Brocade Communications Systems 6650 manuals

Computer Equipment > Switch

When we buy new device such as Brocade Communications Systems 6650 we often through away most of the documentation but the warranty. Very often issues with Brocade Communications Systems 6650 begin only after the warranty period ends and you may want to find how to repair it or just do some service work. Even oftener it is hard to remember what does each function in Switch Brocade Communications Systems 6650 is responsible for and what options to choose for expected result. Fortunately you can find all manuals for Switch on our side using links below.

Brocade Communications Systems 6650 Manual

332 pages3.82 Mb

2Brocade Communications Systems, Incorporated
Document History
- September 2012
- Title Publication number Summary of changes Date
  - Brocade ICX 6650 Security Configuration Guide
  - 53-1002601-01 Release 07.4.00 document updated with enhancements in Release 07.5.00
3Contents
- About This Document
- Chapter 1 Security Access
- 5Chapter 2 SSH2 and SCP
- Chapter 3 Rule-Based IP ACLs
- 7Chapter 4 IPv6 ACLs
- Chapter 5 ACL-based Rate Limiting
- 8Chapter 6 802.1X Port Security
- 9Chapter 7 MAC Port Security
- Chapter 8 MAC-based VLANs
- 10Chapter 9 Multi-Device Port Authentication
- 11Chapter 10 DoS Attack Protection
- 12Chapter 11 Rate Limiting and Rate Shaping
- Chapter 12 DHCP
15About This Document
- Audience
- Supported hardware and software
- Brocade ICX 6650 slot and port numbering
- 16How this document is organized
- 17Document conventions
  - Text formatting
  - Command syntax conventions
  - Notes, cautions, and warnings
- 18Notice to the reader
- Related publications
- 19Additional information
  - Brocade resources
  - Other industry resources
- Getting technical help
21Security Access
- Securing access methods
  - TABLE 1
  - - TABLE 2
      - Securing access methods
    - 22TABLE 2
      - Ways to secure the access method
      - Access method How the access method is secured by default
- 23Remote access to management function restrictions
  - ACL usage to restrict remote access
    - - TABLE 2
    - 24Using an ACL to restrict Telnet access
    - Using an ACL to restrict SSH access
    - Using ACLs to restrict SNMP access
  - 25Defining the console idle time
  - 26Remote access restrictions
    - Restricting Telnet access to a specific IP address
    - Restricting SSH access to a specific IP address
    - Restricting SNMP access to a specific IP address
    - Restricting all remote management access to a specific IP address
  - 27Restricting access to the device based on IP or MAC address
    - Restricting Telnet connection
    - Restricting SSH connection
    - Restricting HTTP and HTTPS connection
  - 28Defining the Telnet idle time
  - Changing the login timeout period for Telnet sessions
  - 29Specifying the maximum number of login attempts for Telnet access
  - Changing the login timeout period for Telnet sessions
  - Restricting remote access to the device to specific VLAN IDs
    - Restricting Telnet access to a specific VLAN
    - Restricting SNMP access to a specific VLAN
    - Restricting TFTP access to a specific VLAN
  - 30Designated VLAN for Telnet management sessions to a Layer 2 switch
  - 31Device management security
    - Allowing SSHv2 access to the Brocade device
    - Allowing SNMP access to the Brocade device
  - 32Disabling specific access methods
    - Disabling Telnet access
    - Disabling SNMP access
    - Disabling TFTP access
- 33Passwords used to secure access
  - Setting a Telnet password
    - Suppressing Telnet connection rejection messages
  - 34Setting passwords for management privilege levels
    - 35Augmenting management privilege levels
  - 36Recovering from a lost password
  - Displaying the SNMP community string
  - Specifying a minimum password length
- 37Local user accounts
  - -
  - -
  - Enhancements to username and password
    - 38Enabling enhanced user password combination requirements
    - 39Enabling user password masking
    - Enabling user password aging
    - 40Configuring password history
    - Enhanced login lockout
    - Setting passwords to expire
    - Requirement to accept the message of the day
  - 41Local user account configuration
    - 42Local user accounts with no passwords
    - Local user accounts with unencrypted passwords
    - Local accounts with encrypted passwords
  - 43Creating a password option
  - Changing a local user password
- 44TACACS and TACACS+ security
  - How TACACS+ differs from TACACS
  - 45TACACS/TACACS+ authentication, authorization, and accounting
    - Configuring TACACS/TACACS+ for devices in a Brocade IronStack
      - TACACS and TACACS+ security kill console Syntax: kill console [all | unit]
      - 46
        Use the show who and the show telnet commands to confirm the status of console sessions.
  - 47TACACS authentication
    - TACACS+ authentication
    - 48TACACS+ authorization
    - TACACS+ accounting
      - TACACS and TACACS+ security
    - 49AAA operations for TACACS/TACACS+
    - AAA security for commands pasted into the running-config
      - TABLE 3
        User action Applicable AAA operations
        [no] aaa accounting system default
  - 50TACACS/TACACS+ configuration considerations
    - Configuring TACACS
    - Configuring TACACS+
  - 51Enabling TACACS
  - Identifying the TACACS/TACACS+ servers
  - 52Specifying different servers for individual AAA functions
  - Setting optional TACACS and TACACS+ parameters
    - 53Setting the TACACS+ key
    - Setting the retransmission limit
    - Setting the timeout parameter
  - 54Configuring authentication-method lists for TACACS and TACACS+
    - TABLE 4
    - 55Entering privileged EXEC mode after a Telnet or SSH login
    - Configuring enable authentication to prompt for password only
    - Telnet and SSH prompts when the TACACS+ server is unavailable
      - TABLE 4
  - 56Configuring TACACS+ authorization
    - Configuring EXEC authorization
      - 57TABLE 5
    - 58Configuring command authorization
  - 59TACACS+ accounting configuration
    - Configuring TACACS+ accounting for Telnet/SSH (Shell) access
    - Configuring TACACS+ accounting for CLI commands
    - Configuring TACACS+ accounting for system events
  - 60Configuring an interface as the source for all TACACS and TACACS+ packets
  - Displaying TACACS/TACACS+ statistics and configuration information
- 61RADIUS security
  - RADIUS authentication, authorization, and accounting
    - RADIUS authentication
    - 62RADIUS authorization
    - RADIUS accounting
    - 63AAA operations for RADIUS
      - TABLE 7
    - AAA security for commands pasted Into the running-config
  - 64RADIUS configuration considerations
    - - TABLE 7
  - 65Configuring RADIUS
  - Brocade-specific attributes on the RADIUS server
    - - RADIUS security
      - TABLE 8
        Attribute name Attribute ID Data type Description
    - 66
  - 67Enabling SNMP to configure RADIUS
  - Identifying the RADIUS server to the Brocade device
    - TABLE 8
  - 68Specifying different servers for individual AAA functions
  - RADIUS server per port
    - RADIUS server per port configuration notes
    - RADIUS configuration example and command syntax
  - 69RADIUS server to individual ports mapping
    - RADIUS server-to-ports configuration notes
    - RADIUS server-to-ports configuration example and command syntax
  - 70RADIUS parameters
    - Setting the RADIUS key
    - Setting the retransmission limit
    - Setting the timeout parameter
    - Setting RADIUS over IPv6
  - 71Setting authentication-method lists for RADIUS
    - 72TABLE 9
    - Entering privileged EXEC mode after a Telnet or SSH login
    - Configuring enable authentication to prompt for password only
  - 73RADIUS authorization
    - Configuring EXEC authorization
    - 74Configuring command authorization
    - Command authorization and accounting for console commands
  - 75RADIUS accounting
    - Configuring RADIUS accounting for Telnet/SSH (Shell) access
    - Configuring RADIUS accounting for CLI commands
    - Configuring RADIUS accounting for system events
  - 76Configuring an interface as the source for all RADIUS packets
  - Displaying RADIUS configuration information
- 78Authentication-method lists
  - Examples of authentication-method lists
    - 79
- 80TCP Flags - edge port security
83SSH2 and SCP
- SSH version 2 overview
  - - TABLE 12
  - 84Tested SSH2 clients
  - SSH2 supported features
  - SSH2 unsupported features
- 85SSH2 authentication types
  - Configuring SSH2
  - Enabling and disabling SSH by generating and deleting host keys
    - 86Setting the CPU priority for key generation
    - Generating and deleting a DSA key pair
    - Generating and deleting an RSA key pair
    - Deleting DSA and RSA key pairs
    - Providing the public key to clients
  - 87Configuring DSA or RSA challenge-response authentication
    - 88Importing authorized public keys into the Brocade device
    - Enabling DSA or RSA challenge-response authentication
- 89Optional SSH parameters
  - 90Setting the number of SSH authentication retries
  - Deactivating user authentication
  - 91Enabling empty password logins
  - Setting the SSH port number
  - Setting the SSH login timeout value
  - Designating an interface as the source for all SSH packets
  - Configuring the maximum idle time for SSH sessions
- 92Filtering SSH access using ACLs
- Terminating an active SSH connection
- Displaying SSH information
  - Displaying SSH connection information
  - 93Displaying SSH configuration information
    - To display SSH configuration information, use the show ip ssh config command:
    - Syntax: show ip ssh config This display shows the following information.
    - TABLE 13
    - TABLE 14
      - Displaying SSH information
  - 94Displaying additional SSH connection information
    - show who [begin expression | exclude expression | include expression]
    - The show who command also displays information about SSH connections:
    - - TABLE 14
- 95Secure copy with SSH2
  - Enabling and disabling SCP
  - Secure copy configuration notes
  - Example file transfers using SCP
    - Copying a file to the running configuration
    - 96Copying a file to the startup configuration
    - Copying the running config uration file to an SCP-enabled client
    - Copying the startup configuration file to an SCP-enabled client
    - Copying a software image file to flash memory
    - Copying a software image file from flash memory
    - 97Importing a digital certificate using SCP
    - Importing an RSA private key
    - Importing a DSA or RSA public key
- 98SSH2 client
  - Enabling SSH2 client
  - Configuring SSH2 client public key authentication
    - Generating and deleting a client DSA key pair
    - Generating and deleting a client RSA key pair
    - Exporting client public keys
  - 99Using SSH2 client
  - 100Displaying SSH2 client information
101Rule-Based IP ACLs
- TABLE 15
- TABLE 16
- 102ACL overview
  - - TABLE 16
  - 103Types of IP ACLs
  - ACL IDs and entries
  - Numbered and named ACLs
  - Default ACL action
- 104How hardware-based ACLs work
  - How fragmented packets are processed
  - Hardware aging of Layer 4 CAM entries
- 105ACL configuration considerations
- 106Configuring standard numbered ACLs
  - Standard numbered ACL syntax
  - Configuration example for standard numbered ACLs
- 107Standard named ACL configuration
  - 108Standard named ACL syntax
  - Configuration example for standard named ACLs
- 110Extended numbered ACL configuration
  - 111Extended numbered ACL syntax
    - 114
    - -
  - 115Configuration examples for extended numbered ACLs
- 116Extended named ACL configuration
- 121Applying egress ACLs to Control (CPU) traffic
- Preserving user input for ACL TCP/UDP port numbers
- 122ACL comment text management
  - Adding a comment to an entry in a numbered ACL
  - 123Adding a comment to an entry in a named ACL
  - Deleting a comment from an ACL entry
  - Viewing comments in an ACL
- 124Applying an ACL to a virtual interface in a protocol- or subnet-based VLAN
- 125ACL logging
  - Configuration notes for ACL logging
  - 126Configuration tasks for ACL logging
  - Example ACL logging configuration
  - 127Displaying ACL Log Entries
- 128Enabling strict control of ACL filtering of fragmented packets
- 129Enabling ACL support for switched traffic in the router image
- Enabling ACL filtering based on VLAN membership or VE port membership
  - Configuration notes for ACL filtering
  - 130Applying an IPv4 ACL to specific VLAN members on a port (Layer 2 devices only)
  - Applying an IPv4 ACL to a subset of ports on a virtual interface (Layer 3 devices only)
- 131ACLs to filter ARP packets
  - 132Configuration considerations for filtering ARP packets
  - Configuring ACLs for ARP filtering
  - Displaying ACL filters for ARP
  - Clearing the filter count
- 133Filtering on IP precedence and ToS values
  - TCP flags - edge port security
- 134QoS options for IP ACLs
  - 135Configuration notes for QoS options on Brocade ICX 6650
  - Using an IP ACL to mark DSCP values (DSCP marking)
    - 136Combined ACL for 802.1p marking
    - Using an ACL to change the forwarding queue
  - DSCP matching
- 137ACL-based rate limiting
- 138ACL statistics
- ACLs to control multicast features
- Enabling and viewing hardware usage statistics for an ACL
- 139Displaying ACL information
- Troubleshooting ACLs
- Policy Based Routing
  - 140Configuration considerations for policy-based routing
  - Configuring a PBR policy
  - 141Configuring the ACLs
  - 142Configuring the route map
  - 143Enabling PBR
  - 144Configuration examples for PBR
    - Basic example of PBR
  - Setting the next hop
  - 145Setting the output interface to the null interface
  - 146Trunk formation with PBR policy
147IPv6 ACLs
- IPv6 ACL overview
  - - TABLE 17
  - IPv6 ACL traffic filtering criteria
  - IPv6 protocol names and numbers
- 148IPv6 ACL configuration notes
- 149Configuring an IPv6 ACL
  - Example IPv6 configurations
  - 151Default and implicit IPv6 ACL action
- 152Creating an IPv6 ACL
  - Syntax for creating an IPv6 ACL
    - For IPv6 and supported protocols other than ICMP, TCP, or UDP
    - 153For ICMP
    - For TCP
    - For UDP
      - Creating an IPv6 ACL Table 1 8 lists the syntax elements.
      - 154TABLE 18
        IPv6 ACL arguments Description
        Creating an IPv6 ACL
      - 155
        TABLE 18
        IPv6 ACL arguments Description
    - 156ICMP message configurations
- 157Enabling IPv6 on an interface to which an ACL will be applied
- Applying an IPv6 ACL to an interface
  - Syntax for applying an IPv6 ACL
  - Applying an IPv6 ACL to a trunk group
  - Applying an IPv6 ACL to a virtual interface in a protocol-based or subnet-based VLAN
- 158Adding a comment to an IPv6 ACL entry
- 159Deleting a comment from an IPv6 ACL entry
- Support for ACL logging
- Displaying IPv6 ACLs
  - 160Displaying IPv6 ACLs
161ACL-based Rate Limiting
- ACL-based rate limiting overview
  - Types of ACL-based rate limiting
    - - TABLE 19
- 162Traffic policies overview
  - Traffic policy structure
    - - -
    - ACL statistics
  - Configuration notes for traffic policies
- 163Configuring fixed rate limiting
- 164Configuring adaptive rate limiting
  - 165Marking Class of Service parameters in adaptive rate limiting
    - TABLE 20
    - TABLE 21
    - 166Inspecting the 802.1p bit in the ACL for adaptive rate limiting
- 167Handling packets that exceed the rate limit
  - Dropping packets
  - Permitting packets at low priority
- 168Enabling and using ACL statistics
  - 169Enabling ACL statistics
  - 170Enabling ACL statistics with rate limiting traffic policies
  - Viewing ACL and rate limit counters
  - 171Clearing ACL and rate limit counters
    - TABLE 22
- 172Viewing traffic policies
  - TABLE 23
173802.1X Port Security
- IETF RFC support
  - - TABLE 24
- 174How 802.1X port security works
  - Device roles in an 802.1X configuration
    - FIGURE 1
  - 175Communication between the devices
    - FIGURE 2
  - Controlled and uncontrolled ports
    - 176FIGURE 3
  - 177Message exchange during authentication
    - FIGURE 4
    - 178Setting the IP MTU size
    - EAP pass-through support
    - Support for RADIUS user-name attribute in access-accept messages
  - 179Authenticating multiple hosts connected to the same port
    - TABLE 25
    - FIGURE 5
    - 180How 802.1X multiple-host authentication works
      - 181
      - -
      - -
      - - -
    - Configurable hardware aging period for denied client dot1x-mac-sessions
  - 182802.1X port security and sFlow
  - 802.1X accounting
- 183802.1X port security configuration
  - 184Configuring an authentication method list for 802.1X
  - Setting RADIUS parameters
    - Supported RADIUS attributes
    - 185Specifying the RADIUS timeout action
    - Allow user access to a restricted VLAN after a RADIUS timeout
  - 186Dynamic VLAN assignment for 802.1X port configuration
    - 187Automatic removal of dynamic VLAN assignments for 802.1X ports
      - TABLE 26
    - 188Dynamic multiple VLAN assignment for 802.1X ports
    - 189Saving dynamic VLAN assignments to the running-config file
    - Considerations for dynamic VLAN assignment in an 802.1X multiple-host configuration
  - 190Dynamically applying IP ACLs and MAC address filters to 802.1X ports
    - Configuration considerations for applying IP ACLs and MAC address filters to 802.1x ports
    - 191Disabling and enabling strict security mode for dynamic filter assignment
    - Disabled strict security mode
    - Disabling strict security mode globally
    - 192Dynamically applying existing ACLs or MAC address filters
      - TABLE 27
      - TABLE 28
    - 193Notes for dynamically applying ACLs or MAC address filters
    - Configuring per-user IP ACLs or MAC address filters
      - TABLE 29
      - TABLE 30
  - 194Enabling 802.1X port security
  - Setting the port control
  - 195Configuring periodic re-authentication
  - 196Re-authenticating a port manually
  - Setting the quiet period
  - Setting the wait interval for EAP frame retransmissions
  - Setting the maximum number of EAP frame retransmissions
  - 197Wait interval and number of EAP-request/ identity frame retransmissions from the RADIUS server
    - Setting the wait interval for EAP frame retransmissions
    - Setting the maximum number of EAP frame retransmissions
  - 198Specifying a timeout for retransmission of messages to the authentication server
  - Initializing 802.1X on a port
  - 199Allowing access to multiple hosts
    - Configuring 802.1X multiple-host authentication
  - MAC address filters for EAP frames
    - Creating MAC address filters for EAP on most devices
  - Configuring VLAN access for non-EAP-capable clients
- 202802.1X accounting configuration
  - 203802.1X accounting attributes for RADIUS
  - Enabling 802.1X accounting
    - TABLE 31
- 204Displaying 802.1X information
  - Displaying 802.1X configuration information
    - TABLE 32
      - Syntax: show dot1x config ethernet port
    - 205TABLE 32
    - 206TABLE 33
  - 207Displaying 802.1X statistics
    - To display 802.1X statistics for an individual port, enter the show dot1x statistics command.
    - Syntax: show dot1x statistics ethernet port
    - TABLE 34
      - Field Statistics
  - 208Clearing 802.1X statistics
  - Displaying dynamically assigned VLAN information
  - 209Displaying information about dynamically applied MAC address filters and IP ACLs
    - Displaying user-defined MAC address filters and IP ACLs
    - Displaying dynamically applied MAC address filters and IP ACLs
    - 210Displaying the status of strict security mode
  - 211Displaying 802.1X multiple-host authentication information
    - 212Displaying 802.1X multiple-host configuration information
      - TABLE 35
        Syntax: show dot1x config ethernet port
        The following table lists the fields in the display.
    - 213 Displaying information about the dot1x MAC sessions on each port
      - TABLE 36
        Example
        Syntax: show dot1x mac-session Table 37 lists the new fields in the display.
      - 214TABLE 37
    - 215Displaying information about the ports in an 802.1X multiple-host configuration
      - TABLE 38
- 216Sample 802.1X configurations
  - Point-to-point configuration
    - FIGURE 6
    - Same point-to-point 802.1x configuration
  - 217Hub configuration
    - FIGURE 7
    - Sample 802.1x configuration using a hub
  - 218802.1X authentication with dynamic VLAN assignment
    - FIGURE 8
- 219Multi-device port authentication and 802.1X security on the same port
221MAC Port Security
- TABLE 39
- 222MAC port security overview
  - Local and global resources used for MAC port security
  - Configuration notes and feature limitations for MAC port security
- 223MAC port security configuration
  - Enabling the MAC port security feature
  - 224Setting the maximum number of secure MAC addresses for an interface
  - Setting the port security age timer
  - 225Specifying secure MAC addresses
    - On an untagged interface
    - On a tagged interface
  - Autosaving secure MAC addresses to the startup configuration
  - 226Specifying the action taken when a security violation occurs
    - Dropping packets from a violating address
    - Disabling the port for a specified amount of time
- 227Clearing port security statistics
  - Clearing restricted MAC addresses
  - Clearing violation statistics
- 228Displaying port security information
  - Displaying port security settings
  - Displaying the secure MAC addresses
    - TABLE 40
  - 229Displaying port security statistics
    - TABLE 41
    - TABLE 42
  - 230Displaying restricted MAC addresses on a port
    - TABLE 43
231MAC-based VLANs
- MAC-based VLAN overview
  - Static and dynamic hosts
    - TABLE 44
  - 232MAC-based VLAN feature structure
    - Source MAC address authentication
    - Policy-based classification and forwarding
    - MAC-based VLAN and port up or down events
- 233Dynamic MAC-based VLAN
  - Configuration notes and feature limitations for dynamic MAC-based VLAN
  - Dynamic MAC-based VLAN CLI commands
    - Dynamic MAC-based VLAN
  - 234Dynamic MAC-based VLAN configuration example
    - The following example shows a MAC-based VLAN configuration.
    - TABLE 45
      - CLI command Description CLI level
- 235MAC-based VLAN configuration
  - 236Using MAC-based VLANs and 802.1X security on the same port
  - Configuring generic and Brocade vendor-specific attributes on the RADIUS server
    - TABLE 46
  - 237Aging for MAC-based VLAN
    - For permitted hosts
    - For blocked hosts
      - TABLE 47
    - For MAC-based dynamic activation
    - To change the length of the software aging period
  - 238Disabling aging for MAC-based VLAN sessions
    - Globally disabling aging
    - Disabling the aging on interfaces
  - 239Configuring the maximum MAC addresses per port
  - Configuring a MAC-based VLAN for a static host
  - 240Configuring MAC-based VLAN for a dynamic host
  - Configuring dynamic MAC-based VLAN
- 241Configuring MAC-based VLANs using SNMP
- Displaying information about MAC-based VLANs
  - Displaying the MAC-VLAN table
    - TABLE 48
  - 242Displaying the MAC-VLAN table for a specific MAC address
  - Displaying allowed MAC addresses
    - TABLE 49
    - TABLE 50
  - 243Displaying denied MAC addresses
    - TABLE 51
    - TABLE 50
  - 244Displaying detailed MAC-VLAN data
  - 245Displaying MAC-VLAN information for a specific interface
    - The following table describes the information in this output.
    - TABLE 52
  - 246Displaying MAC addresses in a MAC-based VLAN
    - Enter the show mac-address command to display a list of MAC addresses in a MAC-based VLAN.
    - TABLE 53
    - TABLE 52
  - Displaying MAC-based VLAN logging
- 247Clearing MAC-VLAN information
- Sample MAC-based VLAN application
  - Sample MAC-based VLAN application
  - 248FIGURE 9
    - 249Sample MAC-based VLAN application
    - The show table-mac-vlan command returns the following results for all ports in this configuration.
251Multi-Device Port Authentication
- How multi-device port authentication works
  - TABLE 54
  - 252RADIUS authentication
  - Authentication-failure actions
  - Supported RADIUS attributes
  - 253Support for dynamic VLAN assignment
  - Support for dynamic ACLs
  - Support for authenticating multiple MAC addresses on an interface
  - Support for dynamic ARP inspection with dynamic ACLs
  - Support for DHCP snooping with dynamic ACLs
  - Support for source guard protection
- 254Multi-device port authentication and 802.1X security on the same port
  - 255Configuring Brocade-specific attributes on the RADIUS server
- 256Multi-device port authentication configuration
  - - TABLE 55
  - 257Enabling multi-device port authentication
    - Globally enabling multi-device port authentication
    - Enabling multi-device port authentication on an interface
  - 258Specifying the format of the MAC addresses sent to the RADIUS server
  - Specifying the authentication-failure action
  - 259Generating traps for multi-device port authentication
  - Defining MAC address filters
  - Configuring dynamic VLAN assignment
    - 260Configuring a port to remain in the restricted VLAN after a successful authentication attempt
    - Configuration notes for configuring a port to remain in the restricted VLAN
    - 261Configuring the RADIUS server to support dynamic VLAN assignment
    - Enabling dynamic VLAN support for tagged packets on non-member VLAN ports
      - TABLE 56
    - 262Specifying to which VLAN a port is moved after its RADIUS-specified VLAN assignment expires
    - Automatic removal of dynamic VLAN assignments for MAC authenticated ports
    - Saving dynamic VLAN assignments to the running-config file
  - 263Dynamically applying IP ACLs to authenticated MAC addresses
    - 264Multi-device port authentication with dynamic IP ACLs and ACL-per-port-per-VLAN
    - Configuration considerations and guidelines for multi-device port authentication
      - - - - - -
    - Configuring the RADIUS server to support dynamic IP ACLs
  - 265Enabling denial of service attack protection
    - TABLE 57
    - TABLE 58
  - 266Enabling source guard protection
    - Viewing the assigned ACL for ports on which source guard protection is enabled
  - 267Clearing authenticated MAC addresses
  - 268Disabling aging for authenticated MAC addresses
    - Globally disabling aging of MAC addresses
    - Disabling the aging of MAC addresses on interfaces
  - 269Changing the hardware aging period for blocked MAC addresses
  - 270Specifying the aging time for blocked MAC addresses
  - Specifying the RADIUS timeout action
    - Permit user access to the network after a RADIUS timeout
    - Deny user access to the network after a RADIUS timeout
    - Allow user access to a restricted VLAN after a RADIUS timeout
  - 271Multi-device port authentication password override
  - Limiting the number of authenticated MAC addresses
- 272Displaying multi-device port authentication information
  - Displaying authenticated MAC address information
  - 273Displaying multi-device port authentication configuration information
    - TABLE 59
  - 274Displaying multi-device port authentication information for a specific MAC address or port
    - TABLE 60
    - TABLE 61
  - 275Displaying the authenticated MAC addresses
    - TABLE 61
  - 276Displaying the non-authenticated MAC addresses
  - Displaying multi-device port authentication information for a port
    - TABLE 62
  - 277Displaying multi-device port authentication settings and authenticated MAC addresses
    - TABLE 62
      - Displaying multi-device port authentication information
    - 278TABLE 63
      - 279Displaying multi-device port authentication information
- 280Example port authentication configurations
  - Multi-device port authentication with dynamic VLAN assignment
    - TABLE 63
    - 281FIGURE 10
    - 282Example 1 Multi-device port authentication with dynamic VLAN assignment
      - FIGURE 11
  - 283Example 1 Multi-device port authentication and 802.1x authentication on the same port
    - 284FIGURE 12
  - 285Example 2 Creating a profile on the RADIUS server for each MAC address
    - FIGURE 13
287DoS Attack Protection
- Smurf attacks
  - FIGURE 14
  - TABLE 64
  - 288Avoiding being an intermediary in a Smurf attack
  - Avoiding being a victim in a Smurf attack
- 289TCP SYN attacks
  - 290TCP security enhancement
    - Protecting against a blind TCP reset attack using the RST bit
    - Protecting against a blind TCP reset attack using the SYN bit
    - Protecting against a blind injection attack
  - 291Displaying statistics about packets dropped because of DoS attacks
293Rate Limiting and Rate Shaping
- Port-based rate limiting
  - TABLE 65
  - 294How port-based fixed rate limiting works
    - FIGURE 15
  - Rate limiting in hardware
  - 295Configuration notes for port-based fixed rate limiting
  - Configuring a port-based fixed rate limiting policy
  - Displaying the port-based fixed rate limiting configuration
    - TABLE 66
- 296Rate shaping
  - Configuration notes for rate shaping
  - Configuring outbound rate shaping for a port
    - TABLE 67
  - Configuring outbound rate shaping for a specific priority
  - Configuring outbound rate shaping for a trunk port
  - Displaying rate shaping configurations
- 297CPU rate-limiting
  - 298TABLE 68
299DHCP
- Dynamic ARP inspection
  - ARP poisoning
    - TABLE 69
  - 300Dynamic ARP Inspection
    - - FIGURE 16
    - ARP entries
  - 301Configuration notes and feature limitations for DAI
  - 302Dynamic ARP inspection configuration
    - Configuring an inspection ARP entry
    - Enabling DAI on a VLAN
      - TABLE 70
    - Enabling trust on a port
  - Displaying ARP inspection status and ports
  - Displaying the ARP table
- 303DHCP snooping
  - 304How DHCP snooping works
    - FIGURE 17
    - FIGURE 18
    - DHCP binding database
    - Client IP-to-MAC address mappings
  - 305System reboot and the binding database
  - Configuration notes and feature limitations for DHCP snooping
  - Configuring DHCP snooping
    - 306Enabling DHCP snooping on a VLAN
    - Enabling trust on a port
    - Disabling the learning of DHCP clients on a port
      - TABLE 71
  - 307Clearing the DHCP binding database
  - Displaying DHCP snooping status and ports
  - Displaying the DHCP snooping binding database
  - Displaying DHCP binding entry and status
  - DHCP snooping configuration example
- 308DHCP relay agent information
  - - FIGURE 19
    - FIGURE 20
  - 309Configuration notes for DHCP option 82
  - DHCP option 82 sub-options
    - +
    - 310Sub-option 1 Circuit ID
      - FIGURE 21
    - Sub-option 2 Remote ID
      - FIGURE 22
    - Sub-option 6 - Subscriber ID
      - FIGURE 23
  - 311DHCP option 82 configuration
    - Disabling and re-enabling DHCP option 82 processing on an individual interface
    - 312Changing the forwarding policy
    - Enabling and disabling subscriber ID processing
  - 313Viewing information about DHCP option 82 processing
    - Viewing the circuit ID, remote ID, and forwarding policy
    - Viewing the ports on which DHCP option 82 is disabled
      - TABLE 72
      - TABLE 73
    - Viewing the status of DHCP option 82 and the subscriber ID
- 314IP source guard
  - TABLE 73
  - 315Configuration notes and feature limitations for IP source guard
  - 316Enabling IP source guard on a port
  - Defining static IP source bindings
  - 317Enabling IP source guard per-port-per-VLAN
  - Enabling IP source guard on a VE
  - Displaying learned IP addresses
319Limiting Broadcast, Multicast, and Unknown Unicast Traffic
- Broadcast, unknown Unicast, and Multicast rate limiting
  - Configuring rate limiting for BUM traffic
  - 320Viewing rate limits set on BUM traffic
    - 321Broadcast, unknown Unicast, and Multicast rate limiting
    - Syntax: show rate-limit broadcast
      - Example
323Index
- Numerics
- A
- 324B
- C
- 325D
- 326F
- G
- I
- 327L
- M
- 328P
- Q
- R
- 329S
- 330T
- U
- 331V

330 pages2.86 Mb

2Brocade Communications Systems, Incorporated
Document History
- Brocade ICX 6650 Administration Guide 53-1002600-01 New document September 2012
- Title Publication number Summary of changes Date
3Contents
- About This Document
- Chapter 1 Management Applications
- Chapter 2 Basic Software Features
- 4Chapter 3 Operations, Administration, and Maintenance
- 5Chapter 4 Ports on Demand Licensing
- 6Chapter 5 IPv6 Configuration on Brocade ICX 6650 Switch
- 7Chapter 6 SNMP Access
- 8Chapter 7 Foundry Discovery Protocol (FDP) and Cisco Discovery Protocol (CDP) Packets
- Chapter 8 LLDP and LLDP-MED
- 9Chapter 9 Hardware Component Monitoring
- Chapter 10 Syslog
- 10Chapter 11 Network Monitoring
13About This Document
- Audience
- Supported hardware and software
- Brocade ICX 6650 slot and port numbering
- 14Document conventions
  - Text formatting
  - Command syntax conventions
  - Notes, cautions, and warnings
    - ATTENTION
- 15Notice to the reader
- 16Related publications
- Additional information
  - Brocade resources
  - Other industry resources
- 17Getting technical help
- Document feedback
19Management Applications
- Management port overview
  - How the management port works
  - 20CLI Commands for use with the management port
- 21Logging on through the CLI
  - 22Online help
  - Command completion
  - Scroll control
  - Line editing commands
- 23Using slot number, and port number with CLI commands
  - TABLE 2
  - 24CLI nomenclature on Brocade ICX 6650 models
  - Searching and filtering output from CLI commands
    - Searching and filtering output from Show commands
    - 25Searching and filtering output at the --More-- prompt
  - 26Using special characters in regular expressions
    - TABLE 3
      - Using slot number, and port number with CLI commands 1
    - 27
    - - TABLE 3
        Character Operation
  - 28Creating an alias for a CLI command
    - Configuration notes for creating a command alias
31Basic Software Features
- - TABLE 4
    - Feature Brocade ICX 6650 Basic System Parameters
    - Basic Port Parameters
- 32Basic system parameter configuration
  - - TABLE 4
  - 33Entering system administration information
  - SNMP parameter configuration
    - Specifying an SNMP trap receiver
    - 34Specifying a single trap source
    - 35Setting the SNMP trap holddown time
    - Disabling SNMP traps
  - 36Displaying virtual routing interface statistics
  - Disabling Syslog messages and traps for CLI access
    - 37
  - Cancelling an outbound Telnet session
- 38Specifying an SNTP server
  - 39TABLE 5
    - Specifying an SNTP server
    - To display detailed information about SNTP associations, enter the show sntp associations details
  - 40TABLE 6
- 41Configuring the device as an SNTP server
  - TABLE 7
  - 42
  - 43Displaying SNTP server information
  - Enabling broadcast mode for an SNTP client
    - TABLE 8
  - 44Setting the system clock
    - 45New start and end dates for US daylight saving time
  - 46Limiting broadcast, multicast, and unknown unicast traffic
  - CLI banner configuration
    - Setting a message of the day banner
    - 47Requiring users to press the Enter key after the message of the day banner
    - Setting a privileged EXEC CLI level banner
    - Displaying a console message when an incoming Telnet session is detected
  - 48Local MAC address for Layer 2 management traffic
- 49Basic port parameter configuration
  - Assigning a port name
  - 50Port speed and duplex mode modification
    - Port speed and duplex mode configuration syntax
  - 51Downgrading the Brocade ICX 6650 front panel ports from 10 GbE to 1 GbE port speed
  - Enabling auto-negotiation maximum port speed advertisement and down-shift
    - Maximum port speed application notes
  - 52Modifying port duplex mode
    - Port duplex mode configuration syntax
  - 53Disabling or re-enabling a port
  - Flow control configuration
    - Flow control configuration notes
    - Disabling or re-enabling flow control
    - 54Negotiation and advertisement of flow control
    - Displaying flow-control status
  - 55Symmetric flow control on Brocade ICX 6650 devices
    - 56About XON and XOFF thresholds
    - Configuration notes and feature limitations for symmetric flow control
      - - -
      - -
        TABLE 9
    - Enabling and disabling symmetric flow control
  - 57Interpacket Gap (IPG) on a Brocade ICX 6650
  - switch
    - IPG configuration notes
  - Changing the Gbps fiber negotiation mode
  - 58Port priority (QoS) modification
  - Port flap dampening configuration
    - Port flap dampening configuration notes
    - 59Configuring port flap dampening on an interface
    - Configuring port flap dampening on a trunk
    - Re-enabling a port disabled by port flap dampening
    - Displaying ports configured with port flap dampening
      - Basic port parameter configuration
      - Table 10 defines the port flap dampening statistics displayed by the show link-error-disable all
      - Syntax: show link-error-disable [all]
    - 60Syslog messages for port flap dampening
      - The following Syslog messages are generated for port flap dampening.
      - down to up has been exceeded, the following Syslog message is displayed.
      - is displayed.
        TABLE 10
        Column Description
  - 61Port loop detection
    - Types of loop detection
    - Recovering disabled ports
    - Port loopback detection configuration notes
    - 62Enabling loop detection
    - Configuring a global loop detection interval
    - Configuring the device to automatically re-enable ports
    - 63Specifying the recovery time interval
    - Clearing loop-detection
    - Displaying loop-detection information
    - 64Displaying loop detection resource information
      - TABLE 11
        Basic port parameter configuration 2
    - 65Displaying loop detection configuration status on an interface
      - The Errdisable function logs a message whenever it re-enables a port.
    - Syslog message due to disabled port in loop detection
      - TABLE 11
67Operations, Administration, and Maintenance
- 68OAM Overview
- Software versions installed and running on a device
  - Determining the flash image version running on the device
    - Brocade ICX 6650 devices
  - 69Displaying the boot image version running on the device
  - Displaying the image versions installed in flash memory
  - 70Flash image verification
    - Flash image CLI commands
- 71Image file types
- Software upgrades
- Viewing the contents of flash files
  - TABLE 13
    - Using SNMP to upgrade software
- 72Using SNMP to upgrade software
- 74Software reboot
  - Software boot configuration notes
- Displaying the boot preference
- 75Loading and saving configuration files
  - saved in flash. To display this file, enter the show configuration command at any CLI prompt.
  - 76Replacing the startup configuration with the running configuration
  - Replacing the running configuration with the startup configuration
  - Logging changes to the startup-config file
  - 77Copying a configuration file to or from a TFTP server
  - Dynamic configuration loading
    - Dynamic configuration usage considerations
    - Preparing the configuration file
    - Loading the configuration information into the running-config
  - 79Maximum file sizes for startup-config file and running-config
- 80Loading and saving configuration files with IPv6
  - Using the IPv6 copy command
    - Copying a file to an IPv6 TFTP server
    - Copying a file from flash memory
    - Copying a file from the running or startup configuration
  - 81Copying a file from an IPv6 TFTP server
    - Copying a file to flash memory
    - Copying a file to the running or startup configuration
  - 82IPv6 ncopy command
    - Copying a primary or secondary boot Image from flash memory to an IPv6 TFTP server
    - Copying the running or startup configuration to an IPv6 TFTP server
  - 83IPv6 TFTP server file upload
    - Uploading a primary or secondary boot image from an IPv6 TFTP server
    - Uploading a running or startup configuration from an IPv6 TFTP server
  - 84Using SNMP to save and load configuration information
  - Erasing image and configuration files
- 85System reload scheduling
  - Reloading at a specific time
  - Reloading after a specific amount of time
  - Displaying the amount of time remaining before a scheduled reload
  - Canceling a scheduled reload
- 86Diagnostic error codes and remedies for TFTP transfers
- 87Network connectivity testing
  - Pinging an IPv4 address
  - 89Tracing an IPv4 route
91Ports on Demand Licensing
- Ports on Demand Overview
- 92Ports on Demand terminology
  - -
- PoD licensing rules
- PoD licensing configuration tasks
  - 93Obtaining a PoD license
    - TABLE 15
    - 97
      - FIGURE 4
- 98Viewing PoD licensing information from the Brocade software portal
- 100Transferring a PoD license
- Syslog message information
- Ports on Demand Licensing
  - Front panel PoD
    - - TABLE 16
      - FIGURE 7
  - 101Rear panel Flexible Ports on Demand
    - - FIGURE 8
  - PoD licenses
    - Ports on Demand Licensing
    - Trial licenses are not available for PoD licensing.
  - 102Enabling ports on the front panel
    - TABLE 17
      - License SKU License Name Function
  - 104Deleting a ICX6650-10G-LIC-POD license
  - 105Enabling ports on the rear panel
  - 107Disabling the FPoD ports on the rear panel
    - Ports on Demand Licensing
    - Syntax: show pod
  - 108Deleting a 10 GbE or 40 GbE license
- 109Viewing information about PoD licenses
  - Viewing the LID and the software packages installed in the device
    - Viewing information about PoD licenses
  - 110Displaying general license information for PoD ports
    - Syntax: show license
    - TABLE 18
    - 111
  - 112Displaying the license configuration for PoD ports for the Brocade ICX 6650
    - TABLE 19
    - - 113Viewing information about PoD licenses 4
      - TABLE 20
  - 114Configuration considerations when configuring PoD for Brocade ICX 6650 devices
    - - - -
      - 115Viewing information about PoD licenses 4
117IPv6 Configuration on Brocade ICX 6650 Switch
- IPv6 Configuration on Brocade ICX 6650 Switch
- this guide:
- 118
  - TABLE 21
    - Feature Brocade ICX 6650
- 119Full Layer 3 IPv6 feature support
- IPv6 addressing overview
  - 120IPv6 address types
    - - IPv6 addressing overview 5
      - TABLE 22
        Address
        Description Address structure
    - 121
  - IPv6 stateless auto-configuration
- 122IPv6 CLI command support
  - TABLE 23
    - IPv6 CLI command support 5
  - 123TABLE 23
    - IPv6 command Description Switch code Router code
- 124IPv6 host address on a Layer 2 switch
  - - TABLE 23
  - 125Configuring a global or site-local IPv6 address with a manually configured interface ID
  - Configuring a link-local IPv6 address as a system-wide address for a switch
- 126Configuring the management port for an IPv6 automatic address configuration
- Configuring basic IPv6 connectivity on a Layer 3 switch
  - Enabling IPv6 routing
  - IPv6 configuration on each router interface
    - 127Configuring a global or site-local IPv6 address on an interface
    - 128Configuring a link-local IPv6 address on an interface
    - Configuring an IPv6 anycast address on an interface
  - 129Configuring IPv4 and IPv6 protocol stacks
- 130IPv6 management on Brocade ICX 6650 devices (IPv6 host support)
  - Configuring IPv6 management ACLs
  - 131Restricting SNMP access to an IPv6 node
  - Specifying an IPv6 SNMP trap receiver
  - Configuring SNMP V3 over IPv6
  - Configuring SNTP over IPv6
  - Secure Shell, SCP, and IPv6
  - 132IPv6 Telnet
    - Establishing a Telnet session from an IPv6 host
  - IPv6 traceroute
  - 133Configuring name-to-IPv6 address resolution using IPv6 DNS resolver
  - Defining an IPv6 DNS entry
  - 134Pinging an IPv6 address
  - 135Configuring an IPv6 Syslog server
  - Viewing IPv6 SNMP server addresses
  - Disabling router advertisement and solicitation messages
  - Disabling IPv6 on a Layer 2 switch
- 136Static IPv6 route configuration
  - 137Configuring a static IPv6 route
    - Static IPv6 route configuration
    - TABLE 24
      - Parameter Configuration details Status
    - 138
- 139IPv6 over IPv4 tunnels
  - FIGURE 10
  - IPv6 over IPv4 tunnel configuration notes
  - Configuring a manual IPv6 tunnel
  - 140Clearing IPv6 tunnel statistics
  - 141Displaying IPv6 tunnel information
    - Displaying a summary of tunnel information
    - Displaying tunnel interface information
      - TABLE 25
      - IPv6 over IPv4 tunnels
    - 142Displaying interface level IPv6 settings
      - TABLE 26
      - IPv6 over IPv4 tunnels 5
        The display command above reflects the following configuration.
        TABLE 27
      - 143
- 144ECMP load sharing for IPv6
  - 145Disabling or re-enabling ECMP load sharing for IPv6
  - Changing the maximum load sharing paths for IPv6
  - Enabling support for network-based ECMP load sharing for IPv6
  - Displaying ECMP load-sharing information for IPv6
- 146IPv6 ICMP feature configuration
  - Configuring ICMP rate limiting
  - Enabling IPv6 ICMP redirect messages
- 147IPv6 neighbor discovery configuration
  - 148IPv6 neighbor discovery configuration notes
  - Neighbor solicitation and advertisement messages
  - 149Router advertisement and solicitation messages
  - Neighbor redirect messages
  - Setting neighbor solicitation parameters for duplicate address detection
  - 150Setting IPv6 router advertisement parameters
  - 152Prefixes advertised in IPv6 router advertisement messages
  - 153Setting flags in IPv6 router advertisement messages
  - Enabling and disabling IPv6 router advertisements
  - Configuring reachable time for remote IPv6 nodes
- 154IPv6 MTU
  - Configuration notes and feature limitations for IPv6 MTU
  - Changing the IPv6 MTU
- 155Static neighbor entries configuration
- 156Limiting the number of hops an IPv6 packet can traverse
- IPv6 source routing security enhancements
- Clearing global IPv6 information
  - 157Clearing the IPv6 cache
  - Clearing IPv6 neighbor information
  - Clearing IPv6 routes from the IPv6 route table
  - Clearing IPv6 traffic statistics
- 158Displaying global IPv6 information
  - Displaying IPv6 cache information
  - 159Displaying IPv6 interface information
    - TABLE 28
    - - 160TABLE 29
      - 161TABLE 30
  - 162Displaying IPv6 neighbor information
    - TABLE 31
  - 163Displaying the IPv6 route table
    - TABLE 31
  - 164Displaying local IPv6 routers
    - TABLE 32
    - - TABLE 33
  - 165Displaying IPv6 TCP information
    - - TABLE 34
        Syntax: show ipv6 tcp connections
      - TABLE 35
    - 166
    - - 167TABLE 35
      - TABLE 36
    - 168
  - 169Displaying IPv6 traffic statistics
    - To display IPv6 traffic statistics, enter the following command at any CLI level.
    - Syntax: show ipv6 traffic This show ipv6 traffic command displays the following information.
      - IPv6 statistics
173SNMP Access
- SNMP overview
- 174SNMP community strings
  - Encryption of SNMP community strings
  - Adding an SNMP community string
    - 175
  - 176Displaying the SNMP community strings
- 177User-based security model
  - Configuring your NMS
  - Configuring SNMP version 3 on Brocade ICX 6650 devices
  - Defining the engine id
  - 178Defining an SNMP group
  - 179Defining an SNMP user account
- 181Defining SNMP views
- 182SNMP version 3 traps
  - Defining an SNMP group and specifying which view is notified of traps
  - 183Defining the UDP port for SNMP v3 traps
  - Trap MIB changes
    - Backward compatibility with SMIv1 trap format
  - 184Specifying an IPv6 host as an SNMP trap receiver
  - SNMP v3 over IPv6
    - Restricting SNMP Access to an IPv6 Node
  - Specifying an IPv6 host as an SNMP trap receiver
  - Viewing IPv6 SNMP server addresses
- 185Displaying SNMP Information
  - Displaying the Engine ID
  - 186Displaying SNMP groups
  - Displaying user information
  - Interpreting varbinds in report packets
    - SNMP v3 configuration examples 6
- 187SNMP v3 configuration examples
  - The following sections present examples of how to configure SNMP v3.
  - Simple SNMP v3 configuration
  - More detailed SNMP v3 configuration
    - Varbind object Identifier Description
189Foundry Discovery Protocol (FDP) and Cisco Discovery Protocol (CDP) Packets
- FDP Overview
  - - TABLE 38
  - 190FDP configuration
    - Enabling FDP globally
    - Enabling FDP at the interface level
    - Specifying the IP management address to advertise
    - Changing the FDP update timer
    - Changing the FDP hold time
  - 191Displaying FDP information
    - Displaying neighbor information
      - FDP Overview
      - To display detailed information, enter the show fdp neighbor detail command.
      - 192TABLE 39
        This line... Displays...
        FDP Overview 7 The show fdp neighbor detail command displays the following information.
    - 193Displaying FDP entries
      - TABLE 40
    - Displaying FDP information for an interface
    - Displaying FDP and CDP statistics
  - 194Clearing FDP and CDP information
    - Clearing FDP and CDP neighbor information
    - Clearing FDP and CDP statistics
- 195CDP packets
  - Enabling interception of CDP packets globally
  - Enabling interception of CDP packets on an interface
  - 196Displaying CDP information
    - Displaying neighbors
      - CDP packets 7
      - Syntax: show fdp entry * | <device-id>
    - 197Displaying CDP entries
      - To display CDP entries for all neighbors, enter the show fdp entry command.
    - Displaying CDP statistics
  - 198Clearing CDP information
199LLDP and LLDP-MED
- 200LLDP terms used in this chapter
  - TABLE 41
- 201LLDP overview
  - FIGURE 11
  - Benefits of LLDP
- 202LLDP-MED overview
  - FIGURE 12
  - 203Benefits of LLDP-MED
  - LLDP-MED class
- 204General LLDP operating principles
  - LLDP operating modes
    - LLDP transmit mode
    - LLDP receive mode
  - 205LLDP packets
    - FIGURE 13
  - 206TLV support
    - LLDP TLVs
    - 207LLDP-MED TLVs
    - Mandatory TLVs
      - TABLE 42
        208FIGURE 14
        TABLE 43
        FIGURE 15
- 209MIB support
- Syslog messages
- 210LLDP configuration
  - LLDP configuration notes and considerations
    - - TABLE 44
  - 211Enabling and disabling LLDP
  - Enabling support for tagged LLDP packets
  - Changing a port LLDP operating mode
  - 213Maximum number of LLDP neighbors
    - Specifying the maximum number of LLDP neighbors per device
    - Specifying the maximum number of LLDP neighbors per port
  - 214Enabling LLDP SNMP notifications and Syslog messages
    - Specifying the minimum time between SNMP traps and Syslog messages
  - 215Changing the minimum time between LLDP transmissions
  - 216Changing the interval between regular LLDP transmissions
  - Changing the holdtime multiplier for transmit TTL
  - 217Changing the minimum time between port reinitializations
  - LLDP TLVs advertised by the Brocade device
    - General system information for LLDP
      - 219
    - 221802.1 capabilities
    - 222802.3 capabilities
- 224LLDP-MED configuration
  - 225Enabling LLDP-MED
  - Enabling SNMP notifications and Syslog messages for LLDP-MED topology changes
    - TABLE 45
  - 226Changing the fast start repeat count
  - 227Defining a location id
    - Coordinate-based location
    - 229Configuring civic address location
      - LLDP-MED configuration
        230TABLE 46
        Civic Address (CA)
        Description Acceptable values / examples
        LLDP-MED configuration 8
        231TABLE 46
        Description Acceptable values / examples
        Civic Address (CA)
    - 232Configuring emergency call service
      - TABLE 46
  - 233Defining an LLDP-MED network policy
    - LLDP-MED network policy configuration syntax
- 235LLDP-MED attributes advertised by the Brocade device
  - LLDP-MED capabilities
  - 236Displaying LLDP statistics and configuration settings
  - LLDP configuration summary
  - 237Displaying LLDP statistics
    - 238LLDP-MED attributes advertised by the Brocade device
    - Syntax: show lldp statistics
    - LLDP-MED attributes advertised by the Brocade device 8
  - 239Displaying LLDP neighbors
  - 240Displaying LLDP neighbors detail
  - Displaying LLDP configuration details
- 241Resetting LLDP statistics
- 242Clearing cached LLDP neighbor information
243Hardware Component Monitoring
- Digital optical monitoring
  - Digital optical monitoring configuration limitations
  - Enabling digital optical monitoring
    - TABLE 47
  - 244Setting the alarm interval
  - Displaying information about installed media
    - 245Digital optical monitoring 9
    - Use the show media slot command to obtain information about the media device installed in a slot.
  - 246Viewing optical monitoring information
    - 247Viewing optical transceiver thresholds
      - TABLE 48
      - TABLE 49
  - 248Syslog messages for optical transceivers
249Syslog
- - TABLE 50
- 250About Syslog messages
- Displaying Syslog messages
  - 251Enabling real-time display of Syslog messages
  - Enabling real-time display for a Telnet or SSH session
  - Displaying real-time Syslog messages
- 252Syslog service configuration
  - Displaying the Syslog configuration
    - 253Static and dynamic buffers
      - TABLE 51
    - 254Clearing log entries
    - Time stamps
  - 256Disabling or re-enabling Syslog
  - Specifying a Syslog server
  - 257Specifying an additional Syslog server
  - Disabling logging of a message level
  - Changing the number of entries the local buffer can hold
    - Local buffer configuration notes
  - 258Changing the log facility
  - 259Displaying interface names in Syslog messages
  - Displaying TCP or UDP port numbers in Syslog messages
  - 260Retaining Syslog messages after a soft reboot
    - Syslog reboot configuration considerations
  - Clearing the Syslog messages from the local buffer
261Network Monitoring
- Basic system management
  - Viewing system information
    - TABLE 52
  - 262Viewing configuration information
  - 263Viewing port statistics
    - - TABLE 53
        Basic system management
        Statistics
    - 264
    - - TABLE 53
        Parameter Description
        Basic system management 11
  - 265Viewing STP statistics
    - - TABLE 53
        Parameter Description
  - 266Clearing statistics
    - Basic system management 11
  - 267Viewing egress queue counters
    - Clearing the egress queue counters
- 268RMON support
  - Maximum number of entries allowed in the RMON control table
    - TABLE 54
  - 269Statistics (RMON group 1)
    - TABLE 55
      - 270RMON support
  - 271History (RMON group 2)
  - Alarm (RMON group 3)
  - Event (RMON group 9)
- 272sFlow
  - sFlow version 5
  - 273sFlow support for IPv6 packets
    - Extended router information
    - Extended gateway information
    - IPv6 packet sampling
  - 274sFlow configuration considerations
    - sFlow and hardware support
    - sFlow and CPU utilization
    - sFlow and source address
    - sFlow and source port
    - sFlow and sampling rate
  - 275Configuring and enabling sFlow
    - 276Specifying the collector
    - 277Changing the polling interval
    - Changing the sampling rate
    - Changing the sFlow source port
  - 281Enabling sFlow forwarding
    - Command syntax for enabling sFlow forwarding
  - 282sFlow version 5 feature configuration
    - 283Egress interface ID for sampled broadcast and multicast packets
    - Specifying the sFlow version format
    - Specifying the sFlow agent IP address
    - Specifying the version used for exporting sFlow data
    - 284Specifying the maximum flow sample size
    - Exporting CPU and memory usage information to the sFlow collector
    - Exporting CPU-directed data (management traffic) to the sFlow collector
  - 285Displaying sFlow information
    - sFlow
    - Syntax: show sflow The show sflow command displays the following information.
    - TABLE 56
    - 286
    - 287Clearing sFlow statistics
      - TABLE 56
- 288Utilization list for an uplink port
  - Utilization list for an uplink port command syntax
  - 289Displaying utilization percentages for an uplink
    - Appendix
291A
- Syslog messages
  - - TABLE 57
  - 292
  - 296
  - 300
  - 306
  - 307
  - 312
  - 313
  - 315
  - Appendix
317B
- NIAP-CCEVS Certification
  - NIAP-CCEVS certified Brocade equipment and Ironware releases
  - Local user password changes
    - TABLE 58
- 319Index
  - B
  - C
  - 322D
  - E
  - F
  - 323I
  - 324L
  - 325M
  - N
  - O
  - P
  - 326R
  - S
  - 328T
  - V

Also you can find more Brocade Communications Systems manuals or manuals for other Computer Equipment.