Manuals / Brands / Computer Equipment / Switch / Cisco Systems / Computer Equipment / Switch

Cisco Systems 2950, 2955 Configuring Network Security with ACLs

1 674

Download 674 pages, 18.88 Mb

CHAPT ER

28-1

Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide

OL-10101-02

28

Configuring Network Security with ACLs

This chapter describes how to configure network security on a Catalyst 2950 or Catalyst 2955 switch by

using access control lists (ACLs), which are also referred to in commands and tables as access lists.

You can create ACLs for physical interfaces or management interfaces. A management interface is

defined as a management VLAN or any traffic that is going directly to the CPU, such as SNMP, Telnet,

or web traffic. You can create ACLs for management interfaces with the standard software image (SI) or

the enhanced software image (EI) installed on your switch. However, you must have the EI installed on

your switch to apply ACLs to physical interfaces.

Note An ACLs that applied is to a physical interface has a limitation of one mask, and certain keywords are

not supported. For more information, see the “Guidelines for Applying ACLs to Physical Interfaces”

section on page 28-5.

Note For complete syntax and usage information for the commands used in this chapter, see the command

reference for this release and the “Configuring IP Services” section of the Cisco IOS IP and IP Routing

Configuration Guide, Cisco IOS Release 12.1 and the Cisco IOS IP and IP Routing Command Reference,

Cisco IOS Release 12.1.

This chapter consists of these sections:

• Understanding ACLs, page 28-2

• Configuring ACLs, page 28-6

• Displaying ACL Information, page 28-20

• Examples for Compiling ACLs, page 28-22

You can configure ACLs by using the command-line interface (CLI).

You can also use the security wizard to filter inbound traffic on the switches. Filtering can be based on

network addresses, TCP applications, or User Datagram Protocol (UDP) applications. You can choose

whether to drop or to forward packets that meet the filtering criteria. To use this wizard, you must know

how the network is designed and how interfaces are used on the filtering device. See the security wizard

online help for step-by-step configuration procedures about using this wizard.

Contents

Main Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide Page CONTENTS Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Preface Audience Purpose Conventions Related Publications Obtaining Documentation and Submitting a Service Request Overview Features Ease of Deployment and Ease of Use Performance Manageability Redundancy VLAN Support Security Quality of Service and Class of Service Monitoring LRE Features (available only on Catalyst 2950 LRE switches) Management Options Management Interface Options Advantages of Using Network Assistant and Clustering Switches Network Configuration Examples Design Concepts for Using the Switch Page Page Small to Medium-Sized Network Configuration Collapsed Backbone and Switch Cluster Configuration Hotel Network Configuration Page 1-18 Service-Provider Central-Office Configuration Page Large Campus Configuration Multidwelling Network Using Catalyst 2950 Switches Page Long-Distance, High-Bandwidth Transport Configuration Where to Go Next Using the Command-Line Interface Cisco IOS Command Modes Page Getting Help Abbreviating Commands Using no and default Forms of Commands Understanding CLI Messages Using Command History Changing the Command History Buffer Size Recalling Commands Disabling the Command History Feature Using Editing Features Enabling and Disabling Editing Features Editing Commands through Keystrokes Editing Command Lines that Wrap Searching and Filtering Output of show and more Commands Accessing the CLI Page Configuring Catalyst 2955 Switch Alarms Understanding Catalyst 2955 Switch Alarms Global Status Monitoring Alarms FCS Error Hysteresis Threshold Port Status Monitoring Alarms Triggering Alarm Options Configuring Catalyst 2955 Switch Alarms Default Catalyst 2955 Switch Alarm Configuration Configuring the Power Supply Alarm Setting the Power Mode Setting the Power Supply Alarm Options Configuring the Switch Temperature Alarms Setting a Secondary Temperature Threshold for the Switch Associating the Temperature Alarms to a Relay Configuring the FCS Bit Error Rate Alarm Setting the FCS Error Threshold Setting the FCS Error Hysteresis Threshold Configuring Alarm Profiles Creating or Modifying an Alarm Profile Attaching an Alarm Profile to a Specific Port Enabling SNMP Traps Displaying Catalyst 2955 Switch Alarms Status Page Assigning the Switch IP Address and Default Gateway Understanding the Boot Process Assigning Switch Information Default Switch Information Understanding DHCP-Based Autoconfiguration DHCP Client Request Process Configuring DHCP-Based Autoconfiguration DHCP Server Configuration Guidelines Configuring the TFTP Server Configuring the DNS Configuring the Relay Device Obtaining Configuration Files Example Configuration Understanding DHCP-Based Autoconfiguration with a Saved Configuration Limitations and Restrictions Configuring DHCP-Based Autoconfiguration with a saved configuration Manually Assigning IP Information Checking and Saving the Running Configuration Modifying the Startup Configuration Default Boot Configuration Automatically Downloading a Configuration File Specifying the Filename to Read and Write the System Configuration Booting Manually Booting a Specific Software Image Controlling Environment Variables Scheduling a Reload of the Software Image Configuring a Scheduled Reload Displaying Scheduled Reload Information Page Configuring Cisco IOS CNS Agents Understanding Cisco Configuration Engine Software Configuration Service Event Service NameSpace Mapper What You Should Know About the CNS IDs and Device Hostnames ConfigID DeviceID Hostname and DeviceID Using Hostname, DeviceID, and ConfigID Understanding Cisco IOS Agents Initial Configuration Incremental (Partial) Configuration Synchronized Configuration Configuring Cisco IOS Agents Enabling Automated CNS Configuration Enabling the CNS Event Agent Enabling the Cisco IOS CNS Agent Enabling an Initial Configuration Page Enabling a Partial Configuration Displaying CNS Configuration Clustering Switches Understanding Switch Clusters Cluster Command Switch Characteristics Standby Cluster Command Switch Characteristics Candidate Switch and Member Switch Characteristics Planning a Switch Cluster Automatic Discovery of Cluster Candidates and Members Discovery Through CDP Hops Discovery Through Non-CDP-Capable and Noncluster-Capable Devices Discovery Through Different VLANs Discovery Through Different Management VLANs Discovery of Newly Installed Switches HSRP and Standby Cluster Command Switches Virtual IP Addresses Other Considerations for Cluster Standby Groups Automatic Recovery of Cluster Configuration IP Addresses Hostnames Passwords SNMP Community Strings TACACS+ and RADIUS LRE Profiles Catalyst 1900 and Catalyst 2820 CLI Considerations Using SNMP to Manage Switch Clusters Page Page Administering the Switch Managing the System Time and Date Understanding the System Clock Understanding Network Time Protocol Configuring NTP Default NTP Configuration Configuring NTP Authentication Configuring NTP Associations Configuring NTP Broadcast Service Page Configuring NTP Access Restrictions Creating an Access Group and Assigning a Basic IP Access List Disabling NTP Services on a Specific Interface Configuring the Source IP Address for NTP Packets Displaying the NTP Configuration Configuring Time and Date Manually Setting the System Clock Displaying the Time and Date Configuration Configuring the Time Zone Configuring Summer Time (Daylight Saving Time) Page Configuring a System Name and Prompt Default System Name and Prompt Configuration Configuring a System Name Understanding DNS Default DNS Configuration Setting Up DNS Displaying the DNS Configuration Creating a Banner Default Banner Configuration Configuring a Message-of-the-Day Login Banner Configuring a Login Banner Managing the MAC Address Table Building the Address Table MAC Addresses and VLANs Default MAC Address Table Configuration Changing the Address Aging Time Removing Dynamic Address Entries Configuring MAC Address Notification Traps Page Adding and Removing Static Address Entries Configuring Unicast MAC Address Filtering Page Managing the ARP Table Configuring Switch-Based Authentication Preventing Unauthorized Access to Your Switch Protecting Access to Privileged EXEC Commands Default Password and Privilege Level Configuration Setting or Changing a Static Enable Password Protecting Enable and Enable Secret Passwords with Encryption Disabling Password Recovery Setting a Telnet Password for a Terminal Line Configuring Username and Password Pairs Configuring Multiple Privilege Levels Setting the Privilege Level for a Command Changing the Default Privilege Level for Lines Logging into and Exiting a Privilege Level Controlling Switch Access with TACACS+ Understanding TACACS+ Page TACACS+ Operation Configuring TACACS+ Default TACACS+ Configuration Identifying the TACACS+ Server Host and Setting the Authentication Key Configuring TACACS+ Login Authentication Page Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services Starting TACACS+ Accounting Displaying the TACACS+ Configuration Controlling Switch Access with RADIUS Understanding RADIUS Page RADIUS Operation Configuring RADIUS Default RADIUS Configuration Identifying the RADIUS Server Host Page Page Configuring RADIUS Login Authentication Page Defining AAA Server Groups Page Configuring RADIUS Authorization for User Privileged Access and Network Services Starting RADIUS Accounting Configuring Settings for All RADIUS Servers Configuring the Switch to Use Vendor-Specific RADIUS Attributes Configuring the Switch for Vendor-Proprietary RADIUS Server Communication Displaying the RADIUS Configuration Configuring the Switch for Local Authentication and Authorization Configuring the Switch for Secure Shell Understanding SSH SSH Servers, Integrated Clients, and Supported Versions Limitations Configuring SSH Configuration Guidelines Cryptographic Software Image Guidelines Setting Up the Switch to Run SSH Configuring the SSH Server Displaying the SSH Configuration and Status Page Configuring IEEE 802.1x Port-Based Authentication Understanding IEEE 802.1x Port-Based Authentication Device Roles Authentication Initiation and Message Exchange Ports in Authorized and Unauthorized States IEEE 802.1x Host Mode IEEE 802.1x Accounting IEEE 802.1x Accounting Attribute-Value Pairs Using IEEE 802.1x Authentication with VLAN Assignment Using IEEE 802.1x Authentication with Guest VLAN Using IEEE 802.1x Authentication with Restricted VLAN Using IEEE 802.1x Authentication with Voice VLAN Ports Using IEEE 802.1x Authentication with Port Security Using IEEE 802.1x Authentication with Wake-on-LAN Network Admission Control Layer 2 IEEE 802.1x Validation Configuring IEEE 802.1x Authentication Default IEEE 802.1x Authentication Configuration IEEE 802.1x Authentication Configuration Guidelines IEEE 802.1x Authentication VLAN Assignment, Guest VLAN, and Restricted VLAN Upgrading from a Previous Software Release Configuring IEEE 802.1x Authentication Page Configuring the Switch-to-RADIUS-Server Communication Configuring the Host Mode Enabling Periodic Re-Authentication Manually Re-Authenticating a Client Connected to a Port Changing the Quiet Period Changing the Switch-to-Client Retransmission Time Setting the Switch-to-Client Frame-Retransmission Number Configuring IEEE 802.1x Accounting Configuring a Guest VLAN Configuring a Restricted VLAN Page Configuring IEEE 802.1x Authentication with WoL Configuring NAC Layer 2 IEEE 802.1x Validation Resetting the IEEE 802.1x Configuration to the Default Values Displaying IEEE 802.1x Statistics and Status Configuring Interface Characteristics Understanding Interface Types Access Ports Trunk Ports Port-Based VLANs EtherChannel Port Groups Connecting Interfaces Using the Interface Command Procedures for Configuring Interfaces Configuring a Range of Interfaces Page Configuring and Using Interface-Range Macros Configuring Ethernet Interfaces Default Ethernet Interface Configuration Configuring Interface Speed and Duplex Mode Configuration Guidelines Page Setting the Interface Speed and Duplex Parameters on a Non-LRE Switch Port Setting the Interface Speed and Duplex Parameters on an LRE Switch Port Configuring Media Types for Gigabit Ethernet Interfaces on LRE Switches Configuring IEEE 802.3x Flow Control on IEEE 802.3z Gigabit Ethernet Ports Adding a Description for an Interface Configuring Loopback Detection Monitoring and Maintaining the Interfaces Monitoring Interface and Controller Status Clearing and Resetting Interfaces and Counters Shutting Down and Restarting the Interface Page Configuring Smartports Macros Understanding Smartports Macros Configuring Smartports Macros Default Smartports Macro Configuration Smartports Macro Configuration Guidelines Creating Smartports Macros Applying Smartports Macros Applying Cisco-Default Smartports Macros Page Displaying Smartports Macros Configuring LRE Understanding LRE Features Ports on the Catalyst 2950 LRE Switches LRE Links and LRE Profiles LRE Profiles Page Page LRE Sequences CPE Ethernet Links LRE Link Monitor LRE Message Logging Process Configuring LRE Ports Default LRE Configuration Environmental Guidelines for LRE Links Guidelines for Using LRE Profiles CPE Ethernet Link Guidelines Guidelines for Configuring Cisco 575 LRE CPEs and 576 LRE 997 CPEs Guidelines for Configuring Cisco 585 LRE CPEs Assigning a Global Profile to All LRE Ports Assigning a Profile to a Specific LRE Port Assigning a Global Sequence to All LRE Ports Assigning a Sequence to a Specific LRE Port Using Rate Selection to Automatically Assign Profiles Precedence Profile Locking Link Qualification and SNR Margins Page Page Configuring LRE Link Persistence Configuring LRE Link Monitor Configuring LRE Interleave Configuring Upstream Power Back-Off Configuring CPE Toggle Configuring Syslog Export Upgrading LRE Switch Firmware Configuring for an LRE Upgrade Performing an LRE Upgrade Global Configuration of LRE Upgrades Controller Configuration of LRE Upgrades LRE Upgrade Details 12-26 LRE Upgrade Example This example shows how an LRE upgrade occurs: The CPE device is reset and the link is down. Ethernet connectivity is unavailable at this point. Upgrade data transfer is complete. Reset the CPE device. The CPE device has finished resetting. The desired profile is applied. Displaying LRE Status Page Configuring STP Understanding Spanning-Tree Features STP Overview Spanning-Tree Topology and BPDUs Bridge ID, Switch Priority, and Extended System ID Spanning-Tree Interface States Blocking State Listening State Learning State Forwarding State Disabled State How a Switch or Port Becomes the Root Switch or Root Port Spanning Tree and Redundant Connectivity Spanning-Tree Address Management Accelerated Aging to Retain Connectivity Spanning-Tree Modes and Protocols Supported Spanning-Tree Instances Spanning-Tree Interoperability and Backward Compatibility STP and IEEE 802.1Q Trunks Configuring Spanning-Tree Features Default Spanning-Tree Configuration Spanning-Tree Configuration Guidelines Changing the Spanning-Tree Mode Disabling Spanning Tree Configuring the Root Switch Page Configuring a Secondary Root Switch Configuring the Port Priority Configuring the Path Cost Configuring the Switch Priority of a VLAN Configuring Spanning-Tree Timers Configuring the Hello Time Configuring the Forwarding-Delay Time for a VLAN Configuring the Maximum-Aging Time for a VLAN Configuring Spanning Tree for Use in a Cascaded Stack Displaying the Spanning-Tree Status Page Configuring MSTP Understanding MSTP Multiple Spanning-Tree Regions IST, CIST, and CST Operations Within an MST Region Operations Between MST Regions Hop Count Boundary Ports Interoperability with IEEE 802.1D STP Understanding RSTP Port Roles and the Active Topology Rapid Convergence Synchronization of Port Roles Bridge Protocol Data Unit Format and Processing Processing Superior BPDU Information Processing Inferior BPDU Information Topology Changes Configuring MSTP Features Default MSTP Configuration MSTP Configuration Guidelines Specifying the MST Region Configuration and Enabling MSTP Configuring the Root Switch Configuring a Secondary Root Switch Configuring the Port Priority Configuring the Path Cost Configuring the Switch Priority Configuring the Hello Time Configuring the Forwarding-Delay Time Configuring the Maximum-Aging Time Configuring the Maximum-Hop Count Specifying the Link Type to Ensure Rapid Transitions Restarting the Protocol Migration Process Displaying the MST Configuration and Status Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features Understanding Port Fast Understanding BPDU Guard Understanding BPDU Filtering Understanding UplinkFast Page Understanding Cross-Stack UplinkFast How CSUF Works Events that Cause Fast Convergence Limitations Connecting the Stack Ports 15-9 Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide OL-10101-02 2 34 56 7 8 910 910 910 910 Understanding BackboneFast Catalyst 3500 XL Catalyst 2950G-12 GigaStack GBIC connection for fast convergence Catalyst 3500 Page Understanding EtherChannel Guard Understanding Root Guard Understanding Loop Guard Configuring Optional Spanning-Tree Features Default Optional Spanning-Tree Configuration Optional Spanning-Tree Configuration Guidelines Enabling Port Fast Enabling BPDU Guard Enabling BPDU Filtering Enabling UplinkFast for Use with Redundant Links Enabling Cross-Stack UplinkFast Enabling BackboneFast Enabling EtherChannel Guard Enabling Root Guard Enabling Loop Guard Displaying the Spanning-Tree Status Page Configuring VLANs Understanding VLANs Supported VLANs VLAN Port Membership Modes Configuring Normal-Range VLANs Token Ring VLANs Normal-Range VLAN Configuration Guidelines VLAN Configuration Mode Options VLAN Configuration in config-vlan Mode VLAN Configuration in VLAN Configuration Mode Saving VLAN Configuration Default Ethernet VLAN Configuration Creating or Modifying an Ethernet VLAN Deleting a VLAN Assigning Static-Access Ports to a VLAN Configuring Extended-Range VLANs Default VLAN Configuration Extended-Range VLAN Configuration Guidelines Creating an Extended-Range VLAN Displaying VLANs Configuring VLAN Trunks Trunking Overview IEEE 802.1Q Configuration Considerations Default Layer 2 Ethernet Interface VLAN Configuration Configuring an Ethernet Interface as a Trunk Port Interaction with Other Features Configuring a Trunk Port Defining the Allowed VLANs on a Trunk Changing the Pruning-Eligible List Configuring the Native VLAN for Untagged Traffic Load Sharing Using STP Load Sharing Using STP Port Priorities Page Load Sharing Using STP Path Cost Configuring VMPS Understanding VMPS Dynamic Port VLAN Membership VMPS Database Configuration File Default VMPS Client Configuration VMPS Configuration Guidelines Configuring the VMPS Client Entering the IP Address of the VMPS Configuring Dynamic Access Ports on VMPS Clients Reconfirming VLAN Memberships Changing the Reconfirmation Interval Changing the Retry Count Monitoring the VMPS Troubleshooting Dynamic Port VLAN Membership VMPS Configuration Example 16-30 Configuring VTP Understanding VTP The VTP Domain VTP Modes VTP Advertisements VTP Version 2 VTP Pruning Page Configuring VTP Default VTP Configuration VTP Configuration Options VTP Configuration in Global Configuration Mode VTP Configuration in VLAN Configuration Mode VTP Configuration Guidelines Domain Names Passwords Upgrading from Previous Software Releases VTP Version Configuring a VTP Server Page Configuring a VTP Client Disabling VTP (VTP Transparent Mode) Enabling VTP Version 2 Enabling VTP Pruning Adding a VTP Client Switch to a VTP Domain Monitoring VTP Page Configuring Voice VLAN Understanding Voice VLAN Configuring Voice VLAN Default Voice VLAN Configuration Voice VLAN Configuration Guidelines Configuring a Port to Connect to a Cisco 7960 IP Phone Configuring Ports to Carry Voice Traffic in IEEE 802.1Q Frames Configuring Ports to Carry Voice Traffic in IEEE 802.1p Priority-Tagged Frames Overriding the CoS Priority of Incoming Data Frames Configuring the IP Phone to Trust the CoS Priority of Incoming Data Frames Displaying Voice VLAN Configuring Port-Based Traffic Control Configuring Storm Control Understanding Storm Control Default Storm Control Configuration Configuring Storm Control and Threshold Levels Page Configuring Protected Ports Configuring Port Blocking Blocking Flooded Traffic on an Interface Resuming Normal Forwarding on a Port Configuring Port Security Understanding Port Security Secure MAC Addresses Security Violations Default Port Security Configuration Port Security Configuration Guidelines Enabling and Configuring Port Security Page Enabling and Configuring Port Security Aging Page Displaying Port-Based Traffic Control Settings Page Configuring DHCP Features Understanding DHCP Features DHCP Server DHCP Relay Agent DHCP Snooping Option-82 Data Insertion Page Configuring DHCP Features Default DHCP Configuration Circuit ID Suboption Frame Format Remote ID Suboption Frame Format DHCP Snooping Configuration Guidelines Configuring the DHCP Server Enabling DHCP Snooping and Option 82 Displaying DHCP Information Configuring IGMP Snooping and MVR Understanding IGMP Snooping IGMP Versions Joining a Multicast Group Leaving a Multicast Group Immediate-Leave Processing IGMP Configurable-Leave Timer IGMP Report Suppression Source-Only Networks Configuring IGMP Snooping Default IGMP Snooping Configuration Enabling or Disabling IGMP Snooping Setting the Snooping Method Configuring a Multicast Router Port Configuring a Host Statically to Join a Group Enabling IGMP Immediate-Leave Processing Configuring the IGMP Leave Timer Disabling IGMP Report Suppression Disabling IP Multicast-Source-Only Learning Configuring the Aging Time Displaying IGMP Snooping Information Understanding Multicast VLAN Registration Using MVR in a Multicast Television Application Page Configuring MVR Default MVR Configuration MVR Configuration Guidelines and Limitations Configuring MVR Global Parameters Configuring MVR Interfaces Displaying MVR Information Configuring IGMP Filtering and Throttling Default IGMP Filtering and Throttling Configuration Configuring IGMP Profiles Applying IGMP Profiles Setting the Maximum Number of IGMP Groups Configuring the IGMP Throttling Action Displaying IGMP Filtering and Throttling Configuration Page Configuring UDLD Understanding UDLD Modes of Operation Methods to Detect Unidirectional Links Configuring UDLD Default UDLD Configuration Enabling UDLD Globally Enabling UDLD on an Interface Resetting an Interface Shut Down by UDLD Displaying UDLD Status Page Configuring CDP Understanding CDP Configuring CDP Default CDP Configuration Configuring the CDP Characteristics Disabling and Enabling CDP Disabling and Enabling CDP on an Interface Monitoring and Maintaining CDP Page Page Configuring SPAN and RSPAN Understanding SPAN and RSPAN Page SPAN and RSPAN Concepts and Terminology SPAN Session Traffic Types Source Port Destination Port Reflector Port SPAN Traffic SPAN and RSPAN Interaction with Other Features SPAN and RSPAN Session Limits Default SPAN and RSPAN Configuration Configuring SPAN SPAN Configuration Guidelines Creating a SPAN Session and Specifying Ports to Monitor Creating a SPAN Session and Enabling Ingress Traffic Removing Ports from a SPAN Session Configuring RSPAN RSPAN Configuration Guidelines Configuring a VLAN as an RSPAN VLAN Creating an RSPAN Source Session Creating an RSPAN Destination Session Removing Ports from an RSPAN Session 24-16 Displaying SPAN and RSPAN Status Configuring RMON Understanding RMON Configuring RMON Default RMON Configuration Configuring RMON Alarms and Events Configuring RMON Collection on an Interface Page Displaying RMON Status Configuring System Message Logging Understanding System Message Logging Configuring System Message Logging System Log Message Format Default System Message Logging Configuration Disabling and Enabling Message Logging Setting the Message Display Destination Device Synchronizing Log Messages Enabling and Disabling Timestamps on Log Messages Enabling and Disabling Sequence Numbers in Log Messages Defining the Message Severity Level Limiting Syslog Messages Sent to the History Table and to SNMP Configuring UNIX Syslog Servers Logging Messages to a UNIX Syslog Daemon Configuring the UNIX System Logging Facility Displaying the Logging Configuration Configuring SNMP Understanding SNMP SNMP Versions SNMP Manager Functions SNMP Agent Functions SNMP Community Strings Using SNMP to Access MIB Variables SNMP Notifications Configuring SNMP Default SNMP Configuration SNMP Configuration Guidelines Disabling the SNMP Agent Configuring Community Strings Page Configuring SNMP Groups and Users Page Configuring SNMP Notifications Page Page Setting the Agent Contact and Location Information Limiting TFTP Servers Used Through SNMP SNMP Examples Displaying SNMP Status Configuring Network Security with ACLs Understanding ACLs Handling Fragmented and Unfragmented Traffic Understanding Access Control Parameters Guidelines for Applying ACLs to Physical Interfaces Configuring ACLs Unsupported Features Creating Standard and Extended IP ACLs ACL Numbers Creating a Numbered Standard ACL Page Creating a Numbered Extended ACL Page Page Creating Named Standard and Extended ACLs Applying Time Ranges to ACLs Page Including Comments About Entries in ACLs Creating Named MAC Extended ACLs Creating MAC Access Groups Applying ACLs to Terminal Lines or Physical Interfaces Applying ACLs to a Terminal Line Applying ACLs to a Physical Interface Displaying ACL Information Displaying ACLs Displaying Access Groups Examples for Compiling ACLs Page Numbered ACL Examples Extended ACL Examples Named ACL Example Commented IP ACL Entry Examples Page Page Configuring QoS Understanding QoS Basic QoS Model Classification Classification Based on QoS ACLs Classification Based on Class Maps and Policy Maps Policing and Marking Mapping Tables Queueing and Scheduling How Class of Service Works Port Priority Port Scheduling Egress CoS Queues Configuring Auto-QoS Generated Auto-QoS Configuration Page Effects of Auto-QoS on the Configuration Upgrading from a Previous Software Release Enabling Auto-QoS for VoIP Displaying Auto-QoS Information Auto-QoS Configuration Example 29-15 Configuring Standard QoS Default Standard QoS Configuration Page Configuring Classification Using Port Trust States Configuring the Trust State on Ports within the QoS Domain Configuring the CoS Value for an Interface Configuring Trusted Boundary Page Enabling Pass-Through Mode Configuring a QoS Policy Classifying Traffic by Using ACLs Page Page Page Classifying Traffic by Using Class Maps Classifying, Policing, and Marking Traffic by Using Policy Maps Page Page Configuring CoS Maps Configuring the CoS-to-DSCP Map Configuring the DSCP-to-CoS Map Page Configuring the Egress Queues Configuring CoS Priority Queues Configuring WRR Priority Enabling the Expedite Queue and Configuring WRR Priority Displaying Standard QoS Information Standard QoS Configuration Examples QoS Configuration for the Existing Wiring Closet QoS Configuration for the Intelligent Wiring Closet Page Configuring EtherChannels Understanding EtherChannels Page Understanding Port-Channel Interfaces Understanding the Port Aggregation Protocol and Link Aggregation Protocol PAgP and LACP Modes Exchanging PAgP Packets Exchanging LACP Packets Physical Learners and Aggregate-Port Learners PAgP and LACP Interaction with Other Features EtherChannel On Mode Understanding Load Balancing and Forwarding Methods Configuring EtherChannels Default EtherChannel Configuration EtherChannel Configuration Guidelines Configuring Layer 2 EtherChannels Page Configuring EtherChannel Load Balancing Configuring the PAgP Learn Method and Priority Configuring the LACP Port Priority Configuring Hot Standby Ports Configuring the LACP System Priority Displaying EtherChannel, PAgP, and LACP Status Troubleshooting Using Recovery Procedures Recovering from a Software Failure Recovering from Lost or Forgotten Passwords on Non-LRE Catalyst 2950 Switches Page Recovering from Lost or Forgotten Passwords on Catalyst 2950 LRE Switches Password Recovery with Password Recovery Enabled Procedure with Password Recovery Disabled Recovering from Lost or Forgotten Passwords on Catalyst 2955 Switches Page Page Recovering from a Command Switch Failure Replacing a Failed Command Switch with a Cluster Member Page Replacing a Failed Command Switch with Another Switch Recovering from Lost Member Connectivity Preventing Autonegotiation Mismatches GBIC and SFP Module Security and Identification Diagnosing Connectivity Problems Using Ping Understanding Ping Executing Ping Using Layer 2 Traceroute Understanding Layer 2 Traceroute Usage Guidelines Displaying the Physical Path Diagnosing LRE Connection Problems Using Debug Commands Enabling Debugging on a Specific Feature Enabling All-System Diagnostics Redirecting Debug and Error Message Output Using the debug auto qos Command Using the show controllers Commands Using the crashinfo File Page APPENDIX A Supported MIBs MIB List Page Using FTP to Access the MIB Files Page APPENDIX B Working with the Cisco IOS File System, Configuration Files, and Software Images Working with the Flash File System Displaying Available File Systems Setting the Default File System Displaying Information about Files on a File System Changing Directories and Displaying the Working Directory Creating and Removing Directories Copying Files Deleting Files Creating, Displaying, and Extracting tar Files Creating a tar File Displaying the Contents of a tar File Extracting a tar File Displaying the Contents of a File Working with Configuration Files Guidelines for Creating and Using Configuration Files Configuration File Types and Location Creating a Configuration File By Using a Text Editor Copying Configuration Files By Using TFTP Preparing to Download or Upload a Configuration File By Using TFTP Downloading the Configuration File By Using TFTP Uploading the Configuration File By Using TFTP Copying Configuration Files By Using FTP Preparing to Download or Upload a Configuration File By Using FTP Downloading a Configuration File By Using FTP Uploading a Configuration File By Using FTP Copying Configuration Files By Using RCP Preparing to Download or Upload a Configuration File By Using RCP Downloading a Configuration File By Using RCP Uploading a Configuration File By Using RCP Clearing Configuration Information Clearing the Startup Configuration File Deleting a Stored Configuration File Working with Software Images Image Location on the Switch tar File Format of Images on a Server or .com Copying Image Files By Using TFTP Preparing to Download or Upload an Image File By Using TFTP Downloading an Image File By Using TFTP Uploading an Image File By Using TFTP Copying Image Files By Using FTP Preparing to Download or Upload an Image File By Using FTP Downloading an Image File By Using FTP Uploading an Image File By Using FTP Copying Image Files By Using RCP Preparing to Download or Upload an Image File By Using RCP Downloading an Image File By Using RCP Page Uploading an Image File By Using RCP Page Page INDEX Numerics A Page B C Page Page D Page E F G H I J L M Page N O P Page Page Q R Page S Page Page Page Page T U V Page W X