exec Command Usage • F or a descr iption of th e items sh own by th is command, refer to “Displaying Sy stem Information” on page -11.
S YSTE M M ANAGEME NT C OMMANDS 4-83 show us ers Shows all activ e c onsole and T elnet session s , including use r name, idle time, and IP address of T elne t client. Default Setting None Command Mode Nor mal Exec , Privileg ed Exec Command Usage The session us ed to execu te this comman d is indicated by a “*” symbol next to t he Line (i.
C OMMAND L IN E I NTE RFA CE 4-84 Command Mode Nor mal Exec , Privileg ed Exec Command Usage See “Displaying Switch Hardware/S oftware V e rsions” on p age 3 -13 for detailed infor mation on the items d isplayed by this command . Example Frame Size Commands jumbo frame This comma nd enables supp or t for jumbo frames .
F LASH /F ILE C OMMANDS 4-85 Command Mode Global Configuratio n Command Usage • Th is switch provi des more effici ent throughput for large sequ ential data transfers by supporting jumbo frames up to 9216 bytes. Compared to standard Ethernet frames that run only up to 1.
C OMMAND L IN E I NTE RFA CE 4-86 copy Th is command moves (upload/down load) a co de imag e or co nfiguratio n file b etween the sw itch’ s flash mem or y and a TFTP server . When y ou sav e the sys tem code o r configura tion settings to a file on a TFTP se r ver , th at file can later be downloaded to th e switch to resto re system op eration.
F LASH /F ILE C OMMANDS 4-87 Command Mode Pri vileged Exec Command Usage • The syst em pr ompts for data req uired to complet e the c opy command. • T he destin ation fi le name sh ould not contain sla shes ( or /), the leading letter of the file name should not be a period (.
C OMMAND L IN E I NTE RFA CE 4-88 Example The foll owing example sh ows ho w to upl oad the co nfiguratio n setting s to a file on the TFTP ser ver: Th e following exa mple shows how to copy the ru nning conf iguratio n to a star tup file .
F LASH /F ILE C OMMANDS 4-89 This exampl e shows ho w to copy a p ublic-key used by SSH from an TFTP server . No te that pu blic k ey authen ticatio n via SSH is only su pported fo r users configured locally on the switch: delete This comm and deletes a file or image.
C OMMAND L IN E I NTE RFA CE 4-90 Example This e xample shows how to delete the test2.cfg c onfiguration file from flash me mor y for unit 1. Related Commands dir (4-90) delete public-key (4 -52) dir This comm and displays a list of files in flash memor y .
F LASH /F ILE C OMMANDS 4-91 • File information is shown below: Example The following example shows how to display all file infor mation: whichboot This command displ ays whic h files were bo oted when the syst em po wered up . Syntax whichboot [ uni t ] unit - Stac k unit.
C OMMAND L IN E I NTE RFA CE 4-92 Example This examp le shows the infor mation displaye d by the whichboot comma nd. See the t able under th e dir command for a des cription of the file infor mation displayed by this command. boot system This comma nd specifies the image used to st ar t up t he system.
A UTHE NTI CAT ION C OMMANDS 4-93 Example Related Commands dir (4-90) whichboot (4-91) Authen tication C o mma nds Y ou can co nfigure th is switc h to authen ticate u s er s log ging i nto the s ystem for manag ement acce ss using local or RADIUS authentic ation method s .
C OMMAND L IN E I NTE RFA CE 4-94 authent ication login This comma nd defines th e login auth enticatio n method and precedence . Use the no form to restore the defaul t . Syntax authentication login {[ loca l ] [ radius ] [ tacacs ]} no authentication login • local - Use l ocal password.
A UTHE NTI CAT ION C OMMANDS 4-95 Example Related Commands username - for set ting the local user names and pa ssword s (4-35) authent ication enable This comma nd defines th e authenti cation meth od and prec edence to use when c hanging fro m Exec co mmand mode to Privileged Ex ec command mode with th e ena ble command (see page 4-27).
C OMMAND L IN E I NTE RFA CE 4-96 • You can s pecify thr ee authe ntication methods in a single command to indica te the au thenticatio n sequence. For example, i f you enter “ authentication enable radius tacacs loc al , ” th e user name and password on th e RAD IUS server is verified first.
A UTHE NTI CAT ION C OMMANDS 4-97 radi us-server host This command specifies primary and bac kup RADIUS ser v ers and authen tication p arameters that apply to each server .
C OMMAND L IN E I NTE RFA CE 4-98 radi us-server port This command set s the RADIUS server netw ork port. Use the no fo r m to restore the default. Syntax radius-ser v er por t por t_nu mber no radius-server por t por t_nu mber - RADIUS ser ver UDP por t used for authenticatio n messages .
A UTHE NTI CAT ION C OMMANDS 4-99 Example radi us-server retran smit This comma nd sets the n umber of re tries . Use the no for m to restore the defau lt.
C OMMAND L IN E I NTE RFA CE 4-100 Command Mode Global Configuratio n Example show radius- server This comma nd displa ys the current sett ings for th e RADIUS ser v er .
A UTHE NTI CAT ION C OMMANDS 4-101 TACACS+ C lient T er minal Access Controlle r Access Co ntrol System (TA CA CS+ ) is a logon authent ication protoc ol that use s software r u nning on a central se r v e r to control access to T A CA CS-awar e devices on the networ k.
C OMMAND L IN E I NTE RFA CE 4-102 tacacs-server p o rt This comma nd specifies the TA CA CS+ server netw ork port. U s e th e no for m to res tore the default. Syntax tacacs-ser ver port port_number no tacacs-ser ver port por t_nu mber - TA CA C S+ ser ver TCP p ort u sed for auth entication messages .
A UTHE NTI CAT ION C OMMANDS 4-103 Example show tacacs-ser ver This comma nd displa ys the current set tings for the TA CA CS+ server . Default Setting None Command Mode Pri vileged Exec Example Port Security Commands These comman ds can be used t o enable po r t securi ty on a port.
C OMMAND L IN E I NTE RFA CE 4-104 port se curity This comma nd enables or co nfigures po r t securi ty . Us e the no for m with out any k eyword s to disa ble port securi ty . Use the no for m with the approp riate ke yword to restor e the default settings f or a respon se to securit y violatio n or for the ma ximum number of allowed addresse s .
A UTHE NTI CAT ION C OMMANDS 4-105 Command Usage • If you ena ble port security, t he switch st ops lear ning ne w MA C addr esses on the s pecified port when i t has reached a configured maxim um numbe r. Only incom ing traffic wit h source add resses already stored in the dynamic or static address table will be accepted.
C OMMAND L IN E I NTE RFA CE 4-106 802.1X Port Au thentication The switch suppor ts IEEE 802.1X (dot1x) port -based access co n trol that prev ents unautho rized access to the netw ork by requiring users to first submit credentials for authenti cation.
A UTHE NTI CAT ION C OMMANDS 4-107 dot1x s ystem-auth- control This command enables 802.1X port authentication globally o n the switch . Use the no for m to rest o re the default.
C OMMAND L IN E I NTE RFA CE 4-108 Default 2 Command Mode Interf ace Configuratio n Example dot1 x port-c ontr ol This c ommand sets th e dot1x mode on a por t interface.
A UTHE NTI CAT ION C OMMANDS 4-109 dot1x oper ation-mode This c ommand allows single or multiple host s (clients) t o connect to an 802.1X-authorized port. Us e the no form with no k eyword s to restore the default to single host. Us e the no for m with th e multi-host max-count ke ywords t o restore the d efault maxim um count.
C OMMAND L IN E I NTE RFA CE 4-110 dot1x re-aut hentic ate This comm and forces re-authentication on all ports or a sp ecific interface. Syntax dot1x re-authenticate [ interface ] interface • ethernet unit / port - unit - Stack unit. (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Po rt numb er.
A UTHE NTI CAT ION C OMMANDS 4-111 dot1x t imeout quiet-perio d This co mmand sets th e time that a switch por t waits after the Max Request Count h as been ex ceeded be fore attempti ng to acquire a new client. Us e the no for m to reset the d efault.
C OMMAND L IN E I NTE RFA CE 4-112 Example dot1x t imeout tx-period This c ommand sets the time that an interf ace on the switch wa its during an authen tication ses sion before re-transmitting an EAP packet. Use the no form to rese t to the default value .
A UTHE NTI CAT ION C OMMANDS 4-113 Command Mode Pri vileged Exec Command Usage This c ommand displays the followin g infor mation: • Global 802.1X Parameters – Shows whether or not 802.1X port authenticatio n is globally enabled on the switch . • 802.
C OMMAND L IN E I NTE RFA CE 4-114 - Max Count – The maximum number of hosts allowed to access this port ( page 4-109). - Port-contr ol – Shows the do t1x mode on a por t as a uto , force-aut horized, or for ce-unauthorized (page 4-10 8). - Su p plicant – MAC address of authorized client .
A UTHE NTI CAT ION C OMMANDS 4-115 Example Console#show dot1x Global 802.1X Parameters system-auth-control: enable 802.1X Port Summary Port Name Status Operation Mode Mode Authorized 1/1 disabled Single-Host ForceAuthorized n/a 1/2 enabled Single-Host auto yes .
C OMMAND L IN E I NTE RFA CE 4-116 Access Co ntrol List Comm ands Access Control Lis t s ( ACL) provide pac ket fi ltering for I P frames (bas ed on add ress , protoc ol, Layer 4 prot ocol por t number or TCP cont rol code) or any fra m es (b ased on MA C a ddress or Ethernet type) .
A CCES S C ONTROL L IST C OMMANDS 4-117 • This switch s upports ACLs for ingress filt ering only. You can o nly bind one IP ACL to any port and o ne MAC ACL glob ally for ing ress filteri ng. In othe r words, o n ly two ACLs ca n be bound to an inte rface - Ingres s IP ACL and Ingress MAC A CL.
C OMMAND L IN E I NTE RFA CE 4-118 access-list i p This command adds an IP access list and en t ers configuration mode for stand ard or extende d IP A CLs .
A CCES S C ONTROL L IST C OMMANDS 4-119 Command Usage • When you create a n ew ACL or enter co nfiguratio n mode for an existin g ACL, use th e permit or deny command to add new rules to the bott om of the list. To create a n ACL, you mu st add at l east one rule to the list.
C OMMAND L IN E I NTE RFA CE 4-120 Command Usage • New rules are a ppended to the end of the list. • Address bi tmasks are si milar to a su bnet mask, c ontaining f our integers from 0 to 255, each separated by a period. The binary mask uses 1 bits to indicate “m atch” and 0 bit s to indicat e “ignore.
A CCES S C ONTROL L IST C OMMANDS 4-121 [ precedence pr eceden ce ] [ tos tos ] [ dscp dscp ] [ source-port sp or t [ end ]] [ desti nati on-por t dport [ end ]] [ control-flag control-fla gs fl ag-bit mask ] • prot ocol-num ber – A specific protocol number.
C OMMAND L IN E I NTE RFA CE 4-122 • Th e control-code b itmask is a deci mal number (rep resenting an equivale nt bit mask ) that is appl ied to the cont rol code. En ter a decim al number, w here the equival ent binary b it “1” means to match a bit and “0” mea ns to ignore a bit.
A CCES S C ONTROL L IST C OMMANDS 4-123 Related Commands access-list ip (4-118) show ip access-list This comm and displays the rules for configured IP A CL s . Syntax show i p access-list { standard | extended } [ acl_n ame ] • standard – Specifies a standard IP ACL.
C OMMAND L IN E I NTE RFA CE 4-124 Command Mode Interf ace Configur ation (Eth ernet) Command Usage • A port can only be bo und to one A CL. • If a port is already b ound to an ACL and you bind it to a d ifferent ACL, the switc h will replace the old binding wit h the new one.
A CCES S C ONTROL L IST C OMMANDS 4-125 map access-list ip This comma nd sets the output queue for pack ets matc hing an A CL rule. The specifie d CoS val ue is only used to map the matc hing pac ket to an output qu eue; it is no t written to the pac ket itself .
C OMMAND L IN E I NTE RFA CE 4-126 show map access-list ip This comma nd shows the CoS v alue mapped t o an IP A CL for t he cur rent inte rface. (The CoS v alue det er mines the o utput queue for packet s matching an A CL r ule.) Syntax show m ap access-list ip [ interfac e ] interface • ethernet unit / port - unit - Sta ck un it.
A CCES S C ONTROL L IST C OMMANDS 4-127 MAC ACLs access-list mac This command adds a MA C access list and enters MA C ACL configuration mode. Use the no form to remov e the specified A CL. Syntax [ no ] access-list m ac acl_ name acl_ name – Name of the A CL.
C OMMAND L IN E I NTE RFA CE 4-128 Command Usage • When you create a n ew ACL or enter co nfiguratio n mode for an existin g ACL, use th e permit or deny command to add new rules to the bott om of the list. To create a n ACL, you mu st add at l east one rule to the list.
A CCES S C ONTROL L IST C OMMANDS 4-129 • address- bitmask 16 – Bitma s k for M AC address (in hexidecimal format). • vid – VLAN ID. (Range: 1-4094) • vid-end – Upper bound of VID range. (Range: 1-4094) • prot ocol – A specific Ethernet protocol number.
C OMMAND L IN E I NTE RFA CE 4-130 show mac access-list This comm and displays the rules for configured MA C A CLs . Syntax show mac access-lis t [ acl_name ] acl_nam e – Name of the A CL .
A CCES S C ONTROL L IST C OMMANDS 4-131 Command Usage • A port can only be bo und to one A CL. • If a port is already b ound to an ACL and you bind it to a d ifferent ACL, the switc h will replace the old binding wit h the new one.
C OMMAND L IN E I NTE RFA CE 4-132 Default Setting None Command Mode Interf ace Configur ation (Eth ernet) Command Usage • Y ou must configure an ACL mask be fore you can map CoS values to the rul e. • A packet matching a rule within the specified ACL is mapped to one of the output queu es as show n below.
A CCES S C ONTROL L IST C OMMANDS 4-133 Command Mode Pri vileged Exec Example Related Commands map access-list mac (4-131) ACL Infor mation show access-list This command shows all ACLs and associated rules, as well as all the user -defined masks . Command Mode Pri vileged Exec Command Usage Once th e A CL is bound to a n interfa ce (i.
C OMMAND L IN E I NTE RFA CE 4-134 Example show access-group Th is command shows the po rt as signment s of A CLs. Command Mode Pri vileged Execut ive Example Console#show access-list IP standard access-list david: permit host 10.1.1.21 permit 168.92.
SNMP C OMMANDS 4-135 SNMP Commands Controls access to this switch from manage ment stations using t he Simple Netw ork Managem ent Protoc ol (SNMP), as well as the error t ypes sent to trap manag ers. snmp-serv er community This comma n d defi nes the comm unity access string for t he Simple Network Man ageme nt Prot ocol.
C OMMAND L IN E I NTE RFA CE 4-136 • rw - Speci fies read/wr ite access. Au thorized m anag ement station s are able to both retrieve and modify MIB objects. Default Setting • public - Read-only access. Authorized managemen t stations are only able to retrieve MIB ob jects.
SNMP C OMMANDS 4-137 Example Related Commands snmp-server locatio n (4-137) snmp-serve r location This comman d sets the system locat ion string . Use the no f o r m to r e move the lo cation string. Syntax snmp-ser v er location text no snmp-ser ver location text - String that desc ribes the syste m location.
C OMMAND L IN E I NTE RFA CE 4-138 snmp-serv er host This co mmand specif ies the rec ipient of a Simple Ne twor k Management Protoc ol notificat ion operat ion.
SNMP C OMMANDS 4-139 enable traps co mmand and t h e snm p-server host comma n d for that host mus t be enable d. • Some notif ication ty pes cann ot be contr olled with t he sn mp-s erve r enable traps command . For exam ple, some notific ation types a re always enabled.
C OMMAND L IN E I NTE RFA CE 4-140 Command Usage • If you do no t enter an sn mp-s erv er e nabl e t raps command, no noti fications controlle d by this c ommand are se nt. In or der to confi g ur e this device to send SNMP no tifications , you must enter at least one snmp-server enable traps comma nd.
SNMP C OMMANDS 4-141 Example Console#show snmp SNMP traps: Authentication: enabled Link-up-down: enabled SNMP communities: 1. private, and the privilege is read- write 2.
C OMMAND L IN E I NTE RFA CE 4-142 Interface Commands These comman ds are used to displa y or set comm unication parameters fo r an Ethernet port, a g g regated link, or VLA N .
I NTERFACE C OMMANDS 4-143 interface This comma nd configures an interface ty pe and ente r interface config uration m ode. Use the no for m to remov e a tr unk. Syntax interf ace interface no interface port-channel ch annel -id interface • ethernet unit / port -u n i t - S t a c k u n i t .
C OMMAND L IN E I NTE RFA CE 4-144 Default Setting None Command Mode Interf ace Configur ation (Eth er net, P ort Chann el) Example The follo wing example adds a descrip tion to port 24. speed-duplex This command co nfigures the s peed and duplex mod e of a giv en interfa ce when a utonegotiati on is dis abled.
I NTERFACE C OMMANDS 4-145 Command Usage • To force operat ion to the s peed and dupl ex mode specifi ed in a speed-duplex co mmand, use the no negotiati o n command to disabl e auto-negotia tion on the selected inte rface.
C OMMAND L IN E I NTE RFA CE 4-146 auto-negotiation is dis abled, you must manually specify the link attribu tes with the speed- duplex and fl owcontrol command s. • I f autoneg otiation is disabled, au to-MDI/MDI -X pin sig nal configuration wi ll also be disabled for the RJ-45 ports.
I NTERFACE C OMMANDS 4-147 Default Setting • 10 0BASE-TX: 10half, 10full, 100half, 100full • 10 00BASE-T: 10half, 10full, 100half, 100full, 1000full • SFP: 1000full Command Mode Interfac e Confi.
C OMMAND L IN E I NTE RFA CE 4-148 Command Mode Interf ace Configur ation (Eth er net, P ort Chann el) Command Usage • Flo w control can eliminate frame loss by “blo cking” traffic from end stat ions or segmen ts conn ected di rectl y to th e switch when it s buffe rs fill.
I NTERFACE C OMMANDS 4-149 Default Setting All interfaces are enabled. Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usage Th is command allows you to dis able a por t due to abnor m al behavio r (e.g ., excessiv e collisions), and the n reenable it after the problem has been res o lv ed.
C OMMAND L IN E I NTE RFA CE 4-150 • This comman d can enable or disable broadcast s torm control for the selected i nterface. However, the specifie d threshold value applies to all po rts on the s witch.
I NTERFACE C OMMANDS 4-151 Example The follo wing example clears statis tics on port 5. show i nterfaces status This comm and displays the status for an interface. Syntax show i nte rfaces status [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t .
C OMMAND L IN E I NTE RFA CE 4-152 Example show interfaces counters This comm and displays interface statistics . Syntax show interfaces counters [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number.
I NTERFACE C OMMANDS 4-153 Command Mode Nor mal Exec , Privileg ed Exec Command Usage If no interface is specified, infor matio n on all interfaces is dis played. F or a descrip tion of the item s display ed by this co m mand, see “Showing P or t Statistics” on pag e 3-115.
C OMMAND L IN E I NTE RFA CE 4-154 show i nterfaces switch port This comm and displays the administrative and operational status of the specified in terfaces . Syntax show interfaces s wi tchport [ in terface ] interface • ethernet unit / port -u n i t - S t a c k u n i t .
I NTERFACE C OMMANDS 4-155 Table 4-41 Interfaces Switchport Statistics Field Description Broadcast thre shold Shows if broadc ast stor m sup pression is enabled or dis abled; if enabled it als o shows the threshold level (page 4-149). Lacp status Shows if Li nk Aggregation Cont rol Protocol has been enable d or disabled (pag e 4-164).
C OMMAND L IN E I NTE RFA CE 4-156 Mirror Port Commands Th is section d escribe s how to mir ror traf fic from a source port to a targ et por t. port monitor This command con figures a mir ror ses sion.
M IR R OR P ORT C OMMANDS 4-157 • T he dest ination p ort is se t by specif ying an Ethern et interf ace. • T he mirror port and mo nitor port speeds should mat ch, othe rwise traff ic may be dr opped from the monito r port. • Y ou can only create a s ingle mirror se ssion.
C OMMAND L IN E I NTE RFA CE 4-158 Example The foll owing shows mirrorin g configured from port 6 to por t 11: Rate Limit Commands This f unction allows t he network manag er to cont rol the maximum r ate for traffic transmitted or receiv e d on an interface .
R ATE L IMIT C OMMANDS 4-159 rate-limit Use this command to de fine the rate li mit lev el for a specific int erface . Use this comm and withou t specifyin g a rate to rest ore the defau lt rate limit level. Use the no for m to r estore t he defa ult stat us of di sabled.
C OMMAND L IN E I NTE RFA CE 4-160 rate-limit granularit y Use this co m man d to define the rate lim it g ranu larity for the F ast Ethernet por ts , and the Gig abit E ther net por ts . Us e the no for m of this co m mand to rest ore t he defau lt setting.
L INK A GG RE G A T I O N C OMMANDS 4-161 show rate-limit Use this command to displ ay the rate limit granularity . Default Setting F ast Ethernet inter face – 3.
C OMMAND L IN E I NTE RFA CE 4-162 Guidelines for Creating Trunks General Guidelines – • Finish conf iguring po rt trunks before you connect the corresp onding network c ables bet ween switch es to avoi d creating a loop. • A trunk can have up to eight ports.
L INK A GG RE G A T I O N C OMMANDS 4-163 • A ll the ports in a trunk have to b e treated as a whole w hen moved from /to, ad ded or de leted fr om a VLA N via the specif ied port- channel. • STP, VL AN, and IGM P setting s can only b e made for th e entire tr unk via the sp ecified port-chann el.
C OMMAND L IN E I NTE RFA CE 4-164 Command Usage • Wh en configuring static t runks, the switches must comply with the Cis co Ethe rChann el stand ard. •U s e no channel-group to remove a po rt group from a trunk . •U s e no interfaces port-channel to remove a tr unk from the switch.
L INK A GG RE G A T I O N C OMMANDS 4-165 Example Th e following shows LA C P enab led on por ts 1 1-13. Bec ause LACP has also bee n enabled on the ports at the o ther end of the links , the show interfaces status por t-channel 1 command shows that T r unk 1 has b een established.
C OMMAND L IN E I NTE RFA CE 4-166 lacp system-priority This comman d configures a port's LA CP syste m priority . Use the no for m to rest ore t he defau lt setting. Syntax lacp { actor | partner } system-priority priority no lacp { actor | par tner } system-priori ty • actor - The local side an aggregate link .
L INK A GG RE G A T I O N C OMMANDS 4-167 lacp admin-key (Ethernet In terface) Th is command configure s a por t's LA C P administ ration key . U se the no for m to res tore the defau lt setting . Syntax lacp { actor | partner } admin-key ke y [ no ] lacp { acto r | par tner } admin-key • actor - The local side an aggregate li nk.
C OMMAND L IN E I NTE RFA CE 4-168 lacp admin-key (Port Channel) This command configures a port c hannel's LA CP admi nistration k ey stri ng . Use the no for m t o restore th e default s etting .
L INK A GG RE G A T I O N C OMMANDS 4-169 lacp port-priority This command c onfigures LA CP port priority . Use the no for m t o res to re the de fault settin g . Syntax lacp { actor | partner } por t-priority priority no lacp { actor | par tner } por t-priority • actor - The local side an aggregate li nk.
C OMMAND L IN E I NTE RFA CE 4-170 show l acp This c ommand displays LA CP infor mation. Syntax show lacp [ port-channel ] { counters | inter nal | neighbors | sysid } • port-channe l - Local identifier for a link aggregation group. (Range: 1-4) • counters - Sta tistics for LAC P protocol me ssages.
L INK A GG RE G A T I O N C OMMANDS 4-171 Example Console#show lacp 1 counters Port channel: 1 ----------------------------------------- -------------------------- Eth 1/ 1 ---------------------------.
C OMMAND L IN E I NTE RFA CE 4-172 Console#show lacp 1 internal Port channel : 1 ----------------------------------------- -------------------------- Oper Key : 4 Admin Key : 0 Eth 1/1 ---------------.
L INK A GG RE G A T I O N C OMMANDS 4-173 Adm in Sta te, Oper S tate Administrat ive or operational valu es of the actor’s state parameters: • Expired – The actor’s receiv e machine is in the .
C OMMAND L IN E I NTE RFA CE 4-174 Console#show lacp 1 neighbors Port channel 1 neighbors ----------------------------------------- -------------------------- Eth 1/1 ---------------------------------.
A DDRESS T ABL E C OMMANDS 4-175 Addre ss Tabl e Comma nds These comma nds are used t o con figure the ad dress table for filtering speci fied addres ses, display ing current entri es, clearing t he table, or setti ng the agin g time.
C OMMAND L IN E I NTE RFA CE 4-176 mac-add ress-table st atic This c ommand maps a static address to a destination po rt in a V LAN . Use the no for m to remove an address .
A DDRESS T ABL E C OMMANDS 4-177 • A static addres s cannot be lear ned on another port u ntil the ad dres s is removed with the no form of this command.
C OMMAND L IN E I NTE RFA CE 4-178 • vlan -id - VLAN ID (Range: 1-4094) • sort - Sort by address , vlan or interface. Default Setting None Command Mode Pri vileged Exec Command Usage • The MAC Addres s Table cont ains the MAC ad dresses assoc i ate d with each inter face.
A DDRESS T ABL E C OMMANDS 4-179 mac -addres s-tabl e aging -time This co mmand sets the aging time for en tries in the addre ss table. Use the no for m to res tore the de fault aging tim e. Syntax mac-address-tabl e a ging-time seco nds no mac-address-ta ble a ging-time seconds - Aging time.
C OMMAND L IN E I NTE RFA CE 4-180 Spanni ng Tree Comma nds This secti on includes co mmands that configure th e Spanning T ree Alg orithm (STA) globally for the switch, and comma nds that config ure ST A for the select ed interface .
S PANNING T REE C OMMANDS 4-181 spanning- tree This comma nd enables t h e Span ning T ree Alg orith m globally for the switch. U se the no fo r m to disable it.
C OMMAND L IN E I NTE RFA CE 4-182 spanning- tree mode This comma nd selects th e spanning tree mode for t his switch . Use the no for m to res tore the default. Syntax spanning-tree mode { stp | rst p } no spanning-tree mode • stp - Spanning Tree Protocol (IEEE 802.
S PANNING T REE C OMMANDS 4-183 spanning-tree for ward-time This comm and configures the spanning tree brid ge forward time globally for this switch. Use the no for m to res tore the defau lt. Syntax spanning-tree for ward -time secon ds no spanning-tree forw ard -time seconds - Time in seconds.
C OMMAND L IN E I NTE RFA CE 4-184 Default Setting 2 second s Command Mode Global Configuratio n Command Usage Th is command sets the ti me inter v al ( in second s) at which th e root device trans m its a config uration message. Example spanning-tree max-age This comman d configures the spanning t ree bridge maxim um age globall y for this switch.
S PANNING T REE C OMMANDS 4-185 a new root po rt is selec ted from among the devic e port s attached to the network. Example spanning- tree priority This comm and configures the spanning tree priority globally for this switch. U se the no form to restore the d efault.
C OMMAND L IN E I NTE RFA CE 4-186 spanning-tree pathcos t method This command configures the path cost metho d used for Rapid Sp anning T ree . Use the no for m to r estore the d efault. Syntax spanning-tree pathcost method { long | short } no spanning-tree pathcost method • lon g - Specifies 32-bit based values that range from 0-200,000,000.
S PANNING T REE C OMMANDS 4-187 Default Setting 3 Command Mode Global Configuratio n Command Usage This c ommand limits th e maximum transmission rat e for BPDUs . Example spanning-tree s panning-disabled This comma nd disables the spanni ng tree algorith m for the speci fied interface.
C OMMAND L IN E I NTE RFA CE 4-188 spanning-tree cos t This comma n d con figures the sp anning tree p ath cost for t he specified interface. Use the no form to res tore the default. Syntax spanning-tree cost cost no spanning-tree cost cost - The p ath cost for the p or t.
S PANNING T REE C OMMANDS 4-189 spanning- tree port-priority This command configures the priority for th e specified interfac e. Use th e no for m to res tore the d efault. Syntax spanning-tree por t-priority priority no spanning-tree por t-priority priority - The priority for a port.
C OMMAND L IN E I NTE RFA CE 4-190 Default Setting Disabled Command Mode Interf ace Configur ation (Eth er net, P ort Chann el) Command Usage • You can enable t his option if an interface is atta ched to a LAN segment t hat is at the en d of a bridge d LAN or to an en d node.
S PANNING T REE C OMMANDS 4-191 Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usage • This command is used to enable/ disable the fast sp anning-tree mode for the sele cted port. In this mo de, ports skip the Discarding and Learnin g st ates, and pro ceed straight to Forwarding.
C OMMAND L IN E I NTE RFA CE 4-192 Default Setting auto Command Mode Interf ace Configur ation (Eth er net, P ort Chann el) Command Usage • Specify a po int-to-point link if the i nterface can on ly be connect ed to exactly on e other brid ge, or a shared lin k if i t ca n be connected t o two or more brid ges.
S PANNING T REE C OMMANDS 4-193 Command Usage If at any time the switch detects STP BPDUs , in cluding Configuration or T opolog y Change Notific ation BPDUs, it will automatically set th e selected inte rface to forced STP-compatible mo de.
C OMMAND L IN E I NTE RFA CE 4-194 • For a desc ription of t he items displ ayed under “S panning-tr ee information,” see “Configuring Global Settings” on page 3-132. For a descripti on of the items displayed for sp ecific interfaces, see “Displaying Interface Settings” on page 3-136.
VLAN C OMMANDS 4-195 VLAN Commands A VLAN is a g roup of port s that can be located a nywhere in the network, but co m m unicate as th ough they belo ng to the s ame phys ical segment.
C OMMAND L IN E I NTE RFA CE 4-196 Command Mode Global Configuratio n Command Usage • Use the VLA N database co mmand mode to ad d, change, an d delete VLAN s. After fin ishing co nfigura tion chan ges, you c an display the VLAN se ttings by entering the show vla n comman d.
VLAN C OMMANDS 4-197 • state - Keyword to be followed by the VLAN s tate. - active - VLAN is op erational. - suspend - VL AN is suspe nded. Suspen ded VLANs do not pass packets. Default Setting By default only VL AN 1 exists and is ac tiv e. Command Mode VLAN Da tabase Conf iguration Command Usage • no vlan vlan -id dele tes the VL AN.
C OMMAND L IN E I NTE RFA CE 4-198 Configuring V LAN Interfaces interface vlan This comma nd enters inte rface config ura t ion mode for VLANs, whic h is used to configure VLA N par ameters for a physical interface . Syntax interface vlan vlan- id vlan-id - ID of the configure d VLAN .
VLAN C OMMANDS 4-199 Example Th e following exa mple shows how to set the in terface configura tion mode to VLAN 1, an d then assign an IP address to the V LAN: Related Commands shutdown (4-148) switc hport m ode This comma nd configures t he VLAN memb ership mode for a p or t.
C OMMAND L IN E I NTE RFA CE 4-200 Example Th e following shows how to se t the conf iguration mode to p ort 1, and then se t the swit c h por t mode to hybrid: Related Commands switchport acce ptable-frame-types (4-200) switchport accep table-frame-types This comma nd configures t he acceptable fra m e ty pes for a po r t.
VLAN C OMMANDS 4-201 Related Commands switchpor t mode (4-199) switchpor t ingress-filtering This c ommand enables ing ress filt ering for an i nterface.
C OMMAND L IN E I NTE RFA CE 4-202 switc hport na tive vla n This c ommand configu res the PV ID (i.e., default VLA N ID) for a por t. Use the no form to restore the defaul t . Syntax swi tc hport native vlan vlan- id no switchpor t nati ve vlan vlan-id - Default VLAN ID for a por t.
VLAN C OMMANDS 4-203 switc hport allow ed vlan This comma n d con figures VLAN g roups on th e selected in terface. Us e the no for m to restore th e default. Syntax swi tc hport allowed vlan { add vl an-l ist [ ta gged | untagged ] | rem ov e vlan-li st } no switchpor t allo wed vlan • add vlan-lis t - List of VLAN ident ifiers to add.
C OMMAND L IN E I NTE RFA CE 4-204 • If a VLAN on the forbidd en list fo r an int erface is m anually added to that inte rface, the VLA N is automat ically removed fro m the forbidden list for that int erface.
VLAN C OMMANDS 4-205 Example Th e following example shows how to preve nt por t 1 from be ing add ed to VLAN 3: Displaying VLAN Information show vlan This command s hows VLAN infor mation. Syntax show v lan [ id vl an-id | name vlan- name | pr ivate-vlan p ri v ate-vlan-type ] • id - Keyw ord to be f ollowed by the VLAN ID.
C OMMAND L IN E I NTE RFA CE 4-206 Command Mode Nor mal Exec , Privileg ed Exec Example Th e following example shows how to dis play infor ma tion fo r VLAN 1 : Configuring P rivate VLANs Pri vate VLAN s provide por t-ba sed security and isolation between por ts within the a ssigned VLAN.
VLAN C OMMANDS 4-207 This sect ion descri bes command s used to con figure pri vate VLANs . T o configure primary/secondary associated g roups , follo w these steps : 1. Use the pri vate-vlan com mand to des ignate one or more commu nity VLANs and the primary VL AN that will channel traffic outside o f the comm unity groups .
C OMMAND L IN E I NTE RFA CE 4-208 5. Use the s wi tchpor t pri vate-vlan mapping command to assi gn a por t to a primar y VL AN . 6. Use the sho w vlan priv ate-vlan command to v eri fy yo ur config uration set tings . T o configure isolated VLA Ns, fo llow thes e steps: 1.
VLAN C OMMANDS 4-209 Default Setting None Command Mode VLAN Config uration Command Usage • Pr ivate VLAN s are used t o restric t traffic to ports within the sam e communi ty or isol ated VLAN, an d channel tr affic passing outside th e communit y through promiscu ous ports.
C OMMAND L IN E I NTE RFA CE 4-210 private vla n associatio n Use th i s co mmand to ass ociate a prima r y VLAN wi th a secondary (i.e ., comm unity) VLAN .
VLAN C OMMANDS 4-211 switc hport mode p rivate- vlan Use this co mmand to set the p riva te VLAN mode for an inte rface. Use the no for m to res tore the d efault set ting .
C OMMAND L IN E I NTE RFA CE 4-212 switchport p rivate-vlan host-association Use this co mmand to ass ociate an interfac e with a second ar y VLAN . Use the no for m to remove this ass ociation.
VLAN C OMMANDS 4-213 Default Setting None Command Mode Inter face Confi guration (E thern et, P or t Chan nel) Command Usage Host po r ts ass igned to a is olated VLAN cannot pass tr affic betwee n group members , and m ust comm unicate with res ources outsi de of the group via a pro miscuous port.
C OMMAND L IN E I NTE RFA CE 4-214 Example show vlan priv ate- vlan Use th i s co mmand to s how the p riva te VLAN c onfigurati on settings on this switch. Syntax show vlan pr ivate-vlan [ community | isolated | primar y ] • community – Disp lays all communi ty VLANs, along with their associated primary VLAN and assigned ho st interfaces.
GVRP AND B RIDGE E XTENSION C OMMANDS 4-215 GVRP and Bridg e Extens ion Com mands GARP VLA N Registration P rotocol d efines a way for swit ches to exc hang e VLAN infor mation in orde r t o autom aticall y regis ter VLAN members on interface s across t he netw ork.
C OMMAND L IN E I NTE RFA CE 4-216 Command Mode Global Configuratio n Command Usage GVRP defines a way for switches to exchange VLAN infor mation in order to register VL AN member s on por ts acro ss the net w o rk.
GVRP AND B RIDGE E XTENSION C OMMANDS 4-217 switchp ort gvrp This command enables GVRP for a por t. Use th e no for m to disable it. Syntax [ no ] s w it c h p o rt g v rp Default Setting Disabled Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Example show gv rp configura tion This comm and shows if GVRP is enabled.
C OMMAND L IN E I NTE RFA CE 4-218 Example garp t imer This comm and sets the values for the join, leave and leav eall tim ers . Use the no for m to resto re the timers’ d efault values .
GVRP AND B RIDGE E XTENSION C OMMANDS 4-219 • Timer values m ust meet the fo llowing rest rictions: - leave >= (2 x join) - leaveall > leave Note: Set GVRP timers on all Layer 2 devices connect ed in the same network to the same valu es. Otherwise , GVRP may not o perate success fully.
C OMMAND L IN E I NTE RFA CE 4-220 Example Related Commands garp timer (4-218) Priority Commands The com mands described in this se ction allow you to specify which data pack ets hav e g reat er precedence wh en traffic is buffer ed in the swi t c h due to con g esti on.
P RIORITY C OMMANDS 4-221 queue mode This c ommand sets th e queue mode to strict priori ty or W eighte d R ound-R obin (WRR) for the class of ser vice (CoS) prio rity queues .
C OMMAND L IN E I NTE RFA CE 4-222 Command Usage Y ou can set t he switch t o ser vice the qu eues based o n a strict rule that requires all t raffic in a higher prio rity queue to be proc essed befor.
P RIORITY C OMMANDS 4-223 frames). This priority does not apply to IEEE 802. 1Q VLAN tagged frames. If the incoming frame is an IEEE 802 .1Q VLAN tagged frame, the IEEE 802.1p User Priority bits will be used. • T his switch provide s eight prio rity que ues for eac h port.
C OMMAND L IN E I NTE RFA CE 4-224 Command Usage WRR con trols bandw idth sharing at the egress port by defining schedul ing weights. Example This exampl e shows ho w to assign WRR weights to priority.
P RIORITY C OMMANDS 4-225 Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usage • CoS values assig ned at the ingre ss port are also used at the egress port.
C OMMAND L IN E I NTE RFA CE 4-226 show queue ban dwidth This comma n d di splays the weighted r ound-robin ( WRR) bandwidth allocatio n for the four prio rity queues. Default Setting None Command Mode Pri vileged Exec Example show queue cos-map This com m a nd shows the class of ser vice p riority map .
P RIORITY C OMMANDS 4-227 Example Priority Commands (Layer 3 and 4) Console#show queue cos-map ethernet 1/1 Information of Eth 1/1 CoS Value : 0 1 2 3 4 5 6 7 Priority Queue: 0 0 0 1 2 2 3 3 Console# .
C OMMAND L IN E I NTE RFA CE 4-228 map ip port (Glob a l Configuration) This comman d enables IP port mapp ing (i.e., class of ser vice mapping fo r TCP/UDP so ckets).
P RIORITY C OMMANDS 4-229 Command Mode Interfac e Configu ration (E thern et, P or t Chan nel) Command Usage • The precedence fo r priority map ping is IP Port, IP Prece dence or IP DSCP , and defa ult swit chport priorit y. • T his command sets the IP p ort priority for all interfaces.
C OMMAND L IN E I NTE RFA CE 4-230 map ip pre cedence (Interface Configuration) This command sets IP precedence prior it y (i.e ., IP T ype of Ser vice prio rity). Use the no form to res tore the default table . Syntax map ip precedence ip-pr ecedence-value cos cos-value no map ip precedence • preced ence-v alue - 3-bit precedence value.
P RIORITY C OMMANDS 4-231 map ip dscp (Globa l Configuration) This comm and enables IP DSCP mapping (i.e., Differentiated Ser vices Code Point mapping).
C OMMAND L IN E I NTE RFA CE 4-232 Default Setting The D SCP default values are defi ned in the fo llowing table. Note tha t all the DSCP values that are not speci fied are mapped to CoS valu e 0.
P RIORITY C OMMANDS 4-233 show map ip port Use this command to s how the I P port priority ma p. Syntax show map ip port [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number.
C OMMAND L IN E I NTE RFA CE 4-234 show map ip precedence This comma nd shows the IP prece dence priori ty map . Syntax show map ip precedence [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number.
P RIORITY C OMMANDS 4-235 show map ip dscp This comm and shows the IP DSCP priority map . Syntax show map ip dscp [ interface ] interface • ethernet unit / port -u n i t - S t a c k u n i t . (Range – SMC6224M: 1-8, SMC6248M: 1-4, mixed stack: 1-4) - port - Port number.
C OMMAND L IN E I NTE RFA CE 4-236 Mult icast F ilte ring Co mmand s Th is switch uses IGMP (In tern et Group Ma nage ment Prot ocol) to qu er y for any a ttached ho sts that w ant to recei ve a spec ific multi cast ser vice . It ident ifies the po r ts cont aining host s requestin g a se r vice and sends data out to those ports onl y .
M ULTICAST F ILTERING C OMMANDS 4-237 ip igmp snooping This c ommand enables IG MP snoopin g on this switch. Use the no for m to dis able it. Syntax [ no ] ip igmp snooping Default Setting Enabl ed Command Mode Global Configuratio n Example The follo wing exam ple enables I GMP snooping .
C OMMAND L IN E I NTE RFA CE 4-238 Command Mode Global Configuratio n Example The following shows how to statically configure a multicast g roup on a por t: ip igmp snooping ve rsion This comma nd configures t he IGMP snoop ing vers ion. Use the no for m to restore th e default .
M ULTICAST F ILTERING C OMMANDS 4-239 show ip ig m p snoopi ng Th is command shows the IG MP snoopin g config uration. Default Setting None Command Mode Pri vileged Exec Command Usage See “Conf iguring IGMP Snooping and Q uer y P arameters ” on pag e 3-185 for a d escript ion of th e display ed items.
C OMMAND L IN E I NTE RFA CE 4-240 Command Mode Pri vileged Exec Command Usage Membe r types d isplayed include I GMP or USE R, depending on select ed o ptions.
M ULTICAST F ILTERING C OMMANDS 4-241 ip igmp snooping qu erier This command enables the switch as an IGMP querier . Use the no for m to disa ble it. Syntax [ no ] ip igmp snooping querier Default Setting Enabl ed Command Mode Global Configuratio n Command Usa ge If enabled, the switch will ser ve as querier if electe d.
C OMMAND L IN E I NTE RFA CE 4-242 Command Usage Th e quer y co unt def ines how long the quer ier waits fo r a respon se from a multicast clie nt befo re takin g action .
M ULTICAST F ILTERING C OMMANDS 4-243 ip igmp s nooping qu ery-max-respons e-time This comma n d con figures the query report dela y . Use the no form to restore the default. Syntax ip igmp snooping quer y-max-response-time seconds no ip igmp snooping quer y-max-response-time seconds - Th e repo r t dela y advertised in IGMP queri es.
C OMMAND L IN E I NTE RFA CE 4-244 ip igmp s nooping router -port-expir e-time This comma nd configures the quer y ti meout. Use the no for m to resto re the de fault.
M ULTICAST F ILTERING C OMMANDS 4-245 Static Multicast Routing Commands ip igmp s nooping vlan mrouter This comm and statically configures a multicast router por t.
C OMMAND L IN E I NTE RFA CE 4-246 Example Th e following shows how to configu re por t 11 as a multic ast router port within VLAN 1: show ip ig m p s n oopi ng mrouter This comm and displays infor mation on statically config ured and dynamically lear ned multicast router por ts .
IP I NTERFACE C OMMANDS 4-247 IP Inte rface Commands An IP ad dres ses may be used for manag emen t acce ss to the switch over your ne t w ork. T he IP address for this switch is obtained via DHCP b y default.
C OMMAND L IN E I NTE RFA CE 4-248 Default Setting DHCP Command Mode Interf ace Configur ation (VLA N) Command Usage • You must assign an IP add ress to this device to gain management access o ver the netw ork. You can manually configure a s pecific IP address, or direct the device to obtain an address from a BOOTP or DHCP server.
IP I NTERFACE C OMMANDS 4-249 ip default-gateway This c ommand establishes a st atic route between this switch and devices that exis t on another network segment.
C OMMAND L IN E I NTE RFA CE 4-250 Command Usage • This comman d issues a BOOTP or DHCP client r equest for any IP interface t hat has been set to BOOTP or D HCP mo de via the ip address comman d. • D HCP requi res th e serv er to re assi gn the clien t’s las t addr ess if available.
IP I NTERFACE C OMMANDS 4-251 show ip redirects This comma nd shows the default gatew ay confi g ured for this devi ce. Default Setting None Command Mode Pri vileged Exec Example Related Commands ip default-gateway (4-249) ping Th is comman d sends IC MP echo re quest packets to ano ther no de on the network.
C OMMAND L IN E I NTE RFA CE 4-252 Command Usage • Us e the pin g command t o see if anoth er site on the netw ork can be reached. • Fo llowing are some results of the ping c o mmand: - Normal respon se - The n ormal respons e occurs in on e to ten seco nds, depe nding on ne twork tra ffic.
A-1 A PPENDIX A S OFTWARE S PECIFI CATIONS Software Features Authentication Local, RADIUS , TA CA CS , Port (802.1X), HTT PS , SSH, P ort Security Acc ess Con trol L ists IP , MA C (up to 88 lists) DH.
S OFTWARE S PECIFICATIONS A-2 Spanning T ree Algorithm Spanning T ree Protocol (STP , IEEE 802.1D) Rapid Spanning T ree Protocol (RSTP , IEEE 802.1w) VLAN Support Up to 255 group s; port-based or tag ged (802.
S OFTWARE S PECIFICATIONS A-3 RMON Groups 1, 2, 3, 9 (Statistics, Histor y , Alar m, Event) Standards IEEE 802.1D Spanning T ree Protocol and traffic priorities IEEE 802.1p Priority tags IEEE 802.1Q VLAN IEEE 802.1w Rapid Span n ing T ree Protocol IEEE 802.
S OFTWARE S PECIFICATIONS A-4 Manageme nt Info rmation Bases Bridge MIB (RFC 1493) Entity MIB (RFC 2737) Ether-lik e MIB (RFC 2665) Extended Bridge MIB (RFC 2674) Extensible SNMP Agents MIB (RFC 2742).
B-1 A PPENDIX B T ROUBLESHOOTING Problems Accessing the Man a gement Interface Table B-1 Troubleshooting Ch art Symptom Acti on Cannot con nect using Telnet, web browse r, or SNMP software • Be sur e the switch is pow ered up. • Chec k network cabling betw een the manageme nt station and t he swit ch.
T R OUBLESHOOTING B-2 Cannot con nect using Secure Shell • If you can not connect usi ng SSH, you may have exceeded the maximu m number of concurrent Telnet/SSH ses sions permitte d.
U SIN G S YSTEM L OGS B-3 Using System Logs If a fault does occur, refer to the Installa tion Guide to ens ure that the probl em you en count ered is actuall y caus ed by the sw itch. If th e proble m appea rs to be ca used by the switch, follow th ese ste ps: 1.
T R OUBLESHOOTING B-4.
Glossary-1 G LOSSA RY Acc ess Con trol Li st (ACL) A CLs can l imit netw ork tr affic and restr ict access to c er tain us ers or devices b y chec king each p acket for certain IP or MA C (i.
G LOSSAR Y Glossary-2 Dynamic Ho st Control Protocol (DH CP) Prov ides a framew ork for passing conf i guration infor mation to hosts on a TCP/IP n etwor k. DHCP is bas ed on the Bo otstrap Prot ocol (BOOT P), adding the capabilit y of automatic allo cation of reusable ne twork a dd resses and ad ditional c onfigurati on opt ions .
G LOSSAR Y Glossary-3 IEEE 802.1D Specifies a g eneral method for the oper ation of MA C bridg es , inc luding the Sp anning Tree Proto col. IEEE 802.1Q VLAN T ag ging—Defines Ethernet frame ta gs which carr y VLAN infor mation.
G LOSSAR Y Glossary-4 IGMP Query On each subnetwork, one IGMP-capable device will act as the que rier — that is, the device tha t asks all hosts to repo rt o n the IP multicas t gro ups they wish to join or to which t hey already belong . T he elected querier will be the device with the l owest IP address i n th e subnetwo rk.
G LOSSAR Y Glossary-5 Link Aggregation See Por t T r unk. Link Ag g regation Contr ol P rotocol (LACP) Allows por ts to automatically neg otiate a tr unked link with LA CP-conf igured ports on another dev ice. Management Inf or mation Base (MI B) An acrony m for Management Information Base.
G LOSSAR Y Glossary-6 Port Mirror ing A method whe reby data on a targ et p o rt is mirrored to a monit o r po r t for troub leshoot ing with a logic analyze r or RMO N probe.
G LOSSAR Y Glossary-7 Sim ple Net work M anage ment Pr otocol (SNMP) The appl ication p rotocol in the Inte r net su ite of prot ocols whi ch offe rs network manag ement ser vices. Simple Networ k Time Protocol (SNTP) SNTP allow s a device to s et its int er nal c lock based on period ic updates from a Netw ork Time Prot ocol (NT P) ser ver .
G LOSSAR Y Glossary-8 User Datagra m Protocol (UDP) UDP pro vides a datagram mode for pack et-switc hed comm unications . I t uses IP as the under lying transp or t mec hanism to provide acc ess to IP-li ke ser v ices.
Index-1 Numerics 802.1X, port authen tication 3-66 A acceptab le frame type 3-157 , 4-200 Access Control List See ACL ACL Extended IP 3-78 , 4-11 6 , 4-117 , 4-120 MAC 3-79 , 4-116 , 4- 127 , 4-127 .
I NDE X Index-2 GVRP global setting 4-215 interface configu ration 3-158 , 4-217 GVRP, globa l setting 3-148 H hardware version, displ aying 3-13 , 4-83 HTTPS 3-54 , 4-42 HTTPS, secure server 3-54 , 4-42 I IEEE 802.1D 3-127 , 4-182 IEEE 802.1w 3-127 , 4-182 IEEE 802.
I NDEX Index-3 port priority configuring 3-1 69 , 4-220 default ingre ss 3-169 , 4-222 STA 3-138 , 4-189 port security, config uring 3-64 , 4-103 port, statistics 3-115 , 4-152 ports autonegot iation .
I NDE X Index-4 setting 3-22 , 4-92 static a ddresses, setting 3-122 , 4-176 statist ics port 3-115 , 4-152 STP 3-132 , 4-182 STP Also see STA system cl ock, setting 3-42 , 4-71 System Logs 3-33 syst .
.
38 T esla Irvine, CA 92618 Phone: (9 49) 679-8000 FOR TECHNICAL SUPPOR T , CALL: From U.S.A. an d Canada (2 4 hours a day , 7 days a week) (800) SMC-4-YOU; Phn: (949) 679-8000; Fax: (949) 679-1481 Fro m Europe : Contac t deta ils can be foun d on www .
Un point important après l'achat de l'appareil (ou même avant l'achat) est de lire le manuel d'utilisation. Nous devons le faire pour quelques raisons simples:
Si vous n'avez pas encore acheté SMC Networks SMC6224M c'est un bon moment pour vous familiariser avec les données de base sur le produit. Consulter d'abord les pages initiales du manuel d'utilisation, que vous trouverez ci-dessus. Vous devriez y trouver les données techniques les plus importants du SMC Networks SMC6224M - de cette manière, vous pouvez vérifier si l'équipement répond à vos besoins. Explorant les pages suivantes du manuel d'utilisation SMC Networks SMC6224M, vous apprendrez toutes les caractéristiques du produit et des informations sur son fonctionnement. Les informations sur le SMC Networks SMC6224M va certainement vous aider à prendre une décision concernant l'achat.
Dans une situation où vous avez déjà le SMC Networks SMC6224M, mais vous avez pas encore lu le manuel d'utilisation, vous devez le faire pour les raisons décrites ci-dessus,. Vous saurez alors si vous avez correctement utilisé les fonctions disponibles, et si vous avez commis des erreurs qui peuvent réduire la durée de vie du SMC Networks SMC6224M.
Cependant, l'un des rôles les plus importants pour l'utilisateur joués par les manuels d'utilisateur est d'aider à résoudre les problèmes concernant le SMC Networks SMC6224M. Presque toujours, vous y trouverez Troubleshooting, soit les pannes et les défaillances les plus fréquentes de l'apparei SMC Networks SMC6224M ainsi que les instructions sur la façon de les résoudre. Même si vous ne parvenez pas à résoudre le problème, le manuel d‘utilisation va vous montrer le chemin d'une nouvelle procédure – le contact avec le centre de service à la clientèle ou le service le plus proche.
