Force10 Networks S2410s specification

storm-control flowcontrol

202	Security Commands

Page 202

Image 202

Force10 Networks S2410s manual Storm-control flowcontrol 202 Security Commands

Contents

Sftos Command Reference for the S2410 Copyright 2008 Force10 Networks Major Changes Sftos Command Reference for the S2410, VersionOther Changes Deprecated Commands New Features Contents Using the Command Line Interface Contents Show running-config Chapter System Configuration Commands 105 127 System Log Port-securitymac-address move 166 Dhcp Server Commands Sntp Commands Chapter Igmp Snooping Commands 235 Chapter LAG/Port Channel Commands 249 Chapter Quality of Service QoS Commands 275 List of Figures 141 List of Tables Page About This Guide Objectives Audience How to Use this GuideAbout This Guide Related Documents and Sources of Additional Information Products and Services LiabilityContact Information Documentation Feedback Sftos Command Reference for the S2410, Version About This Guide Chapter Sftos Overview Sftos 2.4.1 Features Sftos Overview Ingress Rate Limiting Login Access Control Igmp Snooping Layer 2 Multicast Forwarding Sftos Overview Starting the Switch Chapter Quick Start Using the Boot Menu Press 2 and Enter quickly to access the Boot menu Boot Menu Options System Info and System SetupShow hardware Physical Port Data User Account Management Management IP Address SSH Serviceport protocol Managementethernet Address command Ip address ipaddrDefault gateway None bootp dhcp Uploading from the Switch through Xmodem Downloading to the Switch through Xmodem Downloading from a Tftp Server Using Factory DefaultsClear config Copy tftp//ip address Keyword Command Syntax ConventionsParameter Ip address ipaddr subnetmask Using the Command Line InterfaceLoc is a parameter-a placeholder for a required value Mtrace sourceipaddr destination group No Form of a Command Ipaddr Network Address SyntaxMacaddr Obtaining Help at the Command Line Keyboard Shortcuts Using Command Modes Partial Keyword Example Mode-based Topology CLI Mode Diagram Enter the ip dhcp pool Pool-name commandEnter logout or quit Enter the interface range Extended command Mode-based Command HierarchyEnter the mac access-list Enter the tacacs-server Command Prompt hostname Interface # Flow of CLI Operation Using the Web User Interface Follow these steps to bring up the switch Web UI Configuring for Web AccessTo enable Web browser access to the switch Web Page Layout Command Buttons Switch Navigation Icon in Web UI Using the Web User Interface General System Management and Information Commands This section describes the following commands None Privileged Exec System Management CommandsDir Dir Characters HostnameChange the text that appears as part of the CLI prompt Hostname hostname Interface managementethernet Interface managementethernetIp address management Syntax ip address ipaddr subnetmask None Interface ManagementEthernet Mac-addressMac-type Mac-address mac-address Management route default gateway Management route defaultManagement route default Use no management route default to remove the gateway Mtu MtuSyntax no mtu Network parms Network mac-addressNetwork mac-type Network protocol Serviceport ip ipaddr netmask gateway Serviceport ipProtocol none bootp dhcp Protocol Communicating with the switch Serviceport protocolShow arp switch Report fields include Show interface This command displays inventory information for the switchShow hardware Syntax show interface unit/slot/port Fields in Output of show interface unit/slot/port Command Show interface Unit/slot/port Show interface ethernet3965 Example of show interface ethernet switchport Output Show interface ethernet Recent reboot Address Entries Currently in Use Packets Received Packets Received Successfully Packets Transmitted Octets Packets Transmitted Successfully Statistics for this port were last cleared Show interface managementethernet Show interface managementethernetShow interface managementethernet Show interface switchport Show interface switchportShow interface switchport Fields in Output of show interface switchport Command Description unit/slot/port Show interfacesShow interfaces Port Show mac-addr-table Show loggingShow logging All S2410, If Index values areCount Show msglog Show msglog Show running-config all scriptname Show running-configEnabled Show network Show serviceport Show serviceport Show sysinfo This command displays switch informationShow sysinfo Syntax show sysinfo Show version Fields in Output of show sysinfo CommandFields in Output of show version Command Show version Show version Fields in Output of show version Command SNMP-COMMUNITY-MIB Show tech-support Show tech-support Fields in Output of show version CommandSyntax show tech-support This section describes the following Sftos Telnet commands Telnet CommandsThis command assigns the management Vlan of the switch Vlan participation management Ip telnet maxsessions Ip telnet timeoutMinutes, to the default Time is a decimal value from 1to Session-timeout Ip telnet server enableSession-limit Show telnet Telnetcon timeoutTelnet Serial baudrate Serial CommandsTelnetcon maxsessions Telnetcon maxsessions Console activity to the 5-minute default Serial timeout9600 default Show serial Show serial Fields of show serial Command Output Router Ospf Config mode Snmp Management CommandsGlobal Config mode Show serial Show snmpcommunity Show snmpcommunityShow snmptrap Syntax show snmptrap Show trapflags Show trapflags Fields of show snmptrap Command ReportFields of show trapflags Command Report Show trapflags No snmp-server community Snmp-serverSnmp-server community None Snmp-server community ipmask Snmp-server community modeSnmp-server community ipaddr Syntax snmp-server community ipaddr ipaddr name Snmp-server community ro Snmp-server enable traps bcaststormSnmp-server community rw No version of this command disables Multiple User traps Snmp-server enable traps linkmodeSnmp-server enable traps multiusers Syntax no snmp-server enable traps linkmode Snmp-server traps enable Snmp-server enable traps stpmodeSnmp-server enable trap violation This command enables the Authentication traps Snmptrap Snmptrap modeSnmptrap ipaddr Snmp trap link-status all Snmp trap link-statusSnmptrap snmpversion Snmptrap snmpversion 104 System Management Commands System Configuration Commands Sftos Command Reference for the S2410, Version 105 Bridge aging-time Configure106 System Configuration Commands Bridge aging-time Password for the command EnableModes to which the Global Config mode provides a gateway User Exec Interface range ConfigurationInterface Specified interface Range,range EthernetPort-channel Vlan Commands Available in Ethernet Range Mode 110 System Configuration Commands Bulk Configuration Warning Message Single Range Bulk Configuration Destination interface Monitor sessionBe only one destination port Mode No monitor Monitor session 1 modeSyntax no monitor session 1 mode Syntax no monitor Show forwardingdb agetime This command displays the timeout for address agingNo monitor session Show mac-address-table For 1-3965, you have the option of entering a valid Vlan ID Show mac-address-table multicastBy specifying the MAC address as an optional parameter Show mac-address-table multicast macaddr Displays the Multicast Forwarding Database Mfdb Show mac-address-table statsShow monitor session Information Show port Sftos Command Reference for the S2410, Version 117Show port Syntax show monitor session Show port all Command Output Example 118 System Configuration Commands Shutdown all Show port protocolShutdown Interface For the indicated group Virtual LAN Vlan Commands Virtual LAN Vlan commands in this section are Clear vlan Sftos Command Reference for the S2410, Version 121Clear vlan Syntax clear vlan Enter a description for the selected interface port or Vlan 122 System Configuration CommandsDescription Description Interface vlan Sftos Command Reference for the S2410, Version 123Encapsulation Vlan Interface Vlan Makestatic 124 System Configuration CommandsMakestatic Syntax makestatic Mtu Vlan Name Vlan Participation Vlan 126 System Configuration CommandsNetwork mgmtvlan Priority Vlan Group that is identified by this groupid Except when Gvrp is expected to create the VlanProtocol group Such as conf-if-range-vlan 10-20# Pvid Vlan Configure the Vlan ID for a specific port Interface VlanProtocol vlan group all Fail and the interfaces will not be added to the group Id vlanid Show vlanShow vlan brief id vlanid name port Brief Name Display 802.1Q port parameters 130 System Configuration CommandsShow vlan port Show vlan port Tagged Sftos Command Reference for the S2410, Version 131Tagged Tagged unit/slot/port Vlan 132 System Configuration CommandsUntagged Untagged Vlan ingressfilter Vlan acceptframeVlan database Vlan participation interface Vlan port acceptframe This command changes the Vlan ID for all interfacesVlan participation all Vlan port ingressfilter all Vlan port untagging all Sftos Command Reference for the S2410, Version 135Vlan port tagging all Vlan port tagging all Vlan protocol group add protocol Vlan protocol groupVlan protocol group remove Vlan tagging Sftos Command Reference for the S2410, Version 137Vlan pvid Vlan untagging Syntax clear config Clear configSystem Utility Commands Clear counters Clear igmpsnooping Clear port-channelClear traplog Copy Copy Specify a URL for the destination in this formTrap log nvramtraplog Path/filename nvramstartup-config Copy systemrunning-config nvramstartup-configNvramstartup-config and copy tftp //tftpserveripaddress Copy clibanner Copy nvramclibanner tftp//tftpserveripaddress/filepath Enable passwdNo clibanner command removes the CLI banner Tftpserveripaddress Quit Enable passwd passwordLogout Quit Show terminal length PingReload Reload Lines Use Exec or Privileged Exec Terminal lengthTraceroute Destination through the network on a hop-by-hop basis Write Configuration ScriptingCommands in this section are Functionality of this Script list Script applyScript delete Present Script validate Format of display is Line no Line contentsScript show Script file Logging buffered Sftos Command Reference for the S2410, Version 149Syntax logging buffered severitylevel No logging cli-command Logging cli-commandCommands issued on the system Logging buffered wrap Logging console Logging host Logging host remove Logging host reconfigureThis command removes the identified host Logging persistent Logging syslog Use no logging syslog to disable syslog loggingDisabled local0 Logging syslog Show logging buffered This command displays buffered logging the System logShow logging buffered Show logging buffered Unit variable is the host index This command displays configured logging hostsShow logging hosts Show logging hosts unit Show logging traplogs Show logging traplogsShow logging traplogs 156 System Log Clear pass Sftos Command Reference for the S2410, Version 157Syntax clear pass Disconnect Show loginsessionLogin Session ID Show users Username passwd Users snmpv3 authentication Users snmpv3 accessmodeUsers snmpv3 encryption No encryption Sftos Command Reference for the S2410, Version 161Associated with the specified encryption Users snmpv3 encryption Users snmpv3 encryption 162 User Account Commands This section contains the following commands Sftos Command Reference for the S2410, Version 163 Port-security max-dynamic 164 Security CommandsPort-security Port-security Port-security mac-address Sftos Command Reference for the S2410, Version 165Port-security max-static Port-security max-static Port-security mac-address move Show port-security MAC Address MAC address of the dynamically locked MAC Sftos Command Reference for the S2410, Version 167Show port-security dynamic Show port-security dynamic MAC Address-MAC Address of statically locked MAC Show port-security staticShow port-security violation Locked port No authentication login listname Authentication loginAuthentication login Sftos Command Reference for the S2410, Version 169 Clear radius statistics Dot1x defaultloginClear dot1x statistics Clear dot1x statistics unit/slot/port all Dot1x initialize Dot1x loginBe a configured authentication login list Dot1x max-req Dot1x port-control force-unauthorized force-authorized auto Dot1x port-controlDot1x port-control all Auto Unauthorized Dot1x re-authenticateDot1x re-authentication Authorized Dot1x system-auth-control Dot1x timeoutSwitch Can be changed, but is not activated Dot1x user Show authenticationSftos Command Reference for the S2410, Version 175 Dot1x user User column Show authentication usersShow dot1x Displayed Sftos Command Reference for the S2410, Version 177 Show dot1x Example of Output from the show dot1x detail Command 178 Security Commands Show dot1x users Show users authenticationShow users authentication Show dot1x users unit/slot/port Users will be authenticated using local authentication only Users defaultloginUsers login Accidental lockout from the switch Value i.e. the Radius accounting function is disabled Radius accounting modeRadius server host Radius server key Authentication server182 Security Commands Radius server key Radius server primary Previously configured Radius authentication serverRadius server msgauth Radius server retransmit Radius server timeout Show radius Show radius accounting statistics Radius Accounting ModeShow radius accounting statistics Show radius accounting statistics IP address Radius Accounting Server Show radius statistics authentication186 Security Commands Otherwise all the following listed fields are displayed Show radius statistics authentication Sftos Command Reference for the S2410, Version 187 Tacacs-server key Not configuredTacacs-server host To delete a key, use the no tacacs-server key key To restore the default, enter no tacacs-server timeout Tacacs-server timeoutSpecify a global timeout value for all TACACS+ hosts Seconds Global Config Specify a server port number for a particular Tacacs host PortPriority Priority priority Single-connection TimeoutSpecify the timeout value for a particular Tacacs host Show tacacs Ip ssh maxsessions 192 Security CommandsIp ssh maxsessions Ip ssh maxsessions Disabled Global Config Ip ssh server enableEnable SSH No version of this command disables SSH Ip ssh protocol Show ip ssh Ip ssh timeoutThis command displays the SSH settings Report fields Sshcon maxsessions Sshcon timeoutSftos Command Reference for the S2410, Version 195 Sshcon maxsessions SSL3 and TLS1 Global Config Ip http javamode enableThis command is used to set the Sslt port Ip http secure-port No ip http secure-server enable disabled Ip http secure-server enableIp http server enable No ip http server enable Show ip http Show ip httpShow ip http Show storm-control This command displays switch configuration informationShow storm-control Show storm-control unit/slot/port all Storm-control flowcontrol This command enables 802.3x flow control for the switchStorm-control broadcast No storm-control broadcast Sftos Command Reference for the S2410, Version 201 Storm-control flowcontrol Storm-control flowcontrol 202 Security Commands Dhcp Server Commands Sftos Command Reference for the S2410, Version 203 Clear ip dhcp binding BootfileMode Dhcp Pool Config Clear ip dhcp server statistics Client-identifier Clear ip dhcp conflictClient-name Dns-server Default-routerDomain-name From 0 to 255. IP address 0.0.0.0 is invalid Hardware-addressHost Prefix-length is an integer from 0 to Ip dhcp conflict logging Ip dhcp bootp automaticIp dhcp excluded-address Ip dhcp pool Ip dhcp ping packetsLease Netbios-node-type Netbios-name-serverNetwork Next-server Option Show ip dhcp binding Service dhcpService dhcp No option code Show ip dhcp global configuration Show ip dhcp global configurationShow ip dhcp pool configuration Show ip dhcp pool configuration name all Show ip dhcp conflict This command displays Dhcp server statisticsShow ip dhcp server statistics Specified, all the conflicting addresses are displayed Sntp broadcast client poll-interval Where poll-interval can be a value from 6 toSftos Command Reference for the S2410, Version 215 Sntp broadcast client poll-interval poll-interval Sntp client port Sntp client modeThis command sets the Sntp client port ID to a value from Processed Sntp unicast client poll-interval Sntp unicast client poll-timeoutSntp unicast client poll-retry Show sntp This command is used to display Sntp settings and statusSntp server Sntp servers Show sntp client This command is used to display Sntp client settingsSftos Command Reference for the S2410, Version 219 Show sntp client Show sntp server For each configured server220 Sntp Commands Show sntp server Dvlan-tunnel ethertype 802.1Q vman custom Sftos Command Reference for the S2410, Version 221Dvlan-tunnel ethertype Vman Interface. By default, Double Vlan Tunneling is disabled Mode dot1q-tunnelMode dvlan-tunnel Interface Config Show dot1q-tunnel Sftos Command Reference for the S2410, Version 223Show dot1q-tunnel interface unit/slot/port all Show dvlan-tunnel 224 VLAN-Stack CommandsShow dvlan-tunnel Show dvlan-tunnel interface unit/slot/port all Commands in this sections are Set garp timer joinGarp Commands Sftos Command Reference for the S2410, Version 225 Set garp timer join No set garp timer join Set garp timer leaveSet garp timer leave Syntax set garp timer leave Show garp Set garp timer leaveallSyntax set garp timer leaveall Show garp Garp Vlan Registration Protocol Gvrp Commands Gvrp adminmode enableGvrp interfacemode enable This command enables Gvrp globally Show gvrp configuration Gvrp interfacemode enable allSet gvrp adminmode Set gvrp interfacemode Show gvrp configuration 230 GARP, GVRP, and Gmrp Commands Gmrp adminmode Gmrp adminmodeGarp Multicast Registration Protocol Gmrp Commands Syntax gmrp adminmode enable Changed to gmrp adminmode Set gmrp adminmodeGmrp interfacemode enable all Gmrp interfacemode enable all Set gmrp interfacemode all Show gmrp configurationSet gmrp interfacemode One or all interfaces Multicast Forwarding Database Mfdb table 234 GARP, GVRP, and Gmrp CommandsShow mac-address-table gmrp Show mac-address-table gmrp Igmp Snooping Commands Sftos Command Reference for the S2410, Version 235 Disabled Interface Config Interface Vlan Igmp enable interfaceIgmp enable global Revised from set igmp. Added Interface Vlan mode Entry Igmp fast-leave interfaceIgmp groupmembership-interval interface To 3600 seconds No igmp interfacemode enable all Igmp interfacemode enable allIgmp interfacemode enable all 238 Igmp Snooping Commands Igmp maxresponse Mode and Interface Vlan modeIgmp mcrtexpiretime interface No igmp mcrtexpiretime Igmp mrouter interface Igmp mrouter interface enableNo igmp mrouter interface enable No igmp mrouter vlanId Set igmp fast-leave Set igmp interfaceSet igmp system Set igmp groupmembership-interval global Set igmp groupmembership-interval interface Version 2.3 Revised to igmp mrouter interface enable242 Igmp Snooping Commands Set igmp interfacemode all Set igmp maxresponse interface Sftos Command Reference for the S2410, Version 243Set igmp maxresponse global Set igmp maxresponse global Set igmp mcrtexpiretime interface 244 Igmp Snooping CommandsSet igmp mcrtexpiretime global Set igmp mcrtexpiretime global Revised to igmp mrouter Set igmp mrouterShow igmpsnooping Show igmpsnooping unit/slot/port Unit/slot/port Show igmpsnooping mrouter interface unit/slot/port vlan Show igmpsnooping fast-leaveShow igmpsnooping mrouter interface Vlan Show mac-address-table igmpsnooping Sftos Command Reference for the S2410, Version 247Show mac-address-table igmpsnooping Syntax show mac-address-table igmpsnoopingPage Sftos Command Reference for the S2410, Version 249 Addport 250 LAG/Port Channel Commands Deleteport interface configDeleteport interface config Addport unit/slot/port Deleteport unit/slot/port all Deleteport global configPort-channel No port-channel name Port-channel enable interface Port-channel enable all globalPort-channel linktrap Port-channel name This command renames a LAG port channel or all LAGsAll configured LAGs Port-channel staticcapability Port lacptimeout global Port lacpmode enable allPort lacpmode Interface Config Interface Range Port lacptimeout interfaceShow port-channel brief Syntax show port-channel brief Show port-channelFor each LAG, the following information is displayed Show port-channel Lagid all Port channel/LAG Summary Sftos Command Reference for the S2410, Version 257Show port-channel summary Show port-channel summary 258 LAG/Port Channel Commands This command disables the selected LAG port channelNo version of this command enables the selected LAG Shutdown Sftos Command Reference for the S2410, Version 259 Are displayed 260 Spanning Tree STP CommandsShow spanning-tree Show spanning-tree Show spanning-tree interface Following details are displayed on execution of the commandShow spanning-tree interface unit/slot/port Show spanning-tree mst port detailed 262 Spanning Tree STP CommandsShow spanning-tree mst detailed Show spanning-tree mst detailed Sftos Command Reference for the S2410, Version 263 Show spanning-tree mst port detailed Show spanning-tree mst summary Switch. On execution, the following details are displayedShow spanning-tree mst port summary For each Mstid Show spanning-tree vlan Details are displayed on execution of the commandShow spanning-tree summary Spanning-tree No spanning-tree configuration name name Spanning-tree configuration nameSpanning-tree configuration revision Spanning-tree bpdumigrationcheck Spanning-tree forceversion Spanning-tree configuration revisionSpanning-tree edgeport Words Spanning-tree hello-time Internal spanning tree to the default value, in other wordsSpanning-tree forward-time Value being greater than or equal to Bridge Max Age / 2 + Spanning-tree mst Spanning-tree max-ageSpanning-tree max-hops Syntax spanning-tree max-age No spanning-tree max-age No spanning-tree mst Cost auto external-cost auto port-priorty Interface Config270 Spanning Tree STP Commands No spanning-tree mst Maximum number of multiple instances supported by Sftos is Spanning-tree mst instanceSpanning-tree mst priority Multiple spanning tree instance to be removed Spanning-tree mst vlan mstid vlanid Spanning-tree port mode enableSpanning-tree mst vlan No spanning-tree mst vlan mstid vlanid No spanning-tree port mode enable Spanning-tree port mode enable allSpanning-tree port mode enable all No spanning-tree port mode enable allPage Class of Service CoS Commands Sftos Command Reference for the S2410, Version 275 Classofservice dot1p-mapping userpriority trafficclass Classofservice dot1p-mappingNo form of this command is not supported Userpriority range is Cos-queue max-bandwidth Classofservice trustClassofservice trust dot1p Syntax no cos-queue max-bandwidth bw-0…bw-3 Up to four in the S2410 Cos-queue min-bandwidthCos-queue random-detect Operation for the specified queues Cos-queue strict Random-detect exponential-weighting-constantRandom-detect exponential-weighting-constant commands Four in the S2410 Random-detect queue-parms 280 Quality of Service QoS CommandsRandom-detect queue-parms Queue-id-1 queue-id-2 System-wide port trust mode used for all interfaces Show classofservice dot1p-mappingShow classofservice trust For a specific interface Show interfaces random-detect Settings are displayedShow interfaces cos-queue Report Fields Non-IP Traffic Show interfaces tail-drop-threshold Sftos Command Reference for the S2410, Version 283Show interfaces tail-drop-threshold Syntax show interfaces random-detect slot/port Tail-drop queue-parms Global Config and Interface Config284 Quality of Service QoS Commands Tail-drop queue-parms Provisioning Ieee 802.1p Commands Classofservice dot1pmappingDifferentiated Services DiffServ Commands Traffic-shape Vlan port priority all Show classofservice dot1pmappingConfiguration will override this configuration setting Vlan priority This chapter covers the following commands Sftos Command Reference for the S2410, Version 287 Any bpdu Ibmsna, ipv4, ipv6, ipx, mplsmcast, mplsucast, netbiosDenypermit Vlan eq Assign-queue Secondary-vlanSecondary-cos Redirect Mac access-list extended name Mac access-list extendedMac Access List Config Access-list extended command Sftos Command Reference for the S2410, Version 291 Mac access-list extended renameMac access-list extended rename name newname Newname Mac access-group name 1-4294967295in Mac access-groupShow mac access-lists Show mac access-lists name Show mac access-lists Sftos Command Reference for the S2410, Version 293 Show mac access-lists 294 ACL Commands Sftos Command Reference for the S2410, Version 295 Index Copy 37-38 296 Index Sftos Command Reference for the S2410, Version 297 Html Http 298 Index Sftos Command Reference for the S2410, Version 299 PDUs 225 Show inventory 114-116, 119, 169, 227, 229 300 Index Sftos Command Reference for the S2410, Version 301 Show sysinfo 83, 222 75-77 302 Index Sftos Command Reference for the S2410, Version 303 Gvrp IDs 134 304 Index