Main
Cisco IE 3010 Switch Software Configuration Guide
Page
CONTENTS
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Page
Preface
Audience
Purpose
Conventions
Related Publications
Obtaining Documentation, Obtaining Support, and Security Guidelines
Page
Overview
Features
Ease-of-Deployment and Ease-of-Use Features
Performance Features
Management Options
Manageability Features
Availability and Redundancy Features
VLAN Features
Security Features
Page
Page
QoS and CoS Features
Monitoring Features
Default Settings After Initial Switch Configuration
Page
Network Configuration Examples
Design Concepts for Using the Switch
Where to Go Next
Using the Command-Line Interface
Understanding Command Modes
Page
Understanding the Help System
Understanding Abbreviated Commands
Understanding no and default Forms of Commands
Understanding CLI Error Messages
Using Configuration Logging
Using Command History
Changing the Command History Buffer Size
Recalling Commands
Disabling the Command History Feature
Using Editing Features
Enabling and Disabling Editing Features
Editing Commands through Keystrokes
Editing Command Lines that Wrap
Searching and Filtering Output of show and more Commands
Accessing the CLI
Accessing the CLI through a Console Connection or through Telnet
Assigning the Switch IP Address and Default Gateway
Understanding the Boot Process
Page
Assigning Switch Information
Default Switch Information
Understanding DHCP-Based Autoconfiguration
DHCP Client Request Process
Understanding DHCP-based Autoconfiguration and Image Update
DHCP Autoconfiguration
DHCP Auto-Image Update
Limitations and Restrictions
Configuring DHCP-Based Autoconfiguration
DHCP Server Configuration Guidelines
Configuring the TFTP Server
Configuring the DNS
Configuring the Relay Device
Obtaining Configuration Files
Example Configuration
Page
Configuring the DHCP Auto Configuration and Image Update Features
Configuring DHCP Autoconfiguration (Only Configuration File)
Configuring DHCP Auto-Image Update (Configuration File and Image)
Configuring the Client
Manually Assigning IP Information
Checking and Saving the Running Configuration
Modifying the Startup Configuration
Default Boot Configuration
Automatically Downloading a Configuration File
Specifying the Filename to Read and Write the System Configuration
Booting Manually
Booting a Specific Software Image
Controlling Environment Variables
Page
Scheduling a Reload of the Software Image
Configuring a Scheduled Reload
Displaying Scheduled Reload Information
Configuring Cisco IOS Configuration Engine
Understanding Cisco Configuration Engine Software
Configuration Service
Event Service
NameSpace Mapper
What You Should Know About the CNS IDs and Device Hostnames
ConfigID
DeviceID
Hostname and DeviceID
Using Hostname, DeviceID, and ConfigID
Understanding Cisco IOS Agents
Initial Configuration
V
Incremental (Partial) Configuration
Synchronized Configuration
Configuring Cisco IOS Agents
Enabling Automated CNS Configuration
Enabling the CNS Event Agent
Page
Enabling the Cisco IOS CNS Agent
Enabling an Initial Configuration
Page
Page
Enabling a Partial Configuration
Displaying CNS Configuration
Page
Clustering Switches
Understanding Switch Clusters
Page
Cluster Command Switch Characteristics
Standby Cluster Command Switch Characteristics
Candidate Switch and Cluster Member Switch Characteristics
Planning a Switch Cluster
Automatic Discovery of Cluster Candidates and Members
Discovery Through CDP Hops
Discovery Through Non-CDP-Capable and Noncluster-Capable Devices
Discovery Through Different VLANs
Discovery Through Different Management VLANs
Discovery of Newly Installed Switches
Virtual IP Addresses
Other Considerations for Cluster Standby Groups
Automatic Recovery of Cluster Configuration
IP Addresses
Hostnames
Passwords
SNMP Community Strings
TACACS+ and RADIUS
LRE Profiles
Using the CLI to Manage Switch Clusters
Using SNMP to Manage Switch Clusters
Administering the Switch
Understanding the System Clock
Understanding Network Time Protocol
Page
Configuring NTP
Default NTP Configuration
Configuring NTP Authentication
Configuring NTP Associations
Configuring NTP Broadcast Service
Configuring NTP Access Restrictions
Creating an Access Group and Assigning a Basic IP Access List
Disabling NTP Services on a Specific Interface
Configuring the Source IP Address for NTP Packets
Displaying the NTP Configuration
Configuring Time and Date Manually
Setting the System Clock
Displaying the Time and Date Configuration
Configuring the Time Zone
Configuring Summer Time (Daylight Saving Time)
Configuring a System Name and Prompt
Default System Name and Prompt Configuration
Configuring a System Name
Understanding DNS
Default DNS Configuration
Setting Up DNS
Displaying the DNS Configuration
Creating a Banner
Default Banner Configuration
Configuring a Message-of-the-Day Login Banner
Configuring a Login Banner
Managing the MAC Address Table
Building the Address Table
MAC Addresses and VLANs
Default MAC Address Table Configuration
Changing the Address Aging Time
Removing Dynamic Address Entries
Configuring MAC Address Change Notification Traps
Page
Configuring MAC Address Move Notification Traps
Configuring MAC Threshold Notification Traps
Adding and Removing Static Address Entries
Configuring Unicast MAC Address Filtering
Disabling MAC Address Learning on a VLAN
Page
Displaying Address Table Entries
Managing the ARP Table
Configuring the Switch Alarms
Understanding IE 3010 Switch Alarms
Global Status Monitoring Alarms
FCS Error Hysteresis Threshold
Port Status Monitoring Alarms
Triggering Alarm Options
Configuring IE 3010 External Alarms
Page
Configuring IE 3010 Switch Alarms
Default Switch Alarm Configuration
Configuring the Power Supply Alarms
Configuring the Switch Temperature Alarms
Setting the Primary Temperature Threshold for the Switch
Setting a Secondary Temperature Threshold for the Switch
Associating the Temperature Alarms to a Relay
Configuring the FCS Bit Error Rate Alarm
Setting the FCS Error Threshold
Setting the FCS Error Hysteresis Threshold
Configuring Alarm Profiles
Creating or Modifying an Alarm Profile
Attaching an Alarm Profile to a Specific Port
Enabling SNMP Traps
Displaying IE 3010 Switch Alarms Status
Page
Configuring SDM Templates
Understanding the SDM Templates
Configuring the Switch SDM Template
SDM Template Configuration Guidelines
Setting the SDM Template
8-4
Displaying the SDM Templates
This is an example of output from the show sdm prefer dual-ipv4-and-ipv6 default command:
Configuring Switch-Based Authentication
Preventing Unauthorized Access to Your Switch
Protecting Access to Privileged EXEC Commands
Default Password and Privilege Level Configuration
Setting or Changing a Static Enable Password
Protecting Enable and Enable Secret Passwords with Encryption
Disabling Password Recovery
Setting a Telnet Password for a Terminal Line
Configuring Username and Password Pairs
Configuring Multiple Privilege Levels
Setting the Privilege Level for a Command
Changing the Default Privilege Level for Lines
Logging into and Exiting a Privilege Level
Controlling Switch Access with TACACS+
Understanding TACACS+
Page
TACACS+ Operation
Configuring TACACS+
Default TACACS+ Configuration
Identifying the TACACS+ Server Host and Setting the Authentication Key
Configuring TACACS+ Login Authentication
Page
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services
Starting TACACS+ Accounting
Establishing a Session with a Router if the AAA Server is Unreachable
Displaying the TACACS+ Configuration
Controlling Switch Access with RADIUS
Understanding RADIUS
Page
RADIUS Operation
RADIUS Change of Authorization
Overview
Change-of-Authorization Requests
RFC 5176 Compliance
Preconditions
CoA Request Response Code
Session Identification
CoA ACK Response Code
CoA NAK Response Code
CoA Request Commands
Session Reauthentication
Session Termination
CoA Disconnect-Request
CoA Request: Disable Host Port
CoA Request: Bounce-Port
Configuring RADIUS
Default RADIUS Configuration
Identifying the RADIUS Server Host
Page
Configuring RADIUS Login Authentication
Page
Defining AAA Server Groups
Page
Configuring RADIUS Authorization for User Privileged Access and Network Services
Starting RADIUS Accounting
Establishing a Session with a Router if the AAA Server is Unreachable
Configuring Settings for All RADIUS Servers
Configuring the Switch to Use Vendor-Specific RADIUS Attributes
Page
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication
Configuring CoA on the Switch
Monitoring and Troubleshooting CoA Functionality
Configuring RADIUS Server Load Balancing
Displaying the RADIUS Configuration
Controlling Switch Access with Kerberos
Understanding Kerberos
Page
Kerberos Operation
Authenticating to a Boundary Switch
Obtaining a TGT from a KDC
Authenticating to Network Services
Configuring Kerberos
Configuring the Switch for Local Authentication and Authorization
Configuring the Switch for Secure Shell
Understanding SSH
SSH Servers, Integrated Clients, and Supported Versions
Limitations
Configuring SSH
Setting Up the Switch to Run SSH
Configuring the SSH Server
Displaying the SSH Configuration and Status
Configuring the Switch for Secure Socket Layer HTTP
Understanding Secure HTTP Servers and Clients
Certificate Authority Trustpoints
CipherSuites
Configuring Secure HTTP Servers and Clients
Default SSL Configuration
SSL Configuration Guidelines
Configuring a CA Trustpoint
Configuring the Secure HTTP Server
Configuring the Secure HTTP Client
Displaying Secure HTTP Server and Client Status
Configuring the Switch for Secure Copy Protocol
Information About Secure Copy
Configuring IEEE 802.1x Port-Based Authentication
Understanding IEEE 802.1x Port-Based Authentication
Device Roles
Authentication Process
10-4
policy. Figure 10-2 shows the authentication process.
Figure 10-2 Authentication Flowchart
The switch re-authenticates a client when one of these situations occurs:
Authentication Initiation and Message Exchange
Page
Authentication Manager
Port-Based Authentication Methods
Per-User ACLs and Filter-Ids
Authentication Manager CLI Commands
Ports in Authorized and Unauthorized States
802.1x Host Mode
Multidomain Authentication
802.1x Multiple Authentication Mode
MAC Move
MAC Replace
802.1x Accounting
802.1x Accounting Attribute-Value Pairs
802.1x Readiness Check
802.1x Authentication with VLAN Assignment
Using 802.1x Authentication with Per-User ACLs
802.1x Authentication with Downloadable ACLs and Redirect URLs
Page
Cisco Secure ACS and Attribute-Value Pairs for the Redirect URL
Cisco Secure ACS and Attribute-Value Pairs for Downloadable ACLs
VLAN ID-based MAC Authentication
802.1x Authentication with Guest VLAN
802.1x Authentication with Restricted VLAN
802.1x Authentication with Inaccessible Authentication Bypass
Support on Multiple-Authentication Ports
Authentication Results
Feature Interactions
802.1x Authentication with Voice VLAN Ports
802.1x Authentication with Port Security
802.1x Authentication with Wake-on-LAN
802.1x Authentication with MAC Authentication Bypass
Page
802.1x User Distribution
802.1x User Distribution Configuration Guidelines
Network Admission Control Layer 2 802.1x Validation
Flexible Authentication Ordering
Open1x Authentication
Using Voice Aware 802.1x Security
802.1x Supplicant and Authenticator Switches with Network Edge Access Topology (NEAT)
Guidelines
Using IEEE 802.1x Authentication with ACLs and the RADIUS Filter-Id Attribute
4
1
2 3 5
Common Session ID
Configuring 802.1x Authentication
Default 802.1x Authentication Configuration
802.1x Authentication Configuration Guidelines
802.1x Authentication
VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass
MAC Authentication Bypass
Maximum Number of Allowed Devices Per Port
Configuring 802.1x Readiness Check
Configuring Voice Aware 802.1x Security
Configuring 802.1x Violation Modes
Configuring 802.1x Authentication
Page
Configuring the Switch-to-RADIUS-Server Communication
Configuring the Host Mode
Configuring Periodic Re-Authentication
Manually Re-Authenticating a Client Connected to a Port
Changing the Quiet Period
Changing the Switch-to-Client Retransmission Time
Setting the Switch-to-Client Frame-Retransmission Number
Setting the Re-Authentication Number
Enabling MAC Move
Enabling MAC Replace
Configuring 802.1x Accounting
Configuring a Guest VLAN
Configuring a Restricted VLAN
Page
Configuring the Inaccessible Authentication Bypass Feature
Page
Configuring 802.1x Authentication with WoL
Configuring MAC Authentication Bypass
Configuring 802.1x User Distribution
Configuring NAC Layer 2 802.1x Validation
Configuring an Authenticator and a Supplicant Switch with NEAT
Configuring NEAT with Auto Smartports Macros
Configuring 802.1x Authentication with Downloadable ACLs and Redirect URLs
Configuring Downloadable ACLs
Configuring a Downloadable Policy
Page
Configuring VLAN ID-based MAC Authentication
Configuring Flexible Authentication Ordering
Configuring Open1x
Disabling 802.1x Authentication on the Port
Resetting the 802.1x Authentication Configuration to the Default Values
Displaying 802.1x Statistics and Status
Page
Configuring Web-Based Authentication
Understanding Web-Based Authentication
Device Roles
Host Detection
Session Creation
Authentication Process
Local Web Authentication Banner
Page
Web Authentication Customizable Web Pages
Guidelines
Page
Web-based Authentication Interactions with Other Features
Port Security
LAN Port IP
Gateway IP
ACLs
Page
Configuring Web-Based Authentication
Default Web-Based Authentication Configuration
Web-Based Authentication Configuration Guidelines and Restrictions
Web-Based Authentication Configuration Task List
Configuring the Authentication Rule and Interfaces
Configuring AAA Authentication
Configuring Switch-to-RADIUS-Server Communication
Page
Configuring the HTTP Server
Customizing the Authentication Proxy Web Pages
Page
Specifying a Redirection URL for Successful Login
Configuring an AAA Fail Policy
Configuring the Web-Based Authentication Parameters
Configuring a Web Authentication Local Banner
Removing Web-Based Authentication Cache Entries
Displaying Web-Based Authentication Status
Page
Configuring Interface Characteristics
Understanding Interface Types
Port-Based VLANs
Switch Ports
Access Ports
Trunk Ports
EtherChannel Port Groups
Dual-Purpose Uplink Ports
Power over Ethernet Ports
Supported Protocols and Standards
Powered-Device Detection and Initial Power Allocation
Power Management Modes
Power Monitoring and Power Policing
Maximum Power Allocation (Cutoff Power) on a PoE Port
Power Consumption Values
Connecting Interfaces
Using Interface Configuration Mode
Procedures for Configuring Interfaces
Configuring a Range of Interfaces
Page
Configuring and Using Interface Range Macros
Page
Configuring Ethernet Interfaces
Default Ethernet Interface Configuration
Setting the Type of a Dual-Purpose Uplink Port
Configuring Interface Speed and Duplex Mode
Speed and Duplex Configuration Guidelines
Setting the Interface Speed and Duplex Parameters
Configuring IEEE 802.3x Flow Control
Configuring Auto-MDIX on an Interface
Configuring a Power Management Mode on a PoE Port
Page
Budgeting Power for Devices Connected to a PoE Port
Adding a Description for an Interface
Configuring Layer 3 Interfaces
Configuring the System MTU
Page
Monitoring and Maintaining the Interfaces
Monitoring Interface Status
Clearing and Resetting Interfaces and Counters
Shutting Down and Restarting the Interface
Page
Configuring Smartports Macros
Understanding Smartports Macros
Configuring Smartports Macros
Default Smartports Configuration
Smartports Configuration Guidelines
Applying Smartports Macros
Page
Displaying Smartports Macros
Page
Configuring VLANs
Understanding VLANs
Supported VLANs
VLAN Port Membership Modes
Configuring Normal-Range VLANs
Token Ring VLANs
Normal-Range VLAN Configuration Guidelines
Configuring Normal-Range VLANs
Default Ethernet VLAN Configuration
Creating or Modifying an Ethernet VLAN
Deleting a VLAN
Assigning Static-Access Ports to a VLAN
Configuring Extended-Range VLANs
Default VLAN Configuration
Extended-Range VLAN Configuration Guidelines
Creating an Extended-Range VLAN
Creating an Extended-Range VLAN with an Internal VLAN ID
Displaying VLANs
Configuring VLAN Trunks
Trunking Overview
IEEE 802.1Q Configuration Considerations
Default Layer 2 Ethernet Interface VLAN Configuration
Configuring an Ethernet Interface as a Trunk Port
Interaction with Other Features
Configuring a Trunk Port
Defining the Allowed VLANs on a Trunk
Changing the Pruning-Eligible List
Configuring the Native VLAN for Untagged Traffic
Configuring Trunk Ports for Load Sharing
Load Sharing Using STP Port Priorities
Page
Load Sharing Using STP Path Cost
Configuring VMPS
Understanding VMPS
Dynamic-Access Port VLAN Membership
Default VMPS Client Configuration
VMPS Configuration Guidelines
Configuring the VMPS Client
Entering the IP Address of the VMPS
Configuring Dynamic-Access Ports on VMPS Clients
Reconfirming VLAN Memberships
Changing the Reconfirmation Interval
Changing the Retry Count
Monitoring the VMPS
Troubleshooting Dynamic-Access Port VLAN Membership
VMPS Configuration Example
14-30
Figure 14-4 Dynamic Port VLAN Membership Configuration
Configuring VTP
Understanding VTP
The VTP Domain
VTP Modes
VTP Advertisements
VTP Version 2
VTP Version 3
VTP Pruning
Page
Configuring VTP
Default VTP Configuration
VTP Configuration Guidelines
Domain Names
Passwords
VTP Version
Configuration Requirements
Configuring VTP Mode
Page
Configuring a VTP Version 3 Password
Configuring a VTP Version 3 Primary Server
Enabling the VTP Version
Enabling VTP Pruning
Configuring VTP on a Per-Port Basis
Adding a VTP Client Switch to a VTP Domain
Monitoring VTP
Configuring Voice VLAN
Understanding Voice VLAN
Cisco IP Phone Voice Traffic
Cisco IP Phone Data Traffic
Configuring Voice VLAN
Default Voice VLAN Configuration
Voice VLAN Configuration Guidelines
Configuring a Port Connected to a Cisco 7960 IP Phone
Configuring Cisco IP Phone Voice Traffic
Configuring the Priority of Incoming Data Frames
Displaying Voice VLAN
Configuring STP
Understanding Spanning-Tree Features
STP Overview
Spanning-Tree Topology and BPDUs
Bridge ID, Switch Priority, and Extended System ID
Spanning-Tree Interface States
Blocking State
Listening State
Learning State
Forwarding State
Disabled State
How a Switch or Port Becomes the Root Switch or Root Port
Spanning Tree and Redundant Connectivity
Spanning-Tree Address Management
Accelerated Aging to Retain Connectivity
Spanning-Tree Modes and Protocols
Supported Spanning-Tree Instances
Spanning-Tree Interoperability and Backward Compatibility
STP and IEEE 802.1Q Trunks
VLAN-Bridge Spanning Tree
Configuring Spanning-Tree Features
Default Spanning-Tree Configuration
Spanning-Tree Configuration Guidelines
Changing the Spanning-Tree Mode.
Disabling Spanning Tree
Configuring the Root Switch
Page
Configuring a Secondary Root Switch
Configuring Port Priority
Page
Configuring Path Cost
Configuring the Switch Priority of a VLAN
Configuring Spanning-Tree Timers
Configuring the Hello Time
Configuring the Forwarding-Delay Time for a VLAN
Configuring the Maximum-Aging Time for a VLAN
Configuring the Transmit Hold-Count
Displaying the Spanning-Tree Status
Configuring MSTP
Understanding MSTP
Multiple Spanning-Tree Regions
IST, CIST, and CST
Operations Within an MST Region
Operations Between MST Regions
Page
IEEE 802.1s Terminology
Hop Count
Boundary Ports
IEEE 802.1s Implementation
Port Role Naming Change
Interoperation Between Legacy and Standard Switches
Detecting Unidirectional Link Failure
Interoperability with IEEE 802.1D STP
Understanding RSTP
Port Roles and the Active Topology
Rapid Convergence
Page
Synchronization of Port Roles
Bridge Protocol Data Unit Format and Processing
Processing Superior BPDU Information
Processing Inferior BPDU Information
Topology Changes
Configuring MSTP Features
Default MSTP Configuration
MSTP Configuration Guidelines
Specifying the MST Region Configuration and Enabling MSTP
Page
Configuring the Root Switch
Configuring a Secondary Root Switch
Configuring Port Priority
Configuring Path Cost
Configuring the Switch Priority
Configuring the Hello Time
Configuring the Forwarding-Delay Time
Configuring the Maximum-Aging Time
Configuring the Maximum-Hop Count
Specifying the Link Type to Ensure Rapid Transitions
Designating the Neighbor Type
Restarting the Protocol Migration Process
Displaying the MST Configuration and Status
Configuring Optional Spanning-Tree Features
Understanding Optional Spanning-Tree Features
Understanding Port Fast
Understanding BPDU Guard
Understanding BPDU Filtering
Understanding UplinkFast
Page
Understanding BackboneFast
Page
Understanding EtherChannel Guard
Understanding Root Guard
Understanding Loop Guard
Configuring Optional Spanning-Tree Features
Default Optional Spanning-Tree Configuration
Optional Spanning-Tree Configuration Guidelines
Enabling Port Fast
Enabling BPDU Guard
Enabling BPDU Filtering
Enabling UplinkFast for Use with Redundant Links
Enabling BackboneFast
Enabling EtherChannel Guard
Enabling Root Guard
Enabling Loop Guard
Displaying the Spanning-Tree Status
Configuring Flex Links and the MAC Address-Table Move Update Feature
Understanding Flex Links and the MAC Address-Table Move Update
Flex Links
VLAN Flex Link Load Balancing and Support
Flex Link Multicast Fast Convergence
Learning the Other Flex Link Port as the mrouter Port
Generating IGMP Reports
Leaking IGMP Reports
Configuration Examples
Page
MAC Address-Table Move Update
Configuring Flex Links and the MAC Address-Table Move Update
Default Configuration
Configuring Flex Links
Page
Configuring VLAN Load Balancing on Flex Links
Page
Configuring the MAC Address-Table Move Update Feature
Page
Monitoring Flex Links and the MAC Address-Table Move Update
Configuring DHCP Features and IP Source Guard Features
Understanding DHCP Snooping
DHCP Server
DHCP Relay Agent
DHCP Snooping
Page
Option-82 Data Insertion
Page
Circuit ID Suboption Frame Format
Remote ID Suboption Frame Format
Cisco IOS DHCP Server Database
DHCP Snooping Binding Database
Circuit ID Suboption Frame Format (for user-configured string):
Remote ID Suboption Frame Format (for user-configured string):
Configuring DHCP Snooping
Default DHCP Snooping Configuration
DHCP Snooping Configuration Guidelines
Page
Configuring the DHCP Relay Agent
Specifying the Packet Forwarding Address
Enabling DHCP Snooping and Option 82
Page
Enabling the Cisco IOS DHCP Server Database
Enabling the DHCP Snooping Binding Database Agent
Displaying DHCP Snooping Information
Understanding IP Source Guard
Source IP Address Filtering
Source IP and MAC Address Filtering
IP Source Guard for Static Hosts
Configuring IP Source Guard
Default IP Source Guard Configuration
IP Source Guard Configuration Guidelines
Enabling IP Source Guard
Configuring IP Source Guard for Static Hosts
Configuring IP Source Guard for Static Hosts on a Layer 2 Access Port
Page
Page
21-22
21-23
This example displays all active IP or MAC binding entries for all interfaces:
This example displays the count of all IP device tracking host entries for all interfaces:
Configuring IP Source Guard for Static Hosts on a Private VLAN Host Port
21-25
This example shows how to enable IPSG for static hosts with IP filters on a private VLAN host port:
The output shows that the five valid IP-MAC bindings are on both the primary and sec ondary VLAN.
Displaying IP Source Guard Information
Understanding DHCP Server Port-Based Address Allocation
Configuring DHCP Server Port-Based Address Allocation
Default Port-Based Address Allocation Configuration
Port-Based Address Allocation Configuration Guidelines
Enabling DHCP Server Port-Based Address Allocation
Page
Displaying DHCP Server Port-Based Address Allocation
Page
Configuring Dynamic ARP Inspection
Understanding Dynamic ARP Inspection
Page
Interface Trust States and Network Security
Rate Limiting of ARP Packets
Relative Priority of ARP ACLs and DHCP Snooping Entries
Logging of Dropped Packets
Configuring Dynamic ARP Inspection
Default Dynamic ARP Inspection Configuration
Dynamic ARP Inspection Configuration Guidelines
Page
Configuring Dynamic ARP Inspection in DHCP Environments
Configuring ARP ACLs for Non-DHCP Environments
Page
Limiting the Rate of Incoming ARP Packets
Performing Validation Checks
Configuring the Log Buffer
Page
Displaying Dynamic ARP Inspection Information
Page
Page
Configuring IGMP Snooping and MVR
Understanding IGMP Snooping
IGMP Versions
Joining a Multicast Group
Page
Leaving a Multicast Group
Immediate Leave
IGMP Configurable-Leave Timer
IGMP Report Suppression
Configuring IGMP Snooping
Default IGMP Snooping Configuration
Enabling or Disabling IGMP Snooping
Setting the Snooping Method
Configuring a Multicast Router Port
Configuring a Host Statically to Join a Group
Enabling IGMP Immediate Leave
Configuring the IGMP Leave Timer
Configuring TCN-Related Commands
Controlling the Multicast Flooding Time After a TCN Event
Recovering from Flood Mode
Disabling Multicast Flooding During a TCN Event
Configuring the IGMP Snooping Querier
Disabling IGMP Report Suppression
Displaying IGMP Snooping Information
Page
Understanding Multicast VLAN Registration
Using MVR in a Multicast Television Application
Page
Configuring MVR
Default MVR Configuration
MVR Configuration Guidelines and Limitations
Configuring MVR Global Parameters
Configuring MVR Interfaces
Page
Displaying MVR Information
Configuring IGMP Filtering and Throttling
Default IGMP Filtering and Throttling Configuration
Configuring IGMP Profiles
Page
Applying IGMP Profiles
Setting the Maximum Number of IGMP Groups
Configuring the IGMP Throttling Action
Displaying IGMP Filtering and Throttling Configuration
Configuring Port-Based Traffic Control
Configuring Storm Control
Understanding Storm Control
Page
Default Storm Control Configuration
Configuring Storm Control and Threshold Levels
Page
Configuring Protected Ports
Default Protected Port Configuration
Protected Port Configuration Guidelines
Configuring a Protected Port
Configuring Port Blocking
Default Port Blocking Configuration
Blocking Flooded Traffic on an Interface
Configuring Port Security
Understanding Port Security
Secure MAC Addresses
Security Violations
Default Port Security Configuration
Port Security Configuration Guidelines
Page
Enabling and Configuring Port Security
Page
Page
Page
Enabling and Configuring Port Security Aging
Port Security and Private VLANs
Displaying Port-Based Traffic Control Settings
Configuring CDP
Understanding CDP
Configuring CDP
Default CDP Configuration
Configuring the CDP Characteristics
Disabling and Enabling CDP
Disabling and Enabling CDP on an Interface
Monitoring and Maintaining CDP
Page
Configuring LLDP, LLDP-MED, and Wired Location Service
Understanding LLDP, LLDP-MED, and Wired Location Service
LLDP-MED
Wired Location Service
Configuring LLDP, LLDP-MED, and Wired Location Service
Default LLDP Configuration
Enabling LLDP
Configuring LLDP Characteristics
Configuring LLDP-MED TLVs
Configuring Network-Policy TLV
Page
Configuring Location TLV and Wired Location Service
Monitoring and Maintaining LLDP, LLDP-MED, and Wired Location Service
Page
Page
Configuring UDLD
Understanding UDLD
Modes of Operation
Methods to Detect Unidirectional Links
Configuring UDLD
Default UDLD Configuration
Enabling UDLD Globally
Enabling UDLD on an Interface
Resetting an Interface Disabled by UDLD
Displaying UDLD Status
Configuring SPAN and RSPAN
Understanding SPAN and RSPAN
Local SPAN
Remote SPAN
SPAN and RSPAN Concepts and Terminology
SPAN Sessions
Monitored Traffic
Source Ports
Source VLANs
VLAN Filtering
Destination Port
RSPAN VLAN
SPAN and RSPAN Interaction with Other Features
Configuring SPAN and RSPAN
Default SPAN and RSPAN Configuration
Configuring Local SPAN
SPAN Configuration Guidelines
Creating a Local SPAN Session
Page
Creating a Local SPAN Session and Configuring Incoming Traffic
Specifying VLANs to Filter
Configuring RSPAN
RSPAN Configuration Guidelines
Configuring a VLAN as an RSPAN VLAN
Creating an RSPAN Source Session
Creating an RSPAN Destination Session
Creating an RSPAN Destination Session and Configuring Incoming Traffic
Page
Specifying VLANs to Filter
Displaying SPAN and RSPAN Status
Configuring RMON
Understanding RMON
Configuring RMON
Default RMON Configuration
Configuring RMON Alarms and Events
Page
Collecting Group History Statistics on an Interface
Collecting Group Ethernet Statistics on an Interface
Displaying RMON Status
Configuring System Message Logging
Understanding System Message Logging
Configuring System Message Logging
System Log Message Format
Default System Message Logging Configuration
Disabling Message Logging
Setting the Message Display Destination Device
Synchronizing Log Messages
Enabling and Disabling Time Stamps on Log Messages
Enabling and Disabling Sequence Numbers in Log Messages
Defining the Message Severity Level
Page
Limiting Syslog Messages Sent to the History Table and to SNMP
Enabling the Configuration-Change Logger
Configuring UNIX Syslog Servers
Logging Messages to a UNIX Syslog Daemon
Configuring the UNIX System Logging Facility
Displaying the Logging Configuration
Page
Configuring SNMP
Understanding SNMP
SNMP Versions
SNMP Manager Functions
SNMP Agent Functions
SNMP Community Strings
Using SNMP to Access MIB Variables
SNMP Notifications
SNMP ifIndex MIB Object Values
Configuring SNMP
Default SNMP Configuration
SNMP Configuration Guidelines
Disabling the SNMP Agent
Configuring Community Strings
Configuring SNMP Groups and Users
Page
Configuring SNMP Notifications
Page
Page
Page
Setting the CPU Threshold Notification Types and Values
Setting the Agent Contact and Location Information
Limiting TFTP Servers Used Through SNMP
SNMP Examples
Displaying SNMP Status
Configuring Network Security with ACLs
Understanding ACLs
Supported ACLs
Handling Fragmented and Unfragmented Traffic
Configuring IPv4 ACLs
Creating Standard and Extended IPv4 ACLs
Access List Numbers
ACL Logging
Creating a Numbered Standard ACL
Creating a Numbered Extended ACL
Page
Page
Page
Resequencing ACEs in an ACL
Creating Named Standard and Extended ACLs
Page
Using Time Ranges with ACLs
Page
Including Comments in ACLs
Applying an IPv4 ACL to a Terminal Line
Applying an IPv4 ACL to an Interface
Page
Hardware and Software Treatment of IP ACLs
Troubleshooting ACLs
IPv4 ACL Configuration Examples
Page
Numbered ACLs
Extended ACLs
Named ACLs
Time Range Applied to an IP ACL
Commented IP ACL Entries
ACL Logging
Creating Named MAC Extended ACLs
Applying a MAC ACL to a Layer 2 Interface
Page
Displaying IPv4 ACL Configuration
Configuring QoS
Understanding QoS
Page
Basic QoS Model
Classification
Page
33-6
Figure 33-3 Classification Flowchart
Classification Based on QoS ACLs
Classification Based on Class Maps and Policy Maps
Policing and Marking
Policing on Physical Ports
Policing on SVIs
Page
Mapping Tables
Queueing and Scheduling Overview
Weighted Tail Drop
SRR Shaping and Sharing
Queueing and Scheduling on Ingress Queues
WTD Thresholds
Buffer and Bandwidth Allocation
Priority Queueing
Queueing and Scheduling on Egress Queues
Buffer and Memory Allocation
WTD Thresholds
Shaped or Shared Mode
Packet Modification
Configuring Auto-QoS
Generated Auto-QoS Configuration
Page
Page
33-22
The switch automatically maps DSCP values to an egress queue and to a threshold ID.
Table 33-5 Generated Auto-QoS Configuration (continued)
Description Automatically Generated Command
Page
Effects of Auto-QoS on the Configuration
Auto-QoS Configuration Guidelines
Enabling Auto-QoS for VoIP
Page
33-27
Auto-QoS Configuration Example
Figure 33-11 Auto-QoS Configuration Example Network
Displaying Auto-QoS Information
Configuring Standard QoS
Default Standard QoS Configuration
Default Ingress Queue Configuration
Default Egress Queue Configuration
Default Mapping Table Configuration
Standard QoS Configuration Guidelines
QoS ACL Guidelines
Applying QoS on Interfaces
Policing Guidelines
General QoS Guidelines
Enabling QoS Globally
Enabling VLAN-Based QoS on Physical Ports
Configuring Classification Using Port Trust States
Configuring the Trust State on Ports within the QoS Domain
Page
Configuring the CoS Value for an Interface
Configuring a Trusted Boundary to Ensure Port Security
Page
Enabling DSCP Transparency Mode
Configuring the DSCP Trust State on a Port Bordering Another QoS Domain
Page
Configuring a QoS Policy
Classifying Traffic by Using ACLs
Page
Page
Classifying Traffic by Using Class Maps
Page
Classifying, Policing, and Marking Traffic on Physical Ports by Using Policy Maps
Page
Page
Page
Classifying, Policing, and Marking Traffic on SVIs by Using Hierarchical Policy Maps
Page
Page
Page
Page
Page
Classifying, Policing, and Marking Traffic by Using Aggregate Policers
Page
Configuring DSCP Maps
Configuring the CoS-to-DSCP Map
Configuring the IP-Precedence-to-DSCP Map
Configuring the Policed-DSCP Map
Configuring the DSCP-to-CoS Map
Configuring the DSCP-to-DSCP-Mutation Map
Page
Configuring Ingress Queue Characteristics
Mapping DSCP or CoS Values to an Ingress Queue and Setting WTD Thresholds
Page
Allocating Buffer Space Between the Ingress Queues
Allocating Bandwidth Between the Ingress Queues
Configuring the Ingress Priority Queue
Configuring Egress Queue Characteristics
Allocating Buffer Space to and Setting WTD Thresholds for an Egress Queue-Set
Page
Mapping DSCP or CoS Values to an Egress Queue and to a Threshold ID
Configuring SRR Shaped Weights on Egress Queues
Configuring SRR Shared Weights on Egress Queues
Configuring the Egress Expedite Queue
Limiting the Bandwidth on an Egress Interface
Displaying Standard QoS Information
Page
Configuring EtherChannels and Link-State Tracking
Understanding EtherChannels
EtherChannel Overview
Port-Channel Interfaces
Port Aggregation Protocol
PAgP Modes
PAgP Interaction with Virtual Switches and Dual-Active Detection
PAgP Interaction with Other Features
Link Aggregation Control Protocol
LACP Modes
LACP Interaction with Other Features
EtherChannel On Mode
Load Balancing and Forwarding Methods
Configuring EtherChannels
Default EtherChannel Configuration
EtherChannel Configuration Guidelines
Configuring Layer 2 EtherChannels
Page
Page
Configuring EtherChannel Load Balancing
Configuring the PAgP Learn Method and Priority
Configuring LACP Hot-Standby Ports
Configuring the LACP System Priority
Configuring the LACP Port Priority
Displaying EtherChannel, PAgP, and LACP Status
Understanding Link-State Tracking
Page
34-20
Figure 34-4 Typical Link-State Tracking Configuration
Configuring Link-State Tracking
Default Link-State Tracking Configuration
There are no link-state groups defined, and link-state trac king is not enabled for any group.
Link-State Tracking Configuration Guidelines
Configuring Link-State Tracking
Displaying Link-State Tracking Status
Configuring Cisco IOS IP SLAs Operations
Understanding Cisco IOS IP SLAs
Page
Using Cisco IOS IP SLAs to Measure Network Performance
IP SLAs Responder and IP SLAs Control Protocol
Response Time Computation for IP SLAs
IP SLAs Operation Scheduling
IP SLAs Operation Threshold Monitoring
Configuring IP SLAs Operations
Default Configuration
Configuring the IP SLAs Responder
Analyzing IP Service Levels by Using the UDP Jitter Operation
Page
Page
Analyzing IP Service Levels by Using the ICMP Echo Operation
Page
Monitoring IP SLAs Operations
Page
Troubleshooting
Recovering from a Software Failure
Recovering from a Lost or Forgotten Password
Recovering from Lost Cluster Member Connectivity
Preventing Autonegotiation Mismatches
Troubleshooting Power over Ethernet Switch Ports
Disabled Port Caused by Power Loss
Disabled Port Caused by False Link Up
SFP Module Security and Identification
Monitoring SFP Module Status
Using Ping
Understanding Ping
Using Layer 2 Traceroute
Understanding Layer 2 Traceroute
Usage Guidelines
Displaying the Physical Path
Using IP Traceroute
Understanding IP Traceroute
Executing IP Traceroute
Using TDR
Understanding TDR
Running TDR and Displaying the Results
Using Debug Commands
Enabling Debugging on a Specific Feature
Enabling All-System Diagnostics
Redirecting Debug and Error Message Output
Using the show platform forward Command
36-13
Using the crashinfo Files
Basic crashinfo Files
Extended crashinfo Files
Troubleshooting Tables
Troubleshooting CPU Utilization
Possible Symptoms of High CPU Utilization
Verifying the Problem and Cause
Page
Troubleshooting Power over Ethernet (PoE)
Page
Page
Page
A
Supported MIBs
MIB List
Page
Using FTP to Access the MIB Files
Page
B
Working with the Cisco IOS File System, Configuration Files, and Software Images
Working with the Flash File System
Displaying Available File Systems
Detecting an Unsupported SD Flash Memory Card
SD Flash Memory Card LED
Setting the Default File System
Displaying Information about Files on a File System
Changing Directories and Displaying the Working Directory
Creating and Removing Directories
Copying Files
Deleting Files
Creating, Displaying, and Extracting tar Files
Creating a tar File
Displaying the Contents of a tar File
Extracting a tar File
Displaying the Contents of a File
Working with Configuration Files
Guidelines for Creating and Using Configuration Files
Configuration File Types and Location n
Creating a Configuration File By Using a Text Editor
Copying Configuration Files By Using TFTP
Preparing to Download or Upload a Configuration File B y Using TFTP
Downloading the Configuration File By Using TFTP
Uploading the Configuration File By Using TFTP
Copying Configuration Files By Using FTP
Preparing to Download or Upload a Configuration File By Using FTP
Downloading a Configuration File By Using FTP
Uploading a Configuration File By Using FTP
Copying Configuration Files By Using RCP
Preparing to Download or Upload a Configuration File By Using RCP
Downloading a Configuration File By Using RCP
Uploading a Configuration File By Using RCP
Clearing Configuration Information
Clearing the Startup Configuration File
Deleting a Stored Configuration File
Replacing and Rolling Back Configurations
Understanding Configuration Replacement and Rollback
Archiving a Configuration
Replacing a Configuration
Rolling Back a Configuration
Configuring the Configuration Archive
Performing a Configuration Replacement or Rollback Operation
Working with Software Images
Image Location on the Switch
tar File Format of Images on a Server or Cisco.com
Copying Image Files By Using TFTP
Preparing to Download or Upload an Image File By Using TFTP
Downloading an Image File By Using TFTP
Page
Uploading an Image File By Using TFTP
Copying Image Files By Using FTP
Preparing to Download or Upload an Image File By Using FTP
Downloading an Image File By Using FTP
Uploading an Image File By Using FTP
Copying Image Files By Using RCP
Preparing to Download or Upload an Image File By Using RCP
Downloading an Image File By Using RCP
Uploading an Image File By Using RCP
Page
Page
C
Unsupported Commands in Cisco IOS Release 12.2(53)EZ
Access Control Lists
Unsupported Route-Map Configuration Commands
Archive Commands
ARP Commands
Page
Interface Commands
IP SLA
MAC Address Commands
Miscellaneous
Unsupported User EXEC Commands
NetFlow Commands
Network Address Translation (NAT) Commands
QoS
RADIUS
SNMP
SNMPv3
Spanning Tree
VLAN
Page
INDEX
A
Page
B
C
Page
Page
D
Page
Page
Page
E
F
G
H
I
Page
Page
J
K
L
M
Page
Page
Page
N
O
P
Page
Page
Q
Page
R
Page
S
Page
Page
Page
Page
T
Page
U
V
Page
W
X