HP 6600 manuals
Computer Equipment > Switch
When we buy new device such as HP 6600 we often through away most of the documentation but the warranty.
Very often issues with HP 6600 begin only after the warranty period ends and you may want to find how to repair it or just do some service work.
Even oftener it is hard to remember what does each function in Switch HP 6600 is responsible for and what options to choose for expected result.
Fortunately you can find all manuals for Switch on our side using links below.
854 pages 10.12 Mb
3 HP ProCurve3500 Switches 3500yl Switches 5400zl Switches 6200yl Switch 6600 Switches 8200zl Switches Management and Configuration Guide 29 Product Documentation30 Software Feature Indexand MLD Snooping), refer to the IPv6 Configuration Guide included on all switches the HP ProCurve 6200yl switches.) Premium License Software Features Intelligent Edge Software 37 Getting Started38 Introductionwww.hp.com/go/ procurve/manuals ConventionsCommand Syntax Statementscopy tftpSyntax: aaa port-accessauthenticator < port-list 39 Command PromptsProCurve 8212zl# ProCurve(You can use the hostname command to change the text in the CLI prompt.) hostname Screen SimulationsDisplayed TextProCurve> show version Image stamp: /sw/code/build/info March 1, 2007 13:43:13 K.12.01 ProCurve Figure 1-1.Example of a Figure Showing a Simulated Screen Configuration and Operation Examples Keys 40 Sources for More Informationbelow, including Release Notes covering recently added features, visit the ■ Software Release Notes—ReleaseNotes are posted on the HP ProCurve •new features and how to configure and use them •software management, including downloading software to the switch •software fixes addressed in current and previous releases Read Me First Management and Configuration —Use this guide for information on topics such as: •various interfaces available on the switch •memory and configuration operation •interface access •IP addressing •time protocols •port configuration, trunking, traffic control, and PoE operation •Redundant management •SNMP, LLDP, and other network management topics 42 Getting Documentation From the Webwww.hp.com/go/ procurve/manuals Online HelpMenu Interface Figure 1-2.Online Help for Menu Interface 43 helpFigure 1-3.Example of CLI Help Figure 1-4.Web Browser Interface Online Help 44 Need Only a Quick StartTo Set Up and Install the Switch in Your Network 45 Selecting a Management Interface46 Understanding Management InterfacesMenu ProCurve Manager (PCM)— ProCurve Manager Pluscomplete windows-based in-depth in-box for a free 30-day trial.) 47 Advantages of Using the Menu InterfaceFigure 2-1.Example of the Console Interface Display Provides quick, easy management accessto a menu-driven subset of switch configuration and performance features: The menu interface also provides access for: Offers out-of-band access ■Enables Telnet (in-band)access to the menu functionality Allows faster navigation Provides more security 48 Advantages of Using the CLIFigure 2-2.Command Prompt ExamplesGeneral Benefits Information on Using the CLI 49 Advantages of Using the Web BrowserInterface 51 Advantages of Using ProCurve Manager or ProCurve Manager Plus59 Using the Menu Interface60 This chapter describes the following features:■Overview of the Menu Interface (page 3-2) ■Starting and ending a Menu session (page 3-3) ■The Main Menu (page 3-7) ■Screen structure and navigation (page 3-9) ■Rebooting the switch (page 3-12) ■Configure these features: Manager and Operator A network monitoring port passwords SNMP community names System parameters IP authorized managers •Time protocol •Ports •Trunk groups ■View status, counters, and Event Log information ■Update switch software ■Reboot the switch For a detailed list of menu features, see the “Menu Features List” on page Menu Interaction with Other InterfacesThe menu interface displays the current 61 Starting and Ending a Menu SessionYou can access the menu interface using any of the following: 62 How To Start a Menu Interface Session1.Use one of these methods to connect to the switch: •A PC terminal emulator or terminal •Telnet 2.Do one of the following: •If you are using Telnet, go to step If you are using a PC terminal emulator or a terminal, press 3.When the switch screen appears, do one of the following: •If a password has been configured, the password prompt appears Password: Refer to the Access Security Guide for your switch.) When the CLI prompt appears, display the Menu interface by entering the menuProCurve# menu [Enter] results in the following display: Figure 3-1.Example of the Main Menu with Manager Privileges 63 How To End a Menu Session and Exit from the Console:65 Main Menu FeaturesFigure 3-3.The Main Menu View with Manager PrivilegesThe Main Menu gives you access to these Menu interface features: Status and Counters: Switch Configuration: Event Log: 66 Reboot Switch:Download OS: Run Setup: Logout: 67 Screen Structure and NavigationMenu interface screens include these three elements: ■Parameter fields and/or read-onlyinformation such as statistics ■Navigation and configuration actions, such as Save, Edit, and Cancel For example, in the following System Information screen: Figure 3-4.Elements of the Screen Structure1.Press [E] to select the Edit action dit 68 Table 3-1.How To Navigate in the Menu InterfaceIn most screens there is a 69 HelpFigure 3-5.Example Showing How To Display Help 70 Rebooting the SwitchFigure 3-6.The Reboot Switch Option in the Main Menu 71 Rebooting To Activate Configuration Changes. (To access this parameter, go to the Main Menu and select: 2.Switch Configuration 8.VLAN Menu Maximum VLANs to support VLAN Support Figure 3-7.Indication of a Configuration Change Requiring a Reboot the Reboot Switch option 72 Menu Features List73 Where To Go From Here75 Using the Command Line Interface (CLI)76 Accessing the CLIUsing the CLI 90 CLI Control and EditingExecuting a Prior Command—RedoThe redo command executes a prior command in the history list Syntax: redo [number | command-str] Re-executesa command from history. Executes the last command by default command-str: command-str Figure 4-10.Example of the redo Command Repeating Execution of a CommandThe repeat command executes a previous command in the history list repeat 92 Using a Command Aliasalias name: command: show interface customRemember to enclose the command being aliased in quotes ProCurve(config)# alias sc “show config” ProCurve(config)# sc status 93 show aliasFigure 4-13.Example of Alias Commands and Their Configurations 94 CLI Shortcut Keystrokes95 Using the ProCurve Web Browser Interface■Optimize your network uptime by using the Alert Log and other diagnostic tools ■Make configuration changes to the switch ■Maintain security by configuring usernames and passwords This chapter covers the following: ■General features (page 5-4) ■Starting a web browser interface session (page 5-5) ■Tasks for your first web browser interface session (page 5-8): •Creating usernames and passwords in the web browser interface (page 5-9) Selecting the fault detection configuration for the Alert Log operation (page •Getting access to online help for the web browser interface (page 5-12) ■Description of the web browser interface: •Overview window and tabs (page 5-17) •Port Utilization and Status displays (page 5-18) •Alert Log and Alert types (page 5-21) •Setting the Fault Detection Policy (page 5-24) 97 web-managementWeb Agent Enabled No 98 General Features99 Starting a Web Browser Interface Session with the SwitchYou can start a web browser session in the following ways: •Directly connected to your network •Connected through remote access to your network ■Using a network management station running ProCurve Manager on your network Using a Standalone Web Browser in a PC or UNIX WorkstationEnsure that the Java Location Address http:switch5308 [Enter] (example of a DNS-typename) switch530810.11.12.195 [Enter] (example of an IP address) 100 Using ProCurve Manager (PCM) orProCurve Manager Plus (PCM+) 102 Tasks for Your First ProCurve WebBrowser Interface Session■Review the “First Time Install” window ■Set Manager and Operator passwords ■Set access to the web browser interface online help Viewing the “First Time Install” WindowFigure 5-2. First-TimeInstall WindowThis window is the launching point for the basic configuration you need to Log displays to display the Device Passwords screen, and then go to the next page. (You can also access the password screen by clicking on the Security tab.) the Configuration tab, and then the [Fault Detection] key.) 103 Security: Creating Usernames and Passwordsin the Browser Interface 106 Online Help for the Web Browser InterfaceFigure 5-5.TheHelp Button 107 Support/Mgmt URLs Feature■Support URL – A support information site for your switch Support URL■Management Server URL – The web site for web browser online Help Management Server URL Figure 5-6.The Default Support/Mgmt URLs Window 108 Support URLHelp and the Management Server URLManagement Server URL www.hp.com/rnd/device_help Figure 5-7.How To Access Web Browser Interface Online Help 109 Using the PCM Server for Switch Web Help111 Status Reporting FeaturesBrowser elements covered in this section include: ■The Overview window (below) ■Port utilization and status (page 5-18) ■The Alert log (page 5-21) ■The Status bar (page 5-23) The Overview WindowFigure 5-8.The Status Overview WindowPCM can perform network-wide (page 5-14) 112 The Port Utilization and Status DisplaysFigure 5-9.The Graphs Area % Unicast Rx & All Tx: 113 Maximum Activity Indicator:Utilization Guideline To change the amount of bandwidth the Port Utilization bar graph Figure 5-10.Changing the Graph Area ScaleHold the mouse cursor over any of the bars in the graph, and a pop-up figure (next) 114 Figure 5-11.Display of Numerical Values for the BarFigure 5-12.The Port Status Indicators and Legend Port Connected Port Not Connected Port Disabled Port Fault-Disabled 115 The Alert LogFigure 5-13.Example of the Alert LogEach alert has the following fields of information: ■Alert – The specific event identification Alert Description Excessive CRC/Alignment errors on port:Sorting the Alert Log Entries Bold Alert 116 Acknowledge EventDelete Event Cancel 117 Status Indicators118 Setting Fault Detection PolicyFigure 5-15.The Fault Detection Window 119 Log Network ProblemsHigh Sensitivity Medium Sensitivity Low Sensitivity Never Apply Changes Clear Changes Reset to Default Settings 121 Switch Memory and Configuration122 Changing or Overriding the Reboot Configuration PolicyRenaming an Existing Startup-ConfigFile Transferring Startup-ConfigFiles To or From a Remote Server TFTP: Copying a Configuration File to a Remote Host TFTP: Copying a Configuration File from a Remote Host Operating Notes for Multiple Configuration Files 123 Configuration File Managementrunning-config Figure 6-1.Conceptual Illustration of Switch Memory Operation Running Config File: 124 Startup-configFile:Any of the following actions boots the switch: • Executing the boot or the reload command in the CLI • Executing the boot command in the menu interface • Pressing the Reset button on the front of the switch • Removing, then restoring power to the switch Primary and Secondary Flash Image Options” on page In the menu interface: In the web browser interface:button or other appropriate button. This overwrites file and the file with the changes you have specified in the web browser interface window ProCurve(config)# interface ethernet 5 disable Show config How To Use the CLI To Reconfigure Switch Featuresfile) file 2. Use the appropriate commands to verify that you have correctly made the desired changes 126 Using the CLI To ImplementConfiguration ChangesThe CLI offers these capabilities: ■Access to the full set of switch configuration features ■The option of testing configuration changes before making them perma nent ■show config — Displays a listing of the current startup-configfile show config■show running-config— Displays a listing of the current running-configfile ■write terminal — Displays a listing of the current running-configfile write terminal show config status•If the two configurations are the same you will see: –Running configuration is the same as the startup configuration •If the two configurations are different, you will see: –Running configuration has been changed and needs to be saved Syntax: write memory ProCurve(config)# interface e a5 speed-duplex auto-10 127 auto-10128 How To Cancel Changes You Have Made to the Running-ConfigFileUpdate the ProCurve(config)# interface e 1 disable ProCurve(config)# boot Device will be rebooted, do you want to continue [y/n]? y Figure 6-2.Boot Prompt for an Unsaved ConfigurationIf you want to discard the changes you made to the If you use the CLI to make a change to the running-configfile, you should from either the CLI or the menu interface without first executing the write running-configfile, and any changes in the running-configfile will be lost to the running config by the CLI unless you have also made a configuration as indicated above, unless you also make a configuration change in the the change to the startup-configfile 129 How To Reset the startup-configand running-configFiles to theFactory Default Configuration. This command reboots the switch Factory Default Configurationwith the factory-defaultstartup configuration ProCurve(config)# erase startup-config Configuration will be deleted and device rebooted, continue [y/n] Figure 6-3.Example of erase startup-configCommandprevent a reboot file on both the active and the standby management modules as long as in standby mode or has failed selftest, the startup config file is not erased 130 Using the Menu and Web BrowserInterfaces To Implement Configuration ChangesThe menu and web browser interfaces offer these advantages: ■Quick, easy menu or window access to a subset of switch configuration features Immediately changing both the Menu: Implementing Configuration ChangesUsing Save and Cancel in the Menu Interface ancelFor any configuration screen in the menu interface, the Save command: 1.Implements the changes in the running-configfile 2.Saves your changes to the startup-configfile Cancel 132 Figure 6-5.The Reboot Switch Option in the Main Menu2. Switch Configuration 8. VLAN Menu Figure 6-6.Indication of a Configuration Change Requiring a Reboot 133 Web: Implementing Configuration Changesconfig file and the startup-configfile browser interface 134 Using Primary and Secondary FlashImage OptionsDisplaying the Current Flash Image Data135 show versionFigure 6-7.Example Showing the Identity of the Current Flash Image Figure 6-8.Example Showing Different Flash Image Versions Determining Which Flash Image Versions Are Installed. The show ver Figure 6-9.Determining the Software Version in Primary and Secondary Flash 136 Switch Software DownloadsTable 6-1.Primary/Secondary Memory Access xmodem usb Download Interruptions 137 Local Switch Software Replacement and RemovalCopying a Switch Software Image from One Flash Location toSyntax: copy flash flash <destination flash destination flash where: destination flash = primary or secondary: where: primary secondaryFor example, to copy the image in secondary flash to primary flash: Execute the copy command as follows: ProCurve(config)# copy flash flash primary This command deletes the software image file from the specified flash location 138 Caution:No UndoSyntax: erase flash < primary | secondary For example, to erase the software image in primary flash, do the following: ProCurve# boot system flash secondary 2.Then erase the software image in the selected flash (in this case, primary): Figure 6-11.Example of Erase Flash Prompt3.Type y at the prompt to complete the flash erase 4.Use show flash to verify erasure of the selected software flash image Figure 6-12.Example of Show Flash Listing After Erasing Primary Flash 139 Rebooting the SwitchOperating Notes about Booting Default Boot Source boot system flash [primary | secondary] flash [primary | secondary] Interaction of Primary and Secondary Flash Images with the Current 140 reload at 1:00mm/dd mm/dd Boot and Reload Command Comparison 141 Table 6-2.Comparing the Boot and Reload CommandsThe reload commandSetting the Default Flash flashSyntax: boot set-defaultflash [primary |secondary] Upon booting, set the default flash for the next boot to primary or secondary Booting from the Default Flash (Primary or Secondary) 142 boot set- defaultboot system flash <primary | secondarySyntax: boot [system [flash <primary | secondary>] [config FILENAME] Note system:config: You can optionally select a configuration file from which to boot config:Booting from a Specified Flash Syntax: boot system flash < primary | secondary 143 Figure 6-16.Example of Boot Command with Secondary Flash OptionSyntax: [no] fastboot Enables the fastboot option The no option disables the feature Syntax: show fastboot Shows the status of the fastboot feature, either enabled or disabled The fastboot command is shown below ProCurve(config)# fastboot Using Reload 144 Syntax: reload145 Scheduled Reloadat:The no form of the command removes a pending reboot request For more details and examples, see below The scheduled reload feature removes the requirement to physically reboot the switch is scheduled to reboot) No prompt to save configuration file changes is displayed. See Table 6-2on Examples of scheduled reload commands: ■To schedule a reload in 15 minutes: ProCurve# reload after ■To schedule a reload in 3 hours: ProCurve# reload after 03:00 ■To schedule a reload for the same time the following day: ProCurve# reload after 01:00:00 ■To schedule a reload for the same day at 12:05: ProCurve# reload at 12:05 ■To schedule a reload on some future date: ProCurve# reload at 12:05 01/01/2008 Figure 6-18.An Example of the reload Command with a Redundant Management System 146 Multiple Configuration FilesA fixed reboot policy using a specific ■Overriding the current reboot policy on a per-instancebasis Figure 6-19.Optional Reboot Process 147 General OperationThe switch uses three memory “slots”, with identity ) numbers of , and Boot OptionsUse the designated Reboot the switch through the Primary boot path using the 148 backupConfigUse the CLI to make configuration changes in the 149 Transitioning to Multiple Configuration FilesAssigns the filename oldConfigSaves a copy of the existing 150 Listing and Displaying Startup-ConfigFilesViewing the Startup-ConfigFile Status with Multiple Configuration Enabled Syntax: show config files id: act: pri: sec: 151 Changing or Overriding the Reboot Configuration PolicyYou can boot the switch using any available startup-configfile ■The active configuration file Syntax: startup-default[ primary | secondary ] config < filename Specifies a boot configuration policy option: Designates the 152 configboot system flash minconfig newconfigSyntax: boot system flash < primary | secondary > config < filename Using Reload To Reboot From the Current Flash Image and Startup- Config File show config files 153 Managing Startup-ConfigFiles in the Switch158 Transferring Startup-ConfigFiles To or From a Remote ServerTFTP: Copying a Configuration File to a Remote Host src-file remote file 159 testTFTP: Copying a Configuration File from a Remote Host Unable to copy configuration to "< filename erase config <filename test 01.txtXmodem: Copying a Configuration File to a Serially Connected Host 160 copyconfig > xmodemXmodem: Copying a Configuration from a Serially copy xmodemOperating Notes for Multiple Configuration Files /cfg/< filename /cfg 161 Automatic Configuration Update with DHCP Option■One or more DHCP servers with Option 66 are enabled ■One or more TFTP servers has the desired configuration file CLI CommandThe command to enable the configuration update using Option 66 is: Syntax: [no] dhcp config-file-update Enables configuration file update using Option Default: Enabled Figure 6-26.Example of Enabling Configuration File Update Using Option 162 Possible Scenarios for Updating the Configuration File163 Log Messages“Invalid IP address <ip-address>received for DHCP Option 66” 165 Interface Access and System InformationThis chapter describes how to: ■View and modify the configuration for switch interface access ■Use the CLI kill command to terminate a remote session 166 kill■View and modify switch system information For help on how to actually use the interfaces built into the switch, refer to: ■Chapter 3, “Using the Menu Interface” ■Chapter 4, “Using the Command Line Interface (CLI)” ■Chapter 5, “Using the ProCurve Web Browser Interface” 167 Interface Access: Console/Serial Link, Web, and Inbound Telnet175 Denying Interface Access by Terminating Remote Management Sessions176 System Information183 Configuring IP Addressing184 IP ConfigurationIP Configuration Features 186 Just Want a Quick Start with IP Addressingsetup ProCurve# setup # setup ■Select 8. Run Setup in the Main Menu of the menu interface 8. Run SetupFor more on using the Switch Setup screen, refer to the Installation and Getting Started Guide you received with the switch IP Addressing with Multiple VLANsto the DEFAULT_VLAN N o t e s■ If multiple VLANs are configured, then each VLAN can have its own IP address. This is because each VLAN operates as a separate broadcast domain and requires a unique IP address and subnet mask. A default gateway (IP) address for the switch is optional, but recommended ■ In the factory-defaultconfiguration, the default VLAN (named use DHCP or BootP to acquire IP addressing. However, the switch’s agement Guide for your switch 187 Menu: Configuring IP Address, Gateway, and Time-To-Live (TTL)To manually enter an IP address, subnet mask, set the IP Config ManualTo use DHCP or Bootp, use the menu interface to ensure that the DHCP/Bootp To Configure IP Addressing1.From the Main Menu, Select 2.Switch Configuration … 5.IP Configuration 188 Figure 8-1.Example of the IP Service Configuration Screen without MultipleVLANs Configured Default Gateway Default TTL DHCP/ Bootp IP Address Subnet Mask 189 CLI: Configuring IP Address, Gateway, and Time-ToLive (TTL)IP Commands Used in This Section Viewing the Current IP Configuration Syntax: show ip Figure 8-2.Example of the Switch’s Default IP AddressingThe fol lowing is supported: ■Up to 2000 IP addresses for the switch ■Up to 32 IP addresses for the same VLAN ■Up to 512 IP VLANs, that is, VLANs on which you can configure IP addresses 191 Figure 8-4.Example of Configuring and Displaying a Multinetted VLANIf you then wanted to multinet the default VLAN, you would do the following: 192 Figure 8-5.Example of Multinetting on the Default VLANcommand to display the full IP address listing for multinetted VLANs then enter the new address to replace a manually configured default gateway.) Syntax: ip default-gateway < ip-address ip-address ProCurve(config)# ip default-gateway10.28.227.115 NoteThe switch uses the IP default gateway only while operating as a Layer you should use the ip route command to configure a static (default) route ip routeRouting Features” in the Multicast and Routing Guide for your switch ing it Syntax: ip ttl <number-of-hops ProCurve(config)# ip ttl level. The TTL default is 64, and the range is 2 193 Web: Configuring IP AddressingYou can use the web browser interface to access IP addressing only if the switch already has an IP address that is reachable through your network 1. Click on the Configuration tab on [?] to access the web-basedhelp available for the switch How IP Addressing Affects Switch Operation194 Table 8-1.Features Available With and Without IP Addressing on the SwitchDHCP/Bootp Operation the network servers 195 DHCP or Bootpit continues to periodically send request packets, but with decreasing fre and a Bootp configuration is that an IP address assignment from a DHCP addressing provided by the server may be different each time the switch address assignment for the switch by doing either of the following: ■ Configure the server to issue an “infinite” lease switch. (For MAC address information, refer to Appendix D, “MAC Address Management”.) tion provided with the DHCP server 196 Bootp Database Record Entries/etc/bootptab8212switch: ht=ether: ha=0030c1123456: ip=10.66.77.88: sm=255.255.248.0: gw=10.66.77.1: hn: vm=rfc1048 lg=10.22.33.44: T144=”switch.cfg”: where: 197 Network Preparations for Configuring DHCP/Bootp■For Bootp operation: •The necessary network connections are in place •The Bootp server is accessible from the switch ■For DHCP operation: •A DHCP scope has been configured on the appropriate DHCP server •A DHCP server is accessible from the switch 198 Loopback Interfaces203 IP Preserve: Retaining VLAN-1IPAddressing Across Configuration File DownloadsOperating Rules for IP Preserve 204 Enabling IP PreserveFigure 8-9.Example of Implementing IP Preserve in a Configuration FileFor example, consider figure 8-10: Figure 8-10.Example of IP Preserve Operation with Multiple Series Switches 207 Configuring a Single Source IP Address215 Time Protocols216 Viewing the Current TimeP ConfigurationConfiguring (Enabling or Disabling) the TimeP Mode Notes■SNTP Time Protocol Operation ■Timep Time Protocol Operation 217 TimeP Time SynchronizationSNTP Time SynchronizationSNTP provides two operating modes: 218 Unicast Mode:sntp serverGeneral Steps for Running a Time Protocol on the Switch: 1.Select the time synchronization protocol: SNTP or TimeP (the default) TimeP2.Enable the protocol. The choices are: •SNTP: Broadcast or Unicast •TimeP: DHCP or Manual3.Configure the remaining parameters for the time protocol you selected Disabling Time Synchronization ■In the Global config level of the CLI, execute no timesync no timesync 219 SNTP: Viewing, Selecting, andConfiguringTable 9-1.SNTP Parameters 220 Menu: Viewing and Configuring SNTPTo View, Enable, and Modify SNTP Time Protocol: 1. From the Main Menu, select: 2. Switch Configuration 1. System Information 221 Figure 9-1.The System Information Screen (Default Values)SNTP Mode5.Do one of the following: Use the Space bar to select the Broadcast Figure 9-2.Time Configuration Fields for SNTP with Broadcast Mode•Use the Space bar to select the Unicast mode, then do the following: Unicasti.Press [>] to move the cursor to the Server Address field Server Address 222 Server Versioniv.Press [>] to move the cursor to the Poll Interval field, then go to step Figure 9-3.SNTP Configuration Fields for SNTP Configured with Unicast Mode 224 Syntax: show managementConfiguring (Enabling or Disabling) the SNTP Mode 225 sntp < broadcast | unicastSyntax:Selects SNTP as the time synchronization method Syntax: sntp broadcast Configures broadcast as the SNTP mode 226 broadcastTime synchronization is in the ■You want to: 1.View the current time synchronization 2.Select SNTP as the time synchronization mode 3.Enable SNTP for Broadcast mode Figure 9-7.Example of Enabling SNTP Operation in Broadcast Mode 228 Figure 9-8.Example of Configuring SNTP for Unicast OperationFigure 9-9.Example of Specifying the SNTP Protocol Version Number 229 Changing the SNTP Poll IntervalSyntax: sntp poll-interval< 30..720 For example, to change the poll interval to 300 seconds: ProCurve(config)# sntp poll-interval300 Syntax: sntp server priority <1 - 3> <ip-address For example, to set one server to priority 1 and another to priority 2: ProCurve(config)# sntp server priority 1 ProCurve(config)# sntp server priority 2 2001:db8::215:60ff:fe79:8980 The recommended method for disabling time synchroniza tion is to use the Syntax: no timesync Halts time synchronization without changing your SNTP configuration ProCurve(config)# no timesync If you then viewed the SNTP configuration, you would see the following: Figure 9-10.Example of SNTP with Time Synchronization Disabled Disabling the SNTP Mode Syntax: no sntpDisables SNTP by changing the SNTP mode configuration to Disabled no sntp 230 SNTP Client AuthenticationRequirements 231 SNTP Client Authentication Supporttimesync sntp key-value SNTP Server Authentication SupportThe following must be performed on the SNTP server: The same authentication ■SNTP server authentication must be enabled on the server Configuring the Key-Identifier,Authentication Mode, and Key-Value This command configures the key-id, authentication-mode,and key-value 232 authentication-modeThe no version of the command deletes the authentication key Default: No default keys are configured on the switch key-id: A numeric key identifier in the range of 1 4,294,967,295 key-id:(232)that identifies the unique key value. It is sent in the SNTP packet Figure 9-12.Example of Setting Parameters for SNTP AuthenticationConfiguring a Trusted Key 233 trustedEnter the following command to configure a key-id as trusted 234 priority<version-num>: Figure 9-13.Example of Associating a Key-Idwith a Specific ServerEnabling SNTP Client Authentication sntp authenticationConfiguring Unicast and Broadcast Mode Enables SNTP for either broadcast or unicast mode 235 Broadcast:Displaying SNTP Configuration Information 236 Figure 9-14.Example of SNTP Configuration Informationshow sntp authentication Figure 9-15.Example of show sntp authentication Command Output sntp statistics 237 Figure 9-16.Example of SNTP Authentication Statistical InformationSaving Configuration Files and the Include-CredentialsCommand include-credentials show running config 238 Figure 9-17.Example of Configuration File with SNTP Authentication Information 240 TimeP: Viewing, Selecting, and249 SNTP Unicast Time Polling with MultipleSNTP Servers 251 Port Status and Configuration253 Viewing Port Status and Configuring PortParameters 275 Using Friendly (Optional) Port NamesShow Configuring and Operating Rules for Friendly Port Namesshow name show interface port-numberA friendly port name can have up to 64 contiguous alphanumeric charac ters invalid input not assigned 276 Configuring Friendly Port NamesSyntax: interface < port-list > name < port-name-string Assigns a port name to port-list Syntax: no interface < port-list > name Deletes the port name from port-list Figure 10-17.Example of Configuring a Friendly Port Name 277 Displaying Friendly Port Names with Other Port Data281 Configuring Transceivers and Modules That Haven’tBeen InsertedTransceivers Modules Syntax: module <module-num>type <module-type Allows you to configure the type of the module must not have a configuration associated with it Clearing the Module Configuration 283 Uni-DirectionalLink Detection (UDLD)Figure 10-23.UDLD Example 284 Configuring UDLDWhen configuring UDLD, keep the following considerations in mind: group’s primary port enables the feature on that port only ■ Dynamic trunking is not supported. If you want to configure a trunk group that contains ports on which UDLD is enabled, you must remove the UDLD configuration from the ports. After you create the trunk group, you can re-addthe UDLD configuration notes and current manuals for required software versions The following commands allow you to configure UDLD via the CLI Syntax: [no] interface <port-list> link-keepalive Enables UDLD on a port or range of ports To disable the feature, enter the no form of the command Default: UDLD disabled 285 Enabling UDLD286 Changing the Keepalive IntervalChanging the Keepalive Retries Configuring UDLD for Tagged Ports 287 Viewing UDLD Informationlink-keepalive Figure 10-24.Example of Show Link-KeepaliveCommand 288 show link keepalive statisticsFigure 10-25.Example of Show Link-KeepaliveStatistics CommandTo clear UDLD statistics, enter the following command: ProCurve# clear link-keepalivestatistics show link keepalive statistics 289 Configuration Warnings and Event Log MessagesWarning Messages Table 10-3.Warning Messages caused by configuring UDLD for Tagged Ports Event Log Messages Table 10-4.UDLD Event Log Messages 291 Power Over Ethernet (PoE/PoE+) Operation293 Introduction to PoE295 PoE OperationUsing the commands described in this chapter, you can: ■Enable or disable PoE operation on individual ports ■Monitor PoE status and performance per module Configure a Configuration OptionsDisable or Manually allocate the amount of PoE power for a port by usage, value, or class ■Allocate PoE power based on the link-partner’scapabilities via LLDP uring the port 296 PD Support297 Power Priority OperationWhen Is Power Allocation Prioritized How Is Power Allocation Prioritized 298 Configuring PoE OperationDisabling or Re-EnablingPoE Port Operation Enabling Support for Pre-StandardDevices 299 Configuring the PoE Port Priority Level302 Controlling PoE AllocationSyntax: [no] int <port-list> poe-allocate-by[usage | class | value] usage: The automatic allocation by a PD usage class:value: A user-definedlevel of PoE power allocated for that port value:allow for power losses along the Cat-5cable Table 11-2.Power Classes and Their ValuesFor example, to allocate by class for ports 6 - 8: ProCurve(config)# int 6-8 PoE-allocate-byclass 303 Manually Configuring PoE Power Levelspoe allocate-by valueProCurve(config)# int A6 poe-allocate-byvalue or in interface context: ProCurve(eth-A6)# poe-allocate-byvalue Then select a value: ProCurve(config)# int A6 poe-value15 ProCurve(eth-A6)# poe-value15 To view the settings, enter the show power-over-ethernet command: power-over-ethernetIf you set the PoE maximum value to less than the PD requires, a fault occurs Figure 11-2.Example Showing PoE Power Value Set Too Low for the PD 304 Configuring PoE Redundancy (Chassis Switches Only)Syntax: [no] power-over-ethernetredundancy [n+1 | full] Allows you to set the amount of power held in reserve for redundancy The no option means that all available power can be allocated to PDs Default: No PoE redundancy enforced Default: full: www. procurve.com 305 Changing the Threshold for Generating a Power NoticeYou can configure one of the following thresholds: Syntax: power-over-ethernet[slot < slot-id-range >] threshold < 1 - 99 306 [slotslot-id-rangeProCurve(config)# power-over-ethernetthreshold Slot B POE usage has exceeded threshold of 70% Syntax: power-over-ethernet[slot <slot-id-range>]threshold <1 - 99 307 (Continued)Slot B POE usage is below threshold of 70% thresholdProCurve(config)# power-over-ethernetslot d threshold 308 PoE/PoE+ Allocation Using LLDP Information309 Displaying the Switch’s Global PoE Power Status315 Planning and Implementing a PoE Configuration318 PoE Event Log Messages“Informational” PoE Event-LogMessages Slot <slot-id > POE usage is below configured threshold of < 1 - 99 >% port <port-id > applying power to PD port <port-id > PD detected Slot <slot-id > software update started Slot <slot-id > software update completed on PoE controller <controller controller id 319 “Warning” PoE Event-LogMessageschassis Port <port-id > PD Denied power due to insufficient power allocation Port <port-id> PD Invalid Signature <port-id indication Port <port-id > PD Over Current 50v Power Supply is faulted Failures:<num-failures 50v Power Supply is OK. Failures: <num-failures FET bad on port <port-id 321 Port Trunking325 Port Trunk Features and OperationThe switches covered in this guide offer these options for port trunking: ■LACP: IEEE 802.3ad—page ■Trunk: Non-Protocol—page 326 Trunk Configuration Methods330 Menu: Viewing and Configuring a Static Trunk Group1.Follow the procedures in the Important note above 2.From the Main Menu, Select: 2.Port/Trunk Settings Figure 12-4.Example of the Menu Screen for Configuring a Port Trunk Group4.In the Group column, move the cursor to the port you want to configure Use the Space bar to choose a trunk group assignment Trk2 331 Figure 12-5.Example of the Configuration for a Two-PortTrunk Group–LACP –Trunk (the default type if you do not specify a type) LACP Trunk)When you are finished assigning ports to the trunk group, press 332 CLI: Viewing and Configuring Port TrunkGroupsTrunk Status and Configuration Commands Using the CLI To View Port Trunks 335 Using the CLI To Configure a Static or Dynamic Trunk336 Configuring a Static Trunk or Static LACP Trunk GroupSyntax: trunk < port-list > < trk1 ... trk144> < trunk | lacp Configures the specified static trunk type with the group name of Trk2 ProCurve(config)# trunk c4-c6trk2 trunk one or more ports from an existing Trkx trunk group TrkWhen you remove a port from a trunk where spanning tree is not in use on that port Syntax: no trunk < port-list Removes the specified ports from an existing trunk group For example, to remove ports C4 and C5 from an existing trunk group ProCurve(config)# no trunk c4-c5 tion, all ports on the switch are set to disabled. To enable the switch to device on the other end of the link is configured for LACP Passive PassiveSyntax: interface < port-list> lacp active This example uses ports C4 and C5 to enable a dynamic LACP trunk group ProCurve(config)# interface c4-c5lacp active 337 Activepassivewithout first removing LACP operation from the port.) 338 Web: Viewing Existing Port Trunk339 Trunk Group Operation Using LACP347 Distributed Trunking348 Figure 12-13.Example of Distributed Trunking ConfigurationFigure 12-14.Exampleof Distributed Trunking 349 Distributed Trunking Interconnect Protocol (DTIP)350 Configuring Distributed TrunkingISC Port Configuration The no form of the command removes the ISC interface configuration Distributed Trunking Port Configuration Distributed trunking ports must be configured manually To configure distributed trunking on the switch, enter this command: port-lis dt-lacp Figure 12-15.Exampleof Configuring Distributed Trunking 351 Displaying Distributed Trunking Informationshow lacp distributedSyntax: show lacp [distributed] Displays information about distributed trunks and LACP status Figure 12-16.Exampleof the Output for the show lacp distributed Command 352 Maximum DT Trunks and Links SupportedTable 12-1.Maximum DT Trunks and Links Max Number Forwarding Traffic with Distributed Trunking and Spanning TreeForwarding Unicast Traffic Upstream 353 Forwarding Broadcast, Multicast, andUnknown Traffic Upstream Forwarding Unicast Traffic Downstream (to the Server) Forwarding Broadcast, Multicast, and Unknown Traffic Downstream (to the Server) 354 A BDT1 DT2 355 Distributed Trunking RestrictionsThere are several restrictions with distributed trunking Only servers are supported as Distributed Trunking Devices (DTDs) A distributed trunk can span a maximum of two switches Meshing and DT switches are mutually exclusive ARP protection is not supported on the distributed trunks STP is disabled on DT ports QinQ in mixed VLAN mode and distributed trunking are mutually exclu sive SVLANs in mixed mode are not supported on DT or ISC links DHCP snooping and IGMP snooping are not supported on DT links 356 Trunk Group Operation Using the“Trunk” Option 357 How the Switch Lists Trunk DataDynamic LACP Trunk Group: Appears in the output from the CLI show lacp command Outbound Traffic Distribution Across Trunked Links 361 Port Traffic Controls364 Rate-LimitingAll Traffic Rate-LimitingConfiguring Rate-Limiting The mode using bits per second (bps) in releases before K.12.XX has been replaced by the kilobits per second (kbps) mode. Switches that have config urations with bps values will be automatically converted when you update a switch running later versions of the software (K.12.XX or greater) ■Rate-limitingon either inbound or outbound traffic 365 out —kbps — Notes:The •Rate-limitingdoes not apply to trunked ports (including meshed ports) —Continued— Kbps 366 > disableDisplaying the Current Rate-LimitConfiguration 367 Figure 13-1.Example of Listing the Rate-LimitConfigurationTo view RADIUS-assigned rate-limitinformation, use one of the following command options: show port-access web-basedclients < port-list > detailed mac-basedclients < port-list > detailed authenticator clients < port-list > detailed and Configuration Guide for your switch ration currently stored in the startup-configfile. (Note that configuration do not appear in the startup-configfile.) 368 Figure 13-2.Example of Rate-LimitSettings Listed in the “show config” OutputOperating Notes for Rate-Limiting , regardless of traffic priority < port-list >: Operation is not allowed for a trunked port 369 Monitoring (Mirroring)If monitoring is configured, packets dropped by OptimumOptimum occurs with 64-byte of all sizes of packets (((100,000,000 bits) / 8 ) / 84) x 64 = 9,523,809 bytes per second and the rate-limit of 50% has no effect bandwidth usage > (0.50 x 9,523,809) 370 ICMP Rate-Limiting371 all)372 Spoofed Ping:Guidelines for Configuring ICMP Rate-Limiting Figure 13-3.Example of ICMP Rate-LimitingConfiguring ICMP Rate-Limiting 373 kbps<0-10000000>:traffic in kilobits per second 0: This value causes an interface to drop all incoming ICMP traffic, and is not recommended. Refer to the Caution on Note: ICMP rate-limitingis not supported on meshed ports (Rate-limitingcan reduce the efficiency of paths through a mesh domain) limit of 1% on ports A3 - A5, which are used as network edge ports: ProCurve(config)# int a3-a5 rate-limiticmp ProCurve (eth-A3-A5)# rate-limiticmp with the disparity increasing as the packet size decreases (the packet to payload ratio is higher) speeds such as 10 Gbps 374 Using Both ICMP Rate-Limitingand All-Traffic Rate-Limitingon the Same InterfaceThe ICMP traffic If at a given moment: ■Inbound ICMP traffic on port “X” is using 1% of the port’s bandwidth, and ■Inbound traffic of all types on port “X” demands 61% of the ports’s bandwidth Displaying the Current ICMP Rate-LimitConfiguration Syntax: show rate-limiticmp [ port-list ] 375 Figure 13-4.Example of Listing the Rate-LimitConfigurationInterface support: 378 Determining the Switch Port Number Used in ICMP Port ResetCommands: walkmib ifDescrProCurve# walkmib ifDescr ifDescr.48 = B22 ifDescr.49 = B23 ifDescr.50 = B24 Figure 13-5.Matching Internal Port Numbers to External Slot/Port Numbers 379 Configuring Inbound Rate-Limitingfor Broadcast and Multicast Traffic382 Guaranteed Minimum Bandwidth (GMB)GMB Operationfying a minimum bandwidth for a high-priorityqueue but not specifying a configured to allocate a minimum bandwidth of 80% for outbound high starves lower-priorityqueues that do not have a minimum configured but will likely cause delays in the delivery of the lower-prioritytraffic exceed 100% Impacts of QoS Queue Configuration on GMB Operation 384 interface bandwidth-min show bandwidth output Table 13-2.Default GMB Percentage Allocations per QoS Queue Configuration385 For more information on queue configuration and the associated default(QoS): Managing Bandwidth More Effectively” in the Advanced Traffic ” in the Management Guide for your switch Configuring Guaranteed Minimum Bandwidth for Outbound Traffic Syntax: [ no ] int < port-list > bandwidth-minoutput • Queue 1 (low priority): 2% • Queue 2 (low priority): 3% • Queue 3 (normal priority): 30% • Queue 4 (normal priority): 10% • Queue 5 (medium priority): 10% • Queue 6 (medium priority): 10% • Queue 7 (high priority): 15% • Queue 8 (high priority): 20% The no form of the command disables GMB for all ports in 386 %> <queue7%> <queue8%>]1.Queue 8 (high priority) 2.Queue 7 (high priority) 3.Queue 6 (medium priority) 4.Queue 5 (medium priority) 5.Queue 4 (normal priority) 6.Queue 3 (normal priority) 7.Queue 2 (low priority) 8.Queue 1 (low priority) (continued) Displaying the Current Guaranteed Minimum Bandwidth Configuration 388 Figure 13-9.Example of Listing the Guaranteed Minimum BandwidthFigure 13-10.Example of GMB Settings Listed in the “show config” Output 389 GMB Operating NotesImpact of QoS Queue Configuration on GMB commands. Changing 390 Jumbo FramesJumbo Frame: Jumbo VLAN: MTUMaximum Transmission Unit) Standard MTU: 391 Operating RulesSwitch Meshing: GVRP Operation: Port Adds and Moves: Jumbo Traffic Sources: 392 Configuring Jumbo Frame Operation395 Configuring a Maximum Frame SizeGLOBAL 396 frame-sizeconfigured as Syntax: jumbo ip-mtu<size max-frame-sizeDefault: 9198 bytes SNMP Implementation Jumbo Maximum Frame Sizeetary MIB object: hpSwitchMaxFrameSize OBJECT-TYPE default value is set to 9216 bytes Jumbo IP MTUThe IP MTU for Jumbos is supported with the following proprietary MIB object: hpSwitchIpMTU OBJECT-TYPE Displaying the Maximum Frame Size show jumbos Figure 14. Displaying the Maximum Frame Size and IP MTU ValuesOperating Notes for Maximum Frame Size 397 Operating Notes for Jumbo Traffic-Handling400 TroubleshootingA VLAN is configured to allow jumbo frames, but one or more ports drops all inbound jumbo frames speed-duplex show interfaces brief < port-list A non-jumboport is generating “Excessive undersize/giant frames” messages in the Event Log401 CLI: Viewing and Configuring SNMP Community NamesGeneral Steps for Configuring SNMP Notifications Configuring an SNMP Trap Receiver Configuring SNMPv3 Notifications Managing Network Security Notifications Configuring the Source IP Address for SNMP Notifications Displaying SNMP Notification Configuration 402 CLI-ConfiguredsFlow with Multiple InstancesViewing sFlow Configuration and Status LLDP-MED (Media-Endpoint-Discovery) LLDP-MEDTopology Change Notification Displaying Switch Information Available for Outbound 403 Using SNMP Tools To Manage the Switchproducts index Network Management 404 SNMP Management FeaturesSNMP management features on the switch include: ■SNMP version 1, version 2c, or version 3 over IP ■Security via configuration of SNMP communities (page 14-11) ■Security via authentication and privacy for SNMP Version 3 access ■Event reporting via SNMP •Version 1 traps •RMON: groups 1, 2, 3, and ■ProCurve Manager/Plus support ■Flow sampling using sFlow Click on software updates, then MIBs Configuring for SNMP version 1 and 2c Access to the SwitchConfigure the appropriate SNMP communities. (Refer to Configure the appropriate trap receivers. (Refer to 405 Configuring for SNMP Version 3 Access to the Switch406 SNMP Version 3 CommandsSNMP version 3 (SNMPv3) adds some new commands to the CLI for MD5 authentication and DES privacy You may (optionally) restrict access to only SNMPv3 agents by using the the snmpv3 restricted-access command“public” inaccessible to network management applications (such as auto from operating in the switch Syntax: [no] snmpv3 enable Enable and disable the switch for access from SNMPv3 agents. This includes the creation of the initial user record [no] snmpv3 only messages [no] snmpv3 restricted-access to read only access show snmpv3 enable Displays the operating status of SNMPv3 show snmpv3 only Displays status of message reception of non-SNMPv3 show snmpv3 restricted-access Enabling SNMPv3 The snmpv3 enable command allows the switch to: Receive SNMPv3 messages Configure initial users ■ Restrict non-version3 messages to “read only” (optional) 407 N o t e :S N M P V e r s i o n I n i t i a l U s e r suser with SHA authentication and DES privacy Figure 14-1.Example of SNMP version 3 Enable CommandSNMPv3 Users Configure users in the User Table with the 408 show snmpv3 userthat requires either feature, the user will not be able to access the switch security group name to the list of known users with the snmpv3 user command Figure 14-2.Adding SNMPv3 Users and Displaying SNMPv3 Configuration 409 SNMPv3 User CommandsListing Users 410 Assigning Users to Groupssnmpv3 group Figure 14-3.Example of Assigning Users to Groups SNMPv3 Group CommandsSyntax: [no] snmpv3 group group <group_name user <user_name sec-model<ver1 | ver2c | ver3 Group Access Levels Each view allows you to view or modify a different set of MIBs ■Manager Read View – access to all managed objects 411 Manager Read View■Discovery View – Access limited to samplingProbe MIB Discovery View snmpv3 community 412 index_nameFigure 14-4.Assigning a Community to a Group Access Level 413 SNMP Community FeaturesSNMP level view, and either restricted or unrestricted write access compatible with your network Menu: Viewing and Configuring non-SNMPversion Communities To View, Edit, or Add SNMP Communities:1.From the Main Menu, Select: 6.SNMP Community Names 414 Figure 14-5.The SNMP Communities Screen (Default Values)2.Press [A] (for Add) to display the following screen: Add Figure 14-6.The SNMP Add or Edit Screen Need Help elp4.Press [Enter], then [S] (for Save) CLI: Viewing and Configuring SNMP Community Names “SNMP Notifications” on page 14-17) Syntax: show snmp-server [<community-string>] community-string 415 Figure 14-7.Example of the SNMP Community Listing with Two CommunitiesProCurve# show snmp-serverpublic 417 SNMP NotificationsSupported Notifications 418 ■Advance Traffic Management Guide:•Loop protection •Spanning Tree (STP, RSTP, MSTP) ■Access Security Guide: •MAC lockdown •MAC lockout •Uni-DirectionalLink Detection (UDLD) •Virus throttling ■Multicast and Routing Guide: •OSPF •PIM •Virtual Router Redundancy Protocol (VRRP) General Steps for Configuring SNMP Notifications To configure SNMP notifications, follow these general steps: •“SNMPv1 and SNMPv2c Traps” on page •“Configuring an SNMP Trap Receiver” on page •“Enabling SNMPv2c Informs” on page •“Configuring SNMPv3 Notifications” on page •“Enabling Link-ChangeTraps” on page •“Configuring the Source IP Address for SNMP Notifications” on page •“Displaying SNMP Notification Configuration” on page SNMPv1 and SNMPv2c Traps 419 Trap receivers:Fixed or hostSyntax: snmp-serverhost <ipv4-addr | ipv6-addr><community name 420 Table 14-1.Security Levels for Event Log Messages Sent as Trapswith an IP address of 10.28.227.130 to receive only "critical" event log messages, you can enter the following command: critical for the same management station traps and threshold traps (if configured) are still sent Enabling SNMPv2c Informs reached its destination be resent, based on the retry count value the inform notification Syntax: [no] snmp-serverhost <ipv4-addr | ipv6-addr><community name inform [retries <count>] [timeout <interval>]] count switch and allows you to configure options for sending SNMP inform requests retries: Maximum number of times to resend an inform 421 retries:request if no SNMP response is received. Default: before resending the inform request. Default: 15 seconds The retries and timeout values are not used to send trap requests 422 retriestimeout Figure 14-8.Display of SNMPv2c Inform ConfigurationConfiguring SNMPv3 Notifications 423 snmpv3 notifyno snmpv3 notify <notify_name snmpv3 targetaddress params taglist 424 snmpv3 targetaddressparams snmpv3 params taglist 425 snmpv3 params usersec-model msg-processing< sec-model< ver1 | ver2c | ver3 ver3 426 Figure 14-9.Example of an SNMPv3 Notification ConfigurationManaging Network Security Notifications ■“Configuring an SNMP Trap Receiver” on page ■“Configuring SNMPv3 Notifications” on page ■Dynamic IP Lockdown hardware resources consumed ■Link change notification 427 enable traps•login-failure-mgr sends a trap for a failed login with a manager password •password-change-mgr sends a trap when a manager password is reset traps 428 Figure 14-10.Display of Configured Network Security NotificationsEnabling Link-ChangeTraps link-changeSyntax: [no] snmp-serverenable traps link-change<port-list> [all] port-list Enter all to enable or disable link-changetraps on all ports on the switch Configuring the Source IP Address for SNMP Notifications 429 snmp serverresponse-source trap-sourcepv6 addr Default: Interface IP address dst-ip-of-request: 430 loopback<0-7 431 Figure 14-11.Display of Source IP Address ConfigurationDisplaying SNMP Notification Configuration Use the show snmp-server command to display the currently configured: ■Management stations (trap receivers) ■Settings for network security notifications and link-changetraps ■SNMP communities Syntax: show snmp-server 432 Figure 14-12.Display of SNMP Notification Configuration434 Advanced Management: RMONThe following RMON groups are supported: ■Ethernet Statistics (except the numbers of packets of different frame sizes) ■Alarm ■History (of the supported Ethernet statistics) ■Event Network Manager CLI-ConfiguredsFlow with Multiple InstancessFlow — sFlow agent — sFlow destination —Configuring sFlow Syntax: [no] sflow <receiver-instance>destination <ip-address> [udp-port-num] To disable an sFlow receiver/destination, enter no sflow <receiver-instance Syntax: sflow <receiver-instance>sampling <port-list><sampling rate Syntax: sflow <receiver-instance>polling <port-list><polling interval port or ports a polling interval of “0” using the no sflow <receiver-instance> command 435 no sflowViewing sFlow Configuration and Status status via the CLI Syntax: show sflow agent Syntax: show sflow <receiver instance> destination Syntax: show sflow <receiver instance> sampling-polling <port-list/range Displays status information about sFlow sampling and polling 436 show sflow agentProCurve# show sflow agent Version 1.3;HP;K.11.40 Agent Address Figure 14-13.Example of Viewing sFlow Agent InformationProCurve# show sflow 2 destination Destination Instance sflow Datagrams Sent Destination Address Receiver Port Owner Administrator, CLI-owned,Instance Timeout (seconds) Max Datagram Size Datagram Version Support Figure 14-14.Example of Viewing sFlow Destination InformationNote the following details: ■Destination Address remains blank unless it has been configured Destination Address Datagrams Sent Timeout437 instance[port-list] ProCurve# show sflow 2 sampling-polling A1-A4 Port | Sampling Rate Header Dropped Polling Interval | Enabled Samples Yes(2) Yes(1) No(1) Yes(3) No(3) The sampling and polling instances (noted in parentheses) coupled to a specific receiver instance are assigned dynamically, and so the instance 438 LLDP (Link-LayerDiscovery Protocol)Provides an extension to LLDP and is designed to support VoIP deployments enabled as a prerequisite to LLDP-MEDoperation An SNMP utility can progressively discover LLDP devices in a network by: Adjacent Device: Refer to “Neighbor or Neighbor Device” 439 Adjacent Device:Advertisement: See LLDPDU Active Port:LLDP: Link Layer Discovery Protocol: LLDP:•Switches covered in this guide: IEEE 802.1AB LLDP-Aware:LLDP Device: A switch, server, router, or other device running LLDP LLDP Device: 440 LLDP Neighbor:LLDPDU (LLDP Data Unit): LLDP-MED(Link Layer Discover Protocol Media Endpoint MIBten-digit seven-digits are a local telephone number Neighbor: See “LLDP Neighbor” Neighbor:Non-LLDPDevice: A device that is not capable of LLDP operation Non-LLDP Device: PD (Powered Device):802.3af-compliant PDs directly connected to the ports on the module TLV (Type-Length-Value): 441 General LLDP OperationPacket Boundaries in a Network Topology14-42) 442 Enable or DisableLLDP-MED Change the Frequency of LLDP Packet Transmission to Neighbor Devices Transmit and Receive Mode rxonly disable Remote Management Address Debug Logging debug lldp 444 Options for Reading LLDP Information Collected by the Switch■Using the walkmib command to display a listing of the LLDP MIB objects LLDP and LLDP-MEDStandards CompatibilityThe operation covered by this section is compatible with these standards: ■IEEE P802.1AB ■RFC 2922 (PTOPO, or Physical Topology MIB) ■RFC 2737 (Entity MIB) ■RFC 2863 (Interfaces MIB) ANSI/TIA-1057/D6 445 LLDP Operating RulesPort Trunkingxxx.xxx.xxx.xxx: This IP address is not configured or is a DHCP address Spanning-Tree Blocking 802.1X Blocking 446 Configuring LLDP Operationshow lldp config [no] lldp run lldp refresh-interval lldp holdtime-multiplier lldpTxDelay lldpReinitDelay lldp enable-notification lldpnotificationinterval lldp admin-status< txonly | rxonly | tx_rx | disable lldp config < port-list > IpAddrEnable lldp config < port-list > basicTlvEnable Viewing the Current Configuration Displaying the Global LLDP, Port Admin, and SNMP Notification Status 447 show lldp configFigure 14-16.Example of Viewing the General LLDP Configuration 448 Displaying Port Configuration Details. This command displays the portspecific configuration, including Syntax show lldp config < port-list Displays the LLDP port-specificconfiguration for all ports in Figure 14-17.Example of Per-PortConfiguration DisplayConfiguring Global LLDP Packet Controls Enabling LLDP operation (the default) causes the switch to: Use active Syntax [ no ] lldp run For example, to disable LLDP on the switch: ProCurve(config)# no lldp run Syntax lldp refresh-interval< 5 - 32768 Note: The refresh-interval must be greater than or equal to 449 delay-interval450 holdtime-multiplierholdtime-intervalProCurve(config)# lldp holdtime-multiplier2 Changing the Delay Interval Between Advertisements Generated bySyntax setmib lldpTxDelay.0 -i< 1 - 8192 451 Inconsistent valueFigure 14-18.Example of Changing the Transmit-DelayIntervalSyntax setmib lldpReinitDelay.0 -i< 1 - 10 ProCurve(config)# setmib lldpreinitdelay.0 Configuring SNMP Notification Support 452 Enabling LLDP Data Change Notification for SNMP Trap ReceiversSyntax [ no ] lldp enable-notification< port-list port-list For example, this command enables SNMP notification on ports 1 - 5: ProCurve(config)# lldp enable-notification Syntax setmib lldpnotificationinterval.0 -i< 1 - 3600 Configuring Per-PortTransmit and Receive Modes Syntax lldp admin-status< port-list > < txonly | rxonly | tx_rx | disable 453 tx_rx454 Mandatory Data■Chassis Type (TLV subelement) ■Chassis ID (TLV) ■Port Type (TLV subelement) ■Port ID (TLV) Configuring a Remote Management Address for Outbound LLDPSyntax [ no ] lldp config < port-list > ipAddrEnable < ip-address 455 Optional Data■port description (TLV) ■system name (TLV) ■system description (TLV) ■system capabilities (TLV) •system capabilities Supported (TLV subelement) •system capabilities Enabled (TLV subelement) ■port speed and duplex (TLV subelement) Syntax: [ no ] lldp config < port-list > basicTlvEnable < TLV-Type port_descr (Default: Enabled) system_name system_descr 456 Configuring Support for Port Speed and DuplexAdvertisements Syntax: [ no ] lldp config < port-list > dot3TlvEnable macphy_config 457 LLDP-MED (Media-Endpoint-Discovery)■plug-and-playprovisioning for MED-capable,VoIP endpoint devices simplified ■detailed VoIP endpoint data inventory readable via SNMP from the switch 458 Figure 14-19.Example of LLDP-MEDNetwork ElementsLLDP-MED Endpoint Support459 able to use the following network policy elements configured on the client port•voice VLAN ID •802.1p (Layer 2) QoS •Diffserv codepoint (DSCP) (Layer 3) QoS ■discover and advertise device location data learned from the switch ■support emergency call service (ECS—suchas E911, 999, and 112) hardware revision serial number • asset ID firmware revision manufacturer name software revision model name ■support the fast start capability endpoints, and is not designed to support links between network infrastructure devices, such as switch-to-switchor switch-to-routerlinks endpoint device belongs to one of the following three classes: 460 Operational SupportLLDP-MEDTopology Change Notification 462 LLDP-MEDFast Start Control(Range: 1 - 10 seconds; Default: 5 seconds) Advertising Device Capability, Network Policy, PoE Status and Location Data ■LLDP-MEDcapabilities: This TLV enables the switch to determine: •whether a connected endpoint device supports LLDP-MED •which specific LLDP-MEDTLVs the endpoint supports •the device class (1, 2, or 3) for the connected endpoint This TLV also enables an LLDP-MEDendpoint to discover what LLDP MED TLVs the switch port currently supports ■PoE (MED Power-over-Ethernet) ■physical location data — page 463 dot3TlvEnable macphy_config command on pageNetwork Policy Advertisements. Network policy advertisements are Network Policy Advertisementsintended for real-timevoice and video applications, and include these TLV subelements: ■ Layer 2 (802.1p) QoS ■ Layer 3 DSCP (diffserv code point) QoS ■ Voice VLAN ID (VID) network policy TLVs: operation (vlan < vid > voice) voice■ If there are multiple voice VLANs configured on a port, LLDP-MED advertises the voice VLAN having the lowest VID the switch port to have a tagged voice VLAN membership.) ■ If a given port does not belong to a voice VLAN, then the switch does not advertise the VLAN ID TLV through this port using a RADIUS server and 802.1X or MAC authentication. (Web authentication does not apply to VoIP telephones and other telecommunications devices that are not capable of accessing the switch through a Web browser.) The QoS and voice VLAN policy elements can be statically configured with the following CLI commands: vlan < vid > voice vlan < vid > < tagged | untagged > < port-list int < port-list > qos priority < 0 - 7 vlan < vid > qos dscp < codepoint codepoint “Quality of Service (QoS): Managing Bandwidth More Effectively” in the Advanced Traffic Management Guide for your switch 464 Enabling or Disabling medTlvEnable. In the default LLDP-MEDconfiguration, the TLVs controlled by medTlvEnable are enabled Syntax: [ no ] lldp config < port-list > medTlvEnable < medTlv medTlv Enables or disables advertisement of the following TLVs on the specified ports: •device capability TLV •configured network policy TLV configured location data TLV (Refer to •current PoE status TLV (Default: All of the above TLVs are enabled.) capabilities This TLV enables the switch to determine: •which LLDP-MEDTLVs a connected endpoint can discover •the device class (1, 2, or 3) for the connected endpoint (Default: enabled) 466 PoE Advertisementspower type: power source power priority: power value: show lldp info remote-device< port-list show power brief < port-list show power < port-listConfiguring Location Data for LLDP-MEDDevices civic address: 467 ELIN (Emergency Location Identification Number):coordinate-based location:Syntax: [ no ] lldp config < port-list > medPortLocation < Address-Type Address-Type civic-addr civic-addr www.iso.org0:Location of DHCP server 1:Location of switch 2:Location of LLDP-MEDendpoint (recommended application) This field is required in a civic-addr command. —Continued— 468 — Continued—•3 = city •6 = street (name) •25 = building name (Range: 0 - 255) For a sample listing of CA-TYPE specifiers, refer to table 14-4on page elin-addr< emergency-number (Range: 1-15numeric characters) 469 Configuring Coordinate-BasedLocations. Latitude, longitude, andthe application. A further source of information on this topic is RFC 3825 Dynamic Host Configuration Protocol Option for Coordinate-based Location Configuration Information dependent. Refer to the documentation provided with the endpoint device 470 Table 14-4.Some Location Codes Used in CA-TYPEFieldsLocation Element Code Figure 14-20.Example of a Civic Address Configuration 471 Displaying Advertisement Data478 LLDP Operating NotesNeighbor Maximum 479 LLDP Packet Forwarding:LLDP advertises only one IP address even if multiple IP addresses are configured by > ipAddrEnable 802.1Q VLAN Information Effect of 802.1X Operation Neighbor Data Can Remain in the Neighbor Database After the Mandatory TLVs Determining the Switch Port Number Included in Topology Change Notification Traps Figure 14-27.Matching Internal Port Numbers to External Slot/Port Numbers 480 LLDP and CDP Data ManagementLLDP and CDP Neighbor Data 482 CDP Operation and CommandsSNMP utility enabled/disabled both globally on the switch and on a per-portbasis 483 Syntax: show cdpLists the switch’s global and per-portCDP configuration The following example shows the default CDP configuration Figure 14-28.Example of Show CDP with the Default CDP Configuration485 Syntax: [no] cdp runEnables or disables CDP read-onlyoperation on the switch. (Default: Enabled) For example, to disable CDP read-onlyon the switch: ProCurve(config)# no cdp run When CDP is disabled: ■show cdp neighbors displays an empty CDP Neighbors table displays Global CDP information Enable CDP [Yes]: No Syntax: [no] cdp enable < [e] port-list For example, to disable CDP on port A1: ProCurve(config)# no cdp enable a1 487 Redundancy (Switches 8200zl)491 Using Redundant Management499 Management Module SwitchoverEvents that Cause a SwitchoverMM Rese MM Shutdown boot active When Switchover Will not Occur Consequences of Switchover 500 Resetting the Management ModuleMM Reset Figure 15-8.The MM Reset Button on the 8200zl Management Module 501 Hotswapping Management ModulesHotswapping Out the Active Management ModuleMM Shut down Figure 15-9.The MM Shutdown ButtonWhen the Standby Module is not Available green to indicate it is OK to hotswap out the active management module If you remove the active management module without pressing the MM Shutdown button, any files that may have been in the process of transfer is aborted 502 Hotswapping In a Management Module■ The hotswapped module must pass selftest no redundancy management-module Software Version Mismatch Between Active and Hotswapped Module2. The module that was hotswapped in then reboots if necessary to primary or secondary flash, whichever matches (if it doesn’t match already) 503 Downloading a New Software VersionFile Synchronization after DownloadingTable 15-1.Example of Upgrading Software Version K.12.03 to Version K.12.04 504 Potential Software Version MismatchesAfter DownloadingFigure 15-10.Booting the Standby Management Module to Secondary Flash 507 Turning Off Redundant ManagementDisabling Redundancy with Two Modules PresentNext Boot” on page in the event of a hardware failure of the first management module Figure 15-12 shows that redundant management was disabled Figure 15-12.Results of Disabling Redundancy 508 Disabling Redundancy With Only One Module PresentProCurve(config)# redundancy management-module ProCurve(config)# redundancy active-managementstandby The standby management module becomes the active management module 509 Displaying Management Information515 Existing CLI Commands Affected by Redundant ManagementSeveral existing commands have changes related to redundant management Boot CommandThe boot command has these options Figure 15-23.Example Showing boot Command with Default Flash set to Secondaryfiles can be specified as the default boot policy. For more information on multiple configuration files and how they are used, see “Multiple this guide 517 Setting the Default Flash for BootSyntax: boot set-defaultflash <primary | secondary primary: secondary: 518 Reload Command520 Additional Commands Affected by RedundantManagementThe other existing commands operate with redundant management as shown below 522 Using the Web Browser for RedundantManagementUsing the ProCurve Web Browser Interface Identity Page 523 Overview Page■Which module is the active module and which is the standby module ■Version of software running on each management module ■The SystemUp Time since the last reboot Redundancy Status Page 524 Device View Page 526 Management Module LED BehaviorActive (Actv) LED BehaviorFigure 15-30.The Actv LED on the Management Module Table 15-2.Actv (Active) LED Behavior for Management Modules Standby Led Behavior 527 Logging MessagesLog FileSyntax: show logging Displays log events show loggingAn example of the log file listing is shown in Figure Figure 15-31.Log File Listing 528 Crash Filescrash-log and copy crash-data slot-id: Displaying Saved Crash Information 530 Notes on How the Active Module is Determined532 Event Log Messages535 File Transfers536 TFTP: Copying a Software Image to a Remote Host . . . . . . . . . A-27Serially Connected PC or UNIX Workstation . . . . . . . . . . . . . . . A-27 USB: Copying a Software Image to a USB Device . . . . . . . . . . . A-28 USB: Copying a Configuration File to a USB Device . . . . . . . . . A-34 USB: Copying a Configuration File from a USB Device . . . . . . A-34 Xmodem: Uploading an ACL Command File from a Serially USB: Uploading an ACL Command File from a USB Device . . A-37 A-2 537 A-3538 Downloading Switch SoftwareA-4 539 General Software Download RulesUsing TFTP To Download Software from a Server■The TFTP server is accessible to the switch via IP Before you use the procedure, do the following: A-5 Menu: TFTP Download from a Server to Primary Flash Note that the menu interface accesses only the primary flash In the console Main Menu, select 540 Download OSFigure A-1.Example of a Download OS (Software) Screen (Default Values) TFTP Server ecute Figure A-2.Example of the Download OS (Software) Screen During a Download 541 Validating and writing system software to FLASHb.Check the Firmware revision line Figure A-3.Example of Message for Download Failure 542 show log tftpRemote File Name 543 Figure A-4.Example of the Command to Download an OS (Switch Software)Validating and Writing System Software to FLASH …Boots from the selected flash (For more on these commands, refer to “Rebooting the Switch” on page 6-19.) To confirm that the software downloaded correctly, execute show systemreboots the entire system A-9 Enabling TFTP Syntax: [no] tftp <client | server [listen <oobm|data|both>] • For switches that have a separate out-of-bandmanagement to specify whether transfers take place through the out-of band management (oobm) interface, the data interface, or both. Refer to Appendix I, “Networked Out-of-Band Management (OOBM)” in this guide for more information on out-of-bandmanagement To disable all TFTP client or server operation on the switch except for the auto-TFTPfeature, enter the no tftp <client | server> command 544 no tftpclient serverMenu interface “Download OS” screen become unavailable switch’s configuration Guide for your switch A-10 Using Auto-TFTP 545 boot system flash primarySyntax: auto-tftp <ip-addr > <filename auto tftp 546 Using Secure Copy and SFTPSCP channels third-partyapplication software client that supports the SFTP and/or SCP functions. Some examples of software that supports SFTP and SCP are differences in the way these clients work, so be sure you also download the documentation and it connects to a standalone TFTP server or another ProCurve switch upgrade multiple switches simultaneously and securely tunnel, some of the commands are the same as FTP commands. Certain that create files or folders. If you try to issue commands such as create or createremove using SFTP the switch server returns an error message removeonly with SSH version 2 (SSH v2) use. Some examples are: A-12 rcp 547 The SCP/SFTP ProcessDisable TFTP and Auto-TFTPfor Enhanced Security ; J8697 Configuration Editor; Created on release #K.11.XX hostname "ProCurve" module 1 type J8702A module 2 type J702A vlan name "DEFAULT_VLAN" untagged A1-A24,B1-B24 ip address 10.28.234.176 255.255.240.0 exit ip ssh filetransfer no tftp-enablepassword manager password operator 548 Figure A-5.Example of Switch Configuration with SFTP Enabled549 Figure A-6.Using the Menu Interface To Disable TFTPWhile SFTP is enabled, TFTP and SFTP must be disabled before enabling tftp SFTP must be disabled before enabling auto-tftp Command Options If you need to enable SSH v2 (which is required for SFTP) enter this command: ProCurve(config)# ip ssh version A-15 To confirm that SSH is enabled type in the command ProCurve(config)# show ip ssh 550 $HOME/.ssh/known_hostsSCP/SFTP Operating Notes IP file transfer not enabled on the switch A-16 Troubleshooting SSH, SFTP, and SCP Operations SFTP clients will print out on their console in use to display them on the user console Broken SSH Connection. If an ssh connection is broken at the wrong 552 Broken SSH Connection(SSH, SCP, or SFTP) A-18 553 ssh: read error Bad file number, session aborted I 0101/90 00:06:11 00636 ssh: sftp session from ::ffff:10.0.12.35 W 01/01/90 00:06:26 00641 ssh: 01/90 00:09:54 00637 ssh: scp session from ::ffff:10.0.12.35 W 01/01/90 ssh: scp read error Bad file number, session aborted The Bad file number is from the system error value and may differ read was closed as the device read was about to occur will not allow the SCP or SFTP session to start. Depending on the client Received disconnect from 10.0.12.31: 2: Flash access in progress lost connection session is started from a client before the previous client session has been session): Received disconnect from 10.0.12.31: 2: Wait for previous session to complete session or one SCP session at a time. If a second session is initiated (for then the following error message may appear on the client console: session running A-19 554 Using Xmodem to Download Switch Software From a PC or UNIX WorkstationThe switch is connected via the Console ■The switch software is stored on a disk drive in the PC Send File ransferMenu: Xmodem Download to Primary Flash 1.From the console Main Menu, select 7.Download OS XMODEM Press enter and then initiate Xmodem transfer from the attached computera.Click on Transfer, then Send File Transferb.Type the file path and name in the Filename field c.In the Protocol field, select Xmodem Xmodemd.Click on the [Send] button A-20 555 Continue reboot of system? : No1.General System Information Firmware revision 556 Using USB to Transfer Files to and from the SwitchAuxiliary Port 557 dir■ The USB port supports connection to a single USB device. USB hubs to add more ports are not supported Release Notes for information on supported devices Using USB to Download Switch Software Figure A-7.Example of the Command to Copy Switch Software from USB Validating and Writing System Software to the Filesystem.… 558 Switch-to-SwitchDownload561 Using PCM+ to Update Switch Software562 Copying Software ImagesUsing the CLI commands described in this section, you can copy software images from the switch to another device using tftp, xmodem, or usb flash, refer to Chapter 6, “Switch Memory and Configuration” TFTP: Copying a Software Image to a Remote Host Syntax: copy flash tftp < ip-addr > < filename > [oobm] This command copies the primary flash image to a TFTP port, the oobm parameter specifies that the transfer will be through the out-of-bandmanagement interface. If this do not have a separate out-of-bandmanagement port. Refer to for more information on out-of-bandmanagement of 10.28.227.105: ProCurve# copy flash tftp 10.28.227.105 k0800.swi where k0800.swi is the filename given to the flash image being copied Xmodem: Copying a Software Image from the Switch to a Serially Connected PC or UNIX Workstation or UNIX workstation Syntax: copy flash xmodem < pc | unix switch to a PC or Unix workstation A-28 For example, to copy the primary flash image to a serially connected PC: 1.Execute the following command: Procurve# copy xmodem flash Press ‘Enter’ and start XMODEM on your host 2.After you see the above prompt, press [Enter] 3.Execute the terminal emulator commands to begin the file transfer USB: Copying a Software Image to a USB Device Syntax: copy flash usb < filename For example, to copy the primary image to a USB flash drive: 1.Insert a USB device into the switch’s USB port 2.Execute the following command: Procurve# copy flash usb k0800.swi 563 Transferring Switch ConfigurationsUsing the CLI commands described in this section, you can copy switch replace an ACL in the switch configuration described in the section on Using Secure Copy and SFTP on page A-12 keys, and other security credentials in the running config file. For more in the Access Security Guide for your switch copy config < filename > tftp < ip-addr > < remote-file > [ pc | unix ] [oobm] 564 sw8200ProCurve# copy startup-configtftp 10.28.227.105 d:\configs\sw8200 A-30 ProCurve# copy tftp startup-config10.28.227.105 d:\configs\sw8200 TFTP: Copying a Customized Command File to a Switch 565 show-techshow tech customA-31 Syntax: copy tftp show-tech<ipv4 or ipv6 address> <filename> [oobm] Copy a customized command file to the switch 566 Figure A-10.Example of Using the copy tftp show-techCommand to Upload aCustomized Command FileSyntax: show tech custom Executes the commands found in a custom file instead of the hard-codedlist Figure A-11.Example of the show tech custom CommandA-32 568 A-34569 USB: Copying a Configuration File to a USB DeviceFor example, to copy the startup configuration file to a USB flash drive: Procurve# copy startup-configusb procurve-config procurve-config USB: Copying a Configuration File from a USB Device Syntax: copy usb startup-config< filename For example, to copy a configuration file from a USB device to the switch: Procurve# copy usb startup-config procurve-config where procurve-config is the name of the file to copy At the prompt, press A-35 570 Transferring ACL Command FilesTFTP: Uploading an ACL Command File from a TFTP Server Syntax: copy tftp command-file< ip-addr > < filename.txt > < unix | pc > [oobm] filename <ip-addr > = The IP address of a TFTP server available to the switch [oobm] ■Creates a new ACL ■Adds to an existing ACL A-36 For example, suppose you: 1.Created an ACL command file named vlan10_in.txt to update an existing ACL 571 vlan10_in.txt2.Copied the file to a TFTP server at ProCurve(config)# copy tftp command-file18.38.124.16 vlan10_in.txt pc The switch displays this message: Running configuration may change, do you want to continue [y/n] To continue with the upload, press the [Y] key. To abort the upload, press the Figure A-12.Example of Using the Copy Command to Download and Configure an ACLA-37 572 Xmodem: Uploading an ACL Command File from a SeriallyConnected PC or UNIX Workstation Syntax: copy xmodem command-file< unix | pc USB: Uploading an ACL Command File from a USB Device Syntax: copy usb command-file< filename.txt > < unix | pc <unix | pc > = The type of workstation used to create the text file 2.Copied the file to a USB flash drive A-38 ProCurve(config)# copy usb command-filevlan10_in.txt pc Event Log: Copies the switch’s Event Log into a file on the destination device Crash Data: Crash Log: ■Remote Host via TFTP ■Physically connected USB flash drive via the switch’s USB port 573 USB■Serially connected PC or UNIX workstation via Xmodem XmodemA-39 Copying Command Output to a Destination Device cli-command filepath filename 574 Figure A-13.Example of Sending Command Output to a File on an Attached PCA-40 Copying Event Log Output to a Destination Device copy event-logxmodem <filename For example, to copy the event log to a PC connected to the switch: 575 Figure A-14.Example of Sending Event Log Content to a File on an Attached PCCopying Crash Data Content to a Destination Device A-41 copy crash-data [<slot-id | mm>] xmodem For example, to copy the switch’s crash data to a file in a PC: 576 Figure A-15.Example of Copying Switch Crash Data Content to a PCWhen you are using redundant management, the 579 Enabling or Disabling the USB PortFigure A-17.Example of show usb-portCommand Output on version K.13.59 and later Figure A-18.Example of show usb-portCommand Output on version K.14.XX 580 Behavior of Autorun When USB Port is DisabledSoftware Versions K.13.XX Operation Software Version K.14.XX Operation A-46 581 Using USB AutorunThe overall USB autorun solution requires the following components: The network management application ProCurve Manager Plus ■A non-proprietaryUSB flash drive How It Workssteps 1, 2, and 7 require an upcoming update to PCM+ as described above Creating the AutoRun file in PCM+, includes the following steps: a.specify the target device or devices b.create the CLI script to be executed on the target device(s) c.determine if the file will be signed and/or encrypted A-47 582 2.Deploy the AutoRun file to a USB flash drive(If the AutoRun file has been signed or encrypted) Enable 5.Insert the USB flash drive into the switch’s USB auxiliary port 6.Remove the USB device from the USB port (Optional) Transfer the ‘result file’ and ‘report file’ to a Security Considerations ■Disable autorun by setting an operator or manager password ■Disable or re-enablethe USB autorun function via the CLI A-48 Troubleshooting Autorun Operations You can verify autorun operations by checking the following items: 583 AutoRun Status FilesReport file(s) (.xml Result file(s) (.txt Manager documentation for details) been executed after the USB flash drive was removed from the switch A-49 Event Log or Syslog 584 Configuring Autorun on the SwitchSyntax: [no] autorun [encryption-key <key-string>| secure-mode] Enables/disables USB autorun on the switch Use the secure-mode keyword to enable or disable secure mode for autorun Default: Enabled (or Disabled if a password has been set) Enabling Secure Mode autorun encryption keycontain the private key and the matching public key in a X509 certificate A-50 Operating Notes and Restrictions 585 crypto key zeorize autorunAutorun and Configuring Passwords autorun 586 Viewing Autorun Configuration Information587 Monitoring and Analyzing Switch Operation588 B-26B-27 B-29 B-32 B-33 B-34 Remote Mirroring Endpoint and Intermediate Devices B-35 B-36 Migration to Release K.14.01 or Greater Using the Menu or Web Interface To Configure Local Mirroring B-38 Menu and Web Interface Limits B-39 B-42 B-43 B-45 B-48 2. Configure a Mirroring Destination on a Remote Switch B-49 3. Configure a Mirroring Session on the Source Switch B-51 4. Configure the Monitored Traffic in a Mirror Session B-54 B-55 Selecting All Inbound/Outbound Traffic to Mirror B-56 Port Interface with Traffic Direction as the Selection Criteria B-58 Selecting Inbound Traffic Using an ACL (Deprecated) Selecting Inbound/Outbound Traffic Using a MAC Address B-62 Selecting Inbound Traffic Using Advanced B-65 Classifier-BasedMirroring Configuration B-66 B-2 590 Status:■Counters: Display details of traffic volume on individual ports (page B-15) Counters: Event Log Configurable trap receivers: Port monitoring (mirroring):Link test and ping test—analysistools in troubleshooting situations—are page C-62 591 Status and Counters Data614 Traffic MirroringTraffic mirroring provides the following benefits: ■Allows you to monitor the traffic flow on specific source interfaces Mirroring destinations 615 C o n f i g u r a t i o n N o t e sTr a f f i c S e l e c t i o n Selecting mirrored trafficinbound and outbound Direction-based inbound or outbound inbound only K.14.01 or greaterThe following commands have been deprecated: mesh ■vlan < vid-# > monitor ip access-group <acl-name> in mirror < 1 - 4 | name-str K.13 616 Mirroring Terminologylocal mirroring session A remote mirroring session means that: means that: •The monitored interface (A1) and exit port (B7) are on different switches B-30 617 Figure B-23.Local and Remote Sessions Showing Mirroring TermsDestination : Direction-Based Mirroring: Exit Port: 618 IDS:ing session are on the same switch source switch on which the inbound and/or outbound traffic to be mir rored originates, configured with one of the interface monitor or vlan interface monitorSession” on page B-55) Remote Mirroring: The monitored (source) interface and exit port in a Remote Mirroring:must always configure the IP destination address and exit port (the by using the following commands: - On the remote (destination) switch: mirror endpoint ip <src-ip > <src-udp-port > < dst-ip > <exit-port - On the local (source) switch: mirror <session > remote ip <src-ip > <src-udp-port > <dst-ip remote ipon the Source Switch” on page B-52 traffic to be mirrored originates. See also Monitored Interface 619 Mirrored Traffic DestinationsLocal Destinations Remote Destinations remote ■ 3500yl ■ 5400zl ■ 6200yl ■ 8200zl device connected to an exit port. In a remote mirroring session which uses Monitored Traffic SourcesYou can configure mirroring for traffic entering or leaving the switch on: Ports and static trunks: Meshed ports: 620 Criteria for Selecting Mirrored TrafficMirroring Session Limits Mirroring Sessions■You can reduce the risk of oversubscribing a single exit port by: •Directing traffic from different session sources to multiple exit ports Configuring an exit port with a higher bandwidth than the monitored source port ■You can segregate traffic by type, direction, or source 621 Mirroring ConfigurationTable B-1.Mirroring Configuration Options622 Using the CLI, you can configure all mirroring options on a switchexcept Remote Mirroring Endpoint and Intermediate Devices The exit port for a mirroring destination must be an individual port, and ■A switch mirrors traffic on static trunks, but not on dynamic LACP trunks 623 Migration to Release K.12.xx■A legacy mirroring configuration on a port or VLAN interface maps to session Traffic-selection and ■In a legacy mirroring configuration, a local exit port is applied to session to boot the switch from a legacy (pre-K.12.xx)software version after using configuration before booting with the earlier software traffic adds a 54-byteheader to each mirrored frame. If a resulting frame information, refer to “Maximum Supported Frame Size” on page B-92 mirroring frames will be dropped. Also, remote mirroring does not allow downstream devices in a mirroring path to fragment mirrored frames Migration to Release K.14.01 or Greater If a switch is running software release K.12.xx, you must first upgrade to release K.13.xx before migrating the switch to release K.14.01 or greater that is running release K.13.xx and has one or more mirroring sessions is mapped to a class and policy configuration based on the ACL The new mirroring policy is automatically configured on the same port or B-37 ProCurve(config)# show run ip access-listextended "100 10 permit icmp 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 0 exit mirror 1 port C1 interface C1 monitor ip access-group"100" In mirror 1 exit 624 Figure B-24.Mirroring Configuration in “show run” Output in Release K.13.xxmirror name "test-10"remote ip 10.10.10.1 8010 class ipv4 “100MirrorClass” 10 match icmp 0. 255.255.255.255 0.0.0.0 255.255.255.255 policy mirror “100MirrorPolicy” service-policy"100MirrorPolicy" In exit 625 Using the Menu or Web Interface To Configure Local MirroringMenu and Web Interface Limits ■any combination of source port(s), trunk(s), and/or a mesh ■one static, source VLAN interface The Menu and Web interfaces also have these limits: automati cally reconfigures the session Configuration Steps 626 3. Network Monitoring PortFigure B-26.The Default Network Mirroring Configuration Screen Monitoring Port 627 Figure B-27.How To Select a Local Exit PortPorts: Use for mirroring ports, static trunks, or the mesh Ports:VLAN: Use for mirroring a VLAN 7.Do one of the following: •If you are mirroring ports, static trunks, or the mesh, go to step •If you are mirroring a VLAN: i. Press [Tab] or the down arrow key to move to the VLAN field [Tab]ii.Use the Space bar to select the VLAN you want to mirror iii.Go to step B-41 Use the down arrow key to move the cursor to the 628 Action629 CLI: Configuring Local and Remote Mirroring■The same switch as the source interface (local mirroring) ■ “Local Mirroring Overview” on page B-44 ■ “Remote Mirroring Overview” on page B-46 (The remote switch must be chapter.) “1. Determine the Mirroring Session and Destination” on page B-49 “3. Configure a Mirroring Session on the Source Switch” on page B-52 “4. Configure the Monitored Traffic in a Mirror Session” on page B-55: • “Selecting All Inbound/Outbound Traffic to Mirror” on page B-57 (Deprecated in release K.14.01 and greater) B-63 • “Selecting Inbound Traffic Using Advanced Classifier-BasedMirror ing” on page B-66 configure the exit switch for a remote mirroring session before configuring the source switch for the same session Local Mirroring Overview 1. Determine the session and local destination port: • Session number (1-4)and (optional) alphanumeric name 2. Enter the 630 namecommand to configure the session B-44 632 Configure a Mirroring Policy to Select Inbound Traffic (Page B-66)class < ipv4 | ipv6 > < classname classname [no] [seq-number]< match | ignore > < ip-protocol > < source-address precedence tos ip-dscp policy mirror < policy-name [no] [seq-number]class < ipv4 | ipv6 > <classname> action mirror <ses seq-number ses sion [action mirror < session > ... ] [no] default-classaction mirror < session-# port/trunk Configure MAC-basedCriteria to Select Traffic (Page B-63)[no] monitor mac < mac-addr > < src | dst | both > mirror < session Enter the monitor mac mirror command at the global configuration level monitor mac mirrorRemote Mirroring Overview a.Source VLAN or subnet IP address on the source switch b.Destination VLAN or subnet IP address on the destination switch c.Random UDP port number for the session (7933-65535) Requirement 633 Caution634 Configure the Mirroring Destination on a Remote Switch (Page B-50):IP Address and UDP Port on Source Switch IP Address and Exit Port on Remote Switchmirror endpoint ip > port The mirror endpoint ip command configures: ■The IP address of the source switch to use in the session ■The IP address and exit-portnumber on the remote (endpoint) switch Configure the Mirroring Source on the Local Switch (Page B-52) no mirror <1 - 4 Configure ACL Criteria to Select Inbound Traffic (Page B-62)mirror < 1 - 4 | name-str > [< 1 - 4 | name-str > ... ] 635 1. Determine the Mirroring Session and Destinationor leaves the source switch ■ The unique UDP port number to use for the session on the source switch (The recommended port range is from 7933 to 65535.) these port numbers for mirroring can result in an interruption of other IP point) switch and sent to the device connected to the remote exit port 636 2.Configure a Mirroring Destination on a Remote SwitchConfiguring a Destination Switch in a Remote Mirroring SessionB-50 no mirror endpoint ip < src-ip > < src-udp-port > < dst-ip This command is used on a destination switch to configure the remote endpoint of a mirroring session. The command uniquely associates the mirrored traffic from the desired session on a monitored source with a remote exit port on the destination switch. You must use the same set of source and destination parameters you when configure the same session on both the source and destination switches information The no form of the command deletes the mirroring endpoint for the configured session on the remote destination switch Caution: Do not remove the configuration of a remote 637 Caution:mirroring endpoint support for a given session if there are source switches currently configured to mirror traffic to the endpoint address you configure on the source switch for the remote session — Continued — src-udp-port <src udp-port dst-ip 638 3.Configure a Mirroring Session on the Source SwitchB-52 For a local mirroring session, enter the 639 mirror port“1. Determine the Mirroring Session and Destination” on page B-49 Syntax: mirror < 1 - 4 > port < exit-port-# > [name < name-str >] no mirror < 1- 4 This command assigns the exit port to use for the specified mirroring session, and must be executed from the global configuration level The no form of the command removes the mirroring session and any mirroring source previously assigned to that session. To preserve the session while deleting a mirroring source assigned to it, refer to the no command descriptions under “4. Configure the Monitored Traffic in a Mirror Session” on page B-55 < 1 - 4 >: Identifies the mirroring session created by this < 1 - 4command. (Multiple sessions on the switch can use the same exit port.) to identify the session (up to 15 characters in length) session. This is the port to which a traffic analyzer or IDS is connected Remote Switch” on page B-50 B-53 640 src-ip641 4.Configure the Monitored Traffic in a Mirror SessionTraffic Selection Options ■Interface type •Port, trunk, and/or mesh •VLAN •Switch (global configuration level) ■Traffic direction and selection criteria •All inbound and/or outbound traffic on a port or VLAN interface Only inbound IP traffic selected with an ACL (deprecated in software release 642 K.14.01 and greaterOnly inbound IPv4 or IPv6 traffic selected with a ■“Selecting All Inbound/Outbound Traffic to Mirror” on page B-57 ■“Selecting Inbound Traffic Using an ACL (Deprecated)” on page B-62 ■“Selecting Inbound/Outbound Traffic Using a MAC Address” on page B-63 “Selecting Inbound Traffic Using Advanced Mirroring-SourceRestrictions ■Multiple port and trunk, and/or mesh interfaces ■One VLAN ■One classifier-basedpolicy 643 Selecting All Inbound/Outbound Traffic to MirrorPort Interface with Traffic Direction as the Selection Criteria port/trunk/mesh 644 monitor all < in | out | both >: For the interface specified byin: Mirrors entering traffic out: Mirrors exiting traffic outboth: Mirrors traffic entering and exiting monitor all mirror < 1 - 4 | interface a1 monitor all in mirror 1 2 1 - 4 [no-tag-added]:Untagged Mirrored Packets 645 no-tag-addedFigure B-28.Mirroring Commands with the no-tag-addedOptionProCurve# show monitor The MIB object hpicfBridge- DontTagWithVlan is used to implement the no-tag-added option, as shown below: hpicfBridgeDontTagWithVlan OBJECT-TYPESYNTAX INTEGER enabled(1) disabled(2) MAX-ACCESS read-write STATUS current DESCRIPTION B-59 646 Operating NotesCannot monitor more than one logical port with no-tag-addedoption 647 vlanUses the direction of traffic on the specified to select traffic to mirror. Refer to the syntax description on B-57 (If you enter the B-96.) asession, refer to “Mirroring-SourceRestrictions” on page B-56 648 Selecting Inbound Traffic Using an ACL (Deprecated)649 Selecting Inbound/Outbound Traffic Using a MAC Address650 srcdest no monitor mac dest mirror monitor mac mac-addr 651 mirror 1 2 3 traffsrc4[name R e s t r i c t i o n s monitor mac 111111-222222src mirror monitor mac 111111-222222dest mirror monitor mac src mirror 3 monitor mac 652 Selecting Inbound Traffic Using AdvancedClassifier-BasedMirroring■Support for mirroring both IPv4 and IPv6 traffic The ability to 653 ■The mirroring of outbound traffic exiting the switch■The use of meshed ports as monitored (source) interfaces If a mirroring session is configured to use a Classifier-BasedMirroring Configuration B-67 Create an IPv4 or IPv6 traffic class using the 654 Context:Syntax: [no] class < ipv4 | ipv6 > <classname ignore default-class 656 sessionPrerequisite class action session-number RestrictionMirroring is not executed on packets that match ignore criteria in a class B-70 Context: Policy configuration 657 actionAdvanced Traffic Manage ment Guide a port or VLAN interface, the switch immediately starts to use the traffic selection criteria and exit port to mirror traffic to the destination device connected to each exit port mance may be adversely affected by the stream of mirrored traffic B-71 The following restrictions apply to a mirroring service policy: ■Only one mirroring policy is supported on a port or VLAN interface 658 no interfaceno vlan a1, b4, d3 a1-a5 659 ■show class < class-name■show policy < mirror-policy-name show policy ■show policy resources show statistics policyvlan id Classifier-BasedMirroring Restrictions ■A mirroring policy is supported only on inbound IPv4 or IPv6 traffic Only one ■You can enter multiple class action mirror statements in a policy class action mirror•You can configure only one mirroring session (destination) for each class •You can configure the same mirroring session for different classes B-73 660 B-74Applying Multiple Mirroring Sessions to an Interface All inbound and outbound traffic on Ports b1, b2, and b3 is mirrored in session ■Only selected voice traffic on Port b1 is mirrored in session 661 Figure B-32.Example of Applying Multiple Sessions to the Same Interface 662 Displaying a Mirroring ConfigurationDisplaying All Mirroring Sessions Configured on the Switch Syntax: show monitor Mirroring is currently disabledSessions: Lists the four configurable sessions on the switch Sessions:Status: Displays the current status of each session: Status:active: The session is configured active: inactive:not defined: Mirroring is not configured for this session not defined: 663 Sources:Policy: UDP Source Addr: UDP port: UDP Dest Addr: Dest Port:B-77 Displaying the Remote Endpoints Configured on the Switch Syntax: show monitor endpoint 664 show monitor| name Type: show monitor endpointProCurve(config)# show monitor endpoint Remote Mirroring - Remote Endpoints Type UDP Source Addr UDP port UDP Dest Addr Dest Port B-78 Displaying the Mirroring Configuration for a Specific Session Syntax: show monitor < 1 - 4 | name < name-str Session: Displays the number of the specified session 665 Session:Session Name: Displays the name of the session, if configured Session Name: Mirroring Destination: 666 Direction:Figure B-35.Configuring a Remote Mirroring Session and Monitored SourceProCurve_8200(config)# show monitor Session: 2 Session Name: test-10 Policy: no policy relationship exists UDP Dest Addr Status UDP UDP port active Monitoring Sources Both Figure B-36.Displaying the Configuration of a Remote Mirroring SessionAfter you configure a MAC- based mirroring session (Figure B-37) Figure B-37.Configuring a MAC-basedMirroring SessionB-80 Session: 3 Session Name: Mirror Destination: A1 Monitoring Sources Direction MAC: 112233-445566Source 667 Figure B-38.Displaying a MAC-basedMirroring Session■Session number: ■Session name: Detail ■Mirrored traffic is sent to exit port B3 Session: 1 Session Name: Detail Policy: MirrorAdminTraffic Direction Figure B-39.Displaying the Configuration of a Local Mirroring Session 668 Displaying Information on a Classifier-BasedMirroring Session. InmirrorAdminTraffic Figure B-41.Displaying a Classifier-basedPolicy in a Local Mirroring Session 669 Figure B-42.“show class” Output for a Mirroring PolicyFigure B-43.“show policy” Output for a Mirroring Policy 670 Figure B-44.“show statistics policy” Output for a Mirroring PolicyDisplaying Resource Usage for Mirroring Policies Syntax: show policy resources show qos resources access-list resources show <qos | | policy> resourcesB-84 671 B-85Viewing the Mirroring Configurations in the Running Configuration File ;J8697A Configuration Editor; Created on release #K.12.XX max-vlans300 no ip address exit mirror 1 port B3 mirror 2 name "test-10"remote ip 10.10.10.1 8010 interface B1 monitor ip access-group"100" In mirror 1 monitor all Both mirror 672 Figure B-47.Displaying Remote Mirroring Endpoints in the Running Configuration673 Mirroring Configuration ExamplesExample: Local Mirroring Using Traffic-DirectionCriteria 1.Configure the local mirroring session, including the exit port 2.Configure the monitored source interfaces for the session Figure B-48.Local Mirroring TopologyProCurve(config)# mirror 1 port c24 Caution: Please configure destination switch first Do you want to continue [y/n]? y ProCurve(config)# interface a5,b17 monitor all in mirror B-87 Example: Remote Mirroring Using a Classifier-BasedPolicy 674 Figure B-50.Sample Topology in a Remote Mirroring SessionSwitch-C(config)#mirror 10.10.10.119 930010.10.30.2 port a15 Switch-C(config)#mirror endpoint 10.10.20.145930010.10.30.2 port a15 B-88 3Switch-A(config)#vlan 10 service-policymirrorTCP in 675 Figure B-52.Configuring a Classifier-BasedPolicy on Source Switch A4.On source switch B, repeat Steps 2 and 3: B-89 Switch-B(config)#vlan 20 service-policymirrorTCP in 676 Figure B-53.Configuring a Classifier-BasedPolicy on Source Switch BExample: Remote Mirroring Using Traffic-DirectionCriteria B-90 677 Figure B-54.Sample Topology for Remote Mirroring from a Port InterfaceSwitch-C(config)#mirror endpoint ip 10.10.10.119 port b10 Figure B-55.Configuring a Remote Mirroring Endpoint mirror 2 remote ip 10.10.10.119 9400 interface c12 monitor all in mirrorB-91 1Switch-A(config)#mirror 2 remote ip 10.10.10.119 9400 2Do you want to continue [y/n]? y Switch-A(config)#interface c12 monitor all in mirror2 Figure B-56.Configuring a Remote Mirroring Session for Inbound Port Traffic 678 Maximum Supported Frame Size681 Operating Notes for Traffic Mirroring683 Troubleshooting Traffic Mirroring• The configured remote exit port must not be a member of a trunk or mesh source to the destination • On the remote destination (endpoint) switch, the IP addresses of the remote exit port and the switch can belong to different VLANs must be active network performance problems, and is strongly discouraged by ProCurve B-97 684 B-98685 Troubleshooting689 Troubleshooting ApproachesUse these approaches to diagnose switch problems: Check the switch LEDs for indications of proper switch operation: Use ProCurve Manager to help isolate problems and recommend solu tions •Port Utilization Graph •Alert Log •Port Status and Port Counters screens •Diagnostic tools (Link test, Ping test, configuration file browser) •Status and Counters screens •Event Log C-5 690 Browser or Telnet Access Problems692 Unusual Network ActivityGeneral ProblemsThe network runs slow; processes fail; users cannot access servers or other devices•Turn on Spanning Tree Protocol to block redundant links (i.e. topology loops) •Check for FFI messages in the Event Log Duplicate IP Addresses. This is indicated by this Event Log message: Duplicate IP Addresses ip: Invalid ARP source: IP address on IP addressC-8 ip: Invalid ARP source: < IP-address > on <IP-address IP-address The Switch Has Been Configured for DHCP/Bootp Operation, But Has 693 802.1Q Prioritization ProblemsPorts configured for non-defaultprioritization (level 1 - 7) are not performing the specified action ACL ProblemsC-9 694 Figure C-1.Indication that Routing Is Enabledmanagement access If you need to configure IP routing, execute the ip routing command ip routingitself. Also, the switch applies assigned ACLs only at the point where traffic enters or leaves the switch on a VLAN. Ensure that you have correctly applied your ACLs (“in” and/or “out”) to the appropriate VLAN(s) same VLANVLAN from the management device C-10 695 Error (Invalid input) when entering an IP addressFigure C-2.Examples of Correctly and Incorrectly Specifying a Single Host Apparent failure to log all “Deny” Matches log deny any permit any The switch is not performing routing functions on a VLANTwo possible causes of this problem are: show running indicates that routing is not command to enable routing C-11 696 Routing Through a Gateway on the Switch FailsRemote Gateway Case Figure C-3.Example of ACE Blocking an Entire Subnet 697 Figure C-4.Example of Inadvertently Blocking a GatewayLocal Gateway Case2.Permit authorized traffic 3.Deny any unauthorized traffic that you have not already denied in step C-13 698 IGMP-RelatedProblemsLACP-RelatedProblems 699 Port-BasedAccess Control (802.1X)-RelatedProblems702 QoS-RelatedProblemsRadius-RelatedProblemsThe switch does not receive a response to RADIUS authentication Figure C-7.Examples of Global and Unique Encryption Keys 703 Spanning-TreeProtocol (MSTP) and Fast-UplinkProblemstunity to evaluate MSTP performance in your network. Because incorrect Broadcast Storms Appearing in the Network. This can occur whenthe loop to be detected C-19 Fast-Uplink TroubleshootingProblem sources can include: ■Fast-Uplinkis configured on a switch that is the MSTP root device Either the Two edge switches are directly linked to each other with a ■Fast uplink is configured on both ends of a link A switch serving as a backup MSTP root switch has ports configured for 704 SSH-RelatedProblemspub-key filePEM-formatted key into an ASCII-formatted key The switch does not have a host key. Verify by executing show ip host-public-key If you see the message ssh cannot be enabled until a host key is configured (use 'crypto' command) C-20 706 TACACS-RelatedProblemsEvent Log tacacs-serverC-22 ■The account has expired ■The access attempt is through a port that is not allowed for the account ■The time quota for the account has been exhausted ■The time credit for the account has expired ■The access attempt is outside of the time frame allowed for the account ■The allowed number of concurrent logins for the account has been exceeded default user 707 aaa authenticationnum-attempts 708 TimeP, SNTP, or Gateway ProblemsThe Switch Cannot Find the Time Server or the Configured Gateway VLAN-RelatedProblems 710 Fan Failure711 Using the Event Log for Troubleshooting Switch ProblemsReboot the switch by choosing the Event Log EntriesSeverity Date Time Event number System Module 08/05/06 10:52:32 ports: port A1 enabled Figure C-10.Format of an Event Log EntrySeverity is one of the following codes (from highest to lowest severity): SeverityM(major) indicates that a fatal switch error has occurred E(error) indicates that an error condition occurred on the switch W(warning) indicates that a switch service has behaved unexpectedly C-27 I(information) provides information on normal switch operation D(debug) is reserved for ProCurve internal diagnostic information Date is the date in the format mm/dd/yy when an entry is recorded in the log 712 DateTime is the time in the format hh:mm:ss when an entry is recorded in the log Time Event Number log-number System ModuleEvent Message is a brief description of the operating event Event Message Table C-1.Event Log System Modules 719 Menu: Displaying and Navigating in the Event LogEvent Log Figure C-11.Example of an Event Log Display Table C-1.Event Log Control Keys 720 CLI: Displaying the Event LogCLI: Clearing Event Log Entries 721 CLI: Turning Event Numbering OnUsing Log Throttling to Reduce Duplicate Event Log and SNMP Messages 725 Debug/Syslog OperationDebug/Syslog Messaging Debug/Syslog Destination Devicesdebug destination■Up to six Syslog servers A CLI session through a direct 726 Debug/Syslog Configuration CommandsC-42 727 Figure C-15.Summary of Debug/Syslog Configuration Commandspage C-57)is supported on the following switch models: Series 6400cl switches 6200yl Switch 6600 switch Series 5400zl switches Series 5300xl switches Series 4200vl switches ■ Series 4100gl switches (software release G.07.50 or greater) Series 3500 switches C-43 ■Series 3500yl switches ■Series 3400cl switches ■Series 2900 switches ■Series 2800 switches ■Series 2610 switches ■Series 2600 switches and the Switch 6108 (software release H.07.30 or greater) Configure the switch to send Event Log messages to the current manage ■Display the current Syslog server list when Syslog logging is disabled 728 Configuring Debug/Syslog Operationlogging facility 729 no debug event5. If you configure system-moduleand/or severity-levelvalues to filter Event messages to configured debug destinations (Syslog servers and/or CLI session) all Event Log messages, enter one or both of the following commands: If you configure a severity-level, system-module,logging destination, or C-45 Displaying a Debug/Syslog Configuration Use the show debug command to display the currently configured settings for: Syntax: show debug 730 Figure C-16.Sample Output of show debug Command731 logging severity732 Exampleuser 734 Debug Commandshow statistics < aclv4 | aclv6Syntax: [no] debug < debug-type > (Continued) (Continued) If no Syslog server address is configured and you enter the 735 adj —event —dd— Database descriptions hello — Hello messages hello —lsa — Link-stateadvertisements lsr — Link-staterequests lsa — lsr — lsu — retransmission — spf —ip [ rip < database | event | trigger > ] rip < database | event | trigger > > — Enables the specified RIP ripEnables the specified RIP trigger— Display trigger messages trigger—C-51 ipv6 [dhcpv6-client[events | packet ]] [forwarding | nd | packet] 736 dhcpv6-client[events | packet]: Displays DHCPv6 client event and packet data[forwarding]: Displays IPv6 forwarding messages [forwarding]:[nd]: Displays debug messages for IPv6 neighbor discovery [nd]:[packet]: Displays IPv6 packet messages [packet]:lldp Enables all LLDP message types for the configured destina tions Debug Destinations 737 ProCurve#debug destination session 738 Logging CommandBy specifying both a severity level and system module, you can use both configured settings to filter the Event Log messages you want to use to troubleshoot switch or network error conditions power recycle. The debug settings and destinations configured in your which may not be desirable After a reboot, messages remain in the Event Log and are not deleted However, after a power recycle, all Event Log messages are deleted C-54 739 Configuring a Syslog Serversyslog-ip-addr C-55 Syntax: [no] logging < syslog-ip-addr 740 no debug destination loggingdebug destination loggingC-56 Syntax: [no] logging facility < facility-name facility-name user (default) — Random user-levelmessages kern — Kernel messages kern —auth — Security/Authorization messages auth —syslog — Messages generated internally by Syslog lpr — Line-Printersubsystem syslog — lpr —Use the no form of the command to remove the configured facility and reconfigure the default (user) value page C-43 741 Adding a Description for a Syslog Server(IPv4 only) configured for syslog using the CLI or SNMP toring of syslog for SNMP (RFC 3164 supported) C-57 742 Adding a Priority Descriptionseverity system moduleparameters either through the CLI or with SNMP 743 Configuring the Severity Level for Event LogMessages Sent to a Syslog Serverhighest to lowest): Major: A fatal error condition has occurred on the switch Major:Error: An error condition has occurred on the switch Error:Warning: A switch service has behaved unexpectedly Warning:Information: Information on a normal switch event Information:Debug: Reserved for ProCurve internal diagnostic information Debug:Using the logging severity command, you can select a set of Event Log server, see “Configuring a Syslog Server” on page C-55 Syntax: [no] logging severity < major | error l warning | info | debug Configures the switch to send all Event Log messages with a severity level equal to or higher than the specified value to all configured Syslog servers Default: debug (Reports messages of all severity levels.) Event Log messages of all severity levels to Syslog servers All messages remain recorded in the Event Log C-59 Configuring the System Module Used to Select the Event Log Messages Sent to a Syslog Server all-pass 744 Operating Notes for Debug and Syslog746 Diagnostic ToolsDiagnostic Features 747 Port Auto-NegotiationEnsure that the switch port and the port on the attached If the attached Ping and Link Testsbe IEEE 802.3-compliant qualified domain names, refer to “DNS Resolver” on page C-87 respond with an 802.2 Test Response Packet C-63 Web: Executing Ping or Link Tests 748 Figure C-21.Link and Ping Test Screen on the Web Browser InterfaceSuccesses Failures 749 Number of Packets to SendCLI: Ping Test Sends ICMP echo requests to determine if another device is alive ping6 <ip-address| hostnameTarget IP address or hostname of the destination node being pinged repetitions <1-10000Number of ping packets sent to the destination address timeout <1-60 750 source <ip-addr| hostnamedata-size <0-65471 data-fill <0-1024 Figure C-22.Examples of Ping Tests Figure C-23.Example of Link Tests 751 Traceroute CommandCtrl traceroute6<ip-address| hostname The IP address or hostname of the device to which to send the traceroute [minttl < 1-255>] [maxttl < 1-255>] [timeout < 1-120>] 752 tracerouteA Low Maxttl Causes Traceroute To Halt Before Reaching theDestination Address. For example, executing traceroute with its default Destination Address 753 Figure C-24.Example of a Completed Traceroute Enquirymaxttl Figure C-25.Example of Incomplete Traceroute Due to Low Maxttl SettingC-69 Common reasons for Traceroute failing to reach a destination include: Timeouts (indicated by one asterisk per probe, per hop; refer to Figure ■Unreachable hosts ■Unreachable networks ■Interference from firewalls ■Hosts configured to avoid responding 754 Figure C-26.Example of Traceroute Failing to Reach the Destination Address755 Viewing Switch Configuration and Operation767 Restoring the Factory-DefaultConfigurationCLI: Resetting to the Factory-DefaultConfiguration Clear/Reset: Resetting to the Factory-DefaultConfiguration 768 Restoring a Flash Image771 DNS ResolverHost Name —evergreen.trees.org accounts015 sales021 ping accounts015 traceroute accounts015 C-87 772 Basic Operation■When the switch is configured with both of the following: •the IP address of a DNS server available to the switch •the domain suffix of a domain available to the configured DNS server then: ping leader alive, time ping leader.mygroup.procurve.net must C-88 other than mygroup.procurve.net common.group.net 773 Configuring and Using DNS Resolution withDNS-CompatibleCommands 774 Configuring a DNS EntrySyntax: [no] ip dns server-addresspriority < 1 - 3 > < ip-addr •the relative priority of the DNS server when multiple servers are configured •the IP address of the DNS server C-90 775 Example Using DNS Names with Ping and TracerouteFigure C-37.Example Network Domain 776 Entity:Identity: docserver Figure C-38.Configuring Switch “A” in FigureC-37To Support DNS Resolution37 as a target: ProCurve# traceroute docservr.pubs.outdoors.com hops max, 5 sec. timeout, 3 probes 777 Viewing the Current DNS Configurationshow runProCurve# show ip IP Routing : Disabled Gateway : TTL Arp Age DNS server | IP Config DEFAULT_VLAN | Figure C-41.Example of Viewing the Current DNS Configuration 779 Event Log Messages780 Locator LED (Locating a Switch)Syntax: chassislocate [blink | on | off] Locates a switch by using the blue Locate LED on the front panel blink <1-1440 on <1-1440 off Turns the chassis Locate LED off Figure C-42.Locating a Switch with the chassislocate Command 781 MAC Address Management783 Determining MAC AddressesUse the menu interface Use the CLI 784 Menu: Viewing the Switch’s MAC AddressesThe Management Address Information screen lists the MAC addresses for: ■ Base switch (default VLAN; VID = 1) ■ Any additional VLANs configured on the switch Also, the Base MAC address appears on a label on the back of the switch “1”, and cannot be changed “1” Configured on the Switch:1. From the Main Menu, Select Figure D-1.Example of the Management Address Information Screen 785 CLI: Viewing the Port and VLAN MAC Addressesuses the first 24 MAC addresses in the allotment, and so-on (All VLANs in the switch have the same MAC address.) walkmibin the switch, regardless of which VLAN you select the Manager level of the CLI the switch: ProCurve# walkmib ifPhysAddress (The above command is not case-sensitive.) (The above command is not case-sensitive.) ■two non-defaultVLANs configured D-5 786 Figure D-2.Example of Port MAC Address Assignments on a Switch787 Viewing the MAC Addresses ofConnected DevicesMAC address < mac-addr > not found mac-address 789 Monitoring Resources790 Viewing Information on Resource UsagePolicy Enforcement EngineWhen the following features are configured globally or •ACLs •QoS configurations that use the following commands: QoS device priority (IP Address) through the CLI using the 791 qosdevice-priority–QoS application port through the CLI using qos tcp-port or qos udp-port tcp-port–VLAN QoS Policies through the CLI using service-policy •Management VLAN configuration •Remote mirroring endpoint configuration •Mirror policies per VLAN through the CLI using monitor service monitor service•ACLs or QoS applied per-portor per-userthrough RADIUS authentication ACLs applied access-group ipv6 traffic-filter•QoS policies applied per port through the CLI using the service-policy command Mirror policies applied monitor all service 792 Displaying Current Resource Usageshow resources policySyntax: show <qos | access-list| policy> resources ■There is authenticated client usage of IDM resources on ports E-4 793 E-5 794 in/outbcast/mcast qos priority qos dscp qos protocol 795 When Insufficient Resources Are Available797 Daylight Savings Time on ProCurve Switches803 Switch LicensingThe procedure for installing a licensed feature into a switch is: 804 licenseshardware-id <license_typeProCurve# licenses hardware-idpremium 5.Reboot the switch. For example: ProCurve# boot or: or: ProCurve# reload The licensed features should now be active on the switch H-2 805 Power-SavingFeatures814 Concepts818 TasksOOBM ConfigurationOOBM Context Syntax: oobm819 OOBM Enable/disableFrom the OOBM context: enable disable From the general configuration context: Enables or disables networked out-of-band-managementon the switch Examples: J-7 820 OOBM Port Enable/disable821 OOBM Port Speed Control822 OOBM IPv4 Address Configuration[no] ip address [dhcp-bootp| ip-address/mask-length] ip-address/mask-length [no] oobm ip address [dhcp-bootp| ip-address/mask-length] Configures an IPv4 address for the switch’s OOBM interface OOBM IPv4 Default Gateway Configuration [no] ip default-gateway ip-address [no] oobm ip default-gateway ip-address Configures an IPv4 default gateway for the switch’s OOBM interface J-10 823 OOBM Show CommandsShow OOBM Show OOBM IP Configuration 824 show oobm ipShow OOBM ARP Information show oobm arp 825 Application Server CommandsDefault value is both for all servers Telnet: Management and Configuration Guide, page SSH: Access Security Guide, page SNMP: TFTP: Management and Configuration Guide, page A-10 HTTP: In all cases, show running-config will display the server configurations J-13 826 Application Client Commands829 Index
103 pages 2.69 Mb
220 pages 11.54 Mb
Also you can find more HP manuals or manuals for other Computer Equipment.