Security Commands | NETGEAR 7300S guide

User Manual for the NETGEAR 7300S Series Layer 3 Managed Switch Software

9-26	Security Commands

202-10088-01, March 2005

Image 234

NETGEAR 7300S manual Security Commands

Contents

202-10088-01, March Technical Support Canadian Department of Communications Compliance Statement 202-10088-01, March Contents Chapter Command Line Interface Structure 202-10088-01, March 202-10088-01, March 202-10088-01, March 202-10088-01, March Pre-login Banner System Log Syslog User Account Commands 202-10088-01, March 100 202-10088-01, March 202-10088-01, March Chapter Security Commands 202-10088-01, March 202-10088-01, March Chapter Routing Commands Xxii 202-10088-01, March Chapter Quality of Service QoS Commands 202-10088-01, March 202-10088-01, March Chapter Managing Switch Stacks Appendix a Is CLI Mapping Appendix B Cabling Guidelines Contents Xxx Contents Why the Document was Created How to Use This DocumentAudience Typographical Conventions Special Message Formats About This Guide About This Guide Switch Management Overview Scope Comparing Switch Management Methods Chapter Administration Console Interface Set Up Your Switch Using Direct Console Access Connection Description Connection Settings Administration Console Interface Chapter Web-Based Management Interface How to Log In to the Managed Switch Web Based Management Overview Login window opens Web-Based Management Utility Features System Information Interactive Switch Image Interactive switch image Menus Main Menus Switch Secondary MenusManagement Traffic Management System-Wide Popup MenusRouting Smart Wizard Port-Specific Popup Menus Web-Based Management Interface CLI Command Format Command Parameters Values Conventions Macaddr Annotations Quick Starting the Switch Chapter Quick Start up System Info and System Setup Quick Start up Software Version InformationQuick Start up Physical Port Data Quick Start up User Account Management Quick Start up IP Address Quick Start-up IP Address Using Switch as Layer-2 Device Quick Start up Uploading from Switch to Out-of-Band PC Only Quick Start-up IP Address Using Switch as Layer-3 Device Quick Start up Factory Defaults Quick Start up Downloading from Tftp Server Quick Start up Factory Defaults Quick Start up Chapter Mode-based CLI Enter the ip dhcp pool Mode-based Topology Correct Mode-based Command Hierarchy Command prompt shown at this level is Figuration mode to configure the QoS policy map Flow of Operation Invalid input detected at ‘’ marker No Form of a Command Behavior of Command Help ?Support for No Form Mode-based CLI Chapter Switching Commands System Information and Statistics Commands Show arp switch Show eventlogShow hardware Show interface Show interface ethernet Packets Received Packets Received with MAC Errors Packets Received Successfully Received Packets not forwarded Packets Transmitted Octets Transmit Errors Packets Transmitted SuccessfullyTransmit Discards Protocol Statistics Dot1x Statistics Switching Commands Show logging Show mac-addr-table Show running-config Show msglog System Management Commands Show sysinfoSnmp-server Telnet Transport input telnetNo transport input telnet Session-timeout Transport output telnetSession-limit Seconds No session-timeoutBridge aging-time No bridge aging-time Network mac-address MtuNetwork javamode No mtu Network mac-type Network parmsNo network mac-type Telnetcon maxsessions Telnetcon timeoutNetwork protocol No telnetcon maxsessions No serial timeout Serial timeoutNo telnetcon timeout Serial baudrate Set prompt Serviceport ipServiceport protocol Show telnet Show forwardingdb agetime Show network Java Mode Format ModeShow telnetcon Show serviceport Show serial Client IP Address Snmp Community CommandsShow snmpcommunity Client IP Mask Show snmptrap Show trapflags Snmp-server community No snmp-server community No snmp-server community ipaddr Snmp-server community ipaddrSnmp-server community ipmask No snmp-server community ipmask Snmp-server community ro Snmp-server community modeNo snmp-server community mode Snmp-server community rw Snmp-server enable traps linkmode Snmp-server enable trapsSnmp-server enable traps bcaststorm No snmp-server enable traps No snmp-server enable traps linkmode Snmp-server enable traps multiusersSnmp-server enable traps stpmode No snmp-server enable traps stpmode Snmptrap Snmptrap modeNo snmptrap mode Snmptrap ipaddr No snmp trap link-status Snmp trap link-statusSnmp trap link-status all No snmp trap link-status all Network mgmtvlan Management Vlan CommandSystem Configuration Commands Addport Auto-negotiate all Deleteport Interface ConfigDeleteport Global Config No auto-negotiate Macfilter Macfilter adddestNo macfilter No macfilter adddest Macfilter adddest allMacfilter addsrc No macfilter adddest all No macfilter addsrc Macfilter addsrc allMonitor session No macfilter addsrc all Shutdown Monitor session modeNo monitor session mode No monitor session No shutdown Shutdown allSpeed all 100f 10h 10f 100f Storm-control broadcast100h No storm-control broadcast Storm-control flowcontrol Show mac-address-table multicastNo storm-control flowcontrol Show mac-address-table static Show mac-address-table staticfiltering Show mac-address-table stats Show monitorShow port Show port protocol Vlan Virtual LAN Vlan CommandsShow storm-control No vlan No vlan acceptframe Vlan acceptframeVlan ingressfilter No vlan ingressfilter Vlan participation Vlan makestaticVlan name No vlan name Exclude Vlan participation allVlan port acceptframe all Auto No vlan port acceptframe all Vlan port ingressfilter allVlan port pvid all No vlan port ingressfilter all Vlan protocol group add protocol Vlan port tagging allVlan protocol group No vlan port tagging all No vlan protocol group add protocol Vlan protocol group removeProtocol group No protocol group No protocol vlan group Protocol vlan groupProtocol vlan group all No protocol vlan group all Show vlan Vlan pvidVlan tagging No vlan pvid Vlan Type ConfiguredVlan Name Current Show vlan brief Show vlan portPort Vlan ID System Utility Commands TracerouteIngress Filtering Clear counters Clear configEnable passwd Clear igmpsnooping Clear vlan Clear port-channelClear traplog Logout Copy PingReload Formatreload Pre-login Banner Logging cli-command CLI Command LoggingConfiguration Scripting No logging cli-command Format Configscript list Configscript applyConfigscript delete Configscript show Configscript validate System Log Syslog Logging console Logging bufferedLogging buffered wrap No logging buffered No logging console Logging historyLogging host No logging history Logging syslog Logging host removeLogging port No logging port Show logging history Client Local Port Show logging hosts Admin StatusShow logging buffered Severity Level Filter Sntp broadcast client poll-interval Sntp client modeSimple Network Time Protocol Sntp Host Status Sntp unicast client poll-interval Sntp client modeSntp client port No sntp client port Sntp unicast client poll-retry Sntp unicast client poll-timeoutNo sntp unicast client poll-timeout Sntp multicast client poll-interval Sntp server Show sntp Show sntp client Show sntp server User Account Commands Show loginsessionDisconnect Idle Time Show usersConnection From Session Time No users name Users nameUsers passwd No users passwd No users snmpv3 accessmode Users snmpv3 accessmodeUsers snmpv3 authentication No users snmpv3 authentication Dhcp Server Commands Users snmpv3 encryptionNo users snmpv3 encryption No client-identifier Client-identifierClient-name No client-name Dns-server Default-routerNo default-router Hardware-address No hardware-address HostIp dhcp excluded-address No host Ip dhcp pool DefaultnoneIp dhcp ping packets No ip dhcp excluded-address No ip dhcp pool LeaseNetwork No lease No service dhcp Service dhcpBootfile No bootfile Domain-name Ip dhcp bootp automaticNo ip dhcp bootp automatic Ip dhcp conflict logging No netbios-name-server Netbios-name-serverNetbios-node-type No ip dhcp conflict logging Option No netbios-node-typeNext-server No next-server Show ip dhcp global configuration Show ip dhcp bindingNo option Show ip dhcp pool configuration Show ip dhcp server statistics Show ip dhcp conflict Clear ip dhcp server statistics Provisioning Ieee 802.1p CommandsClear ip dhcp binding Clear ip dhcp conflict Vlan port priority all Classofservice dot1pmappingShow classofservice dot1pmapping Vlan priority Garp Commands Set garp timer joinNo set garp timer join No set garp timer join all Set garp timer join allSet garp timer leave No set garp timer leave No set garp timer leave all Set garp timer leave allSet garp timer leaveall No set garp timer leaveall Gmrp Admin Mode Set garp timer leaveall allNo set garp timer leaveall all Gvrp Admin Mode No set gvrp adminmode Garp Vlan Registration Protocol Gvrp CommandsSet gvrp adminmode Set gvrp interfacemode Show gvrp configuration Set gvrp interfacemode all Port Gmrp Mode Garp Multicast Registration Protocol Gmrp CommandsSet gmrp adminmode No set gmrp adminmode No set gmrp interfacemode Set gmrp interfacemodeSet gmrp interfacemode all No set gmrp interfacemode all Show gmrp configuration Show mac-address-table gmrp Internet Group Management Protocol Igmp Commands Set igmp Set igmp groupmembership-interval No set igmpNo set igmp groupmembership-interval No set igmp interfacemode all Set igmp interfacemode allSet igmp maxresponse No set igmp maxresponse Show igmpsnooping Format Mode Admin ModeSet igmp mcrtrexpiretime No set igmp mcrtrexpiretime Igmp Snooping per Vlan Show mac-address-table igmpsnooping Set igmp groupmembershipinterval No set igmp groupmembershipinterval Set igmp mcrtexpiretime Set igmp fast-leaveNo set igmp mcrtexpiretime No set igmp fast-leave Link Aggregation LAG/Port-Channel 802.3AD Commands Fast Leave ModePort-channel staticcapability No port-channel staticcapability Port lacpmodePort lacpmode all No port lacpmode Port-channel Port-channel adminmode allNo port-channel adminmode Port-channel linktrap Port-channel name Show port-channel brief Show port-channel Spanning-tree Spanning Tree STP CommandsSpanning-tree max-hops No spanning-tree max-hops No spanning-tree configuration name Spanning-tree configuration nameSpanning-tree configuration revision No spanning-tree Spanning-tree forceversion No spanning-tree configuration revisionSpanning-tree edgeport No spanning-tree edgeport No spanning-tree forceversion Spanning-tree forward-timeSpanning-tree hello-time No spanning-tree forward-time Spanning-tree max-age Spanning-tree mstNo spanning-tree max-age Cost auto external-cost auto port-priorty No spanning-tree mst No spanning-tree mst instance Spanning-tree mst instanceSpanning-tree mst priority No spanning-tree mst priority Spanning-tree mst vlan Spanning-tree port modeNo spanning-tree port mode No spanning-tree mst vlan Spanning-tree port mode all Spanning-tree bpdumigrationcheck Show spanning-tree Port mode Show spanning-tree interface Show spanning-tree mst detailed Show spanning-tree mst port detailed Port Role Port PriorityPort Forwarding State Port Path Cost CST Regional Root Show spanning-tree mst port summaryShow spanning-tree mst summary CST Port Cost Show spanning-tree summary Show spanning-tree vlan Switching Commands 133 Mode Topology Change Designated Root Root Path CostRoot Port Identifier Root Port Max Age CST Regional Root Regional Root Path Cost Root Port Bridge Forward Delay Derived valueBridge Forward Delay Bridge Identifier Bridge Max Age Mstp BPDUs Transmitted Mstp BPDUs Received STP BPDUs TransmittedRST BPDUs Transmitted MST Instance ID Port Identifier Port Priority Configured value indicating if this port is an edge port Port Security Port-securityNo port-security No port-security max-dynamic Port-security max-dynamicPort-security max-static No port-security max-static Port-security mac-address Snmp-server enable traps violationNo snmp-server enable traps violation Port-security mac-address move Show port-security Show port-security dynamicShow port-security static Port Based Network Access Control Ieee 802.1X Commands Authentication loginShow port-security violation Clear dot1x statistics Dot1x defaultloginNo authentication login Clear radius statistics Dot1x max-req Dot1x loginDot1x initialize No dot1x max-req Dot1x port-control Dot1x port-control AllNo dot1x port-control No dot1x re-authentication Dot1x re-authenticateDot1x re-authentication Dot1x system-auth-control Dot1x timeout No dot1x system-auth-control Show radius accounting No dot1x timeoutDot1x user No dot1x user Show authentication Method Show authentication usersShow dot1x User Server Timeout Control ModeSupplicant Timeout Protocol Version Control Direction Users login Show users authenticationUsers defaultlogin Show dot1x users No radius accounting mode Remote Authentication Dial In User Service Radius CommandsRadius accounting mode Radius server host No radius server host Radius server msgauth Default10Radius server key Radius server primary Show radius Radius server timeoutNo radius server timeout No radius server retransmit Show radius statistics Access Rejects Secure Shell SSH CommandsAccess Accepts Access Challenges Hypertext Transfer Protocol Http Commands Ip ssh protocolShow ip ssh Ip http secure-server Ip http secure-portIp http secure-protocol No ip http secure-port Show ip http Http ModeIp http server No ip http server Security Commands Address Resolution Protocol ARP Commands ArpNo arp No ip proxy-arp Ip proxy-arpArp cachesize No arp cachesize Arp resptime Arp dynamicrenewArp purge No arp dynamicrenew Arp retries Arp timeoutNo arp timeout Clear arp-cache Retries Show arpAge Time seconds Cache Size IP Routing Show arp briefRouting No routing Ip routingIp address No ip routing No ip address Ip route defaultIp route No ip route Ip route distance No ip route defaultDefaultenabled Ip forwarding No ip forwarding Ip netdirbcastIp mtu No ip netdirbcast Show ip brief Show ip interface Show ip interface brief Show ip route Protocol Show ip route bestroutesShow ip route entry Next Hop Intf Next Hop Interface Show ip route preferencesShow ip stats Preference No bootpdhcprelay cidoptmode Bootp/DHCP Relay CommandsBootpdhcprelay cidoptmode Encapsulation Bootpdhcprelay enable Bootpdhcprelay maxhopcountBootpdhcprelay minwaittime Bootpdhcprelay serverip Show bootpdhcprelay Ip irdp address Router Discovery Protocol CommandsIp irdp No ip irdp No ip irdp address Ip irdp holdtimeIp irdp maxadvertinterval No ip irdp holdtime Show ip irdp Ip irdp minadvertintervalIp irdp preference No ip irdp minadvertinterval Virtual LAN Routing Commands Vlan routing Show ip vlan Routing Information Protocol RIP CommandsEnable RIP Logical Interface Default-information originate RIP Ip ripAuto-summary No default-metric RIP Default-metric RIPNo default-information originate RIP Distance rip Distribute-list out Ip rip authenticationNo default-information originate No distribute-list out Ip rip send version No ip rip authenticationIp rip receive version No ip rip receive version No ip rip send version HostroutesacceptSplit-horizon No hostroutesaccept Format for other source protocol RedistributeShow ip rip No redistribute Send Version RIP ModeShow ip rip interface brief Receive Version Show ip rip interface Access Control List ACL Commands Mac access-list extended name Mac access-list extended rename name newname No mac access-list extended nameDenypermit srcmac srcmacmask dstmac dstmacmask Mac access-group name inout sequence Show mac access-list name Show mac access-listsNo mac access-group name inout Access-list Ip access-group Ip access-group allShow ip access-lists Differentiated Services DiffServ Commands Source IP MaskDestination IP Mask Diffserv No diffserv Class CommandsService Levels Traffic Classification No class-map Match secondary-cos Class-map renameMatch ethertype Match secondary-vlan Match any Match class-map Match cos Match destination-address mac Match dstip Match dstl4port Match ip dscp Match ip precedence Match ip tos Match protocol Match source-address mac Match srcipMatch srcl4port Policy Commands Match vlan Assign-queue DropMark secondary-cos Bandwidth kbps RedirectConform-color Policy Type Incompatibilities Bandwidth percentClass Expedite kbps Expedite percent Mark cos Policy Type Mark ip-dscp Policy Type Incompatibilities Mark ip-precedencePolice-simple Police-single-rate Police-two-rate Policy-map Policy-map renameRandomdrop Shape average Shape peak Service Commands Service-policy Show Commands No service-policy Class Type Show class-mapClass Name Match Criteria Show diffserv Show policy-map Conform COSAssign Queue Mark IP Precedence Policy NameMark IP Dscp Policing Style Exceed Action BandwidthShaping Average Direction Show diffserv serviceClass Members Operational Status Policy Details Show diffserv service briefDiffServ Mode OperStatus 11-38 Quality of Service QoS Commands Dir Show service-policySent Octets/Packets Offered Packets Class of Service CoS Commands Classofservice dot1p-mappingClassofservice ip-dscp-mapping No classofservice trust Classofservice ip-precedence-mappingClassofservice trust Cos-queue max-bandwidth Cos-queue random-detect No cos-queue max-bandwidthCos-queue min-bandwidth No cos-queue min-bandwidth No cos-queue strict Cos-queue strictRandom-detect No random-detect Tail-drop queue-parms Random-detect exponential-weighting-constantRandom-detect queue-parms No random-detect queue-parms Show classofservice dot1p-mapping Traffic-shape Show classofservice ip-precedence-mapping Show classofservice trustShow interfaces cos-queue Show interfaces random-detect Show interfaces tail-drop-threshold Fig indication Drop precedence level for this queue, from 1 to p. The spe 11-50 Quality of Service QoS Commands Chapter Managing Switch Stacks Understanding Switch Stacks Switch Stack Membership Managing Switch Stacks 12-3 Interconnect Ports 51 As shown Stack Master Election and Re-Election Stack Member Numbers Switch Stack Offline Configuration Stack Member Priority Values Managing Switch Stacks 12-7 Switch Stack Software Compatibility Recommendations Incompatible Software and Stack Member Image UpgradesSwitch Stack Configuration Files Connectivity to the Switch Stack Through Console Ports Switch Stack Management ConnectivitySwitch Stack Configuration Scenarios Connectivity to the Switch Stack Through Telnet Stacking Recommendations Initial installation and Power-up of a Stack General Practices Removing a Unit from the Stack Adding a Unit to an Operating StackReplacing a Stack Member with a New Unit Renumbering Stack Members Moving a Master to a Different Unit in the Stack Removing a Master Unit from an Operating StackMerging Two Operational Stacks Preconfiguration Upgrading Firmware Migration of Configuration With a Firmware Upgrade Code Mismatch Appendix a Is CLI Mapping Config acl rule action aclid Rulenum permit/deny Exec Is CLI Mapping Config diffserv policy police style Policy-Cla Police-simple Is CLI Mapping Show diffserv class summary Privileged Exec User Class-Ma Match not cos Config Class-Ma Match not ip precedence Config Routing Show arp switch Privileged Is CLI Mapping Is CLI Mapping Vlan Router No enable Is CLI Mapping Is CLI Mapping Config Router No auto-summary Router No split-horizon 7300S Series L3 Switch CLI Command Mode Syntax Config snmptrap ipaddr Global Config telnet maxsessions Privileged Remotecon maxsessions Is CLI Mapping Global No spanning-tree configuration name Config Config spanningtree bridge priority Removed 61440 Interface No spanning-tree mst mstid cost Config Config syslocation location Global Snmp-server location loc Transfer download path path Show loginsession Privileged Show vlan summary Privileged Show vlan brief Exec User Show mfdb gmrp Privileged Show mac-address-table gmrp Config lag create name Global Port-channel name Global Deleteport logical slot/port all Config Is CLI Mapping Config protocol vlan add groupid Privileged No set gvrp adminmode Is CLI Mapping Security Show users authentication Privileged Is CLI Mapping Security Show radius server summary Privileged Is CLI Mapping All detail slot/port statistics Is CLI Mapping Appendix B Cabling Guidelines Fast Ethernet Cable Guidelines Category 5 Cable Specifications Category 5 Cable Specifications Category 5 Cable Requirements Twisted Pair Cables Patch Panels and Cables 4illustrates crossover twisted pair cable Length Using 1000BASE-T Gigabit Ethernet over Category 5 CableCabling Return Loss RJ-45 Plug and RJ-45 Connectors Near End Cross Talk NextPatch Cables PIN Normal Assignment on Uplink Assignment on Ports 1 to Conclusion Appendix C Glossary Numeric See Area Border Router on See Autonomous System Boundary Router on Packet sent to all devices on a network See Command Line Interface on See Differentiated Services on Computer, printer, or server that is connected to a network See Generic Attribute Registration Protocol on See Garp Multicast Registration Protocol on Internet Control Message Protocol See Local Area Network on Megabits per second See Multi-Protocol Label Switching on See Multiplexing on See Open Systems Interconnection on Set of rules for communication between devices on a network See Routing Information Protocol on See Resource Reservation Setup Protocol on See Simple Network Management Protocol on See TLS on See Virtual Local Area Network on Wins