Configuring Dynamic ARP Inspection, 23-5

Chapter 23 Configuring Dynamic ARP Inspection

Configuring Dynamic ARP Inspection

Logging of Dropped Packets

When the switch drops a packet, it places an entry in the log buffer and then generates system messages on a rate-controlled basis. After the message is generated, the switch clears the entry from the log buffer. Each log entry contains flow information, such as the receiving VLAN, the port number, the source and destination IP addresses, and the source and destination MAC addresses.

You use the ip arp inspection log-bufferglobal configuration command to configure the number of entries in the buffer and the number of entries needed in the specified interval to generate system messages. You specify the type of packets that are logged by using the ip arp inspection vlan logging global configuration command. For configuration information, see the “Configuring the Log Buffer” section on page 23-12.

Configuring Dynamic ARP Inspection

These sections contain this configuration information:

•Default Dynamic ARP Inspection Configuration, page 23-5

•Dynamic ARP Inspection Configuration Guidelines, page 23-6

•Configuring Dynamic ARP Inspection in DHCP Environments, page 23-7(required in DHCP environments)

•Configuring ARP ACLs for Non-DHCP Environments, page 23-8(required in non-DHCP environments)

•Limiting the Rate of Incoming ARP Packets, page 23-10(optional)

•Performing Validation Checks, page 23-11(optional)

•Configuring the Log Buffer, page 23-12(optional)

Default Dynamic ARP Inspection Configuration

Table 23-1shows the default dynamic ARP inspection configuration.

Table 23-1 Default Dynamic ARP Inspection Configuration

Feature	Default Setting

Dynamic ARP inspection	Disabled on all VLANs.

Interface trust state	All interfaces are untrusted.

Rate limit of incoming ARP packets	The rate is 15 pps on untrusted interfaces, assuming that
	the network is a switched network with a host
	connecting to as many as 15 new hosts per second.
	The rate is unlimited on all trusted interfaces.
	The burst interval is 1 second.

ARP ACLs for non-DHCP environments	No ARP ACLs are defined.

Validation checks	No checks are performed.

Catalyst 3750-E and 3560-E Switch Software Configuration Guide

	OL-9775-02	23-5

Page 543

Image 543

Cisco Systems 3750E manual Configuring Dynamic ARP Inspection, Logging of Dropped Packets, 23-5

Contents

Text Part Number OL-9775-02 Americas HeadquartersPage Iii N T E N T S Assigning the Switch IP Address and Default Gateway Understanding Cisco Configuration Engine Software Clustering Switches Vii Catalyst 1900 and Catalyst 2820 CLI Considerations Viii Creating a Banner Changing the Default Privilege Level for Lines Device Roles Bypass Xii Routed Ports Xiii Monitoring and Maintaining the Interfaces Xiv Encapsulation Types Domain Names Xvi Private-VLAN Configuration Guidelines Xvii Disabled State Xviii Boundary Ports 19-25 Xix Dhcp Server Xxi Configuring Dynamic ARP Inspection Xxii Configuring MVR Xxiii Understanding Storm Control Xxiv Understanding Udld Modes of Operation Xxv Creating an Rspan Source Session Xxvi Snmp Agent Functions Xxvii Creating a Numbered Extended ACL Xxviii Interaction with Other Features and Switches Xxix Xxx Port-Channel Interfaces Xxxi Configuring IP Addressing Xxxii Nonstop Forwarding Awareness Xxxiii IPv6 Addresses Xxxiv Configuring Hsrp Priority Xxxv Configuring IP Multicast Routing Xxxvi Configuring Basic Dvmrp Interoperability Features Xxxvii Using a Filter 45-14 Xxxviii Xxxix Configuring Online Diagnostics Unsupported Route-Map Configuration Commands C-1 Xli Hsrp Xlii VTP Conventions PrefaceAudience Purpose Xliv Related Publications Xlv Xlvi Overview Features Availability and Redundancy Features, Vlan Features, Deployment Features Overview Features Performance Features Management Options Manageability Features Availability and Redundancy Features Security Features Vlan Features Overview Features QoS and CoS Features Layer 3 Features Power over Ethernet Features Default Settings After Initial Switch Configuration Monitoring FeaturesVlan Overview Default Settings After Initial Switch Configuration Overview Default Settings After Initial Switch Configuration Design Concepts for Using the Switch Network Configuration Examples Network Demands Suggested Design Methods Cost-Effective Wiring Closet High-Performance Wiring Closet High-Performance Workgroup Gigabit-to-the-Desktop Redundant Gigabit Backbone Server Aggregation Linux Server Cluster Cisco SoftPhone Software Gigabit servers Internet Cisco 2600 or 3700 routers Catalyst 3560-E switches Large Network Using Catalyst 3750-E and 3560-E Switches Cisco 7x00 routers Catalyst Catalyst 3560-E Multidwelling Network Using Catalyst 3750-E Switches 11 Catalyst 3750-E Switches in a MAN Configuration Long-Distance, High-Bandwidth Transport Configuration Access layer Aggregation layer Where to Go Next OL-9775-02 Understanding Command Modes Using the Command-Line Interface Ctrl-Z Mode Access Method Prompt Exit Method About This ModeConfigure Quit Line vty or line Console commandCommand Purpose Understanding the Help System Command keyword ? Understanding Abbreviated CommandsUnderstanding no and default Forms of Commands Command ? Understanding CLI Error Messages Using Configuration LoggingError Message Meaning How to Get Help Action1 Result Using Command HistoryChanging the Command History Buffer Size Recalling Commands Switch# terminal editing Using Editing FeaturesDisabling the Command History Feature Enabling and Disabling Editing Features Capability Keystroke1 Purpose Editing Commands through Keystrokes Editing Command Lines that Wrap Return and Space barPress Ctrl-L or Ctrl-R Accessing the CLI Command begin include exclude regular-expressionSwitch# show interfaces include protocol Using the Command-Line Interface Accessing the CLI OL-9775-02 Understanding the Boot Process Assigning the Switch IP Address and Default Gateway Assigning Switch Information Default Switch Information Understanding DHCP-Based AutoconfigurationFeature Default Setting Dhcp Client and Server Message Exchange Dhcp Client Request Process Dhcp Server Configuration Guidelines Configuring DHCP-Based Autoconfiguration Configuring the DNS Configuring the Tftp Server Configuring the Relay Device Obtaining Configuration FilesRouterconfig-if#ip helper-address Tftpserver Example Configuration Dhcp Client Configuration Switch a Switch B Switch C Switch DDNS Server Configuration Tftp Server Configuration on Unix Manually Assigning IP Information Checking and Saving the Running Configuration Switch# show running-configSwitch# copy running-config startup-config Modifying the Startup Configuration Default Boot ConfigurationAutomatically Downloading a Configuration File Configure terminal Enter global configuration mode Booting ManuallyBoot config-file flash/ file-url Show boot Boot system filesystem /file-url Booting a Specific Software Image Controlling Environment Variables Boot system switch number all Set Switchpriority Set Manualboot yes Boot manualSet Switchnumber Switch current-stack-member-number renumber Reload in hhmm text Configuring a Scheduled ReloadScheduling a Reload of the Software Image Variable Description Switch# reload at Switch# reload at 0200 junDisplaying Scheduled Reload Information Understanding Cisco Configuration Engine Software Configuring Cisco IOS CNS Agents Configuration Engine Architectural Overview Configuration Service NameSpace Mapper Event ServiceConfigID What You Should Know About the CNS IDs and Device Hostnames Using Hostname, DeviceID, and ConfigID DeviceIDHostname and DeviceID Understanding Cisco IOS Agents Initial Configuration Enabling Automated CNS Configuration Configuring Cisco IOS AgentsIncremental Partial Configuration Synchronized Configuration Device Required Configuration Show cns event connections Backup init-retry retry-count keepalive secondsShow running-config Enabling the CNS Event Agent Enabling the Cisco IOS CNS Agent Enabling an Initial Configuration Cns id hardware-serial hostname string string Cns config initial ip-address hostnameCns id interface num dns-reverse ipaddress Mac-address event Show cns config stats Enabling a Partial ConfigurationShow running-config Verify your entries Cns config partial ip-address hostname Show cns event subject Displaying CNS ConfigurationShow cns config connections Show cns event stats Understanding Switch Stacks Managing Switch Stacks Managing Switch Stacks Understanding Switch Stacks Switch Stack Membership Creating a Switch Stack from Two Standalone Switches Stack Master Election and Re-Election Adding a Standalone Switch to a Switch Stack Stack Member Numbers Switch Stack Bridge ID and Router MAC Address Stack Member Priority Values Switch Stack Offline Configuration Effects of Adding a Provisioned Switch to a Switch StackScenario Result Scenario Result Effects of Replacing a Provisioned Switch in a Switch Stack Switch Stack Software Compatibility Recommendations Major Version Number Incompatibility Among Switches Minor Version Number Incompatibility Among SwitchesStack Protocol Version Compatibility Understanding Auto-Upgrade and Auto-Advise Auto-Upgrade and Auto-Advise Example Messages SwitchDirectory Mar 1 000422.537%IMAGEMGR-6-AUTOADVISESW Switch Stack Configuration Files Incompatible Software and Stack Member Image Upgrades Switch Stack Management Connectivity Connectivity to the Switch Stack Through an IP Address Connectivity to the Switch Stack Through an SSH SessionConnectivity to Specific Stack Members Switch Stack Configuration Scenarios Use the switch stack-member-numberPriority new-priority-number global Current-stack-member-number Renumber new-stack-member-number Configuring the Switch Stack Default Switch Stack ConfigurationEnabling Persistent MAC Address Time-value Stack-mac persistent timerShow switch Switchconfig# stack-mac persistent timer Setting the Stack Member Priority Value Assigning Stack Member InformationAssigning a Stack Member Number Provisioning a New Member for a Switch Stack Show switch stack-member-number Accessing the CLI of a Specific Stack MemberDisplaying Switch Stack Information Command Description Show switch stack-ports Show switch stack-ring activityDetail OL-9775-02 Understanding Switch Clusters Clustering Switches Switch Cisco IOS Release Cluster Capability Standby Cluster Command Switch Characteristics Cluster Command Switch Characteristics Candidate Switch and Cluster Member Switch Characteristics Planning a Switch Cluster Discovery Through CDP Hops Automatic Discovery of Cluster Candidates and Members Discovery Through CDP Hops Discovery Through Different VLANs Discovery Through Different VLANs Discovery Through Different Management VLANs Discovery Through Routed Ports New out-of-box Discovery of Newly Installed Switches Hsrp and Standby Cluster Command Switches Other Considerations for Cluster Standby Groups Virtual IP Addresses Automatic Recovery of Cluster Configuration Hostnames IP Addresses Snmp Community Strings Passwords Switch Clusters and Switch Stacks Switch Stack Switch ClusterMembers Other cluster member switches LRE Profiles TACACS+ and Radius Using the CLI to Manage Switch Clusters Switch# rcommandCatalyst 1900 and Catalyst 2820 CLI Considerations Snmp Management for a Cluster Using Snmp to Manage Switch Clusters OL-9775-02 Administering the Switch Managing the System Time and DateUnderstanding the System Clock NTP Understanding Network Time Protocol Typical NTP Network Configuration Configuring NTP Default NTP Configuration Configuring NTP AuthenticationNtp authenticate Configuring NTP Associations Key keyid source interface prefer Configuring NTP Broadcast ServiceSwitchconfig# ntp server 172.16.22.44 version Ntp peer ip-address version number Ntp broadcast client Interface interface-idNtp broadcast version number key keyid Destination-address Serve-onl y serve peer Configuring NTP Access RestrictionsNtp broadcastdelay microseconds Ntp access-group query-only Command Purpose Interface interface-id Configuring the Source IP Address for NTP Packets Fundamentals Command Reference, Release Configuring Time and Date ManuallyDisplaying the NTP Configuration Setting the System Clock Minutes-offset Displaying the Time and Date ConfigurationConfiguring the Time Zone Clock timezone zone hours-offset Hh mm offset Configuring Summer Time Daylight Saving TimeClock summer-time zone recurring Week day month hh mm week day month Configuring a System Name and Prompt Clock summer-time zone date monthClock summer-time zone date date Understanding DNS Default System Name and Prompt ConfigurationConfiguring a System Name Copy running-config startup-confi g Ip name-server server-address1 Default DNS ConfigurationSetting Up DNS Ip domain-name name Default Banner Configuration Displaying the DNS ConfigurationCreating a Banner Configuring a Message-of-the-Day Login Banner Banner motd c message cUnix telnet Configuring a Login Banner Banner login c message cManaging the MAC Address Table MAC Addresses and VLANs Building the Address Table MAC Addresses and Switch Stacks Default MAC Address Table ConfigurationChanging the Address Aging Time Show mac address-table aging-time Configuring MAC Address Notification TrapsRemoving Dynamic Address Entries Mac address-table aging-time Mac address-table notification String by using the snmp-server communitySnmp-server enable traps mac-notification Snmp-server host host-addr traps informs version Adding and Removing Static Address Entries Show mac address-table static Configuring Unicast MAC Address FilteringMac address-table static mac-addr Vlan vlan-id interface interface-id Vlan vlan-id drop Displaying Address Table Entries Managing the ARP Table OL-9775-02 Understanding the SDM Templates Configuring SDM Templates Dual IPv4 and IPv6 SDM Templates Resource Access Default Routing IPv4-and-IPv6 Resource Default Routing SDM Templates and Switch Stacks Configuring the Switch SDM Template Default SDM TemplateSDM Template Configuration Guidelines Vlan routing vlan Setting the SDM TemplateSdm prefer access default Dual-ipv4-and-ipv6 default routing Switchconfig# sdm prefer routing Switchconfig# sdm prefer dual-ipv4-and-ipv6 defaultDisplaying the SDM Templates Policy based routing aces 25K OL-9775-02 Preventing Unauthorized Access to Your Switch Configuring Switch-Based Authentication Default Password and Privilege Level Configuration Protecting Access to Privileged Exec Commands Setting or Changing a Static Enable Password Enable password passwordSwitchconfig# enable password l1u2c3k4y5 Service password-encryption Enable password level level passwordEncryption-type encrypted-password Enable secret level level password Disabling Password Recovery No service password-recoveryShow version Switchconfig-line#password let45me67in89 Setting a Telnet Password for a Terminal LineConfiguring Username and Password Pairs Password password Username name privilege level Configuring Multiple Privilege LevelsUsername command Login local Setting the Privilege Level for a Command Privilege mode level level commandShow privilege Changing the Default Privilege Level for Lines CommandLogging into and Exiting a Privilege Level Understanding TACACS+ Controlling Switch Access with TACACS+ Typical TACACS+ Network Configuration TACACS+ Operation Configuring TACACS+ Aaa group server tacacs+ group-name Default TACACS+ ConfigurationTacacs-server host hostname port Aaa new-model Configuring TACACS+ Login Authentication Aaa new-model Enable AAAShow tacacs Verify your entries Line console tty vty line-number Aaa authentication login defaultLogin authentication default Authentication login command Show running-config Verify your entries Controlling Switch Access with Radius Displaying the TACACS+ ConfigurationStarting TACACS+ Accounting Understanding Radius Radius Operation Transitioning from Radius to TACACS+ Services Configuring Radius Default Radius ConfigurationIdentifying the Radius Server Host Page Seconds retransmit retries key Acct-port port-number timeoutRadius-server host hostname Ip-address auth-port port-number Switchconfig# radius-server host host1 Configuring Radius Login Authentication Server Host section on Defining AAA Server Groups Aaa group server radius group-name Radius Aaa authorization network radius Starting Radius Accounting Radius-server retransmit retries Configuring Settings for All Radius ServersRadius-server timeout seconds Radius-server key string Cisco-avpair=ipoutacl#2=deny ip 10.10.10.10 0.0.255.255 any AuthenticationRadius-server vsa send accounting Cisco-avpair=shellpriv-lvl=15 Controlling Switch Access with Kerberos Displaying the Radius ConfigurationRadius-server host hostname ip-address non-standard Understanding Kerberos KDC Term Definition Srvtab Authenticating to a Boundary SwitchKerberos Operation Keytab Configuring Kerberos Authenticating to Network ServicesObtaining a TGT from a KDC Aaa authentication login default local Aaa authorization exec localAaa authorization network local Configuring the Switch for Secure Shell Username commandUsername name privilege level SSH Servers, Integrated Clients, and Supported Versions Understanding SSH Configuring SSH Configuration GuidelinesLimitations Setting Up the Switch to Run SSH Authentication-retries number Displaying the SSH Configuration and StatusConfiguring the SSH Server Ip ssh timeout seconds Configuring the Switch for Secure Socket Layer Http Understanding Secure Http Servers and ClientsCertificate Authority Trustpoints Rsakeypair TP-self-signed-3080755072 Configuring Secure Http Servers and Clients Default SSL ConfigurationCipherSuites Configuring a CA Trustpoint SSL Configuration Guidelines Configuring the Secure Http Server Ip http client secure-trustpoint name Configuring the Secure Http ClientIp http timeout-policy idle seconds life Show ip http server secure status Show ip http client secure status Configuring the Switch for Secure Copy ProtocolDisplaying Secure Http Server and Client Status Ip http client secure-ciphersuite Html Information About Secure Copy OL-9775-02 Configuring Ieee 802.1x Port-Based Authentication Understanding Ieee 802.1x Port-Based Authentication10-1 10-2 Device Roles 10-3 Authentication Process 10-4 Authentication Flowchart 10-5 Authentication Initiation and Message Exchange EAPOL-Start 10-6 Ieee 802.1x Authentication and Switch Stacks Ports in Authorized and Unauthorized States10-7 10-8 Ieee 802.1x Host Mode 10-9 Ieee 802.1x AccountingIeee 802.1x Accounting Attribute-Value Pairs Attribute Number AV Pair Name 10-10 Using Ieee 802.1x Authentication with Vlan Assignment 10-11 Using Ieee 802.1x Authentication with Per-User ACLs 10-12 Using Ieee 802.1x Authentication with Guest Vlan 10-13 Using Ieee 802.1x Authentication with Restricted Vlan 10-14 10-15 Using Ieee 802.1x Authentication with Voice Vlan Ports 10-16 Using Ieee 802.1x Authentication with Port Security 10-17 Using Ieee 802.1x Authentication with Wake-on-LAN 10-18 Using Multidomain Authentication Network Admission Control Layer 2 Ieee 802.1x Validation10-19 Using Web Authentication For example10-20 10-21 Configuring Ieee 802.1x Authentication Default Ieee 802.1x Authentication Configuration AAA10-22 Ieee 802.1x Authentication Configuration Guidelines Ieee 802.1x Authentication10-23 10-24 Configuring Ieee 802.1x Authentication MAC Authentication Bypass10-25 10-26 Configuring the Switch-to-RADIUS-Server Communication 10-27 Ip-address auth-port port-number key Show dot1x interface interface-id Configuring the Host ModeDot1x host-mode multi-host Multi-domain Configuring Periodic Re-Authentication Manually Re-Authenticating a Client Connected to a Port10-29 Show dot1x interface interface-id Verify your entries Changing the Switch-to-Client Retransmission TimeDot1x timeout tx-period seconds Changing the Quiet Period Dot1x max-reauth-req count Setting the Switch-to-Client Frame-Retransmission NumberSwitchconfig-if#dot1x timeout tx-period Show dot1xinterface interface-id Verify your entries 10-32 Setting the Re-Authentication NumberConfiguring Ieee 802.1x Accounting Switchconfig-if#dot1x max-reauth-req 10-33 Configuring a Guest Vlan Dot1x guest-vlan vlan-id Configuring a Restricted VlanSwitchport mode private-vlan host Switchconfig# interface gigabitethernet2/0/2 10-35 Dot1x auth-fail vlan vlan-idDot1x auth-fail max-attempts max Attempts Tries tries Configuring the Inaccessible Authentication Bypass FeatureSwitchconfig-if#dot1x auth-fail max-attempts Radius-server dead-criteria time time 10-37 Show dot1x interface interface-id Configuring Ieee 802.1x Authentication with WoLDot1x critical recovery action Reinitialize vlan vlan-id Dot1x control-direction both Configuring MAC Authentication BypassSwitchconfig-if#dot1x control-direction both Switchconfig-if#dot1x mac-auth-bypass 10-40 Configuring NAC Layer 2 Ieee 802.1x Validation 10-41 Configuring Web Authentication 10-42 10-43 Disabling Ieee 802.1x Authentication on the PortNo dot1x pae Disable Ieee 802.1x authentication on the port Dot1x fallback fallback-profile 10-44 Displaying Ieee 802.1x Statistics and Status Configuring Interface Characteristics Understanding Interface Types11-1 Switch Ports Port-Based VLANs11-2 Access Ports Trunk Ports11-3 Routed Ports Tunnel Ports11-4 Switch Virtual Interfaces EtherChannel Port Groups11-5 11-6 Power over Ethernet PortsGigabit Ethernet Interfaces Supported Protocols and Standards Powered-Device Detection and Initial Power Allocation Class11-7 11-8 Power Management Modes 11-9 Power Monitoring and Power Policing 11-10 Maximum Power Allocation Cutoff Power on a PoE Port 11-11 Connecting Interfaces 11-12 Ethernet Management Port 11-13 Connecting a Switch Stack to a PC 11-14 Tftp Mgmtclr Using Interface Configuration ModeMgmtinit Mgmtshow 11-16 Procedures for Configuring Interfaces Show interfaces interface-id Configuring a Range of InterfacesInterface range port-range macro Macroname 11-18 Interface range macro macroname Configuring and Using Interface Range MacrosShow running-config include define Define interface-range macroname 11-20 Configuring Ethernet InterfacesSwitch# show running-config include define Switch# show run include define 11-21 Default Ethernet Interface Configuration Configuring Interface Speed and Duplex Mode Speed and Duplex Configuration Guidelines11-22 Duplex auto full half Setting the Interface Speed and Duplex ParametersSpeed 10 100 1000 auto 10 Nonegotiate Configuring Ieee 802.3x Flow Control Flowcontrol receive on off desired11-24 11-25 Configuring Auto-MDIX on an InterfaceLocal Side Auto-MDIX With Correct Cabling Configuring a Power Management Mode on a PoE Port Interface-id phy11-26 Neve r static max max-wattage Budgeting Power for Devices Connected to a PoE PortPower inline auto max max-wattage Show power inline i nterface-id 11-28 Wattage 11-29 Configuring Power Policing 11-30 Adding a Description for an Interface 11-31 Configuring Layer 3 InterfacesConfiguring Ethernet Management Ports Switch# show interfaces gigabitethernet1/0/2 description 11-32 No switchportInterface gigabitethernet interface-id vlan vlan-id No shutdown 11-33 Configuring the System MTU 11-34 Use the system mtu jumbo Use the system mtu routingSystem mtu jumbo bytes System mtu routing bytes Show system mtu Configuring the Cisco Redundant Power SystemSystem mtu bytes Reload 11-36 Power rps switch-number name string serialnumberPower rps switch-number port rps-port-id mode active Standby Show env rps Configuring the Power SuppliesPower supply switch-numberoff on Show env power Monitoring and Maintaining the Interfaces Monitoring Interface Status11-38 11-39 Clearing and Resetting Interfaces and Counters 11-40 Shutting Down and Restarting the InterfaceInterface vlan vlan-id gigabitethernet interface-id Shutdown Configuring Smartports Macros Understanding Smartports Macros12-1 12-2 Configuring Smartports MacrosDefault Smartports Macro Configuration Macro Name Description 12-3 Smartports Macro Configuration Guidelines Show parser macro name macro-name Creating Smartports MacrosMacro name macro-name Name Sample-Macro and macro name sample-macro will result 12-5 Applying Smartports Macros 12-6 Applying Cisco-Default Smartports MacrosShow parser macro Show parser macro macro-name Switch# show parser macro cisco-desktop Switchconfig-if#macro apply cisco-desktop $AVID12-7 12-8 Displaying Smartports MacrosShow parser macro brief Show parser macro description interface Configuring VLANs Understanding VLANs13-1 13-2 Supported VLANs Vlan Port Membership Modes13-3 13-4 Configuring Normal-Range VLANs 13-5 Vlan ID Normal-Range Vlan Configuration Guidelines Token Ring VLANs13-6 Vlan Configuration in Vlan Database Configuration Mode Vlan Configuration Mode OptionsSaving Vlan Configuration Vlan Configuration in config-vlan Mode 13-8 Default Ethernet Vlan ConfigurationParameter Default Range VLANxxxx, where 13-9 Copy running-config startup configCreating or Modifying an Ethernet Vlan Remote-span Deleting a Vlan Vlan database13-10 Show vlan brief Assigning Static-Access Ports to a VlanSwitchport access vlan vlan-id No vlan vlan-id Vlan fields of the display Configuring Extended-Range VLANsDefault Vlan Configuration Show interfaces interface-id switchport 13-13 Extended-Range Vlan Configuration Guidelines 13-14 Vtp mode transparentCreating an Extended-Range Vlan Show vlan id vlan-id Show vlan internal usage Switchconfig# vtp mode transparentSwitch# copy running-config startup config Creating an Extended-Range Vlan with an Internal Vlan ID Trunking Overview Configuring Vlan TrunksCommand Command Mode Purpose Displaying VLANs 13-17 Switches in an ISL Trunking Environment 13-18 Mode FunctionEncapsulation Types Encapsulation Function 13-19 Default Layer 2 Ethernet Interface Vlan ConfigurationConfiguring an Ethernet Interface as a Trunk Port Ieee 802.1Q Configuration Considerations 13-20 Interaction with Other FeaturesConfiguring a Trunk Port Dot1q negotiate 13-21 Defining the Allowed VLANs on a Trunk 13-22 Switchport trunk allowed vlan addChanging the Pruning-Eligible List All except remove vlan-list Vlan ,vlan Configuring the Native Vlan for Untagged TrafficSwitchport trunk pruning vlan add Except none remove vlan-list 13-24 Configuring Trunk Ports for Load SharingLoad Sharing Using STP Port Priorities Switchport trunk native vlan vlan-id 13-25 Exit Return to global configuration mode Load Sharing Using STP Path CostOr switch stack Connect to the trunk ports configured on Switch a Spanning-tree vlan 2-4 cost Switchport trunk encapsulationInterface gigabitethernet1/0/1 Isl dot1q negotiate Configuring Vmps Understanding Vmps13-28 13-29 Default Vmps Client ConfigurationVmps Configuration Guidelines Dynamic-Access Port Vlan Membership Configuring the Vmps Client Entering the IP Address of the Vmps13-30 Vmps reconfirm Configuring Dynamic-Access Ports on Vmps ClientsSwitchport access vlan dynamic Reconfirming Vlan Memberships 13-32 Changing the Reconfirmation IntervalChanging the Retry Count Vmps reconfirm minutes Monitoring the Vmps Troubleshooting Dynamic-Access Port Vlan MembershipVmps Configuration Example Switch# show vmps 13-34 Dynamic Port Vlan Membership Configuration Configuring VTP Understanding VTP14-1 14-2 VTP Domain 14-3 VTP Mode DescriptionVTP Modes VTP Advertisements VTP Version VTP Pruning14-4 Vlan 14-5 Configuring VTP VTP and Switch Stacks14-6 14-7 Default VTP ConfigurationVTP Configuration Options VTP Configuration in Global Configuration Mode Domain Names VTP Configuration GuidelinesVTP Configuration in Vlan Database Configuration Mode Passwords 14-9 Configuring a VTP ServerConfiguration Requirements VTP Version Vtp server Vtp password passwordVtp password password Show vtp status 14-11 Configuring a VTP ClientVtp mode client Switch# vlan database 14-12 Disabling VTP VTP Transparent Mode Enabling VTP Version Vtp version14-13 14-14 Adding a VTP Client Switch to a VTP DomainEnabling VTP Pruning Vtp pruning 14-15 14-16 Monitoring VTP Configuring Voice Vlan Understanding Voice Vlan15-1 Cisco IP Phone Voice Traffic Cisco IP Phone Data Traffic15-2 15-3 Configuring Voice VlanDefault Voice Vlan Configuration Voice Vlan Configuration Guidelines 15-4 Configuring a Port Connected to a Cisco 7960 IP Phone 15-5 Configuring Cisco IP Phone Voice Traffic 15-6 Configuring the Priority of Incoming Data Frames 15-7 Displaying Voice Vlan 15-8 Configuring Private VLANs Understanding Private VLANs16-1 Private-VLAN Domain 16-2 16-3 IP Addressing Scheme with Private VLANs Private VLANs across Multiple Switches Private-VLAN Interaction with Other Features16-4 Private VLANs and Unicast, Broadcast, and Multicast Traffic Private VLANs and SVIs16-5 16-6 Configuring Private VLANsTasks for Configuring Private VLANs Private VLANs and Switch Stacks 16-7 Default Private-VLAN ConfigurationPrivate-VLAN Configuration Guidelines Secondary and Primary Vlan Configuration 16-8 Private-VLAN Port Configuration 16-9 Limitations with Other Features 16-10 Configuring and Associating VLANs in a Private Vlan Show vlan private-vlan type Show interfaces status16-11 Primaryvlanid secondaryvlanid Configuring a Layer 2 Interface as a Private-VLAN Host PortSwitchport private-vlan host-association Switch# show interfaces gigabitethernet1/0/22 switchport 16-13 Switchport mode private-vlan promiscuousSwitchport private-vlan mapping primaryvlanid Add remove secondaryvlanlist Show interface private-vlan mapping Switch# show interfaces private-vlan mappingInterface vlan primaryvlanid Private-vlan mapping add remove 16-15 Monitoring Private VLANs 16-16 Configuring Ieee 802.1Q and Layer 2 Protocol Tunneling Understanding Ieee 802.1Q Tunneling17-1 17-2 Ieee 802.1Q Tunnel Ports in a Service-Provider Network 17-3 Native VLANs Configuring Ieee 802.1Q TunnelingDefault Ieee 802.1Q Tunneling Configuration Ieee 802.1Q Tunneling Configuration Guidelines 17-5 System MTU 17-6 Ieee 802.1Q Tunneling and Other Features Show vlan dot1q tag native Configuring an Ieee 802.1Q Tunneling PortVlan dot1q tag native Show dot1q-tunnel 17-8 Understanding Layer 2 Protocol Tunneling Layer 2 Protocol Tunneling 17-9 17-10 Configuring Layer 2 Protocol Tunneling 17-11 Default Layer 2 Protocol Tunneling Configuration 17-12 Layer 2 Protocol Tunneling Configuration Guidelines 17-13 Configuring Layer 2 Protocol Tunneling Pagp lacp udld Configuring Layer 2 Tunneling for EtherChannelsConfiguring the SP Edge Switch L2protocol-tunnel point-to-point 17-15 17-16 Configuring the Customer Switch Switchconfig-if#channel-group 1 mode desirable Switchconfig# interface port-channel17-17 17-18 Monitoring and Maintaining Tunneling Status Configuring STP Understanding Spanning-Tree Features18-1 18-2 STP Overview 18-3 Spanning-Tree Topology and BPDUs 18-4 Bridge ID, Switch Priority, and Extended System ID 32768 16384 8192 4096 2048 1024 512 256 128 Switch Priority ValueSpanning-Tree Interface States Bit 18-6 2illustrates how an interface moves through the states Forwarding State Blocking StateListening State Learning State How a Switch or Port Becomes the Root Switch or Root Port Disabled State18-8 18-9 Spanning Tree and Redundant ConnectivitySpanning-Tree Address Management Accelerated Aging to Retain Connectivity Spanning-Tree Modes and Protocols Supported Spanning-Tree Instances18-10 Rapid PVST+ Spanning-Tree Interoperability and Backward CompatibilitySTP and Ieee 802.1Q Trunks VLAN-Bridge Spanning Tree Configuring Spanning-Tree Features Spanning Tree and Switch Stacks18-12 Default Spanning-Tree Configuration Spanning-Tree Configuration Guidelines18-13 18-14 18-15 Changing the Spanning-Tree Mode 18-16 Configuring the Root SwitchDisabling Spanning Tree Show spanning-tree vlan vlan-id Verify your entries 18-17 Spanning-tree vlan vlan-id root primaryDiameter net-diameter hello-time seconds Show spanning-tree detail Diameter net-diameter hello-time Configuring a Secondary Root SwitchConfiguring Port Priority Spanning-tree vlan vlan-id root secondary Show spanning-tree vlan vlan-id Spanning-tree port-priority prioritySpanning-tree vlan vlan-id port-priority priority Show spanning-tree interface interface-id Spanning-tree vlan vlan-id cost cost Configuring Path CostPort-channel-number Spanning-tree cost cost Configuring the Switch Priority of a Vlan Spanning-tree vlan vlan-id priority priority18-21 18-22 Configuring Spanning-Tree TimersConfiguring the Hello Time Spanning-tree vlan vlan-id hello-time seconds Spanning-tree vlan vlan-idmax-age seconds Configuring the Forwarding-Delay Time for a VlanConfiguring the Maximum-Aging Time for a Vlan Spanning-tree vlan vlan-id forward-time 18-24 Configuring the Transmit Hold-CountDisplaying the Spanning-Tree Status Show spanning-tree detail Verify your entries 19-1 Configuring Mstp Understanding Mstp Multiple Spanning-Tree Regions19-2 IST, CIST, and CST Operations Within an MST Region19-3 19-4 Operations Between MST Regions 19-5 Hop CountIeee 802.1s Terminology Cisco Prestandard Cisco Standard Boundary Ports Ieee 802.1s Implementation19-6 Interoperation Between Legacy and Standard Switches Port Role Naming Change19-7 Mstp and Switch Stacks Detecting Unidirectional Link Failure19-8 19-9 Understanding RstpInteroperability with Ieee 802.1D STP Port Roles and the Active Topology 19-10 Rapid Convergence 19-11 Synchronization of Port Roles Bridge Protocol Data Unit Format and Processing Bit Function19-12 19-13 Topology ChangesProcessing Superior Bpdu Information Processing Inferior Bpdu Information 19-14 Configuring Mstp Features Default Mstp Configuration Mstp Configuration Guidelines19-15 Name name Specifying the MST Region Configuration and Enabling MstpSpanning-tree mst configuration Instance instance-id vlan vlan-range Exit Spanning-tree mode mstRevision version Show pending 19-18 Spanning-tree mst instance-id root primary 19-19 Spanning-tree mst instance-id port-priority priority Show spanning-tree mst interface interface-id19-20 19-21 Spanning-tree mst instance-id cost cost 19-22 Configuring the Switch PriorityConfiguring the Hello Time Spanning-tree mst instance-id priority priority Show spanning-tree mst Configuring the Forwarding-Delay TimeShow spanning-tree mst Verify your entries Spanning-tree mst forward-time seconds Spanning-tree mst max-age seconds Configuring the Maximum-Aging TimeConfiguring the Maximum-Hop Count Specifying the Link Type to Ensure Rapid Transitions 19-25 Designating the Neighbor Type Displaying the MST Configuration and Status Restarting the Protocol Migration Process19-26 Configuring Optional Spanning-Tree Features Understanding Optional Spanning-Tree Features20-1 Understanding Port Fast Understanding Bpdu Guard20-2 Understanding Bpdu Filtering Understanding UplinkFast20-3 20-4 Switches in a Hierarchical Network 20-5 Understanding Cross-Stack UplinkFast 20-6 How Csuf Works Understanding BackboneFast Events that Cause Fast Convergence20-7 BackboneFast Example Before Indirect Link Failure 20-8 20-9 Adding a Switch in a Shared-Medium Topology Understanding EtherChannel Guard Understanding Root Guard20-10 20-11 Understanding Loop Guard 20-12 Default Optional Spanning-Tree ConfigurationOptional Spanning-Tree Configuration Guidelines Enabling Port Fast Portfast Spanning-tree portfast trunk interface configurationEnabling Bpdu Guard Spanning-tree portfast trunk Spanning-tree portfast Enable the Port Fast feature Enabling Bpdu Filtering20-14 20-15 Enabling UplinkFast for Use with Redundant Links Enabling BackboneFast Spanning-tree uplinkfast max-update-rateUplinkfast command Enabling Cross-Stack UplinkFast 20-17 Spanning-tree backbonefast Enable BackboneFastEnabling EtherChannel Guard Show spanning-tree summary Verify your entries Enabling Root Guard Enabling Loop Guard20-18 20-19 20-20 21-1 Flex Links Switchport backup interface preemption delay commands Vlan Flex Link Load Balancing and Support21-2 21-3 MAC Address-Table Move Update 21-4 MAC Address-Table Move Update Example Configuration Guidelines Default Configuration21-5 Switch# show interface switchport backup Configuring Flex LinksSwitchport backup interface interface-id Show interface interface-id switchport backup 21-7 Switchport backup interface interface-id preemptionMode forced bandwidth off Delay delay-time Switch#show interfaces switchport backup Configuring Vlan Load Balancing on Flex LinksSwitchport backup interface interface-id prefer vlan Show interfaces interface-id switchport backup 21-9 Configuring the MAC Address-Table Move Update FeatureSwitchport backup interface interface-idmmu Primary vlan vlan-id 21-10 End Return to global configuration modeSwitchconf# mac address-table move update transmit Switch# show mac-address-table move update 21-11 Monitoring Flex Links and the MAC Address-Table Move Update 21-12 Configuring Dhcp Features and IP Source Guard Understanding Dhcp Features22-1 22-2 Dhcp ServerDhcp Relay Agent Dhcp Snooping 22-3 Option-82 Data Insertion Dhcp Relay Agent in a Metropolitan Ethernet Network 22-4 22-5 Remote ID Suboption Frame Format 22-6 Cisco IOS Dhcp Server DatabaseDhcp Snooping Binding Database Release 22-7 22-8 Configuring Dhcp FeaturesDhcp Snooping and Switch Stacks Default Dhcp Configuration 22-9 Dhcp Snooping Configuration Guidelines Configuring the Dhcp Server Dhcp Server and Switch Stacks22-10 22-11 Configuring the Dhcp Relay AgentSpecifying the Packet Forwarding Address Ip helper-address address Interface range port-range Switchport mode accessSwitchport access vlan vlan-id Enabling Dhcp Snooping and Option 22-13 Ip dhcp snooping database Enabling Dhcp Snooping on Private VLANsEnabling the Cisco IOS Dhcp Server Database Enabling the Dhcp Snooping Binding Database Agent 22-15 Displaying Dhcp Snooping Information Understanding IP Source Guard Source IP Address Filtering22-16 Source IP and MAC Address Filtering Configuring IP Source GuardDefault IP Source Guard Configuration IP Source Guard Configuration Guidelines 22-18 Enabling IP Source Guard 22-19 Displaying IP Source Guard Information 22-20 Configuring Dynamic ARP Inspection Understanding Dynamic ARP Inspection23-1 ARP Cache Poisoning 23-2 23-3 Interface Trust States and Network Security Rate Limiting of ARP Packets Relative Priority of ARP ACLs and Dhcp Snooping Entries23-4 23-5 Configuring Dynamic ARP InspectionDefault Dynamic ARP Inspection Configuration Logging of Dropped Packets 23-6 Dynamic ARP Inspection Configuration Guidelines 23-7 Configuring Dynamic ARP Inspection in Dhcp EnvironmentsShow cdp neighbors Ip arp inspection vlan vlan-range 23-8 Configuring ARP ACLs for Non-DHCP Environments 23-9 Specified with the ip arp inspection vlan logging Show arp access-list acl-nameLimiting the Rate of Incoming ARP Packets No ip arp inspection trust 23-11 Performing Validation Checks Show ip arp inspection vlan Configuring the Log BufferIp arp inspection validate Src-mac dst-mac ip Ip arp inspection log-buffer entries Number logs number interval23-13 23-14 Displaying Dynamic ARP Inspection Information Show ip arp inspection log Clear ip arp inspection statisticsShow ip arp inspection statistics vlan Clear ip arp inspection log 23-16 24-1 Configuring Igmp Snooping and MVR 24-2 Understanding Igmp Snooping Igmp Versions Joining a Multicast Group24-3 24-4 224.1.2.3 24-5 Leaving a Multicast Group 24-6 Igmp Configurable-Leave TimerImmediate Leave Igmp Report Suppression PIM-DVMRP Configuring Igmp SnoopingIgmp Snooping and Switch Stacks Default Igmp Snooping Configuration Enabling or Disabling Igmp Snooping Ip igmp snooping vlan vlan-id24-8 Show ip igmp snooping Setting the Snooping MethodIp igmp snooping vlan vlan-id mrouter Learn cgmp pim-dvmrp Configuring a Multicast Router Port Show ip igmp snooping mrouter vlan vlan-id24-10 Show ip igmp snooping groups Configuring a Host Statically to Join a GroupEnabling Igmp Immediate Leave Ip igmp snooping vlan vlan-id static ipaddress 24-12 Configuring the Igmp Leave Timer Count Configuring TCN-Related CommandsRecovering from Flood Mode Controlling the Multicast Flooding Time After a TCN Event Disabling Multicast Flooding During a TCN Event No ip igmp snooping tcn flood24-14 24-15 Configuring the Igmp Snooping Querier Disabling Igmp Report Suppression No ip igmp snooping report-suppression24-16 24-17 Displaying Igmp Snooping Information 24-18 Understanding Multicast Vlan Registration 24-19 Using MVR in a Multicast Television Application 24-20 Configuring MVRDefault MVR Configuration MVR 24-21 MVR Configuration Guidelines and LimitationsConfiguring MVR Global Parameters Mvr Enable MVR on the switch 24-22 Configuring MVR Interfaces Show mvr interface Show mvr members Mvr type source receiverMvr immediate Show mvr Configuring Igmp Filtering and Throttling Displaying MVR Information24-24 Default Igmp Filtering and Throttling Configuration Configuring Igmp Profiles24-25 Show ip igmp profile profile number Ip igmp profile profile numberPermit deny Range ip multicast address Ip igmp filter profile number Setting the Maximum Number of Igmp GroupsSwitch# show ip igmp profile Applying Igmp Profiles Interface-id Configuring the Igmp Throttling ActionShow running-config interface Verify the configuration EtherChannel group or a EtherChannel interface Show ip igmp profile profile Displaying Igmp Filtering and Throttling ConfigurationIp igmp max-groups action deny Replace 24-30 Configuring IPv6 MLD Snooping Understanding MLD Snooping25-1 25-2 25-3 MLD MessagesMLD Queries Multicast Client Aging Robustness 25-4 Multicast Router DiscoveryMLD Reports MLD Done Messages and Immediate-Leave 25-5 Configuring IPv6 MLD SnoopingMLD Snooping in Switch Stacks Topology Change Notification Processing Default MLD Snooping Configuration MLD Snooping Configuration Guidelines25-6 25-7 Enabling or Disabling MLD SnoopingIpv6 mld snooping Ipv6 mld snooping vlan vlan-id Show ipv6 mld snooping multicast-address vlan Configuring a Static Multicast GroupIpv6 mld snooping vlan vlan-id static Show ipv6 mld snooping multicast-address user 25-9 Enabling MLD Immediate LeaveIpv6 mld snooping vlan vlan-id mrouter Show ipv6 mld snooping mrouter vlan vlan-id 25-10 Configuring MLD Snooping Queries Displaying MLD Snooping Information Disabling MLD Listener Message Suppression25-11 25-12 Show ipv6 mld snooping querier vlan vlan-idVlan-id count dynamic user Vlan-id ipv6-multicast-address 26-1 Configuring Port-Based Traffic ControlConfiguring Storm Control Understanding Storm Control Broadcast Storm Control Example 26-2 Default Storm Control Configuration Configuring Storm Control and Threshold Levels26-3 Storm-control action shutdown trap Storm-control broadcast multicastUnicast level level level-low bps bps Bps-low pps pps pps-low Multicast unicast Configuring Protected PortsDefault Protected Port Configuration Show storm-control interface-id broadcast 26-6 Configuring Port BlockingProtected Port Configuration Guidelines Configuring a Protected Port 26-7 Configuring Port SecurityDefault Port Blocking Configuration Blocking Flooded Traffic on an Interface Understanding Port Security Secure MAC Addresses26-8 26-9 Security Violations 26-10 Default Port Security ConfigurationPort Security Configuration Guidelines Forwarded1 Trap Message Message2 Increments 26-11 26-12 Enabling and Configuring Port Security 26-13 Switchport port-security violationProtect restrict shutdown Shutdown vlan 26-14 Switchconfig-if#switchport port-security violation restrict Switchconfig-if#switchport port-securitySwitchconfig-if#switchport port-security maximum Switchconfig-if#switchport port-security mac-address sticky 26-16 Enabling and Configuring Port Security Aging 26-17 Port Security and Switch StacksSwitchconfig# interface GigabitEthernet 1/0/8 Port Security and Private VLANs 26-18 Displaying Port-Based Traffic Control SettingsShow port-security interface interface-idaddress Show port-security interface interface-idvlan Configuring CDP Understanding CDP27-1 Configuring the CDP Characteristics Configuring CDPCDP and Switch Stacks Default CDP Configuration Show cdp Disabling and Enabling CDPCdp holdtime seconds Cdp advertise-v2 27-4 No cdp enable Disable CDP on the interfaceCdp enable Enable CDP on the interface after disabling it Disabling and Enabling CDP on an Interface 27-5 Monitoring and Maintaining CDP 27-6 28-1 Configuring Lldp and LLDP-MEDUnderstanding Lldp and LLDP-MED Understanding Lldp 28-2 Understanding LLDP-MED 28-3 Configuring Lldp and LLDP-MEDDefault Lldp Configuration Configuring Lldp Characteristics 28-4 Disabling and Enabling Lldp Globally 28-5 Disabling and Enabling Lldp on an Interface Lldp med-tlv-select tlv Specify the TLV to enable Configuring LLDP-MED TLVsTLV, and enter interface configuration mode No lldp med-tlv-select tlv Specify the TLV to disable 28-7 Monitoring and Maintaining Lldp and LLDP-MED 28-8 29-1 Configuring UdldUnderstanding Udld Modes of Operation 29-2 Methods to Detect Unidirectional Links 29-3 Configuring Udld 29-4 Default Udld Configuration Show udld Udld aggressive enable message timeMessage-timer-interval Enabling Udld Globally Udld port aggressive Resetting an Interface Disabled by UdldUdld reset Show udld Enabling Udld on an Interface 29-7 Displaying Udld Status 29-8 Configuring Span and Rspan Understanding Span and Rspan30-1 30-2 Local Span 30-3 Remote Span Span and Rspan Concepts and Terminology Span Sessions30-4 30-5 Monitored Traffic 30-6 Source Ports Source VLANs Vlan Filtering30-7 30-8 Destination Port Span and Rspan Interaction with Other Features Rspan Vlan30-9 Configuring Span and Rspan Span and Rspan and Switch Stacks30-10 30-11 Default Span and Rspan ConfigurationConfiguring Local Span Span Configuration Guidelines 30-12 Creating a Local Span Session Show monitor session sessionnumber Monitor session sessionnumberDestination interface interface-id Encapsulation replicate 30-14 Specifying VLANs to Filter Monitor session sessionnumber filter vlan30-15 30-16 Configuring RspanRspan Configuration Guidelines Be a Vlan 30-17 Configuring a Vlan as an Rspan Vlan 30-18 Creating an Rspan Source SessionInterfaces port-channelport-channel-number. Valid Destination remote vlan vlan-id Creating an Rspan Destination Session Remote vlan vlan-id30-19 30-20 Ingress dot1q vlan vlan-id isl untagged Untagged vlan vlan-id or vlan vlan-id- Forward incoming30-21 30-22 Show monitor session sessionnumber 30-23 Displaying Span and Rspan Status 30-24 Configuring Rmon Understanding Rmon31-1 31-2 Configuring Rmon Default Rmon Configuration Configuring Rmon Alarms and Events31-3 Rmon event number description string log owner string Add an event in the Rmon event table that is31-4 Show rmon history Collecting Group History Statistics on an InterfaceCollecting Group Ethernet Statistics on an Interface Rmon collection history index 31-6 Displaying Rmon StatusRmon collection stats index owner ownername Show rmon statistics Configuring System Message Logging Understanding System Message Logging32-1 Configuring System Message Logging System Log Message Format32-2 Hhmmss short uptime Text string that uniquely describes the message32-3 Disabling Message Logging Default System Message Logging ConfigurationNo logging console Disable message logging Show running-config Verify your entries Show logging 32-5 Setting the Message Display Destination DeviceLogging buffered size Logging host Session to see the debugging messages Synchronizing Log MessagesLogging file flash filename Terminal monitor All limit number-of-buffers Line console vty line-numberLine vty Logging synchronous level severity-level Enabling and Disabling Time Stamps on Log Messages Enabling and Disabling Sequence Numbers in Log Messages32-8 Logging trap level Defining the Message Severity LevelLogging console level Logging monitor level 32-10 Level Description Syslog Definition 32-11 Enabling the Configuration-Change LoggerLogging history level Logging history size number Configuring Unix Syslog Servers Logging Messages to a Unix Syslog Daemon32-12 32-13 Configuring the Unix System Logging FacilityLogging facility facility-type Facility-type keywords Displaying the Logging Configuration Facility Type Keyword Description32-14 Configuring Snmp Understanding Snmp33-1 33-2 Snmp Versions Operation Description Model Level Authentication Encryption ResultSnmp Manager Functions DES Using Snmp to Access MIB Variables Snmp Agent Functions33-4 33-5 Snmp Notifications SVI Configuring SnmpSnmp ifIndex MIB Object Values IfIndex Range Default Snmp Configuration Snmp Configuration Guidelines33-7 33-8 Configuring Community StringsNo snmp-server Disable the Snmp agent operation Disabling the Snmp Agent Permit source source-wildcard View-name ro rw access-list-numberAccess-list access-list-number deny Snmp-server community string view 33-10 Configuring Snmp Groups and UsersSnmp-server engineID local engineid-string Snmp-server engineID local 33-11 Write writeview notify notifyview accessSnmp-server group groupname v1 v2c Auth noauth priv read readview Notification Type Keyword Description Configuring Snmp NotificationsRemote host udp-port port v1 access Encrypted access access-list auth md5 33-13 33-14 Notification-types Setting the Agent Contact and Location Information33-12 , or enter snmp-server enable traps ? Enable traps command for each trap type Snmp-server tftp-server-list Switchconfig# snmp-server community publicLimiting Tftp Servers Used Through Snmp Snmp Examples 33-17 Displaying Snmp Status 33-18 Configuring Network Security with ACLs Understanding ACLs34-1 34-2 Supported ACLs 34-3 Port ACLs 34-4 Router ACLs Handling Fragmented and Unfragmented Traffic Vlan Maps34-5 34-6 ACLs and Switch Stacks 34-7 Configuring IPv4 ACLs 34-8 Access List NumbersAccess List Number Type Supported Creating Standard and Extended IPv4 ACLs 34-9 ACL Logging Source source-wildcard log Access-list access-list-number deny permitShow access-lists number name Creating a Numbered Standard ACL 34-11 Creating a Numbered Extended ACL 34-12 34-13 34-14 Resequencing ACEs in an ACL Creating Named Standard and Extended ACLs34-15 Tos tos established log time-range Ip access-list standard nameIp access-list extended name Any log 34-17 Using Time Ranges with ACLs 34-18 Absolute start time datePeriodic weekdays weekend daily Show time-range 34-19 Switch# show ip access-listsApplying an IPv4 ACL to a Terminal Line Including Comments in ACLs 34-20 Access-class access-list-numberApplying an IPv4 ACL to an Interface Out 34-21 Ip access-group access-list-number IPv4 ACL Configuration Examples Hardware and Software Treatment of IP ACLs34-22 Switchconfig# access-list 6 permit 172.20.128.64 Switchconfig# access-list 106 permit ip any 172.20.128.6434-23 Numbered ACLs Extended ACLs34-24 34-25 Named ACLsTime Range Applied to an IP ACL Commented IP ACL Entries Switch# show logging Switchconfig-if#ip access-group ext134-26 34-27 Creating Named MAC Extended ACLs 34-28 Applying a MAC ACL to a Layer 2 Interface ACL Configuring Vlan MapsMac access-group name Show mac access-group interface interface-id 34-30 Vlan Map Configuration Guidelines Match ip mac address name Vlan access-map name numberCreating a Vlan Map Action drop forward 34-32 Examples of ACLs and Vlan Maps 34-33 Vlan filter mapname vlan-list list Using Vlan Maps in Your NetworkWiring Closet Configuration Applying a Vlan Map to a Vlan Switchconfig# vlan filter map2 vlan Denying Access to a Server on Anothera VlanSwitchconfig# vlan access-map map2 Switchconfig# ip access-list extended matchall 34-36 Using Vlan Maps with Router ACLs 34-37 Vlan Maps and Router ACL Configuration Guidelines 34-38 ACLs and Switched PacketsExamples of Router ACLs and Vlan Maps Applied to VLANs ACLs and Bridged Packets 34-39 ACLs and Routed Packets 34-40 Displaying IPv4 ACL ConfigurationShow ip access-lists number name ACLs and Multicast Packets 34-41 Show running-config interface interface-idShow mac access-group interface interface-id Show ip interface interface-id 34-42 35-1 Configuring IPv6 ACLs 35-2 Understanding IPv6 ACLs 35-3 Supported ACL FeaturesIPv6 ACLs and Switch Stacks IPv6 ACL Limitations 35-4 Configuring IPv6 ACLsDefault IPv6 ACL Configuration Interaction with Other Features and Switches Ipv6 access-list access-list-name Creating IPv6 ACLs35-5 35-6 Dscp value fragments logLog-input routing sequence Value time-range name 35-7 35-8 Ipv6 traffic-filter access-list-nameApplying an IPv6 ACL to an Interface Ipv6 address ipv6-address 35-9 Show access-listsShow ipv6 access-list access-list-name Displaying IPv6 ACLs 35-10 36-1 Configuring QoS 36-2 Understanding QoS 36-3 Basic QoS Model Basic QoS Model 36-4 36-5 Classification Check if packet came with CoS label tag Yes 36-6 Classification Based on QoS ACLs Classification Based on Class Maps and Policy Maps36-7 36-8 Policing and Marking 36-9 Policing on Physical Ports 36-10 Policing on SVIs 36-11 Policing and Marking Flowchart on SVIs 36-12 Mapping Tables 36-13 Queueing and Scheduling Overview Weighted Tail Drop SRR Shaping and Sharing36-14 36-15 Queueing and Scheduling on Ingress Queues 36-16 Queue Type Function 36-17 WTD Thresholds 36-18 Queueing and Scheduling on Egress Queues 36-19 36-20 Buffer and Memory Allocation 36-21 Packet Modification 36-22 Configuring Auto-QoS 36-23 Generated Auto-QoS Configuration 36-24 Description Automatically Generated Command 36-25 Or shared on the egress queues mapped to the port Switch automatically configures the egress queue bufferSizes. It configures the bandwidth and the SRR mode shaped If you entered the auto qos voip trust command, the switch Effects of Auto-QoS on the Configuration Auto-QoS Configuration Guidelines36-27 Show auto qos interface interface-id Enabling Auto-QoS for VoIPAuto qos voip cisco-phone Cisco-softphone trust 36-29 36-30 Auto-QoS Configuration Example Show auto qos Cdp enableDebug auto qos Auto qos voip trust Configuring Standard QoS Displaying Auto-QoS Information36-32 Default Standard QoS Configuration Default Ingress Queue Configuration36-33 Default Egress Queue Configuration Dscp Value Queue ID -Threshold ID36-34 Applying QoS on Interfaces Standard QoS Configuration GuidelinesDefault Mapping Table Configuration QoS ACL Guidelines Policing Guidelines General QoS Guidelines36-36 Enabling QoS Globally Enabling VLAN-Based QoS on Physical Ports36-37 Configuring Classification Using Port Trust States Configuring the Trust State on Ports within the QoS Domain36-38 15 Port Trusted States within the QoS Domain 36-39 36-40 Configuring the CoS Value for an InterfaceMls qos trust cos dscp ip-precedence Show mls qos interface Configuring a Trusted Boundary to Ensure Port Security Mls qos cos default-cos override36-41 36-42 Enabling Dscp Transparency ModeMls qos trust dscp Mls qos trust device cisco-phone 36-43 No mls qos rewrite ip dscp 36-44 Mls qos map dscp-mutationMls qos dscp-mutation Show mls qos maps dscp-mutation Configuring a QoS Policy Switchconfig-if#mls qos dscp-mutation gi1/0/2-mutation36-45 36-46 Classifying Traffic by Using ACLs Source-wildcard Switchconfig# access-list 100 permit ip any any dscpSwitchconfig# access-list 102 permit pim any 224.0.0.2 dscp Permit protocol source source-wildcard 36-48 Mac access-list extended name Match-any keywords Classifying Traffic by Using Class MapsClass-map match-all match-any Is match-all Show class-map Match access-group acl-index-or-nameIp dscp dscp-list ip precedence Ip-precedence-list 36-51 Policy-map policy-map-name Class class-map-name36-52 36-53 Service-policy input policy-map-name Show policy-map policy-map-nameclass36-54 36-55 Switchconfig# policy-map macpolicy1Switchconfig-pmap#class macclass2 maclist2 Switchconfig-if#service-policy input macpolicy1 36-56 Traffic by Using Class Maps section on 36-57 36-58 Police rate-bps burst-byte exceed-actionDrop policed-dscp-transmit Exceed-action policed-dscp-transmit keywords to mark down 36-59 Service-policy policy-map-name Service-policy input policy-map-name Show policy-map policy-map-nameclassShow mls qos vlan-based Policed-dscp-transmit Mls qos aggregate-policerAggregate-policer-name rate-bps burst-byte Exceed-action drop Only one policy map per ingress port is supported Show mls qos aggregate-policerAggregate-policer-name CoS Value Dscp Value Configuring Dscp MapsConfiguring the CoS-to-DSCP Map Switchconfig-pmap-c#police aggregate transmit1 36-64 Configuring the IP-Precedence-to-DSCP MapMls qos map cos-dscp dscp1...dscp8 IP Precedence Value Dscp Value 36-65 Configuring the Policed-DSCP Map Show Configuring the DSCP-to-CoS MapDscp Value CoS Value 36-66 36-67 Configuring the DSCP-to-DSCP-Mutation MapMls qos map dscp-cos dscp-list to cos Show mls qos maps dscp-to-cos Switchconfig-if#mls qos dscp-mutation mutation1 Switch# show mls qos maps dscp-mutation mutation136-68 36-69 Configuring Ingress Queue Characteristics Show mls qos maps Mls qos srr-queue input dscp-mapMls qos srr-queue input cos-map Mls qos srr-queue input threshold Show mls qos interface buffer Allocating Buffer Space Between the Ingress QueuesAllocating Bandwidth Between the Ingress Queues Mls qos srr-queue input buffers Show mls qos interface queueing Configuring the Ingress Priority QueueWeight1 weight2 Mls qos srr-queue input bandwidth Priority-queue queue-id bandwidth Configuring Egress Queue CharacteristicsWeight Mls qos srr-queue input 36-74 Mls qos queue-set output qset-id Queue-set qset-id36-75 36-76 Mls qos srr-queue output dscp-map Mls qos srr-queue output cos-map36-77 Queueing Configuring SRR Shaped Weights on Egress QueuesSrr-queue bandwidth shape weight1 Weight2 weight3 weight4 36-79 Configuring SRR Shared Weights on Egress QueuesConfiguring the Egress Expedite Queue Srr-queue bandwidth share weight1 36-80 Mls qos Enable QoS on a switchSrr-queue bandwidth limit weight1 Limiting the Bandwidth on an Egress Interface 36-81 Displaying Standard QoS Information 36-82 Show running-config include rewrite Configuring EtherChannels and Link-State Tracking Understanding EtherChannels37-1 37-2 EtherChannel Overview 37-3 Single-Switch EtherChannel 37-4 Port-Channel Interfaces 37-5 Port Aggregation Protocol Auto PAgP Interaction with Other FeaturesMode Description PAgP Modes 37-7 Lacp Interaction with Other FeaturesLink Aggregation Control Protocol Lacp Modes EtherChannel On Mode Load-Balancing and Forwarding Methods37-8 37-9 37-10 EtherChannel and Switch Stacks Configuring EtherChannels Default EtherChannel Configuration37-11 37-12 EtherChannel Configuration Guidelines 37-13 Configuring Layer 2 EtherChannels Auto non-silent desirable non-silent on Active passive37-14 37-15 Configuring Layer 3 EtherChannelsSwitchconfig-if-range#channel-group 5 mode active Creating Port-Channel Logical Interfaces No ip address Configuring the Physical InterfacesInterface port-channel port-channel-number Show etherchannel channel-group-number detail 37-17 Partner that is PAgP capable, configure the switch port forFor channel-group-number, the range is 1 to 48. This number Must be the same as the port-channel-number logical port 37-18 Configuring EtherChannel Load-BalancingPort-channel load-balance dst-ip dst-mac Src-dst-ip src-dst-mac src-ip src-mac Configuring the PAgP Learn Method and Priority Show etherchannel load-balance Verify your entries37-19 Show pagp channel-group-number internal Configuring Lacp Hot-Standby PortsPagp learn-method physical-port Pagp port-priority priority Configuring the Lacp System Priority Show running-config Verify your entries Show lacp sys-id37-21 Internal Configuring the Lacp Port PriorityLacp port-priority priority Show lacp channel-group-number Displaying EtherChannel, PAgP, and Lacp Status Understanding Link-State Tracking37-23 37-24 37-25 Configuring Link-State Tracking 37-26 Default Link-State Tracking ConfigurationLink-State Tracking Configuration Guidelines Configuring Link-State Tracking 37-27 Switch show link state groupSwitch show link state group detail Displaying Link-State Tracking Status 37-28 38-1 Configuring IP Unicast Routing Understanding IP Routing Types of Routing38-2 38-3 IP Routing and Switch Stacks 38-4 Steps for Configuring Routing Configuring IP Addressing38-5 38-6 Default Addressing ConfigurationARP Irdp 38-7 Show running-config Verify your entryAssigning IP Addresses to Network Interfaces Use of Subnet Zero 38-8 Classless Routing Configuring Address Resolution Methods No ip classless Disable classless routing behavior38-9 Define a Static ARP Cache Arp ip-address hardware-address type38-10 38-11 Set ARP Encapsulation Proxy ARP Routing Assistance When IP Routing is DisabledEnable Proxy ARP Default Gateway 38-13 Icmp Router Discovery Protocol Irdp 38-14 Configuring Broadcast Packet Handling Ip directed-broadcast access-list-number Ip forward-protocol udp port nd sdns38-15 38-16 Forwarding UDP Broadcast Packets and Protocols 38-17 Establishing an IP Broadcast AddressFlooding IP Broadcasts Ip broadcast-address ip-address Clear ip route network mask Monitoring and Maintaining IP AddressingClear arp-cache Clear host name 38-19 Enabling IP Unicast Routing 38-20 Configuring RIP Network network number Default RIP ConfigurationConfiguring Basic RIP Parameters Router rip 38-22 Ip rip authentication mode text md5 Configuring RIP AuthenticationConfiguring Summary Addresses and Split Horizon Ip rip authentication key-chain name-of-chain No ip split horizon Configuring Split HorizonSwitchconfig-router#neighbor 2.2.2.2 peer-group mygroup Ip summary-address rip ip address ip-network mask Configuring Ospf No ip split-horizon38-25 38-26 Default Ospf Configuration 38-27 Ospf Nonstop Forwarding 38-28 Ospf NSF Awareness Configuring Basic Ospf Parameters Configuring Ospf Interfaces38-29 38-30 38-31 Configuring Ospf Area Parameters 38-32 Configuring Other Ospf Parameters 38-33 38-34 Configuring a Loopback InterfaceChanging LSA Group Pacing Ip address address mask Configuring Eigrp Monitoring Ospf38-35 38-36 38-37 Default Eigrp Configuration 38-38 Eigrp Nonstop Forwarding Eigrp log-neighbor-changes Configuring Basic Eigrp ParametersRouter eigrp autonomous-system Network network-number 38-40 Configuring Eigrp InterfacesNo auto-summary Ip summary-address eigrp Show ip eigrp interface Configuring Eigrp Route AuthenticationIp hello-interval eigrp autonomous-system-number No ip split-horizon eigrp autonomous-system-number 38-42 Eigrp Stub Routing Configuring BGP Monitoring and Maintaining Eigrp38-43 EBGP, IBGP, and Multiple Autonomous Systems 38-44 38-45 Default BGP Configuration 38-46 38-47 Nonstop Forwarding Awareness Route-map route-map-name Enabling BGP RoutingRouter bgp autonomous-system Network network-number mask network-mask 38-49 38-50 Switchconfig-router#neighbor 192.208.10.2 remote-asSwitch# show ip bgp neighbors Managing Routing Policy Changes Show ip bgp Type of Reset Advantages DisadvantagesShow ip bgp neighbors Clear ip bgp * address 38-52 Configuring BGP Decision Attributes 38-53 Configuring BGP Filtering with Route Maps Configuring BGP Filtering by Neighbor38-54 Show ip bgp neighbors paths Ip as-path access-list access-list-numberOut weight weight Route-map map-tag in out 38-56 Configuring Prefix Lists for BGP Filtering Send-community Configuring BGP Community FilteringIp community-listcommunity-list-number Permit deny community-number Show ip bgp community Configuring BGP Neighbors and Peer GroupsSet comm-list list-num delete Ip bgp-community new-format 38-59 38-60 Configuring Aggregate Addresses Configuring Routing Domain Confederations Configuring BGP Route Reflectors38-61 No bgp client-to-client reflection Configuring Route DampeningRoute-reflector-client Bgp cluster-id cluster-id 38-63 Monitoring and Maintaining BGP 38-64 Configuring Multi-VRF CE 38-65 Understanding Multi-VRF CE 38-66 38-67 Default Multi-VRF CE ConfigurationMulti-VRF CE Configuration Guidelines VRF Ip vrf forwarding vrf-name Configuring VRFsRoute-target export import both Import map route-map Redistribute bgp Configuring a VPN Routing SessionShow ip vrf brief detail interfaces Log-adjacency-changes Configuring BGP PE to CE Routing Sessions Multi-VRF CE Configuration Example38-70 VPN2 CE1 38-71 38-72 Configuring Switch a 38-73 Switchconfig-router-af#network 8.8.2.0 maskSwitchconfig-router-af#network 8.8.1.0 mask Switchconfig-if#ip address 208.0.0.20 38-74 Router# configure terminal Configuring Unicast Reverse Path Forwarding Displaying Multi-VRF CE Status38-75 Configuring Protocol-Independent Features Configuring Distributed Cisco Express Forwarding38-76 38-77 Configuring the Number of Equal-Cost Routing Paths Show ip route Configuring Static Unicast RoutesRouter bgp rip ospf eigrp Maximum-paths maximum 38-79 Specifying Default Routes and NetworksRoute Source Default Distance Ip default-network network number Specify a default network 38-80 Using Route Maps to Redistribute Routing Information 38-81 38-82 38-83 Configuring Policy-Based Routing 38-84 PBR Configuration Guidelines 38-85 Enabling PBR 38-86 Ip policy route-map map-tagIp route-cache policy Ip local policy route-map map-tag Setting Passive Interfaces Filtering Routing Information38-87 38-88 Controlling Advertising and Processing in Routing UpdatesFiltering Sources of Routing Information Router bgp rip eigrp 38-89 Managing Authentication KeysDistance weight ip-address ip-address mask Ip access list 38-90 Monitoring and Maintaining the IP Network 38-91 38-92 Configuring IPv6 Unicast Routing Understanding IPv639-1 39-2 IPv6 Addresses Supported IPv6 Unicast Routing Features Bit Wide Unicast Addresses39-3 Neighbor Discovery DNS for IPv6Path MTU Discovery for IPv6 Unicast ICMPv6 39-5 IPv6 Applications Unsupported IPv6 Unicast Routing Features Dual IPv4 and IPv6 Protocol Stacks39-6 IPv6 and Switch Stacks Limitations39-7 39-8 SDM Templates Dual IPv4-and IPv6 SDM Templates39-9 39-10 Configuring IPv6 Default IPv6 Configuration Configuring IPv6 Addressing and Enabling IPv6 Routing39-11 39-12 39-13 Configuring IPv4 and IPv6 Protocol StacksIp routing Enable routing on the switch Switchconfig-if#ipv6 address 20010DB8c181/64 eui 39-14 Show ipv6 interface interface-id Configuring IPv6 Icmp Rate LimitingConfiguring CEF and dCEF for IPv6 Ipv6 icmp error-interval interval bucketsize 39-16 Configuring Static Routing for IPv6 39-17 Administrative distanceIpv6 route ipv6-prefix/prefix length Ipv6-address interface-id ipv6-address Interface-id recursive detail Configuring RIP for IPv6Show ipv6 route static updated Show ipv6 static ipv6-address 39-19 39-20 Configuring Ospf for IPv6 39-21 Switch# show ipv6 interface Displaying IPv639-22 39-23 Switch# show ipv6 cef /0Switch# show ipv6 protocols Switch# show ipv6 rip Switch# show ipv6 traffic Switch# show ipv6 neighborsSwitch# show ipv6 static Switch# show ipv6 route 39-25 39-26 Configuring Hsrp and Enhanced Object Tracking Understanding Hsrp40-1 40-2 40-3 Multiple Hsrp Configuring Hsrp Hsrp and Switch Stacks40-4 40-5 Default Hsrp ConfigurationHsrp Configuration Guidelines Enabling Hsrp Show standby interface-id group Switch# show standbyStandby group-number ip ip-address Secondary 40-7 Configuring Hsrp Priority 40-8 Priority preempt delay delayStandby group-number priority Standby group-number track 40-9 Configuring MhsrpConfiguring Hsrp Authentication and Timers Switchconfig-if#standby 2 ip Holdtime Standby group-number authentication stringStandby group-number timers hellotime Switchconfig-if#standby 1 authentication word Show standby interface-idgroup brief detail Displaying Hsrp ConfigurationsConfiguring Hsrp Groups and Clustering Enabling Hsrp Support for Icmp Redirect Messages Configuring Enhanced Object Tracking Understanding Enhanced Object Tracking40-12 40-13 Configuring Enhanced Object Tracking FeaturesTracking Interface Line-Protocol or IP Routing State Track object-number interface Object object-number not Configuring a Tracked ListSwitch# show track 33 Track Track track-numberlist boolean 40-15 WeightThreshold weight up number Track track-numberlist threshold Threshold percentage up number Track track-number list thresholdPercentage Object object-number 40-17 Configuring Hsrp Object Tracking Configuring Other Tracking Characteristics Show standby40-18 Configuring Web Cache Services By Using Understanding Wccp41-1 41-2 Wccp Message Exchange 41-3 Packet Redirection and Service GroupsWccp Negotiation MD5 Security 41-4 Wccp and Switch Stacks Wccp Configuration Guidelines Configuring WccpUnsupported Wccp Features Default Wccp Configuration 41-6 Enabling the Web Cache Service 41-7 41-8 41-9 Switchconfig# interface range gigabitethernet1/0/3Switchconfig-if-range#switchport access vlan Monitoring and Maintaining Wccp 41-10 Enabled / disabled 42-1 Configuring IP Multicast Routing IP Multicast Routing Protocols 42-2 Understanding Igmp Igmp Version42-3 42-4 Understanding PIMPIM Versions PIM Modes 42-5 PIM Stub Routing 42-6 Auto-RP Bootstrap Router Multicast Forwarding and Reverse Path Check42-7 Understanding Dvmrp Network Port42-8 Multicast Routing and Switch Stacks Understanding Cgmp42-9 42-10 Configuring IP Multicast RoutingDefault Multicast Routing Configuration Multicast Routing Configuration Guidelines Auto-RP and BSR Configuration Guidelines PIMv1 and PIMv2 Interoperability42-11 Configuring Basic Multicast Routing Ip multicast-routing distributed42-12 Sparse-dense-mode Configuring PIM Stub RoutingIp pim version 1 Ip pim dense-mode sparse-mode 42-14 Configuring a Rendezvous PointManually Assigning an RP to Multicast Groups Ip pim passive Access-list-number override Ip pim rp-address ip-address42-15 42-16 Configuring Auto-RP 42-17 Scope ttl group-list access-list-numberIp pim send-rp-announce interface-id Interval seconds 42-18 Ip pim send-rp-discovery scope ttlShow ip pim rp mapping Show ip pim rp Access-list-number group-list Ip pim rp-announce-filter rp-list42-19 Configuring PIMv2 BSR Ip pim bsr-border42-20 42-21 Ip multicast boundary Ip pim bsr-candidate interface-id Hash-mask-length priority42-22 Group-list access-list-number Ip pim rp-candidate interface-id42-23 Show ip pim rp-hash group Using Auto-RP and a BSRShow ip pim rp group-name Group-address mapping Understanding PIM Shared Tree and Source Tree Configuring Advanced PIM FeaturesTroubleshooting PIMv1 and PIMv2 Interoperability Problems Monitoring the RP Mapping Information Shared Tree and Source Tree Shortest-Path Tree 42-26 Delaying the Use of PIM Shortest-Path Tree Ip pim spt-threshold kbps infinity42-27 Show ip igmp interface interface-id Configuring Optional Igmp FeaturesModifying the PIM Router-Query Message Interval Ip pim query-interval seconds 42-29 Default Igmp ConfigurationConfiguring the Switch as a Member of a Group Ip igmp join-group group-address 42-30 Controlling Access to IP Multicast GroupsIp igmp access-group access-list-number Show ip igmp interface interface-id Verify your entries Query-interval or the ip igmp query-max-response-time Changing the Igmp VersionModifying the Igmp Host-Query Message Interval Ip igmp version 1 42-32 Changing the Igmp Query Timeout for IGMPv2Ip igmp querier-timeout seconds Ip igmp query-interval seconds 42-33 Configuring the Switch as a Statically Connected MemberChanging the Maximum Query Response Time for IGMPv2 Ip igmp query-max-response-time 42-34 Configuring Optional Multicast Routing FeaturesEnabling Cgmp Server Support Ip igmp static-group group-address Configuring sdr Listener Support Ip cgmp proxy42-35 42-36 Ip sdr listen Enable sdr listener supportEnabling sdr Listener Support Limiting How Long an sdr Cache Entry Exists 42-37 Configuring an IP Multicast Boundary 42-38 Configuring Basic Dvmrp Interoperability Features 42-39 Configuring Dvmrp Interoperability 42-40 Ip dvmrp metric metric list 42-41 Configuring a Dvmrp Tunnel Ip dvmrp accept-filter Access-list-number distanceNeighbor-list access-list-number Advertising Network 0.0.0.0 to Dvmrp Neighbors Originate only Configuring Advanced Dvmrp Interoperability FeaturesIp dvmrp default-information Responding to mrinfo Requests 42-44 Enabling Dvmrp Unicast Routing 42-45 Rejecting a Dvmrp Nonpruning Neighbor 42-46 Enter interface configuration mode Changing the Dvmrp Route Threshold By default, 7000 routes are advertised. The range is 0 toControlling Route Exchanges Limiting the Number of Dvmrp Routes Advertised 42-48 Configuring a Dvmrp Summary AddressDefault is 10,000 routes. The range is 1 to Route-count 42-49 No ip dvmrp auto-summary Disabling Dvmrp AutosummarizationIp dvmrp summary-address address Mask metric value 42-51 Adding a Metric Offset to the Dvmrp RouteIp dvmrp metric-offset in out Increment 42-52 Monitoring and Maintaining IP Multicast RoutingClearing Caches, Tables, and Databases Displaying System and Network Statistics 42-53 Monitoring IP Multicast Routing 42-54 Configuring Msdp Understanding Msdp43-1 43-2 Msdp Operation 43-3 Msdp Benefits 43-4 Configuring MsdpDefault Msdp Configuration Configuring a Default Msdp Peer Ip msdp default-peer ip-address name Prefix-list list43-5 Ip msdp description peer-name Caching Source-Active StateIp prefix-list name description string Seq number permit deny network 43-7 Ip msdp cache-sa-state list 43-8 Switchconfig# ip msdp sa-requestRequesting Source Information from an Msdp Peer Ip msdp sa-request ip-address name 43-9 Controlling Source Information that Your Switch OriginatesRedistributing Sources Ip msdp redistribute list 43-10 43-11 Name list access-list-numberFiltering Source-Active Request Messages Ip msdp filter-sa-request ip-address Route-map map-tag Controlling Source Information that Your Switch ForwardsUsing a Filter Ip msdp sa-filter out ip-address name 43-13 Ttl Controlling Source Information that Your Switch ReceivesUsing TTL to Limit the Multicast Data Sent in SA Messages Ip msdp ttl-threshold ip-address name Switchconfig# ip msdp sa-filter in switch.cisco.com Ip msdp sa-filter in ip-address name43-15 43-16 Configuring an Msdp Mesh GroupShutting Down an Msdp Peer Ip msdp mesh-group name ip-address 43-17 Including a Bordering PIM Dense-Mode Region in MsdpIp msdp shutdown peer-name peer Ip msdp border sa-address interface-id 43-18 Configuring an Originating Address other than the RP Address Clear ip msdp sa-cache group-addressname Monitoring and Maintaining MsdpClear ip msdp peer peer-addressname Clear ip msdp statistics peer-addressname 43-20 44-1 Configuring Fallback BridgingUnderstanding Fallback Bridging Fallback Bridging Overview 44-2 Configuring Fallback Bridging Fallback Bridging and Switch Stacks44-3 44-4 Default Fallback Bridging ConfigurationFallback Bridging Configuration Guidelines Creating a Bridge Group 44-5 Bridge bridge-group protocolVlan-bridge Bridge-group bridge-group Adjusting Spanning-Tree Parameters Switchconfig# bridge 10 protocol vlan-bridge44-6 Bridge-group bridge-grouppriority Changing the VLAN-Bridge Spanning-Tree PriorityChanging the Interface Priority Bridge bridge-group priority number 44-8 Assigning a Path CostBridge-group bridge-group path-cost Cost 44-9 Adjusting Bpdu IntervalsSwitchconfig# bridge 10 hello-time Bridge bridge-group hello-time seconds Bridge bridge-group max-age seconds Switchconfig# bridge 10 forward-timeSwitchconfig# bridge 10 max-age Bridge bridge-group forward-time Show bridge bridge-group group Monitoring and Maintaining Fallback BridgingDisabling the Spanning Tree on an Interface Clear bridge bridge-group 44-12 45-1 Troubleshooting 45-2 Recovering from a Software Failure Switch copy xmodem flashimagefilename.bin Recovering from a Lost or Forgotten PasswordSwitch flashinit Switch loadhelper 45-4 45-5 Procedure with Password Recovery Enabled 45-6 Copy the configuration file into memory Procedure with Password Recovery Disabled Switch dir flash45-7 45-8 Preventing Switch Stack Problems 45-9 Recovering from a Command Switch Failure Replacing a Failed Command Switch with a Cluster Member Switchconfig# no cluster commander-address45-10 45-11 Replacing a Failed Command Switch with Another Switch 45-12 45-13 Recovering from Lost Cluster Member ConnectivityTroubleshooting Power over Ethernet Switch Ports Preventing Autonegotiation Mismatches SFP Module Security and Identification Disabled Port Caused by Power LossDisabled Port Caused by False Link Up Show controllers power inline privileged Exec command Understanding Ping Monitoring TemperatureUsing Ping Monitoring SFP Module Status 45-16 Switch# pingExecuting Ping Character Description 45-17 Using Layer 2 TracerouteUnderstanding Layer 2 Traceroute Usage Guidelines 45-18 Using IP TracerouteDisplaying the Physical Path Understanding IP Traceroute Trace the path that packets take through the network Switch# traceroute ipExecuting IP Traceroute Traceroute ip host Using TDR Understanding TDR45-20 45-21 Using Debug CommandsEnabling Debugging on a Specific Feature Running TDR and Displaying the Results Enabling All-System Diagnostics Redirecting Debug and Error Message Output45-22 Using the show platform forward Command 45-23Udp 10 45-24 Using the crashinfo Files Basic crashinfo Files45-25 45-26 Using On-Board Failure LoggingExtended crashinfo Files Understanding Obfl 45-27 Configuring Obfl Displaying Obfl Information Show logging onboard module45-28 Configuring Online Diagnostics Understanding Online Diagnostics46-1 Non-disruptive daily hhmm Configuring Online DiagnosticsScheduling Online Diagnostics Diagnostic schedule switch Diagnostic monitor syslog Configuring Health-Monitoring DiagnosticsDiagnostic monitor interval switch Diagnostic content command output Schedule status switch Diagnostic monitor threshold switchDiagnostic monitor switch number test Show diagnostic content post result All basic non-disruptive Running Online Diagnostic TestsStarting Online Diagnostic Tests Diagnostic start switch number 46-6 Displaying Online Diagnostic Tests and Test Results Supported MIBs MIB ListCISCO-FTP-CLIENT-MIB CISCO-HSRP-MIB IGMP-MIB INET-ADDRESS-MIB IPMROUTE-MIB CISCO-IGMP-FILTER-MIBCISCO-RTTMON-MIB CISCO-SMI-MIB ETHERLIKE-MIB IEEE8021-PAE-MIB IEEE8023-LAG-MIB TCP-MIB UDP-MIB Using FTP to Access the MIB Files Working with the Flash File System Displaying Available File Systems Switch# show file systems Field Value Setting the Default File System Pwd Cd newconfigsDisplaying Information about Files on a File System Changing Directories and Displaying the Working Directory Mkdir oldconfigs Creating and Removing DirectoriesCopying Files Switch# delete myconfig Deleting FilesCreating, Displaying, and Extracting Files Archive /create destination-url FlashArchive /table source-url More /ascii /binary /ebcdic Archive /xtract source-urlExtract a file into a directory on the flash file system Directories are extracted Working with Configuration Files Configuration File Types and Location Guidelines for Creating and Using Configuration Files Copying Configuration Files By Using Tftp Creating a Configuration File By Using a Text Editor Uploading the Configuration File By Using Tftp Downloading the Configuration File By Using Tftp Copying Configuration Files By Using FTP Downloading a Configuration File By Using FTP Ip ftp password passwordIp ftp username username Filename nvramstartup-config Uploading a Configuration File By Using FTPFtp // username password @ location /directory Filename systemrunning-config Ftp // username password @ location /directory Filename Copying Configuration Files By Using RCPCopy systemrunning-config Copy nvramstartup-config Hostname Switch1 Ip rcmd remote-username User0 Ip rcmd remote-username username Downloading a Configuration File By Using RCPSystemrunning-config Nvramstartup-config Clearing Configuration Information Uploading a Configuration File By Using RCPSwitch# copy nvramstartup-config rcp Clearing the Startup Configuration File Deleting a Stored Configuration FileWorking with Software Images File Format of Images on a Server or Cisco.com Image Location on the Switch Field Description Copying Image Files By Using Tftp Downloading an Image File By Using Tftp Preparing to Download or Upload an Image File By Using Tftp Archive download-sw /directory Allow-feature-upgrade /directoryArchive download-sw Overwrite /reload Uploading an Image File By Using Tftp Archive upload-swTftp //location /directory /image-name .tar Preparing to Download or Upload an Image File By Using FTP Copying Image Files By Using FTP Downloading an Image File By Using FTP Directory /image-name2 .tar image-name3 .tar Archive download-sw /allow-feature-upgradeDirectory /overwrite /reload For /directory /image-name1 .tar Uploading an Image File By Using FTP Copying Image Files By Using RCP Preparing to Download or Upload an Image File By Using RCP File By Using RCP section on page B-31 Downloading an Image File By Using RCP Or Upload an Image File By Using RCP section on Uploading an Image File By Using RCP Copying an Image File from One Stack Member to Another Rcp // username @ location /directory /image-naMe.tar For /destination-system destination-stack-member-number Archive copy-sw /destination-systemDestination-stack-member-number /force-reload Source-stack-member-number Unsupported Global Configuration Commands Unsupported Commands Cisco IOS Release 12.237SEAccess Control Lists Unsupported Privileged Exec Commands Debug Commands Archive CommandsARP Commands Boot Loader Commands Bridge bridge-group domain domain-name bridge irb Fallback BridgingBridge bridge-groupacquire Bridge crb X25 map bridge x.121-address broadcast options-keywords Hsrp Igmp Snooping Commands Interface CommandsIP Multicast Routing Ip multicast-routing vrf vrf-name Ip pim accept-rpaddress auto-rpgroup-access-list-numberShow ip pim vc group-address name type number Show ip rtp header-compression type number detail IP Unicast Routing Unsupported Privileged Exec or User Exec Commands Unsupported BGP Router Configuration Commands Unsupported VPN Configuration CommandsUnsupported Route Map Commands Set tag tag-value MAC Address CommandsShow cable-diagnostics prbs Test cable-diagnostics prbs Miscellaneous Msdp NetFlow Commands QoS Network Address Translation NAT CommandsUnsupported Global Configuration Command Unsupported Policy-Map Configuration Command Spanning Tree Unsupported Interface Configuration CommandUnsupported User Exec Commands Unsupported Privileged Exec Command IN-1 Numerics IN-2 ACLs TACACS+ CDP Lldp RIPEigrp Hsrp BGP CidrIN-4 IN-5 Bpdu CLI CDPCEF Cgmp IN-7 CNS IN-8 Dhcp DNSIN-9 Wccp SnmpTACACS+ Udld Vmps IN-11 Dhcp option IN-12 DTP IN-13 Dvmrp IN-14 Dynamic ARP inspection IN-15 Lacp STP FIBIN-16 Mstp STP FTPIN-17 Https IcmpIN-18 IN-19 Igmp IN-20 IN-21 IP addresses IN-22 Mbone IN-23 IGP IN-24 IP unicast routing IN-25 ISL IN-26 LLDP-MED IN-27 MDA MhsrpIN-28 IN-29 Msdp IN-30 CSTIST MTU IN-31 NAC IN-32 NSSA, Ospf Obfl PBRIN-33 IN-34 PIM IN-35 Port-based authentication Pvid VvidIN-36 IN-37 Private VLANs IN-38 QoS IN-39 IN-40 RCP IN-41 Radius TACACS+RFC Rmon IN-42 RPSRspan Rstp IN-43 SDM IN-44 Snmp Span SRRIN-45 SSL VTPIN-46 IN-47 Stacks, switch IN-48 LLDP-MED Ospf IN-49 STP IN-50 IN-51 System message logging IN-52 IN-53 IN-54 IN-55 VLANs VPN VQPIN-56 IN-57 WTD IN-58